ML20034E973
| ML20034E973 | |
| Person / Time | |
|---|---|
| Site: | Oyster Creek |
| Issue date: | 02/18/1993 |
| From: | Beall J, Durr J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML20034E974 | List: |
| References | |
| 50-219-93-80, NUDOCS 9303020147 | |
| Download: ML20034E973 (19) | |
See also: IR 05000219/1993080
Text
.
.
U.S. NUCLEAR REGULATORY COMMISSION
REGION I
,
REPORT / DOCKET NOS.: 50-219/93-80
LICENSE NO.:
LICENSEE:
GPU Nuclear Corporation
1 Upper Pond Road
Parsippany, New Jersey 07054
.
FACILITY NAME:
Oyster Creek Nuclear Generating Station
INSPECTION AT:
Forked River, New Jersey
INSPECTION DATES:
January 27 - February 2,1993
INSPECTORS:
A. Dromerick, Sr. Project Manager, NRR
J. Kauffman, Sr. Reactor Systems Engineer, AEOD-
W. Lyon, Sr. Reactor Engineer, NRR
J. Stewart, Operations Engineer, DRS
J. Williams, Sr. Operations Engineer, DRS
OTHER CONTRIBUTING NRC PERSONNEL:
D. Vito, Sr. Resident Inspector, DRP
J. Nakoski, Resident Inspector, DRP
OBSERVER:
D. Vann, State of New Jersey
/
/7 13
TEAM LEADER:
J.
, Team Leader, Engineering
Date
B
ch, Division of Reactor Safety
APPROVED BY:
z? m
der _J
5
'
J. Pf )urr, Chief, Engineering Branch,
/ ~ hate .
f
Division of Reactor Safety
Insoection Summaty: Please see the Executive Summary.
9303020147 930223
ADOCK 05000219
0
,
-.
.
.
TABLE OF CONTENTS
Pace
2
EXECUTIVE SUMMARY ......................................
1.0
INTRODU CTI ON . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4
4
1.l'
The AIT Scope and Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . .
4
1.2
AIT Process ......................................
5
2.0
EVENT DESCRIPTION ...................................
6
3.0
CAUSE OF THE EVENT ..................................
4.0
THERMAL HYDRAULIC BEHAVIOR . . . . . . . . . . . . . . . . . . . . . . . . . . 6
6
4.1
Overview ........................................
7-
4.2
Transient Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8
4.3
Conclusion .......................................
5.0
ROOT C AUS E REVIEW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
5.1
Shutdown Risk Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
5.2
Coordination of Maintenance, Operations and Engineering . . . . . . . . .
10
11
5.3
Temporary Procedural Change Program
....................
5.3.1 Procedure Revision Process . . . . . . . . . . . . . . . . . . . . . . . .
11
12
5.3.2 Change in Intent
..............................
5.3.3 Responsible Technical Review (RTR) . . . . . . . . . . . . . . . . . .
13
5.3.4 Scope and Volume of Temporary Procedure Changes . . . . . . . .
13
5.3.5 Safety Review of Temporary Procedure Changes . . . . . . . . . . .
13
5.4
Concl usi on s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
14
-
6.0
PREVIOUS EVENTS OR PRECURSORS
15
.......................
7.0.
POTENTIAL GENERIC ISSUES . . . . .
. . . . . . . . . . . . . . . . . . . . . . .
15
'
<
~ 15
7.1
Definition of " Change In Intent"
.........................
7.2
Use of STA While Shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . .
16
8.0
LICENSEE RESPONSE TO THE EVENT , . . . . . . . . . . . . . . . . . . . . . .
16
16
8.1
Operator Response
.................................
8.2
Management Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16
8.3 -
Corrective Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ~ 17
9.0
M ANAGEMENT MEETINGS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
17
i
-
-
--
,
.
_
,
.
..
'
.
D
'
Table of Contents
2
,
A'1TACHMENT 1 - AIT Charter
ATTACHMENT 2 - Licensee Personnel Contacted
,
ATTACHMENT 3 - Chronology of Events
A'ITACHMENT 4 - Degraded Core Cooling Transient
ATTACHMENT 5 - Degraded Core Cooling Transient
A'ITACHMENT 6 _ Corporate Flow Chart
A'ITACHMENT 7 - Letter from GPU to T. Martin, dated February 5,1993 -
1
.
i
't
P
f
4
'
l
9
-
,
b
..
-t
. _ .
.
_ ,
.
..
..
.
. . .
..
.~
.
.
EXECUTIVE SUMMARY
.,
On January 25,1993, at about 5:30 p.m., licensee personnel identified that reactor vessel
metal temperatures indicated approximately 228*F. At the time, the plant was supposed to
be less than 212*F and several prerequisites for exceeding a reactor coolant system (RCS)
temperature of 212*F had not been met, ir_luding the requirement for primary containment
integrity. The undetected heatup had occurred over a period of about two days from an
initial water temperature of about 110*F. After the discovery, control room operators took .
immediate measures to increase core cooling and reduced RCS water temperature to below
212*F.
