IR 05000344/1989027

Insp Rept 50-344/89-27 on 890908-1020.Violations & Weaknesses Noted.Major Areas Inspected:Actions Following Licensee Identification That Both ECCS Subsys Potentially Inoperable While in Mode 1

ML19332D441
Person / Time
Site:	Trojan File:Portland General Electric icon.png
Issue date:	11/02/1989
From:	Mendonca M NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION V)
To:
Shared Package
ML19332D434	List: IR 05000344/1989027 ML19332D433 ML19332D440
References
50-344-89-27, IEB-88-004, IEB-88-008, IEB-88-4, IEB-88-8, IEIN-87-059, IEIN-87-59, IEIN-89-008, IEIN-89-8, NUDOCS 8912010204
Download: ML19332D441 (13)

Text

.

.

,

,

.' c'

.

,

..

,

" y i (L.%: } ?m

.

,

W} _, ]NS ) lj.h? *

e s '

'

'

WitWQhj*

i;M"' l 31 f

'

,7 I *

j, c

,

,

, **

_

'n f

4 4.} ' '?f.,y.\\:% \\

• Q.

,_

-

3l~

',',

~

u

. _4

% (D q d v

'

" '

.

,.

1 $ a

i

'

.

,..

'

,

,

%; ~

&;

e

-

.

-

,

..

y,;g dr w

.

'

'el. pN. C '#; -

'xt

'

'H;

+

,

,

\\

w mll

'

' '

_A

y

,

,

-

+ r

' +

...

~

.

.

,0.;.S.. NUCLEAR: REGULATORY COMMISSION _-

-

r

g y o

af y

~

R

'

'

~

'

.

e

,y

,

.

~

W, KREGION V.

q y%

.

,,

,

a

,w#

-

-

a Al g f*f,

?>i

'

l s

<

,

ru

.

rp.:.

.

.

'

,

4tW.

Report No.1 50-34A/89-27-

,

Jjff

~

L R

,....

..

'

.

% K m W (Docket No.1 50-344 Y

_

!

g o ; m > t t o g;.

.NPF-1

'

.

_.,

H # n 1. License No.

wm

-

,-

-

,+

f eye

, m E.s -

- Portland' General' Electric' Company s

_.

.

. - -

.,

Licensee:'

.

>

'

hya $,

y

.

121 S.E : Salmon Street, TB-17

'i

,

'P

"

Portland, OR 97204'-

, 3

%~ +

)

,

,

..

l

.

.

.,

&

Facility!Name::Trojany

.!

,

,

&

w*.

,_ -

.

.

s

'a

'

-

'.;.

In'spection7at:= Rainier,' Oregon-

'

N

o n..

hy;.c

.

i LInspection'conductedi September 8, 1989 - October 20,11989.

%

.

,

. Insp'ectors:

R. CC Barr-

.

.

'

-

f

_

W

Senior Resident Inspector

,

,

,

.

.

.

'

>

ove J.-- F. Melfi

.

"

Resident Inspector

.

.

.

'.

Approved By:/'-

' N

@

"

@; g M. M. Mendonca,-_ Chief Date Signed mg p

'

<

.y

.

Reactor Projects Section 1 I

1 ' '

w,.

e

,

f

Summary

,

&

_

20,71989 (fieport 50-344/89-27)

.t

" Inspection ~on' September 8'- October

.

,

,

LA

,

_

. _

M'

' Areas Inspectedi A special inspection;of the Trojan Nuclear Power 31 ant. 'The.

'

q inspection focused on-actions following'the licensee's identification that-

'

.-.

L both ECCS subsystems we're potentially inoperable whi_le.in Mode 1r. Inspection

3 ygf procedures,30702, 30703,.71707,.90712, 92700,:92701, and 93702 were used'as f

f guidanc'elduring the. conduct;of_the inspection.

f,

~

,

.

.t

,

,

m.g

>

,

.

s

,..

3Results>

"

<

A

-

m

-

m

.

,

<

, rv.

,

.

'

.

.

m;

?*a f Apparent programmatic weakt 1s associated with administerin_g and contro111ng'

ni A

Splant' isorkiactivities to ' e.

i safe. operation and compliance with tecnnical-

'

!/W<

' specifications limiting.conaitions'were identified (Section 7).

This resulted

-

%

in operation in a 72' hour technical: specification action without licensee

,

recognition (Section,4).

.y.

>

@

An apparent weakness in the detail and quality of maintenance work

-

'

/ 'M, J instructionsito clearly define the effects of the maintenance on the

'

'

@ E OPERABILITY,'of systems,' subsystems and components was identified (Section 8).

, y,-

,,,

,

,

-

, 'e

'Y ' s 8912010204 891116

PDR ADOCK 05000344

', "f '

'

,.

O PDC

'

w,

,

' h ;;l "

.

?

Q&% d'G g

'

'

,

\\

i

,

,

_ _

,

,

p y a::*.

,,.f'

_--

'

-,

" -

j

.

.-.

,

,1 L

al

.

?

,

-

x s @

2.

v

..,

,,

'

'

,

,

).

),.

