IR 05000341/1987030
| ML20236J908 | |
| Person / Time | |
|---|---|
| Site: | Fermi  |
| Issue date: | 10/06/1987 |
| From: | Berkman D, Guthrie S, Haughney C, Hunter D, Miller L, Stefano J NRC, NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD), NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV), Office of Nuclear Reactor Regulation, PRISUTA - BECKMAN ASSOCIATES |
| To: | |
| Shared Package | |
| ML20236J870 | List: |
| References | |
| 50-341-87-30, NUDOCS 8711090022 | |
| Download: ML20236J908 (27) | |
Text
{{#Wiki_filter:'
, .: . OFFICE OF NUCLEAR REACTOR REGULATION p . F DIVISION 0F2 REACTOR INSPECTION AND SAFEGUARDS Report'No.: 50-341/87-30
Licensee: Detroit Edison Company ,. 6400 North Dixie Highway Newport, Michigan 48166 ~ Docket No. : 50-341 . Facility Name: Enrico Fermi Nuclear Power Plant, Unit 2 ' Inspection Conducted: July 27 August 7, 1987 Inspectors: A_ /8!6!B7 ^C. E Haug ey, A n l Chief Date Sfigned Special In I ecti inch, NRR, Team Leader > QAJ /d 4
- D; RfKunter Pr
{'SectionChief Datte 6igned lNY$1whv.es labbt? "S: CT/Rittri Sen' Resident Inspector Dat(Sfgndd Big Rock Poi I , d4A l0 T7 /J.(J.$,NRR toNFC7 tifan S roject Manager Dat/pgndd er
"L.' 4Tlle BWR n ructor DatfS/gned Tec cal T nin ~ enter, AE0D
/0 b _ B~egm'an,~ ~C 4su1(any, Prisuta-Beckman Associates Date/Sfgned ' "D: Accompanying Personnel: T. E. Murley, NRR; A. B. Davis, RIII; R. W. Starostecki, NRR; E. G. Greenman, RIII (Team Advisor);
- W. G. Rogers, RIII;
- M.
E. Parker, RIII; j
- H.
J. Miller, RIII; *P.
J. Maclean, RIII;
- H.
A. W iker, RIII q E /0 N Approved By: I
- C.
Haughn 7, Chief, Special Inspection Branch, NRR Datf S/igned % '
- Attended Exit Meeting on August 7, 1987.
J e7i1090022 g h 4i PDR ADOCK pga O . i - __ _ _ _ _ _ _ _ _ _
- - _ _ _ _ _ _ .J ' . , t E s . L PURPOSE AND SCOPE j During the period July 27-August 7, 1987, a six person team performed an Operational Safety Team Inspection (OSTI) at the Fermi site.
The inspection team was comprised of persons not directly associated with the Fermi-2 project, having the objective of obtaining an independent view of the facility's opera-tional performance.
Because the licensee's performance during an unmonitored, uncontrolled mode change incident on June 26, 1987 exhibited similar weak . operational controls that were a cause of concern during a premature criti-cality event in 1985, this inspection emphasized in plant observation of routine operational activities and startup testing in an attempt to evaluate the licensee's capacity to safely operate the facility.
! The inspection team was comprised of experienced, operationally-oriented staff l and contracted inspectors who were not previously involved with events at the facility.
Team members spent an estimated 150 inspector hours observing > control room and in plant activities of licensed and nonlicensed operators.
In addition the inspectors conducted interviews with operations, management, and staff personnel, toured all areas of the facility, examined the interface between operations and other departments, observed managerial involvement and effectiveness, and conducted an extensive review of logs and records.
The team examined the role of the Quality Assurance (QA) organization to evaluate their effectiveness in addressing new and previously identified problems. The I team also reviewed the corrective action process and the effectiveness of the licensee's surveillance activities.
An historical review was conducted to familiarize team members with previously identified problems and to aid in i an evaluation of the effectiveness of several licensee programs that had been developed to correct operational deficiencies.
Although the team reviewed the i licensee's program in each of the areas of inspection, the team deemphasized the programmatic aspects of a given area in favor of a practical, operationally oriented perspective that was intended to show how an identified weakness might impact the licensee's ability to safely operate the facility.
' 2. SUMMARY OF SIGNIFICANT FINDINGS ! The team's findings disclosed no new, significant programmatic or managerial deficiencies which, if remedied, would dramatically improve the licensee's __ ability to safely operate the facility.
The findings substantiated those j presented in other NRC inspection reports and those previously identified by - the licensee, and expanded on those findings by providing examples of how an identified deficiency would cause or contribute to an operational error or event.
When discussed with the licensee, the team's findings were presented in a manner attempting to show how material and administrative deficiencies combined with certain operational and managerial practices to produce J disappointing performance.
In many instances the team determined that a ) finding had previously been identified by the licensee and was in some j instances being addressed voluntarily, although the thoroughness and effective-i ness of those efforts were at times found to be insufficient to produce prompt, l positive results.
Major findings included: l Operators did not appear to understand the use of the Technical Specifications (TS) as a " working" document by being intimately familiar with requirements for operability of systems and time limitations.
Operators appeared to have a good
classroom knowledge of the TS but appeared to have difficulty identifying and j complying with its many requirements.
The operations staff did not use the
Fermi licensing staff as a resource for TS interpretations.
! -1-l l l _-_______________a
-- 'vr' , . ,. . . Operations had a production orientation that regularly resulted in the licensee taking the path of least resistance in resolving adtrf nistrative and material . problems which had the potential to delay progress toward commercial operation.
Examples included a failure to administratively process temporary modifica-tions, the extensive use of temporary changes to procedures, a reluctance to initiate hardware changes as a part of corrective action and performance of technical reviews of deportability questions by operations personnel without involving the technical support staff.
The licensee paid insufficient attention to certain administrative aspects of i plant operation, including temporary modifications and caution tagging systems j intended to show the operating status of equipment.
> l The operators' generally good knowledge level did not always translate into the l broad understanding of system interrelationships necessary for a " big picture" ' grasp of integrated plant operation.
The team regards this weakness as a major contributor to the human errors the team observed in the control room.
Although many of the operators had a naval nuclear background, commercial BWR experience among shift crews was minimal.
For this reason, operators did not have a reference point gained from operating a safe and successful BWR that j would make them aware of the requisite high standards of performance required
in nuclear operations.
' The licensee continued to encounter difficulty with the surveillance program.
The licensee's plans to minimize missed surveillance remained unfulfilled after several attempts.
Earlier efforts to address this deficiency had not been effective, apparently because of a failure to devote sufficient resources < to program improvements.
Successful surveillance performance was complicated by temporary modifications and temporary procedure changes, resulting in continued high error rates.
The team considered the site QA program as a strength, although QA at times l failed to grasp the fundamental causes of problems and instead emphasized ! statistical tabulations.
Corrective action too often involved on-the-spot l procedure changes without addressing generic issues or pursuing a diagnostic approach to deficiency resolution.
I ~ The Deviation Event Report (DER) system that formed the heart of the opera-l tional corrective action process was found to have limited depth in the ' associated root cause analyses.
The team found evidence of nonconservative or j deferred corrective actions in several narrowly focused DER evaluations. A reluctance to delay the startup process was evident through the emphasis of l administrative corrective actions when a hardware problem was involved.
This
weakness in implementing the DER system was disappointing, for the system i itself appeared to be capable of developing and implementing effective problem resolutions.
Based on an examination given to operators by the licensee as a result of the mode change incident and on interviews and observations, the team concluded that operators were not fully knowledgeable in the duties and responsibilities of their individual positions.
Operators, instrument technicians, and maintenance personnel did not seem to grasp the significance of how their actions had the potential to place the plant at risk.
I .g.
f l - - - - _ - - - - _
.~r .,. ' s . . . Six significant events occurred during the inspection period which provided an opportunity for team members to observe operator actions.
In general, the team found examples of operator inattentiveness, instances of unfamiliarity with equipment and system operating characteristics, and the absence of a question-ing, problem oriented attitude that asked "what "" questions in an effort to identify and prevent problems.
Failure to follow proceauces and ineffective communication also contributed to the observed examples of poor performance.
The team found evidence of poor communications between management and shift personnel.
A perception of management unresponsiveness, little one-on-one < exchange, and the workload demands on management time all contributed to the communication dysfunction.
Management was visible in the control room regularly, but the thrust of these visits appeared to be to obtain plant status ] rather than to communicate meaningfully with the shift personnel.
] l Regulatory improvement programs developed in response to previous problems i had only been partially implemented, with certain key aspects of the plans incomplete or orphaned.
Some plant performance indicators showed little improvement, indicating the programs have had limited positive impact.
The team stressed to the licensee that as a result of this inspection no new programs should be undertaken, but rather that sufficient managerial involve-ment in the present plans was warranted.
