ML17329A507
| ML17329A507 | |
| Person / Time | |
|---|---|
| Site: | Cook  |
| Issue date: | 05/04/1992 |
| From: | Blind A INDIANA MICHIGAN POWER CO. (FORMERLY INDIANA & MICHIG |
| To: | Isom J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| References | |
| NUDOCS 9205190275 | |
| Download: ML17329A507 (14) | |
Text
ACCELERATED DISTRIBUTION DEMONSTRATION SYSTEM REGULATORY INFORMATION DISTRIBUTION SYSTEM (RIDS) i CESSION NBR:9205190275 DOC.DATE: 92/05/04 NOTARIZED: NO DOCKET FACIL:50-315 Donald C. Cook Nuclear Power Plant, Unit 1, Indiana M 05000315 50-316 Donald C. Cook Nuclear Power Plant, Unit 2, Indiana M 05000316, AUTH. NAME AUTHOR AFFILIATION BLIND,A.A. . Indiana Michigan Power Co. (formerly"Indiana & Michigan Ele RECIP.NAME RECIPIENT AFFILIATION R ISOM,J.A. Region 3 (Post 820201)
I
SUBJECT:
Responds to violations noted in insp rept 50-315/92-06(DRP)
& 50-316/92-06(DRP).Corrective actions:investigation D completed & written response to questions about unresolved item provided.
DISTRIBUTION CODE: IE01D COPIES RECEIVED:LTR ENCL SIZE:
TITLE: General (50 Dkt)-Insp Rept/Notice of Vio ation Response NOTES A RECIPIENT COPIES RECIPIENT COPIES ID CODE/NAME LTTR ENCL ID CODE/NAME LTTR ENCL PD3-1 PD 1 1 STANG,J 1 1 D INTERNAL: AEOD 1 1 AEOD/DEIIB, 1 1 AEOD/DS P/TPAB 1 1 DEDRO 1 1 NRR MORISSEAU D g 1 1 NRR/DLPQ/LHFBPT 1 1 NRR/DLPQ/LPEB10 1 1 NRR/DOEA/OEAB 1 1 NRR/DRE P/ PEP B9H 1 1 NRR/DST/DIR 8E2 1 1 NRR PMAS/ILRB12 1 1 NUDOCS-ABSTRACT 1 1 0 DIR 1 1 OGC/HDS2 1 1 R G~~E- 1 -
1 RGN3 FILE 01 1 1 EXTERNAL EG&&/BRYCEi J H ~ ~ 1 1 NRC PDR 1 1.
NS C 1 1 D
D D
NOTE TO ALL "RIDS" RECIPIENTS:
I'LEASE HELP US TO REDUCE iVASTE! CONTACT THE DOCUMENT CONTROL DESK, ROO.'i! Pl-37 (EXT. 20079) TO I Llb!INATE YOUR NAivlE FROM DISTRIBUTION LISTS FOR DOCUiiEENTS YOU DON'T NEED!
TOTAL NUMBER OF COPIES REQUIRED: LTTR 21 ENCL 21
indiana Michigan Power Company Cook Nuclear Piant P.O. Box 468 Bridgrnn, Mi 49106 p i5 516 465 5901 s 5110 May 4, 1992 jNDIANA MICHIGAN POWER James A. Isom Senior Resident Inspector U. S. Nuclear Regulatory Commission D. C. Cook Nuclear Plant One Cook Place Bridgman MI 49106
Dear Mr. Isom:
NRC Inspection Report 50-315/92006(DRP); 50-316/92006(DRP) reported the results of the NRC routine safety inspection activities of the D. C. cook Plant for the period of February 19 through March 31, 1992. In this inspection report, Unresolved Item 50-316/92006-01 was identified regarding the investigation. and documentation of an event where automatic pressurizer level control was lost at power due to an operator error. This error occurred during a valve position restoration following a routine clearance evolution for maintenance activities. The purpose of this letter is to provide a written response to the unresolved item to assist in your evaluation and final resolution of this issue.
This unresolved item is a significant concern as it applies to the Cook Plant Corrective Action Program. As you are aware, a fundamental aspect of our program is a "graded" approach to the investigation and analysis of identified problems. This graded approach. enables the assignment of resources for root cause analysis to those events and problems which represent the highest potential for safety impact. In addition, our process has achieved a very low threshold for reporting possible problems. Although this level of reporting is very desirable, it'is dependent on the ability to assess significance and apply problem solving resources appropriately.
During our follow-up of the questions for the subject unresolved item, approximately ten person-days were required for interviews, analysis, and documenting the results. This detailed level of investigation and documentation cannot be supported as a matter of routine for problems of this nature.
