ML15244A714
| ML15244A714 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 11/21/1991 |
| From: | Thadani A Office of Nuclear Reactor Regulation |
| To: | Varga S Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML15244A713 | List: |
| References | |
| NUDOCS 9201290190 | |
| Download: ML15244A714 (12) | |
Text
+
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, 0. C. 20555 November 21, 1991 NOTE FOR:
Steve Varga FROM:
Ashok Thadani
SUBJECT:
OBSERVATIONS AT OCONEE The attached memorandum from Warren Lyon reflects his observations regarding Duke Power Operations of the Oconee units. These observations are based on Warren's interviews of several members of operating staff while he was a member of the AIT inspections conducted during Sept. 10-13 and Sept. 20-23. Although Warren's memorandum reflects subjective views of some Duke Power operating staff regarding the level of attention given to shutdown activities, it would be prudent to conduct either a follow up inspection or to ask Duke Power to discuss their outage planning, control, procedures training, etc. DST would support you or the regions as needed regarding this matter.
Ashok Thadani 9201290190 920121 PDR ADOCK 050002 G
Ip.R REG&I.9 s
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, 0. C. 20555 November 21, 1991 MEMORANDUM FOR:
Stephen A. Varga, Director Division of Reactor Projects -
I/II THRU:
Ashok C. Thadani, Director Division of Systems Technology FROM:
Warren C. Lyon, Sr. Reactor Engineer PWR Systems Section Reactor Systems Branch Division of Systems Technology
SUBJECT:
OBSERVATIONS AND PERSPECTIVE FROM MY INSPECTION ACTIVITIES AT OCONEE, SEPTEMBER 10 -
13 AND SEPTEMBER 20 -
23, 1991
1.0 BACKGROUND
AND PERSPECTIVE Duke power operates three B&W 2568 MW(t) units at the Oconee site.
(Operating B&W units range from 2452 MW(t) to 2772 MW(t).)
The site has a 95.5% capacity factor between refueling outages according to the licensee; and the seven outages before the last Unit 1 outage lasted from 41 to 45 days, essentially on schedule. These times are at the lower limit of the plants I visited during the past year. For perspective, Prairie Island completed a 29 day refueling outage this fall and they've averaged 38 days over the past 10 outages. A number of larger plants use a 50 to 55 day outage as a reasonable goal that their management feels does not compromise safety. (Safety cannot, in my opinion, be correlated with outage time. There are many factors.)
There appears to be an increasing trend in shutdown problems at Oconee that began one or two years ago. Problems I judge to be of greatest significance that occurred during the past half year are:
(1) (3/8/91 Au mented Inspection Team (AIT)) 9800 gal of reactor coolant system RCS) water and 4500 gal of borated water storage tank water flowed into the containment sump. Residual heat removal (RHR) was lost for 18 minutes. Core temperature increased 25*F due to loss of RCS cooling, Reactor cavity dose rate increased from 80 to 8000 mrem/hr, apparently due to the reduced water level.
(2) (9/7/91, AIT) Low pressure service water to the RHR heat exchangers was lost. This was discovered four hours later when water above the core was discovered to be "roiling" and steam was observed in containment.
(3) RCS filling was started with people in the in-core instrumentation tank.
These people "heard water gurgling" and left the tank.
(4) Control rod drives were found to be energized with no rod drive cooling.
Stephen November 21, 1991 (5) Pressurizer level went off-scale high while operators were attempting to fill the core flood tanks. Steam generator handholes were open and RCS water would have been lost if RCS level had reached the openings.
(6) (9/19/91, AIT) The RCS was pressurized while the RHR system was improperly configured. Parts of the RHR system were overpressurized and 12,000 gallons of water were lost.
I was assigned event significance, outage planning, and outage implementation for the September 7 event AIT; and event significance, personnel stress, and training for the September 20 event. I discussed these and related topics with reactor operators (ROs), senior reactor operators (SROs), Unit Supervisors, and Shift Supervisors associated with the events; senior training and planning personnel; the Oconee plant manager; engineering personnel; analysts; and others.
(Each meeting or interview was usually longer than 1/2 hour and most were limited to myself and the Oconee individual. Some lasted several hours or more.)
