ML20091S087
| ML20091S087 | |
| Person / Time | |
|---|---|
| Site: | Crystal River  |
| Issue date: | 01/31/1992 |
| From: | Meyer O EG&G IDAHO, INC., IDAHO NATIONAL ENGINEERING & ENVIRONMENTAL LABORATORY |
| To: | NRC |
| Shared Package | |
| ML20091S077 | List: |
| References | |
| EGG-HFRU-10085, NUDOCS 9202060222 | |
| Download: ML20091S087 (37) | |
Text
- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
i EGG liFRU 10085 TRIP REPORT:
ONSITE ANALYSIS OF T11E HUMAN FACTORS OF AN EVENT AT CRYSTAL RIVER UNIT 3 DECEMBER 8,1991 (PRESSURIZER SPRAY VALVE FAILURE)
Orville Meyer Onsite Analysis Team:
' John Kauffman, NRC/AEOD Dr. Harold Ornstein, NRC/AEOD Orville Meyer, INEL ,
' Team Leader Published January 1992 Idaho National Engineering Laboratory EG&G Idaho, Inc.
Idaho Falls, ID 83415 Prepared for the Office for Analysis and Evaluation of Operational Data U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Under DOE Contract No. DE-AC07-761D01570 9202060222 920130 2 ADOCK O
gDR
_ .._ _ _ _ - ._ . _ _~ ._ __ . _ _ _ _ _. . - _ _ - .. _
EXECUTIVE
SUMMARY
The Office for Analysis and Evaluation of Operational Data (AEOD) of the U.S.
Nuclear Regulatory Commission has a program to study human performance during operating events. As part of this program, AEOD formed a team to conduct an onsite analysis of an event at the Crystal River 3 nuclear generating station during the midnight to 8:00 a.m. shift on December 8,1991. The plant was starting up after a short maintenance outage and was at about 10 percent power preparing to roll the main turbine when a slow loss of reactor coolant system pressure transient became apparent to the operators. The actuator for the pressurizer epray line control valve RCV-14 failed, which left the valve partly open but position indicating lights showed that the valve was closed. The reactor tripped on low pressure, and an operator bypassed engineered safeguards (ES) actuation as the pressure continued to decrease. ES was unbypassed after about si~ minutes and an automatic initiation of ES (including high pressure injection system) immediately occurred with RCS pressure at approximately 1550 psig.
The operators established manual control of the high pressure injection system to maintain reactor coolant system pressure above 1500 psig. The cause of the loss of reactor coolant system pressure remained unknown to the operators until the spray line isolation (block) valve was closed. His stopped the pressurizer spray flow and permitted the pressurizer heaters to reestablish control of pressure, it is noted that the operator further withdrew control rods after the RCS pressure decrease began in an effort to i comrol pressure.
i This human performance study focused on the actions of control room operators during the loss of pressure transient. The study was based on data from plant logs, the station's event investigation report, and interviews with control room operators and other station staff. The station training staff also reproduced the event on the plant specific simulator for observation by the onsite analysis team. -
1 With the pressurizer spray control valve RCV-14 open, but indicating closed, the operators saw a decreasing pressure with no detectable abnormalities in the controls for the pressurizer. It was suspected that the reactor coolant system was being cooled, which lii
1 would shrink the coolant and lower pressurizer level and pressure. The strip chart recorders showed slightly increasing pressurizer level and slightly decreasing reactor coolant system temperature, and there was a report that steam flow to the deaerating
~
feed tank had been initiated. Reactor power was increased and the steam flow to the deaerator was secured. These actions did not diminish the rate of decrease of pressure.
The initial investigation by the operators of the cause of the pressure decrease was guided mainly by their recall of procedures and plant behavior, not by referring to a specific procedure. Passible causes that were investigated and rejected included a leaking pressurizer relief valve, a loss of coolant into containment, an interfacing system loss of coolai t outside of containment, and faulty operation of the pressurizer heaters.
The control switch for RCV-14 was cycled shut, but subsequent, continued flow through RCV-14, whici; could create a pressure reducing spray into the pressurizer, was not suspected.
The pressure reduction continued, initiated a reactor trip at 1800 psig (18 minutes after the pressure reduction started) and continued downward toward the 1500 psig trip point for auto.natic ES initiation. The ES were bypassed at 1650 psig to prevent initiation in the expectation that the pressure decrease would be brought under control.
The bypass was removed six minutes later when the pressure was 1550 psig and the ES initiated high pressure injection system flow into the reactor coolant system. The pressure reduction was reversed by the high pressure injection system flow. The operators took manual control of the high pressure injection system and maintained pressure between 1500 and 1650 psig for 23 minutes while the condition of the plant was evaluated. Since a decrease in pressure to less than 1500 psig would place the reactor in a state of inadequate subcooling margin, the control room supervisor decided to increase the pressure to 1750 psig by compressing the steam bubble in the pressurizer. This was accomplished by controlled injection from the high pressure injection system, which raised the pressurizer level to above the indicated level range but did not approach filling the pressurizer solid.
iv
1 W
' Shortly after this evolution the pressurizer spray line isolation valve RCV.13 was closed to try to correct the pressure decrease. This stopped the spray flow into the pressurizer and removed the cause of the decreasing pressure transient.
The following is a summary of the results of the analysis of the human factors in this event.
lign-Machine Interface .
l The event was initiated by a failure of the actuator for the pressurizer spray flow control valve RCV-14, which left the valve partly open but with position indicator lights that showed the valve fully closed. The resulting spray flow caused a decreasing reactor coolant system pressure transient that appeared to have no directly discernible cause.
Duty Hours The failure of RCV-14 occurred near 3 a.m., when human performance tends to be at its' lowest level.
Procedures and Trainine The procedure that was directly applicable to the decreasing reactor coolant -
system pressure was the annunciator response proceJure. However, the annunciator response procedure for low reactor coolant system pressure was oriented toward control circuit failures, which left RCV-14 indicating open. The abnormal response procedure for engineered safeguards /high pressure injection system actuation had directions for closing the spray line isolation valve RCV-13 to correct a low reactor coolant system pressure condition, but these directions were in a later section of the procedure that was not used because the operator exited the abnormal procedure when ES termination criteria were met.
V l
e
,e Although the alarm response procedure would have been of minimal help, it was not referred to by the operators. Checking all sections of the abnormal response procedure once it was entered and with the loss of reactor coolant system pressure control problem still existing would have provided the crew with the direction to close the RCV 13.
During this event, na operator bypassed ES, while a plant depressurization was in progress and not diagnosed or understood. While guidance existed for ES termination, similar guidance did not exist for ES bypass prior to actuation. The development of similar guidance was planned by the licensee to clarify appropriate and expected operator actions in similar situations. The team noted that such guidance would likely reduce any operator confusion and eliminate the need for a rapid, knowledge-based decision regarding ES bypass to be made in a stressful situation.
