ML20049J667
| ML20049J667 | |
| Person / Time | |
|---|---|
| Site: | Summer  |
| Issue date: | 03/11/1982 |
| From: | Storz L SOUTH CAROLINA ELECTRIC & GAS CO. |
| To: | |
| Shared Package | |
| ML19291F826 | List: |
| References | |
| ISSUANCES-OL, NUDOCS 8203190110 | |
| Download: ML20049J667 (28) | |
Text
{{#Wiki_filter:r s o March 10, 1982 UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE THE ATOMIC SAFETY AND LICENSING BOARD In the Matter of )
)
SOUTH CAROLINA ELECTRIC & ) GAS COMPANY, _et a_l.
) Docket No. 50-395-OL
)
(Virgil C. Summer Nuclear ) Station, Unit 1) ) AFFIDAVIT OF LOUIS F. STORZ REGARDING M. S. MEDEIROS, JR. TRIP REPORT ON V. C. SUMMER NUCLEAR STATION OPERATING PROCEDURES Louis F. Storz, being first duly sworn according to law, comes forward and states: My name is Louis F. Storz. I am employed by South Carolina Electric & Gas Company as Assistant Manager, Operations, in the Nuclear Operations Department. Before assuming my present position in October, 1981, I was Super-visor of Operations. I have been and am responsible for development of plant operating procedures for the V. C. Summer Nuclear Station Unit 1 (V. C. Summer). I have been involved in that effort since coming to work for SCE&G in May, 1980. I have read the trip report prepared by M. S. Medeiros, Jr. of the NRC's Office of Nuclear Regulatory Research, dated December 22, 1981, and have evaluated the criticisms of the Applicants' operating procedures contained therein. I have also read NRC I&E Report 50-395/82-06, which refers to the Medeiros trip report and procedures 8203190110 820311 PDR ADOCK 05000395 O PDR t
O $ matters at pages 10-14, and have read Mr. Bursey's " Motion for Admission of New Contention," which I understand was filed on February 24, 1982, and which refers to the Medeiros trip report. I have testified before in these proceedings and during the course of that testimony have provided a statement of my professional qualifications. (Tr. 4459-60). I have prepared a point-by-point commentary on Mr. Medeiros' trip report, which is attached as Attachment 1. My conclusion is that while some of Mr. Medeiros' editorial comments are well taken, and a few of his technical comments reflect needed corrections, the vast majority of his comments are not substantiated. Prior to 1976, in order to provide assistance in the preparation of required procedures and administrative programs to meet then current regulatory requirements, Applicants contracted with Nuclear Services Corporation (NSC) (now Quadrex Corp.) for development of a " Software Plan" to provide a complete scope of procedures needed to meet the existing requirements. The three specific cate-gories of operating procedures to be developed were General Operating Procedures (GOPs), System Operating Procedures (SOPS), and Emergency Operating Procedures (EOPs). GOPs are intended primarily to be used to coordinate plant status (mode) change. These establish specific limits and precautions to be observed, provide programmatic direc-tion to integrated system operation, and specify instruction as required to achieve integrated system operations. SOPS
< s relate to single systems or large subsystems. SOPS include i items such as valve line-up procedures and electrical and f
control panel checklists to establish the normal operating i configurations for the particular system,. component or sub-system involved. EOPs are intended to provide operators with detailed guidance in the event of specific accidents which may challenge design criteria, to insure that plant systems are performing their design functions. In addition, general guidance is provided to assist operators in evalu-ating an accident and taking the corrective action required upon system failure or impairment. The Quadrex software plan was completed in early 1976. The initial step taken by the Operations group at v. C. Summer was to review procedures from operating plants of similar design; review of generic procedures supplied by Westinghouse (the NSSS vendor); review the architect /engi-neer system descriptions and piping, electrical, and control drawings; review vendor-supplied component and equipment manuals; review FSAR commitments; and establish formats in accordance with ANSI 18.7 (Administrative Controls and Quality Assurance for the Operating Phase of Nuclear Power Plants, the standard governing such procedures) and NRC Regulatory Guide 1.33. This procedures development was performed in accordance with AP-101, Rev. O. (Development of Safety Related and Non-Safety Related Procedures.) The initial effort was completed in early 1979.
The bulk of the initial preparation and writing effort was accomplished by individuals qualified to cold license (i.e. former Naval and Westinghouse certified personnel). Typically, procedure preparation and first qualified review was by Operations personnel and a second review by staff engineers qualified to cold 3icense. In 1979, Applicants contracted with NUS Corporation to augment the site staff in order to provide additional expertise in procedures preparation, technical writing, and field verification as well as technical verification of the preliminary site specific procedures. NUS presented good credentials and their personnel involved in the project had strong backgrounds in the development of operating proce-dures at other nuclear stations. Selected GOPs, SOPS, and EOPs were assigned to NUS for complete rewrite. The scope of their work was similar to the initial effort and included the addition of post-TMI considerations and commitments as well as the Westinghouse Owners Group short-term Emergency Operating Instruction (EOI) recommendations. The bulk of this work was concluded prior to June, 1980. By early 1980 construction of systems at V. C. Summer had reached a state of completion which allowed preopera-tional testing to begin. Where practical, issued SOPS were utilized in testing, and operation feedback was factored into revisions. This is a very effective procedure verifi-cation technique; one which is ongoing.
