ML14178A466
| ML14178A466 | |
| Person / Time | |
|---|---|
| Site: | Robinson  |
| Issue date: | 03/31/1994 |
| From: | Mellen L, Peebles T NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| To: | |
| Shared Package | |
| ML14178A464 | List: |
| References | |
| 50-261-94-07, 50-261-94-7, NUDOCS 9404120208 | |
| Download: ML14178A466 (24) | |
See also: IR 05000261/1994007
Text
A REGo
UNITED STATES
0'
NUCLEAR REGULATORY COMMISSION
REGION II
101 MARIETTA STREET, N.W., SUITE 2900
ATLANTA, GEORGIA 30323-0199
Report No.:
50-261/94-07
Licensee:
Carolina Power and Light Company
P. 0. Box 1551
Raleigh, NC
27602
Docket No.:
50-261
License No.:
Facility Name: H. B. Robinson
Inspection Conducted:
March 14-25, 1994
Inspector:
5
L
3 3/ 9
rry
. Mellen, Reactor Engineer
Date Signed
Accompanying Personnel: C. Rapp, RH
L. King, RH
C. Moore, PSHA, Inc.
V. Barnes, PSHA, Inc.
Approved by:
- _
-, ,:
S
/
Thomas A. Pe'ebles, Acting Chief
D te Signed
Operational Programs Section
Operations Branch
Division of Reactor Safety
SUMMARY
Scope:
This was a special, announced Emergency Operating Procedure (EOP) team
inspection.
Its purpose was to verify that the Robinson Unit 2 EOPs and EOP
support procedures were technically accurate, that their specified actions
could be meaningfully accomplished using existing equipment, controls, and
instrumentation, and that the available procedures had the usability necessary
to provide the operator with effective operating tools. The inspection
evaluated the adequacy of the licensee's EOPs and EOP support procedures,
conformance of these procedures to the Westinghouse Owners' Group Emergency
Response Guidelines, and conformance to the approved writer's guides.
The
inspection included a comparison of the EOPs and the EOP support procedures to
the licensee's generic technical guidelines, a technical adequacy review of
the procedures, control room and in-plant walkthroughs, simulator evaluation
of selected procedures, a review of on-going control of these procedures, and
interviews of plant personnel who use the procedures.
9404120208 940407
PDR ADOCK 05000261
0
2
0
Results:
The overall assessment was that the EOPs and EOP support procedures were
generally adequate. The team identified a number of Technical and Human
Factors deficiencies. Of greater concern was the lack of quality assurance
involvement, procedural guidance that permits deviating from the approved
mitigation strategy, lack of rigor during the verification and validation
process, and failure to adequately resolve previously identified inspection
findings in this area. There were four violations issued (1) for the failure
of the Quality Assurance organization (Nuclear Assessment Department) to audit
EOPs or EOP support procedures, (2) for procedures, instructions, and drawings
errors, (3) document control deficiencies, and (4) corrective action
deficiencies.
0I
REPORT DETAILS
.
1. Persons contacted
Licensee employees
- S. Hinnant, Vice President -
Robinson
G. Attarian, Chief Electrical Engineer
L. Baxley, Radiological Controls
J. Benjamin, RESS (NED)
H. Carter, Manager of Licensed Operator Retraining
- T. Cleary, Manager Technical Support
- J. Cox, Operations
- L. Dutton, Document Control Supervisor
C. Georgeson, Chief Engineering Section - I&C
D. Gudger, Licensing Engineer
M. Heath, Manager -
I&C Maintenance
M. Herrell, Manager - Training
- K. Jury, Manager -
Licensing/Regulatory Programs
- R. Krich, Manager -
Regulatory Affairs
R. Moore, Manager -
Operations
- C. Olexik, Manager -
NAD
- M. Pearson, Plant General Manager
- D. Whitehead Manager Plant Support Services
A. Wingert, Operations
D. Winters, Operations Procedures Coordinator
Other licensee employees contacted included engineers, technicians,
operators and office personnel.
NRC Resident Inspectors
- W. Orders, Senior Resident Inspector
- C. Ogle, Resident Inspector
- Attended exit interview on March 25, 1994.
A list of abbreviations used in this report is contained in Appendix A.
2. Independent Technical Adequacy Review of the EOPs
The team reviewed the procedures listed in Appendix B, and found that
generally,the vendor-recommended accident mitigation strategy and action
sequence was followed. The main entry into the EOP network was via Path-1
on a reactor trip or safety injection. The only other EOPs that were
entered directly were EPP-1, EPP-5, and EPP-21. The EOP entry and
transition conditions closely followed the ERG. The SDD, with few
exceptions, adequately defined the differences between the EOPs and the
ERGs. However, several weaknesses were noted.
For example, setpoint values and justifications were contained in the EOP
setpoint study. The team noted that setpoint values were generated by a
vendor from information provided to them by the licensee in 1990, but were
not reviewed by the licensee before being incorporated into the EOPs.
Report Details
2
Cautions in the EOPs and support procedures frequently lacked a description
of the potential hazard to equipment or personnel as required by the WGs.
Both notes and cautions were written containing action steps or conditional
steps, also contrary to the WG.