Knowledge Versus Rules The operators' recall of the content of procedures and of plant behavior was relied upon to a large extent because of a lack of rules and procedure weaknesses a discussed above. The effectiveness of this knowledge was limited by (a) the limited time for knowledge based decision making, (b) misleading data on spray valve position indication, (c) the stress occasioned by (a) and (b), and, (d) the time of day. These may have been factors leading to the inappropriate bypassing of the ES actuation, the securing of high pressure injection system injection flow before the reactor coolant system pressure had risen well above the 1500 psig minimum for the subcooling margin requirements, and for ceasing the verification and checking of the later sections of the abnormal procedure which contained the direction to close RCV-13.
Teamwork (Command. Control. Communications)
Closer adherence to the general principles for command, control, and communications would have been helpful during this event, especially in view of the vi
4 r, . --
stress occasioned by the event and the time of day. Deviations from these general principles were of particular note in the bypassing of the ES, which occurred without the -
prior concurrence of the control room supervisor and continued for six minutes without being questioned by the control room supervisor. The station's administrative instructions containe(' minimal restrictions on use of the ES bypasses during transients. ,
-This is especially applicable to the engineered safeguards /high pressure injection system ,
bypass since it is used during normal plant cooldowns.
Role of Oiher Control Room Personnel The shift technical advisor was present in the control room throughout this event and participated in the attempts to determine the cause of the decreasing reactor coolant system pressure. lie did not question the bypassing of the ES. The team noted that the involvement of" management on shift" for the reactor startup contributed positively to the event progression. " Management on shift" noted that ES was bypassed and recommended that the pressurizer spray block valve be closed.
Selected Licensee Corrective Actions Shortly after the first review of the event, the plant management was considering actions to reduce the reliance on knowledge based behavior during this type of event.
These actions were to (a) provide a diagnostic procedure for response to a loss of control of RCS pressure, (b) provide a clearer statement in policies and procedures defining the restrictions on overriding ES actuations or other safety system actuations, and (c) review and supplement existing training for this type of event.
l Vii
, ., , , . - --, .- c,.. -~.-- ..n......- a n. , n. a.u.. ..+n.,+ ~ , + . ..x..a.n, .-a.x-,n,~ ..--
..~..-7...n-.....
f ?
7 1 ,"
e 44 ,6 f.
T l -
l it: ')
I i
l IJ t
I I
I.
?
- i l.
I.
I 1
I-.
!~
l.
i h
k f.
i VI!!
.# -. 4 't g ACKNOW1.EDOMENTS We express appreciation to the Crystal River Unit 3 staff for their cooperation in providing the information necessary to analyze the huinan performance during the operating event. We particularly thank the operators who were on duty during the event
,. for their cooperation during the interviews.
1 ix
.,+.9- .-.
-r+... ann - a va- wm sn axa. m -- a a=- .sans. s .4 n .as.s---. n a - a.~ ~ - . n.~> .-.~.,u--.. > s- a .o+ ., u. --.a. ~1.s.s- .-w.- a +.na-
'4o
- 4 e
P f
g r
h r
4 h
4 l
i I
l 1
l 1
e i
X- 1 M -
& w T g =,a.mug e n--(= w--a e n'- p *.9=-g- sy:9 w- 9 M aimp-q 11-w t er
.p.,=.
CONTENTS EXECUTIVE S U M M AR Y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii ACKNOWLEDGMENTS . . . . . . . . . ...... .. ....................... ix ACRONYMS . . . . . . . . . . . . . . . . . .................................. xiii
- 1. I NTR O D U CTI O N . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I 1.1 Purpose ................................................. 1 1.2 S c o p e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I 1.3 Onsit e Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
- 2. DESCR!fTION OF THE EVENT ANALYSIS . . . . . . . . . . . . . . . .......... 3 )
2.1 B a ck g r o u n d . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 -
2.2 Tirne Line of the Event . . . . .. ............... ............ 8 2.3 A n alys is . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ....... 15 2.3.1 Introduction . . . . . . . . ................ ........ .... 15 2.3.2 Man Machine Interface ..... ........................ 15 2.3.3 Duty Hours ...................................... 16 2.3.4 Procedures and Training . . . . . . . . . . . . . . . . . . . . . . . ...... 17 2.3.5 Knowledge Ve rus Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2.3.6 Teamwork (Command, Control, and Communications) . . . . , , . 23 2.3.7 Role of Other Control Room Personnel . . . . . . . . . . . . . . . . . 25
- 3.
SUMMARY
OF TliE HUMAN FACTORS IN THIS EVENT . . . . . . . . . . . . . 27 3.1- Man Machine Interface . . . . ................................ 27 3.2 D u ty H o u rs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
- 3.3 Procedures and Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 3.4 Knowledge Versus Rule s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 3.5 Teamwork (Command, Control, Communications) . . . . . . . . . . . . . . . . . 28 l
3.6 Role of Other Control Room Personnel . . . . . . . . . . . . . . . . . . . . . . . 28.
L 29 3.7 ' Selected Licensee Corrective Actions . . . . . . . . . . . . . . . . . . . . . . . . . . .
FIGURES Figure 1. Crystal River 3 control room crew ........................... 4 Figure 2. RCS pressure ... .......... ....... . . .............. 7 X1
_. - . , . . ~ _ _ , . , - - _ ,_ , , _ .
_ _ _ , _ _ _ _ - . - - - - - - - - ~-"-
t 5 4* g M
59 X11
.; - 4 .
l ACRONYMS l AEOD Office for Analysis and Evaluation of Operational Data ANSS - assistant nuclear shift supenisor AO -auxiliary operator
~
-AOS acting operations superintendent AP - abnormal procedure AR annunciator response CNO chief nuclear operator EFW emergency feedwater EOP emergency operating procedure
- ES engineered safeguards
-IIPI high pressure injection HPIS .high pressure injection system LPI low pressure injection MUV makeup valve MW(e) megawatt (electric)
NO nuclear operator NRC Nuclear Regulatory Commission RCS reactor coolant system SCM subcooling margin SOTA shift operations technical assistant-SPDS. safety parameter display system SS shift supervisor Tave average RCS temperature TBV turbine bypass valve i
l xiii
L. __
- 1. INTRODUCTION 1.1 Purpose The Office for Analysis and Evaluation of Operational Data (AEOD) of the U.S.
