ML20006A336

Engineering Evaluation Rept,Operator Actions During Operational Events

ML20006A336
Person / Time
Issue date:	01/30/1990
From:	Israel S NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
Shared Package
ML20006A335	List: ML20006A334 ML20006A336
References
TASK-AE, TASK-E909 AEOD-E909, NUDOCS 9001260135
Download: ML20006A336 (8)

Text

--

7.,

7 Q :d.l'.

' L.

'. /

i. 'yr

(-

p '..,.

AE0D/E909

1 ENGINEERING ~ EVALUATION REPORT j

t OPERATOR ACTIONS DURING i

+

OPERATIONAL EVENTS T

1 January, 1990

1..

by: -Sanford Israel i

1 i

i.

1 l;

Office for the Analysis and Evaluation of Operational Data e

3 iRG PDC POR

m pg g..

[-E l

4

SUMMARY

The institutional and experiential aspects of impromptu operator actions during

. operational events were reviewed to identify salient issues related to the adequacy of present guidance to the operators in this area. NRC initiatives have not resolved this issue at present and operating events involving impromptu operator actions continue to occur.

Existing utility organizational attitudes as well as operating procedures and operator training may not sufficiently limit or minimize the tendency for the operators to take impromptu actions, which may not necessarily be beneficial to the ultimate recovery from an event.

a 1.

INTRODUCTION Following the auxiliary feedwater event at Davis Besse on June 9,1985, Generic Issue 125.11.10, _ " Hierarchy of Impromptu Operator Actions," was created to address potential operator shortcomings noted during the event. Prior guidance on impromptu operator actions is articulated in Information Notice No. 79-20 and Circular No.81-02 which provide high level policy not easily interpreted at the functional level. Generic Issue 125.11.10 was subsequently dropped and subsumed by Issue HF4.4, " Guidelines for Upgrading Other Procedures."

Ongoing events involving operator action again raise the question of adequacy of guidance for impromptu operator action.

2.

DESCRIPTION OF EVENTS i

McGuire. Unit 1 On September 2,1986, a pressurizer safety valve lifted at a system pressure l-below the design relief point and failed to reseat at the design reseat pressure l

(Ref. 1).

At the time of the event, the system was being pressurized to 2400 psi as part of a leak test while in Mode 3.

The operators were carefully 1

monitoring system pressure and blocked the safety injection (SI) actuat' ion signal l

at 1955 psi as the pressure was decreasing.

Safety injection automatically actuates at 1845 psi. The valve reseated almost immediately after the SI signal was blocked and the system reached a minimum pressure of 1800 psi.

_j l_

The SI signal was blocked after discussion between the two reactor operators and l'

the senior reactor operator regarding plant conditions and the safety of plant personnel inside containment at the time. According to an NRC inspection report (Ref. 2), the licensee management indicated that-Duke Power Company's general policy, which was made known to the operators during their training program, was i

not to b'ock any safety function from automatically initiating.

The licensee L

defended the shift supervisor's actions which deviated from procedures (under L

10CFR50.54(x)); however, the licensee conceded that blocking the SI signal did L

not enhance the safety of the personnel inside containment.

McGuire. Unit 1 On March 7, 1989, a steam generator tube ruptured causing a rapid decrease in pressurizer level and the condenser air ejector radiation monitor to alarm (Ref.

3). The operators believed they had a steam generator tube leak and therefore used recovery procedures for this less severe scenario.

These procedures did not encompass all the well developed actions found in the emergency procedures for a steam generator tube rupture accident which were appropriate in this

c i

instance.

As> a result,. there was an unnecessary delay in the cooldown and-depressurization of._the reactor coolant system which increased the amount of reactor coolant transferred to the secondary system and the offsite radioactive releases.

The overall mitigative strategy deviated substantially from the Westinghouse Owners Group Emergency Responso Guidelines for a steam generator tube rupture.

Plant cooldown was substantially delayed because of cen:ern for boron concentration and system temperature / pressure limits imposed by'the operating procedures-used in the recovery.

