ML20012B909

Responds to NRC 900130 Ltr Re Violations & Deviations Noted in Insp Rept 50-285/89-40.Corrective Actions:Changes Made to Procedure AOP-17 & Procedure Generation Package Incorporated in Plant Procedures as Standing Order G-74

ML20012B909
Person / Time
Site:	Fort Calhoun
Issue date:	03/07/1990
From:	Gates W OMAHA PUBLIC POWER DISTRICT
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
LIC-90-0167, LIC-90-167, NUDOCS 9003190152
Download: ML20012B909 (46)

Text

Omaha Public Power District 1623 Hamey Omaha, Nebraska 68102 2247 y ' 402/536 4000 z = March 7, 1990:

E LIC-90-0167 ,

L

_ U.E S. Nuclear Regulatory Commission Attn: Document Control Desk-Mai1= Station P1-137 Washington, DC 20555

References:

1. Docket No. 50-285

-2. Letter from NRC (Samuel J. Collins) to OPPD (K. J. Morris) dated January 30, 1990 Gentiemen:-

SUBJECT:

Response to Notice of Violation and Notice of Deviation -

Inspection Report 50-285/89-40 0maha Public Power District (0 PPD) received the subject inspection report which identified one violation and one deviation. The violation involved inadequate =

emergency and: abnormal- operating procedures (E0Ps/A0Ps). - The deviation in--

-volved a failure to-validate new and revised E0Ps in accordance with the requirements of the Fort Calhoun Station Procedure Generation P6ckage (PGP). A-one week extension te the commitment date was; agreed to by Mr. J. Jaudon of Region.IV. P. lease' find attached OPPD's responses to the Notice of Violation and the Notice of Deviation in accordance with 10.CFR Part 2.201.

In: addition to the corrective actions described in'the! attached responses, OPPD

~

will: :1) perform a validation of- control room actions within the E0Ps/A0Ps using the Fort Calhoua plant specific simulator following the simulator's acceptance for training, and 2) document and resolve:th~e comments on the< EOPs

, , provided in-Section 2 of the subject inspection report in accordance with the E0P/A0P. Writers Guide (Standing Order G-74). Item-1 will be compl_eted by July 31,:1990 pending the transporting and testing of the FCS control room simulator. Item 2'will be completed by May 1, 1990.

Page-8,-Section 2.2, Paragraph 3, of the inspection report states that, "At the

= time of _the inspection, formal training of licensed operators had been--

. completed on only E0Ps --06, -07, and -20. Final review of all training lesson (plans.used to familiarize the operators with the revised E0Ps was not L complete. "

OPPD has adequately addressed this lack of " formal" training. The two cycles

of requalification training immediately prior to implementation of the revised E0Ps provided the operators with both classroom and simulator training on the function and use of the revised E0Ps. The training effort underway at the time fof the ins 3ection was post-implementation follow-up training designed to heighten tie operator's awareness of the revisions, and review significant

.9003190152 900307 ID

.PDR Q -ADOCK 05000285 #

A PDC #

J 45 5:24 ' ' Employmen h Equal Opportundy l{

i

u4

.', '4.

U. S. Nuclear Regulatory Commission LIC-90-0167_.

Page 2 4

aspects ~ of the use of the E0Ps. Since the inspection, that training effort has been completed and E0P training is now being worked into the standard requalification rotation.

l As a result of our conference call, OPPD has reviewed revisions made to the E0Ps since the date of the inspection. To date, none of these revisions has

'affected the applicable portion of the procedural steps at issue in the inspection report. Therefore, the current version of the applicable _ E0Ps are unchanged from the time of the inspection. If you should have any questions, please contact me.

Sincerely,_

n. 2. 2.n-W. G. Gates Division Manager Nuclear Operations WGG/pjc Attachments

-c: LeBoeuf, Lamb,'Leiby & MacRae A. Bournia, NRC Project Manager R. D. Martin, NRC Regional Administrator, Region IV P. H. Harrell, NRC Senior Resident Inspector 1

4 4 ATTACHMENT RESPONSE TO A NOTICE OF VIOLATl08.

During an NRC inspection conducted October 23 through November 9, 1989, a vio-lation of.NRC requirements was identified. The violation involved inadequate emergency and abnormal operating procedures (E0Ps/A0Ps). In accordance with -

! the " General Statement of Policy Procedure for NRC Enforcement Actions,"

Title 10 of the Code of Federal Regulations (10 CFR) Part 2, Appendix C (1989), the violation is stated below:

Technical Specification (TS) 5.8.1 states, in part, that written proce-dures shall be established, implemented, and maintained that meet or exceed the minimum requirements of Appendix A to Regulatory Guide (RG) 1.33.

Section 6 of Appendix A to RG 1.33 requires procedures for combating emergencies and other significant events. The licensee has issued Procedures AOP-17, " Loss of Instrument Air"; E0P-02, " Loss of Offsite Power and- Loss of Forced Circulation"; E0P-06, " Loss of All Auxiliary Feedwater"; and E0P-20, " Functional Recovery Procedure," to meet the requirements stated in TS 5.8.1.

Contrary to the above, the licensee failed to maintain these emergency -

and abnormal operating procedures adequately as evidenced by the specifics listed below:

1. Procedure AOP-17

a. The procedure instructs operators to control feedwater flow using the feedwater regulating bypass valves through the alternate auxiliary feedwater injection path. However, the auxiliary feedwater injection valves -(normal flow-path) fail open on loss of instrument air, which would mean that while the operator is establishing flow control with the main feedwater regulating bypass valves, the steam generators would be filled through the normal flow path. This procedural inadequacy represents a potential for initiation of an overcooling event.

b. Upon loss of instrument air pressure to containment, the pres-surizer spray valves fail closed. The procedure notes that reactor coolant system pressure control may be difficult; however, the procedure does not provide the alternate method available for pressurizer spray. - The availability of this alternate pressurizer spray method to operations personnel could prevent a potential overpressurization event and unneces-sary challenges to the primary coolant system relief and safety

. valves.

1

=_

q l

+, Y 2. Eracedures E0P-02. -06. -20

a. Step 3.6.d of E0P_-02 does not address the need to augment the j cooling water for the air compressors if turbine plant cooling j water is not available. The failure to provide adequate cool- i ing water flow could result in overheating and subsequent loss of the air compressors. ]

b. Steps 3.8 and 3.9 of E0P-02 do not provide instructions for the l control room operstor to ensure that the radiator exhaust damp- 'l ers open for emergency diesel generators 1 and 2. The failure of the dampers to open would result in overheating and subse-quent loss of the diesel generator.  ;

c. Step 3.11 of E0P-06 states, in part, that the control room operator should immediately initiate once-through-cooling-(0TC) if both steam generators are less than 20 percent water level and' reactor coolant system (RCS) temperature is increasing.

However, the control room operator may never get to Step 3.11 if these conditions exist and the safety function status check success criteria are not met because the control room operator is directed by the procedure to enter E0P-20. The immediate initiation of OTC is necessary to preclude core damage.

d. Resource Tree E of E0P-20 indicates that OTC will be successful-lt if there is one operating high-pressure safety injection (HPSI) ,

pump and-RC', pressure is less than 1350 psig. Step 6.8 of the

~

L safety function status check does not designate the number of HPSI pumps required. The procedure fails to provide adequate success criteria to= assure that the proper number of HPSI pumps ,

I are available to support OTC.

This is a Severity Level IV violation. (Supplement I)

OPPD RESPONSE:

(

1

l. Reason- for the Violation, if Admitted OPPD admits to certain portions of the violation as stated in the Notice-of' Violation dated January 30, 1990. Specifically, OPPD admits that it failed to maintain procedures A0P-17 and E0P-20 adequately. However, OPPD considers procedures E0P-02 and E0P-06 to meet the requirements stated in TS 5.8.1. ,

I Procedure A0P-17 Concerning comments 1.a and 1.b, OPPD admits Procedure A0P-17 was inade-quate to perform its intended function. The failures in the adequacy of A0P-17 occurred because the revision in use at the time of the inspection had not been verified or validated in accordance with Standing Order G-74, " Fort Calhoun Station E0P/A0P Writers Guide." When Revision 13 of A0P-17 was issued, Standing Order G-74 did not exist,.and the Verifica-l tion and Validation requirements of Standing Order G-73, " Fort Calhoun Station Operating Manual Procedure Writers Guide" were not as stringent, resulting in the failure to perform a complete walkdown of the procedure.

1

c. 'i Procedure E0P-20 Concerning comment 2.d, OPPD admits that E0P-20 was inadequate in that it gave conflicting guidance as to the acceptance criteria for the HR-4 Heat Removal Success Path.

During OPPD's evaluation of the apparent discrepancy in E0P-20 between the Resource Assessment Tree E Success Path HR-4 acceptance criteria and the acceptance criteria elsewhere in the procedure, it was determined that-the graphic depiction of Success Path HR-4 is consistent with the CE0G Emergency Procedure Guidelines philosophy of providing the control room operator with an indication of what equipment is available to satisfy the success path. The Resource Tree is not intended to quantify the equipment necessary to satisfy a success path. The acceptance criteria at the bottom of each success path are the only measure of ful-fillment of a safety function. Therefore, the HR-4 Resource Assessment Tree is adequate, and fulfills its intended function.