Nuclear Regulatory Commission has a program to study human performance during operating events, As part of this program, AEOD formed a team to conduct an onsite analysis of an event at the Crystal River 3 nuclear generating station during the midnight to 8:00 a.m. shift on December 8,1991. The plant was starting up after a short maintenance outage and was at about 10 percent power preparing to roll the main turbine when a slow loss of reactor coolant system pressure transient became apparent to the operators. The actuator for the pressurizer spray line control valve RCV-14 failed, which left the valve partly open but indicating closed. The reactor tripped on low pressure, and an operator bypassed engineered safeguards (ES) actuation as the pressure continued to decrease. ES was unbypassed after about six minutes and an automatic initiation cf ES (including high pressure injection system) immediately occurred with RCS pressure at approximately 1550 psig. The operators established manual control of the high pressure injection system to maintain reactor coolant system pressure above 1500 psig. The cause of the loss of reactor coolant system pressure remained unknown to the operators until the spray line isolation (block) valve was closed. This stopped the pressurizer spray flow and permitted the pressurizer heaters to reestablish control of pressure.
1.2 Scone The human performance study focused on the actions of control room operators during the loss of pressure transient. The study was based on data from plant lo;s, the station's event investigation report, and interviews with control room operators and other
. station staff. The station training staff also reproduced the event on the plant-specific simulator for observation by the onsite analysis team. The Idaho National Engineering 12boratory provided technical assistance for this study.
1
~. _ _ _
1.3 Onsite Analysis The onsite analysis team was at the Crystal River 3 site on December 10 12, 1991, and comprised the following members:
. John Kauffman, NRC/AEOD (team leader)
. Dr. liarold Ornstein, NRC/AEOD
. Orville Meyer,INEL/EG&G Idaho.
2
- 2. DESCRil' TION OF Tile EVENT ANALYSIS
2.1 Background
The Crystal River 3 nuclear generating station is located near the city of Crystal River on the Gulf Coast of Central Florida and is owned and operated by the Florida Power Corporation. It is a single unit station with a Babcock & Wilcox pressurized water reactor rated at 2544 MW thermal,825 MWe. The station began commercial operation on March 13, 1977. A reactor trip had occurred on December 3,1991, because of nuclear instrumentation problems, and early in the morning of December 8 the plant was being returned to power operations. The reactor was brought to criticality at 12:50 a.m. by the midnight to 8:00 a.m. shift of control room operators. Tl e reactor was at 11 to 14 percent power and was being brought to 15 percent power in prqaration for startup of the main turbine generator when a decreasing RCS pressure transient became apparent at 2:53 a.m.
Figure 1 illustrates the organizational structure of the control room crew. The shift supervisor _ (SS) is in charge of all plant activities during the shift, including maintenance. The SS was present in the control room during this event because he was overseeing the plant startup. The assistant nuclear shift supervisor (ANSS) was in direct command and controi of control room activities, and his desk is centrally located within the control room. The chief nuclear operator's (CNO's) principal duty normally is the direction of activities of the auxiliary operators (AOs) within the plant external to the control room. The CNO was present in the control room and assisting in control of the balance of plant systems during the operation of placing the main turbine generator on1.ine. The nuclear operators (Nos 1 and 2) normally share all the panel operations duties in the control room. On this shift, during this startup, NO 2 was manipulating the reactor control rods to control reactor power and temperature. He was slowly increasing reactor power from 10 to 15 percent when the decreasing RCS pressure transient became evident. NO 1 was at the main turbine controls and preparing to roll the main turbine.
3
-Acting Operations Superintendent Shift Supervisor i
Assistant Nuclear Shift Operations Shift Supervisor Technical Assistant Chief Nuclear Operator Nuclear Operator 1 Nuclear Operator 2 Note: 1. The acting operations superintendent, the shift supervisor, and the -
ANSS hold senior reactor operator licenses. The chief nuclear operator and the nuclear operators hold reactor operator licenses.
- 2. The acting operations superintendent was present as a management-observer and technical advisor.
1 Figure 1. Crystal River 3 control room crew.
4
.t '. 4g' a Shift operations technical assistants (SOTAs) are assigned 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> duty shifts at the ;
plant. : During this 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period, they may be anywhere in the plant and are assigned a small apartment on site but are required to be in the control room within 10 minutes after being called. When this event began, the SOTA was in the control room to provide technical assistance during the plant startup.
The acting operations superintendent (AOS) was also in the control room to observe and provide technical assistance during the plant startup. The individual serving as the AOS was an SS and was acting for the operations superintendent, who was temporarily offsite. The AOS remained in the rear of the ccatrol room in communication with the SS and the ANSS during this event.
The pressur' er spray line control valve, RCV-14, had not been opened during this startup prior to this event since the normal procedure for heating up the pressurizer and drawing a steam bubble would not require pressure reduction by pressurizer spray. At 2:51 a.m., NO 2 used the control rods to bump" reactor power up by 3 percent, from 11 to 14 percent. This power transient caused a small increase in RCS pressure,=which was sufficient to cause the automatic control circuitry for the pressurizer to open RCV-14 to an indeterminant position but the closed position indicator light remained illuminated.
When the pressurizer spray had reduced the RCS pressure, the control circuitry caused the valve actuator to move toward the closed position but the valve dise did not seat.
(Normally, a key and keyway prevent the valve shaft from rotating such that the worm geari ng can transl ate but not rotate the shaft. The key was missing from the RCV 14 valve actuator. Since the shaft could rotate as well as translate the constant relation between the valve disc position and the actuator position indicator had been lost.
Therefore, RCV-14 remained open an indeterminant amount.)
Since there was no direct indication of tiow in the pressurizer spray line, NOs 1 and 2 saw a decreasing RCS pressure with no detectable abnormalities in the controls for the pressurizer since RCV-14 indicated closed and pressurizer heaters were on.
Operator NO 1 suspected that the RCS was in a cooling transient, which would cause the RCS coolant to shrink and lower pressurizer level and pressure. The strip chart 5
l recorders showed slightly it masing pressurirer level and slightly decreasing 1(CS ;
temperature, cut the hypott.: e af NO 1 seemed to be supported by a report from an i AO that significant steam Cow to the deacrating feed tank from the steam generators had been initiated. NO 1 advised NO 2 to bump reactor power up to correct the !
overcooling and directed the AO to secure the steam flow to t! deacrator, These actions sild not diminish the rate of decrease of RCS pressure. ,
l The ANSS and the SS were notified by the NOs that the RCS pressure was decreasing, and they, the SOTA, and the CNO joined the search for a cause. The investigation by the operators was guided tnalnly by their recall of procedures and plant behavior, not t>y referring to a specific procedure. Possible causes that were investigated and rejected included a leaking pressurizer relief valve, a loss of coolant into containment, an interfacing system loss of coolant outside of containment, and faulty operation of the pressurizer heaters. The control switch for RCV 14 was cycleo shut but continued gross leakage or flow through RC%14, which could create a pressure reducing spray into the pressurizer, was not suspected.