I reviewed selected procedures, and spent roughly two days inspecting the plant, including.containment, the control room (CR) and the auxiliary building.
My in-depth participation in shutdown activities initiated with participation in the AIT investigating the Diablo Canyon event of April 1987. Since then I have participated in meetings with licensees, owners groups, headquarters and regional staff, the ACRS, and others; and have prepared generic letters, temporary instructions, and other communications regarding shutdown operation.
In the past three years, I have been on 24 trips to plant sites in this country to obtain information and to participate in regional inspections, AITs, and an IIT. Most of these included significant time walking the plants and studying shutdown operation. The remainder of this communication provides observations and perspectives on a few aspects of shutdown operation at Oconee relative to this background. I will comment on outage planning, outage implementation (including instrumentation), procedures, training, personnel stress, safety, and plant management.
2.0 DISCUSSION OF SELECTED OCONEE SHUTDOWN OPERATION TOPICS 2.1 Outage Planning 2.1.1 Anticipated Work Oconee outage planning appears to address most work iteis that must be accomplished during an outage. The number of unanticipated work items is small.
The planning accommodates unscheduled perturbations and allows response to unscheduled outages. I judge planning to be better than average with respect to these criteria.
2.1.2 Safety Licensees often provide planning guidance for meeting ALARA and industrial safety considerations, but do not address the measures'necessary to protect public health and safety. Sometimes the safety criteria are understood, but
Stephen November 21, 1991 not well documented. The Superintendent of Integrated Scheduling told me nothing provides guidance for outage safety, and that safety comes from review of the outage plan by Oconee personnel. I believe the review is accomplished using each individual's personal criteria for safety, and that these are not documented. As such, they are subject to change. I have seen a similar approach at several plants.
Oconee's Integrated Scheduling Directive provides criteria and assigns responsibilities for outages. One criterion is "Start early and with heavy manpower so that hidden problems will surface with time to react."
This document provides no comparable criterion or caution that addresses coincidence of this activity with the time of greatest decay heat and potentially greatest risk.
I believe Oconee is below average in providing safety guidance.
2.1.3 Outage Length Four operators* told me Oconee's outages were too short. A number of licensees with large plants, including plants roughly comparable to Oconee's, have told me that 50 to 55 days was the minimum they foresaw for a routine refueling outage without beginning to jeopardize safety. (The latest Oconee refueling outage was not routine - their routine outages are in the low 40 day range.) I have seen outages in the Oconee range that appeared to be conducted smoothly, and I saw one in this range where I have reservations regarding their approach to safety. We cannot generalize on the basis of time alone.
Many factors must be considered. However, I believe that there is too much emphasis on a short outage at Oconee,' and that this is illustrated by some of the difficulties identified in this memorandum.
2.2 Outage Implementation 2.2.1 Coordination and Control Oconee conducts the usual well focused outage meetings I've seen at many plants with status information provided to the participants. One of their overview tools for assessing plant sensitivity will be, when improved, one of the best I have seen. These meetings also provide a forum for recognition of potential safety problems, and such tools provide a focus and enhance safety sensitivity. The lack of clear safety criteria, as identified in Section 2.1.2, is a weakness in outage implementation in the same way as it is for outage planning.
- I will misuse "operators" to describe ROs, SROs, Unit Supervisors, and Shift Supervisors directly involved in CR operations. I interviewed seven operators in depth. An eighth was not on shift, but was in thiCR area during an event, and we conducted a short interview with him. Most feedback is from the seven.
Stephen Nove r 21, 1991 Oconee can usually accommodate unforseen work while maintaining the schedule, and the fraction of such work is smaller than in most plants I have visited.
They control outage schedules and seldom significantly extend outages.
The Superintendent of Integrated Scheduling (the planning manager) told me that his measure of success is how well the unit runs after the outage and how many return work requests are received on equipment worked during the outage.
He said that Oconee's history shows that their outage planning and implementation meet these success criteria.
I have been in plants where outage activities were coordinated from a location adjacent to the CR while maintaining close coordination with CR operators.
This helped to minimize interference with plant control and contributed to a reduction in CR activity. Oconee Units 1 and 2 have a combined CR that is smaller than many CRs for a single unit. Numerous outage activities are coordinated from the CR and extra personnel are assigned to these activities.
