IR 05000397/2011008

IR 05000397/2011008; 09/26/2011 – 11/02/2011; Columbia Generating Station, Event Followup

ML113490182
Person / Time
Site:	Columbia
Issue date:	12/15/2011
From:	Webb Patricia Walker NRC/RGN-IV/DRP/RPB-A
To:	Reddemann M Energy Northwest
References
IR-11-008
Download: ML113490182 (49)

Text

December 15, 2011

Mr. Chief Executive Officer Energy Northwest P.O. Box 968, Mail Drop 1023 Richland, WA 99352-0968

Subject: COLUMBIA GENERATING STATION - NRC SPECIAL INSPECTION REPORT 05000397/2011008

Dear Mr. Reddemann:

On November 2, 2011, the U.S. Nuclear Regulatory Commission (NRC) completed a special inspection at your Columbia Generating Station. The inspection was to evaluate several events that occurred during your most recent refueling outage, including three loss of inventory events, one loss of shutdown cooling event and an inappropriate valve lineup during control rod surveillance testing. Based on deterministic criteria specified in NRC Management Directive 8.3, NRC Incident Investigation Program, the NRC initiated a special inspection in accordance with Inspection Procedure 93812, Special Inspection. The basis for initiating the special inspection and the focus areas for review are detailed in the special inspection charter (Attachment 2). The determination that the inspection would be conducted was made by the NRC on September 20, 2011, and the onsite inspection started on September 26, 2011. The enclosed report documents the inspection findings that were discussed on November 2, 2011 with you and members of yours staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel. Four of the five events involved operator errors. The team observed that operators failed to maintain an awareness of plant status at all times. The failure to maintain adequate configuration controls was also a factor. In some cases, operators chose to proceed with work when it was not approved, was outside the bounds of the procedure, or when they experienced unexpected plant conditions. In these instances, conservative decision making was not evident.

In a few instances, operators suspected that something was wrong but didnt speak up.

Based on the results of this inspection, three self-revealing findings were evaluated under the risk significance determination process as having very low safety significance (Green). The NRC has determined that violations are associated with these findings. However, because of the very low safety significance and because they were entered into your corrective action UNITED STATES NUCLEAR REGULATORY COMMISSION

REGION IV

612 EAST LAMAR BLVD, SUITE 400 ARLINGTON, TEXAS 76011-4125

Energy Northwest

- 2 -

program, the NRC is treating these findings as noncited violations, consistent with Section 2.3.2 of the NRC Enforcement Policy.

If you contest the violations or the significance of the noncited violations, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C.

20555-0001, with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 612 E. Lamar Blvd, Suite 400, Arlington, Texas, 76011-4125; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555-0001; and the NRC Resident Inspector at the facility. In addition, if you disagree with the crosscutting aspect assigned to any finding in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your disagreement, to the Regional Administrator, Region IV, and the NRC Resident Inspector at the facility.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter, its enclosures, and your response, if you choose to provide one for cases where a response is not required, will be made available electronically for public inspection in the NRC Public Document Room or from the NRC's document system (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html. To the extent possible, your response should not include any personal, privacy, or proprietary information so that it can be made available to the public without redaction.

Sincerely,

/RA/

Wayne Walker, Chief Project Branch A Division of Reactor Projects

Docket: 50-397 License: NPF-21

Enclosure:

NRC Inspection Report 05000397/2011008 w/ Attachment: Supplemental Information

REGION IV==

Docket:

05000397 License:

NPF-21 Report:

05000397/2011008 Licensee:

Energy Northwest Facility:

Columbia Generating Station Location:

Richland, WA Dates:

September 26, 2011 through November 2, 2011 Inspectors:

G. Replogle, Senior Reactor Analyst G. Apger, Operations Examiner C. Henderson, Project Engineer J. Groom, Senior Resident Inspector M. Hayes, Resident Inspector Approved By:

W. Walker, Chief, Project Branch A Division of Reactor Projects

- 2 -

Enclosure

SUMMARY OF FINDINGS

IR 05000397/2011008; 09/26/2011 - 11/02/2011; Columbia Generating Station, Event Followup.

The report covers a period of special inspection by a senior reactor analyst, two regional and two resident inspectors. Three Green noncited violations of significance were identified. The significance of most findings is indicated by their color (Green, White, Yellow, or Red) using Inspection Manual Chapter 0609, Significance Determination Process. The crosscutting aspect is determined using Inspection Manual Chapter 0310, Components within the Cross-Cutting Areas. Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4, dated December 2006.

Cornerstone: Mitigating Systems

Green.

The team documented a Green self-revealing violation of Technical Specification 5.4.1(a), Procedures, because operators failed to meet the conditions of a plant clearance order before opening main steam line drain valves. Consequently, operators inadvertently drained approximately 4300 gallons of reactor coolant to the under-vessel sump. Contributors to the violation included: 1) the reactor vessel assembly procedure was inadequate, in that it permitted maintenance personnel to place the reactor vessel level instruments in an uncalibrated condition; and 2) plant operators failed to follow operational performance standards when they were advised of the condition and proceeded to lower reactor vessel level for approximately 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> with inaccurate reactor vessel level instruments. The licensee entered the violation into the corrective action program as Action Request 245507.

The finding was more than minor because it affected the human performance attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of reactor vessel level instruments that are used to respond to initiating events to prevent undesirable consequences (i.e., core damage). The inspectors used NRC Inspection Manual 0609, Appendix G, Shutdown Operations Significance Determination Process, to evaluate the significance of the finding. The finding did not require a quantitative assessment because adequate mitigating equipment remained available and the finding did not constitute a loss of control, as defined in Appendix G. Therefore, the finding screened as

Green.

The finding had a crosscutting aspect in the area of human performance associated with Work Practices because plant personnel, once faced with unexpected circumstances, continued to proceed in the face of uncertainty H.4(a)

(Section 4OA3.8).

Green.

The team documented a Green self-revealing violation of Technical Specification 5.4.1(a), because operators failed follow the control rod drive scram testing procedure, in that they failed to verify that no conflicting activities were in progress. Consequently, control rods were moving much faster than normal because the control rod drive exhaust system header was vented. In addition, plant operators had failed to follow operational performance standards in that they failed to know the plant status at all times and they proceeded with the surveillance when they were not aware of the expected results. Further, once the control rod behavior was clearly outside the expected norms, operators associated the unusual performance to inappropriate causes and continued to test additional control rods. The licensee entered the finding into their corrective action program as Action Request 248171.

The finding was more than minor because it affected the configuration control attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Operation of the control rod drive system with the exhaust header vented could cause damage. Further, control rods withdrawing faster than the normal under certain power configuration could challenge fuel integrity. The inspectors used NRC Inspection Manual 0609, Appendix G, Shutdown Operations Significance Determination Process, to evaluate the significance of the finding. The finding did not require a quantitative assessment because adequate mitigating equipment remained available and the finding did not constitute a loss of control, as defined in Appendix G. Therefore, the finding screened as

Green.

The finding had a crosscutting aspect in the area of human performance associated with Work Practices because operators failed to properly utilize human error prevention techniques such as holding pre-job briefings as well as self and peer checking H.4(a) (Section 4OA3.8).

Cornerstone: Initiating Events

Green.

The team documented a Green self-revealing violation of Technical Specification 5.4.1(a), because operators failed to properly align the train B residual heat removal system prior to starting the pump. Consequently, approximately 269 gallons of water were transferred to the suppression pool because the reactor vessel suction valve was left open. In addition, plant operators had failed to follow operational performance standards in that they did not ensure that the control room supervisor had approved the work, they failed to utilized the appropriate alignment procedure, and the peer checker did not perform a meaningful peer check. The licensee entered the violation into their corrective action program as Action Request 248226.

The finding was more than minor because it affected the human performance attribute of the Initiating Events Cornerstone and affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations.

The inspectors used NRC Inspection Manual 0609, Appendix G, Shutdown Operations Significance Determination Process, to evaluate the significance of the finding. The finding did not require a quantitative assessment because adequate mitigating equipment remained available and the finding did not constitute a loss of control, as defined in Appendix G. Therefore, the finding screened as

Green.

The finding had a crosscutting aspect in the area of human performance associated with Work Practices because operators failed to properly utilize human error prevention techniques such as self and peer checking H.4(a)

(Section 4OA3.8).

Licensee-Identified Violations

None

REPORT DETAILS

REACTOR SAFETY

40A3 Event Follow-up

.1 Special Inspection Initiation

During the most recent refueling outage from April to September 2011, the licensee experienced five events. Those events included:

1. On April 11, while filling the reactor vessel to approximately the reactor vessel flange

level, approximately 4000 gallons of reactor coolant inventory were lost to the containment sump because two in-series steam line drain valves were left in the open position (see NRC Inspection Report 05000397/2011002).

2. From July 28 to 30, operators inadvertently drained approximately 4300 gallons of

water from the reactor vessel through two main steam line drain valves. Operators had failed to ensure that the reactor vessel level indication reference leg remained vented to atmosphere, which resulted in inaccurate reactor vessel level readings.

