IR 05000361/1988013
| ML20154N918 | |
| Person / Time | |
|---|---|
| Site: | San Onofre  |
| Issue date: | 09/08/1988 |
| From: | Gagliardo J, Stewart P NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION V) |
| To: | |
| Shared Package | |
| ML20154N915 | List: |
| References | |
| 50-361-88-13, 50-362-88-14, NUDOCS 8809300051 | |
| Download: ML20154N918 (34) | |
Text
1
, a
.
U.S. NUCLEAR REGU'.ATORY COMMISSION
REGION V
Report No /88-13, 50-362/88-14 Docket No , 50-362 License No NPF-10, NPF-15 Licensee: Southern California Edison Company P. O. Box 800 2244 Walnut Grove Avenue Rosemead, California 92770 Facility Name: San Onofre Units 2 and 3 Inspection at: San Onofre, San Clemente, California Inspection conducted: June 1, 1988 through une 14, 1988 Inspector: hw -
- [r-Hr. P6rry f(%wai't, Team J/eader 8 /[ ~
Dpte 41gned Region IV Team Members: J. O'Brien, Senior Reactor Inspector, Region V L. Defferding, Licensing Examiner C. Tolbert, Human Factors Specialist S. Sun, Reactor Systems Engineer P. Bibb, Resident Inspector, St. Lucie A. Hon, Resident Ins ector, an Onofre Approved By: #J /
J.E.'Gaglia/do,'EQPMan/g6r fhh/
Date SfgrWd' ~
Region IV i
Inspection Summary l I
Inspection on June 1 th.'ough June 14, 1988 (Report Nos. 50-361/88-13 '
50-362/88-14) l Areas Inspected: Special team inspection of Units 2 and 3 Emergency Operatirg i Instructions (E01) includlig the following areas: l o Bcsic E01/CEN-152 comparison o Technical adequacy review of the E0Is l o Control Room and plant walkdown o Simulator o E0I ongoing evaluation o Human factors related guidance esO93%hk PDR !
O l
- - _
. __ _
_
L *
.
. .1
Results: ,
General Conclusions and Specific Findinas: No unsafe operational '
conditions were identifie Sionificant Safety Matters: None, f
Summary of Violations: Non i Open Items Summary: During this inspection, three follow-up items were opene Follow-up is warranted in: (1) incorporation of instrumentation safety margins into the emergency operat.ing instructions,-when the CEN-536 study identifies the appropriate margins needed; (2) revision of the Writer's Guide to provide a method for incorporating minor changes into the emergency operating '
instructions; and (3) review of operator attitude and training in the use of the new functional recovery instructio i i
i l
l l
1
-
_ - _ _ - _ ______ . * '
g .
e DETAILS ,
1. Persons Contacted Southern California Edison (SCE) Company
- C. McCarthy, Vice President, Site Manager H. Morgan, Station Manager
- R. Krieger, Operations Manager V. Fisher, Assistant Operations Superintendent, Units 2/3
, * Wharton, Assistant Technical Manager ;
- G. Gibson, Compliance Engineer
'
j *M. Trillo, Unit 2/3 Operating Procedures Supervisor >
d
- T. Vogt, Assistant Operations Superintendent, Units 2/3
- M. Hyman, Training Administrator
- G. Swift, Training Instructor
- 0 Powers, Shift Technical Advisor '
- G. Vaslos, Quality Assurance Engineer T. James, Simulator. Training Supervisor R. Mette, Operations Training Supervisor M. Kelley, Simulator Training Instructor M. Jones, Operations Technical Assistant K. Johnson, Engineering Supervisor J. Tate, Operations Technical Assistant
- Denotes those attending the exit meeting on June 14, 1988.
! The inspectors also contacted other licensee employees during the course of the inspection, including oper.1tions shift superintendents, control
, room supervisors and control room operators,
,
Also in attendance at the exit meeting on June 14, 1988, were the following NRC and NRC contracted staff personnel:
W. Regan, NRR Chief, Human Factors Branch i A. Chaffee, Region V Deputy Division Director J. Gagliardo, Region IV Section Chief, CE E0P Manager P. Stewart, Region IV CE E0P Team Leader
,
J. O'Brien, Region V Reactor Inspector
-
C. Tolbert, SAIC, Human Factors Engineer L. Defferding, Battelle Northwest Labs, License Examiner S. Sun, NRR Reactor Systems Engineer A. Hon, San Onofre 1 Resident Inspector -
l 2. SAN ONOFRE 2 AND 3 (5023) E01/CEOG CEN-152 Procedure Comparison J
I A comparison of the San Onofre 2 and 3 (5023) Emergency Operating Instructions (E01s) and the Combustion Engineering Owners Group (CEOG)
l Emergency Procedure Guidelines (EPG) CEN-152, Revision 2 was conducted to j
ensure that the licensee had implemented procedures in accordance with the l CEOG recommendation The E0!s reviewed are listed in Part I, Appendix A, of this repor The comparison included a review of the licensee's
,
1
f I
, .
.
documents and interviews of personnel to verify that deviations fro CEN-152 were justifie The inspectors determined that the licenses had adequately developed plant specific E0Is to implement CEN-152, Revision 2. The changes from the CEN-152 recommendations were reviewed with the bases established and documented by the license No violations or deviations were identifie . Independent Technical Adequacy Review of the E0Is The 5023 E0Is listed in Part I, Appendix A, were reviewed to ensure that the procedures were technically accurate and incorporated the guidelines of CEN-152 Revision 2. This review verified that the CEOG step sequence was followed, the exit / entry points were correct, transfer between procedures was well defined and appropriate for procedures performed concurrently, that minimum staffing was met, and that notes and cautions were used correctl Each deviation from CEN-152 was reviewed to ensure that safety significant deviations were reported to the NRC as required, that safety evaluations were performed per 10 CFR 50.59 and that deviations warranted by specific plant design were incorporated, and prioritization of accidant mitigating strategies were correc The team determined that, in general, the E01s adequately incorporated the procedure guidelines of CEN-152. The summary of the findings and observations of the 5023 E0Is is as follows:
o The 5023 E0Is generally followed the CEN-152 Revision 2, step sequence with inclusion of plant specific actions and details, such as valve designations, or specific operation tasks required to accomplish the actions. The E0Is used floating steps (FSs) to include the non-sequence steps contained in CEN-152 (those steps designated with an asterisk). Specifically the FSs included instructions for re-startup of RCPs, throttling / stopping of safety injection (SI) flow, identification and elimination of voids, and termination of containment spray (CS) system, etc. Use of the FSs concept maintains the integrity of the sequential steps and prevents the operator from having to continuously go back through all procedure steps to locate and review a non-sequence ste o Entry / exit points to the 5023 E0Is were clearly stated and could be followed by trained reactor operators, o Notes within the S023 E0Is were gen 5 ally clear and appropriately located in the E0 o The CEN-152 prioritization of the accident safety function investigation hierarchy was maintained in the E01 o The plant specific values for plant protection system setpoints (e.g., SIAS, CIAS, CSAS) were consistent with the plant design valve )
- , .
-
.
During the E0I review, the team identified a number of technical concerns in the E01s, and they are listed along with the licensee's responses in Appendix B of this report. The identified concerns focused on three areas: (1) inadequate documentation of technical bases for the setpoints for the plant protection system or acceptance criteria of the safety function status checks; (2) omissions of major steps specified in the CEN-152 guidelines without technical justification for the omissions; and (3) deviation from the suggested procedural' steps listed in CEN-152 without providing technical bases and/or justification for the use of alternative steps contained within,the plant specific E0Is. During the inspection, the licensee either'provided the clarification to the E0P deviations from CEN-152 or acknowledged the technical deficiencies, which were identified by the inspection team, and agreed to correct them in the E0Is as required to be consistent with CEN-152 in the next revision to the 5023 E01s. The team determined that the licensee's resolutions were acceptabl The team also identified the following item regaruing instrument errors in an adverse containment. environmen o The industry recognizes that instrument accuracy is affected significantly by adverse containment environments resulting from the steam line breaks, feedwater line break, and LOCAs inside the containment. The instruments effected include pressurizer level and pressure, steam generator pressure and level, and reactor coolant system temperature indicator However, as stated in a letter from
, V. C. Hall (CE) to M. L. Merle (SCE), dated February 27, 1984, these ,
l errors have not been assessed for 5023. In general, only traditional (not including the effect of the adverse containment environment)
instrument errors for instruments (including plant protection setpoints) were considered in the preparation of the E0Is. The team identified a concern regarding the effective use of E0Is for
'
accidents resulting from breaks inside containment, since no consideration of instrument errors in these conditions was included in the E0Is in the area of setpoints for plant protection systems (i.e., SIAS, EFAS, CIAS, CSAS, etc.), nor in the acceptance criteria
] of safety function status check In response, the licensee stated that the study of instrument errors in a harsh containment environment, was currently underway with CEN Task 53 The licensee was awaiting the results of this project and will revise its E0!s j accordingly. In order to satisfactorily close out this issue, the ;
licensee is required to submit the results of the CEN Task 536 and ,
its impact to the 5023 E01s for NRC (NRR) review and approval. The ;
licensee also committed to provide a schedule for submittal of these i
,
document This item will be followed up by the NRC resident !
inspector during a future inspection (0 pen Item 50-361/88-13-01). '
No violations or deviations were identifie . Review of Validation Program and Independent Verification of the i E01s (25592)
J As a result of the THI-2 accident, NUREG-0899 was issued in August 1982 to j
'
establish the guidelines for the development and implementation of E01s which would provide the operators with directions to mitigate the l consequences of a broad range of accidents and equipment failure i
" 1
.