The RCS pressure I: duction continued, initiated a reactor trip at 1800 psig (18 minutes after the pressure reduction started) and continued downward toward the 1500 psig (minimum) trip point for automatic engineered safegu;rds (ES) initiation (see Figure 2). The ES was bypassed by an NO at 1650 ps!g to prevent ES initiation in the apectation that the RCS pressure decrease would be brought under control. The ES bypass was removed 6 mitiutes later when the RCS pressure was 1550 psig, und the ES initiated HP!S flow into the RCS. The RCS pressure reduction was reversed by the ilPIS flow. The operators took manual control of the HPIS and maintained RCS pressure between 1500 and 1650 psig for 23 minutes while the ANSS, the SOTA. the SS, and the AOS evaluated the condition of the plant. Since a decrease in RCS pressure to less than 1500 psig would place the reactor in a state of inadequate subcooling margin, the ANSS decided to increase the RCS pressure to 1750 psig by compressing the steam bubble in the pressurizer. This was accomplished by controlled injection to the RCS from the HplS, which raised the pressurizer level to above the indicated level range but did not approach filling the pressurizer solid.
6
l)l, ,l illll ' ll]j I! l ,!Il l' l1lIIl11 I 1 1
. ~ -
.=
tt .
uu .
hh .
ss .
6 413 .
- 21 .
3 -
5V V- .
- UC .
3MR -
.=.
. e
- e. A .
I.
s . _
s s
e z
- 54d n
6 l 1. g
= _
O . _
a:2e - . 4 _
n2 - n .
c4Te a: C p .
x 3No .
s e .
t .
v.
s .
a n v . ee v
a .
s s
t . e s
d c e
t e e . a s6 t .
s 7 y11 a . n s
e1 :v:Pi .
r e
m30%1/i u
t 9
9Ht
<3Ei
- Sn 1j' ,
k3l Q < i'I
=
s a
T u
s .
t s
- w. .
e . =
r .
c . s a0 r t0 u: ewp s V .
1 om 5pu .
- b .
21 .
3
- . =
-- . s
, ~ --. ---- - : : .w = ; $- - --- = /e
n
Y~
~ e *
= e.
- a. . s. .
K s . e * = /**
.E WgI, 84* N Mm v,q
,o*
- aj l i1 1i4 j{
- I : 2
- a ,
.. l Shortly after this evolution, pressurint spray line isolation (block) valve RCV 13 was closed at the suggestion of the AOS (the AOS did not specifically suspect that RCV.
14 was passing flow, but he thought closing RCV 13 might be of some help). This ,
stopped the spray flow into the pressurizer. The closure was seen to have removed the cause of the decreasing RCS pressure transient, i
.iL2 Tin s_1Jne of the Event To establish this time line, the onsite analysis team interviewed all control room personnel shown on Figure 1. Copies of control room strip chart recordings, the control room logs, and the annenclator printout were also provided by the station. The working copy of the reactor trip review and analysis by the station staff and a draft of the unusual operating event report by Babcock & Wilcox Nuclear Serdces was made available.- In ;
addition, the training staff retrieved the event data from the plant computer and plotted it (Figure 2 was one such plot). " Se training staff also reproduced the event for review by the analysis team on the plant specific simulator with high fidelity after correcting the time of operation of the pressurizer heaters. The following sequence of events was established:
12:39:00 a.m. Commenced reactor startup.
'l:
1:03:00 Reactor criti'.al.
2:07:00 .
Entered Mode 1 operations, power above 1 percent.
Warmed up steam lines, established main condenser vacuum, and began dumping steam to the main condenser through the turbine bypass valves (TBVs),
i-8
', 'a
?
2:47 . Reactor power was increased from 11 to 12 percent with the objective of slowly increasing power to 15 percent in preparation >
for rolling the tutbine generator and bringing it online. NO 2 was controlling reactor power and temperature, and NO 1 was preparing to roll the turbine generator.
F 2:49 . Iteactor pressure increased slightly in response to the above small power increase but then began to decrease slowly. Pressurizer spray control valve llCV 14 continued to indicate closed (the green, closed indicating light remained illuminated while the r
yellow,40 percent open and the red, full.open lights were dark).
. NO 2 reported that the itCS pressure was decreasing. NO I and others suspected that the reactor was being cooled because reactor power was less than the neam load, and NO 1 suggested to NO 2 that reactor power be bumped" upward.
2:51 . NO 2 bumped reactor power by 3 percent, from 11 to 14 percent.
by incremental control rod withdrawal.
2:51:47 . RCS pressure increased to 2223 psig and then hegan to decrease.
Tave was 367.3* F and pressurher level was 176 in.
2:52:32 . RCS pressure was 2150 psig and decreasing, Tave was 568.5* F, and pressurizer level was 190 in. NO 2 was monitoring these parameters on the strip chart recorders on the panels. 'these recorders have 4 in, scales and cannot be read precisely.
Ilowever, the trend of the parameters was readable. NO 1 was monitoting RCS pressure on the digital indication available on the safety parameter display system (SPDS), which hv hetter resolution.
- - _ _ _ , - --,,,--- ~ . -.-_,. -
2:53:25 . RCS low pressure alarm annunciated.
. The control room operators (NO 1, the CNO, the ANSS, the SS, and the SOTA) began a concerted search for the cause of the decreasing RCS pressure transient. The steam flow to the deaerating feed tank v as stopped on the premise that a cooldown of the RCS was takhtg place, although Tave was only slightly decreasing and pressurizer level was slightly increasing. Indicators that might show that a loss of RCS coolant was occurring were checked. Pressurizer relief valve leakage indications, containment sump levels and radiation monitors, and turbine building radiation monitors did not indicate any symptoms of a loss of RCS coolant.
The steam generator water levels and fecdwater rates were normal and stable. The ANSS suspected that the insurges to the ,
pressurizer caused by reactor power bumps were cooling the water in the pressurizer and decreasing the pressurizer temperature and pressure (this was an incorrect hypothesis). The
, manual control switch for the pressurizer spray control valve RCV 14 was cycled to the closed position to ensure it was closed although the green, closed position indicating light was already illuminated.
2:54:59 . RCS pressure was 2050 psig and decreasing, and NO 2 again bumped reactor power 3 percent, from 12 to 15 percent.
3:00:29 . RCS pressure was 1980 psig and decreasing. NO 2 bumped reactor power from 13.5 to 15 percent. .
3:09:17 . Reactor automatically tripped on RCS low pressure (1800 psig).
. Reactor trip procedure AP 580 entered.
10
3:09:58 . 1;)w pressurizer level alarm annunciated.
. Immediate actions for reactor trip procedure AP 580 were being executed, with the ANSS reading the procedure aloud and NOs 1 and 2 verifying the actions.
