ML18037A417
| ML18037A417 | |
| Person / Time | |
|---|---|
| Site: | Browns Ferry  |
| Issue date: | 07/31/1993 |
| From: | Hill S, Ibarra J, Kauffman J EG&G IDAHO, INC. |
| To: | NRC |
| Shared Package | |
| ML18037A416 | List: |
| References | |
| NUDOCS 9308230074 | |
| Download: ML18037A417 (26) | |
Text
TRIP REPORT:
ONSITE ANALYSIS OF THE HUMAN FACTORS OF AN EVENT AT BROWNS FERRY 2 ON HAY ll, 1993 ARI/RPT ESF ACTUATION DUE TO SHUTDOWN OVERPRESSURIZATION Jose Ibarra John Kauffman Susan Hi 11 Wi 1 1 i am Steinke Published July 1993 Idaho National Engineering Laboratory EGSG Idaho, Inc.
P. 0. Box 1625 Idaho Falls, ID 83415 Prepared for the Office for Analysis and Evaluation of Operational Data U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Under DOE Contract No. DE-AC07-76ID01570 9308830074 830804 05000260,t PDR P
ADOCK, PDR ~
EXECUTIVE
SUMMARY
The Office for Analysis and Evaluation of Operational Data of the U.S.
Nuclear Regulatory Commission has a program to study human performance during operating events at nuclear reactors. As part of this program, a team conducted an onsite analysis of the event that occur red at the Browns Ferry Nuclear Plant during the evening shift on Hay ll, 1993.
Unit 2 had been in the Cycle 6 refueling outage since January 29, 1993.
Final testing was in progress with a startup scheduled later in the month.
When the evening shift (3:00 p.m. to ll:00 p.m.) relieved the dayshift on May ll, 1993, Reactor Vessel Leak Test (hydrostatic test) 2-SI-3.3.1.A was in progress wi'th system pressure at 1020 psig. At 3:40 p.m., instrument and control (I&C) technicians were authorized to begin Procedure 2-SI-4.7.D.l.d-l, Instrument Line Flow Check Valve Operability Test, referred to as the Harotta valve test.
An ILC technician on sound powered phones was assigned to the control room to maintain communications during the Harotta valve test. The surveillance test separated instruments into designated groups for the performance of this test (e.g., Group A, Group B) . The control room operators were informed by the I&C communicator technician when testing was initiated on Group A instruments. The procedure also directed the I&C technicians to inform the control operators whenever isolating a particular instrument that required entry into a technical specification limiting condition for operation.
The I&C technicians isolated the pressure channel 2-PT-3-207 while performing the flow test on the Group B instruments. The control room was monitoring pressure indication PI-207A to control the hydrostatic test pressure. Unaware of the isolation, the control room operator responded to the pressure instrument and attempted to raise pressure when the indicated value decreased to 978 psig. Actual reactor coolant system pressure increased to 1118 psig where an, alternate (control) rod insertion and recirculation pump trips occurred from operable pressure channels.
111
The control board operator immediately tripped the control rod hydraulic pump 2A and isolated reactor water cleanup system dump/reject flow. A check of pressure indication on .all three channels showed the following: Channel A at 0 psig, channel B at 600 psig, and channel C at 980 psig. The operators checked pressure in the control rod drive system and found the pressure at 600 psig in agreement with the channel B reactor system pressure indication. The control rod drive hydraulic pump was restarted to stabilize pressure at about 600 psig. The crew reset the actuation signals and restarted a motor-generator set and associated recirculation pump to recover temperature control.
The human factors analysis focused on the factors that influenced the performance of operations staff and technical support staff throughout this event. The analysis was based on data derived from interviews with operations and technical staff, review of plant logs and recordings, and review of procedures and training material.
The following is a summary of the results of the analysis of the human factors in this event.
Command Control and Communications The most significant element was the lack of effective verbal communication between the unit operators and the I&C technician within the control room, based primarily on different mental models of the process that would be followed regarding what information would be communicated and in what form it would be communicated during the test procedure.
~Trainin Only one of the three unit operators on the crew had participated in performing these tests previously. Performing these infrequent tests might be used as a training opportunity for the operators who are not actively participating in the tests to see how they are conducted.