Some additional examples of technical concerns found in the EOPs and EOP
support procedures are listed below.
AOP-17, Attachment 1 did not provide a complete listing of valves.
EPP-1, did not provide guidance on how long the AFW pump can operate
without service water.
EPP-1, required the SDAFW pump supply switched from the CST to
alternative supply at 10 percent CST level.
The SBO Coping report
stated that the supply must be switched to the alternate supply at 34
percent CST level to prevent rendering the SDAFW pump inoperable.
OP-402 assumed the SDAFW pump was stopped before switching to alternate
supply. This is identified as part of Violation 50-261/94-07-02,
"Procedures, Instructions, and Drawings Errors."
Path-1, Column 3, second step under entry point C required opening
Foldout B. Step 6, "AFW Supply Switchover Criteria," included an
instruction to switch to alternative AFW water supply if CST level
decreases to less than 10 percent.
AOP-14, Section A, Step 2.1, regarding control room indications, did
not list the following control room alarms:
APP-001 - B3, D3, El, C2,
and F3.
Part 3.0 of Section 2 of AOP-014 under Auto Actions, stated that
FCV-626, "Therm. Bar. Flow Cont.," will close at 100 gpm flow through
RCP thermal barriers. The procedure did not reference actions for
leakage from RC thermal barrier to CCW system.
3. Review of the EOPs by In-plant and Control Room Walkthroughs
During the in-plant and control room walkthroughs, the team noted that the
format of the AOPs continued to differ substantially from the EPPs.
This
discrepancy was noted by the 1989 NRC EOP inspection team, but had not been
corrected. This is identified as part of violation 50-261/94-07-04,
Corrective Action Deficiencies.
The team was concerned about the legibility of metal tags used to label
equipment outside of the control room. For example, there were situations
in which it might be necessary to hold onto a ladder with one hand, the
valve tag with the other and simultaneously use a flashlight to read the
valve tag.
Report Details
3
Although the team identified numerous discrepancies between the
nomenclature used on equipment labels and in procedures, in most cases the
discrepancies were minor. However, instances of substantial discrepancies
were identified. For example, EPP-19, Step 4 refers to components on a
panel identified as "PZR PORV - Auxiliary Panel DG."
The referenced
components were found panel "GC" and no panel "DG" was found. The team
determined that the more substantial discrepancies identified could lead to
errors or delays in procedure performance.
The high frequency of minor
discrepancies observed raised questions about the adequacy of the process
used to validate portions of the procedures that were performed outside of
the control room.
The team believed that walkthroughs, in areas where recent efforts to
improve labelling had been undertaken, demonstrated that substantial
improvements had been made. For example, during walkthroughs of portions
of DSP-002, very few nomenclature discrepancies were found, and no major
discrepancies were identified. Further, several effective aids for
locating and identifying equipment were provided in the area where the
procedure steps were performed. For example, color coded markers were used
to assist in quick identification of equipment, and some panels were
indexed into rows and columns with the compartments identified.
Walkthroughs of the procedures identified numerous cases where manpower and
tool requirements for performing actions outside of the control room were
not specified. For example:
-
In'EPP-1, Step 12 directed the removal of fuses. The procedure did not
indicate prior to this step that fuse pullers are needed to perform
this task.
-
In AOP-017, Step 10.1 directed taking local control of the charging
pump speed by disconnecting the speed control linkage and manually
positioning the fluid drive. The procedure did not specify this task
required tools for removing a cotter pin and a clevis pin.
-
AOP-004, Attachment 3, Step 4 directed manual throttling of the MDAFW
Pump Discharge Valves to maintain steam levels between 65 and 85
percent WR as indicated on the Secondary Control Panel.
These valves
were not near the control panel, and were particularly difficult to
access. To effectively perform this step, a second operator would be
required to relay information.
-
AOP-020, Attachments 1 and 2 contained actions that must be performed
in the RHR Pump Pit (Step 15 directs operators to these attachments).
However, radio communication was not possible from within the RHR Pump
Pit. To effectively perform this step, a second operator would be
required to relay information.
The team identified the following as situations where task-specific
procedures would have been appropriate for locally performed actions:
Report Details
4
-
EPP-22 and EPP-25 includes a step that directs opening of five DS
breakers. Although the breaker cabinets were clearly labeled by
number, this location information was not provided in the procedures.
-
EPP-1, Step 12 provided direction for removing breaker control power
fuses. Between two and four breakers were associated with each
component listed. Thus, performing the tasks required the breakers and
their locations to be recalled from memory correctly.
The team was concerned that the level of detail in procedures was
inadequate in some cases.
For example, EPP-1, Step 4.b, did not indicate
that the described action must be performed locally and EPP-1,
Attachment 1, did not distinguish between Battery A and Battery B loads.
The team was concerned that some procedure steps required more precise
readings from gauges and instrumentation than could be reliably obtained.
For example, coolant level in the Spent Fuel Pit was required to be
maintained less than 37 and 5/8 inches. However, the level markings on the
side of the Spent Fuel Pit were obscured by boron residue and marked at
2-inch increments.