During the above evaluation, however, an ' inconsistency was noted associ-ated with the acceptance criteria stated.in step 6.8 of the Safety Function Status-Check, the Resource Assessment Tree for Success Path HR-4, and step 15.162 of the HR-4 Recovery Instruction. The inconsis-tencies between the various acceptance criteria occurred due to the

' literal adoption of the CE0G Emergency Procedure Guidelines (EPGs) acceptance criteria for the success path HR-4 resource tree, while the procedural guidance was modified to incorporate the results of an engi-neering evaluation on the adequacy of Once Through Cooling (0TC) at the FCS which was performed by Combustion Engineering in December, 1988.

OPPD considers the acceptance criteria specified in the Resource

' Assessment Tree, Step 6.8 of the Safety Function Status Check and Step 15.162 of the procedure provide adequate assurance of successful core heat removal. However, since these acceptance criteria do not directly correlate with each other, nor with the caution statement before Step 15.96 of'the procedure, the operator could become confused and fail to perform the proper steps to establish adequate OTC flow.

Procedures E0P-02. -06 Regarding the observations on E0P-02 and E0P-06, OPPD considers these procedures, as written, to be in full compliance with TS 5.8.1 and RG 1.33, Appendix A.

Comment 2.a states that Step 3.6.d of E0P-02 does not address the need to augment cooling water flow to the air compressors if turbine plant cool-ing water is unavailable. It is OPPD's position that E0P-02 is not the appropriate place for this guidance. The EPGs specify that the Optimal Recovery Procedures are written to "best estimate" scenarios (i.e. equip-ment which should be available to support recovery will be available to perform that function; see Attachment #1, Page 2-1, final paragraph). In a' best estimate scenario for Loss of Offsite Power, the assumption is made that a bearing water (turbine plant cooling water) pump could be restarted if power from the associated diesel generator was available to an air compressor. If a bearing water pump was not available, the loss of instrument air would complicate the casualty and thus require the control room operator to implement E0P-20, " Functional Recovery Proce-dure". Step 11.5 of E0P-20 provides the guidance needed to supply backup cooling water to the air compressore..

gm I t f C - Comment 2.b! states that Steps 3.8 and 3.9 of E0P-02 do not provide I

instructions to ensure that the diesel generator radiator exhaust dampers are open. .It is.0 PPD's position that there are two reasons why such I guidance is unnecessary in this E0P: j 1.- - A plant design modification w'as performed (see Attachment 2) which i greatly reduces the likelihood of the radiator exhaust damper fail- 1 ing to open. . Since the protective trip for diesel generator high ,

coolant temperature is disabled following an emergency start, the diesel. trouble alarm and high coolant temperature status light on J AI-30-01 and -02 would indicate that the engine was overheating.

Status lights on AI-20-01 and -02, showing position of the radiator exhaust damper, would lead the operator to conclude that he must take local action to open the damper. However, the likelihood of being able to open it locally prior to engine trip / failure on overheating is remote. This is due to the proximity of high temperature and rotating equipment to the valving equipment

< necessary to operate the damper, combined with a high rate of temperature increase with no air flow through the radiator 7

(approximately 9 minutes elapsed between engine loading and high temperature trip on September 23, 1987; see Attachment 3, LER 87-25). Therefore, the only realistic option for the operators are to either shutdown the diesel or allow it to run until it fails. .

2. Standing Order G-74 (Attachment 4 Part-3 Step 4.10) states that:

"Too much detail in E0Ps should be avoided in the interest of read-ability and comprehension. Avoiding too much detail is important in order to minimize errors and to allow for. timely response during emergency conditions..." and " Instructions for dealing with abnormal results need not be prescribed within procedural steps when it is a matter of standard practice. For example, observation of noise, vibration,' erratic flow or discharge pressure need not be specified by steps that start pumps." (Reference Attachment 1, pages 2-12 through 2-14; Attachment 5, INP0'82-017, Emergency. Operating Proce-dures-Writing Guideline; S.O. G-74 is based-upon these guidelines).

The operators are trained in both initial and requalification training to monitor for normal engine operation using the diesel engine status panels on AI-30-01 and D2.

NUREG 1358, Appendix C, Part 4, states in part; "During the inspections, the staff found that most E0Ps were written in a complex manner, using multiple action verbs, unnecessary supplemental information and inconsistent. terminology".

In order to provide a step or substep verifying the proper operation of the diesel generator radiator exhaust damper, OPPD believes that it would also be necessary to identify other diesel generator support equipment which could potentially fail to operate. The resultant step, which would have many qualifiers and specific contingency actions, would appear to be very similar to the first example of a poor procedural step given in Appendix C of NUREG 1358.

Comment 2.c states that the operator may never arrive at the step (3.11) directing OTC in E0P-06, Loss of All Feedwater, if he is required to exit to' E0P-20, Functional Recovery Procedure. OPPD agrees that this' scenario could occur. However, should the operator implement E0P-20 and enter one of the other heat. removal success paths before reaching Step 3.11 in y t E0P-06, he will find exactly the same guidance (Step 15.11 for HR-1, Step 15.37 for HR-2 and Step 15.81 for HR-3). Therefore, if complicating.

circumstances require implementation of E0P-20, all heat removal success .

paths will lead to OTC if it is necessary. The time necessary.for the transition to E0P-20 was considered in the development of guidance for OTC in the EPGs. If an event occurred where the loss of all feedwater resulted in a challenge to the heat removal safety function, the guidance in E0P-20 would quickly lead the operator to the heat removal success paths because he is required to address challenged safety functions prior to addressing any safety functions already satisfied. Validation results using E0P-20 on the Windsor simulator confirmed that sufficient' time does exist to reach the OTC guidance prior to the specified entry conditions.

1 The considerable amount of time taken by the operators to reach OTC guid-ance during the inspection appears to have occurred due to their belief that they had a considerable amount of time to steam generator (S/G) dry-out. This belief stems from the fact that the scenario they were given ,

indicated that following the trip, steam generator level had been restored to nornal operating level using only the steam driven Auxiliary Feedwater Pump (FW-10). Given the size of FW-10, a considerable amount of time would have elapsed before S/G 1evels had recovered, thereby greatly reducing the decay heat load at the time of total loss of feed-water. Coupled with the fact that there is considerably more inventory

-in the S/G's at normal level than at the reactor trip setpoint, it is OPPD's opinion that the operators' estimate of time to steam generator dryout was reasonable for the scenerlo to which they believed they were responding.

2. Corrective Actions That Have Been Taken and Results Achieved The following corrective actions were taken in response to the portions of the violation to which OPPD admits:

1., Procedure A0P-17 was walked down outside the control room and additional concerns were identified. These concerns were resolved and appropriate changes were made to the in-place procedure as well as the version that was in draft as part of the ACP upgrade project.

The upgraded version of AOP-17 was approved for incorporation into the Operating Manual on December 7,1989. It should be noted that-several of the concerns identified in the walkdown of A0P-17 had .

already been discovered in the table top validation efforts being performed as part of the A0P upgrade. The additional problems identified in Section 2 of the report were also incorporated in the upgraded version as discussed in Reference 2. ,

2. To determine the extent of outside the control room procedural deficiencies in the A0P procedure set, the additional A0Ps which' require action outside the control room were walked down as part of the upgrade validation. Included in the walkdown efforts were:

A0P-01, Acts of Nature; A0P-06, Fire Emergency; A0P-07, Evacuation of the Control Room; A0P-II, Loss of Component Cooling Water; A0P-19, Loss of Shutdown Cooling;- A0P-20, . Loss of Turbine Plant Cooling Water; and A0P-30, Emergency Fill of the Emergency Feedwater Storage Tank.

h" . 7 1 U-- I Generally,'the result's of these walkdowns were satisfactory, with only minor changes needed to enhance procedure usability. Any changes required by the validation have been incorporated into the

, procedures.

i

3. To' determine the extent of outside the control room deficiencies in the EOP procedure set, the E0Ps which require actions outside the  ;

control room were walked down in the plant to confirm that no sign- '

ificant technical changes had occurred during the 1989'EOP upgrade effort. Technical changes involve items which would result in a change in the way a system is operated or tne control methods used to operate the system (i.e., no change in strategy or intent). -

These procedures are: E0P-02, Loss of Offsite Power / Loss of Forced .

Circulation; E0P-03, Loss of Coolant Accident; E0P-04, Steam Gener-ator Tube Rupture; E0P-05, Uncontrolled Heat Extraction; E0P-06, i Loss of All Feedwater; E0P-07, Station Blackout; and E0P-20, Func-tional Recovery Procedure.