= o The first hot functional test was performed in July-September, 1980. In preparation for the test program issued GOPs and SOPS were reviewed by Westinghouse, Gil-bert/ Commonwealth Associates, and SCE&G start-up engineers, and Nuclear Operations personnel and marked-up to serve as test procedures, i.e., to account for construction restraints or other limitations which required temporary modifications in procedures designed for a fully operational plant. The Plant Manager stressed the need to review the procedures to be sure that they would support a hot functional test. Needed procedure modifications were identified during the performance of the hot functional test and both these and the test-restraint changes were reviewed for possible permanent inclusion into the procedure following completion of the testing. This approach achieved satisfactory results in that no conditions identified as unsafe resulted from use of the procedures, and procedures were verified under test conditions. In August, 1980, the NRC Human Factors Branch initiated a review of emergency procedures to determine conformance with NUREG 0737 requirements. This review resulted in additional changes, which were incorporated. A number of these revised EOPs (EOP-1, -5, -13, -14) were tested on the Zion plant simulator during October, 1980 with NRC repre-sentatives present, following which they were approved by the Staff for use.
- o In July and August, 1980, SCE&G contracted with the Essex Corporation to conduct a human factors evaluation of the main control board. This was expected to lead to physical changes which would require procedural changes to conform. Essex performed a short-term evaluation to deter-mine the overall extent of the required review and a long-term evaluation and upgrading project. This project was completed in late February, 1982. Following the short-term evaluation, the NRC conducted their human factors evaluation of the main control board and concurred in the long-term program proposed by Essex.
We recognized that following completion of the Essex main control board modifications, a meticulous procedure review would be required to conform to changes in layout and terminology, to verify adequacy of the procedures and to assess the overall improvement in the upgrade effort. We realized that significant changes were going to occur on the main control board; Westinghouse review of GOPs, SOPS, and EOPs within their scope would lead to revisions; comments on j procedures resulting from their application in the first hot functional test were still being reviewed; and, post-TMI requirements of NUREG 0737 would cause significant changes to plant systems and procedures. Thus, the Applicants established a program to consolidate all potential changes into the existing issued procedures. l l In August, 1981, the NRC Resident Inspector began a review of issued SOPS. He discovered a number of minor = , problems, most of which resulted from either the constant state of change occurring in the plant due to modifications, or delay in issuance of control documents. The Company management initiated a program to address and resolve the open items and the upgrade of procedures. The second hot functional test was scheduled for late October, 1981. Management recognized that because the upgrade and finalization of procedures, specifically GOPs and SOPS, had fallen far short of the Operations group's schedule, marked-up procedures rather than the final, formal ones would have to be used as in the first hot functional test. In November, 1981, following the second Hot Functional Test and operator oral exams, the Operations Group formed a full time administrative shift to reduce and eliminate open items in the operating procedures. New direction was given and priorities established to complete all SOP and GOP revisions by the projected plant fuel load readiness date. Strong direction from management to review the following items was given to the Procedures group: (1) walkdown of systems using latest available drawing revisions to correct valve lineup discrepancies and possible drawing deficiencies; (2) review Technical Specifications proof and review copy for changes related to the procedures; and, (3) clearing of all identified open items on operating procedures. We had made considerable progress on verification, cross-checking, and upgrading procedures by the time Mr. o e Medeiros conducted his unofficial inspection in December, 1981. Mr. Medeiros' explanation to Mr. Woodward (who succeeded me as Operations Supervisor) was to the effect that the purpose of his visit was familiarization and orientation, not review. He had recently been assigned to an NRC project to develop generic requirements for human factors input to plant operating procedures. He was visiting several nuclear power plants to observe how the nuclear industry developed, reviewed, trained on, and implemented procedures. He felt obliged to repeat to Mr. Woodward on at least three occasions that he had not come to Summer to review plant operating procedures for the NRC. He even pointed out that he was not authorized to review our proce-dures. He made it clear that he was unfamiliar with the plant and nuclear industry terminology, offering this as an explanation for the extensive marginal notes he had made in preparation for the visit on the copies of EOPs 2 and 5, GOP-1 and SOP-101 which he had with him upon arrival at the l l site. l Because Mr. Medeiros claimed his visit to be for the purpose of understanding procedures development, training and implementation, Mr. Woodward reviewed with him the background of their development, along the lines as I have explained the history above. Mr. Medeiros was apparently not aware of the various requirements applicable to proce-dures, so Mr. Woodward explained that the format of the procedures was as required by ANSI 18.7, to which we had l committed in the FSAR. While he was told that a final i l l 1
- 4 revision of the procedures was then underway to insure compliance with the Technical Specifications, FSAR S13.5, PLS (Precautions, Limitations and Set Points), NRC comments and Applicants' commitments, vendor review, and the most up-to-date plant and control room changes and hot functional test operating experience, he insisted on proceeding with the versions on which he had made his notes. He was also specifica.lly told that emergency procedures were based on the Westinghouse Owners Group (WOG) EOIs and that they were to be rewritten to conform to requirements of NUREG 0799 and the newest WOG Emergency Response Guidelines, though in their current state they would provide for safe operation.