Awareness The pressure control operator controlled pressure using the digital pressure indicator PI-207A. There was periodic cross-checking of the pressure using other indicators. However, at the time of the event, the operator did not cross-check the pressure. Less dependence on a single pressure indicator would have been appropriate at this time.
Human-Machine Interface The primary display of reactor pressure was a digital display which showed changes by 1 psig increments. Other pressure displays were marked in 20 psig increments. It would have been difficult for the operator to control the pressure within the required 20 psig band (980-1000 psig) using the alternative pressure displays if the smallest units marked were in 20 psig increments. The location of the alternative pressur e gauges was at the other end of the panel and would have been very difficult to see and read correctly, because of both parallax and scale marking size, by the operator manipulating the RWCU blowdown control.
Procedures The Marotta valve testing procedure was inconsistent with other procedures in the way that.a Limiting Condition for Operation was declared.
The hydrostatic pressure test specifically calls for the digital reactor pressure display PI-207A to be used in controlling pressure. Yet the Marotta valve testing requires PI-207A pressure instrument to be taken out of service.
There was no written procedural direction on what alternative pressure channels to use when the 207/207A channel was taken out of service. Procedure action steps required the I&C technicians to establish and maintain communications but did not specify actions or requirements. The order of the listed equipment on the checklist attachments 2 (affected control room instrumentation) or 3 (affected transmitters) was not the same nor was it the same as the order in which equipment was taken out of service within the procedure. This may have contributed to the operator thinking that the digital PI-207A would not be placed out of service until later.
Work Confi uration There was no practice of tagging the out of service instrumentation in the control room during testing. There was a good practice of identifying annunciator windows that were out of service by means of magnetic surround boxes, although this practice was not significant in this event. There was a question of the appropriate level of experience needed to serve as a control room communications link. Those with less experience may not be familiar with the operations crew or may not recognize procedural inconsistencies or other procedural deficiencies.
Stress There was no evidence that elevated stress was a contributing factor to this event.
ACKNOWLEOGMENTS We appreciate the cooperation of the Browns Ferry staff in freely providing the necessary information and scheduling interviews to assist in the analysis of the human factors of the operating event. We thank the Unit 2 operators and technicians who were on duty during the event for their cooperation during the interviews.
CONTENTS EXECUTIVE
SUMMARY
ACKNOWLEDGMENTS vi 1 ACRONYMS ix
- l. INTRODUCTION ~ ~
II 1.1 Purpose ~ ~ ~ ~ ~ 1 1.2 Scope ~ ~ ~ 2 1.3 Onsite Analysis Team 2
- 2. DESCRIPTION OF THE EVENT ANALYSIS ~ ~ ~ 3 2.1 Background 3 2.2 Time Line of the Event 6 2.3 Analysis ~ ~ ~ 8 2.3. 1 Command, Control and Communicat ion 8 2.3. 2 Training 0 ~ 0 ~ ~ ~ ~ ~ ~ ~ ll 2.3.3 Awareness 12 2.3.4 Human-Machine Interface 12 2.3.5 Procedures 13 2.3.6 Work Configuration 15 2.3.7 Stress 16 2.3.8 Summary of Analysis 16
- 3. REFERENCES ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 17 FIGURES Figure l. Browns Ferry Unit 2 control room staffing ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 18
ACRONYMS AEOD Analysis and Evaluation of Operational Data AUO Auxi 1 i ary Uni t. Operator ARI Alternate Rod Insertion ASME American Society of Mechanical Engineers ASOS Assistant Shift Operations. Supervisor BWR Boiling Water Reactor CRD Control Rod Drive-DSP Division of Safety Programs ESF ~
Engineered Safety Feature ILC Instrument and Cont} ol INEL Idaho National Engineering Laboratory LCO Limiting Condition for Operation NRR Nuclear Reactor Regulation NRC Nuclear Regulatory Commission RCS Reactor Coolant System RO Reactor Operator ROAB Reactor Operations Analysis Branch RPT Recirculation Pump Trip RWCU Reactor Water Cleanup System SI Surveillance Instruction SOS Shi ft Operations Supervisor UO Unit Operator.