If this level of follow-up is required for events of a similar significance, the basis and effectiveness of our graded approach to corrective action will be placed at risk.
The responses to your questions regarding the details of this investigation are included in Attachment 1. These details were reviewed with you at a meeting on April 10, 1992, by the Operations Superintendent. Although additional information not identified in the original investigation was raised S'2051'F02? 5 920504
~,-a)
~t
J. A. Isom May 4, 1992 Page 2 through the follow-up to these questions, the root cause determination and corrective actions were not altered by this information.
Our analysis of the plant response agrees with your assessment of minor operational significance. Attachment 2 of this letter provides a summary of the results of our system engineer calculations and simulator test run. However, the Problem Assessment Group (PAG) and the Operations Department determined that the broader issue of "valve mis-positioning" had a higher level of safety significance. As a result, this event was investigated by an individual qualified under the plant's Human Performance Evaluation System. The broad issue of "valve positioning" formed the basis for the problem report investigation and corrective actions to ensure that the human performance issues were not caused by significant generic process weaknesses.
It has been recommended that this particular valve mis-be added 'to the Operations procedure for positioning "malfunction of Pressurizer Level Control." Since there are any number of combinations of valve lineup errors which could cause this and other significant control system malfunctions, it is not practical, nor our policy, to include these human process errors in our abnormal procedures. Valve positioning is strictly controlled through appropriate administrative controls (including job briefings), skill of the operator, and.
independent verification when necessary.
It is our conclusion, based on the significance of this specific event, that the investigation was appropriately detailed, identified the correct root cause for resolution and implemented adequate corrective actions. In general, the value added by identifying all contributing factors, though not relevant to the primary cause, may not offset the cost to determine those factors. It is our position that the time spent in such intensive investigations will clearly reduce management's ability to focus in detail on broader issues with higher safety significance.
We would welcome the opportunity to discuss this unresolved item further in the future.
Respectfully, A. Alan Blind Plant Manager Attachments
D. H. Williams, Jr.
E. E. Fitzpatrick A. A. Blind M. R. Padgett G. Charnoff NFEM Section Chief A. B. Davis Region B. M. Jorgensen III III Region
ATTACHMENT 1 RESPONSE TO NRC COMMENTS RE: PR 91-1288 Comment No. 1: Problem report investigation did not discuss the significance of the event.
As a normal convention, the Operations Department does not state specifically that a review was completed to determine the event significance in all problem reports. Although significance determination statements are not always included,'they are routinely completed as part of the investigation for all condition and problem reports. The decision to include a statement of significance is based on our consideration for the "primary" audience of the report. For a condition or problem report the primary reader is plant management, the context of the report are not intended for all readers. Therefore, considering the experience and background, of the plant management, if the details of the investigation section of the report adequately presents support that the event is not significant as defined by PMI-7030 (Condition Reports and Plant Reporting), a separate statement in the report to address the significance of the event is not included. But if the investigation required a detailed interpretation of a plant safety function concern or compliance to regulatory requirements, more detailed information as to the significance of the event will be included. Then, a significance determination statement as a conclusion to the investigation will be made so that the plant management reviewing the report can assess the interpretations and conclusions presented in the report.
Using the above review and documentation process, the determination was made that the details presented in the PR 91-1288 investigation report were adequate for plant management to make a determination that the event was not significant. This conclusion was based on the following.
At the start of the event, the charging flow rate was about 120 gpm. The VCT level decreased about 4% (approximately 76 gal.) before the start of the automatic makeup. Considering the charging flow rate and VCT level decrease, it is estimated that the transient started about 40 seconds prior to the automatic makeup alarm which alerted the control room operators to the off normal condition.
- 2. At the point of the VCT automatic makeup, the operator took manual control and stabilized the plant. Prior to operator action, the Pressurizer level increased about 3%
(approximately 225 gal.) to about 55 % level, which is well below the high PZR level alarm of 704.
- 3. ln parallel to the prompt actions taken by the control room operators to restore charging flow and to manually control pressurizer level, the operators promptly notified the operator in the plant performing the clearance restoration to determine if the clearance restoration being performed by the operator was the reason for the indicated decrease in charging flow and increase in PZR level.
ATTACHMENT 1 Considering the short period of time from the start of the transient to the automatic makeup alarm; the prompt actions taken by the operators to stabilize PZR level and notify the operator in the plant; and the relatively small change in PZR and VCT levels, the determination was made that the PZR transient was not a significant event,. as defined in PMI-7030.