It occurs to me that Mr. Medeiros was looking for docu-mentation of ideas on which he had already formulated in the July, 1981 " thinking paper" included with his trip report. The remainder of Mr. Medeiros' time on site, approxi-mately 1-1/2 days, was spent walking through the procedures he had marked up. It should be noted that the walk-through on GOP-1 was based on revision number 1 on which he had made his notes. However, revision number 2 had already been issued on October 28, 1981. I think it is important to understand that Mr. Medeiros was not familiar with commercial nuclear power plants and the terminology common to them. It does not surprise me that he had difficulty with the technical jargon, including abbreviations, or procedures designed for use by trained commercial nuclear power plant operators who are quite e g familiar with the technical terms. Though Mr. Woodward explained that our procedures were already in a revision mode, Mr. Medeiros insisted on working with the un-marked up versions and one completely outdated procedure (which had been superseded by another issued procedure two months prior to his visit) . He based his criticisms on less than two days at the plant. It is important to note that Mr. Medeiros has not cited a single instance where the procedure directs the operator to perform an unsafe act. Mr. Bursey relates the Medeiros trip report to " manage-ment attitudes and abilities" (Bursey Motion, at 3), and proposes a new contention based on the inferences he draws from the Medeiros report. I disagree entirely with Mr. Bursey for the reasons below and in the attachment which forms a part of my affidavit. Conclusions The NRC has followed up on the matter of operating procedures and has attempted to confirm or deny Mr. Medeiros' allegations. Report No. 50-395/82-06 documents routine safety inspections during the period January 5-31, 1982. Item 10 (pages 10-14) addressed the plant operating and emergency procedure review. The NRC Staff Report was directed solely at the current status of issued procedures and their adequacy. The NRC Staff specifically responded to Mr. Medeiros' comments about the EOPs by finding them acceptable for operation at full power (Attachment 2). . s I have my disagreements with some Staff comments, primarily because the Staff also did not identify that rework and upgrading of procedures was in progress and many of the items identified were already addressed in revisions which were in the approval process.1 That is not my subject here. As to the inference Mr. Bursey would like to draw, my discussion on the procedures development process and the fact that we have already recognized the need for major effort to re-review and upgrade the procedures shows that management has been aware of and working on the matter for some time before we ever heard of Mr. Medeiros.
/28/Dn
~
% OUIS F. STORZ SWORN to before me this _,'in day of -- -
, , 1982.
~.
h) . f N' n ' Ts c (L.S.) Notary Public for South Carolina My Commission Expires: - fi' . 1 For example, finding a (5) relates to the fact that Essex Corporation was in the process of making nomenclature changes in the main control board and, though Applicants had committed to update the procedures to reflect these changes, there had not been time to check changes made in procedures reflecting those nomenclature changes before the Staff review was made. Unfortunately, the comments in the Staff review do not reflect this fact. y
.ATTACHMENi l
* * ~
/
[ .
~ , ,
j r 0 ITEM-BY-ITEM RESPONSE TO MEDEIROS' COMMENTS AND OBSERVATIONS AS STATED IN THE ' ~~ TRIP REPORT ON V. C. SUMMER NUCLEAR STATION' DATED DECEMBER 22, 1982 , This memorandum is an item-by-item response to,the [? ' December 22, 1981 trip report by Mr. M. S. Medeiros, J . 9 -
~
e Mr. Medeiros' comments and observations are quoted- from'his c' '?'"
~
report. My response to each item follows. e , c GENERAL OBSERVATIONS ,_ , -7 s ; - (1) The operating procedures are artless from both in' f'
'~ '
editorial and a technical standpoint".'
}'
(2) Sentence construction and punctuation show little , skill; sentence fragments compound the problem. -l ,.
/
Response: Procedures were written by operators for' .ophrators ' based on plant specific knowledge, common training and commonly used and understood terminology. Operators are a selected and trained for their technical c'pabilities,.not , literary or grammatical skills. x (3) Abbreviations are used excessively and inconsistently; capitalization is inconsistent. -
~
Response: Abbreviations are used to reflect actual control board labeling and to define some systems which have 1cng titles; e.g. CVCS for Chemical and Volume Control System or BTRS for Boron Thermal Regeneration System. Once again this is a commonly used and understood terminology which decreases the wordiness in the procedures and reflects the way the l operators actually refer to the system in their everyday work. There are inconsistencies in the capitalization. l I l (4) Directions provided are often vague and ambiguous and sometimes unintelligible. l Response: This observation reflects Mr.-Medeiros'~~ opinion of his understanding of the procedures. During his inspec-tion, he seldom asked if the operator understood the direction. l
,/ - <
j; e - < p +.- ,
* * ,- a n <
They do. ,Where there are possible ambiguities, we will correct,them. ,,, (5) Procedure format is difficult to follow and does not permit rdpid , location of information. Response: As stated in FSAR, Chapter 13.5, procedures have
, a bEen formatted using ANSI 18.'7, Rev. 1, February 19, 1976,
/- as a , guide. The FOPS, GOP and SOP Mr. Medeiros reviewed
, . conform to this format. . ,
" -{ 6 )_ _ Typical of the skill-less' preparation is a glossary which attempts to guide the reader through the inordinate nuraber of abbreviations but <does this in a random order rather than i'n an alphabetical orde2.
Responce:' Of'the four procedures Mr. Medeiros " reviewed"-- .- EOP-2,-EOP-5, COP-1 and' SOP-101--only SOP-101 had the list
, of abbregiations in a nonalphabetical order. This procedure was issued in December 1979. af l ater revised version, that has been-written but not yet issued, corrected this problem.
