ML19354D638

LER 89-022-00:on 890805,change to Surveillance Procedure ST-CEA-1 Became Effective Which Would Have Made Both Emergency Diesel Generators Simultaneously Inoperable During Portion of Test.Change removed.W/891220 Ltr

ML19354D638
Person / Time
Site:	Fort Calhoun
Issue date:	12/20/1989
From:	Morris K, Phillips W OMAHA PUBLIC POWER DISTRICT
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
LER-89-022, LIC-89-1122, NUDOCS 8912280404
Download: ML19354D638 (7)

Text

,

,.c, ...

y amaha Public Power District -

1623 hdtney Omaha. Nebraska 68102 2247 402/536 4000 Deceder 20, 1989 LIC-89-1122:

U. S. Nuclear Regulatory Commission Attn: Document Control Desk Mail Station P1-137 Washington, DC 20555-

Reference:

- Docket No. 50-285 Gentlemen:

Subject:

Licensee Event Report 89-022-for the Fort Calhoun Station Please find' attached Licensee Event Report 89-022 dated December 20, 1989. This re 50.73(a)(2)(v)portisbeingsubmittedperrequirementsof10CFR If you should have any questions, please contact me.

Sincerely, ,

'K. . Morris Division Manager Nuclear Operations KJM/ tem Attachment c: R. D. Martin, NRC Regional Administrator A. Bournia, NRC Project Manager P. H..Harrell, NRC Senior Resident Inspector INP0 Records Center American Nuclear Insurers 8912280404 891220 PDR ADOCK 05000205

/f 6 s enu gM,g

_== ._ m

y FORM 388 U.S. NUCL E AA E tIULAT&JY COMM6alllON APPROvt0 Out NO. SmM EEPt'.18 4/30/92

[""hab ho U 0"$$'hiYTh$t [C $

LICENSEE EVENT REPORT (LER) OMN

^"!UfTc"R,'Ce,MM

' ' ' * ^

U"A"M"^iS&*a&*tMe'"

"'MTAe?=!?To'et1.?!?Paa "

f,Whfl."

$Kti NUGADth QI PAGE I31 9ACILITY NARGE lli Fort Calhoun Station Unit No. 1 o i5 I o 1o I o i 21815 1 IoFI O 16 TITLE 141.

Approved Procedure Which Could Have Caused Inoperability of Both Diesel Generators SVGNT DAf f (Si LER Nundstm Igl REPORT Daf t 171 OTHER 9 ACit.lTIES INVOLVED let Vt. Day vtAR 8 *C' Liv v waMas DOCKET NUustRisi MONTit DAY YEAR b"Nhn ' *YwM MONTH N O15l0lo10; i 1

~ ~

0l8 0l5 8 9 Bl9 0l2l2 0l0 1l 2 2l0 8l9 0 isto 1 0 loi i 1 TMis REPORT 18 SUOMITTSO PURSUANT TO THE Rh0UlREMENTS OF 10 CF R 6 <Checa eae or more e, ,*e Ndiewwift Illi OPGRATING MOct M } 30 403161 30 400tsi to.7 h H2Hal 73 718b1 R

30 406teH1H6) 80 38'.eH11 J to 73teH3Het 73.714el n., 1i 0i 0 = =In H.) _

.o.ie, i 90 melan =4,

_ =;,g,,,,;. g.g,;,,

M 4884eH1 Hell to.736elt2Hal to.73rsH2HeulHAl Js6AJ 30 4084eH1Havl 90.73teH2Het to.73teH2HvihHet 30.4054eH1Het to.73teH2 Hull 90 73taH2Hal LlCENSEE CONT ACT FOR TMil LIR 412)

NAMg TELEPHONE NUMBER aReaCODE W. C. Phillips, Shift Technical Advisor 41012 513 1 31-16181916 COMPLETE ONE LINE SOR E ACM COMPONENT f ALLURE DESCRISED IN THIS REPORT (13)