An Augmented Inspection Team (AIT) was dispatched by the NRC to determine the
circumstances that led to this event, its causes, safety significance and generic implications,
and the adequacy of the licensee's response to the event. The AIT began its assessments on
January 26,1993, completed its onsite review on February 2,1993, and presente<1 its
preli.minary findings in a public exit meeting on February 8,1993.
An inadequate procedure was the immediate cause of the event. The procedure directed
operators to establish plant conditions that inadvertently failed to provide sufficient forced
flow through the reactor core to fully remove decay heat and keep RCS water temperature
stable. The changes in system configuration were accomplished via a temporary procedure
change (TPC).
The consequences of this event were minimal. Although RCS temperature exceeded 212 F
without primary containment established, there was no fuel damage and no release of
radioactivity to the environment. The heatup transient was very slow due to low decay heat,
there were mitigating systems availabic, and the extent and duration of the transient were
>
limited by test conditions.
Licensee performance in the area of shutdown risk management was mixed. - Planning and
outage control were strong, but some weakness in attention to detail was evident in persistent
deficiencies in monitoring instruments. Coordination among the onsite organizations
(Maintenance, Operations, and Engineering) was acceptable in determining that the main
>
steam isolation valve local leak rate testing could be performed in parallel with recirculation
system work. However, engineering justification for the TPC to support performing work in
parallel was not adequately developed. The team concluded that little or no schedule
-
pressure drove the development of the TPC.
The team concluded that the root cause of the degraded core cooling event was a significant
programmatic weakness in the TPC process. No guidance was provided on what constituted
a " change in intent." The site procedures concerning responsible technical review
requirements lacked clarity and did not properly implement the requirements of the corporate
.
l
t
,
.
.
.
.
-
.
.
3
procedure. The high volume of substantive TPCs was indicative of a possible over-reliance
on the TPC process instead of the normal revision process. The use of Safety
Determinations, instead of Safety Evaluations, appeared overly broad and, in the case of the
i
subject TPC, was incorrect. This allowed the use of draft documents and unverified analyses
to support a change to plant conditions.
Licensee management directed three different reviews of the event: the Post Transient
Review, an Independent Transient Review, and a review by the GPU Corporate Independent
Safety Review Staff. None of these reviews was completed during the onsite AIT inspection.
The team reviewed the group's charters, scope and resources, and concluded that the planned
reviews were reasonable and appropriate.
Based on the preliminary findings of the AIT and the licensee's own reviews, the licensee
committed to implement certain enhancements in the TPC process as.an interim measure
until all reviews were complete, These commitments .were provided in a letter to Mr. T.
Martin, Regional Administrator of NRC Region'I, dated February 5,1993, (Attachment 7).
~
The AIT considered the TPC enhancements to be a reasonable interim measure.
.
b
B
S
1
6
i
>
,,
_
.
. .
_
.
.
4
1.0
INTRODUCTION
Upon being informed of the degraded shutdown cooling event at the Oyster Creek Nuclear
Generating Station on January 25,1993, the NRC Region I Regional Administrator and
senior management from the Office of Nuclear Reactor Regulation (NRR) and the Office for
Analysis and Evaluation of Operational Data (AEOD) determined that an Augmented
Inspection Team (AIT) should be formed to review the circumstances and significance of this
occurrence. The basis for the determination was the need for the NRC to fully understand
the causes of the event and to determine if these were associated with generic issues which
required further NRC action. Accordingly, an AIT was selected, briefed, and di patched to
the site on January 26,1993.
1.1
The AIT Scope and Objectives
The charter for the AIT (Attachment 1) was finalized on January 25,1993. The charter
directed the team to conouct an inspection and accomplish the following objectives:
Conduct a timely, thorough and systematic review of the circumstances surrounding
a.
,
the event, including the sequence of events that led to and followed the degraded
shutdown cooling identified on January 25,1993;
b.
Collect, analyze, and document relevant data and factual information to determine the
causes, conditions, and circumstances pertaining to the event, including the response
to the event by the licensee's operating staff;
Assess the safety significance of the event and communicate to NRC Regional and
c.
Headquarters management the facts and safety concerns related to the problems
identified; and,
d.
Evaluate the licensee's review of and response to the event and planned and
,
implemented corrective actions.
1
1.2
AIT Process
During the period January 25 - February 2,1993, the AIT conducted an independent
inspection, review, and evaluation of the conditions and circumstances associated with the
j
event. The team inspected the computer printouts, control room logs, and other relevant
j
records of the event; held discussions and formal interviews with personnel involved in the
event; and evaluated the adequacy of established procedures,_ management oversight, and
personnel training. Attachment 2 is the list of personnel contacted by the AIT.
]
i
'
-
,,
. .
-
.