Management has not been successful at clearly conveying the goals of the various remedial programs to operators in terms of specific expectations for individual performance.
Plans have existed since June 1986 to integrate individual performance into the annual performance evaluations, thus relating performance to paycheck.
At the time of the inspection that new approach had not yet started.
All plant der.artments, including operations, are struggling in attempting to use the estimated 6000 procedures at the facility.
Although first identified
as a major contributor to human error and production delays in 1985, limited progress had been made in streamlining administrative controls. The licensee's newest target date was December 1988.
The team also noted & change in disciplinary policy that emphasized personal accountability.
This change was too recent for the team to assess its impact., ) __ but the team felt the change reflected Fermi management's seriousness toward { achieving excellence in nuclear performance.
3.
OPERATING PRACTICES During the inspection the team members spent considerable time observing g operators in the control room and the plant with an emphasis on practical individual performance.
The following observations are presented as an observed sample of both good and bad operational practices.
Additional
examples of operator performance can be found in Section 10, Events, a.
Shift Relief and Turnover Shift turnover discussions were thorough and involved the expected review of logs and panel walkdowns.
In contrast, formal written turnover sheets < were conspicuously absent; instead operators made notes on scratch paper.
s-3-
_ -__.-_ _ __._____-__ s
l ,,. d E, j ,;
This practice, combined with an observed lack of operating log detail, contributed to operators being uninformed about some plant conditions.
, One example involved an operability question of the Channel D Intermediate Range Monitor that spanned three shifts.
Turnover among operators for i short-term relief was particularly thorough, approaching the level of l detail seen in the full shift turnover.
b.
Communications Use of abnormal lineup sheets was considered a positive practice, as was j the practice of radio control of system lineup changes between the control l room and plant operators.
However, despite a comprehensive communication practices manual and heavy radio use, radio communications rarely featured , a "readback" by the operator receiving the transmission to ensure complete l and accurate receipt.
Generally, operators verbally informed others in j the control room of each action taken that could affect the plant.
) I c.
Annunciators l Followup of control room annunciators was erratic.
During periods of high ) annunciator activity, such as instrument surveillance and power
maneuvers, operators routinely cleared annunciators without investigation ! and occasionally without looking to see which annunciator was alarming.
l Operators seemed distracted by " nuisance" alarms on the annunciator panel, noting the danger of receiving one of the frequently alarming annunciators simultaneously with a legitimate alarm that might be inadvertently cleared or even ignored.
d.
Distractions ]
0'perators were faced with many avoidable distractions which unnecessarily I drew their attention away from the plant.
Examples included phone inquiries to obtain plant condition information or to locate plant person-nel not normally assigned to the control room.
Control room decorum, including access limitation, was generally good.
However, during day shift briefings by Shift Supervisors, excessive j - congregation was observed despite management directives limiting conges- ) tion.
l At the time of the inspection, the Control Room instrumentation contained ) approximately 130 items in the Control Room Information System (CRIS) designed to alert operators to off-normal instrument status.
The inspectors considered this number to be unnecessarily large and burden- ,
some.
l e.
Operator Knowledge l ' Operators were making a diligent effort to keep abreast of equipment condition and expand their individual knowledge of equipment characteris-l tics and quirks.
However, the limited experience at an operating BWR l combined with the complex phase of the startup test program have left - operators with the considerable challenge of becoming intimately familiar I with the plant's operating characteristics.
! l-4-l _ - _ _ _ _ - _ _ _ _ - _ - _ _ - _ _ _ _ -
..
- - .. , nWl.,:;&,.4 4 fy i, ,; ' s 3s, g , -, - ,,, , -l , lll/,' ~ < u c.
'During some of~the evolutions, the operators demonstrated strong knowledge- !by anticipating an alarm and announcing it in advance to others in the- !' control room.' In'other instances, however, operators appeared surprised by what should have been an expected alarm.
f.
' Shift Management =
Inspectors observed dramatic differences in the conduct of operations ! between the different operating shifts that in part reflected the dif-ferent management styles of the supervisory personnel.
The team observed a difference,in the involvement and direction provided to operators by the Nuclear' Assistant Shift Supervisors, as well as differences in the quality of the shift briefings held by the Nuclear Shift Supervisor.
Both in their review of operating events and in observing events which occurred j during the inspection,. the _ team noted extremes in performance for'a given shift - i crew.- For example, one crew prevented a plant trip-on loss of the recircula-i ,> tion pump on one day, prevented a trip resulting from operator error during an instrument surveillance on the next day, but then on'the following day allowed the uncontrolled mode change incident to occur.
The inspectors observed conflicting examples of-the use of common ser.se conservatism in the conduct of activities.
One shift suspended a control rod pull to conduct shift. turnover, but another shift commenced a complicated instrument. surveillance procedure ' i just before. shift change.
.The team felt that the two shift advisors could have been more effectively used.
The Shift Operations Advisor (SOA) appeared to be a valuable researcher as an operational event unfolded.
However, the 50A'could have been more effectively < used had he been heavily involved in the evolution bef ore it turned into an event.
The Shift Technical Advisor (STA) appeared _to be a valuable resource , for trouble shooting surveillance procedures.
The team concluded that the STA
could perform an additional valuable function by identifying in advance of an ij evolution how the' operator was likely to get into trouble and incorporating .j that. knowledge into pre-activity walkthroughs and briefings.
l 4.
ADMINISTRATIVE CONTROLS i l Throughout the inspection, team members observed the implementation of i administrative controls in the operation of the facility. The following i - findings are presented.
While the classroom level of knowledge of the TL appeared high, the operating I staff did not seem to gre the use of the TS as a working level adminntrative l document.
The operators did not regularly use th expartise of the Fermi
licensing staff, and too often interpreted the surveillance and operability
requirements and limiting conditions for operation in a nonconservative direc-
tion that least affected progress toward full commercial operation.
The interpretation of the one hour requirement to commence shutdown during the I leaking feedwater event discussed in Section 10, Events, is an example of I this nonconservative approach.
The team's review of Licensee Event Reports ) and Deviation Event Reports (DERs) lends support to the conclusion that a comprehensive understanding of the administrative requirements contained in the TS was lacking.
i ' -5-
- .i ;
" , . The plant staff paid insufficient attention to the source of the many adminis-trative support activities essential to safe nuclear plant operation.
The . team found: 1) component control tags that were used to identify valves; 2) calibration stickers on instruments essential to Reactor Protection System circuitry that had not been updated for as much as two years even though the calibrations had been performed; and 3) temporary modifications that were not properly controlled.
Temporary modifications evolved into long-term, semi permanent plant modifications, at times without benefit of the appro-priate engineering review.
For instance, a temporary modification on the Standby Liquid Control temperature monitoring function had been installed in November 1985, and included hand written instructions to operators on how to take readings using portable equipment.
Procedural requirements for extension of temporary modifications were generally not being performed.
One factor possibly contributing to the observed tendancy of the operating staff to avoid using the engineering function for technical issue resolution I was the apparent limited availability of engineers during off shift hours.
During interviews, plant operators expressed the view that the engineering staff was unresponsive and unsupportive.
In at least one instance the team was able to substantiate the operator's view that systems experts lacked a good understanding of the system for which they were responsible.
During investi-gation of the Main Steam Isolation Valve reset issue discussed in Section 10, Events, the inspector found that the cognizant system expert had a weak understanding of the circuitry.
The inspectors found several instances where the administrative path of least resistance was chosen, with little regard for whether that choice contained j potential pitfalls that could place the plant at risk.
To avoid delays J resulting from staff reviews of TS or deportability issues, the operations staff conducted their own review.
In a revision to a drywall close out procedure, the operators informed the team that use of information tags was chosen over an appropriate temporary modification to avoid the lengthy review process, and that an interim alteration checksheet was used because of ease of processing.
At the same time a formal change to a surveillance procedure was being processed, an STA was found to be processing a temporary change that would, in effect, allow the plant to pass the surveillance.
In another example, the operations staff performed a technical evaluation titled "RWCU (reactor water cleanup unit) ISOLATION NON REPORTABLE ISSUE NON REGENERATIVE HEAT EXCHANGER HIGH EFFLUENT TEMPERATURE, REVISION 1", designed to justify not - reporting a RWCU isolation as required by 10 CFR 50.72 and 50.73.
The evalua-tion failed to meet the requirements of Standing Order 87-14, Revision 1, which defined the process for preparation of a technical justification for not reporting an Engineered Safety Feature (ESF) actuation.
The standing order required review by the Technical Engineer, Operatiens Engineer, and approval by the Onsite Review Organization.
The team found this evaluation to be inade- < quate, incorrett, and not performed in accordance with the standing order.
Duplicate and uncontrolled logbooks and indexes existed.
The duplicate logbooks and indexes had the potential to create confusion, to complicate plant operation, and to encourage plant personnel to ignore one or more of ' the logs.