The team was concerned that cautions and notes were not used correctly or
consistently. For example, OMM-040 indicates that notes in procedures
should be used to provide supplemental information and that operators
)
should be able to perform procedures correctly without referring to the
notes. However, notes frequently contained both action instructions and
cautionary information, as in the following examples.
-
In EPP-1 the first note prior to Step 7 provides important information
about the timing of particular tasks.
-
In EPP-1 the second note prior to Step 7 alerts the operator of the
need to execute other procedures within one hour if it becomes
necessary to perform those procedures. Because failure to perform
those procedures when required could result in substantial hazards, the
team believed that a caution was warranted rather than a note.
Further, because the information contained instructions of ongoing
applicability, the team believed that a step of continuous
applicability directing users to perform the referenced procedures was
required.
Logic statements were frequently not used in accordance with the WG
requirements for the presentation of decision criteria or were used in ways
that could potentially lead to operator error.
-
The Emergency Procedure Foldouts consisted almost entirely of
conditional statements that were not formatted as logic statements.
-
Long, complex, and embedded logic statements were especially common in
the AOPs.
For example, AOP-018, Section B, Step 5.4 contained logic
statements within other logic statements and a note between the IF and
THEN clauses of one of these.
Report Details
5
The team was concerned about the use of bulleted lists in procedures.
For
example, EPP-01, Step 5 directed checking that at least one steam supply to
the SDAFW pump is open. The use of bullets in the RNO action implied that
both valves would be opened when opening only one valve was required.
The team was concerned that requirements in procedures to transition to
other procedures in accordance with explicit or implied cross references
could severely hamper procedure use for mitigation of accidents. This is
identified as part of Violation 50-261/94-07-02, "Instructions, Procedures,
and Drawings Errors."
-
Procedure steps frequently indicated or implied that other procedures
needed to be used but did not specify the steps or section in those
procedures to use.
For example, AOP-013, Step 5.5 directed increasing
the level of water in the Spent Fuel Pit ". . .in accordance with
OP-019."
The absence of a more specific location for the referenced
information, require determining which portion of OP-019 would be used
and what prerequisite information was -applicable. The prerequisites in
OP-019 also included additional implicit cross-references to other
procedures (OP-603, OP-306,'OP-920,.and OP-906).
The step apparently
referenced in OP-019 (Step 8.1), included additional implicit
references (to OP-913 and OP-915).
Since these documents also included
implicit cross-references either as prerequisites or within the
(presumed) applicable sections, the chain of cross-references quickly
cascaded to include (at least) nine OPs, three FMPs, and one GP.
-
Cross-references were used when including the referenced information in
the original procedure would have better supported operators.
For
example, FRP-H.1, Step 1.b, directed a transition to a single step in
GP-007, which was also a cross-reference.
The Path procedures used in the simulator were reduced from the size
specifications stated in OMM-041. The page size specified in OMM-041 was
37 by 25 inches and the page size of the procedures used in the simulator
was approximately 24 by 18 inches.
The team believed that the graphics of the path procedures were
unnecessarily complex. For example, flowlines often contained turns
causing the paths to snake across the page. As specified in OMM-41,
multiple paths ending in a single location were-indicated with parallel
flowlines rather than by merging the lines into a single line. Neither
procedure users nor writers were aware of any advantage or reason for this
approach.
The path procedures appeared to be an effective tool for both quickly
diagnosing plant conditions and assisting in maintaining a "big picture"
perspective of events. Operators described techniques they used when
following these procedures in which they exploited the visual elements of
the procedures to keep track of information, review status, and plan ahead.
Report Details
6
The team believed that when these techniques were used, the Path procedures
provided the operators with substantially more assistance for maintaining
and using a "big picture" perspective than was provided in the text-format
procedures.
4. Simulator Observation
The adequacy of the approved site-specific EOP network was evaluated in two
simulator scenarios, a SGTR with a MSLB and a SBO, that were developed by
the team. The minimum crew specified in TS of 2 ROs, 1 SRO, a Shift
Foreman, and an STA, were used in the simulator control room. Two AOs were
stationed in the actual plant to simulate the local actions during each of
the scenarios. Based on these scenarios, the following observations were
made.
-
The mitigation strategy of the approved site-specific EOPs was not
followed during the simulator scenarios observed. For example, during
the SGTR with a MSLB, all the MSIVs were closed before entering the
diagnostic portion of the EOPs. This resulted in loss of the primary
heat removal system and potentially uncontrolled, unmonitored releases
through the MSL PORVs. If the EOP mitigation strategy had been
followed, closure of all MSIVs would not have been necessary. Also,
during the SBO, the EDGs were allowed to run without adequate cooling
for an extended period, even though both the high coolant temperature
and the high lube oil alarms for EDG "B" were lit. If the mitigation
strategy of EPP-1 had been followed, EDG "B" would have been shutdown
sooner.
Departures from the EOP network step sequences was an accepted plant
practice, was included in operator training, and was documented as
allowable by OMM-022. Specifically, OMM-022 stated the EOPs are a "tool"
for successful mitigation of an event. Therefore, performing EOP steps out
of sequence was allowed.
This practice was inconsistent with the ERG
mitigation philosophy in that the ERG mitigation boundaries were not
maintained. This could result in a plant configuration which would not
permit diagnosis, mitigation, or recovery using the approved site-specific
EOP network.