'

,,

e

,

w'y

&-

-

'

,

,

,

.

'

.

-2-'

,

.;

'.

G...

b.

'Y # '

. j

'

,

-Two apparent violations for,the failure to comply with procedures:and identify.

)

Limiting. Conditions for a maintenance activity were identified (Section.8).

'

'

'

ce Continuing weaknesses in performing timely, complete engineering evaluations

-

and in root cause corrective actions assessment for potential. safety issues

' ~ "

.

-,.6..

were identified (Section 5).

,

e

_

i A centinuing eeakness.in shift turnavers was identified (Section 8).

• y

,.

<

g

y,'

. '

.h~ Y ' y' _

r e

h g.

v

1 s

'.j k

'

g

,.

.

u.

.1

,.

I g.

I.

p d

%3, h

f

-4

i> } >

'!

E

'

,

_

.

-

-

m.

--

,,

,

-

.'

'

w

>-

,

{#

.

. g e'

'-

p w.

~

1'

'

,a Q ".,.',.

."

/

,

q

-

.

.

S'f k

..

DETAILS

~

yn

-

.

kr #

_

u,

.

.

,

-

.

hF'

"

[1)

Persons Contacted

'

'

j4 1 y

• D. W. Cockfield, Vice President, Nuclear

'4 l

~

1. • C6 P.-Yundt,- Plant General. Manager.

.

'

1. • T.;- D. Walt, General Manager, Technical' Functions

>~

,

' '

'#*C. K.= Seaman, Manager, NucleartQuality Assuranct.

...

1-

_ #*R. ' M.' Nelson, Manager,. Nucle'ar Safety and Regulation Department w.

w

.#*A.-N. Roller Manager,' Nuclear' Plant Engineering

'

1. • D.1 W. Swan,-Manager, Technical' Services.

.#*M. J. Singh, Manager, Plant' Modifications

.c

1. • J. W..Lentsch, Manager, Personnel Protection

1. • A. Rt Ankrum, Manager, Nuclear Security.

R. E. Susee,: Manager, Planning and Scheduling

<

,

..

' J.

M.' Anderson, Manager, Trojan Materials

"'

E. B. James, Outage Manager, Plant Systems Engineering.

~

R. :L. Russell, Branch Manager, Operations '

D. L. Bennett, Branch Manager, Maintenance -

Ji A. Benjamin, Supervisor, Quality Audit

"

<G.-G. Perrin, Shift Supervisor <

'

T.

.

Andone; Jr., Shift Supervisor

~

.

"

1. • W. J Williams, Regulatory Compliance Engineer

.

J. D. Guberski, Nuclear Safety and Regulation Department Engineer s.

J.;J.. Taylor,1PM/EA, Engineer D.:J. Findley, Plant System Engineer J. P. Fischer, PM/EA Branch Manager R. R.yRodriguez, Control-Operator TheEinspectors also discased inspection related topics with other licensee emplcyees during the course of the inspection.. These included

{

,

. shift superviscrs, reactor and auxiliary operators, maintenance

'

personnel, plant technicians and engineers, and quality assurance personnel.

• Denotes those; attending the exit meeting on October 10, 1989.

1. Denotes those attending the. exit meeting on October 20, 1989.

.

2.

Plant Status

!

-On September 8, 1989, the reactor was being operated.in Mode 1 at 98%

'wer.

On September 15, 1989, the reactor was shutdown to repair a

'

'eaking pressurizer safety valve.

On October 3, 1989, the reactor was restarted and achieved 97% power on October 4, 3.989.

The facility

'l

,

.

operated at 97% power the remainder of the inspection period.

<

'

'. 3 ;

. Residual Heat' Removal (RHR) System Description

'

To mitigate the consequences of selected Final Safety Analysis Report

'

'.

, accident-analyses, the Trojan reactor, a four loop Westinghouse design,

=>

uses two-independent Emergency Core Cooling System (ECCS) subsystems.

Each ECCS subsystem consists of centrifugal charging pump (CCP), safety

,-

f

.

.

M

.

_ _. _ _

_._a_

~

^^

,,

n

,

-

,

-

,

^

,

• f

>

-;

.

.,

,.

-

i e

injection pump-(SIP),: Residual Heat Removal (RHR): heat exchanger,.RHR-

'

.

apump, and:a flow path capable of taking suction from the refueling water'

storage tank (RWST) on a safety injection signal and transferring suction'

-to the containment sump during the recirculation phase of operation.

"

The ECCS subsystems are designed to automatichMy start during a design-

-

basis Loss of Coolant Accident (LOCA).

The RHR pumps take a suction from

.

the RWST and deliver water to the four reactor coolant. loop cold-legs-

when' reactor coolant system (RCS) pressure decreases below the RHR pumps

.

discharge pressure.

Until RCS pressure is less than pump discharge

.

'~

_ pressure, the discharge flow of pumps is diverted to the pumps' suction

-

via-the miniflow recirculation lines to prevent pump damage.

