IR 05000458/1997015
| ML20199C550 | |
| Person / Time | |
|---|---|
| Site: | River Bend  |
| Issue date: | 11/17/1997 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML20199C544 | List: |
| References | |
| 50-458-97-15, FACA, NUDOCS 9711200052 | |
| Download: ML20199C550 (18) | |
Text
- _ _ _ . . .. . - -.
.
>>.
'
.-
ENCLOSURE 1 >
,
U.S. NUCLEAR R'EGULATORY_ COMMISSION REGION' IV ~
Docket No.: 50-458 License No.: NPF-47
- Report No.: 50-458/97-015 Licensee: Entergy Operations, In Facility: River Bend Station Location: 5485 U.S. Highway 61 '
St. Francisville, Louisiana 70775 -
Dates: - September 22 through October 17,1997 Inspectors: W. F. Smith, Senior Resident inspector W. B. Jones, Senior Reactor Analyst Division of Reactor Safety Approved By: Elmo E. Collins, Chief, Project Branch C Division of Reactor Projects-Attachment: Supplemental Information 9711200052 971117 l.-
PDR ADOCK 05000458 G pg
"
l
. . - . . . _ . _ . . - _ . . _ . - ,
.
.
EXECUTIVE SUMMARY River Bend Station NRC Inspection Report 50 458/97-015 This specialinspection included a review of the circumstances surrounding the September 13,1997, unexpected increase in reactor coolant temperature which resulted in an inadvertent Mode change from Cold Shutdown (Mode 4) to Hot Shutdown (Mode 3).
Additionally, it reviewed the October 4 loss of shutdown cooling that resulted in a reactor coolant temperature rise of 3.4 Ooerations
- On September 13,1997, the plant was inadvertently allowed to transition from Mode 4 to Mode 3 for approximately 30 minutes during a penod when 11 Technical Specification (TS) Limiting Conditions for Operation (LCO) applicable to Mode 3 were not met (Section 01.2),
- The Facility Review Committee (FRC) demonstrated weak performance by accepting a postmodification test procedure that did not contain adequate controls and precautions for use during periods of high reactor decay heat rate (Section 01.2).
- The inadvertent Mode change event of September 13,1997, demonstrated inadequate training of the operators pertaining to the meaning of reactor coolant system temperature, level, and pressure indications monitored with ahernate methods of reactor coolant circulation (Section 01.2).
- The Shutdown Operations Protection Plan (SOPP) shutdown cooling guidelines and contingency actions f ailed to adequately address the " time-to-boil" curves located in Attachment 10 of Procedure OSP-OO37, and specify which actions were to be performed to ensure there was sufficient transition time between shutdown cooling method changes (Section O1.3).
- Followup actions to Operating Event 94-25 were not comprehensive in that the licensee missed an opportunity to establish a means to monitor reactor coolant bulk temperature with no reactor recirculation pumps in operation (Section 01.3).
- Inadequate procedural controls over outage bus restoration contributed to an inadvertent isolation and resultant loss of shutdown cooling for 17 minutes (Section 01.4).
- The operators involved in outage bus restoration and coordination demonstrated poor performance in that, as a team, they f ailed to be knowledgeable of the impact of breaker closures on existing plant conditions (Section 01.4).
- Operations procedures for establishing and controlling shutdown cooling did not have sufficient instructions to protect key shutdown cooling paths. Instead, the licensee relied upon suf ficient operator knowledge of plant conditions to ensure adequate shutdown cooling (Section 01.4).
_ _ _ __ ______._._.____m _ , _ _ . _ . . . ._ __ . . . .. s
.
.
2. -
- Poor judgement was exercised by control room supervision and the bus coordinator by not taking the time to ensure there was a control room brief on the busses to be restored. This denied control room personnel scrutiny over the actions to be taken that could effect plant conditions (Section 01.4).
- Control room supervision failed to intervene and terminate bus restoration cctivities upon a loss of shutdown cooling event until the cause was established to prevent a ,
recurrence. Consequently, the second valve closed inadvertently when the motor operator was energized (Section 01.4).
Enainecung
.
-* Engineering failed to develop and implement a postmodification test procedure that ,
!
adequately addressed the' applicable precautions associated with performing the
- Alternate Decay Heat Removal (ADHR) System test during a time when decay heat rates were high (Section 01.2).
