ML20096G516
| ML20096G516 | |
| Person / Time | |
|---|---|
| Site: | Prairie Island  |
| Issue date: | 04/30/1992 |
| From: | Hill S, Meyer O, Steinke W IDAHO NATIONAL ENGINEERING & ENVIRONMENTAL LABORATORY |
| To: | NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| Shared Package | |
| ML20096G515 | List: |
| References | |
| EGG-HFRU-10228, NUDOCS 9205260118 | |
| Download: ML20096G516 (32) | |
Text
_ _ _ . _ _ - _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
EGG-HFRU-10228 TRIP REPORT:
ONSITE ANALYSIS OF THE HUMAN FACTORS OF AN EVENT AT PRAIRIE ISLAND 2 FECRVARY 20, 1992 (LOSS OF SHUTDOWN COOLING)
William Steinke Susan Hill Orville Meyer Onsite Analysis Team:
John Kauffman William Steinke Published April 1992 Idaho National Engineering Laboratory EG&G Idaho, Inc. -
P. O. Box 1625 Idaho Falls, 10 33415 Prepared for the Office for Analysis and Evaluation of Operational Data U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Under DOE Contract No. DE-AC07-761001570 9205260118 920512 PDR ADOCK 05000202 O PDR
EXECUTIVE
SUMMARY
At 11:10 p.m., February 20, 1992, a loss of shutdown cooling resulted from insufficient water level in the reactor coolant system at Prairie Island Unit 2. The operators responded promptly and initiatea recovary procedures to restore water level in the reactor vessel and re-establish shutdown cooling flow. On the morning of February 21, 1992, a decision was made by Nuclear Regulatory Commission Region 111 to form an augmented inspection team (AIT) to investigate the event. The AIT leader was Bruce Jorgensen, Region 111. Other NRC staff members of the AIT were James D. Smith, Melvyn Leach, Region 111; David Gamberoni, Office of Nuclear Reactor Regulation (NRR); Warren Lyon, NRR; Arman t Masciantonio, NRR; and John Kauffman, Office for Analysis and Evaluasion of Operational Data (AE00). William Steinke, Idaho National Engineering Laboratory, provided assistance as part of an AE00 program to study the human performance during operating events. The AIT conducted an onsite investigation from February 22 to 25, 1992. This trip report provides a review of the operational details of the event and an analysis of the human factors that contributed to the event.
On February 20, Prairie Island 2 was two days into a refueling outage.
Late on dayshift, reactor vessel drai'iing to midloop had commenced and then been terminated for shift change. The evening shift (6:00 p.m. to 6:00 a.m.)
conducted beginning of shift briefings and re-established draining. The two reactor operators conducting the draindown were extra personnel from another shift used to supplement the normal duty shift (see Figure 1). The extra reactor operators were in communication with operators in the containment building to accomplish the draindown, Newly installed electronic level instrumentation was considered operable during the evolution. When the draindown started, the electronic level instrument display on the control room Emergency Response Computer System was off-scale high (see Figure 2). A tygon tube was the only instrument providing usable level information during the draindown. To obtain actual level within the system, tygon tube levels were transformed, via manual calculation, to correct for the nitrogen pressure effects.
iii l
A systems engineer was on duty tu provide assistance with the draindown and also to perform a pre operational check on the electronic instrumentation when it was indicating on-scale. Af ter approxiaately two hours of draining, at 9:30 p.m., the electronic instrumentation was still off-scale high. The systtus engineer conferred with an instrument technician and made a decision to leave the control room to investigate the level transmitter valve lineup in the certainment building. This effort was interrupted by the announcement that shutdown cooling was lost. The systems engineer returned to the control room at that time.
At 10:55 p.m., the draindown reactor operators were having difficulty calculating actual level and became concerned about reactor vessel water level. A containment building operatcr was sent to open a vent in the suction line of the residual heat removal system to check for air (nitrogen). One of the draindown reactor operators decided nitrogen pressure was higher than it should have been at this point in the draindown and opened a reactor head vessel vent to vent off some of the excess pressure. The containment operator reported back that nothing but air was coming from the vent on the residual heat removal suction line. He was ordered to close the vent and drain valves.