3:11:37 . ES A and 11 Not flypassed alarms annunciated. (These alarms annunciate at 1640 psig and a relay trips after a 10-second delay, which permits the operator to bypass the automatic ES initiation signal, which initiates the llPIS. The purpose of the alarms and the ES A and B bypass switches is to block the initiation of the llP!" injection during a normal plant couldown. Ilowever, ES initiation of IIPIS aise initiates partial containment isolation, emergency feedwater operation, and starting of the emergency diesel generators. The E5 initiation trip setpoint is 1500 psig minimum.)
3:12:49 . NO 1 switched the ES bypass switches for the A and 13 IIPIS to the bypass posit!on. ES A and 11 Not Bypassed ala:ms cleared.
(The ES automatic actuation system remained operable for llPIS initiation from a low low RCS pressure trip at 500 psig or a high containment pressure trip at 4 psig.)
. NO 1 announced that the ES was bypassed. Shift supervision did not acknowledge bypass of ES.
~
3:19 . The AOS asked the ANSS and the SS if they concurred with the bypassing of the ES. (The AOS had been observing but not directing the control room operations.) Tne AOS questioned the advisability of bypassing the ES.
. The ANSS directed NO 1 to take the ES out of bypass.
11
3:191M . The ES initiation histables tripped. Indicated RCS pressure was 1553 psig on Channel A.1574 psig on Channel 11.
3:19:16 . NO 1 removed the bypasses from the ES and the llPIS initiated automatically.
. The signal that initiated high pressure injection (llPI) also initiated the emergency feedwater (EFW) system as designed.
The diesel generators started but did not connect to the busses since the busses were energized.
. Operators entered the ES actuation procedure AP 380.
3:19:58 . NO 1 bypassed ES as per procedure AP 380, which permits the llPI flow to be manually controlled after it has been automatically initiated.
3:20:37 . The EFW system was secured because the main feedwater system was operating normally.
3:21:44 . RCS pressure increased to approximately 1600 psig because of flow from the IIPIS into the RCS.
. NO 1 elosed valves MUV 23, .24, 25, and 2d, which stopped flow from the HPIS into the RCS 11P1 pumps 3A and 3C were secured, and HPl pump 3B was left running.
3:24:25- . RCS pressure increase reset the 1500 psig histables for 3:27:32 automatic ES initiation. NO 1 reset the automa:ic initiation circuit.
12
3:35:!" . ItCS pressure began to decrease again and decreased sutheiently to trip one 15(X) psig IIS bistable, itCS pressure was indicated as 1551 psig on Channel A,1575 psig Channel 11.
3:35:28 . No 1 bypassed the automatic liS initiation.
3:35:29 + A second 1500 psig histable tripped, which would have automatically initiated !!S if the liS were not bypassed.
3:35:29- . ItCS pressure continued to slowly decrease. IRCS 3:42 temperature had decreased from 575' F before the reactor trip to 550' F after reactor trip and had decreased to 544* F because of the short period of IIPl at 3:19:16 but was now increasing slowly.
. The control room operators were closely observing the subcooling margin (SChi) indication, liS actuation procedure AP 380 specifies a minimum SChi of 30 F if the itCS pressure is above 1500' F but a margin of 50* F if the itCS pressure is less than 1500 psig if adequate Scht is lost, AP.380 requires that the reactor coolant pumps be tripped and the steam generator levels be raised to 95 percent to establish natural circulation cooling.
The Scht was observed at 51" F and decreasing because of th .
slowly increasing ItCS temperature and decreasing itCS pressure.
. The ANSS decided to prevent the itCS pressure from decreasing '
below 1500 psig by establishing a centrolled llPI flow to the itCS, which would increase the level of water in the piessuri7er and compress the steam bubble, thereby increasing the pressure. The ANSS directed NO 1 to slowly open makeup valve htUV 24 and to stand by for an order to reclose hiUV.24. IIPI pump 311 was still operating.
13
3:42:56 . No 1 opened MUV 24, admitting flow from IIPI pump 311 to the RCS.
. RCS pressure began to increase immediately but slowly.
(Post event review revealed that minimum RCS pressure was 1503 psig and minimum SCM was 42' F.)
3:45:07 . Pressurizer high high level alarm annunciated. RCS pressure was 1550 psig.
i 3:53:46 . ANSS directed NO 1 to close MUV 24. RCS pressure was 1675 psig and pressurirer level indication was at the top of the t,cale.
3:54 . Pressurizer spray line isolation valve RCV 13 in series with RCW 14 was closed at the suggestion of the AOS. (The AOS did not yet suspect that there was flow through RCV 14. Ilowever, he-noticed that the pressure and pressurizer vapor space temperature had started to decrease again after MUV 24 was closed. Ile believed that closing RCV-13 might be helpful and he may have recalled the rule that closing RCV 13 was one response to a low RCS pressure condition.)
. RCS pressure began to increase rapidly because of cessation of spray Gow and the continued operation of the pressurizer heaters.
4:02 . Operators stabilize RCS pressure at approximately 1750 psig by manual control of the pressurizer heaters.
4:55
- The SS made an emergency action level determination of an unusual event.
14
5:00 . 1he state was notified of the event.
h06 . 'lhe SS declared that the event had been esited.
5:32 . The NitC was notified of the event.
2.3 Analvsh 2).1 IntroductioD Two factors were significant in establishing the context for this event and the shallenges presented to the operators. 'lhey are the man machine interface and the duty hours for the operators, ar.d they are analyzed first below. Other factors analyzed were operating procedures and training, the use and reliability of knowledge versus operating procedures to the operator, command and control of control room operations, and the rok of other control room personnel.
M.2 Man MachinejntcJhg This event was initiated and complicated by a failure of the actuator for valve itCW14 which left the valve partly open but with position indicator lights that showed 1(C%14 fully closed. The possibility of this failure was created by the position indicator for the valve being driven by the rotary gearing in the actuator rather than by the translation of the stem. However, other mechanisms exist for a single failure causing a control valve to indicate closed but still be leaking excessively, such as a foreign object in the seat of the valve or a mechanical failure of the valve itself. The existence of significant spray now te the pressurizer when the closed position indicator light for RC%
14 was lit and the 40 percent open and the full open lights were not lit created a cognitive trap for the operators. Incorrect conclusions were derived from rational deductioru based upon apparently valid, but actually invalid, indications. A spray line 15
i flow meter would provide flow data independent of any failures in RCV-14 or its ,
actuator or contro!s.