L The walkdown identified only minor technical errors and some label- .

ing inconsistencies which were primarily due to the use of " generic" equipment descriptions as opposed to exact label terminology. For example, it was discovered that an instrument bus inverter breaker was given the wrong number in E0P-20, although it was correct in another procedure.

4. In response to comment 2.d, E0P-20 has been evaluated to. determine ,

the adequacy of the guidance and acceptance criteria for success ,

path-HR-4. The acceptance criteria in Step 6.8 of the safety func-l tion status check include a requirement that CET temperature be less L than superheat, the Resource Assessment Tree E requires CET tempera-ture less than 700*F and Step 15.162 requires CET temperature stable or decreasing. These are consistent with the CE0G guidelines with l the exception of Step 15.162. A second instance in which some con-L fusion may arise exists because of the caution statement located before Step 15.96 in success' path HR-4. It states:

• Successful RCS

~ heat removal using.once-through-cooling recuires both PORVs open and l -at least two-HPSI pumps running. It' was cetermined by interviewing E 'one of the E0P writers that the intent of this statement was not to l- provide different acceptance criteria than appear elsewhere. It was

i. provided to reinforce the strategy of HR-4, which is to maximize the likelihood of success of OTC by attempting to get both PORVs open and at least two HPSI pumps running.

Corrective actions identified in the next section have been devel-oped to resolve these problems. Until these corrective actions are implemented, -the operators have been briefed 'in a formal classroom setting on the pending changes and that successful completion of the HR-4 success path is measured by satisfaction of-the acceptance criteria.

3. Corrective Actions That Will Be Taken To Avoid Further Violations OPPD believes the corrective actions already taken will prevent further violations. In addition, the following actions are planned.

6-

k. -)m.

u y _

n

< The E0P-20 acceptance criteria for success path HR-4 will be made con- '

sistent in the safety function status check, the Resource Assessment Tree E, and within the body of the procedure. The caution statement before Step 15.96 will- be replaced by the following note. "The actions in this L success path are intended to establish once through-cooling in which both PORVs are open and at least two HPSI pumps are running. In some cases, other configurations may be successful but this is the desired mode of operation. Successful completion of success path HR-4 is determined by i the acceptance criteria." Corrections to E0P-23.and other corrections developed as a result of comments generated during the various walkdown sessions will be incorporated into the appropriate E0Ps by May 1,1990.

4. Date When Full Compliance Will Be Achieved With the implementation of the changes to the E0Ps as described in Item 3 above, OPPD expects to be in full compliance with the requirements of TS 5.8.1 by May 1,1990.

l l

l l

l 1

l 7_

(

f,, HL . _

a W RESPONSE TO NOTICE OF DEVIATION

A' deviation _ from your commitments to the NRC was identified during the NRC .

inspection conducted October 23 through November 9, 1989. The deviation  !

. involved'a failure to validate new and revised emergency operating procedures l(E0Ps) in accordance with the requirements of the Fort Calhoun Station  !

Procedure Generation Package (PGP). In accordance with the." General State-  ;

ment of Policy for NRC Enforcement Action," Title 10 of the Code of Federal y* Regulations (10 CFR) Part 2, Appendix C (1989) (Enforcement Policy), the

. deviation is listed below:

-In a letter dated March 1, 1985, the licensee committed to upgrade exist- 4 ing and revised E0Ps in accordance with a Procedure Generation Package.

Part 5 of this PGP requires' that E0Ps be initially validated in the control mockup facility.

Contrary to the above, the E0P validation process did not include use of i the control mockup facility. (285/8940-02)

~OPPD RESPONSE-  ;

1. Reason for Deviation. if Admitted j l

-OPPD admits the deviation occurred as stated. This deviation occurred because of a failure to apply the proper administrative controls to the l PGP after it was submitted to the NRC in March, 1985. The PGP was not entered into the FCS administrative controls system until December 12, 1989. As a result, the decisions regarding the specific methods of-validation were not in conformance with any existing FCS procedure or the

, submitted PGP. Since the E0Ps had been validated on the control room ,

' mockup in 1985, based on the scope of changes _ to the E0Ps (which pri- i marily affected usability versus technical content), the best method of  ;

validation was a dynamic simulator validation at the CE generic control  !

room. simulator in Windsor, Connecticut supplemented by extensive table ,1 top validation sessions at the FCS. Because the PGP was not incorporated  :

into the Operating. Manual, no documentation of-the change of validation j method documented stated in the PGP or the rationale behind the change j could be shown. l

2. Corrective Actions That Have Been Taken and Results Achieved 1

The. PGP has been incorporated into the Fort Calhoun~ Station procedures as Standing Order G-74, Fort Calhoun Station E0P/A0P Writers Guide. The one <

E0P determined by OPPD to be a new procedure as defined in the PGP (Stand- ,

ing Order G-74) is .E0P-07, Station Blackout. E0P-07 has been walked down both in the control room mockup and in the-plant to ensure that all steps .;

in the procedure are operationally correct. All comments have been docu-  !

mented and resolutions have been prepared for incorporation in the next revision of E0P-07 to be approved by May 1, 1990. Walkdown validation of 4

~other E0P actions outside the control room are-addressed in the violation

-response sections of'this letter.

I

1. , q J

3. Corrective Actions That Will Be Taken To Avoid Further Devia_ticss To avoid further deviations on the PGP, the validation section of Standing Order G 74 will be modified to re) lace the control room mockup with the new pitnt specific simulator in tie current requirement for validating new procedures. This will provide an improved environment for  ;

validating new and revised procedures. Documentation, including a safety '

evaluation, will be appended to the verification and validation  !

documentation for the upgraded E0Ps, justifying the validation of the upgraded E0Ps using the CE generic simulator and table top validation i sessions. Documentation of the independent review of approved '

resolutions to validation comments made during the 1989 E0P upgrade will  :

also be added to the validation package. These actions will be completed by May 1, 1990. Validation of the E0Ps on the fort Calhoun plant specific control room simulator will be completed by July 31, 1990.

4. Date When Full Compliance Will Be Achieved l OPPD is currently in full compliance with the requirements of Standing Order G-74.

t 9

t L

l  :

i i

't l 5

ATTACHMENT #1 i

EXCERPTS FROM C-E OWNERS GROUP TRAINING COURSE ON OVERVIEW AND PRINCIPLES OF DEVELOPMENT OF THE EMERGENCY PROCEDURE GUIDELINES I

T 1

6

( -_

E..

,4 ,. --

4

"(4.-

y ,3' 8

.y a  ;

{U., t A

g

., f,iljJ445(63L3)/C&1 4

i 4 S

.' s

'y -

i .3.'

n I f

-g-s' 4 l

t r.,;

g-  % ,

t

'j t

~

y, Course

Title:

- EMERGENCY PROCEDURE GUIDELINES OPERATOR TRAINING LECTUREl -j Q>> . Lesson

Title:

EMERGENCY PROCEDURE GUIDELINES OVERVIEW  !

k.

g V; 5 Uf ,

'I

(- , .I i.

g

' t a

.)

4 4

<k a

J} ,

14 i

e; t

l ..

,p

-I I'

n

-' t

'.h

h lt -}

i. -r b -[

, 1 b

-t l: 'hi '

, g_ >

[)

.l D , j, l</'I : 'f l.

g. - m

s i t

t

, 'l f

i ,

t s -.y

~

.,.1 . ;

.t h ;g, ' , ,I 9 reasonable starting assumptions and taking credit for the operation of all involved systems (instead of only safety grade, class IE cualified systems). They also take credit for significant operator actions.

For example, instead of assuming a double ended, guillotine shear of the cold leg in the Reactor Coolant System, best estimate analyses e

look at small LOCAs resulting from a one or two inch pipe break. Such a small break analysis would credit the automatic operations of the Pressurizer Pressure and Level Control Systems, the use of the steam generators for plant cooldown, correct shutdown of the reactor coolant pumps by the operators and automatic operation of both safety injection trains,'just to cite some possible specific analytical assumptions.

Best estimate analyses may also involve what are referred to as parametric studies. In a parametric study, the values of one or two

! parameters, such as break si:e or delay time until cooldown is commenced, are varied to determine the effects on the course of the

, event. The results obtained from best estimate analyses are much closer to the actual instrument readings you would expect to see in L the control room during a real emergency event.

L Operating experience also provided the basis for improvements in operational guidance. Careful analyses of the Three Mile Island event as well as subsequent events (e.g., the steam generator tube rupture at the Robert E. Ginna unit) produced interest in improving emergency l guidance _in specific areas. Some of these areas are discussed in more L detail elsewhere-in these lesson plans. A brief listing is provided here just to give some example of specific changes which have been l

made:

1. Reactor Coolant System (RCS) voids - improved guidance for

detecting and dealing with RCS steam and non-condensible voids has been developed. At the same time, the NRC has required the installation of reactor vessel head vent and level monitoring systems and incorporation of additional operator training on void fonnation.

