IR 05000321/1988012

Insp Repts 50-321/88-12 & 50-366/88-12 on 880502-10. Deficiencies Noted.Major Areas Inspected:Emergency Operating Procedures,Including QA Measures,Quality of Control Room Drawings & Evaluation of Containment Venting Provisions

ML20151C180
Person / Time
Site:	Hatch
Issue date:	06/24/1988
From:	Florek D, Gallo R NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II)
To:
Shared Package
ML20151C170	List: IR 05000321/1988012 ML20151C165
References
50-321-88-12, 50-366-88-12, NUDOCS 8807210250
Download: ML20151C180 (38)

Text

% UNITED STATES

[P Ricoq'o,'

NUCLEAR REGULATORY COMMISslON 83- , R EGION 11 k*'- 101 MARIETTA STREET. 's ATLANTA, GEORGI A 30323

% .%> ....

}

U.S. NUCLEAR REGULATORY COMMISSION

REGION I

Report Nos.: 50-321/88-12 and 50-366/88-12 Licensee: Georgia Power Company P.O. Box 4545 Atlanta, GA 30302 Docket Nos.: 50-321 and 50-366 License Nos.: DPR-57 and NPF-5 Facility Name: Plant Hatch Inspection Dates: May 2-10, 1988 Inspection At: Hatch site near Baxley, Georgia Team Members: R. Evans, Reactor Engineer, Region IV W. Hansen, Consultant, NRC R. Musser, Resident Inspector, Plant Hatch C. Sisco, Operations Engineer, Region I A. Sutthoff, Human Factors Specialist Team Leader: M he D. J. Florek, SrU, OperationV Engineer * Date Division of Reactor Safety, Region I Approved by: 1

'

R. M. Gallo, Chief] Operations / Branch Date Division of Reactd'r Safety, Rdgion I Inspection SunTnary: Inspection on May 2-10, 1988 (Report No. 50-321/88-12 and 50-366/88-12)

Areas Inspected: Special announced team inspection of the Emergency Operating Procedures (E6Fs) to include a comparison of the E0Ps with the BWR Owners Group Emergency Procedure Guidelines and the Plant Specific Technical Guidelines for technical adequacy, reviews of the E0Ps through control room and plant walkdowns, evaluation of the E0Ps on the plant simulator, human factor analysis of the E0Ps, E0P training, on-going evaluation program for E0Ps, QA measures, quality of the control room drawings and an evaluation of the containment venting provision Results: See Executisc Smary in i epor PDR ADOCK 05000321 0 PDC

_ _ _ _ ._ _ __ _ - _ _ _ _ _ _ . _ _ _

%. to l

1 Executive Suamary

Following the Three Mile Island (TMI) accident, the Office of Nuclear Reactor Regulation developed the "TMI Action Plan" (NUREG-0660 and NUREG-0737) which required licensees of operating reactors to reanalyze transients and accidents and to upgrade emergency operating procedures (EOPs) (Item I.C.1). The-plan also required the NRC staff to develop a long-term plan that integrated and expanded efforts in the writing, reviewing, and monitoring the plant procedures (ItemI.C.9). NUREG-0899, "Guidelines for the Preparation of Emergency Operat-ing Procedures," represents the NRC staff's long-term program for upgrading E0Ps, and describes the use of a "Procedures Generation Package" (PGP) to prepare E0Ps. The licensees formed four vendor type owner groups corresponding to the four major reactor types in the United States; Westinnhouse, General Electric, Babcock & Wilcox, and Combustion Engineering. Working with the vendor company and the NRC, these owner groups developed Generic Technical Guidelines (GTGs) which are generic procedures that set forth the desired accident mitigation strategy. These GTGs were to be used by the licensee in developing their PGP. Submittal of the PGP was made a requirement by Confirmatory Order dated February 21, 1984. Generic Letter 82-33, "Supplement 1 to NUREG-0737 - Requirements for Emergency Response Capability" requires each licensee to submit to the NRC a PGP which includes:

1. Plant-specific technical guidelines with justification for differences from the GTG ii. A writer's guide iii. A description of the program to be used for the validation of E0Ps iv. A description of the training program for the upgraded E0P From this PGP, plant specific E0Ps were to have been developed that would provide the operator with directions to mitigate the consequences of a broad .

range of accidents and multiple equipment failure l

,

Due to various circumstances, there were long delays in achieving NRC approval of many of the PGPs. Nevertheless, the licensees have implemented their E0P To determine the success of the implementation, a series of NRC inspections are being performed to examine the final product of the program, the E0P On May 2-10, 1988, an NRC team of inspectors consisting of two reactor inspec-tors, a reactor system consultant, an operator licensing examiner / inspector, a human factors specialist, and the resident inspector conducted an inspection of the Emergency Operating Procedures at Hatch Units 1 and 2. Hatch is a BWR-4 with a Mark I containment. The objectives of the team were to determine if:

the E0Ps are technically correct, the E0Ps can be physically carried-out in the plant, and the E0Ps can be performed by the plant staf ,

l

1 i

j l

-. .. -- - _. _ .. .

s

The objectives would be considered to be met if review of the following areas were found to be adequate: comparison of the Emergency Operating Procedures (E0P) with the Plant Specific Technical Guidelines (PSTG) and the BWR Owners Group Emergency Procedures Guidelines (EPG), review of the technical adequacy of the deviations from the EPG, control room and plant walkdowns of the E0Ps, real time evaluation of E0P usage by running E0P exercise scenarios on the plant simulator, evaluation of the licensee program on continuing improvement of the E0Ps and performance of human factor analysis of the E0Ps. The inspec-tion focused on the adequacy of the end product and did not depend on review of the process to develop E0Ps. However, because of the complexity of the Hatch E0Ps a review of the E0P development process was performed. In addition, containment venting provisions were reviewed. Containment venting provisions for all BWRs with Mark I containments are being performed across the country as an NRC inspection :nitiativ Due to the complexity of the Hatch flow charts, prior to the site visit the inspection team had difficulty in utilizing the flow charts. Once the facility explained the flow chart, how it is set up and how the flow charts are used, the team could then begin to effectively review the E0Ps as implemented at Plant Hatc The inspection findings appear to have a comon source namely, the facility considered the PSTG as a guideline whereas the NRC considered the PSTG as the technical basis upon which to develop the Emergency Operating Procedures and upon which their technical adequacy is judge The facility had developed the PSTG from the vendor guidelines with essentially no deviations. However, the E0Ps developed from the PSTG have many deviations from the PSTG. Documentation was not available to justify the deviations taken from PSTG. Examples of the deviations taken include the values in the proce-dure and logic of the procedures. These are discussed in Section 4 and 5 of -

the repor The QA organization on site had also identified that differences from the PSTG existed in the E0Ps. The facility responded to the specific QA items, but did not aggressively pursue the root cause for the difference The independent technical review recently performed by General Electric also identified differences between the E0Ps and PST Since the NRC considers the PSTG the technical basis for the E0Ps, the proce-dures that satisfy the PSTG requirements similarly are considered by the NRC to be a necessary part of the Emergency Operating Procedures. At Plant Hatch, the procedures that satisfy the PSTG requirements include selected Alarm Response Procedures (ARP), abnormal operating procedures (A0P), flowcharts, end path manuals (EPM) and to some extent the Emergency Plan - Emergency Implementing Procedure In practice the facility only considered the E0Ps to include the flow charts and end path manuals. Development, technical adequacy, administra-tive, training and quality concerns regarding the ARP, A0P portion of the E0Ps were identified (See sections 3, 4, 5, 7, 8, 9, 11, and 12).

_ - _ _ _ _ _ _ _ _ - - - - _ _ _ _ _ _ - - _ _ _ _ _ _ - _ _

. .. \

The primary concern identified from the walkdowns was the inconsistency between plant labels and the procedures. The control of jumpers / tools and the indica-tion that local equipment is E0P related was quite good. The procedures were judged to be able tc be physically carried out in the plant. (See Section 6).

NRC review of the development program concluded that, whereas a team approach in the development, validation and verification was attempted, human factors involvement was not sufficient. Verification activities were essentially conducted by one individual with team involvement only in the differences identified (see Section 3).