.-
i
t
, .
' 4
-
l
'
Paragraph 3.3.5 of this NUREG required that, after development, the E0Is were to undergo a process of verification / validation to determine that tne procedures were technically adequate, address both technical and human factors issues, and could be accurately and efficiently carried ou The licensee's procedure, OP-5023-0-39, Emergency Operating Instruction Authors Guide, outlined the validation program and provided detailed instructions and forms for desk top reviews and simulator exercise The licensee provided documentation to show that the simulator portion of their validation program met the following purposes:
o Determine that the simulator equipment uses the designations, units of measure and operation that is used in the E0I o Determine that the E0Is could be understood and followed without confusion, delays, or errors, o Determine that the E0Is are assured to guide the licensed operator in mitigating transients and accident A review of procedure records showed that the procedures had been reviewed and comments submitted, but documentation was not provided to verify that desk top reviews had been done or documented according to the Writer's '
Guide. The desk top reviews were expected to ensure that:
o The E0Is accurately reflect the CE0G Guideline o The E0Is accurately reflect the Writer's Guid o The E0Is use language and level of information that was compatible with the qualifications, training, experience, and the minimum number of licensed operators on shif o The E0Is referenco controls, equipment, and hardware that are availabl The inspection team conducted control room, simulator and plant walkdowns of the E0Is listed in Part I of Appendix A of this report to ensure that the procedures were validated and verified by the license During the walkdown, instruments and controls were verified to be correctly labeled, indications referenced in the procedures were available to the operator and values were not too specific for the indicators available (except for those deficiencies indicated below and in Appendix D). Administrative procedures were reviewed to ensure adequate controls existed to incorporate changes to the E0Is, and that the latest revision Wds available to the operators, and that they were easily accessibl Documentation of the licensee's validation program was reviewed to ensure that discrepancies noted were adequately addressed and corrected, and comprehensive reviews were conducted.
l The team noted that when modifications were made in the plant or the control room that the applicable E01s had not been changed to reflect the
_
i
, .
-
.
modification The team noted that several E01 deficiencies, which had i been identified, had existed for nine months in some case The root l cause of the accumulation of several minor deficiencies in the E0Is was
. that the Writer's Guide did not provide a mechanism for making minor corrections to the E0!s. The licensee ccmmitted to correct this ,
deficiency by changing the Writer's Guids, which will permit temporary I changes to the E0Is. The team determined that the licensee's proposed l corrective action appeared adequat l i
During one of the simulator scenarios, tae plant reached a condition where ;
a safety function could not be met in prccedure 5023-12-2, Reactor Trip l Recovery, Attachment 1, safety function status check, reactivity control C 1 or 2 and the crew returned to the Functional Recovery E0I. The hart 1, page 15 of 55, only required '
successpathRC-1, reactor power to be Attachment less than 10-1,g%,whichwasbeingmet. This would have ,
sent the operators back to trip recovery procedure agai The licensee l agreed to review this procedure and correct any inconsistencies in the
'
next revision.
l The licensee committed to make the appropriate procedure revisions to the deficiencies identified as noted in Appendix 0. The licensee's correction of the noted E0I procedural deficiencies will be followed up in a later inspection (0 pen Item 50-361/88-13-02).
No violations or deviations were identified in this are . E0I Training (25592)
The inspectors assessed the adequacy of the E0I training by reviewing three areas. The first dealt with observing an unrehearsed operating crew performing the E0!s in the site-specific simulator with scenarios designed to exercise each of the E0Is. The second effort was to review the lesson
plans and training records for the hot licensed and requalification operator training programs as it pertained to E01 training. Finally, interviews were conducted of a selected sample of the Operations Staff, i
- Simulator Scenarios The team's licensed operator examiner and reactor inspector developed scenarios similar to those used for licensed operator exams and EDI trainin During the performance of these scenarios with the
'
unrehearsed operating crew, the entire NRC E0I inspection team had the opportunity to: observe the operator's performance to validate or dismiss any concerna that may have been raised during the table-top
, reviews of the E0!s; assess the licensee's operating philosophy (possibly it differs from CEOG guidance in CEN-152); assess the human factors elements (place keeping, assignment of duties, physical interference, etc.) associated with the performance in a "real time" atmosphere; and observe how the operators diagnosed accident conditions, and transition from one E01 to anothe The team made the following observations:
l
- o The operators exhibited adequate knowledge of the E0!s and the l CEN-152 guidance.
__ - _ _ _ _ - _ _ _ _ _ - _ _ _ _ _ _ - _ - _ _ _ _ _ _ _ - _ - _ -- ._ _ _ _ _ _ _ _ _
-- -
4 i
. .
.
j l
o The operators seemed reluctant to use the Functional Recovery Procedure (FRP). See comments in paragraph c below and in Section 7 of this repor o Control room manning for a single unit implementing the E0Is was adequate; however, staffing would be slightly strained if both units were involved.in the E0Is. -See comments in paragraph c below, o Other Human Factors type observations are addressed in Section 7 and Appendix C of this report, b. Formal Training Programs Lesson plans and simulator scenarios used for E0I training were reviewed to determine whether the training covered the technical basis for the procedur The lesson plans and material reviewed are listed in Part III of Appendix A. This review included a review of attendance sheets for randomly selected lesson plans, and examined how the licensee handled makeup training for those who miss the normally scheduled training. The team made the following observations:
o The hot license training programs adequately covered the technical basis and operating philosophy of the E0Is; however, the requalification program failed to emphasize these area The requalification program involved approximately three hours of lecture and three hours in the simulator for each E0 No additional time was spent on the FRPs, o The requalification program relied heavily on the operations
"priority" reading program for E01 changes, and only had computer based "plato" exams to ensure that the operators were current with the E01 The training program met the minimum requirements as committed to by the licensee and was comparable to training programs at other similar facilities, c. Operator Interviews Operators were interviewed to determine their understanding of the E01s and their responsibilities and required actions, both individually and as a team. Additionally, operators were interviewed to determine if they felt that actions were duplicated by other operators, that they were knowledgeable of the requirements for transitioning from one procedure to another, and that training was conducted on revised E0!s before they were implemente The operators made the following comments indicating their concerns:
(1) Difficulty in the use of the FRP l l
-
. ,
l
.
"Entry conditions for the FRP were vague; you only enter the FRP when you don't know what to do." "The FRP is a last resort effort." "If you enter the FRP from one of the event based procedures you waste too much time confirming what you already ,
verified in the event based procedure." "Exit conditions from j the FRP are confusing." Training on selection of proper
.
success paths was weak."
(2) E0I procedures and training lacked guidance when both units were simultaneously implementing E0I l I
"The procedure provided adequate reminders of equipment and resources available from the other unit, but failed to address what would happen if the casualty affected both units." They also had no recollection of any training done to address this are These observations and the weaknesses in the requalification programs (paragraph b) were presented to the licensee at the exit meeting, and they noted that the improvements will be incorporated in the Revision 3 training this August 1988, and in the Revision 3 to the E0Is to be q implemented by October 198 ; No violations.or deviations were identifie . On coino Evaluations of E0Is (25592)
Administrative procedures listed in Part II of Appendix A were reviewed to ensure that the licensee has an effective program in place to maintain the E0Is up to date and provide feedback from operator experience, simulator exercises, actual post-trip reviews, control room / plant walkthroughs, and plant design change These administrative procedures were found to contain sufficient direction to ensure positive feedback of information to effect changes in the E0Is. In some instances, the procedure contained a
.
form for the user to complete, describing the proposed change, identifying the change by a specific number, and providing justification for the chang Several of these completed forms were reviewed by the team and j found to be satisfactor The team noted that E0Is were treated differently than other site procedures, in that temporary changes were not permitted to be made to E01s. This fact was noted in Operating Procedure 50123-0-20, Revision 0, paragraphs 6.4.3.2 and 6.7.1.1. Changes to E0Is could only be made in the more rigid permanent revision manner with formal review and approva This observation is discussed in Section 4 of this repor No violations or deviations were identified in this are ,
7. Human Factors Analysis of E01s (25592)
An integral part of the E0I inspection effort was to identify human
,
factors considerations in the implementation of 5023 E0ls. The human
, factors review covered a number of domains including analysis of the procedures, observations of instruments in the control room, outside the i
,
. _ . _
. .