- ~ The licensee's shutdown equipment out of service (EOOS) monitoring program and Outage Review Assessment Team (ORAT) risk review provided a comprehensive assessment of steady state shutdown risk based on decay heat,' decay heat removal system availability, and vessel water level. However, the licensee's staff failed to
,
effectively integrate the plant's shutdown risk with actual plant conditions, equipment configurations, and planned evolutions (Section 01.3).
,
a
_ _._ _ a - _ _ _
-
. - __ _ __ _. _ _ _ - . . _ _ _ _ - _ . _ _ _ _ __ ,
_
.
.
Bqport Detaita Summary of Plant Status The plant was shut down and cooled down on September 12,1997, in preparation for Refueling Outage 7. For the duration of this inspection, the plant was either in Mode 4 (Cold Shutdown) or Mode 5 (Refueling).
1. Operations 01 Conduct of Operations (71707)
01.1 Summarv of inadvertent Mode Chanae Event On September 13,1997, with the plant in Mode 4, the licensee commenced testing the ADHR function of the suppression pool cleanup system. Initially, reactor coolant temperatures indicated 129 F at the shut down cooling heat exchanger inlet and at the reactor water cleanup (RWCU) system regenerative heat exchanger inlet. At 11:47 a.m., shutdown cooling was secured to permit placing ADHR in service. At 1:24 p.m., RWCU temperature approached 160*F. When the operetors placed ADHR in service, the ADHR heat exchanger inlet temperature increased from ambient to 210.7 F in 11 minutes while the temperature at the RWCU system increased to 168'F. By 1:41 p.m., the ADHR heat exchanger inlet temperature had decreased to less than 200 F. The licensee subsequently concluded that the plant inadvertently entered Mode 3 (reactor coolant average temperature greater than 200*F) for approximately 30 minutes with a maximum average temperature of 205 F. At approximately 4 p.m., ADHR indicated 140 F while RWCU indicated 109 At the time when reactor temperatures were in excess of 200 F, refueling personnel were disconnecting the reactor core isolation cooling piping from the reactor vessel head. Refueling personnel observed vapor coming from the disconnected piping flange, and af ter contacting the control room and obtaining air samples to determine the radiological conditions, the refueling area was evacuate On September 14, the General Manager, Plant Operations, directed that a SERT ba formed to investigate the event, establish the causes, and recommend corrective action .2 Detailed Review of inadvertent Mode Chanae Event
, Inspection Scope Tne ir spectors reviewed procedures, control room logs, SEFtT conclusions, and interviewed key personnel to obtain an understanding of the circumstances surrounding the September 13,1997, inadvertent change from Mode 4 to Mode i
. - - _ _ - - - _ _ _ _ - - _ _ _ _ _ _ _ _ _ _ - _ _ - . _ _ _ _ - - _ _ _ _ _ _ _ _ _
.
.
b. Qbservations and Findinos On September 12, at 1 a.m., River Bend Station entered Refueling Outage 7. At 4:30 p.m., reactor coolant temperature was 131*F as read at the RWCU regenerative heat exchanger inlet. At this time, the licensee shifted shutdown cooling from Residual Heat Removal (RHR) Pump B to RHR Pump A. During the 20 minute period when shutdown cooling was off, reactor coolant temperature increased about 10*F, as indicated at the RWCU regenerative heat exchange inle Reactor level increased by 100 inches. The licensee considered that with shutdown cooling secured, reactor coolant temperature would increase at a rate of approximately 10'F over a 30 minute perio On September 13, at 1 a.m., maintenance personnel respanned the shutdown range reactor vessel level transmitter and disconnected the reference leg from the -
transmitter as a normal part of preparation for reactor vessel head removal. This action caused the level transmitter to read direct water pressure for level indication rather than differential pressure between the reference leg and variable leg. Any pressure perturbation within the reactor vessel was then read as a level chang At 4:50 a.m., the reactor head vents were tagged closed to support reactor vessel head disassembl At 7:30 a.ir, the FRC was convened to review and approve Post Modification Test Procedure le ' O-0010-PMT-04, "ADHR System initial Operation," Revision 1. The FRC had not inmed the original version of the procedure because it was only a data gathering document. Revision 1 incorporated information from a draf t system operating procedure for the new ADHR system, which was needed to line up and operate the system during the test. Because the procedure contained operational instructions which would affect safety-related components, the licensee's
'
administrative controls required an FRC review. The inspectors reviewed the FRC meeting minutes for Meeting 97-058, dated September 24,1997i and noted that although the FRC asked many questions, such as how, and to what limits, temperatures would be monitored, the subject of " time to boil" was not addressed during their discussion of the time it would take to transition from normal shutdown cooling to ADHR. The FRC accepted the procedure on the basis that the test would be aborted and normal shutdown cooling restored if reactor coolant temperature reached 160* At 9 a.m., a shif t briefing was held in the control room. Among other precautions,
the briefing addressed the 160*F limit imposed by the test procedure. At l~ 11:35 a.m., another briefing was held by the test engineer, as documented in the l control room log.