The primary human factors concern identified in the Plant Hatch E0Ps is the overall complexity of the flowcharts. This high level of complexity is caused by the interaction of a number of human factors concerns contained in the flowcharts, resulting in procedures that are difficult to use, understand, and rea The high level of flow chart complexity dominates the human factor concern Human factor concerns were also identified in the other procedures that imple-ment the E0Ps. Section 8 discusses the human factor analysi The simulator portion of the inspection was the key to understanding the Plant Hatch E0Ps. Due to the complexity of the E0Ps, the team developed simulator scenarios based on the logic of the PSTG to achieve desired end points. The simulator exercises resulted in the desired end points being achieved by the procedures, with the procedures directing the actions to be taken when required. The simulator exercises provided confirmation that the plant staff can use the procedures, and pointed out weaknesses in the procedures for con-current actions on primary and secondary containment contro In summary, the team concluded that the E0Ps at Plant Hatch need improvemen The facility lacks adequate justification for differences between the EPG and E0P The procedures do contain human factor concerns in areas that affect operator performance. The development, validation, verification program did not fully implement a multi-discipline team approach. Training in E0D entry conditions other than a plant scram is required. Procedures to better imple-ment primary and secondary containment and rad release control entry conditions are needed. However, based on the walkdowns and plant simulator exercises, the teams concludes that the Plant Hatch personnel can carry out the E0Ps and that the current E0Ps can get the plant to a safe condition if called upo _ _ _ - - _ _ - . _ - .

. - . . . . .

.

REPORT DETAILS Persons Contacted Licensee' Employees

• J. T. Beckham, Jr., Vice President, Plant Hatch

• S. Bethay, Nuclear Safety and Compliance Supervisor

• J. Betsill, Operations Support Superintendent

• L. Byrnes, Senior Nuclear Engineer

• C. Coggin, Training and EP Manager G. Czech, Senior Plant Engineer

• P. Fornel, Manager, Maintenance

• 0. M. Fraser, QA Site Manager

• R. Hayes, Deputy Manager of Operations R. King, Engineering Supervisor -

R. Knoble, Consultant C. Lane, Consultant

• H. Nix, Plant Manager

• D. Read, Plant Support Manager

• D. Self, Oglethorp Power Company

• L. Sumner, Manager of Operations

• S. Tipps, Nuclear Safety & Compliance Manager

• 0. Vidal, Shift Technical Advisor

• R. Zavadoski, Manager, HP/ Chemistry The inspectors also contacted other licensee personnel including senior reactor operators, reactor operators, training personnel, shift technical advisors and other plant and engineering staf NRC

• L. Crocker, Project Manager Hatch, NRR

• Ernst, Deputy Regional Administrator, Region II

• Hehl, Deputy Director, Division Reactor Projects, Region II

• C, Julian, Chief, Operations Branch, Region II

• G. Lainas, Assistant Director for Region 11 Reactors, NRR

• D. Lange, Chief, BWR Section, DRS, Region I

• J. Henning, Senior Resident Inspector, Plant Hatch

• Patterson, Project Engineer, Region II

• Regan, Chief, Human Factors Assessment Branch, NRR

• Sinkule, Project Section Chief, Region II

• Troskowski, EDO, Region II Coordinator, NRC HQS

• Denotes those present at exit meeting on May 10, 1988

l

,

_ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ . _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _

.. _ . s

2. E0P Development v. mid-1983 an E0P implementation team was formed at Plant Hatch. The team was staffed by contractors, six engineers and a project manager, in addition, Plant Hatch operations personnel participated in a rotational capacity in development activities and in contractor oversight. Four Plant Hatch shift supervisors participated in development activities including simulator testing and desk top review of the many iterations of the early E0P A human factors review was conducted by a' contractor during May-September, 198 The review consisted of interviews with two operators, review of Plant Hatch emergency procedure documents, observation of simulator exercises, interviews v!ith personnel at ' Brunswick Station about their experiences with similar flowcharts, and review of a sample of early Plant Hatch flowchart The E0P implementation team development activities continued through early 1986, including simulator and plant walkthrough validatio Pre-implementation training began in early 1986, consisting of 120 hours0.00139 days <br />0.0333 hours <br />1.984127e-4 weeks <br />4.566e-5 months <br /> of classroom study of the philosophy, content and use of the- new proce-dures. Following the classroom component of the training, 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> of simulator exercise were conducted. Operator comments were solicited during the simulator training for possible integration into the E0P These comments were evaluated by the E0P iinplementation team staff, in consul-tation with Plant Hatch manaoement, and a response was provided each operator on the resolution of his commen Currently Revision 2 of the flowcharts is in effec Findings Several concerns have been generated by a review of the Plant Hatch E0P '

development process. There was an inadequate team approach in-the develop-ment, validation and verification of the E0Ps. Human factors involvement :

was lacking in the fundamental development phase of the E0Ps. After basic i development of the E0Ps was completed, human factor involvement was very limite The verification activities were conducted primarily by one STA, with limited support from other STAS. The only evidence of a team approach in the verification was review by other operations personnel of STA verifica- ,

tion of proper plant nomenclature in the E0P The supporting documentation for the E0P development process and formal validation is under contracter control, not under Georgia Power contro l l

'

\

l l

l

._ _

, s

The formal validation done on those steps not exercised in the simulator was done by. table top analysis and did not include a walkdown of the procedures in the plan E0P validation and verification on those ARPs and A0Ps _ that implement the PSTG was minima . Basic E0P/BWR Owners Group Emergency Procedure Guideline (EPG) Comparison A comparison of revision 3 of the EPG and the E0Ps was made to ensure that the licensee had procedures as indicated in the EPGs. This comparison was made difficult by the unique and complex nature of the implementation of the E0Ps at Plant Hatch. The E0Ps' as implemented at Plant Hatch are contained in a group of procedures. The E0Ps at Plant Hatch consist of the following procedures: Alarm Response Procedures (34AR Series) Abrormal Operating Procedures (34AB Series) Flow Charts End Path Manuals (EPM) Emergency Plan Implementing Procedures (EPIP)

Each group of procedures listed above contains procedural guidance from the EP All of the above listed procedures are required to implement the symptom based E0Ps at Plant Hatc Pre-scram EPG directed operator actions are contained in Alarm Response Procedures (34AR Series). These procedures direct immediate operator actions, and direct the operator to Abnormal Operating Procedures (34AB).

These procedures contain procedural guidance from the EPG, and direct the operator to manually scram the reactor, at which time the flowcharts are entere l l

The flowcharts are entered following ANY scram, or failure to scra l These immediate procedural steps are contained on 5 complex flow charts, l with subsequent operator actions contained in text procedures, called End

'

Path Manual The Primary Containment Control and Secondary Containment Control are identified in the flow charts to be executed concurrently and the instructions to control these items are contained in the End Path Manual Radiation Release Control instructions are also contained in the End Path Manual but are not directed as a concurrent instructio The Emergency Plan Implementation Procedure was also identified by the licensee documents as a source of instructions for radiation release control but the facility was unable to identify the specific instruction in the'EPIP which address EPG step .. . ..

. s

The flow charts are so structured to allow the operator to pick any flow chart, follow the instructions ~ given,land be.. guided to the appropriate flow chart based upon the answers given to a series'of simple-question The flow charts direct the operator to the ' appropriate End Path Manual after the immediate operator actions are take There are four End Path Manual These manuals also-contain the contin-gency procedures: Level Restoration Emergency Depressurization Alternate Depressurization Alterr. ate Pressure Control Alternate Shutdown Cooling Reactor Vessel Flooding Alternate Water Injection Group Isolation Reference Leg Fill The End Path Manuals, as well as portions of the flowcharts, contain the procedural guidance from the EPG for the contingency procedure The team reviewed the procedures listed in Attachment A. The team concluded that the family of procedures listed above will address the EPG requirement The team identified that the procedure control for radiation release did not address radiation release at the alert level pre-scram that may occar as an unmonitored release. Specific comments on the procedures were noted as described in the following section . Indepent.ent Technical Adequacy Review of the Emergency Operating Procedu?es The Hatch E0Ps in Attachment A were reviewed to assure that the procedures are technically adequate and accurately incorporate the BWR Owners Group EPG A comparison of the Plant Specific Technical Guidelines (PSTG) to the EPG and E0Ps was also performed. Differences between the EPG and PSTG were assessed for adequate technical justification. Selected specific values from the procedures were reviewed to determine that the values were ccrrect.