In-each recirculation.line a flow control valve (FCV) opens and diverts flow from the pump discharge-to the suction if the respective RHR pump. breaker is closed,.the FCV selector switch is in auto, and low flow is sensed by its

,

respective miniflow switch.- The licensee has estimated that it would-take about 10 minutes before damage to the RHR pump would be' expected with-no discharge flow.to the RCS or through the miniflow recirculation line.

For an ECCS subsystem to be considered OPERABLE it must be capable of performinyitsspecifiedsafety-relatadfunction(s).

Implicit to an ECCS

'

subsystem s operability is.the assumption that all necessary attendant instrumentation, controls, normal and emergency power, cooling or seal

,

L

water, lubrication or other auxiliary equipment that aru required to

' perform their safety function (s) are also capable of performing 3 heir-

'

rated support functions.. Specifically, for the ECCS subsystems to be OPERABLE the support systems of Component Cooling Water (CCW) system

>

which. cools selected ECCS-related equipment, and the Service Water'(SW)

h system, which cools the-CCW system and selected ECCS-related equipment,

must be OPERABLE.

Additionally, for the RHR pumps to be OPERABLE the miniflow recirculation line FCVs must open en low RHR pump-flow (less than 805 gpm).

4.

Event Chronology (71707, 90712, 92701)

On ' September 6,1989, maintenance request (MR) Bire491 was initiated t'o

.

change the setpoint of the miniflow switch (FIS-611) for the R RHR miniflow recirculation line. This work was initiated because PGE previeusly had been notified by Westinghouse that miniflow indicating switches used by Trojan in tb RHR min 1 flow recirculation lines required the' switches' setpoints be changed.

u On Septembeu 8,1989, at approximately 7:30 am, with the reactor in Mode t

1:at 98% power, the dayshift shift supervisor and control o)erator reviewed MR 89-8491 ard authorized pe'formance of this MR taa' adjusted the FIS'setpoint. This review did not recognize that the switt.h calibration portion ~of the maintenance rendered the B RHR pump, inoperable and placed the facility in Trojan Technical Specification (T.T.S.') Limiting Condition for Operation 3.5.2.d.

The switch calibration began at approximately 9:00 am and completed at 12:00

,

.

'>

f,

- - - - - - - -.

- - -.

-

-

,,

yp

-

.-

- -

W

,N,

'

'

,

.

,

~3 E

,

,

y j.

.

-

p

-..

pm with the:switc6 remaining isolated from the RHR system for subsequent A

'

Y functional' testing.

(In this configuration, the switch would have

<

r

' indicated no flow and opened the valve to allow RHR-miniflow).

f

~

i At 12:50 pm, on September 8, the A train of service water (SW) was declared. inoperable, per Operating Instruction (01) 8-8, to conduct water -

. treatment to inhibit Asiatic clam infestation..Because the A train of SW was inoperable, the A ECCS subsystem was inoperable,

'

o At approximately 2:00_ pm,'the craftsman performing the maintenance returneo to the control. room to obtain permission to perform functional m

testing; however, the shift supervisor did not want to perform the

'

functional testing by operating the RHR pump..He rather wanted-to place the pup.p breaker in the " test" position to perform functional testing.

He ciso recognized that, because the'RHR pump breaker would be in test, the RHR pump would be inoperable, therefore..- he deferred the functional.

.

,

testing. Because MR 89-8491 work instructions were not sufficiently detailed,-he.did not recognize the flow switch was isolated from the RHR system.

At 2.45 pm on September 8,1989, the swingshift operating crew relieved =

-i the'dayshift operating crew. At 3:20 pm, the swingshift supervisor recognized, the B RHR pump was potentially inoperable because maintenance was being conducted on the B RHR miniflow switch and the A RHR heat i

exchanger was inoperable due to the chemical treatment of the A service water system. The shift supervisor took imr..adiate actions to restore the A RHR heat exchanger to operable by returning the A train of serv. ice water. At 3:50 pm the A trains of SW, CCW, and the RHR heat exchanger were declared OPERABLE.

At 9:17 om, maintenance on FCV-611 was completed and B RHR pump was

_

teclarec 7ERAblE.

n

!ations or deviations were identified.

5.

8hR Miniflow Switch Setpoint Change History (30702, 92700, 93702)

On October 15, 1987, PGE received an October 2, 1987, Westinghouse letter (POR-87-607). This letter informed PGE that Westinghouse had revised the setpoints for the Trojan Residual Heat-Removal (RHR) pump miniflow switches and provided PGE with the revised setpoints. The letter explained that additional seismic qualification tests had been performed on the Barton Model 288A differential pressure switches, which Trojan uses to ceasure and control flow in the RHR miniflow recirculation lines.

This letter indicated that the switches may exhibit a setpoint drift of 12.55% span vice the originally assumed 2.55% drift during and after a

seismic event.

On November 2,1987, the licensee entered the letter in the Operational Assessment Review (OAR) system (0AR 87-069), the purpose of which is to evaluate operating experiences at other nuclear facilities. 0AR 87-069 was screened by the OAP coordinator, categorized as nonsignificent, and assigned a resolution date of February 5,1988. Additionally, the Manager of Technical Services, Manager of Nuclear Safety Branch, and the

'

7,,

-

-

-

.

p s

-

p,

<

Engineerin Scpervisor were notified of OAR 87-069 and concluded the setpoint c ange was.not significant.

