IR 05000458/2006013

IR 05000458-06-013; 10/19/2006 - 02/28/2007; River Bend Station; Special Inspection; Operational Event Followup

ML070640396
Person / Time
Site:	River Bend
Issue date:	03/01/2007
From:	Chamberlain D Division of Reactor Safety IV
To:	Venable J Entergy Operations
References
IR-06-013
Download: ML070640396 (71)

Text

March 1, 2007

SUBJECT:

RIVER BEND STATION - NRC SPECIAL INSPECTION REPORT 05000458/2006013

Dear Mr. Venable:

On February 28, 2007, the U.S. Nuclear Regulatory Commission (NRC) completed a special inspection at your River Bend Station to review the circumstances surrounding the inadvertent main feedwater isolation that occurred on October 19, 2006. The onsite portion of this inspection was conducted from November 7-9, 2006. The enclosed inspection report documents the inspection results, which were discussed on February 28, 2007, with you and other members of your staff.

The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.

The report documents eight findings of very low safety significance (Green). Seven of these findings were determined to involve violations of NRC requirements. However, because of the very low safety significance and because they were entered into your corrective action program, the NRC is treating these findings as noncited violations, consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest any noncited violation in this report, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator, U.S. Nuclear Regulatory Commission, Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas 76011-4005; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the River Bend Station facility.

Entergy Operations, Inc.

-2-In accordance with 10 CFR 2.390 of the NRCs "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Website at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Dwight D. Chamberlain, Director Division of Reactor Safety Docket: 50-458 License: NPF-47

Enclosure:

NRC Inspection Report 05000458/2006013 w/Attachment 1, "Supplemental Information" Attachment 2, "Estimation of Risk Significance" Attachment 3, "Special Inspection Team Charter" Attachment 4, "Sequence of Events"

REGION IV==

Docket:

50-458 License:

NPF-47 Report:

05000458/2006013 Licensee:

Entergy Operations, Inc.

Facility:

River Bend Station Location:

5485 U.S. Highway 61 St. Francisville, Louisiana Dates:

October 19, 2006 through February 28, 2007 Team Leader:

David P. Loveless Senior Reactor Analyst Division of Reactor Safety Team Members:

J. Drake, Operations Engineer A. Fairbanks, Reactor Inspector Contributing Inspectors:

P. Alter, Senior Resident Inspector M. Miller, Resident Inspector Approved By:

Dwight D. Chamberlain, Director Division of Reactor Safety

i Enclosure

SUMMARY OF FINDINGS

IR 05000458/2006013; 10/19/2006 - 02/28/2007; River Bend Station; Special Inspection;

Operational Event Followup.

The report covered a special inspection conducted to review the circumstances surrounding an inadvertent loss of feedwater event that occurred at the station on October 19, 2006. Eight findings of very low safety significance (Green) were identified. Seven of these findings were determined to involve violations of NRC requirements. The significance of most NRC findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter 0609,

"Significance Determination Process." Findings for which the significance determination process does not apply may be Green or be assigned a severity level after NRC management review. The NRCs program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.

Cornerstone: Initiating Events

C

Green.

An NRC-identified noncited violation of 10 CFR Part 50, Appendix B,

Criterion XVI, "Corrective Actions," was identified for the failure of licensee personnel to identify and correct a condition adverse to quality in a timely manner.

Specifically, following the reactor scram on October 19, 2006, licensee personnel failed to properly evaluate discrepancies between the expected response of Feedwater Isolation Valves FWS-MOV7A and FWS-MOV7B, operator observation of valve indication, and indication of actual plant parameters affected by the valves, prior to restarting the reactor on October 22, 2006.

This violation was greater than minor because it was associated with the problem identification and resolution and the human performance attributes of the initiating events cornerstone and affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown, as well as power operations. A Phase 2 estimation was required, as determined by the Manual Chapter 0609, Appendix A, Phase 1 Worksheet, "SDP Phase 1 Screening Worksheet for Initiating Events, Mitigation Systems, and Barriers Cornerstones," because the associated performance deficiency represented an increase in the likelihood of both a reactor trip and the likelihood that the power conversion system would be unavailable. Using the appropriate plant-specific Phase 2 worksheets, this violation was determined to have very low safety significance because the violation only increased the initiating event likelihood by a very small amount and the power conversion system was actually recoverable. This finding has a cross-cutting aspect in the area of problem identification and resolution, in that, the licensee did not implement a corrective action program that ensured timely resolution of conditions adverse to quality.

The licensee entered this performance deficiency into their corrective action program for resolution (Section 2.1.1).

v

Green.

A self-revealing noncited violation of Technical Specification, Section 5.4,

"Procedures," was identified for the failure of licensee personnel to accomplish activities affecting quality in accordance with prescribed conduct-of-operations procedures. Specifically, on October 19, 2006, two senior reactor operators (one on-coming and one off-going), conducting turnover activities, and the at-the-controls reactor operator failed to identify that the push buttons for Main Feedwater Isolation Valves 7A and 7B were out of alignment upon panel inspection during panel walk downs conducted in accordance with Entergy Operations Procedure EN-OP-115, "Conduct of Operations," Revision 2.

This violation was greater than minor because it was associated with the human performance attribute of the initiating events cornerstone and affected the cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown, as well as power operations. A Phase 2 estimation was required, as determined by the Manual Chapter 0609, Appendix A, Phase 1 Worksheet, "SDP Phase 1 Screening Worksheet for Initiating Events, Mitigation Systems, and Barriers Cornerstones," because the associated performance deficiency represented an increase in the likelihood of both a reactor trip and the likelihood that the power conversion system would be unavailable. Using the appropriate plant-specific Phase 2 worksheets, this violation was initially determined to have very low safety significance because the violation only increased the initiating event likelihood by a very small amount and the power conversion system was actually recoverable. This violation has a cross-cutting aspect in the area of human performance, work practices component associated with the failure to effectively use human error prevention techniques, such as self and peer checking.

The licensee entered this performance deficiency into their corrective action program for resolution (Section 3.2.2).

Green.

An NRC-identified noncited violation of 10 CFR Part 50, Appendix B,

Criterion XVI, "Corrective Actions," was identified for the failure of licensee personnel to identify and correct a condition adverse to quality in a timely manner.

Specifically, on October 19, 2006, a licensed reactor operator noted a nonconforming condition with Strip Chart Recorder C33-R608 following the fall of the chart paper mechanism and discussed this with his supervision. However, this condition was not documented in the condition reporting process, the recorder was not properly inspected and repaired by qualified maintenance technicians prior to reactor restart, and at least one member of the on-site safety review committee may have been misinformed about the extent and composition of the evaluation and repair activities conducted on control room recorders prior to authorizing plant restart on October 22, 2006.

This finding was greater than minor because it was associated with the problem identification and resolution and the human performance attributes of the initiating events cornerstone and affected the associated cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during power operations because the chart recorder was left in a vi

condition that had resulted in a reactor scram. A Phase 2 estimation was required, as determined by the Manual Chapter 0609, Appendix A, Phase 1 Worksheet,

"SDP Phase 1 Screening Worksheet for Initiating Events, Mitigation Systems, and Barriers Cornerstones," because the associated performance deficiency represented an increase in the likelihood of both a reactor trip and the likelihood that the power conversion system would be unavailable. Using the appropriate plant-specific Phase 2 worksheets, this finding was determined to be of very low safety significance because it only impacted the plant for a 2-day period. This finding has a cross-cutting aspect in the area of problem identification and resolution, in that, the licensee did not implement a corrective action program with a low threshold for identifying issues.

The licensee entered this performance deficiency into their corrective action program for resolution (Section 3.3.2).

Green.

An NRC-identified noncited violation of 10 CFR Part 50, Appendix B,

Criterion XVI, "Corrective Actions," was identified for the failure of licensee personnel to correct a condition adverse to quality. Specifically, following the reactor scram on October 19, 2006, licensee personnel determined that the probable cause of the scram was a human performance error while handling the chart recorder. However, while significant corrective actions were taken, these actions did not completely address this probable cause prior to restarting the reactor on October 22, 2006, in that, expectations for working over control panels were not fully conveyed.

This violation was greater than minor because it was associated with the problem identification and resolution and the human performance attributes of the initiating events cornerstone and affected the associated cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions during power operations because expectations and/or guidance were not provided to licensed operators on how to correct paper take up problems on strip chart recorders while minimizing the risk of dropping components on controls. A Phase 2 estimation was required, as determined by the Manual Chapter 0609,

Appendix A, Phase 1 Worksheet, "SDP Phase 1 Screening Worksheet for Initiating Events, Mitigation Systems, and Barriers Cornerstones," because the associated performance deficiency represented an increase in the likelihood of both a reactor trip and the likelihood that the power conversion system would be unavailable. Using the appropriate plant-specific Phase 2 worksheets, this violation was determined to be of very low safety significance because it only impacted the plant for a limited period of time. This finding has a cross-cutting aspect in the area of problem identification and resolution, in that, the licensee did not implement a corrective action program that ensured timely resolution of conditions adverse to quality.

The licensee entered this performance deficiency into their corrective action program for resolution (Section 3.3.3).

vii

Cornerstone: Mitigating Systems

Green.

A self-revealing noncited violation of Technical Specification, Section 5.4,

"Procedures," was identified for the failure of licensee personnel to accomplish activities affecting quality in accordance with prescribed procedures. Specifically, the at-the-controls operator failed to perform an immediate action required by Abnormal Operating Procedure AOP-0001, "Reactor Scram," Revision 22, which required him to place the mode switch in the SHUTDOWN position. The failure to reposition the mode switch resulted in an inadvertent main steam isolation, complicating the scram recovery.

This violation was greater than minor because it was associated with the human performance attribute and affected the mitigating systems cornerstone objective to ensure the availability, reliability, or function of a system or train in a mitigating system. A Phase 2 estimation was required because this violation represented a loss of function of the steam side of the power conversion system as determined by the Manual Chapter 0609, Appendix A, Phase 1 Worksheet, "SDP Phase 1 Screening Worksheet for Initiating Events, Mitigation Systems, and Barriers Cornerstones." Using the appropriate plant-specific Phase 2 worksheets, this violation was determined to have very low safety significance because the errors only impacted the plant for a short period of time and the power conversion system was actually recoverable. This violation has a cross-cutting aspect in the area of human performance, work practices component associated with the failure to effectively use human error prevention techniques.