This condition persisted for approximately 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br />.

3. Licensee Event Report 05000397/2011-002-00: Loss of Shutdown Cooling Due to

Logic Card Failures: On August 27, the licensee experienced a loss of residual heat removal event following the spurious trip of a reactor protection system train B circuit card. This licensee event report is closed based on the results from this inspection.

4. On September 10, operators failed to follow site procedures and, for a short period,

inadvertently diverted water from the reactor vessel to the suppression pool through the residual heat removal pump minimum flow valve. Reactor vessel level decreased approximately 2 inches.

5. On September 15, operators failed to properly coordinate two control rod drive

surveillances. Control rods were moving faster than expected and two control rods, when given a withdrawal command, inserted instead. Operators then manually inserted the control rods and they appeared to scram (insert very rapidly).

The number and types of events led to questions regarding the adequacy of plant configuration controls. Inadequate or poorly implemented configuration controls are of interest to the NRC because deficiencies in these areas can lead to more significant events.

The NRC evaluated the events using NRC Management Directive 8.3, NRC Incident Investigation Program. While each event, in isolation, did not appear risk significant, the NRC noted that the events could collectively represent a larger concern.

In some instances, the NRC may consider a reactive inspection without meeting the risk criteria specified in Management Directive 8.3. NRC Inspection Manual Chapter 0309, Reactive Inspection Decision Basis for Reactors. Section 04.04 stipulates, in part:

In addition to the significant operational events at power reactors there are other significant operational events that may occur at an NRC-licensed facility.

The factors that cause these other types of incidents are not necessarily part of a licensees probabilistic risk assessment (PRA) model, and their risk significance cannot be quantified.

One of the additional non-risk based deterministic only criteria included:

Involved circumstances sufficiently complex, unique, or not well enough understood or involved characteristics the investigation of which would best serve the needs and interests of the Commission.

Note: The above criterion was included in the incident investigation team section. However, the NRC determined that a special inspection (a lower resource inspection) was an adequate tool to help understand these events and to serve the needs of the Commission.

The NRC developed an inspection charter that was included as Attachment 2 to this inspection report. This report addresses all of the focus areas outlined in the charter.

1. April 11, loss of 4000 gallons through two main-steam drain valves during vessel

fill:

Background: Reactor vessel level instruments are provided in the control room.

During shutdown conditions, operators typically monitor the shutdown range level instruments as well as temporary refueling outage level instruments. The zero reference point is approximately 168 inches above the top of active fuel. During power operations, the normal vessel level is approximately +36 inches (204 inches above the top of reactor fuel). If main steam valves MS-V-1 and MS-V-2 are open, water can start to flow to the equipment drain sump when reactor vessel level is at +188 inches or higher.

Historical Event:

May 5-6, 2007

From May 5 to 6, 2007, operators were filling the reactor vessel to prepare to remove the reactor vessel head. Operators failed to close main steam line drain valves MS-V-1 and MS-V-2 during the fill evolution.

The failure to take effective corrective measures for this event led to the subsequent loss of inventory event described below. Both events were discussed previously in NRC Inspection Report 05000397/2011003. An inadequate procedure contributed to both events.

Simplified Drawing

Recent Event:

April 5, 2011

4:03 p.m.

Operators were implementing Procedure SOP-CAVITY-FILL, Reactor Cavity and Dryer Separator Pit Fill, Revision 10. Specifically, operators were filling the reactor vessel to below the reactor vessel head to permit head detensioning. This was a slow process and operators stopped at predetermined points to support an assortment of maintenance activities.

April 6

3:21 p.m.

Operators closed the containment sump containment isolation valves EDR-V-19 and EDR-V-20. Operators filled the equipment drain sump with water. The water was used as a radiological shield to protect workers in the containment.

April 11

11:27 p.m.

Operators established a reactor vessel level band between +180 and

+215 inches. However, the in-series main steam line drain valves MS-V-1 and MS-V-2 were still open. While valve position indicators were available on a control room panel, operators were unaware of the valves position. At a vessel level of approximately 188 inches, water started to drain through the valves and into the equipment drain sump. Procedure SOP-CAVITY-FILL did not instruct operators to close the valves prior to reaching this level.

The failure to maintain an awareness of plant status at all times was contrary to the requirements of Procedure OI-9, Operations Standards and Expectation, Revision 47, Step 11.1:

The status of plant equipment is known at all times.

During this inspection, the team asked a senior reactor operator about the configuration control of valves MS-V-1 and MS-V-2 during past outages.

Since the same procedure was used during those outages, it was unclear why the same loss of inventory did not occur during each outage. The operator stated that more experienced operators were in the control room during prior outages and knew that they needed to close the two valves prior to exceeding a certain level. The operators did not write condition reports to document the deficient procedure. This was a missed opportunity to correct the problem earlier. The failure to correct the procedure before proceeding was inconsistent with Procedure OI-9, Step 13.2.4.

Resolve procedure problems prior to commencement of a task.

April 12

2:30 a.m.

Operators closed valves MS-V-1 and MS-V-2 as part of a clearance order to support vessel disassembly. The loss of inventory was secured. At this point operators were still unaware that a loss of inventory had occurred.

6:00 a.m.

Maintenance personnel reported a significant increase in the equipment drain sump level. The licensee determined that the late closure of valves MS-V-1 and MS-V-2 allowed approximately 4000 gallons to drain from the reactor vessel to the equipment drain sump.

6:42 a.m.

Reactor vessel level was at +214 inches.

Since enforcement for this finding was documented in NRC Inspection Report 05000397/2011002, no additional findings or violations will be documented in this inspection report.

2. July 28-30. loss of accurate reactor pressure vessel level indication for

approximately 40 hour4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br />s:

Background: Reactor vessel level instruments include a reference leg (filled with water at all times), a variable leg (the water in the reactor vessel), a differential pressure Simplified Drawing

sensor that measures the pressure difference between the two legs, and level indicators in the control room.

One critical design requirement is that the reference and variable legs be vented to the same volume. If the reference leg is vented to the atmosphere, then the variable leg must also be vented to atmosphere. Alternatively, the reactor vessel itself could be used as the common vent point. If the reference and variable legs are not vented to the same space, the level instrument will not read accurately if the pressure at the vent points is not the same. Control room water level indication can then read either higher or lower than the actual level.

Event Time Line:

July 28, 2011

9:00 a.m.

The reactor vessel level instrument variable leg and reference leg were both vented to the atmosphere. The vent path for the reactor vessel was through the reactor core isolation cooling head flange. Assembly of the reactor core isolation cooling system head flange was approaching in the work sequence.

Operators established a reactor vessel level band between 202 inches to 207 inches. Main steam valves MS-V-1 and MS-V-2 were closed.

Time Maintenance personnel called the control room to implement Unknown Procedure PPM 10.3.22, Reactor Pressure Vessel Reassembly, Revision 29, Step 6.10.18:

Have operations caution tag open MS-V-1 and MS-V-2 to allow venting of the reactor pressure vessel head while temporary level instrumentation is being removed.

Maintenance personnel signed off the procedure step when the request was made, not when the action was completed. Maintenance personnel did not track completion of this action. Operators were unable to complete the action immediately because the reactor vessel level was too high (greater than +200 inches). Opening the valves would result in a loss of inventory through the valves when the reactor vessel level was greater than approximately +180 inches.

The opening of valves MS-V-1 and MS-V-2 was to establish a new reactor vessel vent path to ensure continued reactor vessel level instrument operability. This vent path should have been opened prior to closing the reactor core isolation cooling system head flange. This intent was not explained in the procedure. While the procedure sequenced the opening of valves MS-V-1 and MS-V-2 to occur prior to closing the flange, the procedure allowed the steps to be performed out of sequence if approved by the refueling floor supervisor.

8:31 p.m.

The refueling floor supervisor approved assembling the reactor core isolation cooling system head flange out of sequence. The flange was assembled and the bolts were tightened (but not fully torqued). This action effectively isolated the reactor vessel vent. The refueling floor supervisor reported this information to the control room shift manger and stated that the reactor vessel was tight. Reactor vessel level was still above +190 inches and operators were not permitted to open valves MS-V-1 and MS-V-2.

NOTE: The supervisor told the team that he did not understand the design of the reactor vessel level instruments or the importance of maintaining a reactor vessel vent. The licensee had not trained the refueling floor supervisor on these details.

The on-duty shift manager informed the team that he knew that the reactor vessel level instruments were not accurate with the reactor cavity vent secured. The shift manager stated that it was inappropriate to change reactor vessel level when level instruments were not accurate.

The shift manager initiated steps to realign the reactor vessel level instruments so that both the variable and reference legs would be vented to the same space (the reactor vessel). He decided that they would maintain level at the same position until the realignment and re-calibration of the level instruments could be performed. The crew did not complete the work before the shift change.

The shift manager also informed the team that closure of the reactor core isolation cooling flange had been a problem during past outages.