l l
,
f
<
.. .. ~. . . - . . -. - - - -- . - . _ -- -. - --
i
-
,
-3r L i
At 11.47 a.m., the RHR A shutdown cooling heat exchanger inlet temperature was compared with RWCU regenerative heat exchanger intet temperature. They were determined to be in agreement. The control room log noted that the reactor coolant temperature was 129.2*F at this time. RHR Pump A was secured and the operators-commenced placing the new ADHR system in service. During this pcriod, RWCU '
was circulating and there were no reactor recirculatior' 'mps running. Reactor vessei water level was approximately 196 inches, whicn was conducive for natural circulation within the vessel. The minimum level for natural circulation was 75 inche i At 12:47 p.m., RWCU was indicating 138'F. The operators were monitoring temperature frequently as RWCU temperature approached the _160'F precedural
!
limit. Subsequently, as the operators were opening the ADHR path to the reactor vessel, which was the RHR Pump C injection valve, reactor vessel level increased ,
from 196 inches to 220 inches over a 13-minute period and tripped the high level annunciator. Operators responded by taking action to reduce ievel to ensure that reactor coolant was not flowing into the reactor cavity. Additionally, refueling personnel were questioned as to what they were doing at that time. The operators did not recognize that the 24-inch level increase was due to the level instrument reference leg being disconnected and vented as discussed earlier. The 24-inch level increase was later determined to be the level instrument's response to slight -
pressurization of the reactor vessel (i.e., approximately 0.9 psig).
At 1:24 p.m., as the RWCU temperature approached 160*F, the ADHR system was placed in service. At 1:25 p.m., the reactor core isolation cooling spray injection line flange was disconnected from the reactor vessel by refueling personnel. This provided a larger vent path for the reactor vessel, and what started as a small amount of vapor became a cloud of vapor. This activated smoke detecting f:re alarms in the area. The radiation protection supervisor on the refueling floor evacuated the area at 1:31 p.m. Air samples taken during this event showed a slight increase in iodine, particulate, and noble gases. The area was properly controlled by radiation protection personne By 1:35 p.m.,11' minutes af ter ADHR was placed in service, the temperature of reactor coolant entering the ADHR heat exchanger had increased from ambient to 210.7'F. In addition, RWCU was indicating 168' At 1:41 p.m., the ADHR inlet temperature decreased below 200*F, and by 2:31 p.m..- the temperature was 158.3*F. Although this temperature was recorded as being above 200*F for 12 minutes, the licensee recognized that this was a mixture of stratified water which reflected higher temperatures in the core area for a
< longer period of time. Engineering evaluations determined that the verage reactor coolant temperature reached approximately 205'F, and remained above 200'F for approximately 30 minute . -
-. _ . . _ _ - . _ . _ _._..m . _ _ ___ _ ___ ._.__ _ _ _. _ - - -
g ,
.
.
'
-4
,
During the t.pproximately 30 minute period in which the average reactor coolant temperature was greater than 200*F, the plant was in Mode 3, as defined in TS-1, At this time,11 TS LCOs applicable to Mode 3 were not met. For example, primary i
and secondary containment and drywell integrities were not set, the Divisions I and :-
lli emergency diesel generators were inoperable, and the Division I saf ety related -
battery was inoperable. TS 3.0.4 states, in part, that when an LCO is not met, .