5. Verification and Validation
The licensee's program for V&V of the EOPs and EOP support procedures was
inadequate to provide assurance that the EOPs were written in accordance
with the applicable WGs, and could be performed, as written, under expected
conditions of use. A number of programmatic deficiencies were found in
this area. This is identified as part of Violation 50-261/94-07-04,
"Corrective Action Deficiencies."
The team reviewed the procedure history files for a sample of EOPs to
assess the V&V processes followed in procedure development.
For each
procedure, these files contained completed document change forms that
maintained the signatures of those individuals involved in reviewing
Report Details
7
procedure revisions, and various records of validation exercises and safety
analyses of the revisions. However, the team was unable to verify the
depth or completeness of the V&V reviews because the following information
was unavailable:
-
records of discrepancies identified and resolved during the check for
written correctness against the applicable WGs
-
records of the scenarios developed for simulator validation of the
procedures, the number of scenarios run, or the composition of the
crews involved in the exercises
-
records of discrepancies identified and resolved during the simulator
validation exercises and tabletop discussions of the procedures
-
records of the results of walkthroughs of the procedures with the
intended users to identify staffing, communications, equipment and
lighting requirements for performing local actions, as well as to
identify any procedure nomenclature or labeling changes required to
support performance of the procedure
-
records of specific user comments on the procedures that had been
incorporated into the revision, and
-
records of other procedures affected by the revision, contrary to
AP-022.
The governing administrative documents, AP-022 and OMM-043, do not require
that these records be maintained.
The team observed a simulator and tabletop validation of a revision to EPP
9. This procedure describes a set of time-critical actions that must be
performed when RWST level decreases to less than 27 percent. The goal of
the procedure is to transfer the SI and CS systems to the recirculation
mode. The validation process observed was deficient in many areas.
For
example, none of the steps in the RNO column were performed, although
revisions to these steps had been made. Further examples of weaknesses in
the procedure that were not identified by the validation process can be
found in Appendix D.
The team identified a good practice during the validation, in that an AO
was included on the validation team to provide comments on actions that
would be performed by AOs out of the control room. However, the team was
told in interviews that this is not a common practice.
Disciplines other than licensed operators who must perform steps in the
EOPs, such as chemistry and health physics personnel, are not typically
involved in reviewing and validating the procedures. In a talk-through
with a chemistry specialist of FRP-J.2, it was identified that Step 2 of
Report Details
8
this procedure, which states "Sample CV Sump Water for Activity," cannot be
performed. Chemistry would only be able to sample CV sump water from the
RHR system. Records reviewed in the procedure history file for this
procedure confirmed that chemistry had not been required to review it.
Procedure reviewers are not trained to perform the reviews required in OMM
043.
Guidance for performing the reviews is contained in AP-022 and OMM
043, and checklists for the reviews are provided. Although the guidance
suggests that reviewers walk through the procedures, walkthroughs are not
required to consider such issues as available lighting, step-sequencing,
manpower requirements, correspondence between procedural information and
information on labels and tags, availability of necessary tools and
equipment, and communications requirements. As a result, the technical and
usability deficiencies described in Section 3.0 of this report were
identified during the team's walkthroughs of the procedures, but had not
been identified through the licensee's V&V program. Further examples of
procedural deficiencies that were found by the team but had not been
identified by the licensee can also be found in Appendix D.
6. Management Control of EOPs
The team reviewed the procedures that provided the management controls for
the EOPs and the EOP procedural network. These included the controls for
programs such as:
procedure maintenance, setpoint control, training, and
audits. The team identified some weaknesses in each of the program areas
reviewed.
a. Setpoint Control
The team reviewed the EOP setpoints that were contained in "Emergency
Operating Procedures Setpoints Document Final Report," dated
January 27, 1993. The information the setpoints were based upon was
circa 1990 information, much of which is out of date. The setpoints
have not been verified by the licensee, and there were no
administrative controls to ensure that modifications to instrument
loops were reviewed for setpoint implications.
b. Procedure Maintenance
The team reviewed the EOP procedure maintenance program. The team
found there were no administrative controls to ensure that operator
comments from LORP on EOPs, AOPs, or support procedures were reviewed
for procedural inclusion. There were also inconsistent administrative
controls to feed comment resolution back to the comment originator.
The team witnessed the informal program that gathered and reviewed the
LORP comments. The team concluded that the licensee had not devoted
sufficient resources to effectively administer the program.
Report Details
9
c. Training
The team observed that AO training did not encompass complete
procedures in the EOP network. Training appeared to focus on the
performance of specific in-plant steps in the EOPs and support
procedures, rather than on developing an understanding of the overall
mitigation strategy and the role of the in-plant actions in
accomplishing EOP goals.
d. Audits
The 1989 NRC EOP inspection identified inadequate QA involvement in EOP
development prior to implementation. To determine if QA involvement
had increased since that time, the team requested the results of audits
performed by the QA organization since the 1989 NRC EOP inspection.
The team was informed that the QA group had been replaced by NAD in
1991, and there were no records of any audits by either of the groups
during the period.