-
.
,
.
1
5
2.0
EVENT DESCRIPTION
,
On January 23,1993, the Jyster Creek facility was in day 57 of the 14R refueling outage.
The core had been refue,ed and the reactor vessel bolted back together. The plant was in a
normal cold shutdown condition with the primary containment open and the reactor coolant
system (RCS) below 212 F and depressurized (vented) to atmospheric pressure. A reactor
vessel (RV) hydrostatic test had been completed and the RCS water temperature was being
lowered from 190*F to about 110*F. The RV metal temperatures were 180-190 F and
slowly cooling down from the 190-200 F temperatures established during the hydrostatic
test. At around 11:22 a.m., operators began to reconfigure the shutdown cooling system to
support planned work. A chronology of eveats is provided as Attachment 3.
In order to support the planned startup schedule, the licensee elected to secure operation of
the recirculation pumps and lower RV annulus water level. This configuration would allow
completion, in parallel, of recirculation pump cable scaling, recirculation system flow
instrument calibration, and main steam isolation valve (MSIV) local leak rate testing.
Plant Operating Procedure Number 305, " Shutdown Cooling System Operations," required
that reactor level be maintained above 185 inches when all recirculation pumps were secured.
The licensee's corporate engineering staff had prepared a draft Technical Data Report (TDR)
which evaluated core cooling effectiveness in various plant configurations, including
operation with no recirculation pumps in service and reactor level less than 185 inches above
>
the top of active fuel (TAF).
The TDR was used to create a temporary procedure change (TPC) to the shutdown cooling
procedure. The TPC was completed, reviewed, and implemented on January 22,1993. On
January 23, after securing from the RV hydrostatic test, operators established and maintained
plant condiSons in accordance with the TPC. These plant conditions continued until
approximately 5:30 p.m. on January 25, when an operations engineer identified that reactor
vessel metal temperatures were in excess of 212*F. The Technical Specifications and
licensee procedures limited RCS temperature to below 212 F under the plant conditions
established at the time.
When informed of the high RV metal temperatures, operators promptly increased shutdown
cooling flow by first maximizing flow in the two operating loops and then placing a third
cooling loop in service. Additionally, reactor water level was raised to 190 inches and a -
t
recirculation pump was started. Vessel metal temperatures quickly dropped to nominal
values. Radiation les is throughout the plant were verified to be normal and a reactor
chemistry sample was obtained, analyzed, and determined to be normal supporting a
conclusion that core cooling had been adequate to prevent fuel damage.
The licensee appropriately reported the event to the NRC at 8:30 p.m. on January 25, in
accordance with 50.72(b)(2)(iii)(D), for the potential inability of the shutdown cooling system
to fulfill its safety function.
.
_ - .
-
-
.
-. .
i
.
6
3.0
CAUSE OF TIIE EVENT
,
,
The team concluded that the degradation in shutdown cooling had been caused by an
inadequate procedure, specifically, the TPC to the shutdown cooling procedure
(Procedure 305). The TPC did not incorporate all the changes specified by the engineering
evaluation (TDR 1095), in particular, shutdown cooling flow was maintained at about
3200 gpm instead of 6000 gpm which was intended by the TDR. The higher _ flow was
necessary to compensate for an additional flow path established by the TPC which would
allow much of the shutdown cooling system flow to bypass the core. The TPC was also
Dawed in that it contained no provision or guidance on monitoring core temperatures to
assure that decay heat was being adequately removed to k.eep core temperature stable.
The inadequate procedure resulted from a significant programmatic weakness in the conduct
of TPCs. This weakness is discussed in detail in Section 5.3.
4.0
TIIERMAlelIYDRAULIC BEIIAVIOR
4.1
Overview
Shutdown cooling flow was inadequate to assure sufficient flow through the core from
shortly after termination of the RV hydrostatic test (hydro) on January 23 until flow was
increased on January 25. The inadequate flow was due to the establishment of a flow path
bypassing the core without a sufficient, compensating increase in flow. The degraded core
cooling was manifested by gradually increasing RV temperatures caused by rising water
temperature in the upper portion of the' annulus along the inside of the wall of the RV. The
increased annulus temperature may have been caused by the spillover, at a low flow rate, of
increasingly hotter water from within the interior portion of the RV around the reactor core.
Although a gradual heatup occurred, the core remained adequately cooled throughout the
event. No fuel damage occurred, there was no release of radioactivity, and there was no
significant bulk boiling. Although the licensee concluded that the water within the RV
remained subcooled, the team could not rule out the possibility that the water reached
saturation temperature. Analysis of the event was complicated by the need to extrapolate
core water temperature from thermocouples on the metal exterior of the RV, by the presence
of an arti0cially imposed air positive pressure, and the variety of potential contributing
mechanisms for core cooling. These contributors included water spillover into the annulus,
conduction heat transfer through complex metal hardware, and internal recirculation within
the core itself.