. - _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ - _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ - _- . _ _ _ _ _ _ _ _ . - _ _ - _ _ - - _ -

.__ _ _ _ _ _ _ _

.

a. PSTG/EPG The facility had indicated in prior correspondence to the hRC t"St they were taking no deviations with the EPG except for inserting the site specific values into the PSTG and not including systems in the PSTG that do not exist at Plant Hatch. The normal vent and purge system to control containment pressures was not utilized by the facility as was allowed by the EPG. No technical discrepancies were identified in this are b. PSTG/E0P Comparison This comparison found many inconsistencies between the two document These inconsistencies were apparently caused by the licensee belief that the PSTG is a guidance document and was not the technical basis for the procedure developmen The comparison between flow charts and the PSTG revealed several concerrs with the details of the Plant Hatch E0Ps. As the flowcharts are desigoM to prov'de the operato. with detailed procedural check-off lists of specific actions to take while proceeding through them, they conta;.1 many steps which are not included in the PSTG. While not necessarily a problem in concept, it war fourd that in several cases (which are considered tc be representative of the flow charts in general), these additional operator actions varied from the logic of the PSTG and introduced delays in mitigating the casualty as rapidly as pcssible. In some cases the logic of the PSTG was changed by a rearrangement of steps in the transition from the ARP or A0P to the flowcharts and EPMs. In addition. the values for parameters involving betion steps in the E0Ps are often not the same as those specified in the PSI In the E0Pa these values are often alarm set points while the esTG specifies a calculated value or one which was obtained frem the technical specification Examples of these varit-.es arc contained in the following paragraphs:

Example Tne e ctor Pressure Vessel (RPV) Control guideline in the PSTG is to be entered when RPV water level falls below +1 .ches, the low 16 vel scram set-point. The actiori step RC/L calls

, for the monitoring and control of RPV water leve The next sub-step, RC/L '. calls for the confirmation of or initiation of any af the following: 1. Isolation, 2. ECCS, 3. Emergency esal genera-P**. to The next step calls for restoration and maintei.e.; ce of RPV i T ~

water level between +10.0 and +56.5 in, with one or more of the

-

' '

If systems capable of refilling the RPV. The final step calls for

-. 3?"Y; pror; ding to the cold shut down conditio Uy5%

.s s:a -

Ng S

_ _ _ _ . _ . _ - - - - - - _ _ - - - - _ - _--

. .

o

Comparing the mitigation of a low level entry conditior. on Path 3 of the E0P flow charts (the normal SCRAM procedure) with the Leval response of the PSTG above shows the following: .The procedure asks-if a group 2 or 5 isolation auto initiation signal is~ present-and if it is, directs the operator to' a series of steps to determine .

if isolations have occurred, but not if the isolations snould have occurre Then the status of the pneumatic system in the Drywell is checked and corrected if wrong. There is no reference to a potential level problem at this juntture, and there is no reference to th confirmation of ECCS or emergency diesel initiatio Forty three-steps later (in the di' ect r flow path without deviation for other actions) the flow path asks the operator if level can be maintained above +12 inches and if not directs him to Path 4. In Path 4, the various potential sources of water to the RPV are addressed in a serial manner, with deviation notes to check for fire conditions and system line-ups prior to initiation of water-supply to the RP The level limits specified in this example are +10 and +56.6 inches in the PSTG and +12 and +50 inches in the E0 Example 2: Tiie PSTG entry condition- for RPV pressure control is 1054 psig. If any Safety Relicf Valve (SRV) is cycling, SRVs are to be manually opened until RPV pressure drops to 927 psig. Pressure is then to be controlled below 1090 psig with the main turbine bypass valvec which may be augmented by one or mot. of several additional systems. When all control rods are inserted beyond' position 02, the RPV is to be depress rized and the cooldown rate maintained below 100 degrees F/hr. Then shutaown cooling is initiated using RHR, systems used for depressurization, or if that does not work. Alternate Shut-down Cocling. The entry question on Flow Path 3 for RPV Pressure control is Reactor Pressure above 1042 psig. If it-is, you are directed to activate low low pressure cet by momentarily opening an SRV and then maintaining pressure between 850 and 1040. It appears that the low low set activation step is the equivalent of the cycling SRV step in the PSTG because its activation prevent 5 cycling. If the pressure cannot be maintained in this range, then the flow path directs the operator to an "SRVs 5:uck open" question. This is an action which is not required by the PSTG. If a valve is stuck open, -

the operttor is directed to take action to shut the valves thus  !

diverting his attention from maintaining reactor pressure control in accordance with the PSTG, Following the "SRVs stuck open" question, a block on the flow chart states "use SRis as necessary to maintain reactor pressure Lalow 927 psig." The PSTG states at this point that the SR'!s may be used to augment the main turbine bypass valves but only when suppression pool water level is above 58 in. A ficwchart question relating to the use of turbine bypass valves for pressure control does not appear until 14 steps late If available, the operator is to maintain pressure below 927 psig using the bypass valves. The other pressure control aJgmentation methods are found  ;

in th EPMs af ar proc'.eding through many other steos on the flow-chart and within the Elms. Note that the values used as control-points again vary between the PSTGs and the E0Fs, '

_ _ - _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ _

._

m x

Example 3: The encry condition for the monitoring and. control of reactor power in the PSTG is a condition which requires _ reactor scram, end reactor power -above 3% or cannot be determine The actions which are to follow are:' Confirm or place the reactor mode

-

switch in SHUTDOWN (RC/Q-1); if the main turbine-generator is on-line and the- MSIVs are noen, confirm or initiate recirculation flow runback to minimum (RC/Q-2); trip the recirculation pumps if reactor power is above 3% or cannot be determined (RC/Q-3); boron injection is required with Standby Liquid Control (SLC) and automatic initia-tion of Automatic Depressurization System (ADS) it prevented if the reactor cannot be shutdown before suppression pool _ temperature reaches 110 degrees The E0P flow path response, starting with Path 3, takes the operator _

,

to the top of Path 1 if the Nuclear Engineer cannot confim negative reactivity insertion sufficient for cold shutdown which is a time consuming action not called for in the PSTG, In Path 1, instead of imediately reducing recirculation flow to minimum followed by recirculation > ump trip, the E0Ps send available operators to execute sequence insensitive rod insertions, line up recorders, verify 'or initiate alternate rod insertion, continue to try and insert rods, check power supplies, and if the suppression pool is not abcVe 110 degrees F, start checking out the process computer. All these steps are being done before recirculation pumps are run-back or trippe The step to check the suppression pool temperature is also done prior to recirculation pump tri Acccmplishing these sequential steps is different than the logic of the PSTG which is based on the it.sertion of negative reactivity into the reactor as rapidly as possibl In the boron injection phase, the E0Ps call for the operator to attempt SLC injection and if not successful, try to repair the stendby liquid control systems. The PSTG logic required the opera-tors to immediately attempt the alternate methods of boron injectio As the event progresses and power control by level reduction is required, the E0Ps call for level to be maintained at the point of MSIV closure while the PSTG calls for the reduction in water level to the top of active fuel if nacessary to control leve Example 4: For RPV floodin;; the PSTG indicates that the first step is to close the Main Steam Isolation Vulves (MSIVs) and drains as well as High Pressure Coolant Injection (HPCI) and Reactor Core Isolation Cooling (RCIC) steam lines. The facility uses the HPCI and RCIC as alternate boron injection system if SLC should fail, The facility implementation of RPY flooding accounts for the provision to not isolate HPCI and RCIC if being used for boron injection even though this action is in apparent conflict with the PST Example 5: The entry condition into Primary Containment Control on suppression pool HI-Level is 150 inches ae stated in the PSTG, SP/L-3. However, End Path Manual 5.121, paragraph 3.1 does not require operator action until level has risen to 152 inches.

. _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ _ - _ _ _ _ _ ._ . _ . -.

. .. - ,

( '. .