. 8
i
.t control room, and environmental factors, to name a fe The' data were obtained via several methods:
. . .
! o Table-top review of the E0Is and the Writer's Guid o -Walkthroughs of the Unit 2/3 control rooms and plants.
'
o Observation of simulator scenario ;
o Interviews with operator ,
'
Specific examples of deficiencies discussed in this section are provided d
in Appendix C.
J ! Functional Recovery Instruction Procedure '
i !
,
The E0I inspection team observed that operators were reluctant to (
-
enter the FRP. The inspection team determined that based on the observations during the simulator exercises and the interviews with '
.
the operators, that the operating philosophy of most of the operators j included all or some of the following attitudes and perceptions of the FRP: '
<
l (1) Do not enter the FRP, unless operators had no idea what was ;
i happening in the plant and that no other recourse (e.g., E01) i 3 was available.
! .
! (2) A negative attitude toward the FRP; the operators did not think '
that the FRP would actually work in some cases. In two cases, ,
the FRP sent the operator to another E01, which then in turn :
sent the operator back to the FRP, because the acceptance r
,
criteria were different in the two procedures involving the safety function being mitigated.
_1
{ (3) The FRP was too cumbersome to use efficiently, based on the j method of entry into the FRP. The FRP contained all steps i necessary to satisfy the safety functions and stabilize the
, plant. However, if the operators were transferred to the FRP from an event based COI, they were required to start at the ;
beginning of the FRP, which may take several minutes to get to i the desired step, while repeating the same steps which had
!
previously been completed in the event based E01 (i.e., safety i
'
function checklist).
s s
] (4) The FRP was hard to follo The FRP included a basic text, t j figures, attachments, floating steps, safety functions .
- checklist, and success paths for each of the safety function t
'
In addition, no tabs or page numbers were given when a different
, section of the FRP was referenced in a procedure step. As a ,
i result, placekeeping, which was difficult in the event based '
] E0Is, was even more difficult in the FR i The deficiency deg ribed in item (2) above occurred because the FRP l
] acceptance criteria were designed to be less stringent than those in i
i
t
. .
-
.
the other E0Is. For example, in comparing the acceptance criteria on page 8 of the Reactor Trip Recovery procedure with those on page 25 of the FRP, two different acceptance criteria were found. This type of deficiency forced the operators to choose between one of two E0I ,
When asked what they would do in such a situation, operators gave varying response The team also determined that some of the above noted deficiencies were repeated in the E0I training program, thereby reenforcing the operators' attitudes noted abov As discussed in the training section (Section 5), operators have observed FRP failures to work, thus, decreasing operators' confidence it: the procedure. These deficiencies present a fundamental inadequacy in the implementation of the FRP during emergency conditions. The inspectors determined that since the FRP was supposed to be the procedure that will work I regardless of ongoing events, that collectively the identified i FRP program inadequacies were significant. The licensee committed to i l correct the above noted deficiencies, and their root causes (also I l addressed in this report) in the next revision of the FR This item l will be followed up in a future inspection (0 pen Item l
50-361/88-13-03).
b. Procedure Placekeeping i The inspection team noted concerns with placekeeping methods.
l During the scenario, the CRS was observed holding several pages in the E0Is with his fingers, and more than one procedure opened on his desk. No checkoff spaces are provided in the E0I Additionally, no method for recording time and associated parameter values in the procedure was provided. The licensee committed to make improvements with placekeeping method c. Procedure Organization No method is provided to aid operators in easily locating sets of steps, for example, floating steps, in the E01s. Based on the complexity of the E01s,some method, such as tabs, for subdividing the E0Is is needed in order to aid in the organization of the E0Is. The licensee stated that tabs would be included in the next revision of the E01 d. Casualties Requiring E01 Performance on Both Units.
l Ouring an emergency in one unit, the Shift Supervisor (SS) and Shift
- Technical Advisor (STA), who were shared by both units, would proceed l to the affected unit. Although this meets 10 CFR 50.52 if the unaffected unit were to simultaneous develop an emergency, it was not
'
l clear exactly how immediate supervision would be allocated to each I unit.
I As noted in Section 5, E01 training did not include dual-unit events
'
occurring simultaneously on both Units 2 and 3. The team noted that training could be improved in this area for the SS, STA, and CR e. Floating Steps (FSs)
l l
l
_
'
>
i
, ,
. 10
.
The inspection team noted that operators had differing opinions regarding the implementation of the FSs. The difference in understanding was felt to be indicative of inadequate training and lack of guidance in the Writer.'s Guide in differentiating between recurrent and continuous steps when defining verbs, such as "menitor" ,
and "initiate".
Overall the inspection team felt that the use of the FSs were an improvement over the guidance given in CEN-152, and that providing additional operator training and guidance in the use of the FSs would improve the implementation of the E0I f. Emergency Operating Instruction Documentation The EDIs were generally well-written and well-formatted, however.
l several human factors concerns were noted. These concerns included
! the following:
1 Handwritten notes were found in the Unit 2 control room E01 ,
The licensee promptly removed the marked-up copies from the '
l control room.
I l Some E01s contained steps that were not sufficiently specific.
l The lack of specificity is inconsistent with the guidance in the '
l Writer's Guide to present clear and unambiguous information ( B-19). Figures in the E01s are generally acceptable, although the xerox copies of some were found to be illegible, and identification of l
"acceptable / unacceptable" regions were neede l l Although specified by the Writer's Guide (p. B-5), ending an l instruction with a colon if nothing follows it is misleading.
l
'
Several examples were found throughout the E0Is and it was recommended that they be changed to periods. The Writer's Guide should selectively state that colons be used when substeps follow.
, The logical flow and organization of some E0I steps was awkward l or mismatched. In some steps, the logic appeared to be reversed j because the AE/R column described a contingenc g. Control Room
The E0! inspection team concluded that in general, the control room '
panels were reasonably well displayed and organized. However, the team identified several human factors concerns associated with execution of the E0!s. These deficiencies are described in Appendix l C of this repor I h. Local Control Stations l I
The following concerns were noted during walkdowns of local control ,
stations: I
, .
-
. Components needed to complete E0I tasks are inoperabl . In E0.1 12-12, p. 16 of 41 HR-2, RNO 1, operators are required to "Use fire hoses...." However, there are no fittings near the diesel driven fire pum . The accessibility of valves required in E0I 12-7 (LOFC) is limite . Several concerns were noted with the manipulation of the Inverter via the Manual Transfer Switch required in E01-12-16, p. 6 of 7 VA-2b. and e. These concerns included missing information, location of the fuses, and installation, 8. Exit Meeting (30703)
On June 14, 1988, an exit meeting was conducted with the licensee representatives identified in Section 1. The inspectors summarized the inspection scope and finding: as described in the Results section of this repor The licensee acknowledged the inspection findings and noted that appropriate corrective actions would be implemented where warrante The licensee did not identify as proprietary any of the information provided to or reviewed by the inspectors during this inspection, i
I l
l I
i I
i l
l
____---_--_____1 .
. .
- 12
.
APPENDIX A San Onofre 2 and 3 (5023) E0Is Reviewed (Revision 1): Standard Post Trip Actions S023-12-2 (Revision 2): Reactor Trip Recovery Guidelines ; (Revision 1): Loss of Coolant Accident Recovery Guidelines (Revision 2): Steam Generator Tube Rupture Recovery Guidelines (Revision 2): Steam Line Break Recovery Guideline (Revision 2): Loss of Feedwater Recovery Guideline (Revision 2): Loss of Forced Circulation Recovery (Revision 2): Functional Recovery Guideline (Revision 1): Reactivity-Priority 1 1 (Revision 1): RCS Inventory 3 1 (Revision 1): RCS Pressure-Priority 4 1 (Revision 1): Heat Removal-Priority 5 1 (Revision 1): Containment Isolation-Priority 6 1 (Revision 1): Containment Temperatures and Pressure 1 (Revision 1): Vital Auxiliary-Priority 2 I Procedures Revised Which Wera Referenced In E0Is S023-3- Shutdown Cooling System Operation .5 Plant Shutdown from Hot Standby to Cold Shutdown .2.22 SFAS Operation S023-3-2.28 Containment Combustible Gas Control System i
III. E0P Training Material and Lesson Plans Raviewed Classroom and Lecture Presentations:
l Lesson Plan Lesson Title l
2E0701 Introduction to Emergency Operating l Instructions I
, 2E0702 Standard Post Trip Actions (Classroom) I 2E0703 Loss of Coolant Accident E01 (Classroom)
2E0704 Steam Generator Tube Rupture E01 (Classroom)
l 2E0705 Excessive Steam Demand E01 (Classroom)
2E0706 Loss of Forced Circulation E01 (Classroom)
2E0707 Loss of Feedwater E01 (Classroom)
'
2E0708 Functional Recovery Actions (Classroom)
2E0709 Reactor Trip Recovery (Classroom)
i 2E0712 Standard Post Trip Actions (Simulator)
_ . -
4.