The CR was extremely busy every time I was there. I additionally believe that engineering personnel are intimately involved in many of these activities, often preempting typical operator functions. I judge Oconee to be below average regarding interference of the outage with operation of the plant.
2.2.2 Outage Operations Oconee's operators take pride in their work and they took full responsibility for the errors leading to the events I investigated. For example, the operators responsible for manipulating the controls during the September events told me they "felt terrible" because they had let down both their co workers and Oconee. The SRO's similarly felt they should have done better in providing supervision and maintaining an overview of plant operation and took responsibility for causing the events.
Eight operators said the work load was high or very high. I -was also told (often by more than one operator) that they made the schedule with difficulty, that they sometimes took on more work than they could handle, and that they had to cut corners (one operators words) to stay on schedule - and then had to make repairs later. I have heard similar comments in other plants, but not as universally and not from operators who started interviews with an attitude of having made a mistake for which they felt solely responsible.
Operators further told me that they wrote procedures at the last minute in the CR when the need had been known for months, operated without some procedures (two operators), had inadequate procedures for shutdown (four operators),
and sometimes took on more jobs than they could handle and then got into trouble when something went wrong. Operators told me work was often completed that required later work to "make it right."
At first glance, this is inconsistent with their power operating record as described to me, but I was provided with one example of an inappropriate repair at power, and I was told there were many others.
Note that immediately prior to the latest event operators were concentrating on an HPI pump that did not meet temperature acceptance criteria. I understand they passed the test by 10F by-maximizing flow
Stephen November 21, 1991 through the pump to maximize cooling. According to one operator, there was a controversy in the CR involving whether to deviate from or rewrite the procedure to allow the pump to pass if the pump failed to pass the test.
(The pump was required prior to initiating significant RCS heatup and pressurization.)
Both the pump and motor were later replaced.
Three operators felt they had poor communications and were not operating as an effective team. (Conversely, one operator stated this was their strong point.)
In one event, not one of the four ROs and the two SROs in the CR looked at key parameters on the control board for four hours. They were all distracted with shutdown problems not associated with controlling the plant. In another, there was no supervision to assure the proper procedures were in use, in part because the Unit Supervisor told an RO by telephone that Unit 1 was cleared to increase pressure to 300 psi.
This bypassed the SRO, who said after the event that he did not know the plant was moving.
(He was busy with outage problems at the time and was not performing his overview responsibility.) There also appears to be participation of non-operators in operations in ways that reduce operator responsibility and, in my judgement, could led to ROs and perhaps SROs automatically responding to direction instead of staying aware of the plant.
condition.
I often find operators in the CR watching the boards, going over evolutions, and studying upcoming procedures, in addition to performing outage-related activities. At Oconee I saw operators involved in outage activities during several visits to the CR, and it was not always obvious to me that someone was watching the boards.
2.2.3 Instrumentation Oconee Unit 1 (the only unit where I entered containment) has a single RCS water level indication between the lower range of pressurizer indication and the midloop elevation. This depends upon pressure difference sensing. They are considering adding a second indication. Midloop is covered by two ultrasonic level indications plus the above indication, one of the better coverages I have seen. I judge that monitoring of RHR pump operation fails to meet the Generic Letter (GL) 88-17 recommendation for anticipatory problem indication. I also found inadequately installed level instrumentation inside containment and damaged instrument tubing. Alarms were set inappropriately.
I have seen these deficiencies at other plants. However, with the exception of the ultrasonic midloop level indication, I judge Oconee's thermal/hydraulic shutdown instrumentation/monitoring/alarm capability to be below average.
2.3 Procedures I provided comments on procedures in the above discussion. Procedures adequacy needs to be put into perspective. For example, Oconee uses a conservative definition of midloop that provides more water in the reactor vessel than recommended in GL 88-17. This significantly increases time to core uncovery when compared to following the GL 88-17 recommendations: They are also the
Stephen November 21, 1991 only licensee I have seen who provides supplemental ac power to close the equipment hatch should all ac power be lost.
Although the Oconee shutdown operation procedures have numerous deficiencies, this is a condition I've seen in many plants. Oconee appears to prepare more procedures in the CR than other plants, and sometimes depends upon operator knowledge to conduct evolutions without procedures. With these exceptions, the Oconee procedures I reviewed are about average.