Example 6: Flow Chart 1, Caution 21 requires entry into Primary Containment Control at a drywell hydrogen concentration of 2%. This entry condition is not listed in the PST Example 7: Flow Chart 1, Grid B-2 asks if suppression pool tempera-ture is above 110 degrees F. If so, inject SLC. The PSTG requires the initiation of SLC before 110 degrees F is reache Example 8: Entry condition into Secondary Containment Control is iequired at 0 pounds DP as stated in the PSTG. This entry condition is not included in either.End Path Manual 4.126 or 4.12 Example 9: PSTG Caution #14 requires that the operator not depres-surize the RPV below 100 PSIG (HPCI low pressure isolation setpoint)

unless motor driven pumps sufficient to maintain RPV water level are running and available for injectio End Path Manual 4.125, step 3.12 lists 128 PSIG as this valu Example 10: In the Primary & Secondary Containment Control Proce-dures both pre-scram and in the End Path Manual, concurrent control of all containment parameters (i.e. Suppression Pool Temperature, Suppression Pool level, Containment pressure etc.) was not proce-durally required whenever an entry condition existed as provided for in the PSTG, The above are examples of inconsistencies between the PSTG and E0P Documentatice to support the variances was lackin Inconsiste cies similar to the above examples were identified throughout the flow-charts and in the EPM In situations where the PSTG entry conditions exist without scram, the licensee relies on A' ann Response and Abnormal Operating Proce-dures to accomplish the en,ergency mitigating actions. The inspection team traced several of these procedures to determine if the-logic of the PSTG was preserve lnese procedures were found to be under revision making tracing difficul The torus high temperature Abnormal Operating Procedure was found to still refer to the Scram procedure which was cancelled by the E0P Procedure. Several Alarm Response Procedures were found to be "den' ended." If the mitigating action called for in the procedure was not successful, there was no path to direct the operator to an Abnormal Operating Procedure. The affected Alarr Response Procedures included Suppression Chamber Level High, 34AR r:01-127-2S; Suppression Chamber Level High "RCIC",

34AR-602-230-25; Torus Water Level High/ Low, 34AR-654-080-25; Primary Containment High Pressure Trip,14AR-603-106-2 The licensee did not prepare a deviation document between the EPG/

PSTG, when in fact, as the E0Ps ;ere implemented, they are taking deviations from the EPGs. Since the facility only considered the PSTG as a guidance document and not a technical directive upon which

- - - - - - - _ - _ _ _ _ _ _ - _ _ - - _ _ _ _ _ - _ _ _ _ _ _ - _ - _ _ _ - _ _ _ - _ _ _ _ _ _ - _ - - _ _ _ _ _ _ _ _ _ - - - -

. ..

,

the technical adequacy of the procedures can be based, the' facility only assessed that the intent of the PSTG was being met. The facility did not prepare technical justification for the differences'betwee the PSTG/EOP Technical justification.for the deviations of the E0Ps from the EPG is needed, Administrative Controis for Alarm Response Procedures and Abnormal-0perating Procedures that-Implement PSTG Requirement The inspectors-inquired if the administrative controls on the Alarm Response Procedures (ARP) and Abnormal Operating Procedures (A0P)

that implement the PSTG requirements were the same as the . flowcharts and EPM The facility responded that those A0Ps and ARPs tha implement the PSTG requirements were not reviewed and controlled like the flow charts and EPM. The facility is in a major rewrite of the A0Ps and ARPs. The facility management immediately ' directed its staff that until further notice, all ARPs and AOPs and changes will be reviewed by the E0P Group- before implementation to assure that the PSTG requirements are met. This is a temporary action until the licensee formalizes the administrative controls for these procedure . Control Room and Plant Walkdowns The inspectors walked down selected E0Ps to confirm that the procedures can be accomplished. The purpose of the walkdowns was to verify instru-ments and controls as designated in the procedures are consistent with the installed plant equipment, ensure that the indicators, controls, annunicators referenced in the procedures are available to the operator, and ensure that the task can he accomplished. Detailed comments identified are noted in Attachment B. General comments and observations are discussed below:

The most significant general comment is that the plant labeling. and ,

procedure nomenclature do not agree. This appears to be the result of the verification activities which did not have clear guidance regarding this 1

'

area (See Section 3).

The flowcharts in the control room are located in an appropriate plac However, as discussed in Attachment C, adequate table space for concurrent use of the procedures and EPM is lackin l The facility control of tools / jumpers for E0P use is considered quite effective and knowledge of plant personnel on these specialized tool /

jumpers is widesprea Whereas the team did find labeling inconsistencies, the facility has taken care to assure that key relays ard fuse locations and other equipment are appropriately marked to distinguish them as EC? equipment. This is quite evident throughout the facilit I

_

-. . _ . -

- - .. . .

.

'

The teams considered that in spite 'of items identified during the walk-downs, the procedures were able to be performed by the staff at Plant Hatc . Simulator Five scenarios were run on the plant specific simulator with two teams of licensed operators. The first team consisted of both staff and current on-shift licensed operator The second team consisted of the current on-shift crew in training for the week. -The team utilized different numbers of personnel to conduct these scenarios. Scenarios were run with 2-SR0s, 2-R0s, and STA (minimum Tech Spec crew as well as minimum administrative procedure crew) and 2-SROS.3-R0s, and the STA' (normal shift crew size). The simulator scenarios provided information on real time activitie The purpon was to determine that the procedures provide operators with suffici'ent guidance such that their responsibilities and required actions du -i nc, the emergencies, both individually and as a team are clearly outined, verify that the procedures do not cause operators to physically interfere with each other while performing the E0Ps, verify that the procedures did not duplicate operator actions unless required (i.e.,

Independent Verification) when a transition from one E0P to another E0P or other procedure is required, precautions are taken to ensure- that all necessary steps, prerequisites, initial r.onditions, etc., are met or completed; and, operators are knowledgeable about where to enter and exit the procedur *

Due to the complex nature of tha Hatch E0Ps the team initially had diffi-culty in the understanding of how to use the E0Ps when the simulator scenarios were being developed. As a result the team developed the ,

scenarios based upon the logic of the PSTG to achieve a desired end poin l If the procedures being utilized by the operator achieved the desired endpoint, the team would conclude that the E0Ps were capable of bringing the plant to a safe condition. The scenarios were designed to evaluate the E0Ps during various plant upset conditions, both before and after a reactor scra Following each scenario, detailed discussions were held with the operating cre The conclusions and observation of the team follow:

The E0Ps utilized took the simulator to the desired end poin l The operators were obsery-d to effectively use the procedures, even in I reduced lighting situat' .

The procedures directed the actions of the operators in a time frame that l was generally in agreement with the scenario developmen The Safety Parameter Display System (SPDS) was effective in assisting the information needs to respond to the scenario a

The concurrent execution of Primary, Secondary, and Radiation Release Controls are not procedurally required when entry conditions for these exist..The training program also does not address concurrent entry into these control With a staffing level of 2-SR0s, 2-R0s and 1 STA the team observed the SR0s being required to operate the controls. With a level of 2-SR0s, 3-R0s and 1 STA the SR0 did not have to operate the controls. This is a concern on the adequacy of the minimum staffing level requirements of the administrative procedures and technical specification requirement The team concluded the E0Ps can mitigate and control plant upset condi-tions, and place the plant in a safe conditio . Human Factors Analysis As a result of the human factors analysis of the Plant Hatch E0Ps, a list of specific concerns has been generated (see Attachment C). An initial desktop review of the E0Ps was conducted prior to the on-site inspectio Observation of simulator exercises, interviews with Plant Hatch staff, and

,

'

plant walkdowns were used to both corroborate those problems noted during the desktop review and to identify additional concern Findings The primary human factors deficiency identified in the Plant Hatch E0Ps is the overall complexity of the flowchart This high level of com-plexity is caused by the interaction of a number of human factors concerns ccatained in the the flowcharts, resulting in procedures that are difficult to usr<, understand, and rea The major contributing factor to the complexity of the Plant Hatch flow-charts is the high level of detail in the procedure The large amount .

of information has led to several specific concerns in the procedures for ,

example: extensive movement, lengthy action steps, placement of cautions, reduced print size, and overall suall size of the flowcharts. Activities required to correct concerns within the E0Ps include an evaluation and reduction of the amount of information contained in the procedure The technical concerns resulting from the high level of detail can generally be divided into two categories: (a) those with a strong relationship to potential human error (areas 1 through 5) and (b) those less directly related to potential human error but which also affect useability and understandability of the procedures (areas 6 through 8).