The use of uncontrolled documents in the control room could provide incorrect information to the operator and could contriLute to erroneous action.
Examples of duplicate logs included: -6- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
- .
- a
.(. >
a.
The operators were using two versions of the computer Input /0utput index (EF2-64329): Revision B, November 14, 1983, and revision F, June 8, 1984.
b.
They were using two versions of the Technical Specification to Surveillance Cross Reference, one an early version stamped "For Information Only" and labeled STA/SOA COPY, the other a computer printout.
The computer printout was the version that was currently undergoing a line item check to ensure that all TS surveillance requirements were met and was the version that was reported to be 90 percent accurate (as discussed in Section 6, Surveillance Testing).
c.
There were two Red Tag and Abnormal Lineup Index bnoks, one kept in the tagging center and the other kept in the control room.
The control room " copy was supposed to be used for reference purposes; however, the control room copy has not been kept up-to-date, since its last entry was May 30, 1987.
l L The inspectors found multiple instances of failure to administratively maintain procedures used in the control room.
Log books were often found to contain outdated procedures as a reference, and controlled copies of some procedures were not current.
Examples include the biweekly hours log and the alarm defeat index.
Problems with logs and records were compounded by the lack of review i and audits, which were required by the procedures.
The team found inconsistent requirements for the reviews and audits.
For example, the Operations Logs and Records (21.000.02) procedure step 15.2 required a monthly audit of defeated alarms, while the Main Control Annunciator and Sequence Recorder (23.621) procedure step 3.8 required a weekly audit of defeated alarms.
The inspector reviewed the process of defeating control room alarms and noted that not all alarms were defeated according to the Main Control Room Annunciator and Sequence procedure (23.621).
The inspector also noted that there was a i conflict between procedures 23.621 and 21.000.02 concerning the type of tag to be used when defeating an alarm.
Additional examples of failure to maintain logs and procedures were found during a review of the temporary modifications log index (12.000.25) which showed that the required temporary modification renewal forms did not always indicate that the modification renewals were completed in a timely fashion and , that some renewals had been missed.
Temporary modifications 85-0244 and 86-0135 were examples of temporary modifications which did not have the ~~ renewals authorized in a timely fashion.
Temporary modification 85-0244 was an example of an existing temporary modification that had renewals missing as well as an example of a temporary modification installed in the plant that was overdue for permanent processing.
The inspectors found examples of apparent misunderstanding among operators of ' the reason for specific administrative controls.
During the review of the Tagging and Protective Barrier System procedure (12.000.12), the team found that information tags had been used incorrectly for personnel or equipment protection, in place of temporary modifications, and as valve identifiers.
The index showed numerous examples of long-term information tags.
While on plant tours the team found information tags that were filled out with only a valve number written on the back of the tags and no explanatory information, implying their use as a component identifier.
-7- _ _ ___
_ _ - _ _ _ _ _ _ 4 l,i-.,1
' 8ecause of the number of system drawings posted throughout the plant and the
probability for their use in day-to-day plant evolutions, an inspector reviewed i' the Operator Aids procedure (EF0 8080).
The NSS was asked for the operator i aids index and did not know there was an applicable procedure.
Of the opera-j tions personnel on-shift at time, only the SOA knew of the existence of the procedure, but no one could locate the index.
The index was found the next day and contained only one entry dated July 29, 1986, _ although numerous drawings were posted throughout the plant.
The index did not indicate that any of the monthly reviews had been conducted as required.
Discussion with several control room personnel and personnel outside the control room showed that in some cases, the system drawings located in the plant stamped "For Training Use Only" were used in the day-to-day operation of the plant.
An operator aid l consisting of a band-drawn RWCU valve manifold on silver tape stuck on a j stanchion was noted on a tour of the plant.
5.
PROCEDORES The inspectors examined the use of procedures to determine their quality and accuracy.
The following observations resulted from this examination.
a.
Procedure Change Processing.
Many activities at the facility appear to be encumbered by the estimated 6000 currently effective site procedures.
The massive volume of proce-dural requirements helped foster confusion and made compliance difficult, j The administrative burden was presented in the 1985 Reactor Operations q Improvement Plan (ROIP) as being a root cause for the; July 1985 premature j criticality event.
The licensee estimated that the ongoing effort to j consolidate and streamline procedure control was only about 10 percent complete and was assigned a new target' completion date of December 1988.
Procedure revisions that directly affected plant operating schedules were processed promptly, at times with minimum support or review organization involvement.
Revisions that would enhance the long-term quality of the i procedure, but' that were not essential to maintain a production schedule, i were routinely delayeds l Procedures generally had too many revisions, making it difficult for the individual trying to follow the steps to ensure full compliance with -~ procedural requirements and to perform the steps in sequence, The significance of this observation centers on the fact that these revisions were separate pages that were not directly integrated into the text of the basic procedure.
A notable example was the procedure used during hydrogen recombiner troubleshooting and testing in which the individual using the document was required to jump back and forth between nine pages < of revisions and eight pages of original procedure.
The potential for continued human error resulting from this type of procedure change practice appeared tremendous, ' b.
Operator Confidence and Use Despite the large number of procedures, many that directly affected the operations staff were perceived to be inadequate.
Operators indicated , l that while the quality of procedures had improved dramatically during the startup test program, they still did not have full confidence that the ~B- - _ - _- _ __ __ N
, - - - _ - -. _
' , ' !
l procedure they were using to conduct an evolution would <:ontain all the j guidance and requirements necessary to successfully cornplete the task.
The historical documents reviewed and the events observed during the inspection indicated that the operators did not always have a full appre-ciation for the safety implications of procedural compliance.
The team observed operators using the wrong procedure, departing frem the step i sequence, and not recognizing prerequisites.
) . 6.
SURVEILLANCE TESTING The licensee has had a recurring history of problems implementing their sur-veillance program.
On May 14, 1987, the NRC issued a civil penalty for j surveillance related violations.
On May 23, 1987, the licensee reported via LER No. 87 019 another TS surveillance, Standby Gas Treatement Carbon Dioxide Fire Protection Test, that had not been performed as required.
As a result, the licensee had begun several actions to identify and correct surveillance program deficiencies.
The inspector reviewed selected portions of the surveillance program implementation and the status of selected aspects of the i corrective actions.
In reponse to LER 87-019 mentioned above, the licensee. committed to verify: 1) that procedures were available and responsive to each TS surveillance requirement line item by July 31, 1987; 2) that the TS procedure index would j be verified accurate by August 31, 1987; and 3) that an independent sample
verification of these activities would be conducted during September 1987.
The i inspector discussed the status of these corrective actions with the cognizant Surveillance Engineer, j As of August 3,1987, the TS Procedure verification required to be completed by July 31, 1987 was less than 50 percent complete.
Of 417 review packages, 20 had been completed, about 50 were awaiting supervisory review, and about 200 l hed been rejected by supervisory review and were under correction or resub-mittal for review.
Licensee personnel indicated that this project had not been I given high priority and resources were otherwise dedicated to support plant availability and other priorities.
The inspector was unabis to obtain a firm j completion date.
To the extent that the inspector could determine, NRC ' - Region III had not been advised of the missed commitment date.
i The licensee had identified no functional problems in the packages reviewed to date.
The typical discrepancies identified involved scheduling problems with surveillance having a frequency of one week or less, incomplete procedure ( purpose sections, and previously identified omissions and errors in the j index.
j The inspector selected a sample of 15 TS surveillance requirements to: 1) confirm these requirements to be in the licensee's Plant Operations Manual (POM) TS procedure index (POM 7067.13-37-50.00001'); 2) verify that the proce-dures listed in the index satisfied the TS requirements; and 3), ensure that q the procedures had been performed at the required frequency.
The team witnes-sed surveillance tests in progress and reviewed completed surveillance data for selected procedures.
) g i
-. , , . , .i .
, ' . ,;
a.
The inspa-tor identified one discrepancy with respect to testing of ] . Reactor Water Cleanup (2WCU) engineered safety feature isolation func- ,l
l tions.
The TS procedure inde.x identified POM 24.139.03, SLC Manual } [ Initiation and Storage Tank Heater Operability Test, Revision 6, as j satisfying the requirements for the TS Table 4.3.2.1-1.2.d 18-month < ! Channel functional Test of RWCU Isolation on Standby Liquid Control (SLC) } initiation.
The subject procedure did not include this requirement in its ! stated purpose nor in its acceptance criteria although the procedure -{ did verify that the appropriate RWCU isolation valve closed when required j during the pump test portion of the procedure.
The inspector noted that ' this procedure had not yet been reviewed by the review program described above.
) i Although POM 24.139.03 was applicable to both the A and 8 SLC pumps, each pump had a separate isolation initiatirg slave relay that fed a common i RWCU isolation circuit as depicted on Drawings 61721-2131-1, Revision G, l and 61721-2265-3, Revision 1.