The prihafy purpose of the list is to offer guidance to non-
.. operators who have reason to,revi ew the proced ures, not necessarily for the trained operators.
' (7) There is little,,if any, consistency in the meaning and s - use'o_f ,"must," "may not," "should," "must not," "shall" and Mwill." Confusion abounds.
Response:, Pro'cedures were written by operators for operators '~ s
-and no, single opera' tor prepared or reviewed all the procedures.
', 'However, confusion 'does not abo'und. Operators have the
~
common sense to understand the meaning of the directions without get. ting concerned about the difference between "shall,","must" or "will." Our review will make sure no ambiguities'arise. (8) Seemingly stringent elapsed time specifications have no corresponding time measuring requirements or specifica-tion tolerances. Response: EOP-5, Reactor Trip, lists in the Automatic Action section: 4.3 Generator Trip (after 30 second time
" delay). It further states in Step 5.5: Verify generator trip approximately 30 seconds after turbine trip. The reference to the 30 second time delay in Section 4.3 is to a protective setpoint. The generator trips after the turbine.
Verification that the generator tripped is the key, not whether it tripped. If the generator trip occurs a few seconds early or late, it does not have an impact on the safety of the plant. ,
1 g
- e t
'(9)f A parameter was specified for observation in the
,, ' Control Room that was not observable in the Control ,
, Room. (deficiency, was being corrected) s Response Since Mr. Medeiros did not name the parameter, it is impossible to respond to this observation. The punctuation in the parenthetical note would indicate we were being cited by the NRC; this was not the case. Additionally, as noted, actien to correct the problem was in progress.
4 (10) The operator l's required to make calculations for which the input data is not available. (deficiency was being corrected at the time of the review) Response: I believe this observation was in respect to the Hagen controllers. Note again, corrective action was in progress. (11) Meaningless generalities such as: " Care should be exercised," "if desired," and "any significant change" are sprinkled throughout the procedures. Response: FSAR Section 13.5.2.2 states in part: "Since emergencies may not follow anticipated patterns these procedures provide sufficient flexibility to accommodate variations." There is a point in the use of such phrases-- that is, to indicate operator flexibility and the need for operator analysis in situations with which he may be faced. The " meaningless generalities" provide the operators with options and points to consider when performing an evalu-ation. Some actions such as increasing or decreasing flows with a controller cannot be specifically and quantitatively defined but depend on the response of the system to the change. (12) Within the same steps, different terms (eg. card vs. tag and bumped vs. started) are confusingly used to mean identical actions. Response: Card vs. tag is used in SOP-101 but not in the same step. Caution Tag is used in Step 3.5.6.2 and caution carded in the followup NOTE. It is different but not con-fusing to a trained operator. Bumped vs. started is also used in the same section of SOP-101. Bump is used in Step 3.5.6.2 and the followup NOTE defines what bump means. This is not confusing.
e 9 (13) Precautions involving reactor coolant temperatures have been listed in random sequence (eg. 350*F, 145'F, 200*F, 160'f) instead of in the natural sequence of temperature change. Response: Precautions are to be read prior to implementing the body of the procedure. Generally, precautions are arranged by system (e.g. the first three precautions of GOP~ l refer to the RHR system in increasing temperature require-ments) rather than the overall sequence of the procedure. This is not a hard and fast rule and many exceptions exist due to the changes made to the systems between procedure revisions. New precautions are generally added to the sections as they develop. This concern does not have a demonstrable safety significance. (14) The word "will," meaning the result of an automatic system failure, is used interchangeably, and therefore confusingly, with "will," meaning the operator shall take action. The same deficiency exists with use of the word "should" and a similar inadequacy is evident in several instances where "should not exceed" is really meant to be "shall not be allowed to exceed," and "the maximum" is really meant to be "the maximum allowable." Response: Would apply Mr. Medeiros' second observation to the structure of this observation. The assignment of meaning to the words and phrases was done by Mr. Medeiros, not by SCE&G. Therefore, the confusion was primarily on his part and the possible inability of the operator to effectively communicate with him. (15) The emergency operating procedures exhibit the same clumsy form and deficient content as the normal operating procedures. Response: This observation implies that the general observa-tions were only directed at the normal operating procedures; this is not true. Specifically, observations 3, 5, 8, 10, and 11 are primarily emergency procedure comments. All of the specific examples in Enclosures 1 and 2 are emergency procedure related. As stated earlier, procedure format is as per ANSI 18.7 and the FSAR, Chapter 13. The deficient content implies an unsafe procedure, but Mr. Medeiros has not cited a single instance where the procedure directs the operator to perform an unsafe act. ENCLOSURE 1 - EDITORIAL DEFICIENCIES OF EOP-2
- 1. The first two pages of this emergency procedure have been devoted to the non-emergency matters of references, a glossary and a table of abbreviations.
Response: This is a true statement; however, this is in accordance with ANSI 18.7 and does not constitute an editorial deficiency.
- 2. Section 2.1.8 makes little sense listing the feedwater system as a reference.
Response: Concur. The cross-reference to the applicable SOP was omitted. Section 2.1.8 should read " SOP-210, Feedwater System." However, this does not impact on the safety significance of the procedure.
- 3. Section 2.2.1, which consists of a five-line phrase, is
, vague. Furthermore, the words "... line rupture--lower bounded by those signs ..." makes little sense.