2-2 i

.___ _ _ D

m .

i 445(83L3)/mjm-19'  ;

. l l

Now we can turn our attention to how this knowledge of the strengths .

t and limitations of the human information processor can be used in i designing an emergency procedure guideline system.  ;

In the first place, it is probably clear from what we have said that we want the procedures written in a way that uses the operators as  ;

synthesizers and organizers of information. In other words, we want to use the operators in an overview-management mode. There are several steps we can take to induce this to happen:

1. EPGs and emergency operating procedures should be compatible with f

the tendency of operators to use categories to organize their [

thinking. Safety functions are a complete set of all the conditions which must exist or actions which must be taken to ensure public safety. They can provide a manageable set of categories the operators use to organize their thinking about plant safety during an emergency. Safety functions are a small set of categories of rules and criteria which the operators can use to decide if plant status is OX. Several researchers have shown that operators who work with a few overview rules or ,

categories are much more successful diagnosers of plant faults than are those who have no such system or those who get over-involved with detail. -

2. As we pointed out earlier, this EPG system also makes use of the traditional categories of event specific guidelines (e.g., LOCA, steam generator tube rupture, etc.) to permit the operators to

• organize their thinking around the specific sequence of symptoms, indications, and actions associated with each event, i

3. The overall structure of these EPGs, which we will discuss in

• more detail later, is simple. This simplicity is an intentional strategy to minimize the burden on the operators' information 2-12

445(83L3)/mj -20 capacity. Operators who have had to deal in the past with thirty ,

or forty emergency procedures, each with its own immediate actions to be memorized, will welcome this approach.

4 Many of the steps in the EPGs are written to provide the operators with a goal to be achieved and to indicate the means '

(success paths) to achieve that goal. For example, a step might  ;

say to restore pressurizer level to such and such a level and then list the charging pumps, HPSI pumps and LPSI pumps as the possible means to be used. In this way, the decision as to how to procede'is left to the operators. It is a way of building flexibility into procedures. [

5. Excessive detail is avoided. Including a lot of detail about how to operate a charging pump, for example, requires a lot of words in the guideline which burdens the operators' information i processing capacity. It also is unnecessary since all that information is stored in the operators' memory. Once again, ,

there is a good deal of research which reveals that if people are forced to immerse themselves in detail, they will lose track of the big picture. ,

t How can we design EPGs which avoid the limitation of the human information processor? One of the primary ways which was just mentioned above is not to overburden the capacity of operators. Some additional ways of accomplishing this are:

1. Do not write EPG steps in a way which requires the operators to interpret or interpolate what is on the instrument panels. EPGs '

should state criteria and setpoints using units which can be read directly from control room indications, t

2-13

+

445(83L3)/mjm-21

2. When possible, EPG steps should not require the operator to make decisions based on several pieces of infonnation. When this was necessary, these EPGs include pictorial aids to assist the operators in organizing this information (e.g., diagnostic aids, break ID charts, safety function status checks).

In addition to minimizing the information capacity burden, we can prevent operators from becoming latched into the tunnel vision which can be created by expectations and stress. This is prevented by requiring the operators to verify the diagnosis and periodically confirm that instruments are tracking as they should be by using objective, clear cut, quantitative criteria. This process of requiring the operators to periodically get feedback from the plant instruments is a way of catching errors and forcing reevaluation when necessary.

Now let's look at.the specifics of how these human factors goals and methods were implemented in this EPG system in order to provide the best possible presentation of technical information. The following sections will explain in detail the technical and human factor consideration which went into developing the C-E EPGs.

2-14

y.

!- -i f

i i

p r

6 I '! s h> r r

p I

L.

!, f ATTACHMENT #2 i L-EXCERPT FROM HODIFICATION DESIGN PACKAGE ,

FC-87-63, DIESEL RADIATOR EXHAUST DAMPER VALVES-r

+

i ):

i b

C i

k e-I d' ,

DESIGN PACKAGE COVER SHEET FORMG '

MODIFICATION IDENTIFICATION DA CATEGORYi MR NUMBER TITLE D COE ,

FC-S7-63 DIESEL GENERATOR RADIATOR EnlAUST DA!?ER VALVES DESIGN ENGINEER ( S) LEAD & ASSISTING O FIRE PROTECTI!

OEPARTMENT l ENGINEER ELEc (S&W) l B. Bulger O RAD WASTE  :

!:ECH (S&W) I D. W. LEWIS

( -

0 NON COE APPROVALS- SIGNATURE & DATE "UE PURPOS: PREPARER (S) DEPARTMENTAL MDR' DEPARTMENT REVIEWER ( S) REVIEWER ( S) APPROVAL (E O Pre 11rinary B. Bulgar (S&W) -

N

• N@

l D. W. Lewis (S EW) M I FluAL DE%Czu hQ. LEW6 bd ,Y d 2

C ONSTRUCTION D. W. L E WI S me 4

b.' 7cNs N eN Asne dV7

~ W, bk ISSUE lct}a s o,, ,w -

, '0/2-583  ;

u .. -

1 -

F r .1 L

F ,

i s

MR No. TC-87-63

• ' '*. . . i Rev. 2- l i" 1 TABLE OF CONTE!TTS

)1

'Eagg  ;

1 1.0 DOCUMENT CONTROL l

1.1 Table of Contents . .... .. . .. . .. . .. ....... 1-2 1.2 Modification Approval Documentation  ?

. . . . . . .. ...... 1-6  !

i 2.0 SCOPE OR PROBLEM EVALUATION 4 .

2.1 Modification Purpose . . . . . . . . . . . . . . . . . . . . . . 2 ,

r  :

~2.1.1 Root Cause Analysis . . . . . . . . . . . ....... 2-1  !

2.1.2 Impact on Unit . . .

.................. 2-1 i 2.2. Alternative Solutions ...... .. . . . . . ... ..... 2-2 2.3- Performance Analysis . . . . . . . . . . . . . . . . . . . . . . 2-2  !

2.4 Cost / Benefit Analysis ... .........,........ 2-2 2.5 Recommended Solution . . . . . . . . . . . . . . . . . . . . . . 2-2 3.0 REGULATORY REQUIREMENTS

~3.1 Codes and' Standards L1

. ... .................. 3-1 '

3.2 'CQE Designation .. . ... .................. 3-1 313 Code Classification . .. .................... 3-1 -t 3.4 USAR Impact .. .. .... .................. 3-1 '

3.5 Technical Specification Impact ._. .. . . . . . .. . ..... 3-1 3.6  ! Licensing Commitments .. ................... 3-1 ,

3.7 Regulatory / Industry Notices ................... '3-2 1 l

l- 4.0 DESIGN INPUT REQUIREMENTS 4.1 System Functional Requirements . . . . . . .- . . . . . .-. . . 4-1 4.2 System Performance Requirements . .. . . .. . . . . ..... 4-1 '

1-2 9169f/0417f I mg #::.-

d# -

LMP[esb ,

i l

1

, , . .. MR No. FC-87-63 Rev. 2 l

(

g TABLE OF CONTDirS (continued)

i a

.Pagg 4.3 System Design Conditions . . . . . . . . . . . . . . . ... . . . 4-2 4.3.1 Environmental . . . .. ................ 4-2 4.3.2 Seismic . . . . . . .................. 4-2 a

4.3.3 Loading . . . . . . .. ................ 4-2 4.3.4 Materials . . . . . . ................. 4-3 a

4.3.5 Electrical Power . . . . . . . . ............ 4-3 l

4.4 Interfaces with Other Systems ................. 4-3 5.0 DESIGN ANALYSIS 1

5.1 System Design Analysis . . . . . . . . . . . .-. . . . . . . . . 5-1 1

5.2 Procurement Specification. . . . . . . . . . . . . ... . . . .-. 5-1 i l- 5.3 Drawing List . ... . . . . . ................. 5-1 l

l 6.0 SYSTEMS I!TTERACTION ANALYSIS 4 1

6.1 Fire Protection ............ ............ 6-1

'6.2 Environmental Equipment Qualifications . ............ 6-1 1

4 6.3 High Energy Line Break Review ..... ............ 6-1 l

.?

l '6.4 Seismic Analysis . . . . . . . . . . . . . . . . . . . . . . . . '6-1 I 6.5 Electrical System Analysis . . . . . . . ............ 6-1 6.6 Human Factors Revies* . . . . ................. 6-1 6 '. 7 Security Review .. . . . . . ................. 6-2

-. 6.8 Environmental and Radiological Release . . . . . . . . . . . . . 6-2 6.9 Materials Compatibility . . . ................. 6-2 1

6.10 Contaicment Integrity . . . . ................. 6-2 i

l l

1-3 9169f/0417f ,

, ,. ;,... , . g,; .

1

)

. . f, ',50a-.' .. . 2:5.h '.?.UN55 *: > ' '

s .