- entry into 'a mode or other specified condition in the applicability shall not be mad Entering Mode 3 without satisfying the applicable LCOs is an apparent violation of TS 3.0.4 (50-458/97U15 01h The inspectors noted that there was a significant difference between the flow path for ADHR and the flow path for normal RHR shutdown cooling and RWCU. Both ADHR and RHR tcke a suction from the reactor down r:omer annulus; however, >
normal RHR shutdown cooling return is via thc feedwater sparger, which is also in the down comer annulus. ADHR return is via the RHR C injection line through the core shroud directly into the reactor cere. With ADHR operating at 2300 gpm and RHR operating at 5000 gpm, good mixing and circulation occurs with or without the reactor r%irculating pumps operating. RWCU takes a section frum three points, the bottom head drain and each of the recirculation luops. Without forced :
circulation, however, a cooler mix of reactor coolant could be delivered to the RWCU regenerative heat exchangar inlet, where the temperature was monitored as the average reactor coolant temperature, during reduced flow conditions. General Electric Service Information Letter 357, dateJ June 1981, discussed that while in
'
the cold shutdown mode with both recirculation loops off, it is possible to have-vessel water thermal stratification with the RHR shutdown cooling systerr operating in a throttled mode. The letter also stated that without sufficient circulation, the RWCU system bottom drain and recirculation system thermocouples would register significantly lower than the temperature at the surf ace of the water. This was
,
experienced in this even The inspectors noted during the review of Procedure MR-95-0010 PMT-04, that there were no precautions related to performing the test soon after shutdown when decay heat rates were high, nor did the procedure address the " time to-boil" curves,
.
which were available to the operators. The inspectors concluded that the procedure es inadequate to the safe implementation of the ADHR test, and as such, is an
]
apparent violation of TS 5.4.1.a (50-458/97015-02).
b During the course of this inspection, the inspectors reviewed Procedures OSP-0041,
" Alternate Decay Heat Removal," Revision 1, Abnormal Operating Procedure AOP-0051, " Loss of Decay Heat Removal," Revision 7, and System-Operating Procedure SOP 0140, " Suppression Pool Cleanup and ADHR," Revision ,
The inspecto.s noted that these procedures did not address precautions associated with transitioning to ADHR when decay heat rates were high, and that
'
representative reactor coolant temperature monitoring was ensured. As an .
, - _ _ - - _ - _ _ _ . . . - . . _ - ._ __ ~ ~ _ _ . _ _ _ _ _ _ . _ . _ _ _ _ _ _.__ _ __ _ __._ _ _...-_. ..
.-
improvement item, the inspectors noted that the SERT recommended that the :
~ licensee consider incorporating precautions or instructions to address these .
concerns.-
The SERT performed a root cause analysis of the event. Three categories of root causes consisting principally of the following were identified:
(1) Ineffective Change Management of Complex Systems
- Risks and potential consequences involved in cond-:: ting the ADHR
' test shortly after shutdown were not adequately addressed, in view of the additional time required to transition from normal snetdown ,
cooling to the ADHR configuratio * Operators believed that RWCU provided a representative sampling of average reactor coolant temperature based on past experience * The impact of changing the reacior vessel shutdown level instrument to a direct reading pressure instrument was not recognize (2) Inadequate Management Oversight
- Personnel did not adequately evaluate the ADHR modification and testing processes to determine the impact of performing the ADHR test early in the refueling outag * The FRC review of the proposed ADHR test did not identify the impact of the test on the plan (3) Inadequate Use of Available Knowledge Resources
'
- Previous industry operating experience was not effectively utilized to prevent problems.
l
- Use of " time to-boil" curves to predict and monitor reactor vessel
'
heatup was not recognized as an available information sour.: The SERT developed corrective actions that addressed the causes identified. Briefly.
l- they are summarized as follows:
- Training of operators, engineers, and outage m 'agemen * Evaluate remaining outage activities for similar impac * Revise the appropriate procedures wkh lessons learned from this event.