The licensee entered this performance deficiency into their corrective action program for resolution (Section 3.1.1).

Green.

An NRC-identified noncited violation of Technical Specification, Section 5.4, "Procedures," was identified for the failure of licensee personnel to accomplish activities affecting quality in accordance with prescribed procedures.

Specifically, the control room supervisor failed to follow Emergency Operating Procedure EOP-0001, "Reactor Pressure Vessel Control," Revision 20, which required him to verify that the mode switch was in the SHUTDOWN position. The failure to reposition the mode switch resulted in an inadvertent main steam isolation, complicating the scram recovery.

This violation was greater than minor because it was associated with the human performance attribute and affected the mitigating systems cornerstone objective to ensure the availability, reliability, or function of a system or train in a mitigating system. A Phase 2 estimation was required because this violation represented a loss of function of the steam side of the power conversion system, as determined by the Manual Chapter 0609, Appendix A, Phase 1 Worksheet, "SDP Phase 1 Screening Worksheet for Initiating Events, Mitigation Systems, and Barriers Cornerstones." Using the appropriate plant-specific Phase 2 worksheets, this violation was determined to have very low safety significance because the errors only impacted the plant for a short period of time and the power conversion system was actually recoverable. This violation has a cross-cutting aspect in the area of viii human performance, work practices component associated with the failure to provide adequate management oversight in this situation.

The licensee entered this performance deficiency into their corrective action program for resolution (Section 3.1.1).

Green.

An NRC-identified noncited violation of Technical Specification, Section 5.4, "Procedures," was identified for the failure of licensee personnel to accomplish activities affecting quality in accordance with prescribed procedures.

Specifically, licensed operators operated the safety/relief valves manually contrary to Abnormal Operating Procedure AOP-0001, OSP-0053, Attachment 1B, "Post Scram Pressure Control Strategies," Revision 5, requirements to operate them in automatic with the main steam isolation valves closed. Additionally, operators failed to manually operate the safety/relief valves, as required, to control pressure in the prescribed pressure band, without driving level outside the prescribed level band.

This violation was more than minor because it was associated with the human performance attribute and affected the mitigating systems cornerstone objective to ensure the availability, reliability, or function of a system or train in a mitigating system because manual actions affect licensed operator capability to perform simultaneous actions. Using the Manual Chapter 0609, Appendix A, Phase 1 Worksheet, "SDP Phase 1 Screening Worksheet for Initiating Events, Mitigation Systems, and Barriers Cornerstones," the finding was of very low safety significance because it did not represent a loss of safety function nor did it screen as potentially significant to external initiators. This violation has a cross-cutting aspect in the area of human performance, work practices component associated with the effectiveness of communicating expectations regarding procedural compliance.

The licensee entered this performance deficiency into their corrective action program for resolution (Section 3.1.3).

Green.

The team identified a finding for the failure of licensed operators to accomplish activities affecting quality in accordance with the standards established in the conduct-of-operations procedures. Specifically, on October 19, 2006, the on-coming control room supervisor relieved the watch during the loss of feedwater transient, instead of waiting for the plant to be in a stable condition, a self-imposed standard documented in Entergy Operations Procedure EN-OP-115, "Conduct of Operations," Revision 2. Although licensee personnel stated that turnover activities were essentially complete at the time, changing the watch at this time caused the at-the-controls reactor operator and other control room personnel to misunderstand who was in charge of the event response and contributed to the at-the-controls operator not placing the mode switch in the SHUTDOWN position, as required by Procedure AOP-0001, "Reactor Scram," Revision 22. The failure to reposition the mode switch resulted in an inadvertent main steam isolation.

ix

This finding was greater than minor because it was associated with the human performance attribute and affected the mitigating systems cornerstone objective to ensure the availability, reliability, or function of a system or train in a mitigating system, namely the main feedwater system. A Phase 2 estimation was required because this finding resulted in a loss of function of the steam side of the power conversion system as determined by the Manual Chapter 0609, Appendix A,

Phase 1 Worksheet, "SDP Phase 1 Screening Worksheet for Initiating Events,

Mitigation Systems, and Barriers Cornerstones." Using the appropriate plant-specific Phase 2 worksheets, this finding was determined to have very low safety significance because the finding only increased the initiating event likelihood by a very small amount and the power conversion system was actually recoverable.

This finding has a cross-cutting aspect in the area of human performance, work practices component associated with the failure to implement the roles and responsibilities of the senior reactor operators in the main control room as designed.

The licensee entered this performance deficiency into their corrective action program for resolution (Section 3.2.3).

Licensee-Identified Violations

None.

REPORT DETAILS

1.0 Introduction 1.1 Event Description On October 19, 2006, at about 5:55 pm CST, River Bend Station was operating at 100 percent power with the reactor core isolation cooling system out of service for maintenance. As part of routine shift turnover duties, the at-the-controls operator was time and date stamping chart recorders on the main control panel. During this activity, he attempted to correct a paper jam in Chart Recorder C33-R608. The reactor operator pulled the recorder to the forward position and pulled on the paper wound around the drive wheel. As he pulled, the paper drive mechanism fell out of the recorder and onto the main control panel. The mechanism bounced several times striking the open pushbutton for the long-cycle recirculation valve, Valve FWS-103, and the close pushbuttons for Main Feedwater Isolation Valves FWS-MOV7A and FWS-MOV7B.

The at-the-controls operator picked up the mechanism and scanned the panel for any abnormal indications. Two senior reactor operators observed the operator scanning and verifying panel indications immediately following the drop.

During this time, Valve FWS-103 was opening and completed the stroke in approximately 20 seconds. However, the red indicating light for the valve was broken.

Therefore, there was no immediately visible indication of the valve changing position.

The opening of this valve did not have any adverse impact to the plant because a redundant valve in the recirculation line remained closed.

Isolation Valves 7A and 7B are 24-inch motor-driven gate valves and took about 3-1/2 minutes to close during the event. Given the long closing time, initially there were no alarms, visible position indication, or plant response to the valves beginning to close.

At 5:56 pm, as the valves closed, feedwater flow was reduced to the reactor and the reactor low level alarm annunciated indicating that reactor vessel water level had reached Level 4. At this time, a recirculation system flow-control valve runback was automatically initiated because low reactor vessel level and low feedwater suction line flow existed concurrently. The runback resulted in neutron flux dropping to approximately 35% power.

The at-the-controls operator, realizing that feedwater flow had decreased, observing the reduction in reactor power, and verifying that reactor vessel water level was falling, announced to the other control room operators that he was initiating a manual reactor scram. However, prior to taking action, a low reactor vessel water level (Level 3)automatic reactor scram was initiated at about 5:57 pm.

The on-coming control room supervisor stated that he was in charge and immediately entered Emergency Operating Procedure EOP-0001, "Reactor Pressure Vessel Control," Revision 20. The off-going control room supervisor moved to the main control panels and began questioning the at-the-controls operator regarding the status of the main feedwater system. The at-the-controls operator and the off-going control room supervisor began troubleshooting the problem with the main feedwater system. Upon identification that the feedwater isolation valves were closing, they discussed immediately reopening the valves. They decided that the appropriate action was to wait until the valves went fully closed and then reopen them to prevent potentially tripping the valve motor breakers upon reversing current in the motor windings.

As a result of this interaction and other distractions related to the loss of feedwater, the at-the-controls operator failed to complete the post-scram immediate actions, including placing the reactor mode switch in the SHUTDOWN position, and failed to provide a scram report to the control room supervisor. Additionally, the control room supervisor failed to request a scram report and failed to verify that the mode switch was in the SHUTDOWN position as required by the emergency operating procedures.

Following the control rod insertion, the shrink in boiling margin resulted in reactor vessel water level in the annulus decreasing further to Level 2 approximately 20 seconds later.

This resulted in the high pressure core spray system actuating and injecting to the vessel for approximately 2-3/4 minutes until operators closed the system injection valve in accordance with system operating procedures. Additionally, the Division III emergency diesel generator, associated with the high pressure core spray system, started as designed. The Level 2 signal also resulted in tripping the reactor recirculation pumps and isolating the reactor water cleanup system. The reactor core isolation cooling system was unavailable throughout the event.

At about 5:58 pm, control room operators reset the Level 2 isolation signal and restored instrument air to containment to prevent an inadvertent closure of the main steam isolation valves. However, as the high pressure core spray system sprayed the steam space above the core, reactor vessel pressure continued to drop. Approximately 4 minutes after the scram, the main steam isolation valves closed on low steam header pressure at approximately 849 psig. This main steam isolation would normally have been bypassed following a scram by operators placing the mode switch in the SHUTDOWN position. However, as stated, the mode switch was incorrectly left in the RUN position. At about 6:04 pm, operators placed the mode switch in the SHUTDOWN position and began preparations to reopen the main steam isolation valves.

With the main steam isolation valves shut, operators controlled reactor vessel pressure with the safety/relief valves in manual. This condition, combined with the heating and expansion of the cold water injected by the high pressure core spray system, resulted in a high reactor vessel water level (Level 8), and the associated system isolations at about 6:04 pm. In anticipation of the Level 8 signal, operators had secured two of the main feedwater pumps and were in the process of securing Main Feedwater Pump C when the pump tripped as designed upon a reactor vessel water Level 8 signal. With main steam isolated and the safety/relief valves controlling pressure, the suppression pool level and temperature increased to the entry conditions for both Emergency Operating Procedures EOP-0002, "Primary Containment Control," Revision 13, and EOP-0003, "Secondary Containment and Radioactive Release Control," Revision 13, the containment pressure and suppression pool level emergency operating procedures.

The inability to control level precisely while utilizing the safety/relief valves caused additional Level 8 isolations throughout the event. Additionally, at 6:26 pm, after starting a main feedwater pump, reactor vessel water level decreased below Level 3 initiating another reactor scram (rods were already fully inserted). At 6:48 pm, water level once again decreased below Level 3 as operators attempted to place the startup feedwater regulating valves in service.