- 1. INTRODUCTION 1.1 ~Pur ose The Office for Analysis and Evaluation of Operational Data (AEOD) of the U.S. Nuclear Regulatory 'Commission (NRC) has a program to study human performance during operating events. As part of this program, AEOD formed a team to conduct an onsi te analysis of the event that occurred at the Browns Ferry Nuclear Plant during the evening shift on Hay 11, 1993. This report documents the human factors analysis performed as part of the study. The Idaho National Engineering Laboratory (INEL) provided program assistance.
Unit 2 had been in Cycle 6 refueling outage since January 29, 1993.
Final testing was in progress with a startup scheduled later in the month.
When the evening shift (3:00 p.m. to 11:00 p.m.) relieved the dayshift on Hay ll, 1993, a reactor coolant system (RCS) hydrostatic test, following procedure 2-SI-3.3.1.A, ASHE (American Society of Hechanical Engineers)Section XI System Leakage Test of the Reactor Pressure Vessel and Associated Piping (ASHE Section III, Class 1), was in progress with system pressure at 1020 psig. At 3:40 p.m., instrument and control (I&C) technicians were authorized to begin Procedure 2-SI-4.7.D. l.d-l, Instrument Line Flow Check Valve Operability Test.
As part of the test, the I&C technicians isolated pressure channel 2-PT-3-207 which was being monitored by the control room to control the hydrostatic test pressure. The control room operator responded to the isolated pressure instrument and attempted to raise pressure when the indicated value had decreased to 978 psig. Actual RCS pressure increased to 1118 psig where an alternate rod insertion (ARI) signal from operable pressure channels initiated a recirculation pump trip (RPT) actuation causing the running pumps to trip.
The control board operator immediately tripped the control rod drivewater (CRD) pump 2A and isolated RWCU dump/reject flow. Pressure was stabilized at A
about 600 psig.
1.2 ~Sco e The human factors analysis focused on the factors that influenced the performance of operations and maintenance activities throughout this event.
The analysis was based on data derived from interviews with control room operators and maintenance technicians, review of plant logs and recordings, and review of procedures and training material. I 1.3 Onsite Anal sis Team The onsite analysis team visited the Browns Ferry Nuclear Plant during the period of Hay 12-14, 1993, and was composed of the following members:
Jose Ibarra, NRC/AEOD/DSP/ROAB (team leader)
John Kauffman, NRC/AEOD/DSP/ROAB Susan Hill, INEL/EG&G Idaho, Inc.
William Steinke, INEL/EG&G Idaho, Inc.
- 2. DESCRIPTION OF THE EVENT ANALYSIS 2.1 2 The Browns Ferry Nuclear Plant, located in Limestone County in North Alabama, is owned and operated by Tennessee Valley Authority. The three nearly identical boiling water reactors (BWR/4s) are rated at 3293 HW-thermal each -and have General Electric nuclear steam supply systems and a Hark I containment. Units 1 and 2 are operated from a common control room. Unit 2 has been in commercial operation since 1975. Unit 2 had been shut down from 1984 to 1991.
On Hay ll, 1993, Unit 2 was in a refueling outage that had started on January 29. Final testing was in progress with a startup scheduled later in the month. When the evening shift (3:00 p.m. to ll:00 p.m.) relieved the dayshift on May ll, 1993, a reactor coolant system (RCS) hydrostatic test; following procedure 2-SI-3.3.1.A, ASHE Section XI System Leakage Test of the Reactor Pressure Vessel and Associated Piping (ASHE Section III, Class 1), was in progress with system pressure at 1020 psig. Recirculation pumps were running at 30~ of rated flow maintaining RCS temperature at 200 F. A crew briefing was conducted for the on-coming crew by their shift operations supervisor prior to relieving the watch. Additional instructions were given to the three control room operators after the normal briefing to address conditions for the hydrostatic test and a scheduled surveillance instruction to test instrument line excess flow check valves (Marotta valves).
Contingency actions for responding to pressure control problems were included in the crew briefing.