The existence of a spray line flow indicMion would have likely made it clear that ,
RCV 14 was passing How and that the appropriate corrective action was to close ,
RCV 13, the isolation valve in series witn RCV 14. Without a spray line now indication, the existence of spray Cow would need to be established by a process of elimination, and the symptoms for spray flow and for a small steam leak from the pressurizer may be similar. Ilowever, if either a steam leak or a leaking spray valve RCV 14 were both possible causes, the appropriate action would have been to close RCV 13. The annunciator response prscedure AR 502 suggests this and the use of procedures is analyzed below in Sectio /. 2.3.4 One of the possible causes of a decreasing trend in RCS pressure is a decreasing trend in RCS coolant temperature. -This was an early hypothesis by NO 1, although review of the data recordings after the event established that the indicated RCS temperatures were only decreasing slightly and that pressurizer level was increasing slightly. (Pressurizer level is directly proportional to the mass averaged temperature of .
the RCS coolant and responds within the response time of the pressurizer level sensor.)
A contributing factor could have been the less than ideal readability of trends on the ,
Tave strip chart recorder. The recorder has a four inch scale and orly 15 minutes of elapsed time is visible liowever, interviews with operator NO 1 indicated that the hypothesis of significant cooling of the RCS originated before evaluating the strip charts -
and persisted for some time despite the information to the contrary on the strip charts.
233 Duty Hours The significant actions during this event took place between 3:00 and 4:00 a.m.,
when human performance capabilities tend to be at the low point of the daily cycle.
This effect of the daily rhythm is more evident for the cognitive capabilities than for skill-or rule based activities. Individuals who are assigned for long terms to the night shifts 16
.x _ . _ - - _ , . _ . , _ _ _ ~ . _ _ _ _ _ . . . . _ . . _ _ _ _._ _ _ _ _ _. _
are not free of this effect, probably because they cannot be free from the effects of daylight and off-duty activities.
2.3.4 Procedures and Training This event can be divided into three stages for the purpose of analyzing the effectiveness of operating procedures in supporting operator performance. The first stage is the time after a loss of control of RCS pressure became apparent and before the reactor tripped. The second stage began at the time the reactor tripped and continued until the ES/IIPIS bistables tripped. The third stage began with the ES/IIPIS bistable trip and continued until RCV 13 was closed to correct the loss of pressure control.
The RCS low pressure alarm annunciated early in the first stage of this event at a decreasing pressure of 2055 psig at 2:53 a.m. This alarm is an indicated condition for application of the RCS Press 1.nw section of annunciator response procedure AR 502.
The following is stated in this section for operator action for a vah alarm:
- a. Manually control pressurizer heaters, spray valve and/or relief valve isolation valve if auto circuitry fault,
- b. Notify maintenance to check faulty circuitry.
The operators stated that the control room copy of this procedure was not pulled from the file during this event. The statement of operator action in AR 502 is clearly intended to be applicable for response to control circuit faults such as a pressurizer spray valve indicated open. In this event, RCV 14 was indicating fully closed.
The ES actuation procedure AP 380 contained procedural direction applicable to the condition of decreasing RCS pressure. Section 3.14 under " Actions" states " isolate possible sources of low RCS PRESS" and among the details for this action lists close RCV 13, PZR spray block valve." The entry conditions for AP 380 are RCS pressure less than 1500 psig or manual ES actuation, and this procedure was not entered before ES 17
A 4 g 4 %
actuation. Section 3.14 of AP 380 is preceded by Section 3.6, dealing with low pressure ,
injection (LPI) actuation, and since the decreasing RCS pressure never tipproached the -
500 psig LPI actuation pressure, the op:rators did not execute Section 3.14.
ES actuation procedure AP 380 and the reactor trip procedure AP 580 are titled
" Abnormal Procedures" at the Crystal River 3 station. However, these procedures fall I
within the NRC classification of " emergency operating procedures" (EOPs) and would have that title at many other nuclear generating stations. Whenever an EOF is antered it is a good practice to continue to check all sections of the EOP until the plant is ;
stabilized and the cause of the upset is corrected. If this practice had been followed,it is likely that checking Section 3.14 would have resulted in the operators clos,ing RCV 13. It ;
was noted by the team that administrative instruction Al 400E," Conduct of Operations,"
does not contain a caution against exiting an abnormal or emergency procedure before checking the remaining sections of the procedure.
An annunciator response or abnormal operating procedure for low RCS pressure, which has diagnostics and actions similar to Section 3.14 of AP 380, could have resulted in closure of RCV 13 much earlier in this event. Eucuting or checking of all sections of AP 380 could have resulted in closure of RCV 13 after entry into AP 380 and before the decision was made to compress the bubble in the p essurizer.
Bypassing ES/HPI as the RCS presrure decreased below 1650 psig was not appropriate and not in accordance with procedures. Bypassing ES is specified in the plant shutdown procedures, but the control room operatois were clearly not intending to perform a_ controlled cooldown and to depressurize the plant and were not in a shutdown operating procedure. NO 1 used rational reasons for his action of bypassing ES/liplS, and this action is analyzed further in Section 2.3.5 " Knowledge Versus Rules," of this -
report.
The control room supervision directed the removal of the ES oypass before it had any significant effect upon the thermal hydraulle bel.avior of the plant during this event.
18 -
-<> .- . , , - -- , n.n,-,,- ---c- .- ,- -n -
. s '
The applicable procedure for this event, AP-380, was entered and executed through IIPIS safety injection termination, except that the execution did not include Section 3.14 as discussed above.
Execution of AP 380 included bypassing of IIPI actuation and balancing of IIPI flows (Section 3.5) and stopping ilPI when the required Schi conditions exist as specifico in AP-380. Ilowever, llPI flow was stopped when RCS pressure had only increased to 1600 psig and the RCS pressure was then again decreasing toward 1500 psig where adequate SChi would be lost. The llPI flow was stopped because of the operators' concerns about overfilling the pressurizer and lifting the safety valve or power operated relief valve, Stopping IIPI flow at 1600 psig was quite conservative with respect to preventing a lift of relief or safety valves but was not conservative with respect to maintaining an adequate SChi. AP 380 fulfilled the fundamental purpose of maintaining adequate core cooling as indica::d by an adequate SCM indication but the minimum RCS pressure experienced of 1503 psig was very close to the 1500 psig limit.
AP 380 does not contain any direction either as to avoiding a relief or safety valve lift or as to favoring an adequate SChi at the expense of a relief or safety valve lift. Therefore, this event implies a question as to the possible interpretation of the relative priorities an operator might assign to the two undesirable consequences in a future event.
In reviewing AP 380,it was noted that RCS pressure less than 1500 psig is an entry condition, but automatic ES actuation is not. Since the ES bistables are conservatively set slightly above 1500 psig, this event resulted in automatic ES actuation with the RCS pressure never having decreased to 1500 psig. The operators followed the intent, not the letter, of the entry conditions.
The determination and declaration of the emergency action :evel of this event by the SS and his notification of the NRC were both late. The SS was relying on his knowledge of the requirements for timely notification rather than checking the procedures, which again is knowledge based rathet than rule based behavior. The EOPs for response to the initiation of ES at many plants contain a reference to the emergency 19 l
~.. _ . _ _. . _ . - _ _ _ _
<o ,.
response plan end its requirement for emergency action level determinction and notifications. This initiates action outside the plant if needed to protect the public while the operators take action within the plant. Including this reference to the emergency response plan near the front of AP 3SO would reduce the SS's reliance on memory.