, ,
. 13
.
2E0713 Loss of Coolant Accident (Simulator)
2E0714 Steam Generator Tube Rupture (Simulator)
2E0715 Excessive Steam Demand (Simulator)
2E0716 Loss of Forced Circulation (Simulator)
2E0717 Loss of Feedwater (Simulator) ;
2E0718 Functional Recovery Actions (Simulator) ,
2E0719 Reacter Trip Recovery (Simulator)
'
2. Simulator Scenarios and Lesson Plans:
Lesson Plan Lesson Title i 2RS719 Reactor Trip (SPTA) !
2RS719 Ciergency Boration 2RS719 ATWS 2RS719 Functional Recovery 2RS720 Turbine or Generator Trip :
. 2RS720 SBCS Auto Control Malfunction 2RS721 HFWP Trip / Recovery i 2RS722 Loss of Offsite Power ,
2RS722 Operation during System Disturbance 2RS723 Reactor Trip (SPTA)
- 2RS723 Loss of RPS Channel !
j 2RS723 CEAC Failures ,
! 2RS724 Boration/ Dilution at Power 2RS724 Salt Leak >
'
2RS724 Loss of FFCPD
! 2RS724 Loss / Failure of Normal Feedsater i j 2RS725 Fire Inside Containment ;
2RS726 RCP Seal Failure '
2R5726 Loss of Offsite Power
.
2RS726 Natural Circulation Cooldown ,
i 2RS726 Loss of Shutdown Cooling System !
! 2RS726 De:ay Heat Removal '
2RS727 Loss of CCW System j 2RS727 Loss of CCW to RCP 2RS727 Loss of Instrument Air 2RS727 Loss of RPS Channel
,
2RS728 Fuel Failure /High RCS Activity
} 2RS728 Plant Shutdown J 2RS728 Small Break LOCA Inside Containment
2RS728 RCS Leak 2RS729 Loss of Shutdown Cooling System
- 2RS729 Loss of Vital Bus i
'
2RS729 Large LOCA Outside Containment 2RS730 Loss of Non-IE Instrument Bus J
2RS730 Main Steam Line Break 2RS731 Loss of All Feedwater
'
2RS731 Loss / Failure of Normal Feedwater 2RS731 Loss of Vital DC Bus
!. 2RS731 Reactor Trip Recovery
} 2RS731 Inadvertent CIAS i 2RS732 Loss of Condenser Vacuum i l l
,
a
_ _ _ _ _ _ - _ _ _ _ _ _ _ _
i
. .
- 14 l
. l 2RS732 Loss of Saltwater Cooling 2RS733 Earthquake 2RS733 Saturated RCS Response 2RS733 Large LOCA Inside Containment 2RS734 S/G Tube Leak / Rupture 2RS734 Loss of Load 2RS734 Operation During System Disturbance 2RS735 Small Break LOCA Outside Containment 2RS735 Contaminated Injured Man 2RS735 RCS Leak P
I
\
l l
l I
l i
l J
.-. - _ . . - _ _ . - _ .
. _ - . --
. . _
. . _ .
.
)
i
. .
-
-
i l
!
- !
APPENDIX B 3 Technical Review Questions and Answers '
!
- The following are inspection team questions as a result of reviews of the 5023 E01s. In the following responses, the licensee either provided i clarification for the deviations from CEN-152, or acknowledged the deficiencies ;
identified by the inspection team and agreed to correct them in the next revision to the E0Is. Section 5 of the report provides further discussions :
1 regarding these item !
- , E01-5023-12-1 (Revision 1): Standard Post Trip Actions l l Q1: Step 3 - start of emergency boration: no procedure is included or !
referred for initiation and termination of emergency boration while .
CEN-152 requires boration to be consistent with Technical l l Specification value Provide justification for the omissio !
j R1: Emergency boration is an evolution covered frequently by operators as
- part of their training and in simulator scenarios. Ur.it ACO :
, Task 222BGB0968 "Emergency Borate the Reactor Coolant System," is l taught in the CVCS classroom lesson 2XA206 (Objective 3.10: List the
] controls used and describe how they are manipulated to i j achieve... Emergency Boration). This task is also taught and !
i reinforced in the Emergency Boration AOI Lesson 2A071 l
} Lesson 2E0712, $PTA Simulator, contains a scenario that requires j
! Emergency Boration, and states that the "students should carry out t i
the following (E.B.) steps from memory." In addition, this event !
1 (ATWS) will send the Operator to the Functional Recovery i
) instruction (S023-12-9) where detailed instructions exist (in RC-2) l for verifying emergency boration is properly established. Regarding
'
terminationcriteria,theSafetyFunctionStatusggeckof 5023-12-8 j 1 (Functional Recovery) requires "Reactor power <10 AND not rising." i j It must be noted that the bases of the Reactivity Control Safety j runction is W T to restore the Tech Spec Shutdown Margin (50M) but a
simply to ensure the reactor is and remains shutdown. This is I consistent with CEN-152 which states that "Since (normal) procedures i
requireborationpriortocooldown,tysecriteriaareadequateto ensure shutdown." Upon achieving <10 the operator would return to
- the RTR procedure (5023-12-2) and if the boron concentration was also
'
greater than 1750 ppm exit then he would exit E01's, and confirm that SDM requirements were met (by performing 5023-3-3.29 "Calculation of SDM"), and then secure emergency boratio (Also, see Response to Question 2 of E0! S023-12-2 for acceptance criteria of boration.)
! Q2: Step "verify RCS saturated margin >20'F." The inspector has j
the following concerns:
! Whether kCS saturated margin is used in this procedure while the I core exit saturated margin is used in all the other E01s?
l Whether the instrumentation error due to the adverse containment !
environment was included in the acceptance criteria or not? l
! i
. -- . . - . .
.- . -- . .
l
,o .
. 16 l
'
,
!,
l
!. c. Indicato instrument uncertainties e identified in a letter from l Hall (CE) to Merlo (SCE). dated February 27, 1984. Also addross SCE's position on the other five issues indicated in the same lette R2: a. To be consiste's with the other E0!s, the RCS satumtion margin will be changed to specify core exit saturation margi b. The instrument error is included in 20'c based on the SCE's !
calculation. The inspector determined that the method in !
CEN-268 was used and that the instrument errgr in the hagsh containment aavironment contributed about 13 F to the 20 F saturated margin. The calculation was based on tae assumptions of the contrinment environments with initiation of the RCS pipe ,
breaks inside containment for 6 few minutes, therefore further analysis is needed to assess the long term effect of the harsh ,
containment environment on the acceptance criteria of the :
saturation margin (see' response c.6 of this cuestion). l f
c. Response to Enclosure Items 1 - 6 from Letter to M. L. Merlo ,
from V. C. Hall dated February 27, 1987, Subject !
Upgraded SONGS Units 2 and 3 Emergency Procedure Technical Guidelines (EPTGs).
(1) Pressurizer Fill and Drain as a Method of Plant Depressurization
,
The Loss of Forced Circulation (LOFC) E0i directs the operator to use the fill and drain method of cooling the !
Pressurizer (PZR). During the LOFC emergency, assuming a :
loss of offsite power, as part of the Pesponse Not Obtained t (RNO) for step 14 g, the operator alternately fills and j drains the PZR. The concern raised by the use of this l l method is the possibility of inadequate mixing, and !
therefore cooling of the PZR resulting, rather in an !
increase in saturation temperature and pressur !
,
f (2) Hot and Cold Leg Injection Procedure and Boron l Precipitation l
The LOCA EDI uses the guidance provided by the EPTG with j regard to hot and cold leg injectior'. This injection ;
l method is used between two and four hours following the '
LOC The procedure steps involved do not address charging pumps. Charging pumps are maintained running until such time as the Si throttle and flow criteria are satisfied as specified in FS- (3) Reactor Coolant Gas Vent Syrtem The E01s referencas use of the gas vent system in the F The step request evaluation by the Emergency Coordinator for its use in dealing with void eliminatio The licensee agreed wfth the recommendation provided by CE that use of
- -
I~
,*
, .