Operators reopened the main steam isolation valves at 6:54 pm to establish normal reactor level and pressure control. At this time, operators commenced a plant cooldown within the normal reactor coolant system pressure and temperature limits. Emergency operating procedures were exited at 7:23 pm when the operations shift manager and the control room supervisor determined that conditions for exiting the emergency operating procedures were met.

With the exception of the main feedwater isolation valves, plant equipment functioned as expected following the scram. Feedwater Pump B experienced a seal failure during the transient and Safety/Relief Valve SRV-51D developed seat leakage from being cycled multiple times. However, these items did not affect recovery during the transient.

1.2 System Descriptions The team reviewed the final safety analysis report, piping and instrumentation diagrams, operator training materials, and other documentation to assist in understanding specific functions of plant systems involved in the initiation and response to the reactor scram on October 19, 2006. Additionally, the team conducted interviews with licensee engineers, operators, and those individuals involved in the licensees investigation. A description of the system functions reviewed by the team are provided below.

1.2.1 Feedwater Isolation The feedwater system piping of interest at River Bend Station consists of two 20-inch outside diameter lines that penetrate the containment and drywell then branch into four 12-inch lines that connect to the reactor vessel. Each line includes three containment isolation valves consisting of one check valve inside the drywell, one motor-operated gate valve, and one spring-loaded piston-actuated check valve outside the containment.

The design pressure and temperature of the feedwater piping between the reactor and maintenance valve is 1,300 psig and 575°F. The feedwater piping from the reactor through the outboard isolation valve and connected piping of 2-1/2 inch or larger nominal pipe size, up to and including the second isolation valve in the connected piping, are designed to Seismic Category I requirements.

The reactor vessel is protected from blow down, following a postulated rupture of the feedwater piping outside the containment, by the two check valves inside the containment and by the two testable check valves outside the containment. The two motor-operated valves, Feedwater Isolation Valves 7A and 7B, are controlled by switches on the main control panel and are designed to close for containment and reactor isolation after the check valves have greatly reduced differential pressures.

1.2.2 Main Steam Isolation The main steam piping is designed to transport steam from the reactor vessel through the primary containment to the steam turbine. There are four main steam lines between the reactor and the turbine. The use of multiple lines permits system valve tests during unit operation with a minimum amount of load oscillation. Each main steam line at River Bend Station is equipped with two redundant main steam isolation valves. The primary function of these eight valves is to limit the release of radioactive materials to the environment and/or to limit reactor vessel water inventory loss.

The main steam isolation valves are closed by the nuclear steam supply shutoff system logic upon receipt of any of a number of conditions indicating potential failure of a main steam line. One such condition is a low main steam line pressure coincident with the mode switch being in the RUN position. The coincident circuit is designed to prevent an inadvertent main steam isolation during a normal plant shutdown or during transient conditions following a scram provided the main steam system was intact at the time of the scram. These unwanted isolations can be prevented by placing the mode switch in any position other than RUN.

1.2.3 Reactor Core Isolation Cooling The reactor core isolation cooling system is a safety system which consists of a turbine-driven pump, piping, valves, accessories, and instrumentation designed to assure that sufficient reactor water inventory is maintained in the reactor vessel to permit adequate core cooling to take place. This is accomplished by injecting approximately 600 gpm to the reactor vessel over a wide range of reactor coolant system pressures. System functions prevent reactor fuel from overheating during the following conditions:

1. Should the reactor coolant system be isolated from the main steam system and

maintained in the hot standby condition,

2. Should the reactor coolant system be isolated and accompanied by loss-of-coolant

flow from the reactor feedwater system, and

3. Should a complete plant shutdown under conditions of loss-of-normal feedwater

system be started before the reactor is depressurized to a level where the residual heat removal system can be placed into shutdown cooling mode.

Should the reactor coolant system be isolated from the main steam system while the reactor is in the hot standby condition with the reactor core isolation cooling system out of service, the high pressure core spray system is the only remaining system with a discharge pressure high enough to inject to the vessel.

1.2.4 High Pressure Core Spray The high pressure core spray system at River Bend Station pumps water through a peripheral ring spray sparger mounted inside the vessel shroud and above the reactor core. This emergency core cooling system is designed to inject water at full system pressure to provide the following primary functions:

1. Maintaining reactor vessel water inventory after small loss-of-coolant accidents or

leaks that do not depressurize the reactor;

2. Provide spray cooling and pressure control following larger loss-of-coolant

accidents, and;

3. Perform the function of the reactor core isolation cooling system should the system

be unavailable.

The high pressure core spray system consists of a single loop with one motor-driven pump, a suction shutoff valve, a discharge check valve, a motor-operated injection valve, a spray header inside the vessel shroud above the core, and associated piping and valves to take a suction from either the condensate storage tank or the suppression pool. The pump is capable of pumping over 2,000 gpm at typical no-load reactor pressures. The system is also provided with an independent electrical division, Division III, complete with switchgear for system components, vital dc with battery backup, and an emergency diesel generator.

1.3 Preliminary Risk Significance of Event Management Directive 8.3, "Incident Investigation Program," specifies the formal process used for incident evaluation. This directive documents a risk-informed approach to determining when the NRC will commit additional resources for further investigation of an event. The risk metric used for this decision was the conditional core damage probability.

A loss of the power conversion system via isolation of the main feedwater and main steam systems has added risk significance at any nuclear facility. Upon loss of main feedwater, the high pressure injection systems become more important. Because the reactor core isolation cooling system was out of service for maintenance, the high pressure core spray system was the only high-pressure system remaining for immediate injection. To evaluate this event, the team used the Standardized Plant Analysis Risk (SPAR) Model for River Bend Station, Revision 3.31. The senior reactor analyst adjusted the baseline model as follows:

• A class change was made to set all *-TM-* events to FALSE (zero test and maintenance)

• IE-TRANS was set to a probability of 1.0 and all other initiators were set to FALSE

• To establish conditions for a recoverable loss of feedwater and the failure of Feedwater Pump B, the analyst modified the following basic events:

<

MFW-AOV-CF-FCVS was set to 1.0 as a surrogate for the main feedwater isolation valves closing

<

MFW-MDP-FR-PUMPB was set to 1.0 to show that the pump failed

<

MFW-MDP-CF-RUN was set to 5.193E-3 to indicate the change in the common cause failure probability of the feedwater pumps

<

PCS-XHE-XL-TRANS was set to 1E-2 to indicate a reduced capability of the operators to use feedwater for late injection following a main steam isolation

<

MSS-TBV-CC-BYPAS was set to 1E-2 to indicate a reduced capability of the operators to recover PCS steam following a main steam isolation

• Basic Event RCI-TDP-TM-TRAIN was set to a probability of 1.0 because the train was out of service at the time of the event

• The analyst created a new basic event to model that safety-relief valves were opened during the transient by setting the probability of a stuck-open relief valve to 3 x 10-2 The conditional core damage probability was estimated to be 3 x 10-6 indicating that the event significance was in the range that a special inspection may be warranted. The dominant contributor to this risk was the loss of feedwater combined with the reactor core isolation cooling system being out of service. The dominant cutsets, as anticipated, indicated failures of the high pressure core spray system combined with failures of licensed operators to depressurize the reactor coolant system, such that low pressure systems could inject.

The licensee performed an independent analysis using their probabilistic risk assessment model. Their model provided that the conditional core damage probability for this event was approximately 3 x 10-5 supporting the conclusion that a special inspection was warranted. The dominant sequence was the same as determined by the SPAR. However, the licensees probability for failure to depressurize was higher than the generic probability used in the SPAR model.

The risk associated with this event was predominately caused by the loss of feedwater occurring at the time that the reactor core isolation cooling system was out of service.

As such, the effect on overall risk of licensee personnel actions appeared to be extremely low (9 x 10-8). Therefore, as anticipated, the specific performance deficiencies identified during this reactive inspection were of very low risk significance.

2.0 System Performance and Design Issues One noncited violation and several other equipment-related issues were identified and reviewed by the team associated with system performance and potential design issues.

These issues were revealed during and following the event. However, the team noted that, in general, plant equipment functioned as designed in response to the transient.

Each of the issues reviewed are discussed in sections below.

2.1 Response of the Main Feedwater Isolation Valves The team reviewed design drawings, plant traces, and previous test results associated with the performance of Main Feedwater Isolation Valves FWS-MOV7A and FWS-MOV7B. In addition, the team conducted interviews with licensee engineers, operators, and those individuals involved in the licensees investigation. Finally, the team reviewed alarm printouts in detail to develop a comprehensive understanding of the event progression.

2.1.1 Discrepancies between Observations and Indications Discussion: Following the drop of the chart paper mechanism, Main Feedwater Isolation Valves 7A and 7B began to close at approximately 22 seconds after 5:54 pm. The at-the-controls operator and two senior reactor operators, who observed the panel shortly after the mechanism dropped, all stated that only the red open indicating light was illuminated rather than both the red and green lights, which would have alerted them that the valves were closing. One minute and 26 seconds later, main feedwater flow began to decrease to the reactor vessel. Twenty-five seconds after that, feedwater flow began increasing as the feedwater control system attempted to return the decreasing reactor vessel water level to normal. At 21 seconds past 5:56 pm, an automatic scram was initiated on low reactor vessel water Level 3. The plant process computer indicated that the contacts for the open indicator of Valve FWS-MOV7B had opened at 1 second past 6:00 pm, (the valve indicated fully closed) and that the contacts for the open indicator of Valve FWS-MOV7A had opened at 15 seconds past 6:00 pm.

In accordance with the design and past test results, the green light indication should have illuminated via limit-switch contacts the moment the valves came off the full-open position and the red light indication should have remained illuminated via limit-switch contacts until the valves reached their fully-closed positions. Additionally, both valves had a normal-closing stroke time of approximately 118 seconds, as evidenced by inservice test results, and are equipped with 95 percent close torque-switch bypass limit switches. Therefore, had the valves operated as tested, they would have been 5 percent open approximately 112 seconds after the stroke began. However, the team noted that, at this time, plant computer data indicated that the valves were still passing approximately 5.5 Million lbm/hr feedwater flow.