R ORTA E CAUSS SYSTEM COMPONENT * ^)'g A C. RyoORiA pn E CAUSE SY Sit COMPONENT "'"$'g AC- pn l I I I I I I I i i I. I I I I I I I l l l 1 l 1 I I i 1 SUPPLEMENTAL REPORT EXPECTED 1144 MONTM DAY YEAR

$USMi$380N 4 ts II9 vee. eeme**. tMECTt0 Sv0s,ISSION DA Til NO l l l A T R ACT <-, ,, , >0 e.-e.m . e ,s. e , A- ,e .-e -,. .,,e., n .,

On August 5, 1989 a change to surveillance procedure ST-CEA-1 became effective which would have made both emergency diesel generators simultaneously inoperable during performance of a portion of the test. On September 26, 1989, Operations personnel recognized the problem with the change to the test prior to its performance. This change was expeditiously removed from the procedure.

The erroneous version of the procedure was never performed while it was in effect; however, performance of the procedure while the change was included could have prevented the fulfillment of the safety function of the diesel generators and is a condition reportable pursuant to 10 CFR 50.73(a)(2)(v).

The reportability of this event was not recognized until November, 1989. This event is attributed to inadequate administrative controls over procedure change review and approval. These administrative controls have been revised. An additional cause was inadequate generation and review of the safety evaluation associated with the procedure change. Safety evaluation training for appropriate personnel will be enhanced.

NRC 7ere 386 (6491

,,,,_- .._ .,uct .. .. .v6. . , .

. ' , a' ,,,,,,,,,,,,,_,,.

t r,.i t y==

LICENSEE EVENT REPORT (LER) 'd,'L",L',%

TEXT CONTINUATION FJ".'i,s",'dERJOJ'.*Fo*i's,'%*f"f,t.'

 !"ffai30'. Mile'"','!#'".'UEiff N"

,'F.f"t.','i%'Ji,"."1'jf,*.a,',!Oic,NOT,N.

WahhGEMihi AND DVDGET W A&M DC M603.?*

TV tsaast 4,6 ppct 61,suestg. (3p Lt. huantt R IS) 9604 (31 oaa " = ." t'a*J:

Fort Calhoun Station Unit No. 1 o 16 l o j o I o l 21 815 8l 9 -

012l2 -

0l 0 01 2 w 0 l6 verw . .c % m.w mi The procedure change program at Fort Calhoun Station is controlled by Standing Order G-30, Setpoint/ Procedure Changes and Generation. Revision of a controlled arocedure in Fort Ctlhoun Operating Manuals requires completion of a procedure c1ange form (FC 68) with attachments and a safety evaluation form (FC-154) which satisfies the requirements of 10 CFR 50.59. Selected individuals are trained and qualified to perform the screening and analysis process for the 50.59 safety evaluations, and to independently review this work done by other qualified individuals. This documentation is reviewed and recommended for opproval by appropriate individual members of the Plant Review Committee (PRC) aHd at least a quorum of the PRC as a group before final approval tT the Plant Manager (PR(, Chairman) or his dcsignated alternate.

Proceauce change packages tre normally distributed to PR0 members fer review pr1or to the PPC neet(rp..

Each procedure change package is discussed individually at a PRC meeting, if the reouit ed rumber of members have signed approval of a change following l individual review .tnd no problers are identified, general Connittee approval can be recommended. The change package is subsequently stamped as PRC Apprcved <

and set aside for Plant Manager signature and final approval. If for any reasor, a change packtge can not be approved by the PRC, any concerns or deficiencies are isoted with the package and returned to the originator for resolution prior to resubmittal to PRC. Following Plant Manager final review and signature, the change is incorporated into the procedures in the Operating Manual.

I I

Surveillance test ST-CEA-1 F.1 is utilized to verify pro)er operation of the control circuitry for the control element assemblies. T1e test is run with the I

unit in hot shutdown conditions. It was determined that the performance of I certain sinss required to obtain the right testing conditions for the  !