A sumary of concerns in each of these areas, including those found in the EPMs, follow ;

, Movement (Transitions)

Hovement (also known as transitions) within and between procedures .

is often required of an operator during the execution of E0Ps. An operator may be directed to concurrently perform more than one flo .

_ _ _ _ . _ _ _ _ _ _ _ _ _ _ . _ _ _ . _ - _ _ _ _ _ . _ _ _ _ . _ _ ____.______._____________._____-._m___

. . ., .

'

. ..

.

-12-path, or more than on procedure, or to completely exit the procedure being executed and move to a different E0P. An operator may also be-required to reference tables. _ charts, supplemental information, or non-E0P procedure Movement within and between E0Ps can be.disrup-tive, confusing, and cause unnecessary delays and error. -Therefore it is particularly important that these transitions be minimize When movement cannot be avoided, it is important that the transition directions to the cperator be clearly and consistently structure Throughout the Plant Hatch flowcharts and EPMs, many transitions are required of the operator. Not only is the movement extensive, but the transition directions -to the operator are indicated in multiple, inconsistent, and sometimes unclear methods. The number and types of transitions required is the Plant Hatch E0Ps make the procedures more difficult to use and hold potential for error, b. Decisions When individuals are subjected to emotional or environmental' stress, such as those which may be present during the use of E0Ps, difficul-ties may be experienced in a number of cognitive areas. For example, information drawn from long term memory may be incomplete or inaccu-rate, short term memory capacity may be reduced, and the ability to -

accurately assess the importance of details may be degraded. Any or all of these problems will lead to difficulty in decision-makin Because decisions can be extremely important to the execution of E0Ps, it is critical that they be clearly, c:nsistently, and approp-riately mad In the Plant Hatch E0Ps, numerous types of decisions are require Because these many decisions are also inconsistently structured, they can be difficult for operators to use in emergency situations with a potential for erro <

c. Memory Requirements As mentioned above, difficulties may be experienced with both long and short tena memory when individuals must perform under stressful conditions. During execution of E0Ps, operators must - draw upon their experience and training (long term memory). In addition steps and information within the procedures, such as time dependent or recurrent steps, depend upon the use of short tenn memory. When procedures are designed to include multiple demands upon operator memory, the potential for operator error is increase The Plant Hatch E0Ps evidenced numerous demands upon operator memor While some reminders and backup systems are provided to assist cperators, the Plant Hatch E0Ps as a whole appear to place ;

a _ unnecessarily large burden upon tha operator and could lead to erro I

. - .

. ... .

.-

13 Cautions and Notes Cautions are used to describe hazardous conditions that can cause, injury or equipment damage. They should describe the consequence of the hazard. Notes are intended to provide supplemental informa-.

tion to the operato Neither. cautions nor notes should contain-directions to the operator. . Because of the critical nature. of .the information contained in cautions, it is particularly importantL that cautions be emphasized in a way that distinguishes them from notes and that they be _ located where operators-will not overlook the The human factors analysis revealed a number of concerns related to .

format, structure, location, and labeling of cautions and notes .in ;

the Plant Hatch E0P These deficiencies in the treatment of both critical and supplemental information could lead te delay or operator error, e. Graphics A number of aspects of the graphics used in the Plant Hatch- flow-charts have contributed to difficulty in readability. These include inadequate print size, lack of sufficient white space, light glare

off laminate, and low contrast color us It should be noted that

,~

the extent and number of graphics inadequacies in the Plant Hatch flowcharts are such that this category is likely to have a greater

,

relationship to potential error than is usually attributed to

graphics issues in procedures, f. Sentence Structure Both the Plant Hatch Writer's Guide and NUREG-0899 indicate that sentences should be short, simple, including one idea per sentence, and should avoid the use of imprecise adverbs. It was found that steps throughout the Plant Hatch E0Ps were written in a complex manner, using multiple action verbs, imprecise. adverbs, supplemental information, and inconsistent structur The numerous examples of overly complex steps identified in the Plant Hatch E0Ps could lead to operator erro g. Writer's Guide In order to prepare clear, consistent E0Ps that will aid the operator and help minimize orrors that can occur when operators execute procedures during emergencies, a complete and clear writer's guide is necessary. A number of inadequacies were identified in the Plant I Hatch Writer's Guide. These deficiencies result in a writer's guide i which does not provide the guidance necessary for consistent produc- l i

tior, and revision of high quality procedure l

.

A

.

It should also be noted .that, .due to the extensive use of ARPs,

,

A0Ps, and ' EPIPs in conjunction with the E0Ps, guidance for their preparation and revision was not included in the writer's guide for E0P Because they are part of the E0P system, it is critical that format be consistent throughout these procedures and' that the quality of the documents be controlled as strictly as that of the flowcharts and EPM Miscellaneous A number of other miscellaneous inadequacies in the Plant Hatch E0Ps were identified through - the human factors analysis. For example, abbreviations and acronyms were used inconsistently throughout th E0Ps. Placekeeping spaces in the EPS: were located on the right side

. of the steps, not at the step number. References to the flowcharts were inconsistent through E0P3 and satellite procedures, ranging from

"the flowcharts" to 31ED-E0P-001-1S. Other miscellaneous inadequa-cies are detailed in Attachment C, 8. E0P. Training Discussions were held with the Director of Training and Emergency Pre-paredness and senior staff instructor From these discussions and a review of LT-IH-20101-00 INTRODUCTION TO EMERGENCY OPERATING PROCEDURES, the team concluded that the training organization demonstrated weakness in the proper training of the entry conditions into the E0P Plant Hatch utilizes an unique methrd of implementing the E0P They are a group of procedures, made up o':

a, Alarm Response Procedures Abnormal Operating Procedures Flow Charts End Path Manuals Emergency implementing Procedures As currently instructed, the operating staff considers only the Flowcharts and End Path Manuals to be the E0Ps. As currently instructed, the operat-ing staff enters the E0Ps (the Flow Charts and End Path Manuals) only on

,

the following conditions- . Manual Scram Auto Scram Failure to Auto Scrcn These instructions are inadequate and represent a weakness in the E0P construction. Primary Containment Centrol, Secondary Containment Control and Radiation Release Control Guidelines are required in the PSTG to be entered, and executed concurrently when any condition, as specified in the PSTG, are met. These entry conditions can be met, irrespective of a reactor scra _ . .

-. .s

Due to the highly complex nature of Plant Hatch flowcharts, they are -

considered difficult to use. In order to provide operators the famili-arity and understanding necessary to use the flowcharts . a large burden is placed on trainin Observation of operators in the simulator 'and discussion with personnel during this inspection provided the following information: Operators are provided the trainirig and familiarity necessary to use the flowcharts, 'In order to provide the needed training, the training department must devote substantial time and effort to E0P trainin Simplification and reduction of level of detail .of the flowcharts would reduce the burden on trainin Operators believe that, (a) the flowcharts provide more detail than they require to perform thE procedures and, likewise, (b) their overall training is sufficient to allow the reduction of level of 4 detail within the flowcharts, a

9. Ongoing Evaluation of E0Ps Ongoing evaluation of Plant Hatch E0Ps consists of three different evalua-ion activitie First, an annual review of all E0Ps is conducted in accordance with Administrative Procedure 10AC-MGR-003-05, Preparation and Control of Procedures, section 8.4.13. These annual reviews are tracked by tha Administrative Control Department, and in the case of E0Ps are initiated by the Manager of Operations. The reviews are conducted by operators while undergoing requalification training and are documented using the Procedure Review Form, as described in Administrative Guideline AG-ADM-14-1184N, Administration of Procedure Reviews. The Procedure Review Form contains the number of procedures reviewed, revision number, date of review, an indication of acceptance or non-acceptance, and relevant remarks. The form is signed by the Manager of Operations or his deput No indication of the actual reviewer or review methods used is listed on the form. Plant Hatch representatives indicated that there is no method for tracking how or by whom the reviews were actually conducted.

. The second method for ongoing review of E0Ps is through operator comments recorded during regular training. This method is used for all types of procedure An interoffice memorandum fann is used to describe the operator comment and is placed in a binder in the training office. These comment; are then forwarded to an operations supervisor, who refers comments about E0Ps to the supervisor of the E0P project. No proactive effort is made to solicit these comment .. - - - . . . .-- -- -, .. , . - .

