ML20062E799

Special Rept:On 901011,turbine Driven Auxiliary Feedwater Pump Declared Inoperable W/O Having Made Security Notification.Caused by Inappropriate Action

ML20062E799
Person / Time
Site:	McGuire
Issue date:	11/14/1990
From:	Mcconnell T DUKE POWER CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
90-28, NUDOCS 9011260014
Download: ML20062E799 (6)

Text

g a

I Duk 1%nt Company IIO4)8IMUOO AlcGuire Nuclear Station 12700 Hagm Terry R,ad Huntmeille, NC280iS 89M i

i DUKEPOWER November 14, 1990 U.S. Nuclear Regulatory Commission i

Document Control Desk Washington, D.C.

20555

Subject:

McGuire Nuclear Station Unit 1 j

Docket No. 50-369 Voluntary Special Report Gentlement Attached is Voluntary Special Report concerning an incident involving the Standby

-Shutdown' System in which compensatory measures were not established as required by

-l nthe McGuire Physical Security Plan. This' report is being submitted as a Voluntary Special Report. This event is considered to be of no significance with respect to the health and safety of the public, i

Very truly yours, 6

i

/np.tq %

l J

T.L. McConnell i

DVE/ADJ/chl

')

1

]9 Attachment xc:

Mr. S.D. Ebneter Mr, Darl Hood Administrator, Region II' U.S. Nuclear Regulatory Commission U.S. Nuclear Regulatory Commission Office of Nuclear Reactor Regulation 101 Marietta St., NW, Suite 2900 Washington, D.C. 20555 Atlanta, GA 30323 Mr. P.K. Van Doorn l

INPO Records Center NRC Resident Inspector Suite 1500 McGuire Nuclear Station 1100 circle 75 Parkway Atlanta, GA 30339 M&M Nuclear Consultants 1221 Avenue of the Americas New York, NY 10020 9011260014 9011g4 i

{DR ADOCK 05000369 I

I pdc

(\\

(.

ji McGUIRE SAFETY REVIEW GROUP INPLANT REVIFW REPORT 1.0 REPORT NUMBER:

90-28 2.0 DATE OF REVIEW: November. 1990 3.0 SUBJECT DESCRIPTION: A review was conducted of the circumstances relating to the incident described on Problem Investigation Report (PIR) 1-M90-0268. The c

specific purpose of the review was to determine the cause of the incident and possible solutions to prevent further problems of the type described by the PIR.

4.0 EVALUATION AND COMMENT:

PIR 1-M90-0268 documented an incident in which

-compensatory measures were not established as required by the McGuire Physical Security Plan (PSP).

4.1 Background

The Standby Shutdown System (SSS) provides an alternate and independent means to_ achieve and_ maintain a Hot Standby condition for one or both units. Through the SSS, capability is maintained for both units to remain in Hot Standby.for a conservative period of three days without damage control measures being implemented.

SSS instrumentation and controls are located in the Standby Shutdown Facility-(SSF). The SSF also contains a Diesel Generator.to provide assured power for SSS operation should external power be lost.

The SSF controls the secondary side volume by utilizing the Auxiliary Feedwater System (CA) Turbine Driven Pump. This supplies feedwater to the-Steam Generators, thereby providing a heat sink for the Reactor. Coolant System-(NC).

The McGuire PSP states that compensatory measures shall be provided during periods when the SSF is considered degraded. The SSS is required to be operable in Modes 1-(Power Operation), 2 (Startup), and 3 (Hot Standby),

{

per Selected Licensee Commitment 16.9.7.

A note is attached to 16.9.7

4..

I

' ' DPC/MNS r

Inplant Riview No. 90-28 Page 2 describing required actions whenever one or more SSS components become j

inoperable, which states:

Note -

THE SRO SHOULD ENSURE THAT SECURITY IS NOTIFIED 10 MINUTES PRIOR TO DECLARIN0 SSS COMPONENTS INOPERABLE (EXAMPLE: TDCA PUMP) OR ASAP IF SSS COMPONENTS ARE DISCOVERED OR RENDERED INOPERABLE SO THAT COMPENSATORY MEASURES CAN BE IN EFFECT WITHIN 10 MINUTES OF THE TIME OF INOPERABILITY. OTHEP. WISE, A 1 HOUR NOTIFICATION TO NRC IS REQUIRED BY SECURITY.

4.2 Description of Event At the start of night shift on October 10,'1990, Instrumentation And

!y Electrical (IAE) personnel arrived ~in the Control R: ~ with three work requests. These work requests involved working on the non-safety related valve operators for valves ICA-36 (Aux Feedwater No. 1 Discharge To Steam L

Generator ID Control) and ICA (Aux Feedwater Pump To Steam tienerator IB i

h Control)'. After talking with the IAE personnel, the Operations (OPS)

Shift Supervisor determined that it would be better to wait until after-2400 (midnight) to start this work. The Shift Manager was contacted and l

all parties agreed to wait until that time.

E 1At approximately 0130 on October 11, 1990, the IAE personnel returned to the Control Room for permission to begin work. The Control Room Senior; Reactor Operator (SRO) determined that the, nature of this work would make the Turbine Driven Auxiliary Feedwater (TDCA) Pump inoperable.