The licensees root-cause evaluation, Attachment C, "ECR-128, Engineering Review of 10/19/06 SCRAM Timeline," states that "even if the inadvertent closing of FWS-MOV7A and FWS-MOV7B created a higher than expected design basis DP [differential pressure], each MOV [motor-operated valve] would limit the amount of closing thrust to the previous as left close torque switch setting of approximately 75,000 pounds."

However, this statement would not be true if the valves had stalled during the stroke.

Despite the evidence of abnormal operation of the valve indications and the increased stroke time, the licensee did not conduct any post-event testing on the valves to verify proper operation before returning to power operations. Licensee engineers stated that the plant response indicated that the valves had functioned properly, however, the team identified multiple indications and plant parameters that conflicted with this conclusion.

The licensees root-cause report stated that the valves had been set, controlled, and tested under the River Bend Station motor-operated valve program developed in accordance with Generic Letter 96-05, "Periodic Verification of Design-Basis Capability of Safety-Related Motor-Operated Valves." Specifically, the report stated:

"The close torque-limit switch for each of these valves limits the amount of closing load the actuator and valve will see during any operation (both design basis and normal operation). A review of the as left signature test for each MOV (3/26/03 for FWS-MOV7A, 3/12/00 for FWS-MOV7B) indicated that each MOV had a 95%

close torque-limit switch bypass and the close torque-limit switches were set to stop the valve when approximately 75,000 pounds of closing thrust is obtained. If a higher than expected DP occurred when the valve reached the close seat (which is after 95% closed) the torque-limit switch bypass would not be available and the close torque-limit switch settings would limit the maximum closing force of 75,000 pounds at torque-limit switch trip. Therefore, even if the inadvertent closing of FWS-MOV7A and FWS-MOV7B created a higher than expected design basis DP, each MOV would limit the amount of closing thrust to the previous as left close torque-limit switch setting of approximately 75,000 pounds.

"The design pressure rating for the valve is 2000 psig or greater. A differential pressure of 387.5 psig is assumed for setting the valve torque-limit switch. The maximum pressure seen during the scram was 1746 psig and the maximum differential pressure was conservatively estimated to be 836 psid. The design basis dp for the MOV assembly was exceeded but not the pressure rating for the valve. The valve pressure rating is the Iimit to protect the valve internals and not the above differential pressure value."

The licensee concluded that there was no impact from exceeding the motor-operated valve assembly design basis differential pressure.

The licensees root-cause evaluation, Attachment D, "FWS-MOV7A & FWS-MOV7B technical description of operation and indication during the event," states, "FWS-MOV7A and FWS-MOV7B both have a normal [in-service testing,] IST close stroke times of approximately 118 seconds. It is most likely that the stroke times were adversely affected by a combination of high DP load, a backlash of MOV gears and/or the spring pack relaxing due to hydraulic locking and the maintain close signal from the control switch in the control room."

The licensee discussed the following three items that could have affected stroke time:

1)

The high differential pressure load seen during the scram would have caused these motor-operated valves to stop when the torque-limit switch opened prior to the cessation of flow. The torque-limit switches for both valves had been set to actuate under a maximum differential pressure of 135 psid and the pressure seen during the scram was approximately 800 psid.

2)

Although both motor operators have locking gear sets, even locking gear sets have a small amount of gear backlash that could allow the close torque-limit switch contacts to close back if motor inertia was less than this backlash. Backlash is defined as the free play between the gears. It is normal to have some amount of backlash. Furthermore, the close torque-limit switch would also close back if the spring pack relaxed upon relief of the hydraulic locking effect.

3)

The control switches for Valves FWS-MOV7A and FWS-MOV7B were maintain switches so a close signal would still have been present when the close torque-limit switches opened and would cause the valves to continue to close when the torque-limit switch contacts reclosed until the 95 percent closed position was reached. River Bend Station used maintain control switches when signature testing all motor-operated valves. During this testing it has not been uncommon to see torque-limit switch contacts relax back enough to reclose the contacts and cause the valve to travel further closed. This was true even for motor operators with locking gear sets and very little inertia.

The licensee concluded that it was probable that the close torque switches for both valves opened and then re-closed several times from a combination of high differential pressure load, backlash of motor-operated valve gears and/or the spring pack relaxing due to hydraulic locking and the maintain close signal from the control switch in the control room.

Isolation Valves 7A and 7B can not be cycled during power operations because they would cause an isolation of feedwater as observed during the event. The only safety-related function these valves perform was containment isolation to reduce containment leak rate after the main feedwater system check valves have isolated system flow and reduced the potential differential pressure across the valves. The high differential pressure was removed during the event following the reactor scram when level setpoint set down adjusted one of the inputs to reactor vessel level control and the main feedwater regulating valves went closed. Both valves then traveled to the full closed position, and both valves were opened by control room operators as part of the plant restoration without any apparent problems. Therefore, licensee personnel determined that testing of the valves could be deferred until the next plant outage.

The team noted that the failure of the valves to fully stroke initially could have subjected the drive trains to excessive torque. The team determined that the licensees initial evaluation of valve performance had been insufficient to ensure that proper corrective action had been taken. The licensee documented the discrepancies between operator observation, expected response of the isolation valves, and the actual plant response in Condition Report CR-RBS-2006-4078. Corrective Action CA-27 was initiated to resolve the discrepancy between operator observations of Isolation Valves 7A and 7B position indication (timing of GREEN light illuminating) and the valve position indication design.

This action specifically called for appropriate testing and/or troubleshooting with an expected completion date of November 27, 2007.

The team concluded that the failure to implement corrective actions to ensure that Feedwater Isolation Valves FWS-MOV7A and FWS-MOV7B were functioning properly was a violation.

Significance Determination: The team determined that this finding was of very low safety significance, as documented in Attachment 2 to this inspection report.

Enforcement:

An NRC-identified noncited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Actions," was identified for the failure of licensee personnel to identify and correct a condition adverse to quality in a timely manner.

Contrary to the above, following the reactor scram on October 19, 2006, licensee personnel failed to properly evaluate discrepancies between the expected response of the feedwater isolation valves, operator observation of valve indication, and indication of actual plant parameters prior to restarting the reactor on October 22, 2006.

Because the finding was of very low safety significance and the licensee entered these discrepancies into their corrective action program as Condition Report CR-RBS-2006-4078, this violation is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000458/2006013-001, "Failure to identify and correct discrepancies between the design function and observed response of the feedwater isolation valves prior to reactor restart."

This finding has a cross-cutting aspect in the area of problem identification and resolution, in that, the licensee did not implement a corrective action program that ensured timely resolution of conditions adverse to quality.

2.2 Response of the High Pressure Core Spray System The team reviewed system drawings, logic diagrams, and system operating procedures associated with the River Bend Station high pressure core spray system. In addition, the team conducted interviews with licensee operators, engineers, and personnel involved in the licensees investigation. Finally, the team reviewed alarm printouts, in detail, to develop a comprehensive understanding of the performance of the system and operator control of the system throughout event progression.

2.2.1 Isolation of the System Injection Valve Discussion: On October 19, 2006, approximately 10 seconds after the automatic reactor scram, reactor vessel level decreased to below the Low Low Level 2 setpoint

(-43") resulting in the related automatic initiation signal for the high pressure core spray system. The high pressure core spray pump, and its associated Division III emergency diesel generator, started as designed. Approximately 2 seconds later, the system began injecting into the spray header above the reactor core, restoring lost vessel water inventory and decreasing reactor vessel pressure. Licensed operators took manual control, terminating system injection by closing Injection Isolation Valve E22-F004, at approximately 5:59:14 pm. At that time, narrow range level instrumentation indicated approximately 5 inches. Operators terminated injection prior to reaching normal reactor vessel level operating range in anticipation of the ensuing rise in water level from heating and expansion of the cool water.

Although operators had terminated injection, the high pressure core spray system pump remained operating, recirculating water to the condensate storage tank. At about 6:28 pm, operators swapped the system suction from the condensate storage tank to the suppression pool in accordance with System Operating Procedure SOP-0030, "High Pressure Core Spray," Revision 23. At approximately 7:16 pm, operators secured the high pressure core spray system pump and returned the system to standby conditions in accordance with Procedure SOP-0030. However, the Division III emergency diesel generator was allowed to run unloaded until 8:30 pm, at which time it was secured and placed in standby condition in accordance with System Operating Procedure SOP-0052, "HPCS Diesel Generator," Revision 29.

The team noted that the system operated as designed and that operators terminated the injection flow as described in approved procedures and in accordance with the Final Safety Analysis Report description. No findings of significance were identified.

2.3 Response of the Main Feedwater Pumps The team reviewed operator logs, condition reports, and other documents related to the reactor scram. The team reviewed design drawings associated with the River Bend Station feedwater pump mechanical seals. Team members also conducted interviews with licensed operators, licensee engineers, and personnel involved in the licensees investigation. Finally, the team reviewed alarm printouts in detail to develop a comprehensive understanding of the event progression. The purpose of this inspection was to determine the status and availability of the Main Feedwater Pump B following a seal failure that occurred on October 19, 2006, after the reactor scram.

2.3.1 Main Feedwater Pump B Seal Failure Discussion: At 6:02 pm, on October 19, 2006, following the reactor scram, Main Feedwater Pumps 1A and 1B tripped on a reactor vessel water Level 8 actuation signal.

Following restoration of the main steam system from the inadvertent main steam isolation, Feedwater Pump 1A was restarted. Pump A tripped again upon a second reactor vessel water Level 8 actuation signal caused by operators manually controlling the safety/relief valves. Once pressure control had been established through the bypass valves, operators restarted Feedwater Pump 1B at 6:26 pm. At 6:48 pm reactor plant operators reported that the Feedwater Pump 1B inboard seal was leaking excessively, causing licensed operators to secure the pump at 6:53 pm.

An evaluation performed by licensee engineers following the event determined that the pump would have been available for operation if needed and would have been able to fulfill its mission function. Additionally, licensed operators interviewed stated that they would not have hesitated to use Feedwater Pump 1B had it been needed to pump forward to the reactor vessel. No findings of significance were identified.