The Unit 2 control room crew consisted of a shi ft operations supervisor (SOS), assistant shift operations supervisor (ASOS), and three unit operators (UO) . The SOS had assigned each UO to one of three positions for the shift: a desk operator to maintain logs and answer phone calls to the control room,, a hydrostatic pressure control operator at the reactor water cleanup system controls, and a board operator to handle all. other control board operations. A second ASOS was on shift supervising auxiliary unit operator activi ties
outside the control room (see Figure I). The shift personnel were beginning their sixth day of a seven day evening shift routine.
At 3:40 p.m., I&C technicians were authorized by the control room to begin Procedure 2-SI-4.7.D.l.d-l, Instrument Line Flow Check Valve Operability Test (Harotta valve test). The I&C technicians were instructed by operations to perform the procedure up to the step which would drain water from the system. Steps 7.3 and 7.4 of the surveillance instruction (SI) were performed at that time, which required informing the control room desk operator of the effects and giving .the UO a copy of attachments 2 and 3 of the SI. Attachment 2 listed, by groups, the control room instrumentation affected by the SI, and attachment 3 contained a group listing of all transmitters affected. The SI was organized to remove the affected instruments in groups. As each valve was closed, it would isolate a transmitter and make inoperable the associated control room instruments. The in-plant I&C technicians established communications with an I&C communicator in the control room, via sound powered headsets. Once voice communications had been established, they began isolating Group A instruments in accordance with the SI. As control board annunciators alarmed, the I&C communicator in the control room asked the desk operator if the alarms were associated with the instruments being valved out.
No alarms were received as a result of isolating the Group A instruments. The desk operator was informed by the I&C communicator, as required by the procedure, at 5:37 p.m., that instrument loop 2-L-3-58A had been removed from service. The procedure contained instructions to inform the operators of applicable technical specification limiting conditions for operation (LCO) after an instrument had been removed from service.
Leakage had been identified on three control rod seals during the dayshift hydrostatic pressure testing. Technical support engineering and the hydrostatic test director had informed the crew at the shift briefing of the leakage problem. Three control rods with leaking seals were to be individually scrammed three times during the shift in an attempt to stop the 0-ring seal leakage. RCS pressure was increased 5 psig to 1025 psig by the pressure control operator at about 5:55 p.m. in preparation for scramming the rods. The crew was anticipating a 2 gpm leakage rate during the rod scramming 4
and an associated pressure drop. Mhen personnel were in place to conduct the control rod scramming, the I&C technicians were instructed to hold at that point in their SI procedure. Control rod scramming was completed at 6:45 p.m.
and the I&C technicians continued with the Marotta valve test.
Instrument loop 2-L-3-58A was returned to service at 8:17 p.m. and the control room I&C communicator informed the desk operator. Step 7.9.12 of the SI, notifying the UO of completion of Group A instruments, was accomplished at approximately 8:30 p.m. The control room I&C communicator informed the desk operator that work would begin on Group B instruments at that time. The desk operator and the pressure control operator reviewed the instruments in Group B and identified that transmitter 2-PT-3-'207 was to be isolated within that group. The pressure control operator was using PI-207A fed from 2-PT-3-207 to monitor reactor system pressure as directed by hydrostatic pressure test procedure, 2-SI-3.3.1.A. Both the pressure control operator and desk operator had agreed that the SOS and hydrostatic pressure test director should be consulted for guidance to identify alternate pressure instrumentation before transmitter 2-PT-3-207 was isolated. The I&C technicians were not aware that alternate pressure indication was going to be required.
At 10:04 p.m., the control room I&C communicator informed the desk operator that 2-LT-3-52 had been removed from service at 9:50 p.m. The desk operator asked for clarification of the designation (i.e, LT or L). In response, the I&C communicator showed procedure 2-SI-4.7.0.l.d-l, Step 7.10.12, to the desk operator. A problem developed in the next step 7.11 with sensing line B-2 valve and a test deficiency was originated. The control room I&C communicator informed the ASOS, at 11:08 p.m., of the sensing line valve problem in step 7.11.
At 11:00 p.m., the pressure control operator had lowered system pressure to a band of 980 to 1000 psig, in accordance with Step 7. 18 of the hydrostatic test SI, to maintain conditions for the duration of Marotta valve test.