_ . _ .. . - _ . .

s s

The third method used for ongoing review of E0Ps is informal comunication used by operators to relay their coments when not undergoing trainin The supervisor of the E0P project reports that this is a comon method for him to receive operator input about the E0Ps, however, the largest source of coments is through operator training.

) A formal method for requesting changes to, any type of Plant Hatch pro-cedure is through the Deficiency Control System, as described in 10AC-MGR-004-05. Plant Hatch staff ir ated that this system is rarely used for E0Ps, and it is therefore not .scussed in this sectio Findings The methods used for ongoing evaluation of E0Ps at Plant Hatch have several weaknesses. They are: The specific review methods used for the annual review are not noted on any documen Because of the documentation used, it is not possible to track what type of review was conducted._ Therefore, it is not possible to assess the adequacy of the annual review of E0P Using operator training as a source of operator input on the E0Ps is a good method. However, it would be improved by actively soliciting operator coments on the procedures during training, rather than simply taking coments as they are offere Relative to the informal comunication method of obtaining ongoing operator input on the E0Ps outside of training, more active solicita- '

tion of operator input coment' would improve the system.

. 10. QA Involvement in the E0P Program The team inspected the QA organization involvement in the programatic '

approach of the E0P Program. The inspection focused on the planned and periodic audit of the E0P development and implementation process.

.

Discussion were held with the QA Site Manager, and Quality Assurance Audit of Operations 87-P0-2A, dated October 15, 1987 was reviewed. The scope of the E0P audit included the Ficw Charts and End Path Manuals. The audit report had findings in areas of: i Inconsistencies between plant labeling and E0Ps PSTG and E0P differences

E0Ps not written in accordance with Writer's Guide a

. _ - - _ _ _ _ - _ - _ _ _ - _ _ - _ _ _ _ . _ _ _ - _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ - - _ _ - - _ _ _ _ _ - _ _ _ - - _ _ _ - . _ - _ _ _ _ _ _ _ . - - _ _ _ _ - - _ _ _ - _ _ _ _ _ - - - _ _ _ _ _ _

o -

The audit report contained findings similar to the findings of the NRC tea Licensee management corrected the specific inconsistencies contained in the QA audit report and did not do an in-depth review to determine the root cause of these findings, nor did it do a followup assessment to determine if the concern was as widespread as the NRC team ~

has identified. The differences between the-PSTG and E0Ps found by the .

QA audit did not include the difference in logic-between the PSTG and E0P Flowcharts. (Detailed in section 5.0 of this report.)

Because E0P implementation by Plant Hatch includes ' Alarm Response and Abnormal Operating Procedures, the inspector determined that QA did not audit the entire group of procedures that fully implement the E0Ps to ensure compliance with the PSTG and the Writer's Guid . Quality of Control Room Drawings and Procedures The purpose of this inspection was to review the methods utilized to ensure the critical plant P&ID drawings in the Control Room reflect the as-built condition of Plant Hatc Discussions were held with the Superintendent of General Engineering and Support, procedures Design Control 40AC-ENG-003-05, and DCR Processing 42EN-ENG-001-0S were reviewe The inspector also reviewed the critical plant drawings in the Control Roo Corrections to the drawings in the Control Room are made by hand following plant modifications. This is deemed necessary by the licensee, and in accordance with procedures, due to the lead time necessary to update the drawings. The inspector reviewed these changes and found them to be ,

legible and made neatly. Each change was properly documented on the drawings. From discussions held, procedures and drawings reviewed the inspector found no unacceptable condition The following items regarding the quali',y of the control room E0Ps were identified.

" Overall poor upkeep of EPIP and non-upgraded ARP (Facility responded to items during inspection)

-

torn pages  ;

poor xerox quality

'

-

-

lack of tabs or labels

-

broken binder I A0P and ARP E0Ps lacked apprcpriate emphasis (e.g., binders were not l labeled or colored in a manner that easily distinguishes them from !

non-EOP-related procedures), j

' Expired TCH noted in 34AB-0PS-015-25 (expired 4/18/88), was replaced with extension to 6/5/88, rather than correct procedure, Poor xerox quality noted in EPMs; e.g., EPM 2, Unit _ _ _ ._ _ , . _ _ _ . _ _ . ,

.

'

, s

12. Containment Venting Plant Hatch is a two unit facility, utilizing GE Mark I primary contain-ment configurations. The Mark I containment design consists of a light bulb shapped drywell and a doughnut shaped torus. The drywell is inter-connected to the suppression pool by downcours which submerge into the suppression pool water. Vacuum breakers are provided-in the interconnec-tions between the drywell, torus and Reactor Building. The containment atmosphere is inerted with nitrogen during . normal plant operation. Both the drywell and suppression pool chamber are designed to withstand a maximum of 62 psig internal pressur Containment venting is accomplished using components ' of the Primary Containment Purge and Inerting system and the Standby Gas Treatment system. Venting the drywell or torus can be performed in one of two way The first path utilizes two 10 inch lines which are generally used for containment purging and startup inerting. The second path uses redundant 2-inch lines which are used to vent excess pressure during plant heatup and normal operation. Regardless of the vent path used, the volume vented-from the drywell or torus is routed to the Standby Gas Treatment system and released via the plant stack. The.120 meter tall plant stack assures elevated vent gas releases to the environmen Each of the two 18-inch lines (one line is connected to the torus and the other is connected to the drywell) have two butterfly air operated valves (A0V) tbt perform containment isolation function Each of the four 2 inch lines (two lines are connected tc the torus and two connected to the drywell) have two globe A0Vs that perfonn containment isolation functions, and one valve that is use

ATM-0011 Hav. O Procedure Review Forms dated 1/7-8/8 Annual review of Unit 2 E0P E0P Implementation Plan for Emergency Response Capability Projec Rev /2/85. Plant Match.

Meeting Sumary en Information Presentation to NRC, EPRI INP0 on Georgia Power Con.pany - Plant Hatch Emergency Operating Procedures Upgrade Program and overhead projection transparencie April 25, 198 Paul Springer III. Georgia Powe l

_ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ - _ _ - _ _ - _ _ _ _ _ . _ _ - _ _ _ -

. ._ . .. . _ _

_ ,..- . _ . _ _ _

N -( .,

i Attachment A- 3'

Human Factors Review of Plant Hatch 'EOP Flowcharts. - Status Repor November 15. 1984. General Physics Corporation, Columbia, Marylan Edwin 1. Hatch Nuclear Power Plant Control Room Emergency 0perating-  !

Procedures ~ Validation Repor January 17, 198 General Physics

Corporation, Columbia, Marylan Response . to Plant Hatch E0P Validation Study Coments. C. Land.and R. Knoble. March 24, 1986. Georgia Power interoffice correspondence to J. R. Jorda E0-E0P-001-2S, Emergency Operating . Procedure Inside Control Room Unit 2, Containment Control Guideline Drywell Pressure and Temperature Control, Procedure 3.124, Revision 2.

'

31E0-E0P-001-1S, Emergency Operating Procedure Inside Control Room  ;

Unit 1, Containment Control Guideline - Drywell Pressure and (

Temperature Control, Procedure 3.124, Revision i

'3450-E41-001-2S, High Pressure Coolant Injection (HPCI) System, Revision 5 3450-E51-001-25 Reactor Core Isolation Cooling (RCIC) System, Revision 6

'

J

'

,

k

.,

f P

e i

,

b a

i

'

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

. - . . .