2.4 Response of the Safety/Relief Valves The team reviewed operator logs, condition reports, and other documents related to the reactor scram. Team members also conducted interviews with licensed operators, licensee engineers, and personnel involved in the licensees investigation. The purpose of this inspection was to evaluate safety/relief valve performance and to determine the status, availability, and any potential consequences from the reported seat leakage from Safety/Relief Valve SRV-51D following the transient.

2.4.1 Leaking Safety/Relief Valve SRV-51D Discussion: Following the plant recovery from the inadvertent loss-of-feedwater event, on October 19, 2006, Safety/Relief Valve SRV-51D indicated intermittent seat leakage.

On October 28, 2006, operators noted elevated temperatures for the Valve SRV-51D tailpipe. A review of the recorded data revealed that the Valve SRV-51D tailpipe temperature had increased for the first time on October 26, 2006, for about 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

This increase in temperature had been repeated on October 28, 2006.

Again temperatures increased on October 29 for a short period of time. However, on October 31, Valve SRV-51D tailpipe temperature rose to approximately 215 degrees F and has remained elevated except during reduced power operations. The leakage initially started as operators increased power to approximately 75 percent following the reactor scram. At this time, indicated tailpipe temperature rose quickly from approximately 177 to 215 degrees F. Subsequently, whenever the unit reduced power below 75 percent, the tailpipe temperature dropped back to approximately 177 degrees F, then returned to approximately 215 degrees F when power was raised above 75 percent.

The licensee has stated that operators monitoring suppression pool temperature in the vicinity of the tailpipe sparger have not observed a detectable rise in water temperature.

Evaluation by licensee engineers determined that the valve would be available for operation if needed and would be able to fulfill its mission function. No findings of significance were identified.

3.0 Human Performance and Procedural Aspects of the Event A number of issues were identified and characterized by the team associated with licensed operator performance and procedures. These issues were revealed during and following the event. Each of these issues is discussed in sections below.

3.1 Utilization of Emergency Operating and Related Procedures The team assessed emergency and off-normal procedure implementation and control room operator response during the event. The inspection was accomplished through a review of documents, plant computer data, and interviews with operators and engineering staff.

3.1.1 Mode Switch Position Discussion: On October 19, 2006, following the reactor scram, the at-the-controls operator did not place the reactor mode switch in the SHUTDOWN position in accordance with the immediate actions of Abnormal Operating Procedure AOP-0001, "Reactor Scram," Revision 22. Additionally, the control room supervisor failed to verify that this action had been completed, as required by Procedure EOP-0001. As a result, an inadvertent main steam isolation occurred when main steam line pressure lowered below the automatic isolation setpoint.

Once the reactor scram occurred, the control room supervisor entered Procedure EOP-0001, because reactor vessel water level dropped below 9.7 inches, an entry condition to the procedure. Procedure EOP-0001 required that the control room supervisor "Verify Reactor Scram," which he did. The procedure then splits into three paths to be executed concurrently. In accordance with the reactor power path, Step RQ-1, the control room supervisor gave directions to "monitor and control reactor power." However, he did not carry out Step RQ-2, "Verify the Reactor Mode Switch in Shutdown." This path then required that operators enter Procedure AOP-0001.

River Bend Station expectations for licensed operators required the at-the-controls operator to perform the immediate operator actions of Procedure AOP-0001 from memory upon a reactor scram, then verify they are complete using a hard copy of the procedure. The immediate operator actions were as follows:

"4.1 Arm and depress C71A-S3A, B, C, and D, Manual Scram, Pushbuttons.

"4.2 Place C71 A-S1, Reactor System Mode Switch, to SHUTDOWN.

"4.3 Check all Control Rods are fully inserted.

"4.4 If all Control Rods are not fully inserted, then arm and depress both C11C-S1A and B, ARI Channel A and B Manual Initiation, Pushbuttons.

"4.5 Check Reactor Power lowering on the APRMs.

"4.6 Verify the Feedwater System is operating to restore Reactor Water Level.

"4.7 Verify Reactor Pressure is being maintained by one of the following:

• Turbine

• Turbine Bypass Valves

• Safety Relief Valves" The team determined that evidence existed that Steps 4.1 and 4.3 were completed, that the condition for Step 4.4 did not exist, that the conditions in Steps 4.5 and 4.6 were occurring, and that the turbine bypass valves were in service and controlling pressure.

However, Step 4.2 was not completed until approximately 7 minutes after the scram.

Because the reactor mode switch remained in the RUN position, when main steam line pressure lowered to below 849 psig, the main steam isolation valves automatically closed. This complicated the operators response to the scram because reactor pressure had to be controlled using safety/relief valves. Additionally, decay heat from the reactor, that otherwise would have been transported through the bypass valves and out through the cooling towers, was now going to the suppression pool causing an increase in both temperature and level. This resulted in the entry conditions being met for Procedure EOP-0002.

The team interviewed the senior reactor operators who were in the control room during the event. Several indicated that they thought the control room supervisor marked Step RQ-2 as complete after the reactor mode switch was moved to the SHUTDOWN position, approximately 7 minutes after the scram. All operators interviewed indicated that the basis for Step RQ-2 was to provide a backup scram signal. However, the team reviewed the "Emergency Operating and Severe Accident Procedures Bases,"

Revision 9, and noted that the basis for Step RQ-2 was as follows:

"[W]hen the reactor mode switch is placed in SHUTDOWN position, a diverse and redundant reactor scram signal is generated in the [reactor protection system] logic."

The operator training specialist for emergency operating procedure training and implementation stated that the operators are trained on procedure usage and the bases in this bases document.

The team reviewed the BWR Owners Group, "Emergency Procedure Guidelines/Severe Accident Guidelines," Revision 1, upon which the River Bend Station emergency operating procedures are based. The basis for Step RQ-1 being the equivalent to River Bend Stations Step RQ-2, includes the following statement:

"[R]otating the mode switch out of RUN position prevents MSIV closure on low main steam line pressure, thus maintaining main condenser availability and minimizing the heat load on containment."

Additionally, the team noted that when Procedure EOP-0001 requires that the control room supervisor, "Verify the Reactor Mode Switch in Shutdown," the reactor has already been verified to have successfully scrammed and providing a back up scram signal would not be necessary. However, as the Boiling Water Reactor Owners Group bases state, moving the reactor mode switch out of the RUN position will avoid having to use the safety/relief valves for pressure control and avoids unnecessarily adding decay heat to the suppression pool.

The team determined that the training provided to the operators did not emphasize the complete basis for Procedure EOP-0001, Step RQ-2, to verify that the reactor mode switch was in the SHUTDOWN position. As a result, the control room supervisor failed to properly prioritize this step in his implementation of Procedure EOP-0001 on October 19, 2006, complicating the response to the reactor scram.

The team concluded that the failure of the at-the-controls operator to place the mode switch in the SHUTDOWN position following a reactor scram, as required by abnormal operating procedures, and the failure of the control room supervisor to verify that the reactor mode switch position, as required by emergency operating procedures, were violations.

Significance Determination: The team determined that these findings were of very low safety significance, as documented in Attachment 2 to this inspection report.

Enforcement:

Technical Specification 5.4.1.a. requires that written procedures be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Appendix A, "Typical Procedures for Pressurized Water Reactors and Boiling Water Reactors," Revision 2, 1978. Regulatory Guide 1.33, Appendix A, Item 5, recommends, "Procedures for Abnormal, Off Normal, or Alarm Conditions." Procedure AOP-0001 implements this requirement. Immediate Operator Action 4.2 requires that the at-the-controls operator, "Place C71 A-S1, Reactor System Mode Switch, to SHUTDOWN."

Contrary to the above, on October 19, 2006, operators failed to place the reactor mode switch in the SHUTDOWN position following a reactor scram. The inspectors determined that the cause involved a senior reactor operator distracting the at-the-controls operator from performing the post scram immediate actions.

Because this finding was of very low safety significance and has been entered into the licensees corrective action program as Condition Report CR-RBS-2006-04078, this procedural violation is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000458/2006013-002, "Failure to place the reactor mode switch in the SHUTDOWN position following a reactor scram as required by abnormal operating procedures."

This violation has a cross-cutting aspect in the area of human performance, work practices component associated with the failure to effectively use human error prevention techniques.

In addition, Technical Specification 5.4.1.b requires that written procedures be established, implemented, and maintained covering the activities specified in emergency operating procedures required to implement the requirements of NUREGs-0737 and -

0737, Supplement 1. Procedure EOP-0001 implements this requirement. Step RQ-2 required that the control room supervisor verify the reactor mode switch was in SHUTDOWN.

Contrary to the above, on October 19, 2006, the control room supervisor did not verify that the reactor mode switch was in the SHUTDOWN position following a reactor scram.

The inspectors determined that the cause involved a failure of the licensee to train senior reactor operators that the basis for Step RQ-2 was to ensure that the main steam isolation valves remained open to maintain main condenser availability, minimizing the heat load on containment.

The licensee took the following corrective actions to restore compliance:

• Licensee personnel revised the emergency operating procedure bases; and

• Licensed operators were trained on the revised basis.

Because this finding was of very low safety significance and has been entered into the licensees corrective action program as Condition Report CR-RBS-2006-04078, this procedural violation is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000458/2006013-003, "Failure to verify that the reactor mode switch was in the SHUTDOWN position following a reactor scram as required by emergency operating procedures."

This violation has a cross-cutting aspect in the area of human performance, work practices component associated with the failure to provide adequate management oversight in this situation.

3.1.2 Operation of Division III Emergency Diesel Generator Discussion: Following the reactor scram on October 19, 2006, reactor vessel level decreased to below the Low Low Level 2 setpoint (-43") at about 5:56 pm, resulting in the related automatic initiation signal for the high pressure core spray system. By design, the actuation signal for the system also starts the Division III emergency diesel generator. This design was to start the diesel in anticipation of a loss-of-offsite power to Division III. However, power remained available to the Division III buses throughout the event.