Comment No. 2: The problem report did not address that the AEO did not inform the US that he had opened CS-300E when contacted by the control room operator.
Considering that the inadvertent opening of 2-CS-300E was the event being investigated, the inadequate communication by the operator to identify the nature of the error to the control room did not contribute to the inadvertent opening of the valv'e.
Since the inadequate communications did not contribute to the event but was identified as a poor operating practice during the investigation, the use of good communications was addressed as part of the "Lessons Learned" memo (included in the report documentation package) for the findings of the investigations.
Comment No. 3: The problem report did not address whether a pre-job briefing was completed.
The Operations Department places a great deal of emphasis on good job briefing. Currently OS0.083 (Shift Briefings and Guidelines for Operational Evolutions), OP-30 (Clearance Error Avoidance Program), and OHI-4012 (Conduct of Operations Shift Turnover) all contain guidelines related to job briefings. In addition, recently the above guidelines were reviewed and a survey was sent to operations personnel as part of the Operations Department job briefing assessment. The results of this assessment are scheduled to be incorporated into a job briefing guideline.
As part of each condition and problem report investigation, the Operations Department considers the quality of the job brief. If this review shows that the job brief was good or the details of the job brief do not contribute insight to the error that was made, the details of the job brief are not included in the report.
As a part of this investigation, an Event Causal Factor Chart (Human Performance Evaluation System root cause analysis process) was completed. As part of this chart, the job briefing was charted. The details of the charting noted that the Rea'ctor Operator who conducted the job briefing with the AEO included a review of each tag and tag requirement. The RO also discussed with the operator that 2 black seals and 1 blue seal would be needed. In addition, the RO recalled that a discussion was held to review the restoration requirements of the 2-CS-300E valve, and that since the valve was tagged in the normally closed position the valve should remain closed and sealed.
2
ATTACHMENT 1 The prompt to the operator to take an additional seal along for a valve that was expected to be closed and sealed was a good operating practice (tool of the trade). The intent was not for the operator to take a seal because the seal was expected to be needed, the intent was for the operator to take the seal in case the installed seal had been damaged during the maintenance activities in the area of the valve.. If the operator then identified that the seal had been damaged, a seal would be available without having to leave the area to get a seal.. Since the clearance restoration is the control process for returning the component to a normal alignment, the valve position was being controlled by the clearance tag and therefore, verification of the seal integrity during the restoration was important.
Comment No. 4: When the operator was paged and identified that he had made an error, did the operator violate the RWP?
At the time the operator was paged. the operator had already opened 2-CS-300E (East CCP Discharge To RCP Seal Water. Injection Filters Inlet Valve) and was in the process of opening 2-CS-301E (East CCP Discharge Valve), which permitted the charging flow to be diverted from the normal charging path.
2-CS-300E and 2-CS-301E are located within a few feet of each other in the charging pump room, and at the. time of the clearance they were both within the roped off area. Therefore, to respond to the page via the PA in the charging pump room, the operator had to leave the roped off area and then're-enter the roped off area to close 2-CS-300E.
During the investigation of this problem report, the operator was not questioned on the RP practices used to exit and re-enter the controlled area. The operator was doing what was necessary to restore the plant to a safe condition, and therefore the pr'ocess used was not questioned.
A discussion was held with the involved operator to identify the method used to exit and re-enter the roped off area on 4-8 92.
Due to the time passed since the event, the operator could not recall the RP practices used.
Considering the urgency of restoring the normal charging -flow path and the short period of time from the time the operator was notified and took action, it is very likely that the operator did not satisfy the requirements of the RWP when exiting and re-entering the roped off area. Condition reports for the period of time surrounding this event were reviewed to identify if a report had been written to document any actions taken by the operator that" were not per the RWP. A condition report was not identified.
ATTACHMENT 1 Therefore, the conclusion can be made that the operator left the
' roped off area with some portion of his ANTI-C clothing on and then re-entered the area due to the urgency that he placed on the need to restore the valve to the open position. The requirements of the RWP per 12 PMP 6010.RPP.006 (Radiation Work Permit Program) and 12 PMP 6010. RPP. 300 (Contamination Contro1 Program) may not have been met and RP should have been notified.
Following this comment review, the actions taken by the operator to exit and re-enter the roped off area should have been included in the investigation and any violation of the PMP's should have been documented.
The RP practice used by the operator to close 2-CS-300E is not a factor that contributed to this event and therefore the conclusions drawn from the review of this comment do not alter the root cause determination for this event.
Comment No. 5: What are the expectations for taking clearance paperwork into a contaminated area?