_
4
7
4.2
Tra islent Response
,
Selected data on the heatup transient are presented in Attachments _4 and 5. The parameters
plotted include wide range RV downcomer level (WIDE), recirculation loop temperature
(RECI) which is representative of RV lower plenum temperature, RV wall temperature at the
highest level covered by water (T07), and two lines that are intended to bracket RV pressur3
'
(P- and P+).
The starting point (time 0) for Attachment 4 is 10:00 am on January 23, shortly after
completion of the RV hydro, and the parameters reflect the cooldown and depressurization
following that test. The recirculation loop cooled to a steady state value by about 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />.
The RV wall temperature decreased to a minimum at 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, increased, and then decreased.
to a second minimum at about 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. It then increased to a maximum at 55.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. ' The
inflection point at 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> can be postulated as due to the reduction in water flow through the
core, as may the long temperature increase over 44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br />. The temperature increase rates'
are about % ef what would be expected for an adiabatic heatup of everything within the core
barrel, including water and metal up to the steam separator spillover elevation of 185 inches
above the top of active fuel (TAF). The remaining decay heat was being removed by one or
more methods including spillover, conduction, and internal recirculation.
Attachment 5 provides an expanded view of the end of the transient. The sudden increase in
recirculation loop temperature at 55.47 hours5.439815e-4 days <br />0.0131 hours <br />7.771164e-5 weeks <br />1.78835e-5 months <br /> reflects the increased shutdown cooling (SDC)
flow that was initiated about two minutes earlier. Apparently this forced hot water out of the
steam separators, from where it flowed down the downcomer, out of the RV, through the
SDC heat exchangers and back into the bottom of the RV.' The heat exchangers were unable
to fully cool the water'on the first circuit and, as a consequence, warm water entered the RV
lower plenum where it mixed with the relatively cold water that was already there. The
'
water then entered the core and flowed through the circulation loop where the temperature'
was measured. After reaching a peak, the temperature decreased as the shutdown cooling
heat exchangers cooled the entire RV system. The discontinuity at about 56.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />
occurred when the active recirculation loop was changed.
Temperature T07 reached a maximum significantly earlier than the increase in shutdown
cooling flow, but only shortly after the operators initiated depressurization following
completion of the MSIV leak test. The RV level was being decreased for about an hour
.
before the T07 maximum, then was essentially steady from 54.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to 55.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.
Recirculation loop temperature was decreasing during the period bounding the T07
maximum. Thus, several parameters were changing that could affect the maximum T07
temperature, but the increase in shutdown cooling flow rate that terminated the event had not
yet occurred. Possible interpretations of the data include increased heat transfer to the lower
- plenum resulting in cooler water spilling into the annulus, but could also indicate simply a
reduction in water volume spilling into the annulus.
,
e-
8
The licensee postulated that an in-core natural circulation process was taking place on the
basis of some of the above behavior and an analysis using some plant simulator modeling,
i
The licensce's analysis of the event was not complete by the end of the inspection.
J
The saturation temperature for the maximum recorded pressure (46 psig) was 294*F, and the
licensee concluded that maximum water temperature was about 270*F. Lowering pressure
would initially decrease the margin to saturation, raising the possibility that limited boiling
may have occurred. Because pressure did not rise substantially out of the band established
previously by air pressurization and also because pressure did not remain substantially
positive after bleed off began, the team concluded that significant bulk boiling did not occur.
The maximum bulk temperature would therefore have probably been somewhat below 294"F.
4.3
Conclusion
A slow, unmonitored heatup of the RCS occurred due to the establishment of plant conditions
- 4
to support MSIV testing which did not provide sufficient forced flow through the reactor core
to maintain temperature stable. The inadequate flow condition was established at 11:22 a.m.
on January 23. The pressurization of the RV by air, which began at 1:24 a.m. on
January 25, created the possibility that RCS temperature could exceed 212 F without boiling.
The RCS temperature could then reach the higher temperature associated with saturation
conditions without significantly affecting pressure. The highest recorded pressure during the
test was 46 psig so the maximum temperature at saturation was 294*F. Any additional
r
temperature rise would have resulted in a rise in pressure. The AIT concluded, on the basis
of pressure data, that RCS bulk temperature did not exceed 294 F.
,
Adequate core forced flow was restored shortly after the elevated RV temperatures were
identified around 5:30 p.m. on Jaruary 25. About one hour previously, the MSIV tests had
been completed and restoration of normal cold shutdown conditions had begun. This
restoration included RCS depressurization (already begun by 5:30 p.m.) and adequate forced
,
flow through the core (not yet accomplished by 5:30 p.m.). The AIT concluded that,
without discovery of the elevated temperature, the duration of the heatup transient would
have been limited to the length of time required to restore the RCS flow lineup after the
MSIV test. Discussions with operators and other licensee personnel indicated that restoration
,
'
of adequate forced flow would probably have been completed in about two to four hours.