Response: Concur. Section 2.2.1 was intended to bound the accident as being more than the normal control system could accommodate and less than a safety injection condition. It lost something in typing and was missed in review. Actions have been initiated to correct this item.
- 4. The procedure contains an inordinate number of abbre-viations especially in view of the ample blank space generally existing at the end of the steps. Further-more, some abbreviations that are used in the text are not listed in the more-than-one-page list of abbre-viations. In related procedures, some abbreviations are listed in a manner different from that used in the text (eg. SG vs. S/G).
Resoonse: Use of abbreviations has been addressed in responses to the general observations. Some discrepancies in abbreviations used between procedures existed due to the Main Control Board (MCB) human factors review and subsequent labeling of the MCB. Procedure revisions that predate the MCB relabeling effort do not agree with procedure revisions that post-date the relabeling, but all procedures will ultimately be upgraded. Some discrepancies have resulted due to different operators preparing different procedures. This has not been a major concern because the difference between SG vs. S/G is not considered significant to the implementation of the procedures, and in no case has a situation been identified which created an unsafe condition.
- e
- 5. There is little consistency in the use of abbreviations and punctuations. For example, Step 3.6 starts with "RB" while Step 3.7 starts with " Reactor Building";
Step 4.7 uses both "SI" and " Safety Injection." Response: There is no apparent reason for the inconsistency between Step 3.6 and 3.7 use of abbreviations. Step 4.7, however, was perfectly correct in that the NOTE where the "SI and Safety Injection" appears reflected the MCB human factor annunciator alarm rewording. In either case, to the operator / procedure writer, the difference is not significant.
- 6. Writing is so cryptic and so artless that many readings of an emergency step are necessary to even guess at the step's meaning. For example, " ... low / low-low level alarm"; " ... signal low block heaters isolate letdown alarm"; " ... from 2/3 steam headers ..."; " ... from 2/3 RCS loops ..."; " ... 25% S/G level in the narrow range."; " ... 25% narrow range span.";
Response: The reference made is to the alarms cited in the procedures and the annunciator alarm wording as it existed at the time of the procedure preparation. These alarms have been relabeled and relocated since the issue of the proce-dure revision in question; so there was some difficulty in locating the came alarm window with the new wording during Mr. Medeiros' visit. There are over 800 annunciators available on the main control board. Some alarms have multiple inputs which result in multiple meaning as in a low / low-low level type annunciator wording. The reactor protection and control logic; i.e., 2/3 (the "/" means "out of") steam headers and 2/3 RCS loops is contained in NOTES. This is a perfectly acceptable practice since the control board has bistable monitor lights to alert the operator when he is approaching an actuation point. Step 6.5 states: Regulate emergency feedwater flow to the non-faulted S/Gs to maintain 25% S/G level in the narrow range. This is not a cryptic statement, and this is the only reference in the procedure to "25% S/G levels." This concern is unfounded and is only an expression of opinion by Mr. Medeiros.
- 7. There is little consistency in using phrases in lieu of using sentences to specify symptoms and actions.
Response: Specifics of this concern are not identified. The relevance of the observation is not specified and therefore no specific response can be made.
O p
- 8. The caution note accompanying Step 5.6 should preceed
[ sic) the step, not follow it. Response: This is Mr. Medeiros' opinion. There is not a hard and fast rule on the placement of cautions. As to notes, see Item 11 below. There are proponents for either method. The guidance provided to the procedure preparers was to place the caution where it makes the most sense. Apparently, Mr. Medeiros was able to relate the caution to the applicable step, as he_ identified the correct step to which it applied. Our final review will make sure cautions are readily associated with the items to which they apply.
- 9. The confusing "and/or" connective is used where "or" is meant, where "and" is meant, and where "or both" is meant.
Response: The "and/or" connective appears one time in the procedure (Step 6. 3. 3) and has its usual meaning of "either" or "both."
- 10. Unexplained blank lines appear throughout the proce-dure, apparently for signatures. No statement is made in the procedure as to what such signatures might mean in terms of actual performance, observation, or hearsay.
Response: NOTE after 6.0 states " NOTE: Check or initial steps as indicated when they have been' completed." Whether a step is a verification step or performance step is immaterial. The initial or check mark allows the operator, his supervisor, or his relief to know at what step he is and that intervening steps have not been skipped.
- 11. A note between Steps 6.4 and 6.4.1 concludes "... this step may be omitted" but the note is ambigious [ sic] as to which step it applies to.
Response: Notes follow steps throughout the procedures. In the few instances where they precede the steps it is clearly stated that it pertains to the following steps. Therefore, the note after Step 6.4 is not ambiguous.
- 12. Step 6.4.1.B starts with the unintelligible phrase:
" Place all EF isolation ..." and ends with a cryptic table of letters and numbers. A clear, easy-to-understand command could be given with the same amount of text or less.
Response: The first part of the comment is valid. The unintelligible phrase is actually the abbreviated control i t
- r board switch nomenclature written out; thus, it was diffi-cult to make the connection. However, the " cryptic table of letters and numbers" is a listing of the valves to be operated, easily identified by trained operators and not at all cryptic.
- 13. Step 6.4.3 mixes two separate actions into one step.