However, the procedure was not changed in response to those past events. The failure to get the procedure changed was inconsistent with Procedure OI-9, Step 13.2.5, which stated:

Stop an activity and place the equipment in a safe condition if the procedure is found to be inadequate or unclear. Seek resolution prior to proceeding.

July 29

7:00 a.m.

Shift Change: Operators were working 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> shifts. Shift turnovers normally occurred at 7:00 a.m. and 7:00 p.m. The shift manager turned the status of the reactor core isolation cooling system flange, and his recommendations to restore reactor vessel level indication to a calibrated condition, over to the on-coming shift manger. The off-going shift manager was off-duty for the next several days and was not further involved with this issue.

11:10 a.m.

The shift manager (shift manager number 2) contacted maintenance personnel on the refueling floor to obtain a status of the reactor core

isolation cooling system head flange work. Some type of communication error occurred and the shift manager mistakenly believed that the reactor vessel was still vented. Specifically, he thought that the reactor core isolation cooling system head flange was installed, but that a gap existed between the flange plates to act as an effective vent path. Although the shift manger had obtained a different status from the off-going shift manager (shift manager number 1), the shift manager did not have anyone verify that an adequate vent path still existed. An equipment operator could have performed this function. The shift manager believed that he instructed the refueling floor personnel to refrain from tightening the reactor core isolation cooling system head flange. However, work continued to proceed as if no stop work instructions were received.

The team noted that the control of plant work through verbal instructions was inconsistent with Procedure OI-9, Step 11.2.1, which stated:

The control of plant equipment status is governed by procedures, work orders or tagging.

The team interviewed the refueling floor supervisor that shift manager number 2 had spoken to. The refueling floor supervisor could not validate the shift managers statements. The refueling floor supervisor stated that he did not inform the shift manager that a vent still existed and did not receive instructions to stop work until verbally authorized by the shift manager.

The team noted that the shift managers actions were also inconsistent with Procedure OI-9, Step 4.2.2, which stated:

Each individual should not proceed with a task unless he/she understands the task and is aware of the expected results.

Further, OI-9, Step 11.1 stated:

The status of plant equipment is known at all times.

12:45 p.m.

Operators started to lower reactor vessel level. They intended to lower level to at least the point where valves MS-V-1 and MS-V-2 could be opened.

1:45 p.m.

Operators established a new reactor vessel level band from +160 inches to +175 inches. The band was selected to avoid draining water from the reactor vessel to the equipment drain sump. Reactor vessel level indicated +170 inches.

Because the reactor vessel was not vented, control room reactor vessel level indication read as much as six feet lower than the actual level. With respect to atmosphere, the reactor vessel head was at a vacuum.

Operators released Clearance Order C-MS-V-1 and 2-001. The clearance order specified, in part:

C-MS-V-1 and 2-001 release instructions: Reactor pressure vessel level is less than 190 inches.

Contrary to the instructions, actual reactor vessel level was well above

+190 inches when valves MS-V-1 and MS-V-2 were opened.

Operators established a new clearance order (caution tag) for valves MS-V-1 and MS-V-2. Clearance Order C-RPV HEADVENTS-006 specified:

Ensure MS-V-1 and MS-V-2 are open for reactor pressure vessel level recalibration during reactor pressure vessel reassemblyVerify reactor pressure vessel water level is less than +190 inches prior to opening these valves Opening these valves while the reactor pressure vessel is above the main steam lines results in draining the reactor pressure vessel to the equipment drain sump.

2:40 p.m.

The final torque pass was completed on the reactor core isolation cooling system head flange. Following this work, maintenance personnel installed the shield plugs over the reactor core isolation cooling system head flange.

3:15 p.m.

While maintaining reactor vessel level constant, operators identified a flow mismatch between the control rod drive system and the reactor water cleanup system. As part of normal control rod drive operations, water will enter the reactor vessel. To maintain reactor vessel level constant, operators must drain water out of the reactor vessel through the reactor water cleanup system. The in-flow and out-flow should have been the same, but operators noted that less water was flowing through the reactor water cleanup letdown path. Operators suspected that water was leaking out through valves MS-V-1 and MS-V-2 to the equipment drain sump.

Operators decided to open equipment drain sump valves EDR-V-19 and EDR-V-20 to drain the sump. The operators would use the equipment drain sump discharge line flow instrument to determine if water was draining to the sump.

5:40 p.m.

Over the next 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />, operators periodically drained water from the equipment drain sump. The evolution was stopped for shift turnover and then completed late on the next shift.

July 30

7:00 a.m.

Shift Change: During the turnover, the off-going crew advised the on-coming crew they believed that water was passing through MS-V-1 and MS-V-2. The equipment drain sump flow instrument was reading about 30 gallons per minute when it should have been reading less than one gallon per minute. The on-coming control room supervisor expressed concern over lowering reactor vessel level without calibrated reactor vessel level instruments.

The team noted that lowering reactor vessel level without calibrated instruments was inconsistent with 10 CFR 50, Appendix B, Criterion XII, Measuring and Test Equipment, which states:

Measures shall be established to assure that instruments used in activities affecting quality are properly controlled, calibrated, and adjusted at specified periods to maintain accuracy within necessary limits.

10:30 a.m.

Operators initiated action to troubleshoot the flow mis-match between the control rod drive and reactor water cleanup systems. The task involved closing valve MS-V-1 and then monitoring reactor vessel level indication.

If water was leaking through MS-V-1 and MS-V-2 (prior to the test),reactor vessel level should start to increase when valve MS-V-1 was closed. The outage control center, the operations manager, and the shift manager were informed.

10:36 a.m.

MS-V-1 was closed. Reactor vessel level indication started to slowly increase.

10:38 a.m.

Operators noted that flow from the equipment drain sump decreased from approximately 30 gallons per minute to less than 1 gallon per minute.

Operators had confirmed that water was leaking from the reactor vessel to the equipment drain sump through valves MS-V-1 and MS-V-2.

10:45 a.m.

Operators started lowering reactor vessel level to approximately +90 inches as indicated in the control room. Operators understood that actual level was higher. Operators did not pursue establishing a vent or realigning and recalibrating the reactor vessel level instruments to ensure that the instruments were accurate. Instead, the operators wanted to lower level until actual level was lower than the main steam lines.

11:45 a.m.

Indicated reactor vessel level was +91 inches and stable.

12:30 p.m.

Operators throttled open MS-V-1 to a mid-stroke position. Reactor vessel level started to slowly increase. This was expected because the vacuum in the reactor vessel was being relieved. Air was being sucked in through

valves MS-V-1 and MS-V-2. The flow through the equipment drain sump remained steady at less than one-half gallon per minute.

1:05 p.m.

Indicated reactor vessel level was +145 inches. Operators fully opened valve MS-V-1. Indicated level continued to rise slowly. This was expected. The pressure in the reactor vessel was approaching equalization with atmospheric pressure.

2:10 p.m.

Reactor vessel level stabilized at +167 inches. The equipment drain sump flow remained steady at less than one-half gallon per minute.

3:00 p.m.

Operators established a level band of +160 inches to +175 inches.

Operators initiated plans to implement Procedure PPM 10.27.26, Shutdown Level Indication Re-calibration/Range Adjustment. The recalibration was performed the following day.

Following the event, the licensee estimated that approximately 4300 gallons of coolant were unexpectedly diverted from the reactor vessel to the equipment drain sump through valves MS-V-1 and MS-V-2.

In response to this event the licensee initiated an event investigation report. In addition, and in response to several events involving operators, the licensee initiated a root cause determination to identify and understand the causes related to poor operator performance at Columbia Generating Station.

3. August 27, loss of residual heat removal:

September 4, 1990

General Electric (GE) issued Service Information Letter 496R1. GE also issued Supplement 1 to the letter in 1995 and Supplement 2 in 1997. The service information letter and the supplements advised certain boiling water reactor licensees that some reactor owners had experienced spurious trips of the electrical protection assemblies.

These trips could cause 1/2 scrams or automatic valve isolations. These assemblies were used in the reactor protection system at Columbia Generating Station.

For those plants that were experiencing spurious trips, GE recommended certain logic card adjustments. GE also offered a modification kit that could help resolve the problems. In the later supplements GE, recommended service life restrictions for logic cards in higher temperature working environments. Based on the recommendations, the units at Columbia were rated for 40 years. In addition, GE informed licensees that re-designed electrical protection assemblies were available for purchase. The new logic cards were not subject to the same spurious trip mechanisms as the previous cards.

However, Columbia had not experienced spurious trips. General Electric provided no recommendations for plants whose logic cards and electric protection assembly breakers were working properly. Further, GE continued to offer the older style logic cards for purchase.

Over the next several years, engineers and technicians would identify several card malfunctions. The malfunctions were always associated with non-safety related features and the breakers had failed to trip. The breakers consistently tripped on safety signals.

No spurious trips were noted.