( surveillauco test would also generate an automatic diesel start signal. To

! tainimize unnecessary challenges to the emergency diesels, the System Engineering group investigated changes to tae test procedure.

l_ In June 1989, the System Engineer submitted a procedure change to ST-CEA-1 F.1 which included placing the diesel mode control switch into the "0FF AUT0" position for both diesel generators simultaneously. This would defeat the automatic start function for the diesel generators. The System Engineer felt j this change was justified for two reasons:

1) the diesel generators would be operable because the their design function with minimal operator action,ytheir could mode stillbeing perform controlled by a surveillance test.

2) this condition was not a safety risk because even if both diesel generators were considered to be inoperable, the Technical Specification 2.0.1 requirement that "the unit shall be placed in at least HOT SHUTDOWN within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />" was already met when the test was to be performed.

9 C Pass. SEBA 440)

e,hc DOMsBetA U.6 huctEAm 960utaiony C0eskussion

• ' APPm0v10 Out NO. 316DC104 txPimts 4/3092 UCENSEE EVENT REPORT (LER) WafA%',T.NJ'!3"l',/ ..'n','l s,"O's l TEXT CONTINUATION  !?""A",18.';!"M'"MinN!WeO,'UM".'L*?RA P art.wo at itch J (3 0 i0 IC 07 MAhAGEMINT AND tuDGtf.m A&MINGTON.DC 20bO3.

!. P ActLeiv ,eae84 (16 DOChli NUM$4 h (31 tla huessta 14 PADI (31 I

.... wp,*6 g,n --

Fort Calhoun Station Unit No. 1 o ]s jo lo j o l2 l 8l5 8; 9 ._

0l2l 2 __ O0i 0l3 or 0l 6 wtv . ec, m mm TherelevantlimitingDesignBasisAccident(DBA)forthisincidentdiscussed intheUpdatedSafetyAnalysisReport(USAR)isalargebreakLOCAcoupled with a Loss of Offsite Power. The DBA assumes an initial condition of 102%

power and the diesel generator mode switches placed in the " Auto Standby" position. Section 14.15 of the USAR notes that during the DBA, the diesel generators are required to autotatically start, accept safety injection loads, and initiate re flood of the core within 30.32 seconds. The USAR also ercounts for the failure of one of two diesel generators in this DBA accident.

When completing the saf ety evaluation for the procedure change, the Systern Engineer incorrectly responded to two questions in the safety evaluation -

screening process. A *No" respons. was marked when asked " Docs the prope. sed -

chanp inralve changes in the facility es described in the USAR?" i'his M sponse we4 justified in the System Engir,eer's opinion since no physical alterations were performed on tne plant. The writer failed to address or consider that the diesel generstors are described in the USAR as having automatic start capability. ,

The secor.d incorrect "No" response was marked when esked Could the activity affect nuclear safety in a way not previously evaluated in the USAR7" The writer of the safety evaluation had a misunderstanding of the operability of the diesel generator in correlation with the position of the mode switch.

There was also a sense of security in the fact that the initial plant -

condition would be 0% power instead of 102% as described in the USAR and that credit could be taken for operator action, it is thus concluded that the System Engineer failed to recognize the possibility that the procedure change was a potential unreviewed safety question and that further evaluation was necessary. The person performing the review of the safety evaluation made the same error.

From the period of June 20 to July 12, 1989, the procedure change for ST-CEA-1 f.1 was independently reviewed by four PRC members but the review failed to disclose the errors made in the safety evaluation. On July 18, while an Assistant Plant Manager was the acting Chairman for a PRC meeting, several concerns were raised during discussion of the procedure change, including the prudence of the change and its effect on diesel operability.