Furthermore, because " controller" should be " controllers," it is not clear that the cryptic table following Step 6.4.3 is related to Step 6.4.3. Response: There isn't any requirement that precludes having separate but related actions included in a single step. Due to the control board location of the controls mentioned, it is a natural operator response to do these actions at the same point. Once again, the " cryptic table" identifies the valves to be operated. A typographical error omitted the "s" from controllers.
- 14. A typical, poorly written, clumsy step that should be rewritten in plan (sic] English is step 6.5.2 which states: " Place all EF isolation from the turbine driven pump to S/G's and EF isolation from motor driven pump to S/G's valves (6 valves), to the respective S/G, in the MANUAL position."
Response: This is a repeat of Comment 12 in that the same valves were being referred to in the same manner. The clumsiness of the step highlights the problems that could result from eliminating abbreviations. If the actual switch abbreviation had been used: "TD EFP TO SG " or "MD EFP TO SG_" as they are presently labeled, the step would be very clear to an operator. It should be noted again that later revisions to procedures had established use of actual switch abbreviations as a required format.
- 15. The incorrectly punctuated, two-line sentence fragment (with undefined abbreviation), which comprises step 6.7.3, is unintelligible, technically.
Response: The comment is not completely correct. A more valid comment would be: that Step 6.7.3 has an unwarranted comma and that the substeps are located on the nex: page, which does not make them readily available; but rather requires the operator to go to the next page to complete the action required.
- 16. Many steps have multi-line redundant headings which generate confusion and add an unnecessary layer of numbering to an already cumbersome presentation.
Response: I do not fully understand the comment, but reiterate that formatting was in accordance with approved standards and that trained operators have not been confused.
- 17. Extraneous punctuation and missing punctuation makes many steps ambigious [ sic] or change their meanings entirely. Steps 6.8.2A and 6.9 are examples of this deficiency.
Response: There is an unnecessary comma in Step 6.8.2.A; however, it does not make the step ambiguous (i.e., have more than one meaning) or change the meaning entirely. Step
6.9 reads
"IF RCS subcooling cannot be maintained manually initiate safety injection and go to EOP-1." The question was whether there should be a comma after " maintained" (there should) or after " manually" or none at all. Which-ever is used, the meaning is clear--if RCS subcooling is lost, the operator Should safety inject.
j ENCLOSURE 1 - TECHNICAL DEFICIENCIES
- 1. The emergency procedure contains a cumbersome list of 18 symptoms which appear to be ranked in no particular order. For exmmple, symptom 2 mentions changes in feed pump speed and condensate pump flow which may or may not be observable if the operator happened to be looking at these instruments. Furthermore, one param-eter is specified in gallons per minute but the panel meter is calibrated in pounds per hour. The list should be pared down to a more meaningful and manage-able number.
Response: Concur without comment.
- 2. The first immediate action step, step 5.1, starts:
" Evaluate plant parameters ... " which appears to be of little value since the parameters of interest are not mentioned.
Response: This is not a technical deficiency. Pr.rameters of interest are understood by operators and are also under-stood by the I&E Inspector (;Mr. Johnson); i.e., the operator should be looking at the plant parameters that indicate the symptoms leading to the implementation of this procedure but should also not lose sight of the OVERALL plant conditions in case these symptoms were only a part of a larger and more
adverse condition. In other words, evaluate for the incident and don't develop " tunnel vision" or "nind set" excluding the larger picture.
- 3. Similarly, the third immediate action step, step 5.3, starts: "If time and conditions permit it ... " but gives no clue as to what other duties, defined by procedure, training, management, etc., may be so important as to preclude compliance with this step.
Response: Not a technical deficiency. The purpose of this procedure is to provide guidance for a controlled shutdown of the plant during an unusual circumstance to mitigate effects on the plant. As was explained to Mr. Medeiros, the time and conditions permitted relate to taking manual actions prior to automatic initiation of safety system. The purpose of this is to reduce the cyclic stress imposed on the plant. But we don't want our operators to do this when the situation demands drastic action to assure safety.
- 4. Step 5.4 requires the operator to proceed to EOP-5, the Reactor Trip procedure, but does not state whether or not the remainder of EOP-2 is to be ignored or whether EOP-2 and EOP-5 should be performed in parallel.
Response: Marginal technical deficiency. Operators have received considerable training in the implementation of emergency procedures and plant operation. It is only recently that the guidance has been developed that the operator must have the options stated to him in writing. This guidance seems primarily aimed at untrained or unknowl-edgeable personnel who may require help in following the procedures.
- 5. Action required by step 6.4.2 was already required by immediate action step 5.5.
Response: Not a technical deficiency. The NOTE for Step 6.4 as referenced in the preceding section stated that all l of 6.4 may be omitted under certain " conditions. Step 6.4.2 l states " Verify CLOSED or CLOSE ... . There isn't any ( procedural guidance that prohibits rechecking a critical action.
- 6. Alarm tile engravings unjustifiably suffer from the same ambiguities and excessive abbreviations that aflict (sic) the procedures (e.g. low / low-low level alarm).
- . - - - - . - _ _ . . _ . - _ . . . . _ ~ __.- _.--.- . - _ . _ .
i 1 I I Response: This statement has nothing to do with the techni-cal content of the procedure. Multiple alarm conditions sharing a common alarm result in labels which reflect that multiplicity as addressed in a previous section. This is just a restatement of that comment. Alarm tile engravings were developed by an approved human factors contractor as part of the human factors review of the main control board. This is a field where there are many differing opinions. l 7. In step 6.6, if feed flow is unavailable, it appears j that the referenced procedure should be implemented by
' itself, not concurrently with EOP-1 as stated.