2004

The licensee replaced the reactor protection system channel B electrical protection assembly logic card. The old card was capable of performing its safety function and it did not spuriously trip, but some of the voltage signals were out of specification. The licensee purchased a new logic card of the same design from GE.

August 27, 2011

10:21 p.m.

Reactor protection system channel B tripped. Containment isolation Group 6 was tied to channel B. In response to the trip, residual heat removal valve RHR-V-9 automatically closed. Valve RHR-V-9 was in the common shutdown cooling suction line to both trains of shutdown cooling.

When it closed, the suction path to both shutdown cooling trains was isolated and shutdown cooling was lost.

10:31 p.m.

Operators restored power to reactor protection system channel B by placing it on an alternate power supply (one that did not utilize the same logic card).

10:55 p.m.

Operators re-established shutdown cooling. The reactor coolant system temperature had increased by 4 degrees Fahrenheit. Operators were careful and deliberate prior to re-establishing shutdown cooling, to rule out a more significant problem prior to proceeding. Considering the low reactor coolant system heat-up rate, the operators approach was reasonable.

Engineers determined that channel B had tripped on a spurious under-voltage signal. The licensee removed the circuit card and sent it to an independent laboratory for testing and troubleshooting. However, the laboratory was unable to get the circuit card to repeat the failure. The root cause for the trip remained unknown, but the spurious trip malfunction noted in the GE service information letter was a possible cause.

Corrective Measures

The licensee scheduled replacement of the older designed electrical protection assembly logic cards with new logic cards that are of the improved design. The licensee plans to replace logic cards within the current operating cycle. While at power, a spurious card trip can only result in a 1/2 scram, which would not normally cause a plant transient. The team determined that the licensees planned corrective measures were acceptable. No findings were identified for this event.

3. September 10, loss of reactor pressure vessel inventory to the suppression pool

through the residual heat removal minimum flow valve:

September 10

8:45 a.m.

The shift supervisor briefed the control room crew on swapping trains of shutdown cooling from train B to train A.

9:21 a.m.

Operators completed the shutdown cooling train swap.

The reactor operator knew that the purpose of swapping the residual heat removal trains was to support packing consolidation on a train B valve.

The packing consolidation procedure involved pressurizing a portion of the suppression pool cooling piping. To do this, operators would need to align train B into the suppression pool cooling mode of operation.

9:58 a.m.

Operators lifted Clearance Order RHR-SDC-B/R20-004, which cleared a Danger tag on the train B minimum flow valve RHR-FCV-64B.

When the residual heat removal train was in the shutdown cooling mode of operation, operators had danger tagged valve RHR-FCV-64B closed.

Since this valve would direct flow to the suppression pool, tagging the valve closed was necessary to eliminate a potential drain path from the reactor vessel to the suppression pool. However, operators needed to lift Simplified Drawing

the clearance order prior to using the train in the suppression pool cooling mode of operation. The control room supervisor had authorized lifting the clearance order. The lift instructions for Clearance Order RHR-SDC-B/R20-004 specified:

Lift this clearance per Procedure SOP-RHR-SDC, RHR Shutdown Cooling, Section 5.8 [Shifting Shutdown Cooling from RHR Loop B to RHR Loop A] or 5.11 [RHR Loop B Shutdown Cooling Lineup Termination].

With respect to lifting the minimum flow valve danger tag, both procedure sections contained the same requirements:

5.8.37 Remove the danger tags for RHR-FCV-64B (Minimum Flow)

5.8.39 Verify RHR Loop B in Standby Status per SOP-RHR-STBY

Or:

5.11.11 Remove the danger tags for RHR-FCV-64B (Minimum Flow)

5.11.17 Verify RHR Loop B in Standby Status per SOP-RHR-STBY

The standby status as defined by SOP-RHR-STBY would have ensured that valve RHR-V-6B (train B shutdown cooling suction valve) was closed.

This procedure would also swap the suction from the reactor vessel and to the suppression pool.

9:58 a.m.

The reactor operator proceeded to re-align the train B residual heat removal system to the suppression pool mode of operation without proper authorization or a pre-job brief. The operators actions were inconsistent with Procedure PPM-1.3.1, Operating Policies, Programs and Practices.

Step 4.13.3 states, in part:

The assignments and responsibilities of the Control Room Supervisor include directing the operation of the plant in accordance with Technical Specifications and approved plant procedures.

In addition, his actions were inconsistent with Procedure OI-09, Section 5.1.1, which stated, in part:

Senior reactor operators will authorize and prioritize work...

Further, Procedure OI-9, Section 18.2.9.c stated:

Perform pre-job briefs for tasks or evolutions outside of routine activities (i.e. routine activities such as operator rounds or radwast tank transfers). Routine versus non-routine task determinations are made by the shift manager or control room supervisor.

The reactor operator asked a fellow on-shift operator to perform a peer check while he re-aligned the system and started the pump. Although the peer check did not recall a brief on this evolution, and self-questioned why it was being performed, he was a less experienced operator and did not feel comfortable questioning the actions of a more experienced operator. The peer check did not meet the standards for a peer check specified in OI-9, Section 14, Self/Peer checking and First Check.

Some of those standards included:

Peer checks are required for one hundred percent of control room activities, except during plant transients when peer checks may not be immediately available This includes procedure Verify steps outside of operator rounds and data gathering.

Self-checking, peer checking and first check are undocumented review techniques used to ensure proper plant operation and to prevent errors.

Peer checking an action requires the performance of the action to be observable and methodical, with discrete pauses to allow the peer checker to correct any errors.

Peer checkers are competent when they have the training and experience necessary to properly verify an action.

To realign the train, the operator used Procedure SOP-RHR-SPC, Supression Pool Cooling/Spray/Discharge to Radwaste, Revision 7, Section 5.3, Initiating Residual Heat Removal Loop B Suppressin Pool Cooling/Spray/Discharge to Radwaste. The operators should have used the procedure section referenced on the clearance order. He had the clearance order requirements in his hands but did not read them.

Nonetheless, a note in the front of Section 5.3 specified:

This section assumes the system is in standby status.

The operator recognized that the system was not in standby status. The operator did not use a procedure to place the train into standby status, but performed the steps from memory.

The team noted that the appropriate procedure for placing the train into standby status was Procedure SOP-RHR-STBY, Placing Residual Heat Removal in Standby Status, Revision 3. This procedure was classified as a Continuous Use procedure. That meant that the operator was

required to have the procedure in front of him and use it in a step by step manner. Neither the operator nor the peer checker pulled the procedure out to follow it.

The operator failed to implement Procedure SOP-RHR-STBY, Step 5.2.1, which specified, in part:

Verify RHR-V-6B Closed (Shutdown Cooling Suction Valve).

Prior to starting the pump, operators announced the action over the plant address system. No one in the control room tried to stop them.

10:07 a.m.

The operator started the pump. When the pump started, both the reactor vessel and suppression pool discharge valves were closed. The minimum flow valve (RHR-FCV-64B) automatically opened, consistent with its design. The valve directed the pumps discharge flow to the suppression pool.

A control room alarm annunciated, RPV DRAINDOWN RHR-V-6B

[Reactor Pressure Vessel Suction] AND RHR-FCV-64B [Minimum Flow Valve to the Suppression Pool] OPEN. The alarm indicated that operators were pumping down the reactor vessel to the suppression pool through the system minimum flow valve. Operators secured the pump within one minute. When the pump was secured, valve RHR-FCV-64B automatically closed. The reactor vessel level dropped by approximately two inches during the event. The licensee estimated that 269 gallons were transferred to the suppression pool.

In response to this event, the primary control room operator was permanently disqualified. In addition, the remainder of the shift operating crew received remedial training prior to assuming another watch.

In addition, and in response to several events involving operators, the licensee initiated a root cause determination to identify and understand the causes related to poor operator performance at Columbia Generating Station.

4. Sept 15, failure to properly coordinate control rod drive surveillances:

Simplified Drawing

August 7, 2011 The reactor was shutdown and depressurized. Maintenance personnel had replaced all of the hydraulic control unit directional control valves during the outage. Each of the 185 hydraulic control units had four of these valves. The hydraulic control units move the control rods in and out of the core. Operators can move control rods out of the core using the control rod drive system manual pushbuttons. Control rods can be inserted manually, using the manual pushbuttons, or they can be scrammed, which is much faster. In response to safety signals, all control rods are simultaneously scrammed into the core and the reactor is shut down.

Operators performed Procedure 9.3.8, Control Rod Insert and Withdrawal Timing, Revision 18 as one of the postmaintenance tests. This procedure checked the timing of each control rod when operators manually stepped the control rods in and out of the core using the manual pushbuttons. The normal time to fully insert a control rod was 42 to 54 seconds. The normal withdrawal time was 46 to 56 seconds.

The control rod timing procedure directed operators to vent the common control rod drive exhaust header to the atmosphere. Operators implemented Clearance Order C-CRD-9.3.8/R20-001, which hung caution tags on control rod drive valves CRD-V-77A and CRD-V-77B (exhaust header vents) as well as CRD-V-147 and CRD-V-149 (exhaust header isolations). The tags were hung locally. These valves were manual valves and there was no valve indication in the control room. A list of open clearance orders was available in the control room as well as a list of open surveillances.