The. action date was stSsequently changed to December 31, 1988, because the OAR system coordinator and-the

'

action engir.eer believed the issue to.not be significant.

j m

On December 21, 1988,.the action engineer, during revicw of the Octcher 2,41987, Westinghouse letter concerning:the.setpoint change for Barton 288A'miniflow switches recognized the potential safety significance of-theissueandalertedfGEmanagement.

A nonconformance report

,

(NCR-88-621) was issued.

During the NCR evaluation, the licensee recogd zed that the RHR pumps could potentially be rendered inoperable

.aue tu the setpoint shift that the miniflow switch may experience during i

'and after a. seismic event.

As a result, the licensee took short term compensatory measures by deviating procedures to alert operators to the

%,

poteM 11 impact on RHR pump operability due to miniflow switch setpoint dri n during and.after a seismic event.

On December 23, 1988, event re1 ort 88-179 was initiated to evaluate the weaknesses in the OAR system t1at allowed a safdy significant issue to be overlooked.

The event report concluded the root cause of the event was"theissuewasdeferredwithoutaproperunderstandingoftheissue or verification that it was'in fact not urgent" and that this was due to the apparent nonsi0nificant priority of the 0AR and the wording of the Westinghouse letter itself..." The event report was cc,,apleted on March 13, 1989.

The event report included two immediate corrective actions and five= long term corrective actions.

One of the long term corrective actions was for the cognizant' branch manager to acpreve the significance category, however, in this case the cognizant branch manager had reviewed the 0AR and-did not-disagree with the assigned significance. Also, the

event report did not address the involvement of the other reviewers and their contribution to assigning the CAR as nonsignificant. 'This OAR ~

~

review reemphasized weaknesses that have been identified in the Itceasee's root cause/ corrective action assessment efforts.

On January 5, 1989, PGE and Westinghcuse conducted a telephone conference L

call to discuss the safety significance of the setpoint drift of the Barton 288A miniflow switches.

They concluded there was'no safety sigaificance.

At PGE's recuest, Westinghouse provided, via letter NS-0PLS-0PL-II-89-028 datec January 13,-1989, ajustificat;onfor

- continued operation (JCO). The Westinghouse JC0 concluded, based on.long and short term analysis, that the switches utilizing the unrevised n

_setpoints did not present a safety problem.

As part of Plant Setpoint

'

Change (PSC) 89-02, PGE performed a 50.59 Safety Evaluation to ensure safety was not affected as a result of the change.

The evaluation inhluded a review of the Westinghouse JCO.

On subsequent re9iew of the 1989 that the Westinghouse JCO, the inspectors determined on October 3,inal PGE safety evaluation did not record that one of the orig Westinghouse assumptions for the JC0 was incorrect, i.e., the miniflow flow valves were assumed to be oper,.

Afttr substantial research, PGE stated that they had recognized that the Westinghouse assumption was in error but it was not recorded because the setpoints were in the process

-

ofbelngchangedandthat'shorttermcorrectiveactionshadalreadybeen taken to alert the operators to the consequences of a seismic event oa the miniflow switches.

This approach was an example of incomplete o

'

+

-

.

-

fh{f[h [7 X

.

~{

'

^

h

,,

.,

- j

,

,

~

':

'

g

...

,

,,

5:

-

..;

'

<

{_1 4-

<

r Ay

.

<

,

,

,C N

"

Ym

'

iengineering evaluations since'the' Westinghouse JC0 was'used 4

. determining reportability.

.

'

.On Janu'ary 21,11989,ithe setpoints of,the mir.iflow switches were changed

~

,

.

- to toe values Westinghouse recommended in the October 2,1987 letter.

!

'

During a review 1n April,' licensee engineers recognized that the

,

instrument inaccuracies assumed by Westinghouse (2.55%) for the Bart)n h

P 288A flow switches were different from the instrument inaccurar M

! assumed. at Trojan, therefore,: the setpoints:of the flow switch m ld

-

'fagain require changing.

>

'x

~

,

[

.

i On June 13,'1989, the licensee.denfted justification for-continued operation 89-08, "JCO-Residual Heat Removal' Minimum Flow ~ Valves." Theyf L dressed'the following concerns:

the existing switch setpoints for-J;'

miniflow did not include all sources of instrument uncertainty; the RHR.

low-flow alarm / annunciator would be presenu anytime miniflow: valves were open and could, therefore,'~ distract operators;- and:the miniflow valves i

?

w'th the January 13, 1989, revised setpoints.could undergo. cycling and J

-

lpossible failure. 'During the approval process,'the JC0 was revised to delete the later concerns. The JC0 was approved on July 10, 1989.

' The JC0 was~ effective for 60. days-until September ~8,1989.

Sixty days y

,

was chosen "to allow for orderly 1and deliberate review of the Plant Setpoint Change-(PSC) and time to complete. the work." The JC0 noted that a

.