L l'
i l
. _ - . _ . . _ _ _ ___ _._ _ _._._ _ _ -._ . _ _ _ . _ . _ _,
-.: ;
'
-
C
- -
.. !
t L issue an industry operating experience' notice on this even ;
- _ Evaluate the postmodification teet development process control * Commission a Quality Action Team or Natural Work Team to address the
. process of outage risk assessment.- .,
i
'
The licensee issued License,a Event Report 50-458/97-006 on October 14,'1997, ;
. which addressed this event,, k
'
- The SERT found that the actual safety consequences were negligible. The. duration of steaming on September 13 was approximately 15 minutes, and airborne radiation -
levels in the area of the reactor were marginally above the levels requiring the area to be posted as an airborne radiation area. Surveys at the entrances to the~ primary containment indicated that there was no release to the environment; thus, potential safety consequences were minimal. With no operator actions, and no alternate shutdown cooling assumed, core uncovery would not have occurred for 7 hour8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> Within 20 minutes, the operators could have restored either division of normal shutdown cooling, or placed any of the five coolant injection / spray pumps into -
service to provide makeup water and core coolin Conclusions On September 13, the plant was inadvertently allowed to transition '~ rom Mode 4 to Mode 3 for approximately 30 minutes during a period when 11 TS LCOs apolicable to Mode 3 were not met. An apparent violation was identified for failure to comply with TS 3.0.4,
!-
The inspectors found that the operators' assumption that reactor coolant temperature would only increase at 10"F in a 30-minute period was invalid and should have been closer to 10*F in a 15- to 20-minute period.
- - -
'
Engineering f ailed to develop and implement a postmodification test procedure that-adcquately addressed the applicable precautions associated with performing the ADHR test during a time when decay heat rates ware high. An apparent violation was identified for f ailure to maintain an adequate procedure,
,
In view'of the high reactor decay heat _ rate, the FRC demonstrated poor performance
- by accepting a postmodification test procedure that did not contain adequate controls and precaution This event demonstrated inadequate training of the operators on the meaning of -
L reactor coolant system temperature, level, and pressure indications when alternete
'- methods of reactor coolant circulation are in plac !
,
_ _ _ , . _ . _ _ _ . _ _ _ _ . _ . _ _ . . . _ _ . . . _
.
.
7-01.3- Shutdown Risk Review L Insoection Scops The inspectors reviewed tne licensee's shutdown risk assessment processes including the shutdown EOOS monitoring program and its implementation, the ORAT activities, and the SOP Observations and Findinos The shutdown EOOS monitoring program ws ? used to previde a steady state risk asaessment for reactor coolant system boiling and core damage. Shutdown EOOS training was provided to the aperators during requalification training in 1997. This outage was the first time the shutdown EOOS was use The licensee's shutdown EOOS model assessed three levels of decay heat (high, medium, and low) and considered the vessel water level (reactor flange or greater than 23 feet). This provided different time to boiling estimates and core damage frequencies based on decay heat, water inventory, and system or component availability. 'lhe model considered the decay heat removal systems that were available but did not account for the time required to place a system in service, to rotate equipment, to test, or to place backup systems in operatio Different success paths to prevent boiling and core damage were assessed. For example, RWCU would not prevent core boiling in high or medium decay heat periods but provided a success path during a low decay period. Additional decay heat removal success paths, such as decay heat removal system operation by circulating reactor coolant through the refueling pool, were accounted for when the wnter leve; was above 23 fee The shutdown EOOS model was capable of evaluating transition periods by
'
reviewing each period separately; however, it considered the systems that were available but not, necessarily, those that were running. For example, during the 1-hour and 37-minute period on September 13,1997, (high decay heat and vessel level at the flange) the licensee had no decay heat removal system in operation; however, the systems were available and would have shown a shutdown safety function defense in depth color code of green (highest level of safety and defense in depth). A transitional risk assessment with no decay heat removal system in service and the systems unavailable because of the time required to align them for decay heat removal, would have shown the shutdown safety function defense in depth color code red (failure to meet an adequate level of safety and defense in depth).
Prior to Refueling Outage 7 the licensee performed an integrated review of the Levelli outage schedule using the shutdown EOOS monitoring program. An ORAT reviewed the outage risk profile and contingency actions to be put in place for "high
_ _ . ._ - _ _ _ _ _ . __ _ _ _ _ _ - _ _ __- __ _
..