9 Response: Do not agree. Even the loss of feedwater flow is l considered as an IF statement and requires implementing GOP-
- 14. There are steps after 6.6 that can give guidance on i additional tasks and checks that can be accomplished to help mitigate the incident.
4 I 8. Step 6.7.1 appears to identify a design deficiency; i' automatic control should preceed (sic) and prevent an alarm, not be triggered at the alarm point. Response: Not a technical deficiency, but Mr. Medeiros' personal opinion. This also relates to the lack of under-standing or disagreement with the low / low-low level alarm
- setpoint concept.
- 9. In step 6.8.1D, two of the three valves have an incor-rect component designation.
Response: Concur, typographical errors; will be corrected. ENCLOSURE 2 - EXAMPLES OF EDITORIAL AND TECHNICAL DEFICIENCIES EMERGENCY C?ERATING PROCEDURE EOP-5, REACTOR TRIP, (REVISION 3, DA5on 10/22/81) EDITORIAL DEFICIENCIES 4
- 1. The first page of this emergency procedure has been
- almost completely devoted to the non-emergency matters t of references and a glossary of abbreviations.
i 1 Response: Not a deficiency. This is a repeat of first comment in EOP-2 and has already been addressed. 1
e e
- 2. The first listing under automatic actions, " Reactor trip," makes little sense since the emergency procedure is entitled " Reactor Trip." A more meaningful state-ment, such as "all rods drop into the core," should be made.
Response: Not a deficiency, but rather Mr. Medeiros' personal opinion. " Reactor trip" is common terminology used in commercial power plants to describe this event. "All rods drop into the core," I understand is common in Navy nuclear power terminology to describe this event, whereas
" scram" used to be more common in AEC days.
- 3. Action specified by step 5.1 is redundant to action specified by steps 5.1.1 and 5.1.4 and therefore only adds confusion and an unnecessary layer of numbering.
Furthermore, the meaning of the "/" mark is undefined and unclear in this step. Response: This is not a deficiency. Steps 5.1.1 and 5.1.4 are substeps explaining how to do Step 5.1; i.e., verify reactor / turbine trip with alternatives to do if the expected results are not observed. The "/" neans that both events happen concurrently. This was explained to Mr. Medeiros and is understood by the operators. / 4. Step 5.1.1.A is vague since it is not clear how the operator is to determine that the reactor is not tripped. It appears the writer means, "If the rods have not inserted:". A similar deficiency exists in step 5.1.1.A2). Response: Not a deficiency. It is a restatement of Mr. Medeiros' preference for the phrase concerning " rods inserted." 5.1.1 states, " Verify all control and shutdown rods fully inserted by digital rod position indication and rod bottom lights. 5.1.1.A as a substep of 5.1.1 gives an alternative action if 5.1.1 is not satisfied.
- 5. Step 5.2 is awkardly written to make ambiguous the intent of "IF NOT" (i.e. if not verify? or if not running?).
Response: Step 5.2 states " Verify one Reactor Coolant Pump running, IF NOT proceed to EOP-13 for establishing natural circulation." The ambiguity in this statement is purely personal opinion.
- e
- 6. In step 6.7.1, "IF MOT RESET ... " is really meant to be "IF NOT, RESET ... . "
Response: Concur, this is a typographical error.
- 7. Step 6.8 should identify the motor of interest and step 6.11 should specify what information whould (sic] be given to the load dispatcher.
Response: Not a deficiency. Step 6.8 does identify the motor (pumps) of interest, i.e., the motor suction oil pump and the turning gear oil pump. There is only one of each in the plant. There is no set information that "would" be given to the dispatcher. It depends on what information he needs and what information the plant operators have time to give him. It could be as brief as "the plant is shutdown" up to a complete description of the event and estimated time of the outage.
- 8. The note with step 6.19, " Test performed by I &C Technicians," contains no verb and therefore it is unclear whether the test "may be," "should be," "shall be" or "must be" performed by the I & C technicians.
Response: Note is unclear only to Mr. Medeiros. Neither the operators nor the technicians get too " hun up" on "shall," "should," "may be," etc.
- 9. The setpoint column of Attachment I contains numerous ambiguities (e.g. + Penalties; programmed; 4/4; +5%/2 Sec; etc) which detract from the usefulness of the table.
Response: This appears to be Mederios' first exposure to the reactor protection systems of commercial nuclear power plants; however, even naval reactors use 2/3 logic in l protection logic. The table lists the trip, some of the l protection logic and setpoints. Omitting any of it would make the table ambiguous. ENCLOSURE 2 - EOP-5 TECHNICAL DEFICIENCIES l
- 1. The " symptoms" section refers the operator to an attachment I for "any one of the 23 reactor trip first out annunciators." Attachment I lists 24 reactor trips l
! not 23. Furthermore, the attachment contains a distracting I I i
- e column of setpoints which are of little use in an emergency and which, in many cases, have been written unintelligibly.