"the setpnint change can be, accomplished'during a r_outine train > outage

without disrupting plant operations." The JCO was revised to extend the effective date-by 30 days on September 8,1589 because the setpoint change.would.not be implemented by September 8.-

The-initial PGE evaluation indicated that the miniflow control valve f

.

would never.'have opened with the unrevised (old) setpoints.

The

.,

sinspectors considered this a significant5afety concern that needed

'

.' resolution.

As a result PGE contacted-Westinghouse for additional:

L

,,

&'

information.. Westinghouse concluded the valve would have opened because.

-l the li.55% ir.strumentispan drift referred.to by Westinghouse in'the j

'

October 2, 1987 letter was a conservative' assumption and the actual-'dvift l

of-the PGE miniflow: switches was approximately 5%, therefore, no safety-i 11s' sue existed at Trojan.

j w

l

%

,

No, viol.ations or deviations were identified, n

'

.6.

.Miniflow Design Concerns (92701, 93702)

d

,

"

,

,

,

-On October 26, 1987, Westinghouse notified PGE (letter POR-87-615) of

"RHR Pump Mini Flow Design-Concerns " The letter noted the miniflow line

"

,

,

~

t ensures the RHR pump does.not overheat or vibrate when t;ie dic.:hstge line

~

'

is closed or when reactor coolac system (RCS) pressure exceeds RHR punp'

N

'

,

shutoff head uuring the Emergena Core Cooling System (ECCS) injection

,

'

phase.

The two concerns identified in the letter were (1) a potential

-

problem involving parallel pump operation through a common miniflow recirculation line, and (2) pump inlet flow breakdown caused by ' low flow

operation.

The licensee entered this letter in the OAR system as

<

-

%

OAR-87-73.

i

,

e h

.

.

.

.

.

-.

+

. -

.3

.

y qw p w

-

,

(h 9)

JO

.o

.6

'

[

i.

"'

~.;;. ' G

.. f

'

a

'

'

,

,

.

>

.>

R ', o On November 23, 1987, the 11censeelreceived NRClInformation Notice 87-59, 1*

~" Potential _RHR Pump Loss,";that notified all-nuclear facility owne7 of H

the concerns t raised in. the' Wesi inghouse : letter.

The; Notice was edded to

O I

n OAR-87-72.

5-

,

y

.

b On, November 30, 1987, Westinghouse, vih lbtter POR-87-547, notified PGE

,

.

~

'

lthat: the preliminary Westinghouse review of Trojan's design indicated-

,b

' Trojan was net affected by the doncerns~ described in Westinghouse letter

~;

POR-87-615.

The letter also recommended each utility ' review it's-T'

paiticular design'for applicability..

-

,

~

-OnFebiuary6,1989,PGEreceivedNRCInformationNotice89-08,'" Pump

.

,

'

".

. Damage-Caused By Low-Flow Operations." The Notice alerted utilities to Epotential probieris that-may result from operation _~of centrifugalfpumps at

,

low flows. 'The Notice was added to' OAR 87-73.

,

OnMay5L1988,-NRCBu11stin'88-04," Potential. Safety-RelatidPumpLoss,"

w

,

~

was issuedito nuclear utilities. 'The Bulletin requested-licensees

'

-investinateland correct the miniflow design concerns descrit-1 in NRC Information Notice 87-59.

PGE provided a par tial response tnat included

'

• y

= a Justification'for Continued Operation.to the_ Bulletin on July 18; 1988.

PGE committed to provide an updated t esponse when pump vendor information

.

_

on minimum flow was received.

An initial due date for the update

"

response was March I.,1989, which was subsequently changed to January 15,.

,,,

. :

1990,'because-the initial due date had been erroneously dropped

'om-the

,

"

~PGE commitment tracking system.

'

~

On March 6, 1989, the licensee developed an action plan for responding to

,

M m'

the long? term corrective acti.ons identified as"part of PGE's response to i ' '

tNRC concerns in.(a) Bulletin 80-8, (b)Bulletin 88-04, and (c) Notice

,

87-59; One of the ections in the plan evaluated the imppct of the.

'

setpoints on all:Barton 288A-instrumentsLused at Trojan.The action plan

,

Lis cur.'ently in progress.

.

,.

,

,

,

Novihiationsordeviationswereidentified.

'

,,

. N~i;

,

7.

Maintenance Requett Processing and Work Authdrization (92701,.93702)

+

,

'

'

" Trojan Administrative Order- (AO) 3-9; "Mai '.tenancesRequests,", Revis4n

'

,

,

.32, dated August 1,- 1989, establishes the administrative controls-for'

.

'

initiating, planning, performing and docum;nting maintenance _ vork.

At

.

y

+

Trojan any individual may initiate a maintenance request (MR).

After a i

.i

.MR is-: initiated for plant ec,uipment, it'is processeu through the sh1ft fsupervisor.who performs the following:

verifies the MRs validity,

,s x

accuracy and completeness; enters the applicable technical specification

,

-.and the number, of' any Limiting Condition imposed; specifies ths load work

~

,

group; and determines priority. The shift supervisor then forwards the

.

V MR to the alk coordinator for tracking purposes.

- The MR coorciactor forwards the wurk raquest to the planner who draf ts

.

the work instructions and initiates, if required, a safety' related outage

"

worksheet.