-8 risk _ activities (orange)." The ORAT review included decay _ heat removal, inventory
-
__
-control, AC power control, and reactivity control.: The ORAT identified that the -
placement'of the ADHR system in service had the potential to. drain the reactor vessel under_ certain conditions. Therefore, a contingency plan was developed to address this concern. The ORAT also considered the higher decay heat loads which would exist during the refueling outage, and the limitations on the'use of ADHR methods (i.e., use of RWCU). However, the impact of the time needed to place a decay heat removal or alternate decay removal system in service was not specifically considere Procedure OSP-0037, " Shutdown Operations Protection Plan," Revision 5, provided steady function color states for available systems, different decay heat levels, and vessellevel. Thermohydraulic curves (" time to boil" based on vessellevel and days
,
following reactor shutdown) were provided in Attachment 10; however, these " time-to boil" curves were not tied directly to the shutdown cooling guidelines (Section 4.2) or the contingency plans (Section S.1). The SOPP shutdown cooling guidelines and contingency actions were demonstrated to be inadequate to ensure the transition of available and operating decay heat removal systems prior to the reactor entering Mode 3. The time required to transition the ADHR system from being available to being in operation was not integrated with the time to boi During the transition from normal shutdown cooling to the ADHR system (no decay removal systems were in operation), the reactor entered Mode 3. The inspectnrs determined that these sections of the SOPP procedure were inadequate to ensure that there wa= sufficient transition time between securing or inadvertently losing
,
normal shutdown cooling, and establishing suitable alternate shutdown cooling to
'
prevent lost of reactor coolant temperature control, or inadvertently, entering a mode change _when the applicable LCOs were not met. This is another example of an apparent violation of TS 5.4.1.a (50-458/97015-02).
'
l The inspectors reviewed the licensee's actions taken for Operating Event 94-25,
" Hope Creek RHR Shutdown Cooling Bypass Event," The licensee's representative had recommended, in part, that the event specifics and lessons learned be discussed with all operations personnel prior to Refueling Outage 6 (i.e., the significance of maintaining 75 inch reactor pressure vessel water level when no recirculation pumps were running and how this impacted where to specifically monitor bulk coolant temperature). The operating experience tracking log identified that the Hope Creek '
event was covered during Operator Requalification Training, which was completed
"
October 27,1995. The inspectors reviewed this lesson plan and noted that the event review had not included a discussion of wt.are to monitor bulk coolant
- temperatur ___._._ __~_- _ , _ _ _ _ -. . .
. . . .. ~_ , . - . . . .
-.u t
,--
9-
, Conclusions
!
The inspectors found that the shutdown EOOS monitoring program and the ORAT risk review provided a comprehensive assessment of steady state shutdown risk based on decay heat, decay heat removal system availabilityi and vessel water leve However, the licensee had not integrated into the shutdown risk model the impact of decay heat removal systems being " unavailable" because of the time required to
.
reaiign.or reestablish these systems. The SOPP did not integrate the availability of decay heat removal systems during transition periods with the therme, hydraulic curve The SOPP shutdown cooling guidelines and contingency actions failed to adequately address the " time-to boil" curves located in Attachment 10 in the procedure, and specify actions needed to ensure there was sufficient transition time between shutdown cooling method changes. An apparent violation was identified for failure to maintain an adequate procedur .
Followup rctions to Operating Event 94-25 were tot comprehensive. The inspectors determined that the licensee missed an opportunity to establish a means
- to monitor reactor coolant bulk temperature when no reactor recirculation pumps were in operatio .4 Loss of Shutdown Coolino Event of October 4.1997
' insoection Scone The inspectors reviewed the circumstances surrounding the October 4,1997, loss of shutdown cooling caused by an inadvertent isolation of the shutdown cooling
-
suction path. -Key personnel were interviewed, and control room logs, procedures, and the licensee's root cause analysis activities were reviewe Observations and Findinos On October 4,1997, the Division 11 electrical busses were being restored from outage activities. A " Bus Coordinator," who was a licensed operator, was designated to coordinate the restoration between the operators assigned to perform the breaker and switch lineups and the control room. The restoiation was to be performed in accordance with Procedure OSP-OO19, " Electrical Bus Outages,"
Revision 5. This procedure implemented a switch and breaker lineup database,-
which was printed in the format of standard lineup sheets. The lineup sheet (Attachment 24 to Procedure OSP-0019) for the restoration of Motor Control
' Center EHS-MCC2K was already marked with the required restoration positions by the previcus shift bus coordinator, and the associated precautions were attached as Enclosure 24 to Procedure OSP-001 ,
-- --..
. < -~. , . . - , , -r-- - - , - .
. . . - _.- - . - .. .- - - ..- . .