2.4 Training The Director of Training described training as divided into two areas:
(1) Formal classroom and simulator training under his direction, and (2) On-the-job training under the shift supervisors, who receive direction and supervision from the Shift Operations Manager.
The Director of Training said that operators often don't understand or want to know what drives training. He said the end product of initial operator training is an exam that must meet NRC requirements, and Oconee meets that.
He believes that operators have an excellent background in the plant when they have completed their initial training. The other aspect of formal training is for requalification. He noted that last year Oconee had two team failures and six individual failures on requalification exams, and this year only one person failed. This was attributed to a change in training to concentrate on the requalification exam. He then described Oconee as being behind the industry in simulator training, that the trend at Oconee and Catawba is not good, and that he considers the fact that Oconee hasn't solved the problem that resulted in three AITs to be an embarrassment. He said he is adding more integrated control systems and shutdown training into this year's program, and that Oconee is probably going to cut back on the number of licenses (120 to 130 now) to allow better training for those who need licenses.
The Director of Training described the on-the-job training as "paramount," but also described this as probably the weakest part of the training program.
Five operators stated that formal training was for requalification and that it did not meet their operations needs. One stated that training this way was a waste of time, and they needed material that was useful in operating the plant. Three said they need plant and procedures trajiing, four said they need systems training, and three said they need to be trained on plant changes. One said he'd had no overall systems training for four years.
(Other stated times were a year or so less.)
Two operators cited simulator inadequacy as a problem and three said training was better before the change to concentration on requalification. (One described a big part of requalification training as studying typical exam questions, and several provided a similar perspective.) None criticized the need to train on 4k
Stephen November 21, 1991 accidents initiating from power that would normally not be encountered during operation, which apparently takes a significant part of training time.
Seven operators expressed reservations regarding training for shutdown operation. Four said they needed training for outages. They described outage training as being given a package of material to study during the outage.
This package was described as being many inches thick and partly containing vendor literature that was inappropriate to training needs (four operators).
The process was that the operators were to read the material and then sign a form stating that they had done so. One stated that the work load is very heavy during an outage and this is not the time to study training material, a perspective that appeared to be shared by the other operators. Three volunteered the perspective that there were major training deficiencies.
Three operators stated the Oconee training staff was well qualified. Several commented on the excellence and cooperativeness of the Director of Operator Training, although one thought the Director did not respond to their needs.
Oconee's formal training of previously licensed operators has not addressed any of the major aspects specific to shutdown operation since the licensee responded to Generic Letter 88-17 ("Loss of Decay Heat Removal...
").
I am used to finding outage specific training, including in some cases training specific to unusual evolutions. I found none of this at Oconee.
I judge Oconee's training for shutdown operation to be poor when compared to other plants I have visited.
2.5 Stress I understand engineering personnel provide estimated job times and that this is worked into a schedule that is presented to the Plant Manager. He stated that he adds two days to this schedule and defines meeting that schedule to be "world class."
He also said that he did not pressure operations personnel to meet the schedule, and that all operators have the right to stop any operation.
Three operators said they consider meeting the schedule a test for personal excellence. Seven said stress was self generated, and six also identified stress as a reaction to pressure from "outside."
Outside was generally identified as a reference to "engineering."
Four operators stated stress was severe enough to be a..problem. One told me that many operators asked to be excluded from outage work, and that on one shift, two of six SROs asked to be excluded from outage activities and one asked for only minimal participation because of stress.
Another commented that they had more personnel interaction problems, conflicts, and stress in the March 1991 outage than at any previous time. He attributed at least some of it to trying to meet the outage schedule. Two operators identified noise and the number of activities in the CR as leading to operator stress.
Three operators volunteered that if the work load becaie too great or they had a safety concern that they could say "stop."
All three felt that exercising
Stephen A. Varga
- 8 November 21, 1991 this option may lead to their being chastised, and one provided an example of an operator who was chastised for excessive caution in taking too long to perform a procedure. Feelings of letting their fellow operators or Oconee down by not performing the work on schedule were also expressed.
Oconee's operators work four "12's" during an outage and then have a break.
One operator said the working hours were not excessive. No operator stated working hours were too long or that they contributed to a problem.