When a control rod was moved, pressurized water was directed either to the bottom (to move in) or top (to move out) of the control rod piston. Water on the other side of the piston was diverted to the common control rod drive exhaust header. The purpose of venting the exhaust header was to vent gases out of the control rod drive system as the control rods moved. Outage work could have introduced gas into the control rod drives and gas voids have contributed to sluggish control rod movement in the past. Since the reactor was at atmospheric pressure, venting the exhaust header presented no adverse operational or design challenges to the control rod drive system during the surveillance.

In contrast, when the plant is at full power, the exhaust header pressure is slightly above reactor pressure (more than 1020 psig).

When operators completed the surveillance, 3 of the 185 control rods required retesting to address timing problems. All other control rods passed the surveillance (including control rods 14-51 and 18-51). Operators left the surveillance open until retesting could be performed. This meant that the operators did not restore the control rod drive system to the normal operational lineup. In particular, the exhaust header was still vented to the atmosphere.

September 8, 2011 Operators were performing the reactor pressure vessel hydrostatic test. A shift change occurred and a second crew continued with the hydrostatic test. The reactor was at 1020 psig. Operators were not aware that the control rod drive exhaust header was still

vented to atmosphere. The exhaust header vent valves should have been closed and the pressure in the exhaust header should have been slightly above reactor pressure.

11:16 p.m.

The operating crew implemented Procedure TSP-CRD-C101, CRD Scram Timing with Auto Scram Timer, Revision 20. This procedure had operators manually step each control rod (one at a time) out of the core and then scram each control rod. The normal practice was to continuously withdraw a control rod to position 48 (full out) before scramming. In the continuous withdrawal mode, the control rod would not stop until it was at position 48. However, if a source range monitor alarm was received (which was typical for some control rods), operators stopped control rod motion until the alarm cleared. Then they proceeded to withdraw the rod to position 48.

Procedure TSP-CRD-C101 did not require operators to verify the control rod drive system valve lineup prior to implementing the procedure.

However, Step 3.2 specified:

If scram time testing is to be performed, then verify no conflicting activities in progress.

This step was initialed by a reactor operator as complete. Contrary to this requirement, the operator did not adequately review the open surveillance log or the clearance order log for potential conflicts. Operators had improperly assumed that, because they were performing a reactor hydrostatic test, the control rod drive system had been restored to its normal valve lineup.

September 9, 2011

12:36 a.m.

Operators had performed the scram time testing procedure on the first eight control rods. Operators noticed that the withdrawal speeds were faster than they expected. They contributed the fast speeds to the control rod drive system pressure, which was a little higher than normal.

Typically the drive pressure was about 260 psi greater than reactor pressure. It was 280 psi above reactor pressure. The procedure allowed operators to adjust the pressure to as much as 400 psi above reactor pressure to move sluggish control rods. Operators continued with the surveillance.

The ninth control rod was 14-51. This control rod was adjacent to a source range detector. When passing the detector, at approximately position 38, a source range fast period alarm came in. This was expected. The operator stopped control rod movement until the alarm cleared and the source range indication approached normal. The operator then gave control rod 14-51 a withdrawal command. The control rod inserted to position 30 instead. The operator stopped. The operator then declared the control rod inoperable and fully inserted the rod. When the operator manually inserted the control rod with the manual

pushbutton, the control rod fully inserted in approximately 2.0 seconds.

This was similar to the scram speed. From position 30 the control rod should have taken approximately 32 seconds to insert.

Note: When a control rod is given a withdrawal command, it briefly gets an insert signal. This pushes the control rod in just enough to allow the collet locking mechanism to disengage.

Then, the directional control valves realign to withdrawal the control rod. Normally, this brief insert signal is not readily perceptible to observers. Because the control rod drive exhaust header was vented to atmosphere, it was not near the reactor pressure of 1020 psig. This created a large differential pressure across the control rod drive piston, which exaggerated the control rod movements. For example, when given a withdrawal command, the brief insert signal resulted in inserting the control rod six notches. In addition, when operators attempted to manually insert the control rod, it appeared that the control rod scrammed. Operators, however, were still unaware that the control rod drive exhaust header was vented to atmosphere and did not understand the control rod behavior.

12:52 a.m.

The control rods behavior was discussed with the shift manager, the shift nuclear engineers and the control rod drive system engineer. The crew decided that the behavior could be caused by gas in the system, creating a high differential pressure, or it could be caused by the directional control valve maintenance that was performed during the outage. The crew decided that the malfunction was limited to the one control rod and decided to proceed.

Note: The NRC team determined that, at the time of the control rod malfunction, postmaintenance testing on control rod drive 14-51 was already satisfactorily completed. Based on this, it was not reasonable for the operators to have assumed that the control rod malfunction was caused by the directional control valve maintenance. Further, no directional control valve problem could have caused this control rod to insert rapidly into the core in response to a manual insert signal.

The other operator generated reason for the control rod malfunction was gas in the control rod drive system. The NRC team asked the licensee to provide examples where gas in the control rod drive system had caused a control rod to behave in this manner at Columbia Generating Station. The licensee was unable to identify similar past examples. Gas normally caused control rods to behave sluggishly. Sometimes, when sitting at the full in position for a long period of time during outages, control rods would pop off position 00 an extra notch when given a withdrawal signal. The licensee had not experienced a control rod inserting (from a withdrawal signal) from the mid-part of the core.

The team also asked the licensee to provide examples from industry operating experience where gas in the control rod drive system had caused similar behavior at another plant. Again, no examples were provided. Therefore, the team concluded that operators had no basis to assume that gas in the system caused the control rod malfunctions that they were observing.

1:04 a.m.

The crew started to withdraw control rod 18-51. Like control rod 14-51, 18-51 was adjacent to a source range detector. When the source range alarm came in, the operator stopped control rod motion. When the alarm cleared, the operator gave the control rod a withdrawal signal. Similar to control rod 14-51, the control rod inserted instead of withdrawing. The crew declared the control rod inoperable and fully inserted it. Like 14-51, it inserted in a few seconds.

In response to the control rod 18-51 malfunctions, operators determined that a potentially generic problem existed and they started to look for the problem. Operators then discovered that the valves to the control rod drive exhaust header were in the improper configuration.

In addition to the procedure non-compliance mentioned previously, the NRC team determined that the operators had failed to meet the requirements of Procedure OI-9 during this event. Specifically, the following steps applied:

4.2.2 Each individual should not proceed with a task unless he/she understands the task and is aware of the expected results.

11.1 The status of plant equipment is known at all times.

In response to this event, Event Investigation Report AR-CR 248171, documented the licensees initial evaluation. The licensees primary conclusions were:

1. There was no direction in the scram time testing procedure to ensure that the control

rod drive exhaust header was isolated.

2. Operators did not have the proper information necessary to complete the task

successfully, in that the clearance order that maintained the control rod drive exhaust header vented did not have tags hanging in the control room.

In addition, and in response to several events involving operators, the licensee initiated a root cause determination to identify and understand the causes related to poor operator performance at Columbia Generating Station.

.3 Review of Relevant Operating Experience

Operator Performance and Configuration Control: The NRC and third party industry entities periodically issued operating experience that included operator errors. Some of the notices from the NRC included:

• Information Notice 2009-11: Configuration Control Errors, dated July 7, 2009. This information notice alerted licensees to: 1) an out of position instrumentation valve that led to an inoperable turbine driven auxiliary feedwater pump; 2) the failure to use or establish administrative controls including proper component labeling, proper valve locking, and valve checklists; and 3) the failure to apply station and industry operating experience.

• Information Notice 2007-11: Recent Operator Performance Issues at Nuclear Power Plants, dated March 6, 2007. The notice alerted licensees to: 1) incorrectly positioned auxiliary feedwater control switches; 2) an operator error that resulted in the isolation of normal feedwater; 3) the inappropriate removal of containment isolation logic from service; and 4) multiple instances where operators had failed to follow site procedures.

• Information Notice 1998-34: Configuration Control Errors, dated August 28, 1998.

This notice advised licensee of: 1) an improperly positioned emergency diesel generator control switch; 2) mispositioned voltage regulator potentiometers; and mispositioned emergency diesel generator fuel oil transfer switches. In these instances, the configuration control errors were not annunciated to alert operators of their incorrect positions.

The NRC team observed that the licensee had addressed each information notice in a reasonable time after issuance. However, none of these examples were exactly the same as those experienced by the licensee during this past outage.

In addition to the above, the licensee had entered the following operating experience into their corrective action program.

• AR 242740242740 Weaknesses in Operator Fundamentals, dated June 15, 2011: This document was issued by a third party organization to alert licensees to an adverse trend in operator performance across the industry. The document requested licensees to perform a self-assessment of their training programs. The licensee had performed a self-assessment dated September 26, 2007. The licensee identified:

o Operators did not consistently monitor plant parameters.

o Overall operators used human performance error prevention techniques, but some weaknesses were also identified

o In most instances, operators implemented conservative decision making, but one weakness was noted involving a failure to meet a technical specification requirement.