MR Noo TC-87-63 Rev. 2 TABLE OF CONTENTS (continued)

P.SLS 6.11- Control Room Habitability. . . . . . . . . . . . . . . . . . . . 6-2 6.12 Missile Protection . . . . . . . . . . . . . . . . . . . . . . . 6-2 6.13 Internal Flooding ... . . . . . . . . . . . .. . . . . . .. 6-2

'6.14 Separation Criteria .. ... . . . . . . . . . . . . . . . .. 6-3 6.15 Single Failure Criteria . .. . . . . . . . . .. . . . . . .. 6-3 p 6.16 Possibility of Operator Error . . . . . . . . .. . . . . . .. 6-3 6.17 Heavy Loads . . . . . . . . . . . . . . . . . . . . . . . . .. 6-3 6.18 Impact on NVAC . . . . . . . . . . . . . . . . . . . . . . . .. 6-3 7.0 10CFR50.59 ANALYSIS INDEX 10CTR50.59 ANALYSIS . . . . . . . . . . . . . . . . . . . 7-1 7.1 Design . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 7-2 7.2 Construction . . . . . . . . . . . . . . . . . . . . . . . . . . 7-5 7.3 Testing . . . . . . . .. . . . . . . . . . - . . . . . . . ... 7-8 8.0 OPERATING IMPACT 8.1 ALARA Analysis . . . . . . . . . . . . . . . . . . . . . . . . . 8-1 8.2 Constructibility. Operability, Maintainability Review (COM) . . . . . . . . . . . . .. . . . . . . . . . ... 8-1 8.3 Special Training Requirements . . . . . . . . . . . . . . ... 8-1 8.4 Special Testing Requirements . . . . . . . . . . . . . . . . . . 8 8.5 Special Maintenance Requirements . . . . . . . . . . . . . . . . 8-1

.- 1-4 ,,

-9169f/0417f i tm ,m "'4;t i

.6'.. . ..g'-

t.

l

, , MR Noo FC-87-63 '

Rev. 2 i TABLE OF CONTENTS (continued) l f

.P,,att }

9.0 INSTALLATION AND TESTING REQUIREMENTS  !

9.1 Installation and Testing Sumary ............... 9-1 1

9.2 Installation and Testing Procedures . . . .:. . . . . . . . . . 9-2 ,

10.0 DOCUMENT REVISION , . . . .. ................. 10-1 11.0 RESOURCE REOUIREMENTS 11.1 Material List . . . . . . . . ................. 11-1 11.2 Material Estimate . . . . . . . . . . . . . . . . . . . . . . . 11-1 >

11.3 Engineering & Design Estimate . . . . . . . . . . . . . . . . . 11-1 -

11.4 Construction Labor Estimate . . . . . . . . . . . . . . . . . . 11-1 [

11.5 Work Order ... . . . . . . ................. 11-1 12.0 SCHEDULE c

12.1 Design h

. . .... . . . . . ................. 12-1 12.2 Procurement . . . . . . . . . ................. 12-1 12.3 Construction . . . . . . . . ...... ... ........ 12-1 i

k i

5 1

6 1-5 9169f/0417f

.~; s\ .. -

.D':r . ' ../.is EL . _. .. . . . . .

7 s .  !

f ggQ%$ i t

S.O. G 21 56 (f,C 3 I 9N

( ,-

p,;gt,W p FORM REY. 22 04-10-67 Form A (l *I O}

j x4 ENGINEERING EVALUATION &

AS$1 STANCE REQUEST (EEAR) -.

. EEAR NO: FC-87-063 DATE: _17.sg.g7 TITLE:

Diesel Generator Radiator Exhaust Damper Valves '

SYSTEM IDENTIFICATION: D.G. , ,

COMPONENT: YCV-871E, YCV-671F  :

LOCATION: .

Room's 64 and 65 -

L REFERENCE - DRAWINGS: 11405-M-97 t

- PROCEDURES:

- TECHNICAL MANUALS: L

- TECHNICAL SPECIFICATIONS

• 1

- UPDATED SAFETY ANALYSIS REPORT (FORT C

- OTHER: LIC-87-783 ,

b' DETAILED STATEMENT OF PROBLEM: On September Y

Lshutcown on high temperature.' The reason for this23, 1987, DG-2 au YCV-871F the [D

.raciator.

failed to function properly, restricting shutdown flow was thatthrougn  ;

to open the cameer. was found to be pluggec, e -off preven g proper valve-operation.

t PROPOSED SOLUTION (IF ANY): - Replace the Diesel Generat with a valve with a different type of operating control mechor exha not be cepencent on a small ported orifice. -(LIC-B7-7B3 anism which will

, pg. IX-6) .

L 1.

i l

l lr l/\

FC/50/03 l~ S h.

.p-f ,

a g*; jy . . , z.a 1

r~ ,

.* F g R___m_r: r R27 04-10-87

.___._ _ __ _ _ _ _ _____ _ _ _ _ _o _s___

.. ii.. ' .

l 5.0. G-21 57 FORM REY. 22 04-10 87  !

Fom A t (2 of 3)  !

EEAR NO: IC-87-053 i RESTRICTIONS / LIMITATIONS:

SPECIAL REQUIREMENTS:

. 1 REQUIRED BY: ,

-) '

COMMITMENT TO REGULATORY AGENCY: Yes. LIC-67-783 l

- . \

SUBMITTED BY: . > -

DATE: h.F#,P7 Steve Swearngin N g

IMMEDIATE SUPERVISOR: # f. Aw j

,, DATE: 12 2.f f7 John F. Sailey }'

PLANT ENGINEERING nEVIEW:

YES-( 1. NO

'A Plant Engineering has detemined that a mocification is recuirec1.in accorcance with the guidance given in [A()

checklist .

-[ ]

2. .

\

If the answer to 1 is yes, fill out Form B, anc complete Fom Engineering. A anc forward to Section Manager, Generating Station- -

3.  !

If-the answer to 1 is no and additional evaluation is reovired, request via memo that such evaluation be Form A and Form 8 . performed by Technical Services prior to compleli FOR ADDITIONAL INFORMATION, CONTACT OPERATIONS 5 5~ m uo,dENGINEER:

f 1

APPROVED:'#E. M -- DATE:

lant Engineer /t..z/t'7 n I-7 FC/SO/03

.w;;u w w ,,. ] ; q ::; g-

- ~ ^ R27 04-10-87  :

_, . . . I 5.0. G 21-58

(

FORM REY. 22 04-10 87 Fom A i

(3 of 3) -

EEAR NO: FC 87 063  !

L RESOLUTION NEEDED: '

(

) FOR CONTINUED OPERATION l

(/C ) AS 500N AS PRACTICABLE

( ) BY NEXT REFUELING

( ) BY NEIT BUDGET PERIOD l

( ) OTHER (SPECIFY)

~

h 1

{

2 3 4  :

PRIORITY ( ) (%) ( ) ()

COMMENTS (lF ANY):

APPROVED BY MANAGER - FORT CALHOUN STATION: T boa > DATE:

/"4 !L'i [/7 COPY TO:

ALARA COORDINATOR ( )

OTHER N

FC/SO/03 j- $ -

m R27 04-10-87

_. a.::. ,u.,.

.i : ~'1Sr 2d & c n ~.

. ~ . ~ ~ -

~ ~ - -

. i. * * . ,

@.] D' '% S.0. c-21-60 iI\ f4 l l C43 .

FORM REY. 21 04-10-87 Fem B

. d[ t '.1 (1 of 2) l FORT CALHOUN STATION REVIEW & EVALUATION {

EEAR NO.: FC-87-063 05AR NO.: N/A MODIFICATION REQUEST NO.: MR-FC-87-063 1

DATE: 12-27-87 l TITLE: Diesel Generator Radiator NORMAL (xx )

Exhaust Damper Valves -

61ERGENCY ( )

i: 1 2 3 4 PRIORITY ( ) (XX) ( ) ( )

MINOR * '( )

REVIEW AND EVALUATION:

Plant Engineering has determined that a modification is required to replace the I control mechanism on YCV-871E and YCV-871F. It is requested that GSE pursue this modification to answer the NRC commitment made in LIC-87-783.

? .

l PREPARED BY:

DATE: 12-29-87 Stefe Swearngin U

• For a minor modification, the Modification Design Basis, Technical Evaluation, Design Evaluation, and Plant Design Basis Safety Analysis in accordance with Reference 1.3.4, Procecure B-2 must be fully discussed.

. I-9 FC/SO/03 R27 04-10-87

B . .?: d ? . ____ __

_ _ __ _ _ _ _ _ ______ . A-MC_hbSV - - ~ - a

E , )

i

!~ l

! i i

, 4. *., ,

g

.. ., t

, )

5.0. G-21-61  !

e i

. FORM REY. 21 Ot-10-87 Forn B i (2 of 2) i EEAR NO.: 1C-87-063 MODIFICATION REQUEST NO.:Mp re m7-oss i

IF MODIFICATION 15 REQUIRED, DESCRIBE BENEFITS OF PROPOSED MODIF  !