The team was provided with one technical comment sheet, dated March 22,
1993, which was based on an independent review of EOP setpoints. The
independent review, while documented only as a comment, identified
problems with EOP setpoints. These included math errors in the
subcooling monitor setpoints, multiple errors in the PZR Level setpoint
and incorrect data supplied to the vendor that performed the setpoint
calculations. On March 26, 1993, a meeting was held between NED and
Operations on the setpoint issues. The decision was made to extend
NED's review deadline and look at all of the calculations. The budget
was later cut and the deadline was extended again. The items have
still not been corrected, and by procedure, the NAD comments have been
purged from the computer records.
While there are multiple causes for the setpoints not being corrected
in a prompt manner, the root cause is a breakdown in the program
controls for the NAD organization. The NAD program manual requires
that comments either be elevated to findings status, or purged after
one year. Although this was the only time in five years that the EOP
program had any portion reviewed, there were known problems with the
EOP program, and this NAD independent review identified problems with
EOP setpoints which could have operational impact, the comments were
deemed not significant enough to be elevated to a finding. Without
being elevated to a finding, there were no required corrective actions,
no formal or documented NAD follow up, no timely review of other
potentially impacted setpoints, and the records were purged after 12
months.
The program that allowed a deficiency to be handled in this manner and
required the records of this inappropriately handled finding to be
destroyed after 12 months, does not meet the requirements of 10 CFR 50,
Appendix B, Criterion XVII, "Quality Assurance Records" which requires
in part, "Sufficient records shall be maintained to furnish objective
Report Details
10
evidence of activities affecting quality and that the records shall
include audits, and the records shall be identifiable and retrievable."
The program also is inconsistent with TS 6.10.2.k which requires, in
part, records of the independent reviews by NAD be maintained for the
duration of the operating license. The program is also inconsistent
with PLP-026 which requires in part that conditions adverse to quality
be identified and promptly corrected. Additionally, the program is
inconsistent with 10 CFR 50, Appendix B, Criterion XVI, "Corrective
Actions Deficiencies."
The team felt that the programmatic aspects of
the QA/NAD were ineffectual and that this represented a violation of
the basic QA program guidelines. This is identified as Violation
50-261/94-07-01, "Quality Assurance Program Deficiencies"
e. Configuration Control
In the review of EOP setpoints the team identified a RPS power supply
configuration error. This power supply was used for RPS pressurizer
level instrument loops and consequently affects the EOPs through the
EOP setpoint calculations. The power supply on the controlled drawings
was a Hagan Model 121 Loop Power Supply. This was a 45-volt power
supply. The power supply that was actually installed was a Lambda
Model 122-137. This was a 40-volt power supply. After further NRC
investigation it was determined that there were a total of twenty power
supplies installed that were of a different type and of a lower voltage
rating than the power supply depicted on the drawings, and that the
discrepancy had apparently existed for more than 25 years. The
licensee issued an ACR to investigate this problem after the 20 power
supplies were identified as deficient by the inspectors. The specific
transmitters and Hagan Wiring Diagrams are listed in Appendix C. This
is identified as part of Violation 50-261/94-07-02, "Instructions,
Procedures, and Drawings Errors."
AOP-017 did not identify CVC-353 as a locked closed valve. P&ID
5379-685, Sheet 2 indicated the valve was locked closed. The team
inspected the valve and determined the P&ID, rather than the procedure,
was correct.
f. Document Control
The team identified that the controlled copies of AOP-004 in the EOF
and the technical library were incorrect in that 13 of 21 pages were
missing. The copies were replaced. The team ensured the copies in the
control room were correct. The licensee did write an ACR or
investigate the deficient condition. The team selected a sample of
procedure revisions to determine if the problem was isolated to a
single occurrence. It was not. The team identified problems with the
controlled copies of PEP-104, APP-048, OST-010, and OST-551. These
copies included the Emergency On-site Facility copies. The condition
Report Details
11
of the copies made the procedures unusable. Following the team's
findings, the licensee issued an ACR and identified several additional
controlled drawing deficiencies. The team identified this as Violation
50-261/94-07-03, "Document Control Deficiencies."
g. Corrective Actions
The team found that many of the weaknesses identified in NRC Inspection
Report No. 50-261/89-16 have not yet been resolved. These weaknesses
include (1) needed equipment for some required actions is not
prestaged, mentioned in the procedures, or always easily available, (2)
the plant verification and validation process continues to be
inadequate, (3) no process has been established to ensure that changes
to equipment or other procedures that affect the EOPs and EOP support
procedures are identified and result in the necessary procedure
revisions, (4) no requirement for in-plant walkthroughs of procedures
has been incorporated into the governing EOP program documents, (5)
staffing for all disciplines who must perform actions in the EOPs and
support procedures (e.g., Instrument and Controls, chemistry) is not
provided round the clock, and (6) independent job performance aids for
Auxiliary Operators who must perform multiple local actions have not
been developed for actions other than a few in the dedicated shutdown
procedures. The failure to adequately address these weaknesses is
identified as part of violation 50-261/94-07-04, Corrective Action
)
Deficiencies.