Electronic level had suddenly changed from off-scale to an indicatica of about 723 feet (5 inches below midloop), and a low level alarm was received. Based on interview data, the indicated level was as low as 722 ft 6.5 in.(10 inches below midloop). Alar s on the ERCS for residual heat removal pump low suction pressure, low motor-amps, and low flow were received at 11:08 p.m. The shift manager ordered the running 22 residual heat removal pump stopped at 11:10 p,m.
The shif t supervisor took direct command of the operations and entered abnormal procedure D2 A0P1, " loss of Coolant While in a Reduced Inventory Condition," which directed the starting of a charging pump to raise the reactor vessel water level. The operators were monitoring reactor coolant system temperature using available in-core thermocouples. The temperature was about 133*F at the time of the trip or the running residual heat removal pump.
One entry condition for Emergency Procedure 2E-4, " Core Cocling Following loss of RHR Flow," required that reactor coolant system tem?erature be at 190'F.
The operators observed from the rate of level increase and heatup that actions iv
~. . _ _ _ _ _ _ _ __-___ _ _. m_ _ _____ __
of the abnormal procedure were insufficient to mitigate the transient before reaching entry conditions of the emergency procedure. The emergency procedure was immediately implemented when the temperature reached 190'F. The 21 residual heat removal pump was aligned to the refueling water storage tank and started to inject water to the reactor vessel. Reactor vessel level was promptly regained. The 21 residual heat removal pump was then stopped and realigned for shutdown cooling and restarted. A peak temperature of 221*f was reached before re-establishing shutdown cooling and returning the plant to pre event conditions.
A containment evacuation of 42 people was accomplished, with the exception of two operation personnel. They were directed to stay in the containment by the control room staff to continue monitoring tygon tube level and be available to operate valves for the draindown. Containment integrity was verified to be intact as directed by the emergency procedure.
A number of factors contributed to the event occurrence.- Procedures and training did not provide sufficient direction in nitrogen pressure control.
The significance of round off errors during water level calculations was not recognized by the reactor operators and had not been addressed during training. The. procedure did not require recording of the actual water level during drain down although it is evident from the event analysis that such information is necessary to maintain an awareness of level.
Several command and control anomalies were identified. Management's ,
incorrect assumption of the reactor operators' experience during the draindown process was not compensated for by detailed procedures or technical support personnel. There was uncertainty as to who had responsibility and authority to make the decision to stop or hold draindown activity. The junior reactor operator was placed in charge because he was the first to arrive on duty. The draindown reactor operators were uncertain as to who was in charge. The shift manager and the shift supervisor assumed the reactor operators were experienced in this procedure and did not. require continual supervision. An apparent hesitation by the druindown crew to communicate some concerns to the supervisors may have resulted from the R0s not working with their normal crew.
The infrequently performed draindown operation is a type of operation where v
operator performance can be enhanced by an emphasis on briefings and review of command, control, and communication at the beginning of the operation and after shift changes.
The draindown reactor operators lacked awareness of some of the effects higher nitrogen pressures had on the draining process. The calculations of water level from tygon tube readings were performed but did not reflect the expected decreasing trend, which was assumed to be a result of steam generator tube burping. There was a lack of questioning attitude regarding the response of the electronic display indicators even when it was identified in the procedure that the displays should be operable. There seemed to be a lack of awareness on the part of the shift supervisor of the concerns about the progress of the draindown. There was no action by the supervisors to hold or stop the draindown.
It would have been appropriate to hold or stop the draindown because of discrepancies and uncertainties regarding water level. However, that decision ,
was not made by the supervisors or crew. The systems engineer made the decision to leave the control room apparently without consulting with the reactor operators.
A human machine interface issue was identifieu when the local operator had difficulty reading the level correctly in the tygon tube. There were reported para 11hx problems and poor lighting and tube visibility was degraded l by the tube penetrating the next floor. There is also the question of reliance on the tygon tubing for level information because of all the possible (and actual) sources of unreliability that are associated with tygon tubing use. The draindown was' a sensitive, manually controlled operation with no direct indication of the critical paradter (water level) available to the control room command and with no automatic alarm on decreasing level due to high nitrogen pressure. The human machine interface did not provide reliable, independent support of the operation.
