ML20058L314

Forwards Comments in Response to 930702 Memo Re Human Performance Study Rept of 930416 NA-2 Event Involving Disabling of Auxiliary Feedwater Sys During Reactor Trip Recovery

ML20058L314
Person / Time
Site:	North Anna
Issue date:	12/09/1993
From:	Varga S Office of Nuclear Reactor Regulation
To:	Jordan E NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
References
NUDOCS 9312160257
Download: ML20058L314 (6)

Text

i e .

g a% ]

(w A3 gf  !

UNITED STATES NUCLEAR REGULATORY COMMISSION

%g y,.....f WASMNCTON, D.C. 2055S-am December 9,1993 Docket No. 50-339 MEMORANDUM FOR: Edward L. Jordan, Director Office for Analysis & Evaluation of Operational Data FROM: Steven A. Varga, Director Division of Reactor Projects - I/II i

SUBJECT:

HUMAN PERFORMANCE STUDY REPORT, NORTH ANNA, UNIT 2 (NA-2)

EVENT, APRIL 16, 1993 This memorandum is in response to your memorandum dated July 2, 1993 regarding your Human Performance Study Report of the NA-2 April 16, 1993, event involving the disabling of the auxiliary feedwater system during a reactor trip recovery.

Your July 2, 1993, memorandum highlighted concerns regarding the inappropriate bypassing of an engineered safety feature and a man-machine interface which requires the operator at the controls to use an individual " spotter" to report information from recorders. You also questioned whether the relaxation given by the NRC for Surry control room deficiencies was significant.

The staff has completed a review of your concerns as identified above. The staff's evaluation and conclusions are specified 11 the enclosed report of the NA-2 April 16, 1993, event.

l In summary, the staff finds that the NA-2 April ?6,1993, evetw, regarding the  :

bypassing of an engineered safety feature, does l'ot represent tt.e loss of l focus on a lesson-learned from Three Mile Island 2 as much as it represents an instance in which an operating crew failed to employ the communications and teamwork skills necessary to implement the intended mitigation strategy.

The particular controls and indications associated with the use of a " spotter" have been evaluated and documented in the NA Detailed Control Room Design Review (DCRDR). The staff completed a review and evaluation of the NA DCRDR and concluded that the DCRDR met the requirements of NUREG-0737, Supplement 1. l The staff's safety evaluation for the NA DCRDR was issued on February 28, 1990 and re-reviewed for adequacy in a site visit on November 5, 1993. Also, the staff finds the use of a " spotter" at NA during startup operations to be an enhancement.

1300v  ;

NRG R E CENI B iM Y l 9312160257 931209 /~s i PDR S

ADOC 05000339 PDR _ j i h

I Edward L. Jordan December 9, 1993 ,

Finally, similar control room feedwater control at the Surry Power Station is augmented with temporary trend recorders during startup, and a " spotter" is not used. The staff has previously evaluated the use of temporary recorders as an alternative to permanent installation of recorders on the bench board.

The staff's safety evaluation dated March 23, 1993, found the use of these temporary recorders to be acceptable. ,

J Sincerely, (Original Signed By)  ;

i l

Steven A. Varga, Director Division of Reactor Projects - I/II Distribution Docket File NRC & Local PDRs (w/ incoming)

PDII-2 RF L. Mitchell T. Murley M. sinkule, RII F. Miraglia .

L. Callan S. Varga i G. Lainas H. Berkow ,

L. Engle (w/ incoming) ,

E. Tana i L. Dodley NRR Mailroom 12-G-18

• See previous concurrence j o m cE LA:POII-2 PM:PDII-2 D:PDIl-2 AD:DRPE DtDflPE M -

q WE ETana 8 I LEngle k HBbkh Glainas* b aY DATE 12/ 7 /93 12/9 /93 12/ 9 /93 12/8/93 s12]My/93 1 0FFICIAL RECORD COPY - DOCUMENT NAME: C : \ AUTOS \WPDOCS \NOANNA\Y E LTCKI'. NA2 I

l A-

Staff Report t

North Anna Power Station, Unit No. 2 .