This modification would increase the reliability of the D.4. exhaust damper valves by eliminating their sensitivity to particulates.

i v

I l t 9

REY EWED BY: d I DATE: /!f'!SS

,P NT ihalNEfR - FORT /CALHOUh STATION '

!' APPROVEDqY: U e #

y STATIch MANAGER - FORT CALtt0VN STATION DATE: / -- 5 '

I - 10 FC/$0/03 4 , y ,, * * .d

- - - - - - - - ~ - - _

es** **

• T f 4?.3..s.

R27 04-10-87 x-

l

+

f P

FORM REY. 20 9-26-85 Form C g

i EEAR NO.: w,-rc-87-63 MODIFICATION REQUEST 110.: MR-rc-87-63  ;

+

ASSIGNMENT OF DESIGN RESPONSIBILITY  !

REVIEW BY: A - DATE: 3,num-v M. 1988 v ri tyhur.h sr.i.ii uar. '

COMMENTS: '

e GSE DEPARTMENT ASSIGNED: CIVIL- ( ) ,

ELEC'RICAL ( )

MECHANICAL (x)

NUCLEAR ( ) ,

DESIGN ENGINEER ASSIGNED: M N lC 08C/66 7 M N d N GSE Di.PARTP.ENT MANAGER DATE: ' /'!2*hf k

W FORM C Page 1 of 1 I-li

.s:q -

~ .Y - N .s

__Ao4 M __ _3g'Ae'_*^y o*'__*._- @ @W ' ' .

• 1 i

S.C. 3-21-63  :

I FORM REY. 22 04 10-87 E

Fem 0  ;

(1 of 1) l J

MODIFICATICN DESIGN TRANSMITTAL I M001FICATION REQUEST No.: FC - B "I - G .l WORK ORDER NO.: leier

~ ..... ....... .... .... ....- . . ....... .....

PRELIMINARY MODIFICATION B. Q leer DESIGN PACKAGE PREPARED: fTo4E 1 WEbsTE e / 0. L, ",.5 DATE Tfla[68 ULMsii t.thihLLR REVIEWED anc FORWARDED: M Ob DATE f/ ") d G5E DEPARTMEhi t% NAGER REVIEWED: # 7 te DATE /,[13 !#8 MANAGER . FORT CALn0UN 5iAiich .*

t

................... ......... ......_..._.. .... ...-............. 1 N . PARED: b ,7 roA. D.W. pts = OATE 9/t.l NT

, pE51GN ENGintiR 't APPROVED: (( DATE 22 G5EDEFARThlyhiMANAGER ISSUED: 88 -

DATE W .

5ECTich iMNAGER . G5E -

...............~...... ......... ........ .... . ......-..............

l THIS MODIFICATION AFFECTS; ELECTRICAL DRAWINGS L (X MECHANICAL DRAWINGS (X CIVIL / STRUCTURAL DRAWINGS .

(.

' INSERVICE INSPECTION ORAMINGS ( ,

. f i

i PRC REVIEWED anc. APPROVED: DATE >

MANAGER FORT CALNQUN STAiiON ,

f s

FC/SO/03 R27 04-10-E t - \ 1.

f.ut rap'

n. .. cw

.., 7,~, -

Tha . . . _. . .: .. . .

,, MR No. FC-87-63 i Rev. 2  :

s 2.0 SCOPE OR PROBLEM EVALUATION '

2.1 Modification Purpose Replace the Diesel Generator radiator exhaust damper . operator with an operator which will not be dependent on a small ported orifice pilot '

valve. This modification is a commitment to the NRC per LIC-87-783 '

to replace the actuator based on a failure of damper YCV-871F to open on Sept.- 23, 1987 which caused Diesel Generator No. 2 to shut down.

he existing actuator is a Matryx Model No.1250 FS2 which utilizes a '

4-way air operated pilot valve controlling air flow to the actuator >

in order to open or close the damper. To assure a fail open position, the actuator is equipped with an accumulator which supplies .

enough air to operate the damper when instrument air is lost. To  !

eliminate the future possibility of failure caused by the pilot valve, this modification replaces the existing actuator, accumulator '

and pilot valve with a spring return actuator. This arrangement .;

requires air to close and will fail open with spring force when '

instrument air is lost.

Additionally, a means of isolating the damper electrical circuits l

from the control room will be provided. This isolation will be '

accomplished by utilizing the Master Emergency Switch (MES) located on the Diesel Generator Control Panels along with a relay to provide  !

sufficient isolation contacts. '

2.1.1 Root Cause Analysis ,

The root cause for the Diesel Generator exhaust radiator damper failure was a plugged bleed-off orifice 'in the pilot valve which '

prevented proper valve operation. De pilot valve orifice was probably plugged from the interaction of water (from the Fire i Protection System leak into instrument air), 0-ring lubricants and i other operator components according to letter LIC-87-783, p. II-2. ,

'The requirement for the additional isolation relay is due to several damper control circuit wires which go to control room panels AI-30A '

and B. During a " smart" control room fire, these could potentially L be shorted to another source of voltage causing misoperation of the dampers.

2.1.2 Impact on Unit b

This modification will not change the operation of the Diesel Generator radiator exhaust dampers but only insure that a repeat failure due to debris in the instrument air system or due to a control room fire does not occur.

2-1 e

9169f/0417f

- 'd3MN, M . .. .

Yhdyir.% */J. .. ., ,,,a;?

{

HR N3. FC-87-63 Rev. 2 -

2.2 Alternative Solutions There are no alternative solutions for this modification. An NRC i connitment was made to replace the Diesel Generator air damper  !

l controller with a different type of controller per LIC-87-783, p.

! IX-6.

l 2.3 Performance Analysis l

By replacing the c:cumulator operated actuator and pilot valve with a '

spring return actuator the possibility of failure is greatly reduced. The existing actuator relies on the accumlator to open the damper which can fail if air leaks develop in the piping or if the check valve, which holds air in the accumulator, doesn't seat. The ,

new actuator uses a spring to ensure the damper fails open. This is l a simpler arrangement which reduces the possibility of actuator l problems. Also, the new actuator will use a 3-way solenoid valve and The filter will further reduce the possibility of failure a filter.

by eliminating debris from entering the actuator. The 3-way solenoid

• l valve will electrically fail to vent the actuator and ensure the dampers fail open in the event of power loss.

l The added damper circuit isolation relay will not affect performance l l of the diesels but will provide added safety in the event of a l control room fire. This relay is normally deenergized and has no t

affect on. normal damper operation. In the event of a control room l fire the relay will be energized by operation of the 183HES switch. ,

1; Tallure of the relay t6 operate will leave the dampers ' in their normal mode and not affect their automatic operation with a diesel start. Analysis of single failures is not required for the case of remote shutdown operations (Ref. 10CFR50 Appendix R).

l 2.4 Cost / Benefit Analysis There will be no cost / benefit analysis for this modification since it is required by an NRC commitment in LIC-87-783 and LIC-79-0128.

2.5 Recommended Solution l

Replace the existing Mattp actuator with a Matryx spring return actuator. The new actuator will also use a 3-way fail close solenoid valve and a filter.

Utilize the existing Master Emergency Switch, 183 HES, located in the i Diesel Generator 1 & 2 control panels to initiate the electrical p ' isolation of the damper control circuits from the control room.

2-2 14# d p

. 9169f/0417f

.g _ ,3 % -

i

. . Aa . -eer.a.% '..tc-.. 'J ! .. s* D +'? .

)

i MR Noo FC-87-63 j

... Rev. 2 i 2.2 Alternative Solutions There are no alternative solutions for this modification. An NRC $

commitment was made to replace the Diesel Generator air damper l controller with a different type of controller per LIC-87-783, p.

IX-6.

2.3 Performance Analysis By replacing the accumulator operated actuator and pilot valve with a I spring return actuator the possibility of failure is greatly -

reduced. The existing actuator relies on the accumulator to open the i damper which can fail if air leaks develop in the piping or if the check valve, which holds air in the accumulator, doesn't seat. The new actuator uses a spring to ensure the damper fails open. This is '

a simpler arrangement which teduces the possibility of actuator problems. Also, the new actuator will use a 3-way solenoid valve and .

a filter. The filter will further reduce the possibility of failure by eliminating debris from entering the actuator. The 3-way solenoid valve will electrically fail to vent the actuator and ensure the dampers fail open in the event of power loss.

The added damper circuit isolation relay will not affect performance of the diesels but will provide added safety in the event of a control room fire. This relay is normally deenergized and has no affect on normal damper operation. In the event of a control room fire the relay will be energized by operation of the 183MES switch. l Failure of the relay to operate will leave the dampers' in their j normal mode and not affect their automatic operation with a diesel start. Analysis of single failures is not required for the case of remote shutdown operations (Ref. 10CTR50 Appendix R).

2.4 Cost / Benefit Analysis There will be no cost / benefit analysis for this modification since it is required by an NRC commitment in LIC-87-783 and LIC-79-0128.

2.5 Recommended Solution Replace the existing Matryx actuator with a Matryx spring return l actuator. The new actuator will also use a 3-way fail close solenoid valve and a filter. ,

Utilize the existing Master Emergency Switch, 183 MES, located in the Diesel Generator 1 & 2 control panels to initiate the electrical isolation of the damper control circuits from the control room.