The procedure change for ST-CEA-1 was rejected until these concerns could be resolved. There was a belief shared by several PRC members that due to the initial conditions, it would be acceptable to take credit for operator action to manually start the diesel generators in a timely fashion should the need arise. It was the intent of the PRC to discuss this procedure change further at a later date for a workable solution.

c e- =.A

o

, g vi.uca.....ou,o..

n,c.n u==

LICENSEE EVENT REPORT (LER) ISl",".',%$8lM',?ol'!?o*i'n3 *f"f# IE."Ja$ I TEXT CONTINUATION  !?"*AYS*,P.'ff1*ciUN'.U"cU,'EnN"s' UENfA o

M"..A','8",JJi*n'!'J.M,o",'E*ic,?%*#A'

.oi m .~o umn-.~ 21o* oc == Of.'i j

. .e ,6., , . o. , um n v . ., n . ,, o . . .., ....,,,  ;

! ma i- " m .;r." WJ.T: I i

Fort Calhoun Station Unit No. 1 o l6 jo jo lo l2 [ 8l5 g9 _ 0;2;2 __ 0;O Ol4 or 0;6 rent w .-.

l

.e % m.m nn  !

I After being rejected, the procedure change is believed to have been inadvertently placed in the " Approved " stack rather than the *Non-Approved" stack by a substitute PRC Technical Secretary. Subsequently, the procedure change was inappropriately stamped as approved after the meeting was adjourned and then returned to the System Engineer.  ;

1 The System Engineer made all corrections thought necessary to add.ress PRC l concerns. Seeing the PRC ' Approved' stomp en the p oce6ure cha.4e cover l sheet, the System Engineer believad wly correctioris need?u to be made to tha I procedure itself Lefore the procedu:e cnange was ready for incorpention. The Synen Ftgireer did not eelieve the procedure ch.nge required re4rvbmittal to  :

the PRC because of the starb On August 1. the System Engineer hand carried the pro: educe change to the Plant Manager (who had not been involved in the initial PRC review). The  ;

Plant Mana er was infern.ed that all concerns were addressed and the procedure '

' had been a.tered accordingly. The Plant Manager was led to believe the procedure we.s ready for acceptance and finel signature because (1) the procedure change was stamped as ' Approved', (2) the System Engineer indicated theprocedurechangewasreadyforapproval,and(3)thePlantManagerhad received no information from the Assistant Plant Manager concerning this subject. The procedure change was thus approved and incorporated into the Fort Calhoun Operating Manuals effective August 5, 1989.

At this point a condition existed which alone could have prevented the fulfillment of the safety function of the diesel generators. An approved procedure was available for use which would have caused the diesel generators to become inoperable with respect to automatic start capability. This is a >

condition reportable to NRC pursuant to 10 CFR 50.73(a)'(2)(v) which was not known at the time.

On Scptember 26, after a brief maintenance outage, the )rocedure ST-CEA-1 F.1 was required to be performed before reactor startup. Tae Shift Supervisor and the operating crew noted the procedure had been changed to allew both diesel generators to be ) laced in the "Off Auto" position. The operating crew felt uncomfortable wit 1 this system alignment and notified the Operations Supervisor prior to allowing >erformance of the test. The surveillance test was subsequently required to ye changed to eliminate disabling both diesel generators prior to starting the test procedure. Reportability of these events was not recognized at this time.

.ac e-

Wht ,OhtB W U 6. WWChi&M kt1WLaTLMV CORABIEDDh

. i k,,u. -

UCENSEE EVENT REPORY (LERI 'N'",01,%'?s",NJ',U,"$1,%'ff# ,T."Jll's TEXT CONTINUATION itt'"#,l' ",!".'ffai MN'.M!,'e'"f,'l# '".' Mf!

M',P,",'. ",JeE""1?M'!"?,i'?"4.M" t'; fili O MAh&GEMENT AND SuDGif th A&MihGTOh, DC 20bD3 thCtLef t ts4W m DOCktt edutaDlh pi 449 teuestth 14) ,A64 (31 ma " t'.W." .

l'an Fort Calhoun Station Unit No. 1 o ls ]o j o lo l2 ] 8;5 8;9 _ 0;2;2 _ 0; O 0,5 o, 06 T5k1 M masse ausse a seeissEX ses estRusqW 8WAC ,er.n W W tih A subsequent review of the approved procedure change to ST-CEA-1 by the Nuclear Safety Review Group revealed that the change was a potential .

unreviewed safety question. An Incident Re was initiated on November 15, 1989 to document the problem.During port (89-0646) evaluation of this report it was determined on November 20, 1989 that this event was reportable since it matched ar, example given ir. Sepplement 1 of NUREG-1022. Hence, the report dete for the LER is more 'han 30 days from the date the reportable condition i

begen.