As permitted by TS 4.1.5, the pump tests I of POM 24.139.04 provide that only one pump was to be tested caery 18 months with both pumps tested every 36 months on a rotating basis.
Therefore, even though the test functionally satisfied TS 4.3.2.1, its frequency did not permit testing of 'ooth individual pump slave relays every 18 months.
On August 3, the cognizant System Engineer advised the inspector that, based on treatment of the RWCU/ SIC function as a single channel by TS 3/4.3.2.1, testing the common circuitry and only one pump relay each 18 l ' months satisfied the requirements of TS 4.3.2.1.
Discussion between the inspector and the NRR licensing project manager determined this position to be incerrect.
. The inspector reviewed actual test data for POM 24.139.03 for both SLC i pumps on April 11-12, 1986 and determined that both circuits had been j tested within the required 18 month period even though the performance ! copies of the procedure did not include that test in the purpose or acceptance criteria sections of the procedure.
- Another observed problem was the extensive use of on-the-spot Procedure j b.
Change Requests (PCRs).
For example, POM 24.409.02, Div 1 Post LOCA l Thermal Recombiner 6 Month Functional Test, Revision 8, included PCR l T5371.
The procedure consisted of eight original pages and nine tem- , porarily inserted page changes.
This condition in combination with a poorly coordinated cross-reference to POM 23.409, the thermal recombiner system operating procedure, was believed to have contributed to poten-tially damaging the recombiner on July 31.
1 c.
Prior surveillance problems identified by NRC inspections and licensee
events included chronic instrument and control (I&C) personnel errors and human factors problems, equipment labeling and identification problems, and improper control of plant conditions and equipment availability.
Staff interviews and inspector observations indicated that improvement was beginning in these areas but not necessarily broadly or rapidly enough.
For example, interview results indicated that I&C personnel still had a tendency not to process on the spot changes for needed procedure discre-pancies.
-10- _ _ _ _
o- .. , g iL.[ e* >
.i ' 't I ' ' In sum: nary, the' licensee has continued to encounter difficulty in the control .j and accuracy of the surveillance program.' The licensee's action plans appeared L p' Jto be. adequate but have failed in timeliness and thoroughness of implementa- ! . tion.. The licensee does not'eppear to have applied sufficient resources nor corrected procedu're structural and cross-reference deficiencies which appeared to? be chronic problem contributors.
i: - 7. -QUALITY ASSURANCE ! L !
.The team reviewed the QA Program to identify specific activities associated 'with plant operations. The program included both an audit program and a production QA group that, performed surveillance and inspection activities.
The team reviewed audits, operations QA, and QC activities by examining procc-dures and by interviewing selected personnel.
In the areas reviewed, the QA I Program appeared to be acceptable.
The production QA group remained active.in quality issues by being a member of the~0nsite Review Organization (OSRO), attending daily planning meetings, and'
routinely participating in the Corrective Action Review Board (CARB) meetings.
l The production QA group was responsible for implementation of the QA Surveil-j f lance Program in accordance with Operational Assurance Instruction (OAI) 12, Revision 1.
The program c:onsisted of scheduled and unscheduled surveillance of plant activities. This program was considered a strength by this team, for it went well beyond regulatory requirements.
The'inspectorfreviewed CIA 11, selected Procedure Compliance Modules (PCMs) or checklists for surveillance, maintenance, and control room activities, and also the management control room audit plan implemented in response'to prior NRC concerns. 'The inspector found the program to be generally comprehensive in , the' areas addressed.
l ,The inspector also reviewed schedules and schedule performance for 1986-87.
About 450 surveillance (PCM items) had been completed during 1987.
The , inspector noted that recent attrition from the group had caused a rolling j backlog of about 15-18 overdue surveillance o'ut of tl.e 24 scheduled as of j August 9, 1987. The team expected that a recent consolidation of quality
- groups and the formation of a quality engineering organization will provide I a reallocation of resources and tasks that should improve this performance., ) , The production QA group and plant and operations management ccnducted periodic meetings to discuss program findings.
This practice indicated a reesonable level of management involvement and attention.
, J Based upon the team's review of the QA audit and surveillance programs, the team felt that the progran might be enhanced in three areas: QA's efforts to use technical expertise on audit teams should be increased.where possible to further improve audit scope and content.
j
The attendance of operations QA in certain safety-related meetings, such l as the CARB, OSRO, and daily planning and scheduling, should be required by management to ensure QA review at the earliest opportunity.
The j practice observed by the team was that QA's attendance at these meetings-11- _ _ - _ _ _ _ _
- .1. ; [ -
I was optional.
The identification and solving of potential problems as early as possible should provide an increased assurance of quality.
The QA audit and surveillance activities should be reviewed to ensure { thorough coordination with all groups and full program coverage and to i avoid unnecessary overlap.
' The inspector also reviewed selected QA surveillance deficiency listings for the period June 1, 1986 to May 31, 1987.
Monthly reports showing findings, summaries, and statistical trending of findings were also reviewed.
Review of
this data and discussions with QA managers resulted in the following observa- ! tions: o a.
The program categorized findings as "A" for acceptable, "A*" for meeting the intent of the audit characteristics but with some deviation or l comment, and "U" for unacceptable.
The items categorized as "A*" j significantly outnumbered those categorized as "U".
The inspector found that many of the "A*" items could be more appropriately categorized as "U" or unacceptable.
For instance, since August 1986, 22 "A*" findings were reported for matters involving control of operator overtime, which is a TS requirement.
Typical findings included overtime records not up to date and lifting of
overtime restrictions without approval.
Findings in other areas included ) failure to perform or document log reviews, missed procedure steps, and ) discrepancies improperly noted on surveillance performance forms.
The ' categorization of these types of findings appeared inconsistent because in some cases the findings were listed as "U" while in others "A*". Since the "A*" items were not tracked past immediate corrective action unless a significant trend was detected, additional attention may be needed to upgrade these findings to ensure that nonconforming conditions receive adequate attention, including action to prevent recurrence, b.
The licensee performed trend analysis of the surveillance results but this analysis appeared to be a mere statistical tabulation of finding counts, distribution, and closure in each functional area.
Although specific - findings were highlighted and reported as problem areas, the trend analysis did not appear to address finding specific subject trending.
For , example, it appeared that I&C surveillance findings were trended to the j PCM checklist characteristic level but that similar findings in other . relevant areas were not.
c.
The program concentrated on immediate corrective action while deemphasizing
analysis of the findings for generic and long-term preventive action.
The inspector reviewed several QA surveillance findings, noting that they , emphasized prompt procedural corrections and personnel training or counseling but did not address these broader considerations.
Examples include: } S-0A-87-0-296-01, Use of Inappropriate Measuring and Test Equipment.
} S-0A-87-0-235-01, Failure to Document Surveillance Performance and
Procedure Discrepancies on SPF.
S-0A-87-0-113-01, Inadequate RWP Implementation for Surveillance.
l-12-
. - - - - - - - - . ., ,
- g ai g==
1 - ? 1he inspector noted that ma_ny.of the QA surveillance findings were similar to problems identified as contributors to past operational problems, indicating . ' that the program _was identifying potentially significant indicators and precur-l sors. -For_this reason the team felt that the surveillance findings may not - have been given sufficient attention to identify and correct potentially l generic or chronic problems.
!
8.
CORRECTIVE ACTION PROCf:SSES i The inspector co'nducted a review of the Deviation Event Report (DER) process.
t DERs allowed any individual to submit a condition which was adverse to quality l for management' review and disposition.
DERs could be written for any safety- 'l related or non-safety ':.ted item, activity, or service.
A DER accepted for ' . , processing by the authe supervisor was dispositioned by the Corrective Action Review Board (CAhJ;, a subcommittee of the Onsite Review Organization (OSR0), during a biweekly meeting. The inspector's review of 125 DERs spanning' i the first-half of 1987, augment.ed by interv4ws with various plant personnel assosciated with the review and disposition of the DERs resulted in the following findings.
i a.
The events described in those-DERs reviewed by the team _ indicated multiple examples of failure to follow procedures, rumerous equipment failures both explained and unexplained, and multiple examples of inattention to detail resulting in personnel. error.
The accompanyir.g root cause evaluations.
i were found.to lack details describing the steps and bases for prescribed { corrective actions.
The. inspector found the evaluations to be narrowly j focused and to lack an evaluation of how the' deviation could otherwise adversely affect the plant, b.
Most corrective actions were found to be limited to procedural and administrative changes.
Hardware oriented solutions, when apparently - appropriate, were rarely initiated.
For example, DER No. 87-.129, "APRM Card Removed From Incorrect Div 41on During Surveillance functional Test", received no evaluation for a change to the cabinet even though both cards for both divisions were located in the same cabinet.
Although the proce-dure change prescribed appeared to be appropriate, this was a deficiency where some hardware modification seemed prudent to physically preclude a recurrence of a similar event in the future.