Pressure channel PI-207A was displayed near the"RMCU controls on a digital readout visible from all areas of the control room. Noticing that the digital pressure indication was decreasing in 3 to 5 psig increments on the display
and was approaching 980 psig, the pressure control operator made several adjustments on RWCU blowdown." The SOS observed the adjustments made by the UO and went to the control board to assess the plant condition. Pressure decreased to 978 psig, the operator decreased RWCU blowdown further and pressure indication increased to 983 psig. At ll:23 p.m., approximately one minute after the RWCU adjustments, an ARI signal initiated a RPT (actual pressure had increased to approximately 1118 psig). The SOS',ordered a trip of the CRD hydraulic pump 2A and RWCU blowdown was isolated. Pressure instruments on the left side of the full core display panel were checked and channel A was indicating 0 psig, Channel B 600 psig, and Channel C 980 psig.
The pressure control operator also checked pressure indication on the CRD drive water system which agreed with Channel B at 600 psig. The SOS instructed the pressure control operator to restart the CRD hydraulic pump and stabilize pressure.
The desk operator informed the SOS that pressure channel B recorder trace showed an increase in pressure prior to the ARI actuation. The SOS P
directed resetting the ARI and restarting the motor-generators to facilitate getting a recirculation pump back in-service for temperature control.
2.2 Time Line of the Event The following time line sequence of the event was developed from interviews with the on-duty shift control room personnel and technicians, copies of the control room logs, and plant computer printouts.
TIME EVENTS 3:00 p.m. Shift brief conducted for on-coming crew covering:
~ Hydrostatic Test and contingency actions
~ Scheduled Marotta valve flow test
~ Control rod drive leakage
~ Assignment of control room operators to required posi tions
I&C technicians signed on to the Marotta valve test SI and were authorized to proceed to the point of draining water from the system.
Communication with the in-plant I&C technicians was established with the I&C communicator positioned in the control room for the Harotta valve test.
Control room desk operator was notified by the I&C communicator that instrument loop 2-L-3-58A had been removed from service.
System pressure was raised 5 psig, by the pressure control operator to 1025 psig in preparation for scramming control rods. I&C technicians were instructed to hold on the Harotta valve test.
Rod scramming was completed for the three leaking control rods. I&C technicians continued with Marotta valve testing.
Control room desk operator notified by the I&C communicator that testing on instrument loop 2-L-3-58A had been completed and was returned -to service and LCO exited.
(approximately) Control room I&C communicator informed the desk operator that Group A instruments had been completed and they were proceeding with Group B. Pressure control
-operator and desk operator reviewed Group 8 instruments and discussed the loss of 2-PT-3-207 which fed PI-207A.
Control room I&C communicator informed the desk operator that LCO-related 2-LT-3-52 had been removed from service'at 9:50 p.m. The desk operator asked for clarification of the designation (i.e, LT or L).
Pressure control operator lowered system pressure to a band of 980 to 1000 psig, in accordance with Step 7. 18 of the hydrostatic test SI, to maintain conditions for the duration of Harotta valve test.
A problem developed while performing step 7.11. A test deficiency was originated and the control room I&C communicator informed the ASOS.
ll:22 p.m. (approximately) Pressure control operator made several adjustments on RWCU blowdown. The SOS went to the control board to assess plant condition. Pressure decreased to 978 psig, the operator decreased RWCU blowdown further and pressure indication increased to 983 psig.
ll:23 p.m. ~ Reactor pressure ARI initiated, resulting in recirculation pump trip.
~ The SOS ordered a trip of the CRD hydraulic pump 2A and RWCU blowdown was isolated.
~ Pressure channels on 93 Panel indicate 0 psig on A, 600 psig on B, and 980 psig on C. CRD drivewater system pressure indicated 600 psig with pump stopped.
~ Recorder for pressure channel B indicated an upward trend in pressure prior to the ARI.
ll:24 p.m. SOS directed the following:
~ Restart of the CRD hydraulic pump by the pressure control operator to stabilize pressure.
~ Reset of the ARI signal.
~ Reset of the RPT breakers.
~ Restart of the recirculation motor-generators.
~ Restart of the recirculation pump 2A.
2.3 ~Anal sis There were many factors that contributed to the event. This section discusses the human performance aspects of the event.