The work instructions are required to be of " sufficient

.

,

, -

~ detair to enable quclified: individuals to perform specified actions

'

.

.)

1 N'

,

'

q w7

-

,

-

,,

'

p

,

,

J

-

,

.

,

,

~

, 7?, m a

-;7

,

'

'

.

,

.

.

,

Fs,..f y

'

'

"

withoat direct supervision."' The MR is then forwarded to other

+

departments for appropriate input and review.

-

,

sm'

The MR is then returned to the cognizant worV group supervisor to review

~

the work-instructionsufor the following: correct quality classificatio0;

,

'

affect on' plant safety and reliability; and adequt:te consioaration of

.!

'

-requirements of codes, stbndards, re9uiatory guides, and PGC Ouality-

.

-

Assurance Program.- The cogniram-work group supervisor then forwards the "

,*

- MR to the maintenance activity scheduler who coordinatw the start of the-maintenance activity with plant Operations. Wher, the work scheduled date'

'

i

' occurs, the scheduler provides the MR to the work craft supervisor who -

,

distributes the: work to the craf tsman. The craftsman then takes the MR fg to the control. room and obtains the shift supervisor's authorization to start work.

e4

^

Prior to the shift supervisor. authorizing a maintenance request on'

safety-related equipir.ent,- he reviews the MR ano the associated work-instructions for affect.on equipment / system operability. This. review-is:-

'

performed in accordance with A0-3-14. " Control of Safety Related Equipment Cutages,"' Revision 22, dated June 21, 1989; the purpo e of;

,

which is to describe the method for planning safety-related equipment outages. If;the shift supervisor determines the maintena ce renders

.

L equipment inoperable, the shift supervisor assesses impact-on plant safety, completes.the safety-related equipment outage worksheet, cnd, if appropriate, authorizes the craftsman to perform the maintenance if plant conditions support-the work.

No violations or' deviations were identified.

8.-

Event Follow-up-(30702, 92701, 93702)

On September 6, 1989, to' implement plant setpoint change 89-002 on.

m'niflow switch FIS-611, MR 89-P491 was initiated by the cugnizant' plant

.

-

system' engineer, per A0-3-9, this engineer completed the appropriate tections of the Mi ard forwarded the MR to the shift' supervisor. The shift supervisor completed assigned sections of the MR. 'However, for the

'

Technical Specification / Limitation bkc he noted that T.T.S. 3.5.2 appikd ~but failed to note that Limiting Condition for Operation 3.5.2.d applied. This is an apparent violation of A0-3-9 (50-344/89-27-01).

In subsequent conversations, this shift supervisor stated he thought the Technical Specification / Limit 1 tion block met Technical Specification or limitation, instead of and limitation. Hc'also stated that the purpose of that block was to identify to the planner and scheduler any special considerations ti.at must~ be taken into account when planning or scheduling & maintenance activity. had the Technical Specification / Limitation block been properly filled out, the shift supervisor that authorized the work may have concluded that the B RHR pump was inoperable during the performance of the maintenar.ce.

dext, the ki sent to the mrintenance planner who developed MR 89-0491

'

-work instructions. The inspector discussed MR 89-8491, its work instractions and the work pa-age contents with the planner. He stated that he received the MR on Septem!,er 6 and planned it the same day f

-._

V*

-

'

7

>

,,

'

p

8 j

,

'

%'L

-

."o

,

i l

because it was a rush (Priority 1) request.

He stated that he recognized i

c0 that T.T.S. -3,5.2. and Limiting Condition for Operation 3.5.2.d applied,

<

'and<that the B RHR pump would be inoperable for portions of the

,

'

maintenance. -He also noted that (ecause the B RHR pump would be affected

^

~

- by the maintenance, he initiated a safety-related equipment outage

worksheet and included it with the work package.

The inspector notea the first step of the work request provided the option for-the shift supervisor to establish a clearance to isolate the flow indicating switch

.and that.genersilly clearances are required to set work boundaries. The

inspector as % the planner if optional cTearances were a standard

-

practice. The planner indicated that plant operations always had the, final say on establishing clearances,'and for this maintenance he wanted to provide maximum flexibility since he did not know exactly what plant

- conditions would be at the time the maintenance was performed.

Because MR 89-8491-work instructions did not specifically identify when

-

the B RHR-pump would be inoperable or that electrical leads would be lifted, the' inspector discussed the detail of work instructions with the planner. The planner stated that at Trojan, plant operations determines

~~ ability and that the level of detail of work instructions for the instrument technician craftsman is not detailed to provide the craftsman-maximum flexibility in performing maintenance. Because MR 89-8491 did not require a post maintenance test (PMT), the inspector discussed PMTs

.

with the planner. He noted that in the work in;truction a functional test was included.

The inspector noted the details of how to conduct the functional test were not specific and the planner agreed. The planner also noted that additional maintenance on the flow indicating switch was performed after the functional test and that a PMT should have been prescribed. He also noted that a PMT had been performed even though a fMT was not required.

On September 7 processing of the MR was completed, and the MR was

,

scheduled to be worked on September 8, 1989.. At approximately 7:30 am on

!