A second example, DER - ! 87-074, combined a ten 6ncy to prescribe an administrative solution with a i nonconservative corrective action.
The initial disposition of DER 87-074 j permitted operation of the High Pressure Coolant Injection (HPCI) turbine j with the set screws missing from the turbine to pump coupling key.
Loss
of this key would render this important piece of safety equipment l inoperable, yet operation was permitted provided strobe lights were i periodically used to verify the location of the key.
The set screws were subsequently reinstalled.
9.
SAFETY REVIEWS a.
Independent Safety Engineering Group (ISEG) The team reviewed the ISEG activities as they related to the overview of Fermi-2 operations.
The review revealed that the ISEG had performed a number of special tasks, including the detailed review of plant generated safety evaluations (SECS) and test program data.
The ISEG appeared to-13-
.. .
- M., '.
i ( l have done a credible job on these special tasks.
The ISEG activities ! would be enhanced by ensuring timely and thorough performance of the more routine tasks as well as the special assignments.
! The inspector reviewed selected internal ISEG reports that described the results of their special reviews and provided recommended actions to other g responsible elements of the Fermi-2 organization.
These reports were { quite detailed and provided ample evidence of the thorough nature of
ISEG's special reviews.
However, in some cases these reports gave the ] inspector the impression that other parts of the Fermi-2 organization were ! paying scant attention to apparently substantive issues raised by ISEG.
For instance, report ISES 87-004, June 23, 1987 described two matters involving deferred or incomplete testing for which rapid corrective action was apparently needed but was not being accomplished.
The first issue involved an apparent lack of functional testing for the core spray pump room fan cooler thermostatic start feature, and the second issue involved deferred flow balancing for certain emergency equipment cooling water system throttle valves.
When the inspector pursued both these issues with knowledgeable individuals in the testing and engineering departments, he i i found that the issues were being addressed and tracked with rt. ore thought and vigor than one could glean by mereij reading the ISEG report.
More significantly, the actual status of these issues was not well understood by senior Fermi-2 managers who were responsible for ISEG.
Although these ! managers were very busy and were concerned about large numbers of action items and recommendations from a variety of sources, the team was concerned that ISEG may have lacked sufficient clout tc foster the atten-tion needed to address its substantive issues, i b.
Onsite Review Organization (OSRO) ' The team conducted a review of the OSR0 charter and OSR0 associated activities.
Reviews of procedures and practices revealed that routine
daily OSR0 meetings were conducted, as necessary, in order to more effec-
tively manage the high workload.
The review of selected safety evalua- , tions (SECS) included with recent OSR0 minutes revealed that the SECS j could be improved in order to enhance the documented information provided ' to both the OSR0 and the independent offsite review committee, the Nuclear - Safety Review Group (NSRG).
SECS reviewed included the following: j SEC 87-0166 (HPSI Suction Transient) l SEC 87-0165 (HPSI 5000 gpm in 25 seconds) SEC 87-0162 (HPSI check valve replacement) ! SEC 87-167 (Defeat / Isolate RCIC Low Suction Trip)
The OSRO practices included the use of a walk-around and a telephone review process.
These reviews did not appear to meet the TS requirement i to conduct meetings as a committee with e quorum present.
The walk-around and telephone reviews did not provide the forum for personal exchange among committee members with different technical disciplines.
-14-
l
pg 77 , , -- - - - - - - , GNJQ V, , ,, _ _ I ' .I ., .
g~ Interviews-conducted and records' reviewed revealed specific, recent-e requests' for. special audits _ or reviews on ; behalf of the OSR0,. including , ,~ n maintenance,; environmentally qualified motor operated valves, and' valve c lineups.. The team' considered this practice of performing special reviews
.for.0SRO to be a strength.
Through re' view of1the OSR0 practices and discussions with personnel the.
. team noted that the 0perations Superintendent, who had not been licensed ' at the Fermi-2 plant and who attended OSR0 meetings,.was not specifically . provided. training regarding the Fermi-2 plant.
This' individual had been ~ , ' licensed and trained at:another operating boiling water reactor.
However, he.had not been trained on the Fermi-2 TS, license requirements, , . administrative procedures, and differences between Fermi-2 and his previous plant.
The effectiveness of the Operations Superintendent could be further enhanced through selected Fermi-2 specific. training.
c.
10'CFR 50.59 Safety Evaluations The inspector reviewed the licensee's safety evaluation process to deter- , mine compliance with the requirements of 10 CFR 50.59 and internal ! ' - facility procedures.
The inspection included a review of the procedure . developed by the licensee for performing safety evaluations, a review of safety evaluations and associated documents, and interviews with licensee representatives responsible for the administration, control. and assess-I ment of safety evaluations.
The inspector noted several problems which , have been experienced at Fermi 2 with plant' equipment and sought to j address the adequacy with.which the licensee: 1) has conducted the . ! requisite design reviews performed to resolve equipment problems; 2) has initiated plant modifications; and 3) has documented the basis upon which ' design changes have been implemented.
Safety evaluations were performed d in accordance with procedure NOIP 11.000.053, 10 CFR 50.59 Safety Evalua- .l tion, Revision 3.
This procedure established a two part safety review l process that included a preliminary evaluation to help identify.those.
l specific changes, lists and experiments that would be subject to a safety i evaluation and the safety evaluation itself.
The procedure also-identi-fied the activities or documentation to which the safety review process ! should be applied.
! I See al 10 CFh 50.59 se.fety evaluation files were randomly selected and rw1ewed to determine the quality, completeness and acceptability of the ) conclusions reached and to verify that an unreviewed safety question did not exist.
Topics reviewed by these safety evaluations included: 1) j design changes to correct equipment problems; 2) changes to preclude j scrams caused by incorrect operating and surveillance procedures; and 3) TS interpretations which concluded that a TS amendment was not required.
Safety evaluations reviewed included: ' 87-0107, Temperature Modifications
- 87-0114, MSR out-of-service l
87-0148, HPCI criteria exceeded 87-0165/0166, HPCI overspeed/overpressurization-15- . _ _ _ _ _ __- -__-____-
_ .; l.L., '.
Based upon this review, the inspector noted the following findings:
The purpose or intent of the safety evaluation was not always clearly described.
Responses to 10 CFR 50.59 unreviewed safety question checklists typically restated the question but did not document the process or basis upon which a conclusion was reached that no unreviewed safety question was involved.
The safety evaluations did not discuss how FSAR or TS sections referenced on the coversheet of the file were impacted by the proposed change.
The inspector particularly noted SEC 87-0165/0166 involving the HPCI overspeed and overpressurization events.
These events had high level management atten-tion and as such, the safety evaluation performed was more detailed and appeared to have been coordinated between affected plant organizations.
Even though these evaluations were more detailed and informative, responses to all of the unreviewed safety question checklist items were not complete.
From interviews with plant personnel involved with the preparation and review of safety evaluations there was general agreement that the quality of safety evaluations needed to be improved and better coordinated to ensure the com-pleteness and correctness of conclusions.
The inspector determined from these
interviews that safety evaluations were usually performed by the technical j support personnel within the plant operations organization, particularly where i TS interpretations were involved, and that coordination of those evaluations with the engineering and licensing staffs was not always accomplished.
Such coordination did occur for high visibility issues, such as the HPCI test problem.
In addition, the inspector determined that training programs had been ! developed to teach required performance and documentation for a safety evalua-l tion.
Opinions expressed by licensee persons who had received this training i about its effectiveness were mixed.
From the files reviewed, the inspector I concluded that this training has not produced the needed improvement in the
preparation of safety evaluations, j I - On the basis of the above findings, the inspector concluded that the overall l quality and thoroughness of safety evaluations was weak and that the licensee's i efforts to train staff in the performance of safety evaluations had not been ! entirely effective.
10.
EVENTS OBSERVED DURING INSPECTION l
During the inspection period, the team members observed eight events that occurred during the conduct of normal activities or surveillance testing.
The events ranged in severity from an isolation of the Reactor Water Cleanup (RWCU) l system to the reactor vessel coolant inventory being partially pumped to the ' torus.
One potential design deficiency was identified in conjunction with these events.
A brief summary of each event and the observed significant operating weaknesses identified follows.
l f-16- -
a:.1..,)* t a.
Containment Isolation Valve Leakage The licensee made repeated unsuccessful attempts to temporarily repair a shaft seal leak on a main feedwater check valve F-076B, which is also a containment isolation valve.
These repairs were attempted using an injected leak sealant.
During day shift on July 30, leakage from the ' shaft seal again increased in excess of TS limits during plant pres-surization'and heatup.
TS 3.6.1 requires that combined leakage _from all containment leakage sources be less than 0.6 la (leak rate at post-accident pressure).
The licensee's technical staff performed calculations intended to correlate liquid leakage from the valve to the equivalent air or vapor leakage rates allowed by TS 3.6.1.