In any event, the operators were successful in-finally depressurizing the reactor with aid from their technical support center and use of selected portions of the steam generator tube rupture emergency procedures.

~3.

DISCUSSION These operational events all developed slowly enough to permit operator intervention before automatic actuation of engineered safety features occurred.

The first example involved the deliberate defeat of an engineered safety feature because of a perceived plant personnel protection problem. This action occurred while the plant was in the middle of an uncontrolled depressurization event.

This deviation from procedures and training was supported by the operators' perception that-core cooling was not in any immediate jeopardy and that they could actuate high pressure safety injection manually if needed.

It was subsequently determined that the impromptu action would not have provided the personnel protection anticipated. Belatedly, the action was justified under the provisions of 10CFR50.54(x).

Concern about implementation of procedures at McGuire was expressed in an NRC diagnostic report in 1988 (Ref. 4). A conclusion reached in this report stated:

"However, the considerable flexibility given the operators in implementing some procedures, as well as a lack of detailed guidance and technical information in certain procedures, contributed to the procedural deficiencies and the personnel errors in following procedures which were observed or identified in records..."

The report also observed that "The practice of giving the operators greater flexibility in some procedures could carryover into the use of this practice in other

- procedures which require strict verbatim step-by-step compliance to assure safe operation of the plant."

These comments emanated generally from a review of normal operating procedures, control room logs, and observation of a plant start-up. None of these situations involved events as serious as those cited in the above examples.

McGuire is not unique in the flexibility given to control room operators.

An NRC inspection report on the licensed operator training program at Indian Point, Unit 2- (Ref. 5) indicated that the instructors were providing conflicting directions to the operators. An excerpt from this report is:

2

' a

+

4

/

"The problem was initially identified when the inspectors were observing

_ a-class of licensed operators during simulator training.

One of the operators started a - pump, with the supervisor's approval, before the procedure called for t. hat pump to be started.

During-the simulator instructor's post-scenario critique of the operators' performance, the operators were congratulated for thinking ahead but no clarifying or.

corrective comment was made with respect to the steps being performed out of sequence. The int;pectors questioned the instructor about his comments-and-determined that the instructor was not teaching the procedural requirement that the E0Ps are to be implemented as written. During a later meeting with both simulator instructors and the operating training administrator, the inspectors' concern was reenforced. Additionally, the second simulator instructor stated that -they teach

" good operating philosophy" and should not be forced to teach policy.

Subsequent interviews with-operators indicated a level of confusion as to what is expected of them with respect to E0P compliance.

0AD-15, Policy for Conduct of Operations, Revision 8, Paragraph 5.7.3 states ' Personnel shall not give directions, guidance, or clarifications which conflict with approved procedures '

Paragraph - 5.7.5 states

'Following procedural steps in sequence is only mandatory in cases of j

Emergency Operating Procedures.'"

j This concern did not get elevated to the status of an unresolved item, an open i

item, or a violation in the inspection report.

-i A similar type of environment is illustrated in the Augmented Inspection Team report on the loss of offsite power event at Pilgrim in 1987 (Ref. 6).

The procedures'for restoration of offsite power were fragmented and did-not appear l

l to provide an integrated strategy for coping with a station blackout. The report i

states:

L

" Discussions with watch engineers indicate that based on their experience i

and plant knowledge, they are prepared to take prudent actions, without i

spending substantial time sifting through and interpreting the interrelated I

procedures which would cover the full spectrum of operator actions during j

a station blackout."

Thus, impromptu actions are anticipated even for important events.

1 The steam generator-tube rupture event at McGuire in 1989 (Ref. 3) presented a situation where the procedures were flawed.

The operator used an abnormal procedure supplemented by additional actions based on training and advice from the technical support center. Thus, the response was not a verbatim implemen-tation of procedures.

Of most concern in this event is the fact that the operators weren't following the guidelines developed by the Westinghouse Owners-Group (WOG) for recovery from a steam generator tube rupture (SGTR).