.
.
the gas vent system should not be part of the "normal" strategy used in developing steps for void eliminatio The licensee indicated, however, its use should be considered under the close evaluation of the technical staff as a potential use of non-condensible gas elimination in order to avoid the possibility of further core degradatio (4) ,AFS and Emergency Feed Actuation Sianal (EFAS)
The E0!s incorporate steps which direct the operator to reset EFAS when SG 1evels are above 30% (NR) (This is the reset value of the actuation signal.). It than further directs the operator to maintain levels between 40% to 80% NR which requires manual operation of the AFW syste No automatic level control system is provided for maintaining SG levels using the AFW syste (5) Post Accident Samplina System (PASS)
The PASS is not addressed in the E01 This is consistent with CEN-15 (6) Instrument Inaccuracies The issue of instrument error in the harsh containment environments is an on going project (CEN Task 536). The licensee is currently actively participating in the project. In order to resolve the issue of instrument error in the harsh containment environment satisfactorily, the licensee is required to commit itself to perform analyris for instrument errors and provide the schedule for submittal of the results of instrument error analysis and its applications to the E0Is for NRC raview and approva (This is identified as an open issue and will be followed up and closed out by the NRC on-site inspecto See Section 5 for further discussion.)
Q3: Pages 2-3 and 2-6 of EPTG relate to Step 12, which states do rot operate RCPs when pressurizer pressure <1430 psia. The licensee had a difference between the E01 and EPTG since the E01 directs the operator to trip two RCPs and leave two RCPs running. Clarify the inconsistence in E01 vs. EPT R3: The EPTG provided plant specific information and was issued by Combustion Engineering (CE) to SCE for the purpose of drafting the E0Is. EPTG Revision 1 included revised RCP operating strategy which specifies "tripping two RCPs (one in each loop) if the RCS depressurizes in a rapid and uncontrolled fashion below the pressurize pressure of 1430 psia." This is reflected in the current revision of the E0I The inspector determined the above explanation is includeo in the revised EPTG, which clarifies the apparent discrepancy between the E0! and the technical oasi J
. .
- 18
.
Q4: Step 6 - E0I does not include Sa, Sb, Se of CEN-15 What is justift:ation foe omission?
R4: The E01s use the verb ENSURE, which is defined in the Emergency Operatina Instruction Authors Guide 5023-0-39 Table 3-1 page 30 as "to verify a specified condition exists, and if it does not, to manually take the necessary steps to establish the condition." Operators response to this term encompasses the requirements of CEN 152 step Sa, Sb, and Se.
!
l Q5: Step 7.4 - Step continnency action 6.C of CEN-152 is not included.
i What is justification for omission?
'
R5: EPTG Step 6 Cogtingency Action verifies RCS Subcooling greater than '
or equal to 20 F is not, in itself, indication of natural circulation conditions. Verification that T cold and T hot are not rising is i considered a positive indication of natural circulation and thus a .
preferred method of verifying satisfactory Core Heat Reuva I However, in the next revision of the E0ls, the RNO step addresses l taking action to restore subccoling if indication of single phase !
natural circulations is los '
Q6: Step 8.B.1 & 2 : 3 values (40%, 25%, 80% of narrow range) are given I to initiate action - What is the technical bases for these values?
(Refer to Question 6.C for instrument error also.)
R6: 25% NR is the ESFAS setpoint for EFA Instrument uncertainty is already included in the development of the ESFAS setpoints independent of the E01. 40% NR to 60% NR is consistent with the CE i EPTG prepared for 502 '
Q1: Step 10.2 specifies "containment spray header >50% " Does the l instrument read in GPM or in %? What is the 50% flow rate in GPH I
(CEN-152 specifies the containment spray flow to be greater than 1500 GPM or plant specific value).
R: The spray flow instrument reads in % flo >50% flow corresponds to
>1750 gp This is in accordance w"th startup testing performed at
.
SONGS (ref PE-226-01).
Q8: Step 11.A - Hydrogen concentration is 0.5% Why do you use 0.5% and does it include instrument uncertainty? ,
k8: Specification of 0.5% Hydrogen will be removed from the next revision to the E01s. This is consistent with CEN-152 Revision CEN-152 Revision 3 deletes the requirement to monitor H2 because no H2 is expected following an uncomplicated reactor tri Revision 3 specifies maintaining containment temperature and pressure as a means of controlling ths H2 (ref. p. 2-19 and 2-20). H2 recombiners are addressed in the LCCA E01 which places the H2 recombiners in service as specified in the EPTG App. A, page A-39 step 5.12 _ _ _
'
o
, ,
. 19
.
Q9:. Step 14.A.1 Regarding recovery diagnostic - the recovery diagnostic diagram is different from CEN-152. How are you gcing to effectively use the Table, since CEN diagram has flow arrow? j R9: Objective 5 of Lesson 2E0702, SPTA Classroom, is "use the Recovery Diagnostic to identify the recovery instructions to be implemented." ,
The suggested strategy for the instructor to teach this lesson is to l fill out the worksheets on the overhead while the students do the '
same in their individual copies of the E01. One of the lesson's review questions gives the students a practical exercise in using the 1 Recovery Diagrostic, and the lesson's closing statement says that the Recovery Diagnostic must be utilized even if the event's diagnosis is obviou The correct use of the Recovery Diagnostic is reinforced through all i E01 training since the operators must go through the Standard Post
Trip Actions (SPTA) and diagnose the event to get into the Reactor ;
,
Trip Recovery (RTR), any other Optimum Recovery Instruction (ORI), i d
and/or the Functional Recovery (FR). The next revision to the E01s !
however, will be using a flow d!agram similar to the one used in l CEN-152 Resision l
'
II. E01-5023-12-2 (Revision 2), Reactor Trip Recovery (RTR) {
f Q1: Entry conditions - In CEN-152, states that "standard post-trip i
actions have been performed"; the E01 does not include this I statemen ;
<
l R1: The implications of this Entry Condition step is for the operator to
- take an action verifying "standard post-trip actions have been
.
performed." It is therefore an action step and not a condition for l I
entry to the RTR. Also this Entry Condition step is the same as stop '
l 1 of the Operator Actions CEN-152 and is therefore redundant and not !
require '
,
Q2: Step C.2 of attachment 1 - What is the technical basis for boratten to 1750 ppm?
!
R2: This boron concentration was chosen for simplicity as it matched the l
required boron concentration in the Refueling Water Storage tanks and was also the bxsis for the Shutdown Margin requirement of 5.15% which ;
assumes a EOL MSLB accident and ensures the Reactor remains !
subcritical during this event, assuming all CEAs were inserted except
,
the worst rod stuck out. However, the only time this number is used ,
is during ATVS events, in which case the normal plant procedures !
would ensure emergency boration continued until the required SDM was
restored. It is not intended that emergency boration be stopped upon i achieving 1750 ppm until confirmation of required 5.15% SOM is
assure If an ATWS event occurs concurrent with a LOCA/MSLB/SGTR j those E01s ensure that prior to initiating cooldown that the
"Emergency Coordinator evaluate RCS boron requirements for cold
, shutdown," and then the required concentrations are establishe It is Qanned to replace tnis nun:ber with the criteria that "power is l <10 % AND Emergency Boration is in progress, 5.15% SDM has been
,
i
o
, ,
.
.
achieved" in the next revision to clarify that once the RTR procedure has been achieved, emergency boration will continue until the Technical Specifications required SDM is restore III. E01-5023-12-3 (Revision 1): Loss of Coolant Accident Q1: Step 4-E, the E01 does not include steps 3 and 9 of CEN-152 after step 4. Provide justification for omissio R1: With input from Steam Generator Blowdown, Air Ejector, and Main Steam Line radiation monitors, there is adequate information to determine the presence of a SGTR. Because of the time involved in drawing and analyzing SG samples it is not considered the most expedient method for aiding the operator in LOCA diagnosi Therefore, this direction was not incorporated in the LOCA E0 $1AS initiation is recorded in step 1, and therefore, step 4 is not neede Q2: Step 17 A provide the technical basis for 40 R/hr to activate CSAS to remove iodin R2: 40 R/r is based on maintaining the cumulative thyroid dosa at the Exclusion Area Boundary less than 170 mrem /hr, which is below the level at which a protective action guide of sheltering would be recommende Ref: Letter P. J. Knapp to H. E. Morgan, "Loss of Coolant Accident Emergency Operating Instruction", March 28, 198 Q3: Step 7 - the concept of a "floating step" is not used in CEN-15 Justify the use the of the FS and how it is consistent with "PGP Writer's Guidelines."