(after 5:30 p.m.) if the elevated temperatures had not been identified.
f-
5.0
ROOT CAUSE REVIEW
The AIT reviewed several licensee programs and processes to determine if they constituted a
possible root cause to the inadequate procedure described in Section 3.0. The areas
examined included licensee management of shutdown risk., coordination among the licensee's
maintenance, operations and engineering organizations, and the administrative control of
TPCs.
.
i
--
..- m
.
-
. -
.
.
.
-
.
i
.
,
<
9
5.1
Shutdown Risk Management
The team reviewed management presence and administrative controls to minimize shutdown
risk before, during and after the event. Throughout the outage, the licensee had
implemented a " Key Safety Function Plan" which established a minimum redundancy of
mechanical and electrical systems. The plan was implemented by Shutdown Management
Procedure,2000-ADM-3023.01, which required that the shift supervisor review plant
conditions and verify that the minimum equipment required for the specified plant
configuration was available. Deviations from the minimum required equipment required
either restoration of equipment to minimum configuration or the specific approval from the
Director, Oyster Creek. The team observed that information on the plant risk management-
configuration had been widely disseminated to all outage work groups in the _ daily outage
status report. The team verified, for the time period of the event, that each shift had
completed the review of plant configuration. The minimum equipment required for the
configuration at the beginning of the event included one condensate piimp and two control
rod drive pumps for inventory control, two shutdown cooling trains for decay heat removal,
and two diesel generators for electrical redundancy. The team verified that the required -
equipment had been available at the beginning of the event.
A weakness of the shutdown management plan was that minimum instrument availability was
,
not specified. In reviewing the event, the team identified two deficiencies in shutdown
cooling temperature monitoring that, if corrected, may have allowed earlier detection that
core temperatures were increasing. First, a reactor vessel temperature monitoring panel,
relocated from the control room to the reactor building during the outage, was functional, but
had not been made operational when the reactor level was lowered below 185 inches. The
.
panel provided RV metal temperature and was used by engineering personnel to identify that
RV metal temperatures were greater than 212*F. The team noted that no compensatory
temperature monitoring capability was provided to the operators during the period of time
'
when the panel was being relocated. NRC IE Circular 81-11 and also General Electric
Service Information Letter (SIL) . Number 357, dated June 1981, identified the possibility of
reactor vessel temperature stratification if recircilation was secured and shutdown cooling
>
was insufficient to remove all decay heat. The SIL noted that monitoring of RV metal
temperature could forewarn of temperature increases that could cause vessel pressurization if'
decay heat removal was inadequate. The licensee (in Plant Analysis Task Record Number
PA5178) had identified that vessel level should be maintained above 185 inches TAF when
no reactor recirculation pumps were operating. The temporary procedure change that led to
the event removed this requirement.
.
.
.
10
The second deficiency involved an inoperable shutdown cooling temperature strip chart
,
recorder. The recorder, when operational, provides indication of shutdown cooling heat-
exchanger differential temperature which directly reflects the amou'nt of heat being removed
from the core by the shutdown cooling system. The deficiency was the failure of the
,
recorder pen which had existed since December 31,1992. Although the low level of decay
heat and normal instrument accuracy would have impacted this device, it might have enabled
the operators to diagnose that shutdown cooling was not fully effective.
In summary, the licensee shutdown risk management program was a strength in that both
planning and outage control were well defined in a safety context. However, deficiencies
persisted that diminished the ability of the operators to monitor plant conditions, These
deficiencies included the relocation and upgrade of the RV metal temperature monitoring
panel to the reactor building without interim compensatory measures and the unaddressed
failure of the shutdown cooling strip chart recorder to ink while using shutdown cooling.
These deficiencies were not significant safety issues, but the failure to correct promptly
identified de6cient conditions related to monitoring plant conditions while usg shutdown
cooling was considered to be a weakness in attenuon to detail.
4
5.2
Coordination of Maintenance, Operations and Engineering
The team identified no evidence that a weakness in the coordination of activities among
maintenance, operations, and engineering contributed to this event. Outage management was
assured by engineering that development of adequate technical justification was in progress to
support the procedure chznges needed to allow the MSIV local leak rate test (LLRT), in the
plant configuration desired for the test, i.e., reactor vessel water level below 185" TAF,-
recirculation pumps secured, and one recirculation loop open. Performance of the MSIV
LLRT under those conditions allowed reactor recirculation system outage work to be
performed in parallel, rather than in series, with the MSIV LLRT.
The original schedule for the conduct of the inboard MSIV LLRT was to use the main steam
line plugs. Emergent work on the inboards MSIVs extended their refurbishment past the
window of opportunity to perform the MSIV LLRT with the main steam line plugs installed.