7. Exit Interview
The inspection scope and findings were summarized on March 25, 1994, with
those persons indicated in paragraph 1. The NRC described the areas
inspected and discussed in detail the inspection findings listed below. No
proprietary material is contained in this report. No dissenting comments
were received from the licensee.
Item Number
Status
Description/Reference Paragraph
50-261/94-07-01
Open
VIO - Quality Assurance Program
Deficiencies (paragraph 6.b)
50-261/94-07-02
Open
VIO -
Instructions, Procedures, and
Drawings Errors (paragraphs 2, 3 6.e)
50-261/94-07-03
Open
VIO - Document Control Deficiencies
(paragraph 6.f)
50-261/94-07-04
Open
VIO - Corrective Action Deficiencies
(paragraph 4, 5, 6.g)
APPENDIX A
Auxiliary Building
Auxiliary Operator
Abnormal Operating Procedure
Administrative Procedure
APP
Annunciator Panel Procedure
Component Cooling Water
Critical Safety Function Status Tree
Condensate Storage Tank
CV
Containment Vessel
Diesel Generator
DS
Dedicated Shutdown
DSDG
Dedicated Shutdown Diesel Generator
DSP
Dedicated Shutdown Procedure
Emergency Operating Procedure
End Path Procedure
Emergency Response Guideline
Flow Control Valve
Functional Recovery Procedure
General Procedure
gpm
gallons per minute
Heating Ventilation and Air Conditioning
LORP
Licensed Operator Requalification Program
Motor Driven Auxiliary Feedwater
Main Steamline Isolation Valve
Main Steamline
Main Steamline Break
NAD
Nuclear Assessment Department
NED
Nuclear Engineering Department
OMM
Operations Management Manual
OP
Operating Procedure
POG
Plant Operations Guideline
Power Operated Relief Valve
PSTG
Plant Specific Technical Guidelines
PZR
Pressurizer
Quality Assurance
RC
Reactor Coolant Pump
RNO
Response Not Obtained
Reactor Operator
Reactor Turbine Generator Board
Reactor Vessel Level Information System
Reactor Water Storage Tank
S/G
Steam Generator Tube Rupture
Safety Injection
Appendix A
2
Station Blackout
Steam Driven Auxiliary Feedwater
SDD
Step Deviation Document
Senior Reactor Operator
Turbine Building
Verification and Validation
WG
Writer's Guide
Wide Range
Westinghouse Owners' Group
APPENDIX B
I
PROCEDURES REVIEWED
Procedure
Title
Revision
Malfunction of Reactor Control System
5
Emergency Boration
4
Control Room Inaccessibility
5
Radiation Monitoring System
10
Turbine Eccentricity/Vibration
5
Turbine Trip Without Reactor Trip Below
2
P-7
Accidental Release of Liquid Waste
2
Accidental Gas Release from a WGDT
3
Inadequate Feedwater Flow
7
Loss of Circulating Water Pump
2
Partial Loss of Condenser Vacuum
7
Fuel Handling Accident
5
Loss of Component Cooling Water
4
Secondary Load Rejection or Turbine
3
Runback
Excessive Primay Plant Leakage
7
Loss of Instrument Air
10
Reactor Coolant Pump Abnormal Conditions
5
Malfunction of RCS Pressure Control
3
Loss of Residual Heat Removal (Shutdown
13
Cooling)
Seismic Disturbances
6
Loss of Service Water
10
Loss of Containment Integrity
6
Loss of Instrument Bus
5
Low Frequency Operation
3
Operation with Degraded System Voltage
6
Appendix B
2
Procedure
Title
Revision
ISFSI Abnormal Events
2
Loss of DC Bus "A"
2
Loss of DC Bus "B"
2
Operation with High Switchyard Voltage
1
Accidental Release of Water from the Fire
1
Protection System
EPP-1
Loss of All AC Power
11
EPP-2
Loss of All AC Power Recovery without SI
9
Required
EPP-3
Loss of All AC Power Recovery with SI
7
Required
EPP-4
Reactor Trip Response
8
EPP-5
Natural Circulation Cooldown
6
EPP-6
Natural Circulation Cooldown with Steam
4
Void in Vessel
EPP-7
SI Termination
11
EPP-8
Post LOCA Cooldown and Depressurization
6
EPP-9
Transfer to Cold Leg Recirculation
13
EPP-10
Transfer to Long Term Recirculation
7
EPP-11
Faulted Steam Generator Isolation
3
EPP-12
Post SGTR Cooldown Using Backfill
5
EPP-13
Post SGTR Cooldown Using Blowdown
5
EPP-14
Post SGTR Cooldown Using Steam Dump
5
EPP-15
Loss of Emergency Coolant Recirculation
7
EPP-16
Uncontrolled Depressurization of All Steam
7
Generators
EPP-17
SGTR with Loss of Reactor Coolant:
7
Subcooled Recovery
EPP-18
SGTR with Loss of Reactor Coolant:
6
Saturated Recovery
EPP-19
SGTR without Pressurizer Pressure Control
5
Appendix B
3
Procedure
Title
Revision
EPP-20
LOCA Outside Containment
3
EPP-21
Energizing Pressurizer Heaters From
5
Emergency Busses
EPP-22
Energizing Plant Equipment Using Dedicated
7
Shutdown Diesel Generator
EPP-23
Restoration of Cooling Water Flow to
1
Reactor Coolant Pumps
EPP-24
Isolation of Leakage in the RHR Pump Pit
3
EPP-25
Energizing Supplemental Plant Equipment
0
Using the DSDG.