R3: CEN-152 refers to non-sequential steps as those perforesd l strategically any time the specified condition (s) exist and are designated with an asterisk, i.e. * Steps Performed Continuousl The E0I Writers Guide, which was part of the PGP, in section 3. explains and justifies the concept of "floating steps". The FS ,
concept differentiates between sequential and non-sequential steps by j concentrating the latte This maintains the integrity of the I sequential steps preventing the operator from having to continuously go back through the procedure to review a ste Q4: Steps 8.6,11.6 and 12.e - no minimum feedwater flow, as required by CEN-152, is included in the steps. Provide the technical justification for the omissio R4: Above 40% NR level there is ao minimum feed flow requiremen Steps 3.b 11.b and 12.e in combination with 12.h provide adequate direction for maintaining SG level QS: Pages 42 and 49 - the figures appear difficult to rea Enlarge figure for increased lagibility, i
R5: SCE will enlarge figure to allow for increaso legibilit !
i
o
. .
-
.
Q6: Safety Injection Flow (SIF) figure page 35 - consider whether this curve needs a note "This curve is for conditions when a charging pump is running." If note is not needed, do the E0!s ensure that the charging pumps are running?
R6: The SIF figure shows the minimum acceptable SIS flow at the cold leg
, injection point which will ensure adequate heat removal capabilities
during cold leg injection mode and recirculation mod The figure is provided as a tool for the operator to verify SI flow t.ing specifically installed instruments which do not including charging pump flow rates. As such, a note of this nature. would not be technically accurat The exclusion of this 'nformation from the figure does not by itself violate the provisions of the accident analysis. Rather, compliance with the requirements of the Technical Specifications and adherence to the EPG and EPTG for the E0! ensure the provisions of the accident analysis are satisfie Step Sa of the E0I ensures all available pumps are running to establish maximum SI flo FS-2Ba checks to ensure flow is adequate per SIF curve and if not, the RNO step specifically addresses ensuring all available charging and SI pumps are running. The next revision to the E01 will specify the charging pumps as part of the initial SI flow verification, i
IV. E01-5023-12-4 (Revision 2): Steam Generator Tube Rupture 91: Step 6.8.3 - the 200 degree F (which is a Technical Specifications '
limit? appears to have no margin, i.e., if operation exceeds it, the Technical Specifications are violate ! R1: Exceeding 200 degrees per hour (for a short period of time, i.e.,
less than one hour) is not a Tec.hnical Specifications violation although it is very undesirable to enter the action statement. The maximum anticipated operator initiated couldewn cata woulo come when lowering the PZR pressure from 2250 psia to 1000 psia during the SGT With both spray valves fully open this 108 degree change could
occur over about 14 minutes. When averaged over any one hour period,
] this would still be less than 200 degrees per hour. In actual
practice however, normally only one spray valve is used and it is not opened full Q2: Step 14.e - after resetting EFAS - Do you still have AFW operating?
If so, is it necessary to add step e "AFW"?
R2: In the absence of a MSIS, when the EFAS is reset, any AFW flow that existed prior to the reset of the EFAS will be maintaine It should be noted that HFW could still be providing water to the intact SG, and thus it is not recommended that we change Feedwater to AF SCE will make a further evaluation to ensure subsets e and h are consisten Q3: Step 16.A - refers to when a termination criteria is achieved -
reference needed to FS 5 (page 33 of 56)?
I
o
, ,
. 22
.
R3: The next revision to SGTR references the appropriate F Q4: Step 17.C - substeps 1, 2, 3, and 4 appear to be steps (not .
substeps).
'
R4: Substeps 1 thru 4 all have to do with establishing one train of CCW non-critical loop supply and return to the containment, and therefore are not stand alone step SCE will review and restructure these step ,
QS: Step 19 - step A - Establish T hot >385 degrees; step B - Establish pressurizer pressure - This appears to be a logic loop - suggest i
adding the words "if not go to step 19A and lower temperature" to step RS: This will be corrected in the next revision to the E0I E01-2023-12-6 (Revision 2): Loss of Feedwater Q1: Step 1.c - why is this step here? - The step is for checking that a diesel generator is loaded while the contingency action is to verify availability of offsite power and then unload the diesel R1: Step la of the E01 requires completion of the SPTA which includes ,
verification of the availability of offsite powe This verification is implied in the use of the word "unloaded." A reliable source of offsite power is important to establish as an action step for 1.C and
! more evaluation is important prior to stopping an unloaded diese i
Q2: Step 9.d - Why are condensate pumps not considered as a feedwater !
source to be consistent with CEN-1527 l
R2: Next revision to the E01 will add'.*ess this option. The present draft still provides for using the condensate pumps in the functional l recover During the simulator validation of the revised E01s use of the condensate pumps will be reviewed to determine its feasibility, i l Q3: Step 1.6 - Recording SIAS time does not appear necessary for a loss
) of feedwate R.1: The next revision to the E0I does not reference SIA CEN-152 Revision 3 removes the requirement. However, containment temperature and pressure are monitored an:t SI throttle criterf a are included in s the FS in tne event SI was initiate I VI. E01-5023-12-8 (Revision 2): Functional Recovery Q1: Subprocedure PC-1 of chart (page 33 of 55) - CEN-152 has VCT l included. Provide the justification for omission, l R1: The normal post SIAS actuation borated water supply to the charging i pumps is the RWST and/or the Boric Acid Makeup Tanks. The VCT outlet !
valve to the charging pump suction, LV 0227B, closes on a SIAS l l
'
e
. . 23
.
actuation and has no override capabilities from the control room and, therefore, is not used as a suction path to the charging pump Q2: Step 2.a (page 2 of 55) seys stop 4 RCPs while FS 1.a (page 7 of 55)
says to check at least 1 pump per loops stopped. Provide the technical justification for tne inconsistenc R2: The next revision to the E0! corrects this inconsistency so that all RCPs will be tripped in both step VII. E01-5023-12-14 (Revision 1): Containment Temperature and Pressure Q1: CTP-3, page 5 of 9, step 4 - Why not check containment spray (CS)
pump for cavitation also?
R1: The NPSH requirements for the HPSI pump is more restrictive than that of the CS pump (12.S' and 11.5' respectively). Therefore a problem with the HPSI pump cavitation would also indicate a similar problem with the CS pum The RNO for step 4 a. is the throttling of the CS pump discharge valves which would reduce the cavitation of both pump !
i
o l
. .
. 24 !
.
APPENDIX C EXAMPLES OF HUMAN FACTORS DEFICIENCIES 1. Absence of Specific Information E01 12-4, step 10, RNO 1. The RNO states, "Open ADV to control RCS T." The operator took r.everal minutes to determine which 3kmosphericdumpvalvetoopen. The specific ADV should be explicitly indicated in the E0 The licensee agreed to correct this ,
in the next E01 revision, E01 12-6, RNO step 5.c.1. "Evaluate Stopping Pumps." The specific pump should be cited, especially since the A/ER refers to just one main feed pump, and the preceding step identified three different pumps.
I E01 12-16, VA-1, RNO "Attempt to re-energize Bus from:" In this case, the corresponding A/ER is in plural form, which makes the RNO reference to a bus confusing. The appropriate bus should be identified, e.g., energized or unenergized.
i E01 12-14, CPT - 3. "Check contain. ment emergency sump cooling."
Since there is no specific sump cooling system, the required action must be more specific. The operator could not determine what actions were required to complete this step
2. References 4 E01 12-4, step 1 "Check SI termination criteria." Since these criteria are only found in the FSs the exact location should be specified, i.e., "refer to FS 5 (p. 33 of 56)". E01 12-3, FS-2 Reference should be made to where the "Figure PT limits" can be found, e.g., a page number or figure numbe EDI 12-7, RNO step 1 Go to substep a." The step number
associated with the substep letter should be included, e.g., "Go to substep (13)a." E0I 12-4, RNO step 17.c.3. "Go to substep d." the step number associated with the substep letter should be included, E01 12-3, p. 22 of 65, end of FS-2 No reference is provided to tell the operators where to go next, especially since the subsequent 1 two pages are figures rather than FS-20 or FS- I
' E0 12-4, step 12.J. "Initiate Applicable Unit Cooldown Attachment 3 or 4." Reference should be made to indicate that Attachment 3 is for Urit 2 cooldown and Attachment 4 is for Unit 3 cooldown, E01 12-4, pages 13 and 15 of 5 Indication should be made at the bottom of the page that the E01 continues (e.g., "cont.") onto the
- _ _ _ - - _ - - _ _ _ _ _ _ _ - - _ _ _ _ _ _ _ _ _ - _ - - _ _ _ - - _-__- _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ - - _ - _ _ - _ _ - - _ _ _ _ _ _ _ _ _ _
l o
o .