The main steam line plugs were removed and the RV reassembly was completed, before
work on the inboard MSIVs was complete. The licensee identified three other windows of -
- '
opportunity: 1) prior to the ASME leak rate test of the reactor pressure vessel, 2) after leak
rate testing of the reactor pressure vessel and before the primary containment integrated leak
rate test (PCILRT), and 3) after the PCILRT. The licensee used the second window. The
third window was not used because the MSIV LLRT was completed.
The team concluded that adequate coordination of activities had resulted in licensee
e
management being provided three engineered alternatives for operations to conduct the
maintenance activity. Licensee management had selected the alternative which they
concluded to best fit the outage schedule.
,
,
.
.,
,
,,
_ -
-
.
m
m
.
11
5.3
Temporary Procedural Change Program
The technical justification for the tempcrary procedure change (TPC) was based on a draft
technical document report (TDR). In the draft report (TDR 1095), there were a number of
concerns identified, but not all were addressed by the TPC. Of these concerns, the most
signincant was the need to operate the shutdown cooling system at 6000 gpm flow when
there was no forced recirculation flow and reactor vessel water level was below 185 inches
top of active fuel (TAF). Based on interviews, this requirement was not understood by the
originator of the TPC because he based his changes to the TPC on the procedure
recommendations section of the TDR which indicated the need for two SDC loops in
operation rather than the assumptions section of the analysis that assumed 3000 gpm flow per
shutdown cooling loop in operation. A contributing factor to the misunderstanding was the
standard operating practice at Oyster Creek to run the shutdown cooling system at about
3000 gpm.
5.3.1 Procedure Revision Process
The Oyster Creek Nuclear Generating Procedure Number 107, " Procedure Control," is used
to prepare, review, approve and revise site procedures. This procedure establishes, among
other things, two distinctly different processes for implementing substantive revisions. -The
normal revision process required preparation, review, and approval of all technical and safety
reviews before implementation. The temporary procedure change (TPC) process, as
conducted at the time of the event, required neither the full technical review of TPCs nor the
full technical and independent safety reviews of associated safety evahtations prior to TPC
implementation. All reviews of non-intent TPC changes were required to be completed
within 14 days after implementation.
Per Procedure Number 107, the TPC process was intended for procedure revisions "which
cannot be delayed for normal review and approval" or for one time use such that "it is not
desired to make a permanent change." Such TPCs required approval by two members of the
licensee's management staff who were qualified as a responsibic technical reviewer (RTR).
If qualined as RTR, these approvals could be by the TPC preparer and an onshift SRO.
All procedure changes required a safety review prior to implementation with the nature of the
reviews prescribed by the GPU Nuclear Corporate Policy and Procedure Manual, " Safety
Review Process" (Number 1000-ADM-1291.01) and the implementing Oyster Creek Nuclear
Generating Station Procedure, " Conduct of Technical Reslew and Safety Review" by Plant
.
Review Group (Number 130). The initial review is accomplished by a " Safety
Determination" which is used to determine if there is a need for a full safety evaluation. The
safety determination asks, among other things, if the change has "the POTENTIAL to
adversely affect NUCLEAR SAFETY or safe plant operations" (capitalization in original).
A "yes" answer would direct the performance of a Safety Evaluation.
_
---
,
12
Although both the corporate and the site procedures properly call for " broad consideration"
as to the possible effect on plant operations, the licensee stated that no minimum standards
were specified for the bases used to support Safety Determination conclusions. A full Safety
Evaluation did have such standards specified. The licensee based this position on the
following excerpt from Procedure 130:
4.1.6 Calculations and/or analyses which support the basis for any safety evaluation
and/or unreviewed safety question determination shall be design verified...
4.1.7 The preparation and review of Safety Determinations and Safety Evaluations
should also include consideration of other regulations and commitments
regarding safe plant operation.
The AIT felt that the above excerpt contained some ambiguity, especially as the
" Determination" form was also called the " Safety / Environmental Determination and 50.59
Review Form" in the GPU corporate procedure, The team also noted that, according to the
licensce's procedure on technical reports (Number 5000-ADM-7316.01), TDRs were not
design verified.
In summary, a new procedure or a normal revision required all technical reviews and
approvals before implementation. A TPC required a full technical review within 14 days of
1
implementation. A Safety Evaluation had specified standards for bases; a Safety
Determination did not have specified standards, reliance was on engineering judgment.
.
5.3.2 Change in Intent
The changes made to the shutdown cooling procedure were significant and may have
represented a change in intent. Use of a TPC allowed the significant changes to be -
implemented without prior technical review. Technical Specifications (TS) require that
procedure changes that change the intent of a procedure receive a thorough technical review
'
before implementation. Although there was no evidence that the question on the change of
procedure intent was answered, all operators, engineers and managers interviewed were -
unanimous in considering that the changes in RV level, RCS pressure, shutdown cooling
flow path and flow rate directed by the TDR and TPC did not constitute a change ofintent.-
Licensee personnel stated that so long as the shutdown cooling system was used to provide
shutdown cooling that no change of intent was involved. The team felt that the licensee's.
position was overly broad and that the changes did represent a change in intent. Further
discussion on the change in intent question is contained in Section 7.1.