Two operators expressed reservations about going to work because of what one identified as excessive pressure and the other identified as stress.
2.6 Safety Two experienced Oconee operations personnel told me they were concerned that plant safety was inadequate during shutdown operation. They identified contributors to this concern as the high work load, management not responsive to problems, plant instability during shutdown operation, procedure violations, failure to use procedures, and failure to follow up mistakes with corrective training. These comments occurred near the end of the interview in each case, and many of the subjects identified in this document had been discussed and were not identified again.
2.7 Plant Management One operator told me they needed more than lectures to correct the problems.
Another that management did not understand, as evidenced by their adding an SRO with responsibility for the operating unit to the CR personnel. He said this didn't help because the SRO ordinarily spent almost all his time with the shutdown unit and little on the operating unit, and the new SRO had little to do while the shutdown unit SRO remained extremely busy.
The September AIT identified several management weaknesses that I will not repeat here. I will close by observing that I left the site with the feeling that Oconee management did not understand the potential seriousness of the shutdown operation problem, nor did they understand how they were contributing to the problem.
Warren C. Lyon, Sr eactor Engineer PWR Systems Secti n Reactor Systems Branch Division of Systems Technology cc: T. Murley F. Miraglia W RU 1J.
Partlow E. McKenna L. Wiens
OCONEE SHUTDOWN RISK Issues being addressed by Shutdown Risk and Outage Management Pilot MEMO ISSUE DETAILS Inspection I -
OUTAGE PLANNING I - OUTAGE PLANNING
- 1. Anticipated Work
- 2. Safety 0 No written Safety Guidance iden-Criteria and method used by licensee tifying individual safety criteria to schedule and control work
- 3. Outage Length 0 Emphasis on short outage length activities and plant evolutions during shutdown conditions is being addressed.
II -
OUTAGE IMPLEMENTATION
- 1. Coordination &
0 Deficiency related to Item 1.2 11 -
OUTAGE IMPLEMENTATION Control Busy Control Room O
Non-operator involvement in Coordination of work activities shift functions between support personnel and shift operators is being addressed.
- 2. Outage Operations Difficult to meet schedule Direct observation of control room activities is being performed.
0 Cut Corners o
Frequent rework needed The inspection will not address o Incomplete procedures w/impromptu issues regarding frequent rework or procedure writing practice inappropriate maintenance a Poor Communications and Teamwork activities. It will address o Inappropriate repairs at power communications, teamwork and watch C
Poor watchstanding standing practices.
- 3. Instrumentation aRHR pump instrumentation does not Availability of control room.
meet GL 88-17 instrumentation is being addressed.
Dinadequate level instrumentation installation inside containment i
Damaged instrument tubing o Alarms set inappropriately
-2 Issues being addressed by Shutdown Risk and Outage Management Pilot MEMO ISSUE DETAILS Inspection III -
PROCEDURES Average (some good points present)
III - PROCEDURES Procedures that control normal shutdown evolutions and procedures for response to abnormal conditions are being reviewed.
IV -
TRAINING 0 Behind industry in simulator IV - TRAINING training 0 Stress on training for requalifi-Training, both formal classroom and cation exam rather than operational OJT, is being addressed.
needs o Lack of outage specific training V -
STRESS 0 Some Operators avoid outage shifts V - STRESS due to stress to meet short outage length Stress is being addressed to the extent that the team plans to interface with control room operators and attend both daily outage meetings and shift briefings.
The team also intends to review overtiame records.
VI -
SAFETY 0 Some operators stated that plant VI -
SAFETY safety was inadequate during shutdown operation due to:
The inspection will be addressing o Workload corrective actions that have been o
taken for past problems but only U lnespnstilangeen indirectly. Workload, management
- Plant instability 0 Procedure violations responsiveness, procedure adherence 0 Failure to use procedures should all be addressed to some c
No corrective training extent.
-3 issues being addressed by Shutdown Risk and Outage Management Pilot MEMO ISSUE DETAILS Inspection VII -
PLANT MANAGEMENT 0 Management did not understand VII - PLANT MANAGEMENT potential seriousness of shutdown operational problems and their Plant management responsiveness to involvement in their resolution team concerns and the aggressiveness with which plant management appears to be addressing previous concerns should be addressed by the inspection team.