1 Response: Attachment I lists 20, not 24, reactor trips and disagrees with the number of first out annunciators due to the fact that the steam generator trips are combined in the table and are defined by loop (A, B, or C) on the alarm tiles. Mr. Madeiros' opinion of the table has been addressed in the previous section. This is not a technical deficiency. t
- 2. The symptoms section fails to mention a rapid decrease in reactor power, or rod bottom lights being energized, as plant-specific parameters and events that are key symptoms of a reactor trip.
Response: This is an opinion, not a technical deficiency. These parameters are addressed in the immediate action verification steps.
- 3. The command " Emergency borate 17 minutes (approximately 100 PPM) ... " makes little sense technically since a differential rather than an absolute value is meant.
Response: Not completely sure what the comment is trying to say; however, it does take an absolute amount of time (about 17 minutes) to make a differential change of 100 ppm in the primary system boron concentration. This is not a technical deficiency.
- 4. The recorder specified in step 5.1.3 is the same one j specified in step 6.7, yet the component _ designations are different in the two steps; step 6.7 is in error.
Response: Concur; this is a typographical error.
- 5. Step 5.1.4 should specify what indication the operator should use to verify that the turbine has tripped.
Response: This could be a valid comment; however, there are a multiple (at least six) ways of verifying a turbine trip and some reliance is placed on operator training and knowledge to be aware of fundamentals such as this.
- 6. Immediate action step 5.3 makes little technical sense when it requires the operator to: " Verify RCS tempera-ture ... by operation of steam dumps."
Response: The step is a statement of fact in that the RCS temperature is decreased following'a reactor trip by operation l l
e . of the steam dumps. The words omitted by Medeiros are the ones to which "by operation" apply. Therefore, this is not a technicial deficiency.
- 7. Similarly, the apparent run-on-sentence of immediate action step 5.4: " Verify pressurizer level and pressure commence recovery from transient." makes little sense technically. Any pressurizer level and any pressurizer pressure would satisfy this command, and almost any action would meet the recovery statement, when, in '
fact, what is meant is that the operator should verify that pressurizer level and pressurizer pressure are returning to normal. Response: Do not concur that this is a technical deficiency. The recommended rewording is a restatement of the procedure step that merely expresses a difference of opinion as to wording of the step.
- 8. Step 5.4.A is of little additional help with its generalities: "If not recovering, evaluate conditions for safety injection symptoms. If necessary, safety inject ... . " Step 6.3.2 is similarly deficient.
Response: Do not agree that this is a technical deficiency. The intent is to lead the operator away from a " mind set" that his only event is a reactor trip and to evaluate total plant parameters. Failure of the pressurizer pressure and level and RCS temperature to respond as expected for a reactor trip are key indicators that there may be a more serious event in progress.
- 9. Section 5.5 contains no contingency step similar to the contingency steps in sections 5.1.1 and 5.1.4 in spite of the fact that the likelihood of need is similar in all three sections.
Response: Do not agree that this is a technical deficiency br a safety consideration. Failure of the generator to trip could cause damage to the turbine-generator set; however, this is primarily an economic concern, not a safety concern, contrary to what Mr. Medeiros stated in the body of his report.
- 10. Step 6.2, " Verify feedwater isolation at Tavg 564*F."
is too cryptic to be understood consistently and is too restrictive to be performed reliably. The step should state clearly what automatic operations are to be observed, what manual action is to be taken, and with
~15-
+ .
what degree of precision, (i.e. not at exactly 564'F) recognizing that a busy operator must tend multiple duties. Response: Do not agree that this is a technical deficiency. It is a statement concerning a defined setpoint. The procedure recognizes that busy operators must tend to multiple duties. It attempts to minimize wordiness and to be specific, not to be vague and cryptic.
- 11. Similarly, step 6.3, " Verify Tavg at or approaching no-load value of 557*F.", is technically unintelligible.
What does the command mean? What is the operator supposed to do? Why does it need to be done precisely at 557'F? Response: Do not agree this is technically unintelligible. The command means what it says: " verify." Commonly recog-nized constrained language usage defines " verify" as " deter-mine if in proper condition / status." "At or approaching
..." does not imply precisely at 557'F. However, 557'F is a defined setpoint.
- 12. Step 6.3.1 starts: "If cooldown rate is uncontrolled
... " but gives the operator no criteria or guidance to recognize this condition. If the intention is to prevent a restart accident in the event automatic steam dumping takes reactor temperature below a certain value, this fact should be stated rather than rely on the operator to guess.
Response: Do not agree that this is a technical deficiency. Step 6.3, of which 6.3.1 is a contingency, states the criteria or guidance, i.e., "Tavg at or approaching no-load value of 557*F."
- 13. Step 6.4.2.A cannot be performed with the information given since the panel meter is not calibrated in psig.
j Either a meter value, an equation or a calibration i chart reference should be provided if the panel meter design cannot be improved to obviate the need for these crutches. Response: This is a repeat of a comment concerning main control board controllers in EOP-2. Operators have received specific training on the Hagen controllers used on the MCB.
- 14. Step 6.14 action should be based on direction by the senior reactor operator rather than on the desires of the operator.
Response: Do not agree. This procedural technical deficiency
- ' is strictly a personal opinion. In fact, the entire imple-mentation of the emergency procedures is under the control and direction of an SRO, either the Control Room Foreman or Shift Supervisor.
4 1 i k i i i
- ,r--n- -*m-- , , , - - - - -
-e ;, ,. , ,.m -
y,. -
- - , - - - - - - - , - - , - - - , - - ,}}