2-2 14sf ke.

9169f/0417f J:9.Q .5%%. .

, u -eer.r .. *%. .,,4-.

• M . : ;*F'4* . .

7 l'

D-, l

.I r

j -'

,\ ,

I i i t

i 1 k

'~

s c ,

I

, t

{. +

?

ATTACHMENT #3 l

L t

b 7

[; ' LER 87-25, D2 SHUTDOWN ON , -

HIGH COOLANT TEMPERATURE 9

h

)

f i

l

.1 I --

l l-t l

l y,

&*,""'" "' l a.m ,, 7

. , ~ ,

UCENSEE EVENT REPORY (LERI '*******= '

w,, .. . i mu Fort Calhoun Station Unit No.1  ; .. m ..

to is l o is t o 2i8 iS! t icN0 : 5- ;

DG-2..

Shutdown on High Coolant Temperature

...........i . . .

rami c= n- .i = i . i ~ ~ ' ' - '

Pasa' '~ 'a'a' N

~~ lo isio i o io, , i 019 2 l 3 817 8 l 7 0 l 215, ~

0 l 1 O l l ,1 l 5 817 "

es. =

. lo isie io ,o, 1 m . g,

'-~

. - - ~ ..o e i

"'"""" ~

au 3.3 l1 0i0 i.,,

• • "a" m o mm .

am es 2 '*"

N

""~

imm im

~

, m, s

~

.u -=

g g.,.=,., ,-

""""""" .u.==.-=

50.73(c)

~ (M . . u. ..

T. L. Patterson, Supervisor Technical '"*""'"""

. . con

-m i . u, 40i2. 4i2iGii401il i.u.e{i,m.' co e

"' J** %".',g,"f . e er m . c, ~, g.a lilii, 9,.,,.,.,m, .jjjpg;

, , , l EbW w

l, , , , l,,,l JgME i i i ie i  %,,V i i i i sm ,=. . ..

i i mm.deE&n

""1 ,= = - e ,,,,,,,, . .l ,

m me.

";"1 E , ,

On September 23,1987, at 0906 CDT, following repair of the exhaust pipe, Diesel Generator as required byNo. Surveil 2 (OG-2) lance Test ST-ESF 6was started and loade test, DG-2 automatically shutdown due to high coolant temperature.Approxim Investigations revealed that the air operated exhaust camper for the diesel generator radiator may not have fully opened automatically as designed when the diesel was running, thus restricting the required air flow through the radiator. )

The cause of the damper malfunction was postulated to be the presence of resid causing the pilot valve that directs air flow to sometimes stick. On July 6, I water was introduced into the instrument air system during the performance of a surveillance generator rooms. test on the fire protection system dry pipe valve for the diesel below elevation 1025'. The water intrusion was limited to the auxiliary building at or An extensive program was undertaken ( h July) and was repeated as necessary during the months of August and September to blowdown air operated allowed during devices power includingoperation. air operated valves and to cycle those v21ves as i

After the trip of DG 2, the pilot valve was inspected and cleaned and the I accumulator drained.

recurrence Similar actions were taken for DG-1. To prevent a possible {

an extensive corrective action program is in progress. Details of -

the program, and meetings held with the NRC are contained in a submitta) to the NRC dated November 20, 1987 (LIC-87-783). This report is a supplemental report per 10 CFR 50.73(c).

g,== an

1

~

UCENSEE EVENT REPORT (LER) TEXT CONTINUATION .. .$,,

.... ,,m ,

Fort Calhoun Station o 9 9o g g io ! 21815 817 -

01215 -

o' 011 012 0 15 At 0644 hours0.00745 days <br />0.179 hours <br />0.00106 weeks <br />2.45042e-4 months <br /> on September 22, 1987, when Fort Calhoun Station was operating at full powir, Diesel Generator No. 1 (DG-1) was started to prove operability prior to )

performing maintenance on the exhaust pipe for Olesel Generator No. 2 (DG-2). At this time, a 7-day Limiting Condition for Operation was entered per Technical Specification 2.7. )

On September 23, 1987, at 0906 hours0.0105 days <br />0.252 hours <br />0.0015 weeks <br />3.44733e-4 months <br /> COT, DG-2 was manually l started, followed by synchronization and loading at 0911 hours0.0105 days <br />0.253 hours <br />0.00151 weeks <br />3.466355e-4 months <br /> per Operating i Instruction 01-DG-2 as required by Surveillance Test ST-ESF-6. At 0920 hours0.0106 days <br />0.256 hours <br />0.00152 weeks <br />3.5006e-4 months <br />. OG 2 automatically shutdowri due to high coolant temperature. Personnel were immediately i

dispatched to determine the cause of the overheating. Investigations revealed that the air operated radiator exhaust air damper YCV-871F may not have automatically  :

fully opened when the diesel was running, thus restricting the required air flow through the radiator, and subsequently overheating the diesel coolant.

The air to operate the damper is supplied via a pilot valve. As shown on Figure 1 the air to the pilot valve is provided by either the instrument air system or an ,

accumulator. The damper is.normally closed to limit the diesel's exposure to cold '

i outside air and it is designed to be open when the diesel is running.

i L

Investigations revealed that the pilot valve internals had a white, "line-like" i residue and the accumulator was partially filled with water. The pilot valve was ,

l cleaned, other associated valves and solenoids were inspected with no problems found, and the accumulator drained. The amount of water in the accumulator for 04-2 was not measured. It was approximately one-half full which represents two quarts of water.

The cause of the damper malfunction was postulated to be the presence of the residue causing the pilot valve to sometimes stick. $1nce the potential existed for DG-1 to be similarly affected, the DG-1 exhaust dampers were cycled open without any problems ,

and left open to ensure that if DG-1 was required to operate, adequate radiator cooling would be available. In accordance with the requirements of 50.73(4)(2)(vii), -

this event was determined to be reportable. DG-2 was successfully tested and returned to service at 1805 hours0.0209 days <br />0.501 hours <br />0.00298 weeks <br />6.868025e-4 months <br /> on September 24, 1987. At this time, the Technical ,

Specification 2.7 seven day Limiting Condition for Operation was exited.

Subsequently, DG-1 was removed from service and the instrument air valves associated with the radiator exhaust damper were inspected and approximately 12 ounces of water was drained from the accumulator.

On July 6,1987i during the performance of surveillance test ST-FP-5, operations personnel became aware that water had entered the instrument air system and immediately took actions to isolate the source of water intrusion, i.e., the instrument air connection to the diesel generator fire protection system dry pipe valve FP-513. The piping arrangement is shown on Figure 2. .

Immediate corrective actions were to inspect and clean both check valves (IA 575 and IA-576) and to restore the diesel generator fire protection system. The extent of the water in the air system was determined by blowing down selected air-operated components on the air risers. It was determined that water had not reached above elevi. tion 1025'. This verified that no water entered containment since the L

L i

og : ..e...

L p u == s w ,

UCENSEE EVENT REPORT (LEN TEXT CONTINUATION , ,

L , _ n .. .

- ~ . ,

.. i

.... j am. .q Fort Calhoun Station, Unit No.1

=n. . . ara o p io Io lo l2;8; 5 B; 7 -

0l2l 5 - 0;I '

nn 0l3 o, O g5 centerline of the containment penetration is located at elevation 1029'. No water

.the was structure.

intake found in the instrument air system piping in the turbine building or An extensive program was undertaken to blow down the devices fed auxiliary building.from the affected portions of the instrument air system in the

,a effort. One group was responsible for the accumulators and t W ~

responsible for devices such as dampers, instruments and valve operators including solenoids and regulators. Of the 17 air accumulators reviewed for operability, 6 were above the 1025 elevation and did not require draining. Seven of the remaining 11 had no water and 4 had some water.

At the result of a sunmary report issued to the Plant Review Committee on August 3, 1987, five piston operated air valves had required repair since July 6. These valves were HCV-485, FCV-269X, HCV-2928. HCV-2918 and HCV-2882. The problems associated with u

these valves were not necessarily determined to be associated with the instrument air system problem. A problem also existed with water in the bubbler that measures the diesel generator fuel storage tank. As allowed by procedure, an alternate method was used to verify tank level until the bubbler was repaired.-

Currently, 38 valves have yet to be cycled because of operating constraints. The L ma,jority of these valves are diaphrage operated rather than piston operated. It ,

o has been concluded that failure of the operators for these valves would not L affect.the plant's ability to mitigate the consequences of an accident or to bring the plant to a safe shutdown condition. i Details of the complete program and meetings held with the NRC are contained in a submittal from OPPD to the NRC dated November 20,1987,(LIC-87-783). This report is a supplemental report per 10 CFR 50.73(c). l l

I i

l l

i l

l 1

i

j. '4 :

1

&** *"a 1 r

UCENSEE EVENT REPORT (LERI TEXT CONTINUATION "

.summ =eweemen L '""' **** e u m .