,A q ATTACHMENT B Plant Walkdown Corments E0P Equipment Cabinet t An inspection of the Unit 2 Emergency Operating Procedure (E0P) equipment cabinets was perfumed. One normally locked filing cabinet was noted to contain emergency procedures, end path manuals, jumpers filed by component to be jumped, phone, bolt cutters, and several rings of keys, including kns to the remote shutdown panel The two equipment cabinets (large tool boxes) contained hoses, fittings, l tools and meters required to perform cmergency system manipulations. Also noted in the vicinity of the cabinets were tables and ledders needed to support emergency operation The cabinets were noted to be wire sealed, organized and contained only equipment (identified by the color pink) necessary for use in an emer-gency. The NRC inspector expressed a concern over +% security of the keys in the filing cabir.et. The cperators stated tha6 the filing cabinet (a standard office type cabinet with a single lock in the upper right hand corner) was located in a vital area (security controlled access area) and the cabinet lock was sufficient securit The operator also stated the cabinet was inspected weekly for inventory of content End Path Manuals A walkdown was performed on the procedures written to vent the containment during an emergency. Containment Control Guideline, Drywell Pressure and ,

Temperature Control (Procedure 3.123), provides instructions on contain-ment venting. Both Unit 1 and Unit 2 procedures were reviewed. The Unit 1 procedure is generally identical to Unit 2, but only Unit 2 procedure comments are listed below, t In Procedure 3.123, the purpose of step 3.26.2 (determine hydrogen and oxygen concentrations) prior to containment venting was not clea . Step 3.26.5 instructs the operator to override all signals to all valves, including valves that will not be used. The step 3.2 does not clearly indicate which valves will by bypasse . Step 3.26.6 instructs the operacor to reset the Group II isolation signal. This is an unnecessary action to open the valves (step 3.26.7). The step 3.26.6 appears to be inappropriately located near

"

step 3.27.4, when the valve override signals are rer.ove . Step 3.5.1 instructs the operator to lift leads at an electrical bu The bus frame numbers were not listed in step 3. . Step 3.27.1 tells the operator to place a bypass switch in the NORMAL position. The switch is actually labelled AUTO-BYPAS '

. 5-Attachment B 2

'

6 .~ EPM 4.122 steps 3.1.1-3.10.5 are not required in E0P . When the EPMs are used in a real situation, they are signed and marked upon. The facility does not have procedures or processes formally in place to assure the manuals are restored to their original content af ter us Operating Procedures

< Flow Path 1 instructs operators to inject boron into the RPV using HPCI and RCIC, if available, on failure of Standby Liquid Contro The two procedures, 3450-E41-001-25, HPCI system, and 3450-E51-001-2S, RCIC system, were reviewed and walked down to assure the procedures could be performed, l Several plant labels were noted to be different from the procedure step For example, the valve 2G31-F106 (HPCI procedure step 7.4.8.9.1) is called the RWCU Precoat Pump Suction Valve in the procedure, but is labelled-the Precoat Tank Outlet Valve Z on the local pane . HPCI step 7.4.8.3 incorrectly lists 2E41-R612 as 2E41-K61 , HPCI step 7.4.7.10 incorrectly lists 2H11-P601 as 2H11-P60 . A comparison of HPCI to RCIC procedures identified several inconsis-tencies. RCIC step 7.3.9.8.13 lacked the statement "using one of the following valves" to agree with HPCI step 7.4.8.9.13. In the HPCI procedure, the 2C41-F034 valve is assumed to be a locked closed valve, while the parallel valve is not 1ccked in the RCIC Procedur The same logic step in HPCI (step 7.4.8.19) and RCIC (step 7.3.9.17)

sends the operator to different steps in the RCIC or HPCI Procedure The RCIC procedure (steps 7.3.8.14 and 7.3.9.14) has a note to turn valve power off, while HPCI procedure (steps 7.4.7.16 and 7.4.8.16)

does not have the same not . The HPCI procedure requires operators to throttle valves to initiate -

boron flow. Step 7.4.8.16 throttles 2E41-F041 while step 7.4.7.16 throttles 2E41-F04 . RCIC procedure step 7.3.8.8.5 does not list 2C41-F015 as a valve to throttle to maintain boron leve . RCIC steps 7.3.8.12, 7.3.8.18.1, 7.3.9.12 and 7.3.9.23.1 list the wrong electrical frame number . RCIC steps 7.3.9.20 and 7.3.9.21 list wrong steps to be repeate . The precoat level instrumentation was not- restored in HPCI step 7.4.8.25 and RCIC step 7.3.9.2 % O, Attachment B 3 1 Instructions were not found to flush HPCI/RCIC following boron injectio Flow Charts The most outstanding concern noted throughout the flow chart was associ-ated with plant labelling. Numerous discrepancies between wording end actual plant labels were noted, including: certain switch positions were described as OPEN-CLOSED, but actual positions are NORMAL-SCRAM in the control room; system designators for 2B21 switches are labelled as B21B in the control room; and uses the words suppression pool while the same items are called torus in the control roo Path 1 The statements "If installed" should be deleted from steps in Note 30, grid A-3 and grid J- . Pump 2E21-C003 is incorrectly listed as 2E21-B003 in grid F- . Steps in Note 16 are misnumbered (missing step 2.b). In Note 16, step A.1, change system I/II to A/ . Frame locations are missing in step B.1.b for locations of jumpers /

lifted leads to be installe . In Note 4, only the. TB1-12 termination has to be lifted to allow 2P70-F005 to fail ope . The numerical value the operator may have to read on analog meters is core precise than meter increments will allow. For example, 76 psig or 88 psig has to be read on the wide range pressure meter,'which has 20 psi increments on the meter scal Temperatures of 157 degrees or 58 degrees F have to be read on the suppression pool temperature ,

meter which has 5 degree increments. Reactor vessel levels of 31 I inches and 97 inches are to be read off a meter which has 10 inch increment If SPDS or the process computer are available, the l numerical values of the above readings can be observed in digital i form. If not available, the operator reading of analog meters would I result in approximate value l Steps in grids F-1 and H-8 instructs operators to install pressure gauges on either RPS rack, if necessary. The step appears unneces-sary since each rack already has pressure gauge meters installed on the i Step in grid C-8 instructs operator to close or verify closed valves without telling the operator the valves are operated locally only, i

l

- _ _ - - _ _ _ _

.s * '-

Attachment B 4 1 The NRC inspectors observed the operator searching to find specific diagnostic screens on SPD Adding the specific SPDS screen numbers to Path 1 steps that refer operators to diagnostic displays would aid the operators in an emergenc . Notes 3 & 4 do not include the CRD as per the PST . The Top of Fuel Level was not plainly indicated or easily determin-able on the Control Room recorde Path 3 Valves listed in procedure as "2T48-F026" and "2T48-F027" were on the panels as "2T48-M0V-F026" and "2T48-M0V-F027." 'This was found in other cases on Path . Grid 1-J, an example of an inconsistency was found in that various valves listed in the procedure (ie 2E11-F047, 2E11-F003...) have the number "2" at the beginning of the valve n (The "2" stands for Unit 2). The values in the above grid did not have the "2" in front of the valve number on the pane . Grid 1-K, procedure step states: "energize steam pressure reducing valve pilot solenoid 2E11-F051 by placing mode switch on"

-

The switch has open/close positions in lieu of as indicated in the procedure .

-

The switch is labeled as E11-F051,53 in lieu of "2E11-F051". Group 3E isclation valves 2C51-J004A, B, C, D are not labeled on the TIP drawer Path 4 Grid C4, the E0P flow chart instructs the operator to "Place switches for all stuckopen SRV's to open then close. This is inconsistent with Abnormal procedure 34AB-0PS-007-25, which does not call for this action. There is no close position on ADS SRVs, only "open" and *

"auto." Grid C-3, the SRV cycling sequence used in the E0P is not the same as the sequence specified on the SRV panel in the control roo Specifically, the "E" and the "H" SRVs are not listed on the control room pane _ __ _ _ -_-____ __-_-_ -__-_ _- ___ _-

c s a s

,

!

ATTACHMENT C Human Factors Ana1ysis Examples '

The following examples are provided to clarify the types of concerns identified in the eight areas of human factors concerns described in section 8 of this-repor These examples are not intended to be viewed as an inclusive list of all -such concerns found in the Planc Hatch E0Ps, but rather as examples of the types of inadequacies identified through the human factors analysi (1) Movement (Transitions)

(a) Excessive transitions ,

The Plant Hatch E0Ps were found to contain transitions so numerous that the resultant movement within and between procedures increases the possibility of error by operators exercising the E0Ps. For example, within any flowchart operators are required to (1) move through flowpaths that include extremely long flowlines between ,

columns; (2) scan the entire flowpath before beginning to perform actions in order to check for sequence insensitive steps; (3) move to the right and left sides of the flowchart to read notes and cautions referenced in the flowpaths; (4) move backward in flowpaths '

to monitor key parameter steps; (5) move backward in flowpaths to monitor path specific parameter steps; and, (6) move within and bet.een flowcharts and EPMs as directed by referencing and branching

instruction (b) Excessive number of transition methods Transitions are indicated through multiple methods. For example, EPM 4.40 includes seven different methods of directing transitions. No differentiation between the different methods is provided in the writer's guide nor are they clear from their use. Within flowcharts, movement is also indicated through the use of path-to-path arrows and directives within action step (c) Unclear transition methods Movement through flowcharts is directed through extremely long flow-lines, running parallel with other flowlines that do not share the

same destinatio No direction indication is given, and the lines are so close that it is difficci. to remain on the correct lin When different color flowlines run parallel, contrast is sometimes insufficient to aid in differentiating the two line .