E l}

l At.this time, the Control Room SRO referenced Technical Specification (TS)

L 3.7.1'.2, Auxiliary Feedwater System, to determine the proper action statement requirements. He selected action 'a' as the-appropriate one, Action 'a' states as follows:

p With'one auxiliary feedwater pump inoperable, restore the reanired auxiliary feedwater pumps to-Operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in at least Hot Standby within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in Hot Shutdown within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

q, DEC/MNS

)

• 1

.Inplant Review No. 90 -Page 3 He then referenced page'1,Section IV of tre TS Reference Manual to determine if other systems or components would be affected when the;TDCA pump was declared inoperable. No reference was made to other systems or components. Neither reference used addressed the fact that if the TDCA pump was declared inoperable, the Selected Licensee Commitments Manual should also be consulted.

Subsequently, at 0145, on October 11, 1990, the TDCA pump was declared inoperable.

Approximately twenty minutes later, the OPS Shif t Supervisor returned to the Control Room.- The Control Room SR0' informed him that he had declared-

.,.a-the TDCA pump inoperable. The Shift Supervisor then asked the Control U

Room SRO if he had also consulted the Selected Licensee Commitments Manual. The response was no.

i At that. time, the Shift Supervisor knew that an error had been made and

{

T directed the SRO to reference the Selected Licensee Commitments Manual, item 16.9.7, entitled Standby Shutdown System.

Based on the note attached to the page of 16.9.7, the Control Room SRO Lc

. realized that when he had declared the TDCA pump inoperable, a subsequent i

security notification should have been made.

o L.

At'0222, the Control Room SRO declared the SSF inoperable and notified the-Security Lieutenant of the error. He also informed him that the required-one-hour notification to the NRC had to be made by no later than 0245.

J Security personnel implemented appropriate compensatory actions at 0231.

This involved opening Fire Door 801J and placing constant Security Surveillance at the door. The Security Lieutenant then made the required-one hour notification to the NRC at 0240.

The Shift Manager:was informed of the event, and made appropriate 4

1 notifications.

The NRC Resident Inspector was also notified by Security personnel.

'S 4

DPC/MNS Inplant' Review No. 90-28

- Page 4 It was later determined that this event was not reportable under 10CFR73.71 Appendix G-1.

Therefore, the 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> notification to the NRC was not required.

4.3 Safety Evaluation During the time the SSF was degraded, the area accessed through Fire Door 801J was not provided security compensatory measures as required for approximately 46 minutes. During normal operating conditions when the SSF is not degraded, the equipment in this area is non-vital. When the SSF is degraded, the equipment in this area becomes vital because the equipment is necessary to safely shutdown the pl"at.

Pursuant to the McGuire PSP two levels of security protection are required for areas containing vital' equipment: One level of physical protection and access control for the protected area; and, a second level,of physical protection and access control for areas containing vital equipment within the protected area. This second level of security protection is provided to prevent. personnel inside the protected area from accessing areas containing vital equipment for which they have not been authorized access.

Personnel are allowed access to areas containing' vital equipment on an as needed basis. By limiting the. number of personnel accessing vital equipment, the-probability of insider sabotage is reduced. -During.the 46 minutes.when security protection was not'provided at Fire-Door 801J, the physical protection and access control to the protected area was maintained. Additionally, there were no challenges made to gain access to the protected' area. During the event, there were no ESF actuations or challenges to safety systems that required the use of the SSF to shut down the plant. The plant operated without incident during the: time the required. security compensatory measure was not fulfilled. Therefore, the health and safety of the public and on-site personnel were not affected by this incident.-

-5.0' CONCLUSION This incident is assigned a cause of Inappropriate Action because the required action as specified by the note attached to Selected Licensee Commitment 16.9.7 was omitted. The Control Room SRO failed to recognize the need to consult the

DPC/MNS Inplant Re cew No.-90-28 Page 5 f

Selected. Licensee Commitments Manual when he declared the TDCA Pump inoperable, l

Consequently, the required notification of Security personnel was omitted because the Control Room SRO did not reference the Selected Licensee Commitments Manual.

When questioned, the Control Room SRO involved stated that he had never performed this particular task as an SRO and was, therefore,- unaware of the requirements as specified by the Selected Licensee Commitment.

It should be noted that the Control Room SRO involved had only been promoted to that position four weeks prior to this event.

He also stated that the task was not one that he remembered as being emphasized during training. However, Production' Support Training personnel stated that their lesson plan covers using the Selected Licensee Commitments Manual whenever the TDCA pump is declared inoperable.- Subsequently, the incident has been covered with all appropriate OPS personnel to help preclude recurrence of.similar incidents.

Additionally, a copy of Selected Licensee Commitment 16.9.7, and tite attached note detailing' required actions, has been placed in the TS Reference Manual in '

the Control-Room. This should serve as a reference whenever the TDCA pump is declared inoperable in the' future.

Compliance personnel will evaluate and submit appropriate changes to the Selected Licensee Commitments Manual to clarify appropriate actions required whenever any component of the SSS is declared inoperable.

J6.0 RECOMMENDATIONS: None

7.0 REFERENCES

1.

.McGuire Technical Specification, Section 3.7.1.2, Auxiliary Feedwater

~

-System 2.

lMcGuire Technical Specification Reference Manual, Page 1,Section IV 3.

McGuire Selected Licensee Cossnitments Manual, Item 16.9.7, Standby Shutdown System

'4.

McGuire Senior Reactor Operator's Logbook, Unit 1 5.

McGuire Shift Manager's Logbook, Unit 1 6.

McGuire Technical Specification Action Item Logbook, Unit 1 7.

McGuire Safeguards ENS Event Report, For 10/11/90 at 0222 8.

McGuire Physical Security Plan 9.

• % ire Security Procedure EXAC-15 l

...