Per 12 PMP 6010.RPP.300 (Control of Equipment and Materials in a Restricted Area) personnel items such as flashlight, notebook, clipboard or similar items may be taken in to a restricted area provided the item is frisked by the user when exiting a restricted area. Although, the original clearance attached to a clipboard would be permitted by the PMP provided it was frisked out following the exit from the area, the Operations Department promotes the use of a clearance copy when entering a restricted area. The use of a copy is promoted so that if the copy is contaminated and cannot be. frisked out of the area, the steps and signatures can be transferred to the original..
The,use of a clearance copy is at this time a good operating practice used by the shift personnel. A review of this practice with shift'ersonnel (polled operating shift and training shift April 8th & 9th) identified that Supervisors polled usually request the operator to make a copy of the clearance if the Supervisor is aware that the area is restricted. The non supervisory personnel polled understood that the taking a copy of a clearance into a restricted area is a good operating practice and routinely evaluate the need for a copy dependent on the reasons for the restrictions on the area.
The issue presented in the problem, report was not that the operator failed to take a copy of the clearance with him into the roped off area, the issue was that by not having the clearance in hand the operator did not take with him a good tool to provide a .
means to self-check. As an acceptable alternative, the operator could have self-checked by leaving the clearance at the step-off pad and checking the valve number, noun name, and restoration position just prior to performing the task and again immediately
~ '
ATTACHMENT 1 after the task. During the interview with the involved operator, the operator stated that he had a mind set that the 2-CS-300E and 2-CS-301E were to be restored to the open position and therefore he left the clearance outside the boundary,and performed the restoration of the valves by memory.
The operator positioned a valve and hung a tag from memory which is not an accepted operating practice and is not consistent with our written self-check training.
Comment No. 6: No written requirement that the valve seal is a barrier.
The term "barrier" as defined by the INPO HPES process 'for human performance root cause analysis, includes physical barriers (examples: engineering safety features, safety and relief devices, conservative design allowances, locked doors, radiation shielding), administrative barriers (examples: policies and practices, training and education, methods of communications, supervisory practices), plus "many more". During the performance of the human performance root cause analysis, the following barriers were considered that failed related to the involved operator.
The operator training, experience, inadequate reference to the clearance and the seal were all barriers that failed. The seal wa.' barrier not because of a procedure or administrative requirement associated with the seal but rather because the involved operators interaction with the seal caused the to question his actions, but the operator did not followoperator up to resolve the question.
The involved operator had completed systems training and was qualified to perform the Auxiliary'uilding tour, and therefore the expectation- is that the qualified operator would have known that the 2-CS-300E is normally in the sealed closed position.
The operator did not adequately review the clearance .to identify the correct restoration position for 2-CS-300E on the clearance.
2-CS-300E was sealed closed and during the interview the operator stated that he questioned to himself why the valve was sealed, but he allowed his "mind set" that the valve was to be sealed open to override the need to take the time to recheck the clearance or ask his supervisor.
Comment No. 7: What sequence did the involved operator perform the clearance restoration?
Upon entering the charging pump room, the operator first restored 2-CS-298E (2-QMO-225 Outlet Valve) which was located in a non-restricted area. The operator then entered the roped off area and opened 2-CS-300E (Discharge to RCP Seal Water Injection Filters Inlet Valve), followed by 2-CS-301E (E CCP Discharge Valve). Upon opening 2-CS-300E, the charging flow was diverted from the normal charging flow path to the RCP Seals.
ATTACHMENT 1 Comment No. 8: Is there a requirement to seal closed a valve when a clearance tag is placed on a normally sealed closed valve?
Is'here a difference between "closed" and "sealed closed" on the clearance equipment position sheet?
In addition to .providing clearance points to remove equipment from service,'he Clearance Permit System is the procedural method in place to ensure the proper restoration of equipment placed under a clearance. When a clearance is placed on a normally sealed closed valve, the clearance tag becomes the means for controlling the valve in the closed position.
fact that the valve is sealed closed is secondary toTherefore, the the
'requirements'f the clearance tag position and "closed" in the placement position is acceptable.
For this event, since 2-CS-300E is a normally closed valve and therefore would be restored to the sealed closed position, leaving the seal on the valve should have enhanced the clearance restoration process.
Comment No. 9: OHI-4014 states that "Valve Position" abbreviations are defined in the "Valve Legend" at the bottom of each lineup sheet. Should the same convention be used on Clearance Equipment Position sheets?
The use of a valve position abbreviation legend was implemented to .enhance the "human factor" attributes of valve lineup sheets.