The NRC team noted that this piece of operating experience was most relevant to the findings that occurred during the refueling outage. However, because it was issued fairly recently (June, 2011), the licensee did not have a reasonable opportunity to fully implement corrective measures to prevent some of the events.

Nonetheless, the licensee could have focused their operators on fundamental behaviors that were already documented in their site procedures. The licensee had failed to adequately implement this type of short term remedy.

• AR 221596221596 Operator Response to a March 28, 2010 Event at H. B. Robinson Steam Electric Plant: This document was issued by a third party organization to alert licensees to poor operator performance in response to an electrical fire at H. B.

Robinson. The operating experience asked licensees to evaluate certain Maintenance and Operations performance attributes. The operating experience also asked licensees to evaluate certain plant design features. In response to the operating experience, the licensee generated a few relatively minor comments but they believed that all of the documents topics were adequately addressed.

The NRC team observed that the operating experience posed certain questions to the licensees and each licensee was expected to formally respond. One question from the operating experience was particularly applicable to this special inspection.

The question was:

Do station managers ensure that operating crew shortfalls are adequately addressed and corrected in a timely manner that will prevent events? [emphasis added]

The licensee responded:

Yes. When crew performance issues arise in the plant, the shift manager is expected to fully investigate the event and document the investigation in accordance with the station event investigation procedure. Furthermore, the shift manager is expected to brief the operations manager on the specific behaviors exhibited and standards that were not met These expectations have been codified in operations department instructions.

In contrast to this response, the NRC team observed that a failure to implement the codified operating instructions was a direct contributor to the operator errors documented in this report. Specifically, OI-9, Operations Standard and Expectations, Revision 47, Section 1.0 stated, in part:

This standards and expectations document provides the bases for Operations to continuously strengthen our leadership role in activities which impact safe, reliable, and efficient plant operations at Columbia Generating Station. For Operations to accomplish this mission, these expectations and standards must be aggressively enforced. [emphasis added]

In particular, the team observed that shift management at all levels had failed to aggressively enforce the fundamental behaviors specified in OI-9 (as referenced throughout this report).

Spurious Trips of Residual Heat Removal: General Electric (GE) issued Service Information Letter 496R1. GE also issued Supplement 1 to the letter in 1995 and Supplement 2 in 1997. The service information letter and the supplements advised certain boiling water reactor licensees that some reactor owners had experienced spurious trips of the electrical protection assemblies. These trips could cause 1/2 scrams or automatic valve isolations. These assemblies were used in the reactor protection system at Columbia Generating Station. This piece of operating experience is discussed in additional detail in Section 4OA3.2 of this report (the event timelines).

The NRC team noted that the licensee had met the recommendations outlined in the service information letter.

.4 Review of the Licensees Root Cause Evaluations and Corrective Measures

The licensee completed the following three root cause evaluations in response to the noted events. The team found the root cause evaluations to be self-critical, intrusive, and thorough. The licensees root causes addressed the extent of condition and extent of cause for the events. In total, the licensees corrective measures should be effective at preventing recurrence. However, Operations management will need to continue to aggressively assess operator performance on an ongoing basis to achieve lasting results. A summary of the licensees conclusions follow each root cause title:

• Continued Decline in Operational Human Performance at Columbia Generating Station, dated 10/27/2011 (AR 248578248578. The licensee concluded:

1. Corrective actions from previous human performance improvement actions were

not fully effective in addressing the behaviors associated with the consistent use of human performance tools.

2. Operators sometimes accept and work around procedure quality issues instead

of getting the procedures revised.

3. Operations lacks a robust method of tracking abnormal system configurations.

Planned corrective measures included:

1. Complete Operations high intensity training to enforce expectations and

demonstrate compliance with Operations standards.

2. Operations manager and assistant operations manager will conduct focused

performance monitoring of all crews.

6. Senior Maintenance managers will conduct focused performance monitoring of

maintenance personnel.

7. Selected procedure changes.

• Unmonitored Letdown of Reactor Water to the Under Vessel Sump Area, [7/28/2011 to 7/30/2011 event], dated 10/27/2011

1. Procedures SOP-CAVITY-DRAIN, Reactor Cavity and Dryer Separator Pit

Draining, Revision 7 and PPM 10.3.22, Reactor Vessel Reassembly, Revision 29 provided inadequate direction concerning the reactor vessel level instrumentation vent path.

2. Operators failed to aggressively investigate the reactor pressure vessel letdown

and makeup flow mismatch at the first opportunity. This delayed identification of the flow mismatch for approximately 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />.

Corrective measures included:

1. Revision of the noted procedures to provide appropriate direction. The

procedures were revised to require that an alternate vent path be provided prior to closing the reactor core isolation cooling system head flange.

2. Create a new system operating procedure for reactor shutdown level control

strategies.

• Loss of Reactor Protection System Channel B and Automatic Isolation of Shutdown Cooling, dated 10/31/2011

1. Columbia Generating Station did not take a proactive approach to replacing the

older style logic boards.

Corrective measures included the schedule replacement of all of the older style logic boards with boards of the improved design.

Additional details are provided in Sections 4OA3.2 of this report.

.5 Review the Potential Cause or Causes of the Events for Common Causes

Four of the five events involved operator errors. In these four events, the failure to maintain an awareness of plant status was a contributor. The failure to maintain adequate configuration controls was also a factor. Some operators stated that some of these events had happened in the past (loss of inventory through MS-V-1 and 2, as well as the event where reactor vessel level instruments were not properly vented). In some cases, operators chose to proceed with work when it was not approved, was outside the bounds of the procedure, or when they experienced unexpected plant conditions. In these instances, conservative decision making was not evident. In a few instances, operators suspected that something was wrong but didnt speak up.

The team observed that all of the above performance issues were related to the failure to enforce fundamental operator behaviors detailed in Procedure OI-9, Operations Standard and Expectations, Revision 47, Section 1.0 stated, in part:

This standards and expectations document provides the bases for Operations to continuously strengthen our leadership role in activities which impact safe, reliable, and efficient plant operations at Columbia Generating Station. For Operations to accomplish this mission, these expectations and standards must be aggressively enforced. [emphasis added]

The failure to aggressively enforce the standard was particularly evident during the most recent refueling outage. However, the willingness to work around substandard procedures was a longstanding operator behavior. As noted in Section 4OA3.2, operators had repeatedly failed to properly implement the requirements of OI-9. A review of the examples is provided below:

1. April 11 event - operators inadvertently drained 4000 gallons of reactor coolant

inventory through valves MS-V-1 and MS-V-2 to the equipment drain sump.

Operators failed to follow OI-9 Steps 11.1 and 13.2.4, in that: 1) operators failed to know the status of plant equipment at all times; and 2) during prior outages, operators had failed to resolve procedure problems prior to commencing similar work.

2. July 28 to 30 event - reactor vessel level instruments were inaccurate and operators

inadvertently drained approximately 4300 gallons of water from the reactor vessel.

Operators failed to follow OI-9 Steps 4.2.2, 11.1, 11.2.1, and 13.2.5 because 1)operators did not understand the task and were not aware of the expected results prior to proceeding; 2) operators did not know the status of plant equipment at all times; 3) operators used verbal instructions to control work, versus procedures, work orders or tags; and 4) operators failed to stop the activity when the procedure was found to be inadequate or unclear and failed to correct the procedure prior to proceeding. In addition, during past outages, operators had worked around the deficient procedure and had failed to get it changed.

3. September 10 event - operators failed to follow procedures and drained reactor

coolant to the suppression pool. Operators failed to follow OI-9 Step 18.2.9.c and Section 14, in that: 1) operators started work prior to conducting a pre-job brief; and 2) the peer check for the evolution did not perform an adequate peer check.

4. September 15 event - operators failed to properly coordinate two control rod drive

surveillances. Operators failed to follow OI-9 Steps 4.2.2 and 11.1 in that: 1)operators proceeded with a task when they were not aware of the expected results; and 2) operators did not maintain an awareness of plant status at all times.

The team observed that Procedure OI-9 was a reference use procedure. This means operators were not required to review the procedure on an ongoing basis. They were expected to review the procedure as needed. Over time, Columbia supervision failed to reinforce the procedures requirements and operators became complacent. For this type of procedure to be effective, control room supervisors and managers must aggressively

review operator performance against the procedures standards. In some of the cases, control room shift managers and supervisors were non-compliant with the standards.

.6 Review Applicable Training, Crew Command and Control, and Procedure

Adherence

Prior to the outage, the licensee provided Just in Time training to the operators. This training included the plant shutdown and startup. The specific evolutions where operator performance issues arose were not covered, but most plants would not provide Just in Time training to this level of detail.

Command and control in the control room environment is best when performance standards are continuously re-enforced by control room supervisors and shift managers.