>
--
.
13
5.3.3 Responsible Technical Review (RTR)
Signatures by two RTR qualified individuals were required before a TPC could be
implemented. Interviews with operators, engineers, and managers evidenced some confusion
as to what those signatures meant and exactly what constituted an "RTR Review." Procedure
107 used "RTR" to mean, variously, the review task, the person reviewing, and the
qualification level of the individual. The team also felt that the procedure was confusing
since a TPC review / approval signature required to be made by an RTR qualified individual
'
did not denote an "RTR Review."
The RTR review was also required for Safety Determinations and Safety Evaluations. The
requirement was established by the GPU Corporate Policy and Procedure Manual procedure,
" Safety Review Process," Number 1000-ADM-1291.01. This requirement was implemented
at Oyster Creek in Procedure 130. Additionally, a Safety Evaluation called for an
Independent Safety Review (ISR). The corporate procedure contains a flow chart (see
Attachment 6) of the process. It should be noted that the bottom of the chart 'contains the
-
'
following footnote which refers to a Safety Evaluation, which had concluded that no
unreviewed safety question or Technical Specifications change was involved: "This review is
mandatory, but is not required before implementing approval. Consult division procedure."
As described in the corporate procedure, and as shown on the chart, all technical reviews are
required to be complete prior to implementing approval..
Procedure 107 and Oyster Creek practice directed the implementation of TPCs before RTR
review for both Safety Determination and Safety Evaluations. The A1T concluded that this
practice was inconsistent with both Procedure 130 and the corporate procedure and
represented a significant weakness in implementing substantive TPCs. The team was
concerned that substantive TPCs, with the potential to impact safety, were routinely being_
implemented prior to the completion of required safety reviews.
The post-implementation RTR review of the TPC identified safety issues and concerns.
Followup of these concerns led to the identification of the elevated RV metal temperatures
from the degraded core cooling. The team considered this to be good evidence that a pre-
implementation RTR review would have identified the same concerns such that degraded core
cooling would have been prevented.
5.3.4 Scope and Vohime of Temporary Procedure Changes
The AIT felt that the scope of the TPC and the changes involved in plant conditions for this -
[
event were unusually broad and was not a prudent use of the TPC process.
l
!
-
II
l
.
14
'Ihe TPC was made with inadequate review of technical bases and previous licensee
responses to NRC and industry concerns regarding thermal stratification. General Electric
(GE) Service Information letter (SIL) 357 recommended monitoring reactor pressure vessel
(RPV) thermocouples under certain conditions during which thermal stratification could
occur. The inadequate review was due, in part, to utilizing'a TPC rather than a new .
.
procedure or a normal procedure revision.
The team noted that the licensee used a very high volume of TPCs during the outage: 188
between December 1,1992, and January 26,1993. The licensee estimated that about 90
percent of those TPCs were substantive. The team was concerned that the high volume of
substantive, potentially unreviewed, TPCs represented a challenge to the onshift senior
reactor operator responsible for approval and implementation. The team'was also concerne<1
that the high volume of substantive TPCs could be indicative of over-reliance on the TPC
process.
5.3.5 Safety Review of Temporary Procedure Changes
The safety review of the TPC demonstrated a significant programmatic weakness. The safety
determination question regarding the potentialimpact on safe operation was answered "no"
based on a draft TDR. The TDR evaluated if flow was adequate for core cooling, given the
impact of planned changes in RV level and shutdown cooling flowpath. The Safety
Determination conclusion was wrong; inadequate flow adjustment caused an unmonitored
RCS heatup to above 212*F without primary containment. Interviews with operators,
engineers, and managers showed that licensee personnel felt that the safety review of the
TPC was adequate, but that the preparer committed a personnel error in transcribing the
higher TDR flow requirements into the TPC. Contrary to this position, the fact that flow.
analysis was necessary due to the impact of planned changes in RV level and shutdown flow
path was clear evidence that there was a " potential" to affect safety. The Safety
Determination question should have been answered "yes" and a Safety Evaluation should
have been performed. Procedure 130 required design verification of analyses and pre-
implementation technical and safety reviews. The team felt that these additional measures
would have assured the adequacy of the TPC.
5.4
Conclusions
Licensee performance in the area of shutdown risk management was mixed. Planning and
outage control were strong, but some weakness in attention to detail was evident in
deficiencies in monitoring instruments.
Coordination between the onsite organizations (Maintenance, Operations, and Engineering)-
was acceptable in determining that the MSIV LLRT could be performed in parallel with
recirculation system work. However, engineering justification for the TPC to support
performing work in parallel was not adequately developed. Little or no schedule pressure
,
drove the development of the TPC.