The liquid measurements and calculations' indicated that this limit would be exceeded and; therefore, the licensee entered a TS action statement requiring correction within 1 hour or commencement of plant shutdown to operational condition 3 within the next 12 hours.
The
licensee then began immediate emergency repairs using the injected leak ' sealant in the hope the repair would be successfully completed within one hour in order to avoid the shutdown required by the action statement.
Although the licensee stopped the leak, the repair took slightly over one hour.
This practice illustrates the team's ccncern that the licensee's did not fully appreciate their obligations for stringent compliance with the TS.
Although the licensee did successfully reduce the leakage to , within required limits, the explicit requirements of TS to begin a plant-i shutdown within one hour were not observed.
+ With the reactor at about 3 percent power and reactor pressure raised to 875 psig, leakage from the temporary repair ' increased again during the ', evening of July 30.
The licensee began plant depressurization at about l 1:00 am July 31, in preparation for'further sealant injection.
The depressurization and eventual shutdown were begun by the Nuclear Shift Supervisor; however, plant management. initially wanted to maintain the . .. plant at power and attempt another temporary repair.
Valve leakage was i measured concurrently with these activities and an Unusual Event was declared at 2:20 a.m. July 31.
At that time the leakage was determined to > be approximately 4.2 liters per minute, which was in excess of allowable - containment boundary leakage.
The licensee commenced a reactor shutdown.
There were two cora11ary issues associated with the valve leakage that warrant discussion.
The first involved the choice of an injected leak sealant as a suitable temporary repair boundary for a containment isola-tion valve subjected to reactor and feedwater pressure.
During the several attempts to repair F0-0768, the team questioned the suitability i . and qualification of the sealant to perform this pressure boundary l function.
The team was concerned about the steam, temperature, and t radiation environments as well as material compatibility between the ' sealant and the valve materials.
The licensee assured the team that the ' sealant was qualified for this application.
When pressed by the team for objective evidence, the licensee wrote the sealant manufacturer requesting confirmation that the chosen scalant had been tested and certified to l perform satisfactorily under the relevant environmental conditions.
The
manufacturer responded by declining to certify the sealant as having been suitably tested to perform the intended nuclear safety function.
J-17-i
__.- - - . _ - -- _ - _ _ _ __ - - " +(;;%[L . .
- q,
' ' R < f ' j , n The secon'd'corallary issue involved the ordering of replacement parts to: . permanently: repair'the check valve.- Although this. valve had been causing.
leakage problems for several weeks, not all-the repair parts needed to repair,the valve-had been ordered when the leakage.was first' detected, rThis-oversight became known when senior licensee managers requested a-detailed-status of the back ordered parts, since the leakage had become i more troublesome.
l < Theseitwo issues illustrate the team!s perception that the licensee has been taking shortcuts while simultaneously neglecting more prudent and- ! traditional steps.to~ problem resolution.
Unfortunately, the quick fixes.
at times percipitated longer delays and reduced productivity.
! i This matter involvingTthe inappropriate use of the leak sealant is' further l discussed _in inspection' report 87-031, issued by the regional office.
b.
Reactor Scram During Shutdown t The inspector observed shutdown activities both in the control room and in ' .the reactor building.
During preparations for shutdown, the inspector.- noted that the Nuclear Assistant Shift Supervisor (NASS) was not exer-l cising agressive control and was not providing adequate direction to the a Nuclear Supervising Operaters (NS0) and the remainder of the shift crew.
When. asked by the inspector about his.somewhat passive involvement, the-l NASS' stated that he had sufficient confidence in the NS0s to adequately
complete-the shutdown.
Subsequently, the NS0s themselves repeatedly H called on the NASS to organize integrated shutdown activities, to stipu-late required procedures'and'the specific' methods to be used.
, The inspector further noted that the operators appeared to be uncomfort-I-able and unfamiliar with the control rod and plant downpower maneuver a required for a routine shutdown.
Difficulties were encountered with the
rod control program and rod inhibit circuitry tests at the 50 percent rod density condition. LThe operators appeared slightly. confused by the system , responses and had paused to research procedures and system technical-information when"other events = described below precipitated an automatic
scram, _ Although Operations Department management interviews did not indicate any
besitance toward routine down power maneuvers, there appeared to have been ' a history of manual scrams to complete otherwise routine shutdowns.
Also, for this specific event, management did discuss the advantages of manually scraming the reactor prior to reaching the end of the initial TS one hour action statement-in order to avoiding entry into conditions which, by i licensee emergency response procedures, would have required declaration of an Unusual Event and the attendant off site notifications.
This point became moot because the Unusual Event declaration and notifications were
made in the interim.
j While reducing reactor power and pressure, feedwater flow oscillations in j response to varying steam flows and reactor water level produced a reactor j scram at 3:14 a.m. on intermediate range high neutron flux.
Based on a l-description of the event by the involved operators, the difficulties in controlling feedwater flow appeared to have resulted from a combination of startup feedwater control system design and tuning.
All safety systems-18- - _ _ _ - _ - _ _ _ _ - _ _ _ _ _ _. _-. _ _. -
.,',0..,*, !
responded normally, and no emergency core cooling system (ECCS) actuations occurred.
The licensee notified the NRC headquarters duty officer, state, and local officials of the Unusual Event and scram; and the Unusual Event was terminated at 4:04 a.m. following plant stabilization and initiation of a normal plant cooldown.
The licensee completed a normal plant cool-down and planned to complete permanent repairs to the leaking check valve.
c.
Security Event At about 1:30 am on July 31, a routine security patrol found that the containment airlock door was improperly padlocked such that operation of the airlock doors was not inhibited by the locks and chain.
The last entry into containment had occurred earlier on dayshift for a routine inspection following plant pressurization.
Licensee administrative procedures required closure verification by operations, health physics, and security personnel, all of whom had :;eparate padlocks on the chain but .none of whom noted the error.
The door was properly relocked at about 1:45 a.m. and was verified locked by the inspector.
d.
Reactor Water Cleanup System (RWCU) Inadvertent Isolation Early on the evening shift on July 29, with the plant critical at about 150 psig reactor pressure, operators were attempting to restore the RWCU system to service.
The licensee reviewed the event and interviewed operators during the shift and, at about 11:00 p.m. advised the inspector i that the isolation had occurred due to use of the wrong procedure.
' P0M 23.707, RWCU system operating procedure, section 4.16, placed the RWCU q in service with the reactor vessel above ambient temperature and pressure , should have been used for this evolution.
Instead, the NS0 had ] inadvertently selected section 4.1 of the same procedure which applied to a cold reactor vessel conditions.
The licensee concluded that the error was caused by operator misidentification of the proper procedure.
The lack of a pre-evolution briefing and lack of communication between personnel further contributed to the event.
In the inspector's view, NASS involve-ment was less than desirable in that he neither caused such a briefing to _ take place nor did he personally confirm or supervise the evolution.
At the close of this inspection, the licensee was formulating a corrective action plan for this and the related Shutdown Cooling System misalignment event described below.
Preliminarily, the licensee expected to issue a set of specific guidelines for the conduct of system and plant level evolutions which would be responsive to the lessons learned from these events, including more formal pre-evolution briefings and dry runs, more
intense supervisory involvement, and improved oral communications.
The licensee was also reviewing individual operator performance.
e.
Overheating of Reactor Feed Pump (RFP) Seal Injection Pu_mg m On July 29, the West RFP Seal Injection Pump was found to % running very hot, apparently steambound.
When shutdown the pump stopped abruptly with little or no coastdown, and steam emitted from the casing vents when they were opened.
-19-
.,,f:<. j, Y/
-y 4
< . *, 'b n The RFP seal system was equipped with filters $ar/d ; temperature control q <o 'i F ..('? valves for'each RFP.
Licensee investigation found that one set of filters j L had been redoved from service for maintenance,' eliminating one system flow ' I: , f path.: Concurrently,thetemperat'urecontrol<valveinthaotherflowpath gj was closed.due to low temperatures because of lon Jnjecthn flow demand, ! .thereby shutting both. injection paths witho6t a puup recirculation or l ~ I other flow path available.
The pump was 0110wed toccooldown, was visually.
inspected by' plant operators, and was successfully bestarted.
< a j s < , , Thiseventappearedtoillustratethelicensee'srecurringhistoryof 'equipmentproblemsresultingfromstaffinexperienceandlackc3at%,ention y,' j ' j a "j , to changes in system and plant conditions.
> ~' l, 0 7'q ,f ,6 ShutdownCoolingMisalignment-Level 3ScramandIsolatMontg/,r g<d ('e
- f.
< v m a s ta s ,, At 11:07 a.m. on' Adus1' 2,1987, a reactor le' vel 34eact/ir scram wp .\\
- !
i, received along with the associated automatic nucleanstham< supply sWtoff ' ~ isolations.