L ,, ,,,,,, ,,, ,,

6e==== .  !

L Fort Calhoun Station. Unit No. I ""' =---r" z i y,=-

en . . 8 Istoloqe1218 iS 817 -

01215 I

-0 n. 0 :4 or o 15 l!,

e t

i.

V l;

l.1 , i i ,

t W d g, e - e s

c k2 V3 e.

t.1 .

e

_,. . ew meter j' ~\

L-

. ctesse L

1 he' -

wr ,

,, escom usster egen

/ Pilot Valve ,/

spring seeees pisten FIGURE 1 L ...

a.

.____.___________D______-_--------------^~---~

'b

+

,, =.

, E

== = mane ==m W# ,

ucalessE EVulf RSPORT (LEM TEXT ColmNUATION exam e. .

=

1

===== t w ass .  :

Fort Calhoun Station; Unit No.1 "" ~

.m..======= e is le Ie ie 12i S IS 8l7 0(2 {5 -0 n i

015 o' 0 is I' U i w i T

E 4 7 3

,_m.

D)

%p. -

5 tu go .?  !

i a -

-N-- .

!* 5"  !

.. sts.

i s --M-- T'  ?

!. 972 h hI

__y; 2 I l

g !A*S73 N-bR *

(

3 4 .

9 = .

i 0 ,- s, _

.i,m

.p

~

. 1 O w

$. g

• m O  ;

As Y u  ;

k. wa /

a..m r s

~

4 3 b' ,

ia n Q.

i- 7 4 h3

• '7"  !

• Ig"5 1., a s

?

n y

, }

~ n.

c -1 .

x- ,, a e

, =

e FIGURE = 2

, n . - , . - - - - . _ _ _ _ _ _ _ _ . _ _ _ _ _ - - - _ - - - - _ _ _ _ _ . - - - _ - _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ . _ - - _ . _ _ _ _ _ . - . _ _ _ _ _ . - - _ _ . _

ge.e-c .

y ,.7, i

4

' 'I e.

t j

t

f. '.

t n

i e

1

, 4

' .jl

.l 1

1

'f 4

r k

4

-l i

3

.}

q z.

i P

t V

t

-t ATTACHMENT 4 -F ii t

i 1

4

=f

.c

? ' .h l- i a

.q PART 3, STEP 4.10 0F 1 4

STANDING ORDER G-74 'It L

p :. t 4

{! I g.

. . tr e- ,

e h t..

h ', '  ?

5 E.

v f.

7 h:

p. -j N -- L Y' f

.s h

p 5

e. ,

C

(( r I: .

?-

$+ ' s

( b f[

, .s.;

.t-t, A

'r i.:.

gP ,

4; ,

t' .

o .rr is .

s.

K  ?

I a'

c t.

p ,

hkh;em: OL,;_ m # ys , m,;, ., 4

FORT CALHOUN STATION- STANDING ORDER G-74 FORT CALHOUN STATION EOP/AOP WRITER'S GUIDE PAGE 33-OF 112 Part 3 4.10 Level of Detail Too.much detail in EOPs should be avoided in the interest of readability and: comprehension. Avoiding-too much detail is important in order to minimize errors and to allow for timely response during emergency conditions. The level of detail-required is-for that of an Operator who:has recently received a Reactor Operator's license on Fort Calhoun Station Unit No. 1.

To assist in determining-the appropriate level of detail in the EOPs, the following general rules apply: ,

. For. control circuitry that executes an entire function upon actuation of the Control Switch, the action verb appropriate to the component suffices without further amplification of how to manipulate the control device. Example: Trip. generator field breaker.

Recommended action verbs'are. listed.as follows.(a more detailed listing can be found in Table'3):

3 4'.10.1 For power-driven rotating equipment; use Start, Stop.-

4.10.2 For valves; use Open, Close, Throttle Open,-

Throttle close, Throttle.

4.10.3 For Power Distribution Breakers; use Synchronize and Close, Trip.

.- For multiposition Control Switches that have more than one position for a similar function, placement to the desired position;should be specified.

Example:- Place the Steam Dump and Bypass M

" AUTO-INHIBIT" switch to "IHHIBIT".

Instructions for dealing with abnormal.results need -r not be prescribed within procedural steps when it is a matter of standard practice. For example, observation of noise, vibration, erratic flow, or discharge pressure need not be specified by steps that start pumps, i

~FC/SO/11 R0 i

d i ,

E . .; ,; i . '8.'

. ,_ C -

m .

.i i

s-D

!!- L

!0 ,

iw

...p.

,k. i, f r

i t

t b

ATTACHMENT #5 t'

EXCERPT FROM INPO 82-017,

' EMERGENCY OPER* TING PROCEDURES

=

WRITING GUIDELINE A

F i

t i

s e

4

_. _. ._ . .._ . ._ _ , _ . _ . _ . . . . . . . _ . - _ . _ _ _ .~ . . _ . . _ _ _ _ _

.. . e .3 July 1982

. Guideline INPO 82 017 Emergency  :

Operating  :

Procecures Writing l u,uideline

[~

)

.k, o

Ir l

h[ .

p[f(.fhhftl,\

, h $h

. c y A -- .

h;,p g

,*. ffff,[jf;"{ee )[I y< .. ts p

iji, N

'A w .,,

, ((,I

~

Q. '- M' l j y }'[ ' ~g y #, ..

8' 3

a@MXan*=?TRM M k.1 1:QW s.+; z

%>t  :. . - :.s.. w.

ww

.ak,m,egy z . .sep&uw& M %s

.JNp.w: -  ; - - .n. -. 3 7,. 4 .;

e s- w .

+

'.: h,'dv 4: . d

$ .'Y. '$f. ~,*III p$*q -

. ,, w .  :~ . e . y,.

N '*

thh) lff { g n h

p nhar6

~.s"

.te%"

• i1:BM j* t ,Mjj3W,y j s .rs R_

~..

l* , ) f n e l ~ ' ' >

• h**f ,A St*

.- 63/ ; W{'e ,

'4 :.

N$.h.%'$s. .,* x;. hY: b ,,f <

w.C+ p y, '%.

y 4

, )  ? -

• ' i*

- . M Ec' Lgynbra:'  %

.45 m u u .

j E u$k.

! A't . . . ?tym -

.r.y * ' W,.ge.nw.. . . l 'n ' 'i[

w ' gsy.

'4% 4 TA' y-8 ,'" z.

jW '. , *

)?

IN ' '

, q' d. :Q' .t; ' *< . M G ,y '

WY.O

-w s.md

,5;M

< T

. . . . ' - . 45 Je

1 b ,

i li / ,,. . 4sg4- +

]

I

-o Example ' 2. - Method -of numbe' ring without additional-le ' indentation 1

p ~1.

1.1 '

1. 2. l'

.0 1.2.2 .

1. 3 ::  ;

2.3.12: LEVEL OF DETAIL Provide sufficient procedural detail to support the user's instruc-'

I tional=needs.

. , 1 12.3.12.1~' Explanation

, Very llittle ' benefit' is ' gained by giving t'he. operator instructions ~

concerning^ simple details that are within the scope of his train-

.ing . . Some tasks, :such as starting pumps, are : repeated 'of ten : ' q, 19 '

enoughfthat,the detailed, actions required do not have:to-be stated. There is adequate assurance, for instance,.that the instruction." Start pump PL-16" is sufficient, and any further t datail<will merely detract from-reading' speed.-'Otherl tasks

~

associated with emergency response may be performed so_infre-quently:that'more. detailed-instructions should'be'provided.by the - -

procedure.

The determination of the degree of detail required in a given j instruction is'a function of the following factors: --

o importance of task

.: o . operator knowledge.and skill' o--:_ complexity of task l .o operator's experience ,

/

- In-a " layered" procedure or a tier approach with both a higher lL and lower degree of detail, the upper level task is followed by Lj sub-tasks with a higher degree of detail. The sub-tasks may be referenced to a detailed procedure.

2-30

.~n~

2.3.12.2 Guidance o The desired level of detail is one in which enough details are presented that the operator has all the information he needs, but not so many details that the operator becomes confused by superficial or redundant information, o Avoiding too much detail is an important consideration for EOPs because of the need for timely response and to mini-mize errors.

o Objects of actions must be identified adequately to fore-stall errors of identification or oversight.

o Any limits on the actions must be stated quantitatively if possible.

o Procedures must be written at a skill level appropriate for operators with the minimum expected skill.

o The tier approach to level of detail may satisfy the skill level requirement for plants with a mix of experienced and inexperienced operators.

2.3.12.3 Comparative Examples The determination of the proper level of detail is subject to the writer's judgment. The following examples are intended to reflect the matter of judgment.

o Example 1. - Demonstrater increasing level of detail from adequate level (a) to a high level (c)

a. Verify that the following valves are open:

2CV-1039-2 2CV-1037-2

b. Verify that the following CC emergency feedwater valves are open:

2CV-1039-2 2CV-1037-2 2-31

_ _ _ _ _