.
..-
- 10- ,
The bus coordinator atterrpted to discuss the upcoming bus restoration tasks with-
_ _
the Operations Shif t Superintendents however, the Operations Shift Superintendent was involved in many other tasks and could not be engaged in the discussion. The
' bus coordinator then held a briefing with the operators that were assigned to perform the lineups. The breakers addressed on the Enclosure 24 sheet were discussed, (i.e., for certain breakers, ensure that isolation signals were reset before closing the breakers). The operators were also cautioned to watch for danger tags
or administrative hold tag During the restoration of the electrical breakers in Motor Control Center EHS-MCC2K, an operator came to Breaker 4A, which controls Valve E12 MOVF009 (inboard suction for normal shutdown cooling). The operator found no tags on the breaker, or precautions on Enclosure 24, so he closed the breaker in accordance with the lineup sheet; however, a leak detection isolation signal was present because the leak detection panel was deenergized for the outag '
When power was restored to Valve E12-MOVFOO9, the valve automatically close RHR Pump A then tripped on the loss of suction source logic, and shutdown cooling was los Because the isolation signal t.6d not be reset in a timely manner, the operator was instructed to open Breaker 4A, and another operator was dispatched to manually open Valve E12-MOVF009. Shutdown cooling was restored within 17 minutes af ter the loss; as a result, reactor coolant temperatuie increased from 97*F to 100.4* Following resumption of shutdown cooling, the operator continued with bus restoration activities. Approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> later, the reactor coolant rejection to adwaste Valve E12-MOVF049 stroked closed because of the same leak detection isolation signal. Again, the control room directed the breaker to be opened, and the valve was manually opened within 6 minutes. Valve E12-MOVF049 was in the drain path for reactor vessel water level contro The inspectors revies.n i Enclosure 24 of Procedure OSP 0019, and found incomplete breaker designations, possibly indicating that the database printout was missing information that could be critical to safe restoration. Neither the bus coordinator nor the operators questioned the incomplete breaker designations. In addition, the enclosure did not recommend verifying the position of Breaker 4A to ensure that isolation signals were reset during restoration. Because the procedure listed specific breakers for which the isolation reset should be verified, the operators could have been led to believe that Breaker 4A was not applicable. As such, the
- inspectors concluded that Procedure OSP-0019-was inadequate. This is another example of an apparent violation of TS 5.4,1.a (50-458/97015-02).
The inspectors also reviewed System Operating Procedure SOP-0031, " Residual Heat Removal," Revision 21, and Technical Section Procedure TSP-0052,
" Shutdown Cooling Reliability During Cold Shutdown or Refueling Outage,"
.
-, .
.. .. . -- _
.
.
-11-Revision 2. These procedures did not fully specify administrative tagging of critical shutdown cooling components. For examp!e, the breakers for i Valves E12-MOVF008 and -09 were not designated for tagging af ter deenergizing to prevent valve movement during shutdown cooling, lhe inspectors considered that this would be a good opportunity to better protect the integrity of shutdown coolin The licensee performed a root cause determination which determined the following issues:
(1) Poor work practices
- The operators did not anticipate component response when positioning breakers. Operators depended on administrative controls (tags) or precautions on the lineup enclosure *
- The bus coordinators specified required positions strictly by using the applicable system operating procedures without evaluating effects of plant outage corjitions. There was also reliance on tagging of component >
(2) Inadequate procedures
- Inadequate administrative controls over the shutdown cooling prntected pst * The process of assigning component position during implementation of Procedure OSP-0019 did not have a review until af ter the bus was restore (3) Inadequate supervision
- A briefing was nut conducted with the control room cre * Af ter the loss of shutdown cooling, neither the bus coordinator nor control room supervision intervened to terminate bus restoration activities until the cause of the problem was identified and correcte As a result, the second valve (E12-MOVF049) closed when the breaker was close The licensee developed the following corrective actions:
- Training personnel provided remedial training to the appropriate operators on protected train concepts, RHR isolation Icgic, and the SOPP, on October * An administrative hold tag was attached to Breaker 4A on October l
_ __ -_ - _ - - - - __ _ _ - _ _ _ _ -
. . . - __ _ _ _ _ - . _ _ _ . _ - _ _ . _ _ -_ _ .
,
. .