At approximately 7:16 pm, operators secured the high pressure core spray system pump and returned the system to standby conditions in accordance with Procedure SOP-0030. However, the Division III emergency diesel generator was allowed to run unloaded until 8:14 pm, at which time it was secured and placed in standby condition in accordance with Procedure SOP-0052. The Division III diesel ran with the generator unloaded for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 17 minutes despite the fact that the high pressure core spray system had only been utilized for the first 2 minutes and 41 seconds and operators had secured the pump and returned the system to standby conditions almost an hour earlier.

Procedure SOP-0052 requires that:

"Under non-emergency conditions, the Diesel Engine must not be run at less than 1950 kW for greater than 10 minutes."

The Division III emergency diesel generator should have been shutdown prior to exceeding this 10-minute time limit so as to avoid incomplete combustion of the diesel fuel. Given the emergency conditions under which the diesel started, failure to shut down the engine early in the event recovery may not have been a violation. However, the team concluded that the engine was required to be shutdown within 10 minutes following the cessation of emergency conditions. However, the engine was allowed to continue to run for almost an hour after the high pressure core spray system was returned to its standby alignment.

Procedure SOP-0052 requires the EDG to:

"... be loaded to greater than or equal to 2300 kW, for... at least two hours, if the engine was run at less than 1950 kW for equal to or greater than one hour but less than four hours."

In accordance with Procedure SOP-0052, licensed operators started the Division III emergency diesel generator on October 20, 2006, at 10:39 am, and connected the generator to the grid at 11:06 am. The generator was run at full load of approximately 2400 kW from 11:26 am to about 1:33 pm.

The team determined that the failure to shut down the Division III diesel within 10 minutes was a minor violation because it had little impact on the Division III emergency diesel generator operability and had no safety consequences. The licensee also completed procedural requirements by running the emergency diesel generator loaded for about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> on October 20, 2006.

3.1.3 Safety/Relief Valve Operation Discussion: On October 19, 2006, at about 5:59 pm, an inadvertent main steam isolation occurred on low reactor pressure caused by high pressure core spray injection.

With the main steam isolation valves closed, reactor pressure began to increase as the large volume of cooler water injected by the high pressure core spray system expanded.

Approximately 7 minutes later, with reactor pressure at 1090 psig, operators opened a safety/relief valve to control pressure below the automatic relief setpoint. The Table 3.1-2 documents the valve manipulations that occurred during the event.

TABLE 3.1-2 Safety/Relief Valve Manual Operations Valve Stroked Opened Closed Time (hh:mm:ss)

Pressure (psig)

Time (hh:mm:ss)

Pressure (psig)

SRV-F051D 18:06:11 1090 18:07:27 922 SRV-F051B 18:12:54 1054 18:13:59 1032 SRV-F051G 18:14:17 1067 18:14:28 1023 SRV-F047F 18:16:09 1055 18:16:16 1025 SRV-F051D 18:18:33 1063 18:18:41 1021 SRV-F051B 18:23:13 1060 18:25:50 811

TABLE 3.1-2 Safety/Relief Valve Manual Operations Valve Stroked Opened Closed Time (hh:mm:ss)

Pressure (psig)

Time (hh:mm:ss)

Pressure (psig)

SRV-F051G 18:31:52 911 18:32:10 864 SRV-F051D 18:38:40 932 18:38:47 910 SRV-F051C 18:39:41 932 18:39:50 908 SRV-F051B 18:40:37 930 18:40:51 891 SRV-F051G 18:42:23 934 18:42:45 876 SRV-F047F 18:45:10 930 18:45:39 864 SRV-F051D 18:46:37 895 18:48:28 749 SRV-F051C 18:50:40 805 18:51:09 725 Abnormal Operating Procedure AOP-0001, OSP-0053, Attachment 1B, "Post Scram Pressure Control Strategies," Revision 5, states, in part, "1.2 Post-Scram Pressure Control for an MSIV Isolation.

"1.2.1 IF only the inboard MSIVs close due to a loss of air to containment, THEN perform the following:

"1.

Take manual control of the inboard MSIVs by taking the control switch of each valve to CLOSE.

"2.

Utilize available steam drains to control pressure.

"3.

IF required, THEN augment pressure control with SRVs. Each SRV cycle should be closely coordinated with the at-the-controls operator.

"1.2.2.

For a full MSIV isolation, perform the following:

"1.

Verify SRVs are cycling automatically to control pressure.

"2.

IF automatic SRV cycling is preventing the level control operator from controlling RPV water level in the required band, THEN perform one of the following:

!

Closely coordinate with the level control operator to manually operate SRVs as required to control pressure in the prescribed pressure band, without driving level outside the prescribed level band.

!

Transition level control from the Feed and Condensate system to the RCIC system.

!

Run RCIC either directly for level control, or in pressure control lineup (maximized)."

However, following the main steam line isolation, the safety/relief valves never operated in automatic. Therefore, operators did not verify that they were cycling in automatic, nor could they observe that the automatic function was preventing the level-control operator from controlling reactor pressure vessel level in the required band. In addition, manual control of the safety/relief valves drove level out of the required band on multiple occasions during the event.

Licensed operators and plant management stated that operators knew that under the conditions that existed they could not properly control level if the safety/relief valves were cycling in automatic and that they had been trained to operate the safety/relief valves manually under these conditions. This expectation was supported by operations management. Additionally, plant management stated that this procedure was not a requirement and was in conflict with the bases of the emergency operating procedures.

The team reviewed Section 1, Purpose, of Attachment 1B and noted that Step 1.3 stated:

The Continuous Use designation of this procedure is intended to apply to the Hard Card attachments only. The Strategy attachments and procedure body are informational in nature and do not provide step by step procedural guidance.

Section 3, Strategies, Step 1.3, stated:

Strategy attachments are provided in this procedure for those activities which do not lend themselves to step by step instructions due to the varying impact on these activities by differing plant conditions for different transients.

Additionally, in Section 4, Hard Cards, Step 4.7.1 stated:

s 1A, 1B, and 1C are strategies, not Hard Cards.

The team noted that these procedure statements should be reviewed in light of the definitions given in River Bend Nuclear Procedure RBNP-001, Revision 25, Control and Use of RBS Procedures. Section 3, Definitions, Step 3.4 defines the level of use of plant procedures, indicating that there are three categories of procedure: Continuous Use, Reference Use, and Informational Use.

Informational use procedures were defined as procedures frequently performed or not complex in which the activity could be accomplished from memory and within the skills of qualified individuals. While these procedures are not required to be available at the work location, they are still expected to be followed.

The team also reviewed the bases for EOP-0001, Step RP-3, Stabilize RPV Pressure Below 1090 psig. One portion of this document suggested that Safety/relief valves should generally be opened manually. However, the bases discussed many exceptions to this general statement. Additionally, the document stated:

...the adequacy of steps taken to stabilize RPV pressure must be judged by the effect of any continuing pressure variations on RPV water level...

The team reviewed plant operating parameters and the associated time line elements and determined that reactor vessel water level had gone outside the established level band at least 6 times during the 53 minutes that the main steam isolation valves were closed. This fact, combined with an evaluation of the data, shown in Table 3.1-2 indicated to the team that operators may have been attempting to control pressure at specific points without regard for reactor water level at the time.

The team concluded that the failure of licensed operators to permit the safety/relief valves to cycle in automatic and to manually operate Safety/relief valves without driving level outside the prescribed level band, as required by abnormal operating procedures, was a violation.

Significance Determination: The team determined that this finding was of very low safety significance, as documented in Attachment 2 to this inspection report.

Enforcement:

Technical Specification 5.4.1.a. requires that written procedures be established, implemented, and maintained covering the applicable procedures recommended in Regulatory Guide 1.33, Revision 2, Appendix A, 1978. Regulatory Guide 1.33, Appendix A, Item 5, recommends, "Procedures for Abnormal, Off Normal, or Alarm Conditions." Procedure AOP-0001, OSP-0053, Attachment 1B, implements this requirement. Step 1.2.2.1 requires that operators, "Verify SRVs are cycling automatically to control pressure," and Step 1.2.2.2 (for conditions when the reactor isolation cooling system is unavailable) requires, IF automatic SRV cycling is preventing the level control operator from controlling RPV water level in the required band, THEN..

. Closely coordinate with the level control operator to manually operate SRVs as required to control pressure in the prescribed pressure band, without driving level outside the prescribed level band.

Contrary to the above, on October 19, 2006, operators failed to verify that the safety/relief valves were cycling in automatic following a main steam isolation, and operator actions intended to closely coordinate with the level control operator to manually operate the safety/relief valves, were not effective in maintaining level within the prescribed level band.

Because the finding was of very low safety significance and has been entered into the licensees corrective action program as Condition Report CR-RBS-2007-00697, this procedural violation is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000458/2006013-004 "Operators failed to permit the safety/relief valves to cycle in automatic and to manually operate the safety/relief valves without driving level outside the prescribed level band as required by abnormal operating procedures."

This violation has a cross-cutting aspect in the area of human performance, work practices component associated with the effectiveness of communicating expectations regarding procedural compliance.

3.2 Conduct of Operations in the Main Control Room The team assessed emergency procedure implementation and control room operator response as it related to the event. The inspection was accomplished through a review of documents and interviews with operators and engineering staff. The team evaluated main control room command and control during the event, as well as operator training including standards and expectations. Additionally, the team developed a sequence of events related to the event, including plant response, operator actions and the timing of failed administrative barriers. The teams sequence was provided as Attachment 4 to this inspection report.

3.2.1 General Control Room Activities Discussion: On October 19, 2006, as the at-the-controls operator attempted to correct a paper misfeed in Chart Recorder C33-R608, the drive mechanism fell and bounced several times on the main control panel. The at-the-controls operator retrieved the drive mechanism and scanned the panel for any indication of inadvertent switch actuation.

Two senior reactor operators observed the at-the-controls operator scanning and verifying panel indications immediately following the occurrence of the dropped drive mechanism. Additionally, shortly afterwards, senior reactor operators conducting control board walkdowns as part of their watch turnover, also observed the subject panel.

During this time period, Feedwater Isolation Valves 7A and 7B began to stroke closed.