^

l April 16, 1993 Reactor Trip-Bypass of Engineered Safety Feature Docket No. 50-339 Item 1. Inappropriate Bypass of an Engineered Safety Feature On April 16, 1993, North Anna, Unit 2 (NA-2) experienced a reactor trip from i 100% power. During recovery from the reactor trip an operator placed the  ;

controls for the auxiliary feedwater pumps in pull-to-lock and thereby i l

inappropriately bypassed an engineered safety feature (ESF). AE00 l characterized this event as further evidence of an TMI lesson that has faded 1 i

despite a recent information notice. The following excerpt from the AE00 I human performance study report concerning this event describes the sequence of events related to bypassing of the ESF.

)

While the crew implemented 2-ES-0.1, Reactor Trip Recovery, the reactor coolant system dropped below 547'F because of full auxiliary feedwater flow to the steam generators. The procedure reader was at  !

Step 6 and attempted to go back to Step 1 for instructions to throttle or control auxiliary feedwater flow for the purpose of -

I limiting reactor coolant system cooldown, although Step I was not <

identified as a continuous action step. At this point, the Unit 2 supervisor stopped the procedure reader and communicated directly  !

with the secondary operator. The ' secondary operator, after j receiving permission from the Unit 2 supervisor to " secure AFW" established main feedwater flow to the steam generator and disabled 1 the auxiliary feedwater pumps to stop auxiliary feedwater flow.

Recovery of the plant continued until the procedure reader reached ,

Step 12, " Stopping AFW PUMPS." Realizing the procedure still called  ;

for the pumps to be running and that the switches were in the pull-to-lock position, the procedure reader informed the shift supervisor. The auxiliary feedwater system was immediately returned to an operable configuration by the crew.

Evaluation Information Notice (IN) 92-47, " Intentional Bypassing of Automatic Actuation of Plant Protective Features," describes a December 8,1991, event at Crystal River Unit 3 in which an ESF was intentionally bypassed. IN 92-47 noted that one of the significant lessons learned fro:n the accident at Three Mile Island, Unit 2 (TMI-2) was that the core damage resulted from operators manually terminating safety injection based on an inaccurate diagnosis of plant conditions. Although the April 16, 1993, event at NA-2 is similar to the events described in IN 92-47 (i.e., each involved bypassing an ESF), there are important root cause differences between the NA-2 event and the preceding events discussed in IN 92-47.

4 The THI-2 event and the Crystal River Unit 3 event both involved intentional bypassing of an ESF. These events were instances that demonstrated errors in decision making. In contrast, the operating crew invol ad in the NA-2 event inadvertently bypassed an ESF. The imediate cause of the bypassed ESF was determined to be inadequate comunications. The NA-2 supervisor had comunicated directly with the secondary plant operator, rather than through the procedure reader. The NA-2 supervisor incorrectly comunicated his intention for the secondary operator to close the AFW valves by directing the operator to " secure AFW.* Virginia Electric and Power Company (the licensee) defines " secure" in their procedures ". . . to remove a system from service and take appropriate action to prevent return." The secondary operator took actions consistent with this definition and placed the AFW pump controls in pull-to-lock. Inadequate verification by the procedure reader, unit supervisor, and shift supervisor resulted in the disabled AFW pump status to remain unrecognized for a period of 18 minutes.

The licensee had developed a policy regarding the defeating of equipment or system automatic safety functions and trained operators concerning the policy.

Nevertheless, such training was of limited value in the current circumstances because errors in performance and fundamental knowledge deficiencies caused the operators to fail to realize that they had created conditions to which the policy applied. Although the secondary operator should have recognized that his actions resulted in a bypassed ESF, interview results indicate that at the i time of the event he considered the AFW system as a non-ESF system unless a safety system has actuated. Once heat sink requirements were met, he took what he thought to be appropriate action for the conditions. Given these conditions, the staff believes that operator insensitivity to the licensee's policy concerning the defeating of equipment or system automatic safety functions was not a significant contributing factor to this event. Rather, a fundamental deficiency in knowledge of the system appears to have contributed to the event.