EPP-Supplements
Supplements
10
EPP-Foldouts
Foldouts
13
FRP-S.1
Response to Nuclear Power Generation/ATWS
6
FRP-S.2
Response to Loss of Core Shutdown
3
)
FRP-C.1
Response to Inadequate Core Cooling
6
FRP-C.2
Response to Degraded Core Cooling
5
FRP-C.3
Response to Saturated Core Cooling
3
FRP-H.1
Response to Loss of Secondary Heat Sink
7
FRP-H.2
Response to Steam Generator Overpressure
3
FRP-H.3
Response to Steam Generator High Level
5
FRP-H.4
(MISSING - SDD but no procedure)
FRP-H.5
Response to Steam Generator Low Level
3
FRP-P.1
Response to Imminent Pressurized Thermal
7
Shock
FRP-P.2
Response to Anticipate Pressurized Thermal
4
Shock
FRP-I.1
Response to High Pressurizer Level
3
FRP-I.2
Response to Low Pressurizer Level
3
FRP-I.3
Response to Voids in Reactor Vessel
6
FRP-J.1
Response to High Containment Pressure
3
Appendix B
4
Procedure
Title
Revision
FRP-J.2
Response to Containment Flooding
2
FRP-J.3
Response to High Containment Radiation
3
Level
OMM-022
Emergency Operating Procedures Users Guide
4
OMM-040
Writers Standard for Operations Procedures
3
OMM-041
Writer's Guide for the Development and
1
Revision of Flowpath and Two Column Format
Procedures
OMM-042
Writer's Guide for the Development and
3
Revision of Single Column Format
Procedures
OMM-043
Verification and Validation
2
AP-022
Document Change Procedure
15
POG-044
Operations Procedure Review
1
DSP-002
Hot Shutdown Using The Dedicated/Alternate
11
Shutdown System
Reactor Coolant System And Reactor Coolant
27
Pump Startup And Operation
APPENDIX C
REACTOR PROTECTION SYSTEM DRAWING ERRORS
TRANSMITTER #
HAGAN WIRING DRAWING #
1
PT-444
5379-3532
2
PT-445
5379-3532
3
PT-455
5379-3531
4
PT-456
5379-3531
5
PT-457
5379-3483
6
LT-459
5379-3482
7
LT-460
5379-3530
8
LT-461
5379-3501
9
LT-474
5379-3518
10
LT-475
5379-3513
11
LT-476
5379-3513
12
LT-477
5379-3518
13
LT-484
5379-3516
14
LT-485
5379-3514
15
LT-486
5379-3514
16
LT-487
5379-3516
17
LT-494
5379-3517
18
LT-495
5379-3513
19
LT-496
5379-3515
20
LT-497
5379-3517
21
FT-932
5379-3508
22
FT-933
5379-3508
APPENDIX D
VALIDATION AND VERIFICATION DEFICIENCIES
The following examples of weaknesses in the licensee's validation process were
identified during the simulator validation of EPP-9:
-
Cross-references, including entry conditions, to and from the procedure
were not performed, so that potential effects of the revisions on the
procedures were not evaluated.
-
A full shift complement was not used in the exercise to validate that the
actions can be coordinated among crew members without physical
interference.
-
The process failed to note that the SRO did not read aloud about half of
the procedure steps verbatim, but rather paraphrased the content of the
step, and failed to recognize the additional mental workload associated
with having to translate steps in this fashion.
-
The process failed to note that Step 1, which states, "Perform Steps 1
Through 18 Without Delay," is supplementary/descriptive information rather
than an action step and that "without delay" is vague.
-
The process failed to note that Step 2 is a caution, rather than an action
step.
-
The process failed to note that the licensee practice of RO repeat-backs of
procedure steps could not be implemented for Steps 3 and 45 because they
are too long and complex. The team observed that the RO did not attempt to
repeat back these steps.
-
The process failed to note that the RO required clarification from the SRO
regarding the intent of the first bullet in Step 7.a because it is stated
negatively rather than positively.
-
The process failed to note that the third bullet in Step 7.a refers to
stopping ALL RHR pumps, implying there are several, rather..than to stop
BOTH RHR pumps, as there are only two. The RO repeated this step back as
"both," but validators failed to notice the discrepancy between the
language in the procedure and common operator usage.
-
The process failed to note that the SRO had to ask the RO, in Step 7.b,
which CV spray pump was stopped and that the procedure did not include an
instruction to the RO to report back this information.
-
The process failed to note that Step 7.c is missing an OR between the two
bullets. As formatted, this step implies that both sets of valves should
be closed, but that the order of closing them is at the operator's
discretion.
Appendix D
2
-
The process failed to note that Step 10 includes conditional information
but is presented as an action step.
-
The process failed to note that Step 11 does not indicate that an RO must
obtain keys and perform the action at a back cabinet.
-
The process failed to note that Step 12 states that keys must be obtained
before performing the actions, and so is inconsistent with Step 11.