The reactor was in cold shutdown with'alh pods fully inserted M l' ) at thectime of the event.
The reactor scram sigriai'was a result of operator' error causing reactor coolant to be diver %d from Divisich II of - a l
- residual. heat removal (RHR) in shutdown cooling m[e, fthrodg6 the, Ohision l
I RHR pump suction valve to the torusl' Th6 Jicens'ee was in en process of ' filling land venting the Division I RJi1 rlyst'emjn 97eparation for switching ' shutdown cooling to Division I.
T% event wasscaused by petunnel error-l I .due to an improper valve alignmes of-the suction valven & aptop vessel , level decreased from an initial level of 240 inches to s'asinitum level of ! 173 inches.
The level transient was terminated,by the. reactor < 1evel 3 y' actuation of the nuclear steam supply shutoff"rdstem, group 4' isolation.,b lAll systems. responded as expected.
ReactorAccolaatitemperature remtined stable was maintained at appro);imately 150 degrees J during the event, L j and, level was restored utilizing core sprag, keep-fill system.
J l < n x. ~
e Earlier in the shift, the ope'rators had identified the RHR pump C ' discharge check valve E11-F031C as leaking and the NASS prepared log entries and was checking the surveillance requirements.
The NASS directed the NSO to verify thaO cheh valves B21-F011 A and 8.were not leaking and that the feedwater' lines were drained to allow working on the feedwater ! check valve N21-F076B, ashsoon as possible.
The HS0 had also been l - instructedtoshiftDivJspnIIRHRtostandbypndDivisionIRHRtothe ] shutdown, cooling mode to support testing the Division I thermal
recombiner.
) ) ,g
' < \\ The NS0 conducted a briefing with the Nuclear P. owe,r Plant Operator (NPPO) who was t6 enter the steata tunnel to verify ddining of the faddwater
f lines.
A'second NPPO was called into thelc6ntrol room and was briefed i The'brieff'gpovered the procedure that I on the fill and vent evolution.
n was to be used during the evolution and lasted about 10 minutes.
The a NASS was satisfied with the briefing eved thou(he did not participate in the briefing.
i , , ! The NPP0 at the steam tunnel called aeportirig he was ready to enter the ) steam tunnel.
The NSO directed him to enter and to conduct the verifica-i ti oh.' After cycling B21-1010 A and B,,the NS0 directed the NPP0 in the \\ l control room to complete 'Attachaent 5 of POM 23.205, Residual Heat Removal e{ System.
The NPP0 did not questici tbe direr. tion of the NSO about comple-l l l c-20- ! l ' ' __ ,
-- - 77 ; - y, , _~- yoy;. -- --
- - --- - --- -
.J.1[f.
i ' ,'Q i{; ' *_ ' "
- ry '
y nyfy ,,a. a w , > if ag
} i hh"gr . tion.of h theNP%,thestesreqNiredbeforeattachment5couldbeconducted.
After
t the control room, the NSO/ completed the leak check verifica- ! [ >tig,n,-made the log entries, and reviewed the out-of-specification log.
y.
- Thb NPP0 notified the control. room that E11-F072A was open and that he was
.! lgetting flow.
Control room personnel failed to realize that the NSO had ,not completed the required prerequbite steps of 23.205.
The NSO told the NPP0ithat the flow was keep-fill flew due.to air in the pump casing or lines.
The MPPO stated that itfsounded like more than keep-fill flow.
r. The NSO directed.the NPP0'to open E11-F071A; this action established a flowpath around pump and check vahe /v11owing water to be pumped to the - ~ /f, toms. ! The NPP0 reported significot flow.
The NSO directed NPPO~to , i! J throttle flow with the E11-F071A.
About a minute or two later, the NASS a / ( ' questioned the NSO about"the lineup.. After the reflash of the High' Water l Level alarm, the NPP0 was" directed to shut the E11-F071A and the $1L-F072A.
The NSO openedjthe core spray injection valves and started ' bufth demineralized transfer' pumps.
The E11-F010 RHR cross-connect valve e z was closed. When the reactor. water level decreased to level 3, the ' h, reactor scrammed and RHR istiated.
l Cy (
\\c t
.g
,
,
,,
I~
i 5[
~
MSIV[v'alve' logic and the DC logic of the inboard MSIV valve logic to be de-dr.ergized.
Both the AC and DC logics of the inboard MSIV valve logic
-
were de energized at this time and the inboard MSIVs shut.
With the Division II RPS re-energized, the DC logic required only the MSIV isola-t
'
tion logic to be reset to reopen the Inboard MSIVs.
The only requirertents to reset Qe isolution logic were that the condition causing the isolation j
o
,
be cleared and that the isolation logic reset pushbuttons be depressed.
j Once the KSIV [rchtion logic was reset, the inboard MSIVs opened.
i
,t s<
c'
p 1%ns,V isolati)q
'
HSI n logic and the MSIV valve logic were two different logic thi and nutting the MSIV isolation logic dio' hot reset the MSIV
!
valve logic.
The failure of operators and applicabJe procedures to recognize this interre1@.ionship between the two logics was the prime contributor to the eventh
).,5 i
!r BoththeY@orrc9ndoutboardMSIYvalvelogiccontained.DCandACpowered j
~
[
logic trains, and both the AC and DC logic trains were required to be j
.3x de energized for'the indoard or outboard MSIVs to s W t.
Only one of the
-
outboardMSIVs.lwerereduiredtobeenergizedtoopentheinboardor two logit trains
\\
De-energizing one KOS bus would effectively cause the DC
logic on one set'cf MSIVs and the AC'?ogh on the other set of MSIVs to
\\
trip.
Re-energizing the RPS bus wo# d'al 5w the DC logic to be reset when
.
thij MSIV isttiation logic is reset.
We AC logic required that not only i /
J tke the MSIV isolation logic he reset but also that the seal-in contact for the AC logic be reset, by dep?essing the open pushbutton for the h
h affected MSIVs.
'
\\!
I, s>
g s
,1 s s
,
,
.
A full isolation or de-e Nrgizing of both RFS buses with the.pth ent Hi d \\
j (.'
valve IQ6 design would (equire the operaters< to take different steps, t.o
{
'
I allow recoveg than the st@s that must butM6,to recover from the I
,
s i
observed evst.
Neither the surveillance procedure (42.610.01) nor tN
,
referenced system oper@l;;g procedure (23.316), included the necessary q
steps to correctly recover from the loss oi"clectrical power associated
-
I with the transfer of RPS power \\ supplies, q-
l
>
,
There were no alarms or indications available on the control room panels
to indicate to the operators that the AC gr DC logic was de-energized.
- n' There were locaP anmeters for the AC and UC logics but this lodal ' indica-tion was not well known emong the operato m ),
- '
' This event could recur as a result of any combination of events that could f.
cause both RPS power supplies to be momentarily de-energized and the y isolation logic reset.
Design' deficiencies allow the MSIVs to reopen when < powt/ is restored to the RPS bus and the isolation logic is reset, without ' , furcher operator action.
If this had happened at rated power and the ' \\ IMEW, had, cycled the resulting pressure transient on the vessel and steam . system and components could have been significant.
Discussion with '
e engineering staff personnel who had been involved with the initial design
I4 . .S of the MSIV Valve control logic indicated that the event that occurred and T L ' i( ' similar events.nre not considered in the logic design.
'y, The inspector expressed concern to the licensee that, while the MSIVs ' ..' would be expected to isolate as designed on a full iso htion sigal, the logic design'that permits automatic reopening of the valves upon reset ' represents a serious design deficiency and a possible unreviewed safety 'l , .22- < . - - - _ - - ~ _ - _ _ _ _ _ _. - '.- - - W
J,, - _ - _ _ _ _. _ _ _ _ ' -
.s..,
-
i , question.
At the close of the inspection period the issue was under review by the regional office.
l ! 11.
MANAGEMENT l
h @ Throughout the inspection the team observed the role of licensee management in l Q' routine operations and event response.
Management communication, involvement, [c and effectiveness were evaluated through direct observation, interviews with p managers and subordinates, and through review of manap rial prcgrams and
policies. The following observations are presented.
' a.
A review of previous Systematic Assessment of Licensee Performance (SALP) l
findings indicated a history of communication problems between management i ' and staff personnel The inspectors found certain examples of communica-l ' tion practices with the potential to negatively impact on plant opera-t f.', tions. One-on-one exchanges between managers and shift personnel were \\ rare, due primarily to management's demanding work load and individcal management styles.
While management appeared to talk with the Nuclear i Shift Supervisor (NSS) during daily visits to the control room, nearly all i other management direction was communicated by written memorandum.
Review
of those memoranda indicated they effectively served to convey both ! compliments and concerns and to alert shift personnel to technical or , operational issues needing particular attention.