.

i

,

--ern,- -e ,-, woe n------wv,.,e,awp---n -w--w - . - - ~~,y ..-,,.y4, ,.m,.m, _,,p , , , , . , ,_y4,. , ._ ,_e,, n ,

,..,,p.,_, _

-_

O * 4- ,

,

'

' Attachment C 2

'

(2) Decisions (a) Excessive number of decisions Within the Plant Hatch E0PS, required -decisions are indicated by two types of decision symbolt, along with sequence sensitive action

'

steps, sequence insensitivr action steps, notes, cautions, and logic ,

sequences within EPMs action steps and flowchart action steps. Within Path 4, approximately 40 percent of all steps require decisions. In

, addition, decision symbols on the flowcharts must be remembered and '

decision making repeated, should conditions chang (b) Inconsistent decision formats

'

The decision directives within these steps and symbols are written in inconsistent formats. In decision symbols, sometimes the decision is worded as a question, other times it is worded as a statement. Logic-terms such as IF, WHEN, and THEN, are used in the flowcharts in a manner inconsistent with that defined for use in the EPM (e.g., Path '

4, area 7-D). Not unly is this usesof logic statements within action'

'

steps on the flowcharts inconsistent with that in the EPM, but it '

'

fails to utilize the decision symbols provided for use in the flow-

,

chart (3) Memory Requirements (a) Excessive memory requirements The Plant Hatch E0Ps contain many steps that require the operator to remember step content for all or part of the execution of the procedur For example, all key parameter decision steps must be remembered while in the E0P system, that is, the flow chart and any EPMs referenced, in addition, all path specific parameters must be remembered throughout the path in which they are included. All sequence insensitive steps must be ;

remembered after an initial scanning, so that they can be executed at any time prior to their location on the flowlin Cautions and notes are ;

reported to often be used through m2mory alon (4) Cautions and Notes

<

(a) Inadequate format distinction between cautions and notes Because of the critical nature of information contained in cautions, it is particularly important that they be (1) properly emphasized to catch the operators attention, and (2) distinguished from the non-critical information contained in notes. In the Plant Hatch E0Ps, cautions and notes in the flowcharts are emphasized in exactly the same manne Within the EPMS, cautions are bordered on top and bottom by a solid line, in contrast to a dotted line used to encircle

'

l

- __ _ . _ - . _ , . __ _ - ., ,, , _ _ , ,~ ~

m

o- (

Attachment C' 3 notes. In neither case is the distinction between notes and cautions-considered adequate. In the flowcharts, placement of some cautions along the perimeter of the flowchart with the notes could also lead to them being overlooked by the operato (b) Incorrect content Cautions are ' intended to contain critical information relating to potential injury or equipment damage. Notes are intended to contain supplemental information that may be of use to the operator. Neither are to contain operator actions. Throughout the Plant Hatch E0Ps, cautians and notes are found to (1) contain operator actions (e.g.,

Path 4, cautions 17 and 20; notes 23 and 24) and (2) be mislabeled (e.g., cautions as notes; notes as cautions. See Path 4, cautions 1, 2, end 20. In addition, most cautions or notes containing cautionary information did not identify the potential hazar Also, relative to the problem of excessive detail in the procedures, some information included in notes and cautions was so basic that it appeared unnecessary to include in the procedur (5) Graphics Graphics methods employed in the production of the Plant Hatch flowcharts have contributed a number of problems. For example, print size on the mid-sized flowcharts is estimated to be approximately one-third of the minimum size required by application of human factors engineering princi-ples. The use of color is not only reported to be of no use to operators, but entails colors which do not provide adequate contrast and, in fact, make the flowcharts more difficult to read. Use of all capital letters not only is more difficult to read, but eliminates the use of all caps for emphasi The type of laminate used on the flowcharts causes glare, requiring operators to flex the flowcharts in order to read them. In addition as observed in the control room the reproduction quality of the EPMs was poor and in conflict with the Plant Hatch Writer's Guide and NUREG-0899, since the quality of the copies was not equal to the quality of the original (6) Sentence Structure Structure of steps within the Plant Hatch E0PS include a number of problems which contribute to difficulty in understandability, useability, and the excessive level of detail. In addition, these problems are generally in conflict with guidance provided in NUREG-0899. For example, many steps are written in an overly complex ~+ructure, including supple-mental phrases that are unnecessary for the ex utiun of the action (e.g.,

Path 4, section L-1, K-5, K-9, caution 17). Related to this issue, many ,

Plant Hatch staff indicated that complete sequences of steps within the procedures were unnecessary for execution of the actions require !

,

. - ^ - - , ev --e -- -,.- . _ . - ._ -

, _ .

_

~*.

g .Q Attachment'C 4 In conflict with the Plant Hatch Writer's Guide, imprecise adverbs (e.g.,

slowly, rapidly) and terms (e.g., as required, if installed) are used within the procedures (e.g., Path 1, sections K-16, B-14). Sentence structitre is also used inconsistently throughout -the E0Ps. For example, logic terminology is sometimes used incorrectly (e.g., Path 4, sections N-2,N-3). Sentences sometimes begin with the action verb, but in other cases the action verb is buried within the sentence or completely missing (e.g., Path 4, section K-2. Path 5, sections 0-1, D-3).

(7) Writer's Guide The Plant Hatch Writer's Guide does not provide sufficient nor adequately restrictive guidance to result in consistently prepared and revised, high-quality E0Ps. For example, the guidance provided in Section 8.3 for preparation of the EPMs and cover procedures contains guidance on general writing techniques. However, Section 8.2, Organization of Flow Charts, does not include guidance on the writing of individua.1 steps. As noted-above, this is a problem area within the E0P In addition, the guidance that is provided is in some places is vague and non-restrictive. For example, writers are directed to use language "such as," (go to), to indicate branching within an EPM. This lack of restriction has led to inconsistent use of multipic indications to the operator that a transition is to be made. Related to writer's guide inadequacies, the acronyms and abbreviations provided in the PSTG are not consistently applied within the E0P The nature of the Plant Hatch E0P system requires that ARPs, AOPs, and EPIPs be used during execution of E0Ps. The writer's guide does not provide guidance for consistent formatting, structure, and control of the entire family of E0Ps and related procedures. As currently managed, these procedures are not maintained properly for use during emergencies. Torn pages, missing tabs, and insufficiently emphasized binders make the ARPs, A0Ps, and EPIS inadequate for easy access and use by operator (8) Miscellaneous A number of miscellaneous inadequacies were identified in the Plant Hatch E0P system. Some are:

(a) Physical aspects of the cnntrol room and EPMs Current physical structure of the control room does not provide adequate desktop space for use of the flowcharts and EPMs, along with the satellite procedures required during their use. During simulator exerciscs, binders were piled upon each other and flowcharts were propped against the tabletop, promptly falling to the floo This condition could lead to delay and error during execution of the E0 . v= o Attachment C 5-The' binder used for the EPM is designed in a manner that results in part of the book sitting on-top of a telephone in the control room, which is awkward and could-lead to problems in using the procedure In addition, the EPM binder-in its current form includes two sections which open backwards and include sections that are numbered back-wards. This is in conflict with common Western use and experience and could-lead to delay and erro (b) Acronyms and abbreviations, in addition. to- deviating from those listed in the PSTG, were used inconsistently throughout the E0P ,

(c) References to the flowcharts were inconsistent, ranging from "the flowcharts" to "31E0-E0P-001-0S."

(d) Placekeeping spaces provided in the EPMs were placed on the right side of the steps, rather than at the step numbe When a step is longer than one line, this method could lead to confusion abou exactly which step had been ,erforme (e) The writer's guide lacked a sufficiently complete list of approved action verb (f) Yes/no exits from decision symbols on the flowcharts were incon-sistently placed.

.

1