Since the present issue of OHI-4014, the Operations Procedure group philosophy has changed. In accordance with PGG.004.001 (Operation Department, Procedure Group Guidelines Generic'"
Writing, Instructions) valve positions on lineup sheets are stated rather than abbreviated. On the next revision of OHI-4014 the valve legend requirement will be updated.
A review of the use=of abbreviations on clearances was conducted with shift personnel (polled operating shift and training shift April 8th & 9th). The results of this review noted that the operators are familiar. with the abbreviations used on clearances and that questions associated with an abbreviation are answered
- during the job briefing.
In addition, a review of- this comment with Operations Department Staff personnel'noted that the clearance data base design for the positions listed in the "Placement Position" and "Restoration Position" are human factored such that the position read identical to the labels in the plant. Also, the discussions noted that the present format of the Equipment Position Sheet would not provide the space needed to include a legend without the elimination and alteration of other valued information on the data sheet.
Following the consideration of this comment, the conclusion is made that the addition of an abbreviation legend on the Equipment Position Sheet is not warranted based on the limited space available on the form, the standard conventions used, and the consideration of the trade offs required to include a legend.
ATTACHMENT 1 Comment No. 10: Add the inadvertent opening of 2-CS-300E to the symptoms section of the Malfunction 'of Pressurizer Level Control System?
The Malfunction of Pressurizer Level Control System (2-OHP 4022.003.002) .and Loss of Letdown or Charging Flow (2-OHP 4022.003.001) abnormal procedure were reviewed for the addition of the symptom of inadvertent opening of 2-CS-300E. Followi'ng this review, it is concluded that the addition of this step would not enhance the procedures for the following reasons:
A review of this comment with the Operations procedure group identified that the purpose of the symptoms section of an abnormal procedure is to present a list of possible causes of the malfunction of a control system. The inadvertent repositioning of a manual valve does not does criteria. In other words, this would be a human thisfit intervention and not a cause.
- 2. In addition to the symptoms listed in the abnormal procedures the licensed operators are trained to consider work activities that are in process in the plant at the time of an off normal indication for consideration as to the possible effects of this activity on the symptoms noted in the control room.
Considering that the inadvertent opening of a manual valve does not meet the criteria for an abnormal procedure symptom, and that the control room operators did recognize that the clearance restoration being completed, on the charging system may effect. the normal charging flow and paged the operator performing the clearance restoration in parallel to the response to the indications in the control room, the. addition of the inadvertent manual opening of the 2-CS-300E valve to the symptoms would not enhance the abnormal PZR level and charging procedures.
Following a careful review of the comments and questions presented by the'esident'RC inspector, it is concluded that no additional- facts related to this problem report have been identified that will alter the conclusion of the initial problem report investigation and report.
E In response to Comment No. 4, due to the time that has elapsed since this event the involved individual operator could not recall the details of his actions. Therefore, no additional actions directed 'at this individuals actions are possible at this time. This issue will be addressed with the ACC section to ensure that an, investigation concerning similar RP practices are properly documented. In addition, a letter to the Shift Supervisors to review the PMP requirement to notify RP personnel under similar circumstances has been issued.'
ATTACHMENT 2 CALCULATIONS REGARDING PLANT RESPONSE TO OPENING CS-300 WHILE AT POWER The ECCS (emergency core cooling system) System Engineer was asked to perform an evaluation to predict the Plant response to an inadvertent opening of CS-300E with no operator action the Plant is at power. Specifically, how long will it. take while to reach the following setpoints, pressurizer high-level deviation alarm, pressurizer high-level alarm, and the pressurizer high-level reactor trip.
The initial conditions presented for this evaluation were as follows:
~
Plant is at. stable, steady-state conditions.
Charging and letdown flow balanced 120 GPM letdown.
~
VCT level approximately 18:.
Pressurizer level approximately 524.
Annunciators (such as VCT make-up) not in auto, PW pump pressure low or failure, primary water flow deviation, boric acid flow deviation, pressurizer level deviation, pressurizer level high, pressurizer level high as well as the clicking noise made by blender operation would not,be acted on by the control room operators.
\
The calculations demonstrate that', with no operator action, auto make-up to the VCT will commence in approximately five minutes, pressurizer level deviation alarm in 21 minutes, pressurizer level high alarm in 87 minutes, and the reactor pressurizer high level would occur in just under trip from three hours.
In addition, On April 11, 1992, a simulator exercise was conducted in an attempt to recreate the event on the simulator.
The results of this exercise were inconclusive. simulator instructors were very clear on 'the point that the The this case, may not reflect actual Plant response. There is noin simulator, Plant data available that can be used to verify that the simulator response to opening CS-300E would parallel actual plant response.