The valves took approximately 3.5 minutes to close during the event. Given the long closing time and the throttling characteristics of gate valves, initially there were no alarms or indication of plant response to the valves beginning to close. However, by design, the green and red position indication lights of both valves should have been illuminated (indicating the valves were in mid-position) within 1 second. Additionally, the open pushbutton of each valve would no longer have been depressed. The at-the-controls operator and the on-coming and off-going control room supervisors failed to identify these abnormal indications during their monitoring of the panel in accordance with Entergy Operations Procedure EN-OP-115, "Conduct of Operations," Revision 2.

As the valves closed, feedwater flow was reduced to the reactor resulting in lowering reactor vessel water level and the associated alarms. When the initial alarms were received indicating there was a problem with the plant, the on-coming control room supervisor relieved the off-going control room supervisor by stating that he was in charge and immediately entering Procedure EOP-0001. An off-going senior reactor operator moved to the main control panels and began questioning the at-the-controls operator regarding the status of the main feedwater system.

As reactor vessel water level continued to lower, a Level 3 automatic reactor scram occurred. The shrink in boiling margin following the scram resulted in a Level 2 actuation of the high pressure core spray system, which injected into the core for approximately 2-3/4 minutes until operators closed the injection valve in accordance with system operating procedures.

Approximately 4 minutes after the scram, a main steam isolation occurred on low steam header pressure at about 849 psig. The main steam isolation signal would normally have been bypassed following a scram by operators placing the mode switch in the SHUTDOWN position in accordance with Procedure AOP-0001. However, the mode switch was inadvertently left in the RUN position. With the main steam isolation valves shut, operators controlled reactor pressure with the safety/relief valves.

3.2.2 Control Panel Verification Discussion: As Feedwater Isolation Valves 7A and 7B closed, initially there were no alarms or indication of plant response to the valves beginning to close. However, by design, the green and red position indication lights of both valves should have been illuminated within 1 second. Additionally, the open pushbutton of each valve would no longer have been depressed. The at-the-controls operator and two senior reactor operators (one on-coming and one off-going), conducting turnover activities, failed to identify these abnormal indications during their monitoring of the panel.

In accordance with Procedure EN-OP-115, Section 5.12, Step 3 states:

"Control room reactor operators walk down the main control panels once per shift to ensure that safety related switch and valve line-ups are in their required configuration."

Additionally, Section 5.16, Step 3, states:

"The oncoming Control Room Operators and SROs will conduct control board walkdowns with an off-going operator."

The team determined that had any of these operators identified the switch mispositioning prior to low reactor water level conditions, at a minimum, licensed operators would have had time to prepare for and insert a manual reactor scram, and the troubleshooting efforts that occurred following the scram would not have happened and would not have affected the post-scram response as they did.

The team concluded that the failure of reactor operators to perform an adequate control board walkdown, which resulted in failure to identify that feedwater isolation valves were closing was a violation.

Significance Determination: The team determined that this finding was of very low safety significance, as documented in Attachment 2 to this inspection report.

Enforcement:

A self-revealing noncited violation of 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," was identified for the failure of licensee personnel to accomplish activities affecting quality in accordance with prescribed conduct-of-operations procedures.

Contrary to the above, on October 19, 2006, two senior reactor operators (one on-coming and one off-going), conducting turnover activities, and the at-the-controls reactor operator failed to identify that the push buttons for Main Feedwater Isolation Valves 7A and 7B were out of alignment upon panel inspection during panel walk downs conducted in accordance with Procedure EN-OP-115.

Because the finding was of very low safety significance and the licensee entered these discrepancies into their corrective action program as Condition Report CR-RBS-2006-4078, Corrective Action CA-27, this violation is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy:

NCV 05000458/2006013-005 "Failure of reactor operators to perform an adequate control board walkdown resulting in failure to identify that feedwater isolation valves were closing."

This violation has a cross-cutting aspect in the area of human performance, work practices component associated with the failure to effectively use human error prevention techniques such as self and peer checking.

3.2.3 Relief of Control Room Supervision Discussion: On October 19, 2006, while six control room senior reactor operators were still in the process of shift turnover, the reactor scrammed on low reactor vessel water level. At that time, the on-coming control room supervisor stated that he was in charge and immediately entered Procedure EOP-0001. The off-going control room supervisor moved to the main control panels and began questioning the at-the-controls operator regarding the status of the main feedwater system. The at-the-controls operator and the senior reactor operator began troubleshooting the problem with the main feedwater system. As a result, the at-the-controls operator failed to complete the post-scram immediate actions and failed to provide a scram report to the control room supervisor.

During interviews, the at-the-controls operator stated that he was not sure who was in charge, and indicated that he had provided information to and received direction from the closest control room supervisor, who may not have had the watch.

The team reviewed the licensees conduct of operations procedures and expectations.

A self-imposed standard documented in Procedure EN-OP-115, Section 5.16, Step 10, states:

"If a plant evolution/transient is in progress, the watch should not be relieved until the evolution/transient is complete or a logical breakpoint has been reached."

However, the on-coming control room supervisor relieved the watch during the loss-of-feedwater transient, instead of waiting for the plant to be in a stable condition.

Although licensee personnel stated that turnover activities were essentially complete at the time, changing the watch caused the at-the-controls reactor operator and other control room personnel to misunderstand who was in charge of the event response and contributed to the at-the-controls operator not placing the mode switch in the SHUTDOWN position, as required by Procedure AOP-0001. The failure to reposition the mode switch resulted in an inadvertent main steam isolation, which complicated the scram recovery process.

The team concluded that when senior reactor operators relieved the watch during a transient without waiting for the plant to be in a stable condition, they did so in a manner contrary to the standards established in the conduct-of-operations procedures.

Significance Determination: The team determined that this finding was of very low safety significance, as documented in Attachment 2 to this inspection report.

Enforcement:

The team determined that no violation of NRC requirements occurred because Procedure EN-OP-115, Section 5.16, Step 10, is an expectation and not a procedural requirement. However, the failure to implement an established, self-imposed standard that was within the licensees ability to control represents a performance deficiency. Because this finding doesn't involve a violation of regulatory requirements and has very low safety significance it is identified as: FIN 05000458/2006013-006, "Senior reactor operator relieved the watch during a transient without waiting for the plant to be in a stable condition, resulting in an inadvertent main steam isolation."

This finding has a cross-cutting aspect in the area of human performance, work practices component associated with the failure to implement the roles and responsibilities of the senior reactor operators in the main control room as designed.

3.3 Evaluation of Corrective Actions The team assessed the root cause and corrective actions related to the October 19, 2006, scram, including the oversight provided by the on-site safety review committee, and an evaluation of the over lap of the post-scram review discovery and the timing of the on-site review committee meeting. The inspection was accomplished through a review of corrective action documents, meeting minutes, and interviews with operators, plant managers, and engineering staff.

3.3.1 Previous operational experience Discussion: On June 19, 2005, a licensed operator dropped the roll of paper for Strip Chart Recorder H13-P870 actuating two switches. This personnel error was entered into the licensees corrective action program as Condition Report CR-RBS-2005-02238.

The licensee's corrective actions focused narrowly on that specific type of recorder rather than all control areas where dropped items could result in inadvertent actuation of vital equipment/systems. This failure to recognize that the event was transportable to other systems was an opportunity for the licensee to have prevented the reactor scram on October 19, 2006.

The licensee stated that these events were somewhat similar but not entirely the same.

The event on October 19, 2006, occurred as the operator was attempting to free up jammed paper in the recorder. For the 2005 event, the operator dropped a roll of chart paper. However, in both cases, the operators did not provide adequate support for the components to prevent impact with the panels below the recorders. Following the June 19, 2005, event, licensee personnel limited their investigation to chart recorders of the same design, despite the issue being identified as items being handled over plant controls.

Additionally, the team reviewed Condition Report CR-ANO-2-2006-00945, that discussed an event in which the fix-it-now team at Arkansas Nuclear One had caused component actuation while working with a recorder over control panels. This operational experience document had been provided to the fix-it-now team at the River Bend Station. However, the experience was not shared with operations personnel. The failure to provide this operational experience to all personnel that worked over control panels represented an additional opportunity for the licensee to have prevented the reactor scram on October 19, 2006.

No findings of significance were identified.

3.3.2 Deficiency with Chart Recorder Discussion: On October 19, 2006, as part of routine shift turnover duties, the at-the-controls operator was time and date stamping chart recorders on the main control panel. During this activity, he attempted to correct a paper jam in Strip Chart Recorder C33-R608. The reactor operator pulled the recorder to the forward position and pulled on the paper wound around the drive wheel. As he pulled, the paper drive mechanism fell out of the recorder and onto the main control panel. The mechanism bounced several times striking the open pushbutton for Long-Cycle Recirculation Valve FWS-103, and the close pushbuttons for both Feedwater Isolation Valves FWS-MOV7A and FWS-MOV7B.

The at-the-controls operator picked up the mechanism and scanned the panel for any indication of mispositioning. He then took the mechanism over to the reactor operators table and corrected the condition with the paper feed. Upon returning the mechanism to the recorder, the at-the-controls operator noted that the spring clip holding the mechanism pivot pin in place was significantly bent toward the top of the recorder housing. The at-the-controls operator attempted to straighten the clip to its original position; however, he later stated that he believed it had been damaged from overuse.

The team noted that Strip Chart Recorder C33-R608 was required to be operational for post accident monitoring. This recorder provides licensed operators with trend indication of reactor vessel water level on both the narrow and wide-range channels.

River Bend Station Technical Specifications, Table 3.3.3.1-1, Post Accident Monitoring Instrumentation, requires 2 channels of wide-range level indication be provided to the operators. Additionally, the River Bend Station Updated Safety Analysis Report, Section 7.5, Safety-Related Display Instrumentation, states that required indication includes one recorder and one meter displaying wide-range reactor vessel water level.

Following the reactor scram, operations supervision discussed the condition of the recorder spring clip with the operator. The at-the-controls operator showed his supervision what he had done to adjust the spring clip. Additionally, the licensee indicated that operators inspected every similar recorder and ensured that the spring clip was not bent significantly toward the top of the recorder housing. However, the team interviewed a member of the on-site safety review committee, he stated that he believed that repairs and inspections of the recorders had been performed by maintenance technicians and that the deficiencies had been fully reviewed and repaired prior to restart.