-
.
'
subsequent page. On page 15, also, more blank space is needed between "Action / Expected Response" heading and step 1 As presently formatted, step 13 is not readily visible as it could b E01 12-8, p. 8 of 55. An indication that this FS (FS-28) continues af ter the subsequent page, which is a figure, is necessar . Figures E01 12-3, pages 42 and 49 of 6 The central part of the figure, containing the actual curves, should be enlarged to increase the ,
figure's readabilit In addition, the quality of the reproduced '
copies found in the control room of these figures was also poo E0I 12-4, pages 18 and 19 of 56. Feedwater is measured in gallons or kilo gallons on the figure However, the feedwater instrument is measured in percent (%). Therefore the operator must make a '
conversion. The units of measurement on the figures should be consistent with those on the required instrument (s). E0I 12-3, p. 19 of 65, and other E0ls that use this SI Flow figur The figure does not identify how many injection points are acceptable (3 or 47). In addition, the figure does not identify acceptable and unacceptable regions, which is of significant aid to the operato The table that is embedded within the figure formats has units of ,
measurement differegt from the figure's units of measurement. The table reads "LB/In. a" and "GAL / MIN"; whereas the figure reads "PSIA" and "GPM." The table units should be changed to be consistent with the figure i E0 12-3, p. 63 of 6 The figure contains a box in the lower -
lef t-hand corner which contains illegibly printed information. Also, l the last line of text on the page is very light due to poor xerox !
qualit All printed information should be checked for readability following document reproductio ' E01 12-8, p. 15 of 55, and dll other E0!s that include this Pressure / Temperature Limits figure. The figure does not identify acceptable and unacceptable regions. Due to the high number of curves that are included, a designation of what is and is not {
acceptable would help the operators read the figure more quickl This information could be provided with two different colors, and l thus wtuld not further visually clutter the figure. The xerox quality of this figure is marginal, and some of the print is blurred togethe . Organization and Clarity E01 12-3, p. 34 of 6 The logical organization on this page is I cumbersome and not immediately obviou The OR between steps a and b l is not very apparent, so the operator may not see it until the operator has read through most of the step A method for grouping j all steps in a vs. those in b would help this problem, e.g., boxing ;
l each set of steps separated by o Once the distribution between a j i
_ _ _ _ _ _ - _ _ - _ _ - - _ _ - _ _ _ _ _ _ _ _ _ _ _ - _ _ - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __-__ ____ --
'
a l
, ,
. 26 l.
j and b is highlighted, the remaining logic can more easily be !
l addressed. It is not clear why ANDS were inserted between each step ;
l under a. This is a conflict with the Writer's Guide, which suggests a list format for a series of inclusive step . EDI 12-4, step 7.a. This step could be rewritten as an If - Then 1 statement because step 1 is only to be performed j f "a" is availabl '
l l Operators could inadvertently perform step 1. without first examining l l
a. and understanding the contingency.
l l
' E01 12-4, step 8 b. The logic between the A/ER and RNO is I mismatched, i.e., the RNO does not follow directly from the A/E f The logic of this step should be reorganize E01 12-4,-step 13. Substeps 1. and 2. of this step should actually j be b. and c. because they are not substeps beneath a. but instead of !
equal level with The Itcensee has agreed to correct this on the ;
next E0I revisio l E01 12-4, step 17.c. Substeps 2-4 are actually part of 1), and therefore should be a-c underneath 1). As presently formatted, i substeps 2-4 appear independent of 1, when in fact they are the :
actions required to accomplish 1). The RN0s associated with this step are not aligned with that of the respective A/ERs. This adds j difficulty to interpreting this str :
t
' E01 12-6, step 9.b. and No RN0s are provided to teli the operator if the A/ER's cannot be met, i.e., if saturation margin is ;
not between 80 - 160 ; E01 12-13, attachment A few of the ESF train and location ,
designations listed in the Attachment are not compatible with the l present control room panels, and should be update ; E01 12-16, VA-1, k and The logic of these two steps is difficult f to follow; the operator took a few minutes to interpret i It is !
not clear what operators should d [
l E0! 12-7, step 13.a. The word "Project" is not immediately obvious as a verb. It should be capitalized or underlined, as appropriate, e to illustrate that it is a ver i E01 12-7, step 1 "Stop unloaded Diesel Generator:" Either a specific reference to the diesel generator should follow this step or the colon should be a period. Otherwise, operators may infer that j some information was omitted from the E0 i l E0! 12-3, step "Notify Emergency Coordinator of initiation of I LOCA procedure:" Again, if no information is required after the j colon, it should be changed to a perio E01 12-8, pages 4 and 5 of 5 The logic presented on these two pages to initiate the Functional Recovery is difficult to follow. It is not clear if "optimal" is really intended as such, and whether it
'
. .
- 27
.
is used consistently. The steps need to be condensed and explained in a more direct manner. The E0! inspection team understood that these pages have recently been revised in the latest E01 revisio The team did not have the opportunity to review the latest revision in detail, E01 12-7, RNO step "Allow corrected PZR level to lower to - ,
30%." Althwgh the format of this step is consistent with the format to present plant conditions, this step could be misread as - 30% ;
(minus 30%), i.e., to decrease by 30%. When numerical plant '
conditions are to be identified, they should be introduced by punctuation other than a short dash, The E01 inspection team examined the bound E015 in the Unit 2 control room and found han kritten notes in the margins, e.g., parameter values. The handwritten information could distract the next CRS who needs to use the EDIs. The licensee promptly removed the marked-up copies of the E01: from the control roo E0I 12-16, p. 2 of 7 VA-1" RNO c, the instruction is to "attempt to re-energize Bus fro Since the A/ER instruction referred to l two buses, it is not clear in the cited instruction which bus is
,
being referenced. The step should identify the specific bus. The l absence of specific and uMmbiguous information could cause the operator to misinterpret the ste ,
5. Floating Steps The variance in operators understanding of F5 implementation was felt to be indicative of inadequate FS training and of vague definitions provided in the Writer's Guid The Writer's Guide (p. B-11) does not differentiate between "recurrent" !
and "continuous" steps. In fact, only "recurrent" step are addressed, and l
they implicitly assume "continuous" steps. "Monitor" is defined as a >
l "recurrent" step and not necessarily continuous. When an EDI directs an operator to "monitor floating steps" it is not clear how frequently the '
steps are to be monitore i
!
When asked to interpret "initiate FS-5", virtually all operators stated I that the current procedure steps were to be continued concurrently with initiating FS-5, thus requiring parallel action However, the Writer's Guide does not define "initiate"; it recommends that the verb "implement" be used to designate concurrent steps (p. B-11).
6. Control Room Panel Deficiencies A few instrument scales were not labeled with measurement units. Also, i both the tetdown Heat Exchanger Outlet Temperature Regulator and the Letdown Flow Pressurizer Level Regulator did not have measurement unit These instruments are required to perform E01 12-3 (LOCA), page 34 of 65, step Another gauge which does not display measurement units is the Instrument Air Header Pressure gauge, required for E01 12-16, VA-1, RNO g.1. The gauge has two adjacent scales which are identical, each of (
l i
_-
"
. ,
. 28
.
which measures a different parameter; one measures air header pressure, the other, Nitrogen header pressure. But no differentiating label is provided to identify each scal Consequently, the operator must rely on memor (NUkEG 800, 5.6.6, 5.6.8)
InE0112-6jl0FW), step 6.drequiresoperatorstoestablishflowbetween 60 & 75 x 10 lbm/hr. On the Main Feedwater Recorder, however, this difference is less than one scale graduation and thus is almost imperceptible. The LOCA E01, 12-3, p. 38, step a.b also requires operators to check the Main Feedwater Recorder and make an equally indiscriminative judgment. -(NUREG 800, 5.6.8)
A discrepancy between a QSPOS value and an E0! value was identifie In E0112-3(LOCA),p.39of65,theoperatormustdegerminewhether
"containmentaveragetemperature"islessthan215Ftosatisfyghesafety function. However the corresponding QSPDS display alarms at 120 F; therefore, the operator is alerted for no apparent reaso This is a potential source of confusion for the operator and should be evaluated und l
changed if necessary. In addition, other QSPOS parameter setpoints and values should be checked to ensure that there are no additional
'
discrepancies. (NUREG 899, 5.4.6, 5.4.7)
The control panels were identified as having a couple of deficiencies that
'
pertained directly to the E0! The problem with the broadest scope was ;
l found on the Electrical Systems panel. Verification of components on this l panel are required when performing E01 12-16 (Vital Auxiliaries),
I steps VA-1, a- The panel contains a mimic of the system which, although
! quite useful, does not differentiate between mimic labels and mimicked
'
buse Specifically, the buses are represented by long, thin, l three-dimensional rectangles, which are connected to appropriate l l "components." The label that identifies the bus, however, is a mimic :
'
I almost identical to the bus itself, except it is wider (i.e. , more I
solvent) and is located approximately six inches away from the bus itself.
l The actual label, e.g., 2A02, is on one end of the "label mimic" so that i
it looks like the bus itsel Therefore, operators might erroneously i l conclude that two buses exist, or experience difficulty in determining which mimic actually represents the bus. To further complicate the panel, ,
the voltage indicators are not physically connected to their corresponding I buses. Thus, it is not obvious which meter belongs to which bus. Also, i the nomenclature found in the E01 is not consistent with the mimic labels, i The E01 (12-16, step VA-1.b & c) refers to the "IE 4 kV" buses, whereas the mimic is labeled as "Bus 2A04" and "Bus 2A06." If operators think in terms of IE 4 kV buses, then the mimic labels should reflect that (e.g., i A-1E 4 kV vs. B-1E 4 kV).