A root cause of this event was inadequacy in the administrative controls over procedure change review and approval, particularly in the hendling of documentation during and af ter PRC consideration. This ailowed a procedure change which the PRC did not intend to approve to inadvertently be approved and incorporated into the Station Operating Manual.

An additional root cause was the inadequate generation and review of the safety evaluation provided to sup) ort the procedure change. If the evaluation had properly identified the possi)ility of an unreviewed safety question being created, the change would not have been submitted to the PRC for review.

There was also inappropriate agreement with the safety evaluation by several PRC members who initially approved the change.

The following corrective actions have been implemented to preclude recurrence of this type event:

1. A change has been made to Standing Order G-5, Plant Review Committee, which better defines the rules of order for PRC meetings and the handling of documents reviewed by the PRC. Any procedure or change rejected or requiring comment resolution will not be stamped.

2. A representative review has been performed of procedure changes approved during the June through September, 1989 period. This review revealed no other instance where a procedure change was approved and incorporated into the Operating Manual without proper PRC review and concurrence.

3. Qualifications for the writing and reviewing of 10 CFR 50.59 safety evaluations have been withdrawn from the two individuals who completed safety evaluation screening for the ST-CEA-1 procedure change until retraining can take place.

4. The Plant Manager has discussed this event with the PRC members involved and emphasized the need for adequate review of safety evaluations.

e,>

r i

,p u. .t A. .t.utAio.v oo ,

E xPC E S- 4/30802 UCENSEE EVENT REPO;T (LER) $l",'.!!,%'did MUo$'!!a"ul't,'%i"l,Il is.",mi"%

TEXT CONTINUATION $"",'t,'o'.%'.'""'*cilJ"fulflc'n,'!JS".' *'Et" f!

1 t Att miarO h4 u 1aON R 0 0 0 C OF MANAGlut NT AND tvDotT,m Ann NGTON. DC 20bO3.

D ACl4ITY 44 4 Hi DOCkti Wue.Sthtal 48 R Nt h (61 PA04 m ns= "n' :' ?i:. :

Fort Calhoun Station Unit No. 1 ois;o;o;o;2;8;5 8; 9 __ 0;2l2 ._ 0; O 0;6 or 0; 6 vint 0 . .,,e ,.- m nn The following corrective actions will be implemented:

1. Training on this event as a case study will be given to all regular and alternate pRC members. This will be completed by February 16, 1990.

2. Lessons learned from this event will be included into the training program  ;

for 50.59 ssfaty evaluations. This will be completed by February 1,1990. I

3. The 50.59 safety evaluation training program w;11 be revised to include periodic recertification of personnel qualifie:I to perform safety evaluat{ons. This wili be implemented by May 31, 1990.

4. A full 50.59 evaluation will be performed for the change to ST-CEA-1 which initiated this event. This will be completed by January 5, 1990.

There was minimal safety significance associated with this event. The fact that the procedure as approved was cor.trary to Technical Specification 2.7 was recognized by the operating staff prior to cicarance being given to perform it. Even if the procedure had been pe.' formed as ap) roved, the conditions (hot shutdown) for running the test would have reduced tle consequences of an accident requiring emergency power and increased the time available for providing emergency power. Finally, the automatic start availability of the diesel generators could have been easily restored by repositioning the mode control switches if the need arose.

This is the first event reported for Fort Calhoun Station where an erroneously approved procedure could have presented fulfillment of the safety function of a system.

mac penn a.e4 546)