On October 24, 2006, licensed operators wrote Work Order WO-96563 to repair Strip Chart Recorder C33-R608 because it continued to have problems with the paper take-up device that had caused the initial paper jam on October 19, 2006. He stated in an email, as an addendum to Condition Report CR2006-4096, that the post (pivot pin)was loosely attached and the paper assembly became detached very easily from the recorder.

The team interviewed the technician and reviewed documentation of his work on Strip Chart Recorder C33-R608 conducted on October 24, 2006. The technician stated that he had removed the recorder from the main control panel and taken it to the shop to repair the drive mechanism. He stated that when he placed the recorder on the work bench, the paper drive mechanism fell out in his hand.

The team determined that the at-the-controls operator had identified a deficiency with Strip Chart Recorder C33-R608. However, this condition was not documented in the condition reporting process, the recorder was not properly inspected and repaired by qualified maintenance technicians, and at least one member of the on-site safety review committee may have been misinformed about the extent and composition of the evaluation and repair activities conducted on control room recorders prior to plant restart on October 22, 2006.

The team concluded that the failure to identify and correct the deficiencies with Strip Chart Recorder C33-R608 prior to restart was a violation.

Significance Determination: The team determined that this finding was of very low safety significance, as documented in Attachment 2 to this inspection report.

Enforcement:

An NRC-identified noncited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Actions," was identified for the failure of licensee personnel to identify and correct a condition adverse to quality in a timely manner.

Contrary to the above, a licensed reactor operator noted a nonconforming condition with Strip Chart Recorder C33-R608 following the fall of the chart paper mechanism and discussed this with his supervision. However, this condition was not entered into the licensees corrective action process at that time, and the complete failure mode was not discovered and repaired until October 24, 2006, after operators had restarted the reactor on October 22, 2006.

Because the finding was of very low safety significance and the licensee entered these discrepancies into their corrective action program as Condition Report CR-RBS-2006-4078, Corrective Action CA-13 this violation is being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy:

NCV 05000458/2006013-007, "Licensee personnel failed to identify, place in the corrective action program, and correct deficiencies with Chart Recorder C33-R608 prior to restarting the reactor."

This finding has a cross-cutting aspect in the area of problem identification and resolution in that the licensee did not implement a corrective action program with a low threshold for identifying issues.

3.3.3 Addressing Probable Cause of Reactor Scram Discussion: As documented in the "Scram Report," completed on October 20, 2006 in accordance with General Operating Procedure GOP-0003, "Scram Recovery,"

Revision 17, the root cause of the October 19, 2006 reactor scram was an operator error. The report states, "The event was driven by a human performance event, there were no equipment malfunctions that caused the event."

Operations management stated that the at-the-controls operator should have removed the paper drive mechanism from the recorder and left the control panel to clear the jam and rewind the paper. However, this expectation had not been clearly delineated to operators prior to the scram.

The team evaluated the licensees actions prior to restarting the reactor, including a review of Simulator Scenario RSMS-OPS-539, Loss of Feedwater with Full MSIV Closure. This scenario was used to train all operating crews on the subject of this event. Included in this scenario was a discussion of the October 19, 2006 event. The training included a section on work over the control room panels. The scenario documentation stated that the following expectation should be conveyed:

Be sensitive to evolutions conducted around [Main Control Room] MCR panels.

Do not hold binders or other materials over a MCR panel where it could drop on to the panel. Fluids should not be held over the panels. When working with installed equipment such as chart recorders, take additional measures to guard against possible drops of the equipment; utilize additional personnel support, ensure sensitive components have barriers protecting the equipment, etc. Maintain a healthy questioning attitude of what could go wrong?

The team interviewed multiple licensed operators and discussed their understanding of this expectation. While all operators stated that work should not be performed over the panels, their understanding of the definition of work was varied. Some operators indicated that rewinding paper loose or unwound paper onto a paper drive mechanism would be acceptable without removing the mechanism from the recorder. The team noted that such an activity was being performed by the at-the-controls operator on October 19, 2006, and constituted the licensees probable cause.

As such, the team concluded that corrective actions taken to address this expectation were inadequately communicated to other operating crews. Operations management stated that they believed that operators on other crews would learn from descriptions of the event. Additionally, plant management spent a significant amount of time on shift observing operators performing routine plant evolutions. These coaching sessions were used to provide immediate feedback to the operators whenever activities that resulted in items being held over the control panels were witnessed.

However, as stated earlier, during interviews with operators, conducted as part of the inspection, not all licensed operators were aware/sure of management expectations with regard to evolutions involving materials over the panels. Some thought it pertained only to relatively heavy items, while others thought it included papers and logs as well.

Additionally, it was not clear that activities where the chart recorder was pulled to the forward position, but the paper drive mechanism was not to be removed, would be included in this expectation.

The team concluded that the licensee had taken significant efforts to train licensed operators on managements expectations regarding work over the control room panels.

However, the efforts fell short in completely communicating the definition and scope of what constituted work, and thus, the probable cause of the scram was not completely addressed prior to plant restart.

The failure of the licensee to take complete action to ensure that the probable cause of the reactor scram was corrected, prior to restarting the reactor, was a violation.

Significance Determination: The team determined that this finding was of very low safety significance, as documented in Attachment 2 to this inspection report.

Enforcement:

An NRC-identified noncited violation of 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Actions," was identified for the failure of licensee personnel to ensure that the probable cause of the reactor scram was corrected, prior to restarting the reactor.

Contrary to the above, following the reactor scram on October 19, 2006, licensee personnel determined that the probable cause of the scram was a human performance error while handling the paper drive mechanism of Strip Chart Recorder C33-R608.

However, complete corrective actions were not taken to address this probable cause prior to restarting the reactor on October 22, 2006.

Because the finding was of very low safety significance and the licensee entered the discrepancy into their corrective action program as Condition Report CR-RBS-2006-4078, Corrective Actions CA-17, CA-33, and CA-41, this violation

was being treated as a noncited violation consistent with Section VI.A of the Enforcement Policy: NCV 05000458/2006013-008, "Licensee personnel failed to provide complete corrective actions to address the probable cause of the October 19, 2006, scram, prior to restarting the reactor."

This finding has a cross-cutting aspect in the area of problem identification and resolution in that the licensee did not implement a corrective action program that ensured timely resolution of conditions adverse to quality.

3.3.4 On-site Safety Review Committee Oversight On October 20, 2006, a series of on-site safety review committee meetings were held to review issues associated with the October 19, 2006,reactor scram and to determine if restart of the unit could be authorized. The committee reviewed data in two main parts:

1) plant and equipment response; and 2) human performance. The activities included a review of the scram report and associated operator logs and computer plots.

The team interviewed the committee chairman, reviewed the formal minutes of the meetings, and identified the value added in root cause and scram documentation.

While discovery was taking place during parts of the meeting and problem solving was conducted in addition to other committee activities, the team concluded that these were part of a thorough review by committee members. Comments and recommendations made by the committee provided positive additions to the licensees corrective actions associated with the reactor scram and operator response to the transient.

No findings of significance were identified.

1, "Supplemental Information" 2, "Estimation of Risk Significance" 3, "Special Inspection Team Charter" 4, "Sequence of Events"

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

L. Ballard, Manager, Quality Programs

R. Biggs, Coordinator Nuclear Safety Assurance

T. Burnett, Acting Manager, Training and Development

C. Bush, Manager, Outage

J. Clark, Assistant Operations Manager - Training

M. Davis, Manager, Radiation Protection

M. Feltner, Manager, Planning and Scheduling/Outage

C. Forpahl, Manager, Corrective Action and Assessment

R. Fuller, Assistant Operations Manager - Admin.

T. Gates, Manager, Equipment Reliability

H. Goodman, Director, Engineering

B. Heath, Acting Superintendent, Chemistry

K. Higginbotham, Assistant Operations Manager - Shift

B. Houston, Manager, Plant Maintenance

N. Johnson, Manager, Engineering Programs & Components

R. King, Director, Nuclear Safety Assurance

J. Leavines, Manager, Emergency Planning

D. Lorfing, Manager, Licensing

J. Maher, Superintendent, Reactor Engineering

W. Mashburn, Manager, Design Engineering

J. Miller, Manager, Operations

B. Olinde, Superintendent I&C Maintenance

P. Russell, Manager, System Engineering

J. Schlesinger, Supervisor, Design Engineering

D. Steinsiek, Supervisor, Engineering Programs & Components

J. Venable, Site Senior Vice President

D. Vinci, General Manager - Plant Operations

ITEMS OPENED and CLOSED

Opened and Closed

05000458/2006013-001

NCV

Failure to identify and correct discrepancies between the

design function and observed response of the feedwater

isolation valves prior to reactor restart.(Section 2.1.1). 05000458/2006013-002

NCV

Failure to place the reactor mode switch in the

SHUTDOWN position following a reactor scram as

required by abnormal operating procedures

(Section 3.1.1). 05000458/2006013-003

NCV

Failure to verify that the reactor mode switch was in the

SHUTDOWN position following a reactor scram as

required by emergency operating procedures

(Section 3.1.1). 05000458/2006013-004

NCV

Operators failed to permit the safety/relief valves to cycle

in automatic and to manually operate the safety/relief

valves without driving level outside the prescribed level

band as required by abnormal operating procedures

(Section 3.1.3). 05000458/2006013-005

NCV

Failure of reactor operators to perform an adequate control

board walkdown resulting in failure to identify that

feedwater isolation valves were closing (Section 3.2.2). 05000458/2006013-006

FIN

Senior reactor operator relieved the watch during a

transient without waiting for the plant to be in a stable

condition, resulting in an inadvertent main steam isolation

(Section 3.2.3). 05000458/2006013-007

NCV

Licensee personnel

failed to identify, place in the

corrective action program, and correct deficiencies with

Chart Recorder C33-R608 prior to restarting the reactor

(Section 3.3.2). 05000458/2006013-008

NCV

Licensee personnel

failed to provide complete corrective

actions to address the probable cause of the October 19,

2006, scram, prior to restarting the reactor (Section 3.3.3).