Another panel deficiency was identified in the walkthrough of E01 12-13 l (Containment Isolation), on page 12 of 22, step g.1. The E01 lists four valves - two on Train A and two on Train B. The Train A valve names are listed directly under "Train A", and the Train B Valve names are listed directly under "Train B", thus unambiguously separating the two trains and associated valves. However, valve HV 9379, which is listed in the E01 under "Train B", is located in the Train A section of the control board.
l To minimize operator error and time, the va.ve control should be moved to I the Train B section of the control boar (NUREG 899, 5.7.11)
l l
..
' .
-
29 l
.
Also identified during a walkthrough by the E01 inspection team was an incorrectly referenced annunciator. E0I 12-6 (LOFW), step 5.b.2, referenced the 60A33 annunciator window, but the correct window was 60A4 This discrepancy most likely arose from a plant modification that took place approximately two years ago. The E0I needs to be updated to be consistent with the modifications. (NUREG B99, 5.7.11)
Another control room human factors concern identified by the inspection team pertained to instrument error during emergency conditions. The accuracy of the instrumentation readings in the control room (e.g.,
pressurizer pressure, temperature, and level) has not been exactly determined at this time. Additional discussion of this problem is in Section 3 of this report. (NUREG 700, 6.1.1.la)
7. Local Control Stations In E01 12-14, Containment Temperature and Pressure, on page 4 of 9, the operator is to ensure that CSAS has activated by checking the position of valves and pumps listed in a tabl However, some of these components are associated with the Sodium Hydrtxide addition system which is no longer in servic These components have been abandoned in place. The licensee had previously identified this deficiency, however, it has been in existence for over a year on one unit and six months on the other. This concern with the E01 program is addressed in Section 6 of this repor During a walkdown of Step 6.c of E01 12-6 (LOFW) operators were provided with the option to locally operate the main feed control valves. This local manipuldtion is not possible on Unit 2 because the valve handwheels were removed, In E01 12-12, p. 16 of 41, HR-2, RNO 1, operators are told to "Use fire hoses...." However, there are no fittings near the diesel driven fire pump. The only available option is to hook up to the fire main supplied by the diesel driven fire pump. If operators are supposed to do the latter, then the E01 should explicitly say so to avoid time delays and operator misunderstanding. If the fire hoses are supposed to be connected to fittings, then these should be available, accessible and operable, The accessibility of valves required E01 12-7 (LOFC) is limite On page 14 of 50, RNO step 13.b, operators must access locked aux spray valves 521208MU130, 191 and 084, however, operators do not normally carry these keys with the Instead, operators must return to the control room to get the key In addition, this room ("jailhouse")
,
j is entirely under Health Physics control. If an operator had to access the area immediately, e.g., in a Loss of Power, then he or she i would be delayed waiting for the key. The licenste asserted that l operators would have adequate time to get the keys or wait for H j Another source of diffic.ulty for operators is the manipulation of the Inverter via the Manual Transfer Switch, required in E01 12-16, p. 6 of 7 VA-2b. and e. The twitch is located about seven feet above the floor on a panel, is very large and because it is so high, obstructs l
l
!
- ;
- i r
-
. ,
. 30 e
.
the position labels, i.e., "Inv." and "Line". A red light that indicated which position the switch is in is too dim to be readily detecte The switch is also very heavy, requiring two hands and a
-
substantial effort to manipulate i Several problems were observed in the execution of EDI 12-5 (SLB),
pg and 52 of 54, step 4.c (for both pages). Operators are instructed to install SIT vent valve fuses in 2/3 L-071, located ;
directly outside the control roo The fuses are listed in the E01 ;
, step, but the fuse amperage is not. The operator must first locate .
j the fuses (which could not be located during the E01 walkthrough),
l however, once obtained, he/she may not know what amperage is i required. Inserting the fuses is difficult. The operator requires a t flashlight to see and must kneel on the floor. Additionally, the I fuse labels are difficult to find because they are small, in the i dark, and hidden behind many wire ;
^
i
J
!
!
!
'
l i !
I !
l
[
,
d l
! l 4 l l
i i l I
,
!
>
i l
l l
J
'
l
.
l i - - _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . . _ _ _
r-
..
. .. .
.
APPENDIX D Verification / Validation Review Comments Specific comments on the control room walkdowns and the review of the validation programs are provided below. The licensee committed to correct these weaknesses or review specific steps for potential changes. Section 4 of this report provides further discussions regarding verification and validatio . General The EPGs require the ability to measure feedwater flow greater than l 150 gpm as part of the standard post trip and recovery actions. This i flow is less than the smallest increment on the flow recorder scal i The licensee stated that they w!11 initiate a Station Problem i Report (SPR) requesting Station Technical to provide operations a means of measuring flows at low ranges of 150 gpm and greate ; The QSPDS alarms at 120 F containment temperature which appears to be auctioneered from one of sevegal temperature indications rather than ,
an average temperature of 215 The licensee stated that an SPR is i being prepared to address this problem. ,The SPR will request that f the setpoint be raised to a value of 215 F in order to allow l unnecessary alarms which may otherwise distract the operato ;
i The manual auxiliary spray valves 521208MU130, 191 and 084 require !
keys which operators don't normally carry. The licensee stated that j the use of manual auxiliary spray would only be used during a t cooldown. The decision to cooldown is expected to take sufficient j time so any required keys can easily be made available to the !
operator, j E01 5023-12-4 SGTR ;
i t Step 10 RNO substep 1. should specify which ADV is to be opened to j control T . The licensee stated this would be corrected in the next j revisionYotheE01 t LOFW
! Step 5. The annunciator referenced in the procedure should be changed from 60A33 to 60A4 The licensee stated that this will be corrected in the next revision, Step 6.C. The mainfeed regulation valves on Unit 2 cannot be operated locally because the handwheels have been moved to Unit The licensee stated that a SPR report was prepared addressing this problem, Functional Recovery Containment Isolation ,
(1) CI-2 step g.1) Train A valve HV9379 is listed under Train l
'
. '. ,
. 32
.
(2) Attachment I - some valve controls or control indications are listed under the wrong train and other valve control locations are listed on the wrong pane The licensee agreed to review the valve lists and make corrections in the next revisio b. 5023-12-14 Containment Temperature and Pressure (1) CTP-3 page 4 of 9, the table in step "a" contains pumps and valve designations that are no longer in use. (The sodium hydroxide system is not.used.)
(2) CTP-3 page 409, the table in step "a" should include valves 2HV6501 in Train A and 2 HV6500 in Train The licensee stated that this table will be revised to rerpove the equipment designations that are not in use and to include the two additional valve (3) CTP-3 page 6 of 9 step d.3 this step requests the operator to check if containment emergency. sump cooling is required. Since there is no specific sump cooling system the operator was unsure l what he was expected to chec i The licensee stated that after a RAS, the CS system in conjunction with the HPSI pumps, is the cooling med'.Ium used via the Shutdown l Cooling heat exchangers to maintain core cooling. Prior to l terminating the CS pumps an evaltation is required to determine if j alternate means are available for core cooling. The next revision to :
the E07 will clarify this by requesting an evaluation by the SS to determine whether an alternate means of core cooling is being
'
,
provided prior to resetting CSA ;
c. 5023-12-15 Containment-Combustible Ga l i
(1) C 6-1 page 2 of 6 step C should include step 6.2.7 of !
procedure 5023-3-2.28 to be consistent with that procedur (2) CG-1 page 2 of 6 step C should be consistent with the labels on '
the equipmen i The licensee stated that the next revision to the EDI will be l verified to be consistent with label indications on equipment and the -
referenced procedure, i
I l
t