2.3.1 Command Control and Communication A primary factor in this event was the communication between the control room operations crew and the IKC technicians. In particular, the desk operator and the IE.C technician present within the control room did not communicate effectively. Both individuals were confident that they were carrying out their functions in an appropriate manner. The IEC communicator was performing the procedure as written, notifying the control room desk 8
operator of activities when required by the procedure. The operator had been given a copy of the procedure attachments which listed which instruments would be taken off line during the procedure. It was known by the desk operator and the operations crew which instruments would be removed from service at some time as part of the procedure. The procedure required that the I8C communicator notify the operator that "Group B" would be coming off line in the next section of testing and when the technical specification limiting condition for operation (LCO) for one particular instrument would be entered.
The desk operator was confident that he understood that the I&C communicator would be notifying him as each instrument was taken off line, not just the LCO-related instruments. Digital pressure indicator PI-207A was not an LCO-related instrument.
Events suggest that the desk operator had a specific "mental model" of the steps that had been taken and the steps that were going to be taken. The first "Group A" of transmitters and their associated control- room indicators were taken off line with no problem. The three control room components in Group A, listed in attachment 2, are all LCO-related, and each had a notification and time-dependent action step associated with it within the procedure. The "Group A" steps may have contributed to the development of a mental model that each control room instrument affected would"have a specific notification step within the procedure. If the desk operator understood the I&C communicator to say that instruments would be reported to him one at a time, then that would strengthen the mental model of what was to occur.
The operator acted using his mental model of the process. In addition, confirmation bias, where an individual is, more likely to gather information that confirms what he already thinks, rather than to seek disconfirming information (see discussions by Reason, 1990 and Gi lovich, 1991), may have contributed to this event. The operator did not seek out information that would disconfirm his mental model of how the process was to be carried out (i.e., one instrument reported at a time).
Another aspect related to confirmation bias was that there were no expectations on the part of the control room operators as to the time when various procedure activities would be taking place and they did not seek any
additional information about when instruments were taken off line. The operators knew, from crew briefings, that the Harotta valve testing would be taking place over several shifts (i.e., 72 hrs). Therefore they did not perceive it as odd, even after the operators were notified that Group B would be worked on next, that no instruments were reported by the I&C communicator as being taken off line over some period of time (perhaps as much as 90 minutes).
The most effective way to communicate would be to develop and present explicitly the most appropriate mental model of how the process will work, and not leave it up to the operator to develop his own mental model from observation and experience. In this case, consistency of actions across procedures becomes particularly important, such as entering an LCO. Another aspect is to maintain a questioning attitude. It should be understood that a questioning attitude entai ls seeking out disconfirming information. If process expectations, such as a rough estimate of how much time some activity will take, can be explicitly addressed in a test prebrief, then the operator and I&C technician would have common information and expectations with which to work.
A very positive aspect of command and control was the prebriefing that the crew received before going on shift. The prebriefing given to the crew before going on shift was effective in outlining possible problems that could occur during the 'in-service leak, hydrostatic pressure test. Also, recovery actions to take were presented. The operators indicated that the prebrief information assisted them in making the recovery 'actions to stabilize conditions once the ARI/RPT trip occurred. The proceduralization of the contingency actions would ensure that all crews would receive the same valuable information that was presented to this crew by the SOS and standardize performance across all crews.
The SOS was actively involved in supervising the crew which contributed to a timely recovery from the event. He had selected the operators to perform specific tasks. The SOS had good awareness of control room actions he noticed the pressure control operator make two adjustments to the RWCU 10
blowdown and recognized abnormal actions for the current plant conditions. He went to investigate the actions of the pressure control operator and was at the control panel when the trip occurred. The ASOS was primarily at his desk performing paperwork and deferred to the SOS when the event occurred.
2.3.2 ~Tvainin The operators had not received specific simulator training on the hydrostatic pressure test nor the Marotta valve testing procedures. It is not expected that the operators would receive simulator training on these and other outage procedures.
Only one of the three UOs on the crew had participated in performing these tests previously. Both the control room configuration and the Marotta valve testing were changed from the last outage when the tests were performed.
The unit had been shutdown for approximately seven years when operators would not have participated in cycles of normal operation and outage activities.
Performing these infrequent tests might be used as a training opportunity for the operators who are not actively participating in the tests to see how they are conducted, introduce them to the procedure, and any other aspects that come with observing a test actually being performed.