The AIT report does not give any indication that the operators or the technical support center personnel ever said they should be following the WOG SGTR guidelines, although selected portions of the guidelines were used during the recovery.

3

e-W

+

,m>:

a h

A SGTR is not a hypothetical event in the FSAR. Considerable attention was given to this - accident after the Ginna event in 1982 to preclude unnecessary overfilling of the steam generator caused by a delayed plant cooldown 'similar to that which occurred at McGuire.

The WOG guidelines were very effective in facilitating the recovery of-the SGTR event at North Anna in 1987.

These guidelines also-served as the basis.for accepting for referencing the topical report "SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill,"WCAP-10698. The NRC staff conclusion (Ref. 7) states in part, "We find that the path of operator action assumed for the design-basis SGTR analysis is consistent with ERG-specified steps and able to be performed with the calculated i

symptoms values."

Consequently, was a high expectation that these procedures a

would be used for these events.

Flawed emergency procedures were flagged in information notices in 1986 and 1987 (Refs. 8 and 9).

In addition, similar findings were made in 1988 in a summary report of an accelerated E0P inspection program (Ref.10).

Because of these circumstances, some operator impromptu action is expected.

This raises the question of adequate guidance for impromptu actions remembering that the whole issue of emergency procedures was brought to the forefront by impromptu actions during the TMI accident.

The issue of operator guidance, Generic Issue No. 125.11.10, " Hierarchy of Impromptu Operator Actions," was raised after the Davis-Besse event in 1985 when the operators delayed initiating feed-and-bleed cooling immediately upon reaching plant conditions where such action was required by the emergency procedures.

In 1987, the staff dropped this issue from further consideration (Ref.11) citing ongoing work on Issue HF4.4, " Guidelines for Upgrading Other Procedures." The discussion surrounding this resolution appeared to be directed at disregard for safety in favor of operational or financial benefits.

It was concluded that l

existing enforcement apparatus was sufficient to deter these types of activities and that HF4.4 would resolve any residual concerns about impromptu actions noting that " Issue HF4.4 is to provide assurance that plant procedures are adequate and can be used effectively..."

l Providing assurance that the procedures are adequate and can be used effectively l

is a significant task.

For example, the SGTR event at McGuire was a straight-l forward, uncomplicated event with extensive prior discussion, interest, and expenditure of resources. It is inexplicable that the recovery procedures were 1.

flawed even if it was being treated as an abnormal event rather than an accident.

l The recovery process would lead through the same decisions and actions as those l

presented -in the SGTR guidelines as indicated by the extensive modification of the abnormal recovery procedure af ter the event.

Guidance for operator actions is stated in Information Notice No. 79-20, Rev.

1, (Ref. 12) which reads:

"NRC policy for the responsibility for safe operation of NRC licensed facilities continues to be as follows:

(1) The facility licensee is responsible for assuring that the facility is operated within the requirements of the license, 4

l e

u

.i

'l Technical Specifications, rules, regulations, and Orders of the NRC and for the actions of their employees.

(2) NRC licensed individuals are responsible for taking timely and proper actions so as not to create or cause a hazard to " safe-operation of ~ the facility" (i.e. actions or activities, including

~ failure to take action, related to the facility which could have an adverse affect on the health and safety of the public, plant workers -

or the individuals)."

This same policy was reiterated about two years later in Circular No. 81-02 (Ref.

13).

Similar general guidance are found in plant administrative procedures defining operator responsibilities.

These guidelines are general and do not provide explicit guidance for handling real conflicts and dilemmas.

Thus, the responsibility for making the "right decision" during the " heat of battle" is imposed on the operators without any structured framework for making marginal decisions other than reliance on their general simulator training, experience, and their native ability.

In Ref.13, in discussing expected performance of licensed individuals, the circular - states:

" Factors making up this professional attitude include... aggressiveness of the operating staff to prevent operational problems, and correcting observed deficiencies."