1 During this event, an operator bypassed ES, while a plant depressurization was in ;
progress and not diagnosed or understood. While guidance existed for ES terminatfor, similar guidance did not exist for ES bypass prior to actuation. The development of similar guidance was planned by the licensee to clarify appropriate and expected operator actions in similar situations. The team noted that such guidance would likely reduce any operator confusion and eliminate the need for a rapid, knowledge based decision regarding ES bypass to ,e made in a stressful situation.
23.5 Knowledge Versus Ruld Comprehensive rules are provided for operation of a nuclear power plant in the form of operating procedures for normal, abnormal, and emergency conditi6ns.
. Knowledge, derived from training, of the plant configuration, instruments and controls, and system behavior is always required to apply the procedures and to adapt the procedures to the specific conditions of the plant. In this event, no procedure was readily available to the operators to support the diagnosis und correction of the loss of control of RCS pressure. The diagnosis by the operators of the cause and means or correction was based almost ent: rely on their knowledge, The event illustrates several factors which test the reliability of knowledge. based behavior. First, the dynamics of the plant behavior provides lim:ted time for investigation, analysis, and decisa making. In this event, there were 18 minutes from detection of the decrease in reactor pressure to the reactor trip. The reactor trip initiated demands for immediate actions, which commanded the attention of the operators. The initiation of ES actuation at 10 minutes after the teactor trip put the operators into en abnormal procedure, the purpose of which was to ensure that adequate 20
- - . . . - -- - - . ~ . - . - , -, - .- - -
, s .
core cooling was not 'ost. This is an on . ating objective of the highest priority, and the objective was met. The only time for the operators to give priority to the problem of loss of control of itCS pressure was the 18 minutes irnmediately before reactor trip.
Second, some of the data available to the operators in this event were misleading or erroneous and none were sufficient to permit an unambiguous determination of the cause of the loss of control of itCS pressure. The report that the steam flow to the deacrator had increased was true but was misicading since it was not causing Tave to significantly decrease and therefore, not causing the observed 1(CS pressure decrease.
The report by NO 1 that the llCS was in a cooldown transient was erroneous. There was a report fro"' the technicians sent to check the pressurizer heaters tbs,t the power to one group of heaters was rero. This report was accurate but erroneous because the fuse for the power meter was blown. One operator recalled that information passed during shift turnover included some kind of trouble with the position indica'or on IRCV 14 but cycling its switch to the closed position seemJd to discount this data. In fact, the summation of the data indicated to the operators that the IRCS oressure should not be decreasing. The plant behavior was apparently implausible.
Third, the time limitations and the limited available data increased the stress on the operators. Stress can be either enabling due to arousal or disabling due to ansiety.
Stresses in this event may have reached the disabling levels because of the apparently illogical behavior of the RCS pressure and the impending reactor trip and the subsequent entry into emergency conditions owing to ES actuation.
The fact that this event occurred between 3:00 and 4:00 a.m. makes it more probah!c that the stress reached disabling levels. This is the time in the daily cycle when humans are least able to withstand stress and when its limitat ions on cognitive behavior become most probable.
The event illustrates some adverse consequences of knowledge-based behavior under s'.ress such as (a) the incorrect deductions and (b. the unwillingness to abandon 21
- o .'
them (mindset). Two of the incorrect deductions were (a) that the RCS pre re decrease was due to cooling of the RCS even though the pressunzer level w a not decreasing and (b) that the surges in pressurizer level caused by the bumps in reactor power were causing the RCS pressure to decrease.
The first bypassing of the ES before ES initiation was an inappropriate action since it did not conform to any procedure and should have had the prior concurrence of the ANSS, espechily since the cause of the RCS pressure decrease and therefore the condition of the plant was in doubt. The action was based upon the operator acting on his own knowledge at a time of stress. The action did have a rational basis in the operator's mind. Ilis rationale was that the ES bistable trip setpoints are set con 3ervatively and the ES bypass would prevent an early trip of the ES and prevent a massive coolant injection to the RCS from all three llPIS pumps before the RCS pressure actually reached 1500 psig. The ES bypass could give him a few more minutes to find and correct the cause of the decreasing RCS pressure. Finally, the ES bypass was reversible and could be removed at any time. Ilowever, as is typical of a decision that is based upon knowledge under sttess, the operator persisted in his decision and left the ES in bypass until the action was countermanded by the ANSS.
The delay in the declaration of an emergency action level and the notification of the NRC as is shown on the time line was also the result of knowledge based behavior.
This was the responsibility of the SS and he was relying on his memory of the emergency response plan procedures.
Shortly after the first review of the event, the plant mar.agement was considering actions to reduce the reliance on knowledge based behavior during this type of event.
These actions were to 'a) provide a diagnostic procedure for response to a loss of control of RCS pressure,(b) provide a clearer statement in policies and procedures definine the restrictions on overriding LS t.ctuations or other safety system actuations, anf (c) review and supplement existing trahdng for this type of event.
22 .
Knowledge based behavior did result in obtaining control of itCS pressure and of increasirg the SCM by the method of increasing the pressurizer kvel. Increasing the pressurizer lesel to compress the steam bubble and, thus, to increase itCS pressure is a strategy that was not defined in any operating procedure. The automatic !!S actuation of the llPIS does this, but the abnormal procedure Ap 3SO provides no direction to prevent the unnecessary lift of relief and safety valves. The strategy devised by the control ro >m supenision both satisfied the SCM specifications of AP 380 and also limited the increase of itCS pressure to below the setpoints of the relief and safety valves. There is sufficient margin between the itCS pressures for these two limits that the strategy of filling the pres,urizer can be successfully implemented.
l'he AOS could not remember specific reason for his suggestion to close the spray block valve PCV 13, it is probable that he was recalling the rule in Section 3.14 of abnormal procedure AP-380 that stmes that closing itCV 13 is one proper response to a low RCS pressure conditi on. If so this was rule based, not knowledge based behaviar.
2.3.6 Tnutwork (Command. Control. and Communicalletn) reveral observations were made during the analysis of human performance during this event that indicated that operator performance may have been improved by closer adherence to general principles for command, control, and communications. These general principles could be especially helpful during an unplanned transient at 3:00 a.m.
since the capabilities of all members of the control room team may be adversely impacted by the time of day. These observations were as follows:
. NO 2 acted upon the suggestion by NO 1 to bump reactor power upward by using the control rods without first verifying that Tave was decreasing.
Verification by NO 2 would have shown him that Tave was only slightly decreasing and that control rod withdrawal was inappropriate.