However, as noted in Section 4OA3.5, in some cases control room supervisors and shift managers were non-compliant with the performance standards specified in OI-9. In other cases, shift supervision were not enforcing the standards. These lapses led to the procedure non-compliances noted earlier.

.7 Review Corrective Actions from Ongoing Site Improvement Programs (i.e. Pride in

Performance/Pride in Excellence) to Determine their Effect on Improving Operator Performance Over the past few operating cycles, a number of performance issues were identified at Columbia Generating Station. In addition, an NRC performance indicator Reactor (Scrams) had turned from Green to White. In response to the concerns, the licensee had implemented a performance improvement program entitled: Pride in Performance.

Further, the licensee had completed a root cause assessment for the five reactor scrams. Some of the contributing causes, which were relevant to this special inspection, included:

1. Decisions made were non-conservative and demonstrated a tolerance for high risk

activities.

2. Weaknesses in the implementation of policies and programs (particularly in the area

of maintenance and engineering).

3. Supervision was not thoroughly engaged in the actual conduct of work which caused

an increased number of performance errors.

While the performance problems were likely site-wide, the licensee had perceived that the problems were primarily in the Maintenance and Engineering functional areas. This logic was somewhat faulty because Operations personnel were involved with all of the decision making activities at the site. Nonetheless, the licensee focused performance improvement initiates primarily in Maintenance and Engineering. Operations was involved to a lesser degree. By not focusing more attention on Operations, the licensee missed an opportunity to correct the deficient behaviors that led to the four operator caused events.

.8 Findings

For the first documented event, loss of inventory during flood-up through valves MS-V-1 and MS-V-2, findings were already documented in NRC Inspection Report 05000397/2011002. For the event that resulted in a loss of residual heat removal, no findings of significance were identified. For the remaining three events, the team documented the following findings.

(1) Failure to Follow Clearance Order Instructions

Introduction.

The team documented a Green self-revealing violation of Technical Specification 5.4.1(a), Procedures, because operators failed to meet the conditions of a plant clearance order before opening main steam line drain valves. Consequently, operators inadvertently drained approximately 4300 gallons of reactor coolant to the under-vessel sump. Contributors to the violation included: 1) the reactor vessel assembly procedure was inadequate, in that it permitted maintenance personnel to place the reactor vessel level instruments in an uncalibrated condition; and 2) plant operators failed to follow operational performance standards when they were advised of the condition and proceeded to lower reactor vessel level for approximately 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> with inaccurate reactor vessel level instruments. The licensee entered the violation into their corrective action program as Action Request 245507.

Description.

This event is discussed in detail in Section 4OA3.2 of this report. The team observed the following performance deficiencies that occurred starting on July 28, 2011 and continuing through July 30, 2011.

1. Operators failed to follow the requirements of Procedure PPM 1.3.64, Plant

Clearance Order, Revision 24, Step 4.10.1, when lifting a clearance order. The procedure required:

Ensure the requirements of the instructions associated with the step are completed prior to moving ahead.

Clearance Order C-MS-V-1 and 2-001 specified:

Release instructions: Reactor pressure vessel level is less than +190 inches.

Contrary to the instructions, actual reactor vessel level was well above +190 inches when the operators lifted the clearance order and opened valves MS-V-1 and MS-V-2.

2. Procedure PPM 10.3.22, Reactor Pressure Vessel Reassembly, Revision 29, was

inadequate, in that it permitted maintenance personnel to isolate the vent path that was needed to maintain reactor vessel level instruments in a calibrated condition.

Subsequently, vessel level was much higher than indicated on control room instruments and operators inadvertently drained approximately 4300 gallons of water from the reactor vessel to the equipment drain sump.

3. Operators had failed to obtain appropriate procedure changes when the deficient

procedure caused similar problems during past outages. In those instances, however, operators had recalibrated the level instruments for the new conditions.

The failure to get the procedure changed was inconsistent with Procedure OI-9, Step 13.2.5, which stated:

Stop an activity and place the equipment in a safe condition if the procedure is found to be inadequate or unclear. Seek resolution prior to proceeding.

4. Once notified of the closed reactor vessel vent, operational personnel failed to verify

the actual condition of the reactor vessel vent prior to proceeding. They convinced themselves that the vent was still functional when it was not. In addition, the shift attempted to control the work through verbal instructions and not through the documented means intended for that purpose. The shift managers actions were inconsistent with the following sections from Procedure OI-9, Operations Standard and Expectation Revision 47:

a. Step 11.1, which stated:

The status of plant equipment is known at all times.

b. Step 11.2.1 which stated:

The control of plant equipment status is governed by procedures, work orders or tagging.

c. Step 4.2.2:

Each individual should not proceed with a task unless he/she understands the task and is aware of the expected results.

Analysis.

The failure to follow the clearance order release requirements was a performance deficiency. In addition, the failure to implement Procedure OI-9 to verify the status of plant equipment, to control work with documented instructions, to only proceed with a task once it is understood, and to stop and get deficient procedures corrected prior to proceeding were also performance deficiencies. The finding was more than minor because it affected the human performance attribute of the Mitigating

Systems Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of reactor vessel level instruments that are used to respond to initiating events to prevent undesirable consequences (i.e., core damage). The inspectors used NRC Inspection Manual 0609, Appendix G, Shutdown Operations Significance Determination Process, to evaluate the significance of the finding. The finding did not require a quantitative assessment because adequate mitigating equipment remained available and the finding did not constitute a loss of control, as defined in Appendix G. Therefore, the finding screened as Green. The finding had a crosscutting aspect in the area of human performance associated with Work Practices because plant personnel, once faced with unexpected circumstances, continued to proceed in the face of uncertainty H.4(a).

Enforcement.

Columbia Generating Technical Specification 5.4.1(a) stated, in part, that written procedures shall be established, implemented and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978. Appendix A to the regulatory guide, Section 1.c specified procedures for equipment control (locking and tagging). When lifting a clearance order, Procedure PPM 1.3.64, Plant Clearance Order, Revision 24 (a procedure for locking and tagging), Step 4.10.1, required, Ensure the requirements of the instructions associated with the step are completed prior to moving ahead. Clearance Order C-MS-V-1 and 2-001 specified, Release instructions: Reactor pressure vessel level is less than 190 inches.

Contrary to the instructions, actual reactor vessel level was well above 190 inches when the operators lifted the clearance order and opened valves MS-V-1 and MS-V-2.

Because this finding was of very low safety significance and was entered into the licensees corrective action program as Action Request 245507, this violation is being treated as a noncited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000397/20011008-01, Failure to Follow Clearance Order Instructions.

(2) Failure to Follow Suppression Pool Cooling Procedure

Introduction.

The team documented a Green self-revealing violation of Technical Specification 5.4.1(a), Procedures, because operators failed to properly align the train B residual heat removal system prior to starting the pump. Consequently, approximately 269 gallons of water were transferred to the suppression pool because the reactor vessel suction valve was left open. In addition, plant operators had failed to follow operational performance standards in that they did not ensure that the control room supervisor had approved the work, they failed to utilize the appropriate alignment procedure, and the peer check did not perform a meaningful peer check. The licensee entered the violation into their corrective action program as Action Request 248226.

Description.

This event is discussed in detail in Section 4OA3.2 of this report. The team observed the following performance deficiencies that occurred on September 10, 2011.

1. The reactor operator failed to follow the instructions in Procedure SOP-RHR-STBY,

Placing Residual Heat Removal in Standby Status, Revision 3. Step 5.2.1 specified, in part:

Verify RHR-V-6B Closed (Shutdown Cooling Suction Valve).

2. The reactor operator also failed to obtain the control room supervisors permission

prior to re-aligning train B. Specifically, the operators actions were inconsistent with Procedure PPM-1.3.1, Operating Policies, Programs and Practices. Step 4.13.3 states, in part:

The assignments and responsibilities of the Control Room Supervisor (CRS)include directing the operation of the plant in accordance with Technical Specifications and approved plant procedures.

In addition, his actions were inconsistent with Procedure OI-09, Section 5.1.1, which stated, in part:

Senior reactor operators will authorize and prioritize work...

3. The operator failed to ensure that a pre-job brief was performed prior to re-aligning

train B. Procedure OI-9, Section 18.2.9.c stated:

Perform pre-job briefs for tasks or evolutions outside of routine activities (i.e.

routine activities such as operator rounds or radwaste tank transfers). Routine versus non-routine task determinations are made by the shift manager or control room supervisor.

4. The peer check for the task failed to perform a meaningful peer check. The reactor

operator asked a fellow on-shift operator to perform a peer check while he re-aligned the system and started the pump. Although the peer check did not recall a brief on this evolution, and self-questioned why it was being performed, he was a less experienced operator and did not feel comfortable questioning the actions of a more experienced operator. The peer check did not meet the standards for a peer check specified in OI-9, Section 14, Self/Peer checking and First Check. Some of those standards included:

Peer checks are required for one hundred percent of control room activities, except during plant transients when peer checks may not be immediately available This includes procedure Verify steps outside of operator rounds and data gathering.