The operators in the two events cited above were aggressive in responding to the situations at hand, however, in hindsight, none of these impromptu actions were particularly useful in accomplishing the operators' intents or expeditiously recovering from the event as was the case with the steam generator tube rupture accident.

These results may be atypical, but they illustrate the potential deficiencies of impromptu actions.

Intuitively, one would expect that impromptu actions would be beneficial or benign in the majority of the situations because of the operators' high level of skill and training.

The question of consequence, though, is not how often they perform impromptu actions correctly, but rather, how often will their actions be deleterious and impose a hazard all by themselves.

The two major-nuclear accidents (TMI and Chernobyl) attributed to human errors indicate that-impromptu actions are a significant contributor to severe accidents.

In addition, there have been several situations noted above where the operator responses may have been acceptable within the framework of existing procedures, but in hindsight may have been less than optimum.

The present process of controlling or directing impromptu actions appears to lack specificity.

Policy encourages aggressive actions and holds the operator responsible for taking appropriate corrective action that will not cause a hazard to safe operation.

The situations previously discussed certainly show a willingness to take independent actions with or without procedures available.

L Specific criteria for making these decisions are generally articulated at a high level that may not provide any effective operational guidance. The depth of the guidance-provided in the past may have been predicated on the availability of i

effective operating procedures and extensive operator training.

As noted in the above discussion, both of these programmatic entities may need further l-improvement.

5 1

[~

e g. 7. :

Lv 4;

CONCLUSION

- The present guidance to the operators regarding impromptu actions should be improved to facilitate making ad hoc decisions when conflicts or dilemmas arise

-during recovery from.an event.

This guidance could take the form of a simple decision structure that ranks functions or actions in a prioritized form or may be training that deals with a range of potential conflicts and dilemmas and-

. identifies the preferred paths of action.

5.

REFERENCES 1.

Duke Power Company, Licensee Event Report 50-369/86-016, McGuire, Unit 1, October 2, 1986, 2.

U.S. Nuclear Regulatory Commission, Inspection Report 50-369/86-28, McGuire, Unit 1, November 5, 1986.

i 3.

U.S. Nuclear Regulatory Commission, Inspection Report 50-369/89-06, McGuire, Unit 1, April 10, 1989.

4.

U.S. Nuclear Regulatory Commission, Diagnostic Evaluation Team Report for McGuire Nuclear Station, March 8, 1988.

5.

U.S. Nuclear Regulatory Commission, Inspection Report 50-247/88-07, Indian Point, Unit 2, May 2, 1988.

i 6.

U.S. Nuclear Regulatory Commission, Inspection Report 50-293/87-53, L

Pilgrim, December 14, 1987.

l L

7.

Letter from C.E. Rossi (NRC) to A. Ladieu (WOG), March 30, 1987.

l-8.

U.S. Nuclear Regulatory Commission, IE Information Notice No. 86-64:

l-

" Deficiencies in Upgrade Programs for Plant Emergency Operating l

Procedures," August 14, 1986.

9.

U.S. Nuclear Regulatory Commission, IE Information Notice No. 86-64, l

l Supplement 1, " Deficiencies in Upgrade Programs for Plant Emergency Operating Procedures," April 20, 1987.

10. Memorandum from J. Roe (NRC) to T. Murley (NRC), " Internal Report Summarizing the Accelerated E0P Inspection Program," November 3,1988.

11. Memorandum from H. Denton (NRC) to T. Speis (NRC) et al, " Schedule for Resolving Generic Issue No. 125.11.10, ' Hierarchy of Impromptu Operator Actions,'" February 1, 1987.

12. U.S. Nuclear Regulatory Commission, IE Information Notice No. 79-20, Revision 1, "NRC Enforcement Policy - NRC Licensed Individuals,"

September 7, 1979.

6

wr..;

9o: :.c. ;y i

e i'

s

(

.13. U.S. Nuclear Regulatory Connission, IE Circular No. 81-02, " Performance.

of NRC-Licensed Individuals while on Duty," February 9,:1981.-

-l p

l[.

i 4

}b b

r i

i l

i L

W 7

-.