23
. The ANSS did not question the increases in reactor power. lie may not nave been aware of them at an early stage.
I
+ NO 1 stated during the interviews that he had bypassed the ES without the prior concurrence of the ANSS.
- The SOTA did not question the bypassing of the US.
. The ANSS countermanded the action to bypass the ES but this was 6 minutes later and was after the AOS had questioned the action. The ANSS perhaps did not realize that the ES was bypassed or did not critically consider the advisability of the action. l
. The procedure for response to the RCS low low pressure alarm was not pulled from the file by the NOs. ,
. Nos 1 and 2 were relatively inexperienced in responses to unplanned transients, which would suggest a need for closer supervision of their actions in interpreting transients, increasing reactor power, use of bypass controls, and the use of procedures.
. Manua! control of the llPIS was taken at a very early stage after automatic ES initiation. HPIS injection was stopped after a relatively small increase in RCS pressure and while the RCS pressure and the SCM were still near their lower limits. A more conservative application of the abnormal procedure by the ANSS would have raised the pressurizer level and increased th: RCS pressure which was the maneuver that was executed 20 minutes later.
. A more thorough command and control of the execution of the abnormal procedure AP 380," Engineered Safeguards Actuation," would have included having one of the three NOs or the SOTA check through all the steps in 24
- , - _ - - - ~ , . - . . - - . . - . - - . . - - - , - - -
AP 380. Section 3.14 of AP 3SO contains an action to "close 1(CV 13, PZit spray block valve" to isolate a possible source of low 1(CS pressure. There would have ocen no specific reason at the time to not clos RCV 13.
. 'lhe station's procedures call for entry into emergency operations per the emergency response plan upon automatic initiation of the ES. The SS was responsible for determining the emergency action level and became the emergency director until relieved. The emergency action level declaration of an unusual event and the wnsequent notification of the NRC were made at a time c"nsiderably in excess of the specified time. A more ef fective division of responsibilities among the ANSS, the SS, the SOTA, and the AUS could have prevented this delay since each of them was capable of assisting in the emergency action level d .ermination and the notifications.
The successful strategy to fill the pressurizer to raise RCS pressure was devised by the ANSS based upon his knowledge of system theory It was successfully executed by the teamwork of the ANSS and the NOs. Throughout the event, the need for giving priority to the minimum SCM limit was realized and the monitoring and control of the SCM was a team effort by the control room crew.
?.3.7 Role of Other Control Room Persound The SOTA was present in the control room when the decrease in RCS pressure was obsened since a reactor startup and initiation of power operation was in progress.
The 9TA assisted in the attempts to diat, nose the cause of the decreasing RCS pressure and later in the retrieval of copies of procedures and diagrams and in the verification of the execution of the abnormal procedures. Evidently, he did not verify enough of the later steps of AP 380 to find the direction to close RCV 13, the pressurizer spray block . :,e, and did not question the first bypassing of the ES.
25
Since the SOTA was present during this event and was alett and observant l'e was a significant source of data during the later analysis of this event.
I The AOS was present during this event because it was station policy to have a !
management representative present in the control room during major maneuvers such as startups. This policy resulted in removing the first bypass of the ES and the closure of RCW13, which were done at the advice of the AOS, I
f k
9 r
k l 26 1
l *
- 3. SUMMAltY OF Tilli ilUMAN FACI'OltS IN Tills liVIINT 3,l.. M;Ln Machine Interfacs The event was initiated by a failure of the actuator for the pressurizer spray flow control valve llCV 14, which left the valve partly open but with position indicator lights that showed the valve fully closed. The resulting spray now caused a decreasing reactor coolant system pressure transient that appeared to have no directly discernible cause.
l 3.2 Duty llours The failure of IRCV 14 occurred near 3 a.m., when human performance tends to be at its lowest level.
3.3 Procedures and Training The procedure that was directly applicable to the decreasing reactor coolant system pressure was the annunciator response procedure. Ilowever, the annunciator response procedure for low reactor coolant system pressure was oriented toward control circuit failures which left itCV 14 indicating open. The abnormal response procedure for engineered safeguards /high pressure injection system actuation had directions for closing the spray line isolation valve llCV-13 to correct a low reactor coolant system pressure condition, but these directions were in a later section of the procedure that was not used because tN opet .r exitet { c abnormal procedure when IIS termination criteria were met.
Althoug'i the alarm response procedure would have been of minimal help, it was not referred to by the operators. Checking all sections of the abnormal response procedure once it war 'lk wd and with the loss of reactor coolant system pressure control problem stilli mm' would have provided the crew with the direction to close the IRCV-13, 27
14_Snowledge Versus Itules The operators' recall of the content of procedures and of plant behavior was relied upon to a large extent because of a lack of rules and procedure weaknesses as discussed above. The effectiveness of this knowledge was limited by (a) the limited time for knowledge based deelsion making, (b; misleading data on spray valve position indication, (c) the stress occasioned by (a) and (b), and, (d) the time of day. These may have been factors leading to the inappropriate bypassing of the ES actuation, the securing of high pressure injection system injection flow before the reactor coolant system pressure had risen well above the 1500 psig minimum for the subcooling margin requirements, and for ceasing the verification and checking of the later sections of the abnormal procedure which contained the direedon to close RCV 13.
3.5 Teamwork (Command. Control. Comrpunications)
Closer adherence to the general principles for command, control, and communications would have been helpful during this event, especially in view of the stress occasioned by the event and the time of day. Deviations from these general principles were of particular note in the bypassing of the ES, which occurred without the prior concurrence of the control room supervisor and continued for six minutes without being questioned by the control room supervisor. The station's administrative instructions contained minimal restrictions on use of the ES bypasses during transients.
This is especially applicable to the engineered safeguards /high ptessure injection system bypass since it is used during normal plant cooldowns.
1 3.6 Role of Other Control Room Personnd
=
The shift technical advisor was present in the control room thrm:ghout this event and participated in the attempts to determine the cause of the decreasing reactor coolant '
system pressure. lie did not question the bypassing of the ES. The team not d that the involvement of" management on shift" for the reactor startup contributed positively to 28 1
1 '
the event progreuion.
- Management on shift" noted that !!S was bypaued and reconunended that the preswrizer spray block vahe be closed.
ALSekutilktInttfentc1hrAthuu Shortly after the first review of the event, the plant management was considering actions to reduce the reliance on knowledge. based behavior during this type of event.
These actions were to (a) provide a diagnostic procedure for response to a loss of control of RCS pressure,(b) provide a clearer statement in policies and procedures defining the restrictions on overriding liS netuations or other safe'.y system actuations,
, and (e) review and supplement existing training for this type of event.
4 29 l
- . _ - _ _____ _ - _ _ _ - _ - ____ - - _ _