Within the past three months, the crew had received classroom and simulator training on the newly modified (during this outage) control room instrumentation and were scheduled to receive more training in the near future.
The training that contractor personnel received when working at Browns Ferry was of interest because the IKC technician acting as "communicator" within the control room was a contractor. Contractor personnel are considered as "long-term" (discussed as being hired for more than a few months, such as six or more months) or "short-term" personnel (i .e., less than six months).
Short-term contractors are screened for basic instrumentation knowledge.
Long-term contractors receive system familiarization training which may last 2
to 6 weeks. The 18C technician who acted as communicator was hired for work during the outage and was considered "short-term."
2.3.3 Awareness The pressure control operator had been controlling the pressure using mainly the digital PI-207A indicator for the entire shift. When there was a drop in the pressure, good operating practice by the operator would have included a cross-check of the pressure r eading with the other pressure instruments. This was particularly true with the knowledge that the digital pressure indicator would be taken out of service at some time during the Marotta valve test. Less dependence on a single pressure indicator would have been appropriate. The current human-.machine interface (as discussed in the next section) would make it easier to rely on the digital pressure indicator for readings and when making control actions rather than the alternative pressure displays.
2.3.4 Human-Machine Interface The primary display of reactor pressure was a digital display which showed changes by 1 psig increments. The other three pressure gauges were analog moving pointer, fixed scale displays. These scales were marked off every 20 psig. The band of pressure in which the operator was controlling the pressure was 980-1000 psig. It would be difficult to control pressure within a 20 psig band if the smallest units marked are 20 psig apart. A human factors principle is not to require reading scales more precisely than the smallest unit of measure on the scale allows.
The location of the pressure displays and the RWCU reject controller used for reactor pressure control was of interest. The digital display PI-207A was located close to the RWCU blowdown control and could be easily read and monitored from that position. The three alternative pressure gauges were located at the other end of the panel (approximately 10 feet away) and would have been very difficult to see and read correctly, because of both parallax and scale marking size, by the operator manipulating the control.
12
The digital pressure display, specified by the procedure, was used to control pressure during the hydrostatic pressure test. This digital display would have been preferred by the operator as the primary display because of the ease with which it could be seen because of its size, its location (near the RWCU blowdown control), and the ability to see changes of pressure in 1 psig incr ements. However, digital displays are not inherently more accurate and depend solely on the data being transmitted to it. The same data was transmitted to an analog PI-207 and digital PI-207A pressure display.
r.
The operators did not specifically mention using the plant computer screens that presented reactor pressure information. The operators had received training on the new computer that had been installed during the current outage (i .e., within the previous four months) . The system was operable and the operators had keyed in the RWCU reject flow and CRD charging flow parameters for monitoring.
2.3.5 Procedures The in-service leak test (also called the hydrostatic pressure test) was considered a "complex and infrequent" procedure. The Marotta valve testing, although performed in conjunction with the hydrostatic pressure test and therefore infrequently performed, was not specifically designated as "complex."
Several issues dealing with the procedures were identified. One issue was that this particular procedure for Marotta valve testing was inconsistent with other procedures in the way that a LCO was declared. In this procedure, there was a notification that a piece of equipment would be coming off-line, the equipment was taken off-line, and the operator was informed to retroactively enter the LCO. This process was reported to be in contrast to other procedures where the operator is notified that the LCO is declared and then the equipment is taken off-line.
The procedure for the hydrostatic pressure testing specifically called for the digital PI-207A reactor pressure indicator to be used in controlling 13
pressure. It also specifically called for Harotta valve testing to be performed in conjunction with the hydrostatic pressure test. Yet the Harotta valve testing required the. digital 207A instrument to be taken out of service.
There was no written procedural direction on what alternative pressure channels to use when the 207/207A channel was taken out of service.
Directions for use of alternative pressure indications would be a helpful addition to the procedure.
Within the Harotta valve testing procedure, the notification of an LCO for Group A was made using the terminology of a loop (i.e., "L"). For Group B, the LCO notification was made for an individual level transmitter (i.e., "LT"). Based on the Group A notification, the desk operator may have expected notifications to be made at the loop (L) level. Consistency in procedures is important to not mislead or create false expectations of what will be accomplished or what specific terminology means. The "L" nomenclature was introduced and used in the action steps, although it was not .used in either attachments 2 and 3 which were provided to the operator to assist during the test.