-
,
,
15
The team concluded that the root cause of the degraded core cooling event was a significant
programmatic weakness in the TPC process. No guidance was provided on what constituted
a " change in intent." The site procedures concerning RTR review requirements lacked
clarity and did not properly implement the requirements of the comorate procedure. The
high volume of substantive TPCs was indicative of a possible over-reliance on the TPC
process over the normal revision process. The use of Safety Determinations, instead of
Safety Evaluations, appeared overly broad and, in the case of the subject TPC, was
incorrect. This allowed the use of draft documents and unverified analyses to support a
change to plant conditions.
6.0
PREVIOUS EVENTS OR PRECURSORS
The team reviewed the Oyster Creek operating history and identified two recent events
during which the shutdown cooling system was placed in operation in unusual or abnormal
plant conditions. After further review, the team concluded that these events contained
,
important differences from the current event and did not represent precursors._ Prior notice
was available to the licensee in IE Circular 81-11 and GE SIL 357 as discussed in
Section 5.1.
7.0
POTENTIAL GENERIC ISSU15
The team identified two potentially generic issues involving the definition of " change in
intent" and the use of the STA with the plant in cold shutdown conditions.
7.1
Definition of " Change In Intent"
The temporary procedure change (TPC) to Procedure 305 was an important and significant
change that did not receive adequate review prior to implementation. Technical Specification 6.8.1 allows use of TPCs provided "the intent of the original procedure is not altered." For
" intent changes" to procedures, the normal procedure revision process is used. The normal
process requires thorough responsible technical reviewer (RTR) reviews prior to
implementation of the procedure revision.
Licensee guidance for determination of a " change of intent" was lacking. Based on
interviews, licensee staff did not have a common understanding of what constituted an " intent
change." Further, the TPC determination form did not raise the question of whether the
TPC was an " intent change."
The team noted that:
a)
the TPC deleted precautions to maintain reactor water level greater than-185".
t
_
.
16
b)
the TPC allowed normal operation of the SDC system in a condition contrary to
Prerequisite 4.1.2 of the Normal Operation section of the procedure (i.e., the
prerequisites of the procedure should have been changed to allow operation without
the reactor vessel being vented),
c)
the TPC placed the plant in a condition Oess than 185 inches TAF reactor water level,
no recirculation pumps running) that was normally prohibited and where (as
recognized in the draft-TDR) instrumentation normally monitored by the operators
would not alert them to an unplanned core heatup, and
d)
the TPC placed the plant in a condition Oess than 185 inches TAF reactor water level,
no recirculation pumps running) that management had prohibited. In response to
prior generic communications from NRC and the vendor (GE SIL 357), management
had prohibited operation of the SDC system with reactor vessel water level below 185
inches TAF without recirculation flow.
The team considered this to be a potentially generic issue because no NRC or standard
industry definition could be identified as to what constituted an " intent change."
7.2
Use of Shift Technical Advisor (STA) While Shutdown
The team noted that the Oyster Creek TPC process called for STA review prior to
implementation. The STA was not required by the Technical Specifications during cold
shutdown conditions, so this review step was normally marked as not applicable. The -
licensee's data on TPCs indicated that TPC use was much higher during cold shutdown the
at any other time. The team considered that this represented a possible need to reconsider,
generically, the role and requirements of the STA.
8.0
LICENSEE RESPONSE TO TIIE EVENT
8.1
Operntor Response
Operators took prompt action to increase core cooling to return the plant to cold shutdown.
In parallel, operators acted to establish primary containment. Radiation levels were verified
to be normal and a chemistry sample was obtained and analyzed to confirm that no core
damage had occurred. The appropriate NRC notifications were made.
8.2
Management Response
Licensee management directed three different reviews of the event: the Post Transient
Review, an Independent Transient Review, and a review by the GPU Corporate Independent
Safety Review Staff. None of these reviews was completed during the onsite AIT inspection.
The team reviewed the group's charters, scope and resources, and concluded that the planned
reviews were reasonable and appropriate.
.
17
8.3
Corrective Actions
Based on the preliminary findings of the AIT and the licensee's own reviews, the licensee
committed to implement certain enhancements in the TPC process as an interim measure
until all reviews were complete. These commitments were listed in a letter to Mr. T.
Martin, Regional Administrator of NRC Region I, dated February 5,1993, (Attachment 7).
The AIT considered the TPC enhancements to be a reasonable interim measure.
9.0
MANAGEMENT MEETINGS
The licensee management was informed of the scope of the AIT during an entrance meeting .
on Tuesday, January 26,1993. Licensee management was briefed of the inspection
observations routinely and at the conclusion of onsite review on Tuesday, February 2,1993.
A public exit meeting was conducted on February 8,1993, at 1:00 p.m. at the licensee's
visitor center with licensee representatives identified in Attachment 2 to discuss the
preliminary inspection findings.
l
!
,
h
I
l
i
l
l
1_
1
i.
, _ . . . _ . .