Conclusions There are important differences between the human errors involved in the NA-2 event and the human errors that contributed to the events discussed in IN 92-47. The event at NA-2 does not represent the fading of a lesson learned from THI-2 as much as it represents an instance in which an operating crew failed to employ the comunication and teamwork skills necessary to implement the intended mitigation strategy. The staff would not expect that corrective actions taken in response to IN 92-47 would necessarily have beei effective in preventing the event at NA-2.

Item 2. A man-machine interface weakness was noted in which the operator at the controls needs a spotter at important recorders to provide readings. In one case this led to a flow adjustment to the wrong steam generator due to a comunication error.

l

Since initial operations, North Anna Power Station (NAPS) has regularly used a licensed operator as a " spotter" to monitor and report steam generator feed flow, steam flow, and level recorder indications to the balance of plant (B0P) operator during the initial loading of the turbine generator. This practice was instituted in response to operator difficulties experienced during main feedwater (MFW) control in feeding steam generators at that point in plant startup. The " spotter" was able to focus attention on the wide and narrow range steam generator level recorders and promptly alert the B0P operator to trend changes. This enabled the BOP operator to more capably monitor all appropriate indications and to be more responsive in control of steam generator level. NAPS does not have any written guidance or procedures governing this practice.

Evaluation On November 5, 1993, the staff conducted a site visit to evaluate the use of the " spotter." Licensee employees including NAPS licensed and non-licensed operators, training staff, and management were interviewed. The evaluator observed the MFW indications and controls in the control room and plant reference simulator. The evaluator reviewed applicable training material, administrative procedures, and Detailed Control Room Design Review (DCRDR) documentation.

To date, there appears to be no evidence of non-licensed personnel being used as " spotters" in the control room during an actual plant startup. Non-licensed operators have been used as " spotters" in the simulator training scenarios. Although not specified by procedure, " spotters" are assigned by licensed operators. When interviewed, operators described appropriate assignment criteria, including knowledge of MFW system operation and indications.

The " spotter" function is limited to verbally providing information to the B0P operator regarding current MFW indications and trends. All personnel who serve as " spotters" during either startup operations or training receive formal communications training. The " spotter" does not manipulate or direct the manipulation of safety system controls.

Since the initial use of the " spotter," significant MFW system improvements, including regulating valve and controller modifications, and procedural changes which provide for smoother initial loading of the turbine generator, have aided MFW control. All operators interviewed expressed confidence that control of MFW during startup can be adequately and safely performed without the use of a " spotter," and the " spotter" merely serves to enhance MFW control. l The NRC staff completed a review and evaluation of the NAPS DCRDR and concluded that the licensee met the DCRDR requirements of Supplement 1 to NUREG-0737, and issued a Safety Evaluation on February 28, 1990. The November 5,1993 evaluator site visit included a review of the associated DCRDR documentation which appeared to be adequate.

I t

I i

l Similar control room AFW controls and _ indications at the licensee's Surry ,

Power Station are augmented with temporary trend recorders.during startup, and  :

a " spotter" is not used. The staff previously evaluated the use of these -

temporary trend recorders as an alternative to permanent installation of the ,

recorders on the' bench board. In a safety evaluation dated March 23, 1993, l the statf concluded that the use of temporary trend recorders for steam

~

generator narrow range level at Surry Power Station was acceptable, and that  :

the installation of these recorders on the bench board was not appropriate. '

Conclusions .

The licensee has evaluated and documented in the NAPS DCRDR the particular controls and indications associated with the use of the " spotter." The NRC 1 has found the DCRDR acceptable. _ NAPS does not have any written guidance or >

procedures governing the use of the " spotter," however, the " spotter" does not manipulate or direct the manipulation of safety system controls. This  !

practice currently uses a licensed operator to enhance the on-shift licensed .

operator's control of MFW during the initial loading of the turbine generator.  !

It provides additional focused monitoring of appropriate indications by l appropriate personnel and appears to heighten on-shift operator awareness.  :

Therefore, the staff concludes that the use of a " spotter," as currently >

practiced at NAPS, and the use of temporary trend recorders for steam '

generator narrow range level at Surry are acceptable.  !

i r

l 1

t P

- ~ , - ,