However, the night j orders, the only other normal written communications channel, were often , sketchy and lacking in direction through the use of such phrases as " follow the plan".
Lacking regular one-one-one contact with management, operators interviewed reportad virtually no contact with management above the NSS level.
Many operators expressed relief that the NSS functioned as a communications ! buffer.
With no encouragement of an "open door" po? icy, operators directed all upward communications through the chain of command.
The unresponsiveness of management to upward communications reported by those interviewed discouraged attempts to provide input to management.
For example, one SOA reported he finally stopped sending monthly reports due to lack of any response and that the suspens'on of the report was appar-ently never noticed. __ One opportunity for effective one-on-one communication was a newly formed policy of management meeting with each shift during that shift's training ' week, thus giving each operator access to management once every six weeks.
This practice was a new facet of the existing Pride Program.
Interviews with participants in the program indicated lack of managerial involvement and feedback limit the programs ef festiveness.
Participants generally - reported that the shift members could normally solve problems within the shift but those problems requiring management action seldom got a res-j ponse.
l Inspectors found evidence of poor communication between the Operations ' Engineer, an individual licensed at the facility, and the Operationc
h Superintendent, an unlicensed individual who appeared familiar with the facility.
Shift personnel reported some problems with the chain of '
command on back shifts when the licensed individual would not be readily available.
-23-u
_ _ _ _ _ _ _ _ _ _ _ _ _ - _ %. d. 3.! *
While the Operations Engineer, Operations Superintendent, and Plant Manager were in the control room at least daily and when operational conditions warranted, certain other senior managers made only rare visits inside the plant.
Designated senior staff members who are required to make monthly written reports to the Vice President presenting their i findings from plant tours generally failed to tour or report, although one manager did comply fully.
The inspectors reviewed the three formal performance improvement programs developed by the licensee since the July 1985 premature criticality event in an attempt determine the effectiveness of those initiatives The Reactor Operations Improvement Program (ROIP) was the first program developed in response to the premature criticality event.
The root causes identified by the licensee in the ROIP were still in evidence to a large extent.
The inspectors found that operating staff personnel continued to display an inadequate understanding of their own responsibi-lity for safe plant operation, based on the results of an examination conducted in response to the recent mode change incident.
While the
second identifiers root cause, that of an excessive number of outstanding q plant modifications, has abated since the completion of construction, temporary modifications and hardware deficiencies continue to contribute to operational problems.
The third identified root cause, that of weak-nesses in the corrective action process, continued without significant improvement.
A contrwuting factor common to all root causes, that of administrative 1y burdensome procedural requirements, has received licensee attention but with mixed results.. Performance indicators tracked by the ROIP for 1986-87 indicate no improvement in the number of work orders, alarming annunciators, time sensitive LCOs, and reportable occurrences.
The remaining action items on the ROIP were administratively closed by memorandum in April 1987.
The Nuclear Operations Improvement Plan (NOIP) was the second of the licensee's programs to improve operations and grew out of their response to Region III's initiative under 10 CFR 50.54f.
The NOIP absorbed the > ROIP and established a new set of performance indicators.
Trends indica-ted little change over the 1986-87 period.
Parameters displaying an ._ upward trend included LERs, noncompliance, unplanned scrams, outstanding temporary modifications, and personnel error rates.
The NOIP was absorbed by the Fermi Business Plan and its supporting departmental Business Plans in the Spring of 1987.
Management's stated goal was to encourage every manager throughout the facility to support, through their own business plan goals, the Fermi Business Plan and in so doing to analyze how their activities contributed to the objective of generating electricity safely.
The inspector expressed concern to the licensee that while the licensee had displayed an excellent record of new program development in the period 1985 present, the successful implementa-tion and follow through of those programs was found to fall short of expectations.
The team strongly encouraged the licensee to concentrate their efforts on making the Fermi Business Plan successful rather than l developing another new program to address regulatory concerns.
, -24-l l
. g.h.;" * d The inspector expressed concern that the ultimate improvement in plant safety and operation resulting from the Business Plan would depend in large part on management's ability to translate the goals of the plan to the individual at the controls, to the technicians performing the sur-veillance or maintenance, or to the engineer performing calculations.
This translation of the Business Plan goals should be expressed in terms of individual performance expectations.
The inspector noted problems with communications between management and staff, the apparent lack of under-standing among individuals concerning their own job responsibilities, and the failure to revise individual performance plans on schedule.
The inspector noted the managerial trend toward personal accountability as evidenced by a recent shift in disciplinary policy.
The team expressed confidence that the management staff understands the high technical, administrative, and regulatory standards necessary to safely operate the facility.
However, the team expressed the concern that management must take the initiative in demonstrating those performance standards to the relatively inexperienced plant staff who may have an j approach to safety more appropriate for a nonnuclear facility.
12.
ENGINEERING AND MAINTENANCE The team examined the interface between the operations, maintenance, and engineering departments in order to evaluate the adequacy of support for-operational activities.
Because another team from the regional office was concentrating on maintenance, the OSTI team deemphasized this aspect.
The results of the maintenance inspection are described in inspection report 87-28.
The inspectors noted a perception by operators that maintenance and engineering support was not always timely and thorough.
The operators expressed particular frustration in obtaining support for unanticipated problems that occurred on backshifts.
They also expressed concern with the time delay experienced in processing design changes that had been requested by operators.
The team ' felt that these concerns may have been compounded by the difficulties encountered during the lengthy startup test program.
Nonetheless, the team also felt that facility performance could be improved if these interfacing departments could become increasingly aware of each other's special problems _ and requirements.
For instance, a suggested design change that appeared to be a simple, quick fix to an operator may have presented the engineers with a highly complex problem.
This situation could easily arise when the proposed change required consideration of horizontal design requirements such as seismic, environmental qualification, fire protection, and human factors.
Any perceived gaps between departments could be at least partially bridged by
increased awareness of other departments needs and workloads and by providing periodic feedback to individual initiators of the status of their work requests or suggested design changes.
13.
PLANT TOURS , i Members of the team conducted several tours of selected areas of the facility assessing housekeeping and the material condition of the plant.
A number of areas appeared to be maintained above average, including the control room, i auxiliary building, turbine building, and cable spreading room.
The reactor l building and relay room needed some attention to remove certain extraneous { items, such as tools and portable equipment that were not in use.
! l-25-lE- _ - - - _ - - - - J
_ - - _ _ .,l,Q 4 < 14.
EXIT INTERVIEW The inspection. team presented its findings to the licensee in a meeting on August 7.
The licensee accepted the findings.
15. - PERSONS CONTACTED B. Sylvia, Group VP - Nuclear Operations F. Agosti, VP, Engineering and Support Services W. Orser, VP, Nuclear Operations G. Trahey, Director, Quality Assurance L. Lenart, Plant Manager S. Catola, Chairman, NSRG J.'Nyquist, ISEG J. James, Shift Operations Advisor J. Bass, Sr. Engineer Operations Surveillance , R. O Sullivan, Engineer - Surveillance j J. Plona, Operations Support Engineer R. Lightfoot, Nuclear Shift Supervisor W. Tucker, Superintendent Operations G. Reece, Nuclear Assistant Shift Supervisor W. Colonnello, Shift Technical Advisor R. Buehler, Nuclear Shift Operator K. Karnik, Nuclear Shift Operator D. Pierce, Nuclear Shift Operator G. Pierce, Nuclear Shift Supervisor R. Speek, Nuclear Assistant Shift Supervisor.
K. Snyder, Nuclear Shift Operator W. Ostrom, Nuclear Assistant Shift Supervisor P. Tarwacki, Operations Support J. Kauffman, Nuclear Power Plant Operator K. Earle, Technical Engineer (Nuclear Production) F. Schwartz, Supervisor, Quality Program Assurance J. Wald, Supervisor Operational. Assurance. , J. Cwiklinski, Systems Engineer, Tech Staff M. Nunnely, Systems Engineer, Tech Staff F. Svetkovich, Principal Engineer - Plant Systems - L. Wooden, System Engineering ! M. Kluka, Technical Engineering I J. Thorpe, Systems Engineer D. Bergmotter, Systems Engineer K. Dahm, I&C Engineer B. Sheffel, Supervisor Inservice Inspection L. Esau, Supervisor, I&C Support Group D. Eammons, Maintenance Support Technician B. Stone, Maintenance Support Technician P. Perchard, General Foreman - Modifications J. Rotondo, Supervisor Maintenance Support L. Bregni, Compliance Engineer J. Price, Licensing Engineer S. Cashell, Licensing Engineer T. Dong, Plant Safety J. Leman, Director, Nuclear Plant Safety 6. Preston, Assistant Director, Nuclear Plant Safety L. Lessor, Advisor to Plant Manager C. Alderson, Technical Advisor to Group VP C. Bak.er, Supervisor, Plant Procedures Coordination-26- _ - _ _ _ _ _ _ _ _ _ }}