Self-checking, peer checking and first check are undocumented review techniques used to ensure proper plant operation and to prevent errors.

Peer checking an action requires the performance of the action to be observable and methodical, with discrete pauses to allow the peer checker to correct any errors.

Peer checkers are competent when they have the training and experience necessary to properly verify an action.

When the pump started, both the reactor vessel and suppression pool discharge valves were closed. The minimum flow valve (RHR-FCV-64B) automatically opened, consistent with its design. The valve directed the pumps discharge flow to the suppression pool. A control room alarm annunciated, RPV DRAINDOWN RHR-V-6B [Reactor Pressure Vessel Suction] AND RHR-FCV-64B [Minimum Flow Valve to the Suppression Pool]

OPEN. The alarm indicated that operators were pumping down the reactor vessel to the suppression pool through the system minimum flow valve. Operators secured the pump within one minute. When the pump was secured, valve RHR-FCV-64B automatically closed. Reactor vessel level dropped by approximately two inches during the event. The licensee estimated that 269 gallons were transferred to the suppression pool.

Analysis.

The failure to follow procedure requirements when aligning the residual heat removal train was a performance deficiency. In addition, the failure to implement Procedure OI-9 to ensure that work was authorized, briefed and that a peer check was fully engaged were also performance deficiencies. The finding was more than minor because it affected the human performance attribute of the Initiating Events Cornerstone and affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. The inspectors used NRC Inspection Manual 0609, Appendix G, Shutdown Operations Significance Determination Process, to evaluate the significance of the finding. The finding did not require a quantitative assessment because adequate mitigating equipment remained available and the finding did not constitute a loss of control, as defined in Appendix G. Therefore, the finding screened as Green. The finding had a crosscutting aspect in the area of human performance associated with Work Practices because operators failed to properly utilize human error prevention techniques such as holding pre-job briefings as well as self and peer checking H.4(a).

Enforcement.

Columbia Generating Technical Specification 5.4.1(a) stated, in part, that written procedures shall be established, implemented and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978. Appendix A to the regulatory guide, Section 4 specified procedures for operation of safety related equipment. Procedure SOP-RHR-STBY, Step 5.2.1, specified, in part: Verify RHR-V-6B Closed (Shutdown Cooling Suction Valve).

Contrary to the above, valve RHR-V-6B was left open. Because this finding was of very low safety significance and was entered into the licensees corrective action program as Action Request 245507, this violation is being treated as a noncited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000397/20011008-02, Failure to Suppression Pool Cooling Procedure.

(3) Failure to Verify the Control Rod Drive System Lineup

Introduction.

The team documented a Green self-revealing violation of Technical Specification 5.4.1(a), Procedures, because operators failed to follow the control rod drive scram testing procedure, in that they failed to verify that no conflicting activities were in progress. Consequently, control rods were moving much faster than normal because the control rod drive exhaust system header was vented. In addition, plant operators had failed to follow operational performance standards in that failed to know the plant status at all times and they proceeded with the surveillance when they were not

aware of the expected results. Further, once the control rod behavior was clearly outside the expected norms, operators contributed the unusual performance to inappropriate causes and continued to test additional control rods. The licensee entered the finding into their corrective action program as Action Request 248171.

Description.

This event is discussed in detail in Section 4OA3.2 of this report. The team observed the following performance deficiencies that occurred on September 9, 2011.

1. Operators failed to follow the instructions in Procedure TSP-CRD-C101, CRD

Scram Timing with Auto Scram Timer, Revision 20. Step 3.2 specified:

If scram time testing is to be performed, then verify no conflicting activities in progress.

Contrary to this requirement, the operator did not adequately review the open surveillance log or the clearance order log for potential conflicts. Operators had improperly assumed that, because they were performing a reactor hydrostatic test, the control rod drive system had been restored to its normal valve lineup. In reality, the control rod drive exhaust header was vented to support a conflicting control rod drive surveillance. It should have been isolated and the pressure in the exhaust header should have been greater than 1020 psig.

2. In response to 1) control rods moving faster than expected; 2) one control rod

inserted when given a withdrawal signal; and 3) the same control rod appeared to scram when given a manual insert signal, operators attributed the anomalies to inappropriate causes and continued with the testing. For example, they stated that either directional control valve maintenance caused the problems (after postmaintenance testing was completed satisfactorily) or gas in the system was causing the problems (gas had not cause this type of problem previously).

3. Operators failed to implement OI-9, Procedure OI-9, Operations Standard and

Expectation, Revision 47 during this event. Specifically, the following steps applied:

4.2.2 Each individual should not proceed with a task unless he/she understand the task and is aware of the expected results.

11.1 The status of plant equipment is known at all times.

Analysis.

The failure to follow procedure requirements when performing control rod drive system surveillance testing was a performance deficiency. In addition, the failure to implement Procedure OI-9 to ensure that operators were aware of plant status at all times and understood the task and expected results before proceeding were also performance deficiencies. The finding was more than minor because it affected the configuration control attribute of the Mitigating Systems Cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. In addition, this finding could be more significant if left uncorrected. Operation of the control rod drive system with the exhaust header vented could cause damage. Control rod withdrawal faster than the normal (under certain power configuration) could challenge fuel integrity.

The inspectors used NRC Inspection Manual 0609, Appendix G, Shutdown Operations Significance Determination Process, to evaluate the significance of the finding. The

finding did not require a quantitative assessment because adequate mitigating equipment remained available and the finding did not constitute a loss of control, as defined in Appendix G. Therefore, the finding screened as Green. The finding had a crosscutting aspect in the area of human performance associated with Work Practices because operators failed to properly utilize human error prevention techniques such as holding pre-job briefings as well as self and peer checking H.4(a).

Enforcement.

Columbia Generating Technical Specification 5.4.1(a) stated, in part, that written procedures shall be established, implemented and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978. Appendix A to the regulatory guide, Section 4 specified procedures for operation of safety related equipment, including the control rod drive system. Procedure TSP-CRD-C101, Step 3.2 specified: If scram time testing is to be performed, then verify no conflicting activities in progress. Contrary to the above, on September 9, 2011, the control room operator implemented Procedure TSP-CRD-C101 without first verifying that no conflicting activities were in progress. Because this finding was of very low safety significance and was entered into the licensees corrective action program as Action Request 248171, this violation is being treated as a noncited violation, consistent with Section 2.3.2 of the NRC Enforcement Policy: NCV 05000397/20011008-03, Failure to Verify Control Rod Drive System Lineup.

40A6 Meetings

Exit Meeting Summary

On November 2, 2011, the inspectors presented the inspection results to Mr. M. Reddemann, Chief Executive Officer, and other members of the licensee staff. The licensee acknowledged the issues presented. The inspector asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary information was identified.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

M. Reddemann, Chief Executive Officer

D. Atkinson, Vice President, Operations Support/Corporate Support

M. Armente, Reactor Fuels Manager

J. Bekhazi, Maintenance Manager

I. Belts, Equipment Operator

I. Boreland, Supervisor, Corrective Action Program

D. Brown, Operations Manager

I. Butner, Equipment Operator

J. Carlson, Reactor Operator

K. Christianson, Acting Licensing Supervisor

G. Cullen, Recovery Manager

M. Davis, Radiological Services Manager

C. England, Chemistry Manager

K. Farley, Reactor Operator

M. Feser, Senior Reactor Operator

R. Garcia, Licensing Engineer

B. Green, Operations Crew Manager

D. Gregoire, Acting Manager, Regulatory Affairs

J. Hedgecock, Shift Manager

A. Jarorih, Vice President, Engineering

J. Jones, Senior Reactor Operator

V. Keszler, Reactor Operator

C. King, Assistant Plant General Manager

B. MacKissock, Plant General Manager

D. Matthews, Reactor Operator

C. Moon, Training Manager

C. Nordhaus, Operations Work Control Manager

M. Pezetti, Operations Support Manager

R. Preweit, Assistant Operations Manager

N. Rullman, Shift Support Supervisor

B. Sawatzke, Chief Nuclear Officer

B. Sherman, Bonneville Power Authority

M. Shobe, Chemistry Supervisor

J. Sims, Production and Project Manager

T. Steckler, Reactor Operator

D. Swank, General Manager, Engineering

R. Torres, Quality Manager

D. Williams, Equipment Operator

P. Zylinski, Equipment Operator

NRC Personnel

J. Groom, Senior Resident Inspector

M. Hayes, Resident Inspector

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

None.

Opened and Closed

05000397/2011008-01 NCV Failure to Follow Clearance Order Instructions (Section 4OA3.8(1))

05000397/2011008-02 NCV Failure to Follow Suppression Pool Cooling Procedure (Section 4OA3.8(2))

05000397/2010008-03 NCV Failure to Verify Control Rod Drive System Lineup (Section 4OA3.8(3))

Closed

05000

05000397-2011-02-00 LER Loss of Shutdown Cooling Due to Logic Card Failure

Discussed

None