-
The process failed to note the implications of the time-critical nature of
this procedure in Step 12.
This step requires four actions to be performed
at physically separated locations, but the step directs that only one
operator be dispatched to perform them. Further, validators failed to note
that the three AOs typically available on shift, may be unavailable to
perform this step because they were dispatched to perform the Attachments
in Step 10 and would be unlikely to have finished those actions before Step
12 must be performed.
-
The process failed to note that the SRO did not wait for confirmation that
Step 12 was completed before performing Step 13.
-
At Steps 23-26, the RWST level fell to 6.87 percent before actions
dependent upon it being less than 9 percent were performed. Although RWST
level was shown on the SPDS, the RO used a small-faced mechanical gauge to
)
obtain level information and may not have been able to see when level fell
below 9 percent.
-
The process failed to identify that, at Step 24, the operators were put in
a "do loop" when they reached this step because the level was not below 9
percent but was at 11 percent. If he returned to Step 21, the question
arose as to whether another RHR pump should be started. The SI pump was
not secured until less than 9 percent in the RWST was obtained, which
brings up the question of the adequacy of the NPSH at levels below 9
percent.
-
The process failed to note that Step 34 is formatted as an action step,
when in fact it is a critical caution that protects against potential
damage to the fuel.
-
The process failed to note that the first sentence in Step 45 is a note,
rather than an action step.
-
The process failed to identify that Step 1 in Attachments 1 and 2 are
cautions rather than action steps.
-
The process failed to note that Steps 2.a-d in Attachment 1, Steps 2.a, b,d
and 3 in Attachment 2, and Steps 1.a, b, d and e in Attachment 3 are
conditional steps but are not formatted as such.
-
The process failed to note that Step 3 of Attachment 3 is a conditional
step formatted as a logic statement.
Appendix D
3
-
Written comments from the validation team were not encouraged to be
maintained in the procedure history file as a record of the basis for the
design of the procedure.
The following are examples of procedural deficiencies identified by the team
were not found through the licensee's V&V process prior to approval and
implementation:
-
Substeps 13a, b, and c of EPP-1 must be performed inside the EDG room.
Because of potential signal interference, portable radios could not be used
to communicate while in the EDG room, and the PA system would be inoperable
at this point in the procedure. No emergency lighting was provided at the
EDG control panel, and the EDG room was behind a heavy fire door that is to
remain closed during these activities. If an EDG could not be started, the
operator must leave the EDG room to open the starting air solenoid valves,
return to check if an EDG has started, then leave again to close the
starting air solenoid breakers.
-
The Caution tags on the root isolation valves for PX-1619A and B on the SW
outlet from the CCW heat exchangers, which were required to be opened in
Step 34.a.2 in the RNO column of EPP-1, were broken, melted and could not
be read. The cautionary information contained on the tags was not provided
in the procedure.
-
Substep sequencing for Step 37 in EPP-1 was organized by system rather than
by the location at which the actions must be performed. Consequently, if a
single operator was required to perform these steps in order, for Substep
37.a, he would be required to perform two actions in the AB and two in the
TB. For Substep 37.b, he would have to perform one action in the AB and
another in the TB. For Substep 37.c, again he would perform one action in
each building. Substep 37.d would be performed in the AB, and then Substep
37.e would be performed in the TB. Because manpower requirements were not
addressed in the header for this step, control room personnel might assign
one individual to perform all of these steps, rather than assign them to
the "inside" AO (stationed in the AB) or the "outside" AO (stationed in the
TB), as appropriate, potentially resulting in unnecessary delays in
completing the step.
-
A key was required to operate the pressurizer heater breaker arm switch in
Step 11.b of EPP-21.
However, the procedure did not provide direction to
obtain the key until Step 7, on the second page of the procedure, following
local actions in Steps 5 and 6. The key must be obtained in the control
room.
-
In EPP-22 at Step 2, the operator was required to locally open five
Dedicated Shutdown Bus Breakers. Although the cabinets in which the
breakers were contained had cabinet numbers on them in large, easily
visible labels, this location information was not used in the procedure.
Consequently, an operator would be required to search a bank of breaker
cabinets to identify the correct cabinet for each action and to read small,
visually busy cabinet labels that did not agree with the breaker titles
Appendix D
4
provided in the procedure. Further, although these actions could be
performed in any order from a technical perspective, they were not
presented in the procedure in any systematic sequence (e.g., left-to-right,
top-to-bottom) that could reduce an operator's search time. This same step
was also used in Step 3 of EPP-25.
-
Although plant procedures required that only a diesel-qualified operator
perform the local actions in EPP-22, there was no administrative process
for ensuring that a diesel-qualified AO was always available on-shift.
-
Step 1 of Attachment 1 to EPP-22 directed the operator to verify that
Battery Charger A and A-1 breakers were "OPEN," whereas the indication on
the breaker panels read "OFF."
These same steps were used in Attachment 1
to EPP-25.
-
Procedures referenced in DSP-002 were maintained at the Secondary Control
Panel in a notebook. However, no laydown space was available for the
procedures, making it difficult to follow them while performing actions or
especially to track concurrent performance in multiple procedures.