Within the Harotta valve testing procedure, there was an action step that requires the I8C technicians to "establish and maintain" communications with the control room unit operator. That action was appropriately required at a critical place in the procedure, where the instruments were taken out of service. That procedural step acknowledged the importance of communication, but did not clearly identify what was meant nor did it provide specific actions that would initiate communication (wi th the exceptions of the notifications regarding beginning a new group of instruments and entering LCOs) . It was not specified. that the actions invol.ved in every one of the components should be conveyed to the unit desk operator. If there was a specific intent implied in that procedural step, good practice would not have it left up to the individual performers to infer what was meant by communication but would have made explicit requirements.
The operator was given a copy of attachments 2 and 3 to the Harotta valve procedure which listed the instruments to be removed by "group." The 14
operator was checking the, instruments off as he was notified by the I8C communicator that they were taken out of service. The order of the listed equipment on the checklist attachments 2 and 3 was not the same nor was it the same as the order in which the equipment was taken off line within the procedure. List elements are usually interpreted as sequential, unless specified otherwise. Therefore, the location of the 207 pressure transmitter and indicator in the lists in the attachments 2 and 3 may have contributed to the operator thinking that the digital pressure display PI-207A would not be placed out of service for some time; "
2.3.6 Work Confi uration There was no practice of tagging the out of service instrumentation in the control room during testing. One of the corrective actions from this event was to implement identification of out of service instrumentation via temporary labels (i.e., Post-It notes). Identifying control room instruments that are out of service is a common and useful way of aiding the control room operators.
There was a good practice at Browns Ferry of identifying annunciator windows that wi 11 be out of service by means of magnetic surround boxes, although this practice was not significant in this event. This is an aid for those in the control room so that they can know at a glance if the lighted annunciator window is an actual alarm or it results from testing, maintenance or other non-operational activity.
The IKC test/surveillance crews included a lead performer who was a TVA employee and in charge of the test. Other IKC technicians perform on the ISC test teams, which may include contractor personnel. The current configuration of the test team, specifically for the Harotta valve test, was to have an IKC communicator in the control room to serve as the communications link between operations in the control room and the I&C technicians in the plant. There is the question of the appropriate level of experience needed to serve as the control room communications link. Those with less experience, such as shor t-15
term contractors, will not be familiar with the operations crew or may not recognize procedural inconsistencies or other procedural deficiencies.
2.3.7 Stress There is no evidence that elevated stress was a contributing factor to this event. The hydrostatic pressure test was the single major test being conducted at the time; it is a slow paced evolution. There were no reports 'of fatigue, although the event did take place near the end of the shift. There were no reports of overload, with too much work being required of the operators.
2.3.8 Summar of Anal sis There were several contributing factors to the ARI/RPT trip event at Browns Ferry Unit 2. The most significant element was the lack of effective communication between the UOs and the I&C technician within the control room, based primarily on different mental models of the process that would be followed regarding what information would be communicated and in what form it would be communicated during the test procedure. Factors related to procedures, human-machine interface, and work configuration also contributed to the event.
The prebriefing that the crew receive prior to shift turnover was a positive contributor to effective and timely recovery actions; The SOS was actively involved in the control room operation.
16
- 3. REFERENCES Reason, J. (1990). Human error. Cambridge, England: Cambridge University Press.
Gilovich, T. (1991). How we know what isn't so. New York: The free Press.
17
Shift Operations Supervisor SRO - 9 yr.
Assistant Shift Assistant Shift Operations Supervisor Operations Supervisor SRO - 3 yr. SRO - 2 yr.
In-Plant Operators Unit Operator Pressure Control Desk Operator Operator RO - 13 y,r. RO - 1.5 yr. RO - 7 mo.
Note 1: The SRO and RO license periods are for Browns Ferry and do not include any previous licensing or operating experience.
Note 2: The position of pressure control operator was only required during the hydrostatic test.
Figure 1. Browns Ferry Unit 2 control room staffing.
18