September.8, 1989, MR 89-8491-was reviewed by both the control operator and the shift supervisor. Per A0-3-14, they discussed the MR's impact cn RHR pump operability. They reviewed the technical Epecifications and the definition of OPERABLE. They concluded (incorrectly) that the RHR pump would remain operable throughout the work activity and FCV-611 could be operated manually, if required, to establish a miniflow recirculation path. They did consider the requirement-for the system to automatically i

function during a design-basis LOCA but did not consider implementing a compensatory action of stationing a qualified operator at the valve to immediately. open the valve if require 1.

Since they concluded the RHR e

pump's operability was not affected, they did not fill out the safety-related outage worksheet that was provided with the MR package.

They also did not question why the safety related outage worksheet was with the package. This is an apparent violation (50-344/89-27-02).

The inspector discussed with the control operator and the assistant shift supervisor their review of MR 89-8491. The cortrol operator stated, that he and the1 shift supervisor reviewed the MR and concluded the B RHR pump would not be inoperable because se technical specification did not specifically include FIS-511 and the MR work instructions did not identify the B RHP pump would be inoperable due to lifting electrical a

MS Otia J-'

,

.

..

.

V

?

-

,-

o

, f.

,

..

}

,

[

1eads to conduct the calibration of FIS-611.

With respect to the safety-related equipment outage worksheet, the assistant shift supervisor and two other shift supervisors noted that frequently MRs have the worksheets included and, in fact, the equipment is not inoperable.

They

l also stated that, even though the equipment is not made inoperable by the j

roposed maintenance,=they complete the worksheet and file it.. The g'

inspector confirmed this practice by reviewing the safety-rel.3ted i

E equipment outage worksheet notebook.

The control operator stated, if he had recognized that the calibration of FIS-611 had made the B RHR pump i

inoperable, he would not have allowed the calibration to he performed.

-

.

The inspector noted1 hat in January 1989 when FIS-611 was calibrated, that the B RHR' pump was declared inoperable, and that the same control

.;

operator lreleaced the work.

At 12:50 pm, the A SW-system was removed from service to conduct chemical treatment. This rendered the A RHR heat exchanger and the A ECCS subsystem inoperable.

However, the B ECCS subsystem was operable because i

'

-

when FIS-611, as isolated, would sense less than 805 gpm flow and FCV-611

.P would open on a safety injection signal and provide recirculation flow for the B RHR pumpt The operators, however,'did not recognize this at the time of authorizing the maintenance or when it was discovered that

'

work on both ECCS subsystems was in progress.

.

At approximately 2:45 pm shift change occurred.

Prior to assuming shift-

!

the on-coming shift supervisor reviewed plant logs, responeibility,fety-related equipment outage notebook and discussed with

'-

reviewed the sa his off going shift su)ervisor maintenance in progress.

The on-coming shift supervisor remem)ered discussing the maintenance on FIS-611 but did nct recall if the off going shift supervisor stated the B RHR train was affected.

The maintenance of FIS-611 was not included on the shift supervisor turnover sheet.

t At 3:20 pm, the craftsman performing the maintenance returned to the control room to obtain permission to perform the functional test for

'FIS-611.

At that time the shift supervisor realized that FIS-611 was the B RHR pump miniflow switch that was being worked and that potentially

-

both ECCS subsystems were inoperable.

.

As soon as the shift supervisor recognized that both trains of RHR were inoperable, he declared the facility to be in T.T.S. 3.0.3, reported the event to the NRC via the Emergency Notification System (ENS), and initiated event report (ER)89-154.

Subsequently, the licensee also decided to perform a Human Performance Evaluation System (HPES) review

-

for this event.

As part of the event report process, the licensee conducted two critiques-the purpose of which were to establish a sequence of events, immediate corrective ections and follow-up responsibilities.

The first critique, September 8 at 5:00 pm, established the following two corrective actions:

only work scheduleo on the Plan-of-the-Day would be allowed to be performed, and a formal policy statement would be issued.

The licensee concluded the immediate.orrective actions were required because (1) work was being performed that was not scheduled on the Plan-of-the-Day, consequently, the operating crews were having difficulty

-

_

.

.

m 7=

, 7 yr

~

~

'

s

bmC. ~c

(f

}

'

'

.

,

,

,

p y-7v

&

..,

,

,

tracking /evaluatingL the impact of the wor'k in progress, and' (2)' all' plant'

f. #,

, personnel ~needed to be immediately apprised of.tha change in conducting

-

l routine day-to-day operation.' The second critique, September 9, 1989, t,

established the following two additional corrective actions:

actions

"

g" were taken to hold the shift r,upervisor,= assistant shift supervisor and

. control operator accountable for their: actions; and lessons learned-

,,

.

' briefings-were_ held wlth all on-shift operating crews.

,

,"

On September 15, 1989, the event evaluation on ER 89-154 which included a -

t re-evaluation of ER 88-179 was complei,ed and presented to the Plant Review Board (PRB). ~ ER 89-154 concluded there were two prirsry causes.

"

,

-and.eight. contributing causes for the event.