-_
=
. .
12-
'
- . Procedures were revised to incorporate administrative controls over protected shutdown cooling component .
- Errors and omissions in Procedure OSP-OO19 enclosures were correcte '
- . Task descriptions for operations outage task coordinators were develope The licensee has indicated that a licensee event report would be submitted as required by 10 CFR 50.7 .
The safety consequences of the above loss of shutdown cooling were minimal. The plant had been shut down for 29 days, and the approximate time to boil was .
'
4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> at the time. Shutdown cooling was restored in 17 minutes with a resultant 3.4*F increase in reactor coolant temperature. The inadvertent closure of Valve E12-MOVF049 constituted a 6-minute loss of the reactor water reject flow ,
path, which was an operational inconvenience, c. Conclusions inadequate procedural controls for bus restoration contributed to the loss of shutdown cooling for 17 minutes. An apparent violation was identified for the f ailure to maintain adequate procedure The operators involved in bus restoration ar.d coordination demonstrated poor performance in that, as a team, they failed to be knowledgeable of the impact of breaker closures for the existing plant conditions. They further demonstrated a lack
^
of attention to detailin accepting a bus restoration lineup sheet with an incomplete printout of precautions to be take Poor judgement was exercised by control room supervision and the bus coordinator by not taking the time to ensure there was a control room brief pertaining to the i busses which were to be restored, thus denying control room personnel scrutiny over the actions to be taken that could effect plant conditions,
Control room supervision f ailed to intervene and terminate bus restoration activities upon loss of shutdown cooling until the cause was established to prevent a recurrence. Consequently, a second valve closed inadvertently when the motor operator was energize i Operations procedures associated with the establishment and maintenance of shutdown cooling did not'have complete positive instructions to administratively protect key shutdown cooling paths, but, rather, the licensee relied upon operators to be sufficiently knowledgeable of plant conditions and to take appropriate actions to protect the integrity of shutdown cooling.
.
i
-- - , , - - - ,
r-_-____--___ _ __ _ . _ .
.
.. . _ _ _
_
l.4.
' =
- 13-V. Management Meetinas X1 Exit Meeting Summary The inspectors presented the inspection results to member? of licensee management at the conclusion of the inspection on October 17,1997. The licensee acknowledged the findings presente The inspectors asked the licensee whether any materisis examined during the inspection should be considered proprietary. No proprietary information was identifie >
- - - - - - - - - - -,___ _ _ _ _ _ _ _ _ . _ _ , _ . . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
__
_____ .
.
l*
.
ATTACHMENl SUPPLEMWTAL INFORMATION PARTIAL LlSI OF PERSONS CONTACTED UREDIED J. P. Dimmette, General Manager, Plant Operations M. A. Dietrich, Director, Quality Programs D. T. Dormady, Manager, System Engineering D. N. Lorfing, Supervisor, Lir nsing J. R. McGaha, Vice President Operations M. G. McHugh, Licensing Engineer 111 W. P. O'Malley, Manager, Operations D. L. Pace, Director, Design Engineering A. D. Wells, Superintendent, Radiation Control (
b INSPECTION PROCEDURES USED IP 71707 Plant Operations ITEMS OPENED QEEmd 50 458/97015 01 APP VIO Failure to comply with TS 3.0.4 (Section 01.2)
50 4b9/97015 02 APP VIO Failure to maintain an adequate ADHR test procedure (Section 01.2), f ailure to maintain and adequate LOPP (Secton 01.3), and f ailure to maintain an adequate bus restoration procedure (Section 01.41
_- . - - _ _ _ _ _ _ . _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ , , _ _ _ _ _ _ _ _ _ _ _ _ , _ _
r
- 8 s
,
.
,
LIST OF ACRONYMS USED '
ADHR alternate decay heat removal EOOS equipment out of service
'F doctees, f ahrenheit FRC Facility Review Committee gpm_ gallons por minute
- LCO limiting condition for operation ORAT Outage keview Assessment Team
- PDR publh document room psig pounds per square inch gage
RWCU reactor water cleanup SERT Significant Event Response Team
.
SOPP Shutdown' Operations Protection Plan
. TS Technical Specification i
e
!'
i i
_
+e se+N ww ww-J- e wp.-g a rr'e m P t V-=ae m swiWW='u w t'ec-+d,punwa