The' primary causes were (1)

cersonnel' error in' determining operability and (2) inadequate -

administrative controls.

Administrative controls were a problem in that multiple challenges were presented to'the operating crews in theLform of work requests that could render two redundant safety systems

~

simultaneously inoperable.

The event report recommended fourteen corrective actions.

A weakness in work control, identified in the Event

' Report,. was the shift supervisor'or the' control operator made the only-operability determination prior to work being authorized. and this.

I represented a situation 'where ene individual could make a safety decision

,

that was not_previously;cvaluated. As a corrective action, the Event Report recommended a second operability determination be made prior to-y R'

authorizing work performance.

At the conclusion of the inspection

. period,_ the Plant rianager was reviewing the proposed actions for

.

assignment and action due dates.

'

-

The inspectors attended the critiques and reviewed the event report.

The critiques were generally effefcive in identifying event' chronology,

-

'

' identifying immediate corrective actions-and assigning appropriate

'

_ follow-up. actions.

The event report was timely, and generally thorough and complete.

To date, ER 89-154 has been the most timely and thorough-

- event evaluation the licensee has performed.

,

.

Generally, ER 89-154 identified the event :mises and recommended

• ,.

appropriate actions._ The event report di) not address the failure of MR

'

reviews conducted by various departments as a weakness.

The failure of

-

, 4_.

these reviews to evaluate RHR pump operability and quality of work

_.

instructions represents missed opportunities.

~

.

.

.;< r The event report also did not discuss the quality of the maintenance. work

'

instructions.

The work instructions left Plant Operations an option.to

'

-

_ establish a clearance for isolating the flow indicating switch.

The~MR

-

did not' require a post maintenance test (PMT); however, the work-

'

- '.

instructions appeared to include a PMT. The work instructions had-

,

'E FIS-611 isolated, drained and vented, then calibrated.

The instructions

Lwere:not_ specific enough to ind; rate that electrical leads would be

' lifted and, as a result, the 8 RHR pump would be inoperable.

.

(i Further, the event report identified that the shift turnover for this event was not adequate; however, no actions were proposed to improve the

/-

!

shift relief process.

The relieving shitt supervisor is not required to

'

review the authorized work or the work in progress.

The licensee could

'

.

i

.s

!

i

y fykg;V N D --J )9:

we ;

7=

' -

o

v ?

,,

,

'

.

y yf Nju

.i n';

.

,

~

N a; nlr,*y

,A f

.

m

-

n>

_

- l fyMgh,y 3

}j

,

's

G U., % 'e

.

.

W,

& W d ; nave;'improYed theih event report evaluation by considering that the fA

$$ * y 3 } !reljevifiggshi.ft supirvisor review in-progress work._-

1e*f 7 N J-o

>

t

,o

.

,

SN

'l

.

' l, 4 (

y y, g ;q"l Additionally,e the inspectors reviewed ER 88-179 to understand its N

-

.pote'ntial: contribution to this event.

During the inspectors' review of

'

tth'e January:13, 1989 Westinghouse JCO,'the inspectors identified the 7t M

ffollowing3twc potential concerns: Westinghouse seismic testingiperformed

-

v ?:on Barton flow switch model 581A atsumed Barton Model 288A-~were'of'

>

'similar design,_and,--as previously discussed, Westinghouse assumed that

'

'the miniflow recirculatien flow control valve were _'open vice shut. ~ When

'

the ; inspectors rec;uested support documentation to validate these

, ',.

"

assumptions, the licensee could not provide that information.;

The

'

-inspectors noted that_the Westinghouse JC0 had been the basis for

.

reportability and was considered in the safety evaluation for plant-

-

'

setpoint change-89-002.s After evaluating the inspectors concerns,-the

-

licensee'. initially concluded that the RHR pump would have been inoperable had a seismic' event occurred.' ' However, ~after conferring with

'

E Westinghouse and obtaining the appropriate justifying documentation, it

. appeared the recirculation flow control-valve would have operated using l

unrevised setpoints._:The review of the Westinghouse JC0 provides another

~

eu mple of:inadequatC 53.59 evaluation.and poor engineering work.

$

r l

Two violations werc identified.

9.

txit! Interview (30703)

~

The Inspectors met with the licensee, representatives denoted 'in paragraph-1 cn October 10, and'0ctober 20, 1989 and with licensee management

,throughout the inspection period.

In these meetings, the Inspectors tsummarized the scope'and. findings of the inspectioniactivities. The'

'

uo inspectors noted, that while' the shift supervisor erred in determining operability of the RHR' system, the work control-system does not' afford an

't appropriate second check to prevent a single individual's error from-x compromising safety. Additionally, an integrated effort may; have resulted

}

+: in the setpoint change being conducted during the outage when onlyfone

'

train of RHR would be required.

i t

^

,

i

.i 1%

.

j

'

'

' t, t [*

.

.

~

%

k j-

.

.

.

.-

t

.

~ (.

2 3'

y j

V y

>

,

j i

, t

,

<

.,. -

f

"

t

?

c

.-

'.($Y N ?

..p

_A

e! e a

,B, a ll2.

e,

'

-

..?

.-

+