The, reactor operators made cognitive errors in their calculations to obtain actual water level from tygon tube readings. Their attempts to monitor
-level, without required instrumentation functioning properly, created a vi
l workload they had not previously experienced. As a result, incorrect information was being used for the draindown.
This event illustrates the interdependence of shutdown risk and administrative controls on the succesful comoletion of outage activities.
Therefore, the control of risk during shutdown relies heavily on human performance. Human performance issues are of particular concern during shutdown operations. l 1
Y t
9 vii
ACKNOWLEDGEMENTS j We express appreciation to the Prairie Island staff for their cooperation for freely providing information necessary to analyze the human factors of the operating event. We particularly thank the Unit 2 operators and technical staff who were on duty during the evening shift of February 20 for their cooperation during the interviews.
6 b.
L l
i- viii
_ . _ _ . ~ . _ , _ _ , . . . _ _ _ . _ . . _ . _ _ ._ ._. _ . . - , _. . .. _ ,_ .._ - _ , _ __ _ - _ . ._ , , _ _ _ _,_,
)
i l
\
CONTENTS EXECUTIVE
SUMMARY
. . . . . . . . . . . . . . . . . . . . . . . . . . . iii ACKNOWLEDGEMENTS ........................... vitt ACRONYMS ................................. x
- 1. INTRODUCTION ............................ 1 l.1 Purpose . . . . . . . . . . . . . , . . . . . . . . . . . . . . I 1.2 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I 1.3 Onsite Analysis . . . . . . . . . . . . . . . . . . . . . . . . 2
- 2. DESCRIPTION OF THE EVENT ANALYSIS . . . . . . . . . . . . . . . . . . 3 2.1 Background .......................... 3 1 2.2 Time Line of the Event .................... 7 2.3 Analysis ........................... 11 2.3.1 Procedures and Training ................ 11 2.3.2 Command and Control .................. 13 2.3.3 Situational Awareness ................. 14 2.3.4 Decisionmaking . . . . . . . . . . . . . . . . . . . . . 15 2.3.5 Sh i f t S t a f fi ng . . . . . . . . . . . . . . . . . . . . . 16 2.3.6 Human-Machine Interface ..............,. 16 2.3.7 Cognitive Errors . . . . . . . . . . . . . . . . . . . . 18 2.3.8 Administrative Controls During Shutdown ..... .. 19 3.' REFERENCES , . . . ... . . . . . . . . . . . . . . . . . . . . . . 19 Appendix A ....,..........................20 FIGURES Figure 1. Prairie Island Control Room Staffing . . . . . . . . . . . . . 22 Figure 2. Emergency Response Computer System . . . . . . . . . . . . . . 23 Figure 3. ' Prairie Island RCS Elevations . . . . . . . . . . . . . . . . 24 ix
e l
ACRONYMS AE00 Analysis Evaluation of Operational Data ,
AIT augmented inspection team ERCS Emergency Response Computer System ;
INEL Idaho National Engineering Laboratory i LR0 lead reactor operator NRC Nuclear Regulatory Commission NRR Nuclear Reactor Regulation PRT pressure relief tank RCS reactor coolant system RHR residual heat removal RO reactor operator RWST refueling water storage tank SE systems engineer .
SM shift manager SS shift supervisor STA shift technical advisor O
k X
- s _
- 1. INTRODUCTION 1.1 Purcose Nuclear Regulatory Commission (NRC) Region 111 formed an augmcr.:ed l inspection team (AIT) to investigate the loss of shutdow1 cooling that occurred at Prairie Island Unit 2 on February 20, 1992, sur 5?) refueling outage. Reactor coolant system (RCS) water level was o'e?ng lowered to midloop in accordance with Operating Procedure 02, "RCS Reduced :nventory n.ouration,"
and monitored by tygon tube level indication in the containment building.
Electronic level instrumentation, conside: ed operable, was not indicating on-scale because of high nitrogen pressure during the draining process.
Incorrect pressure compensation calculations, to convert tygon tube levels to actual level values, produced erroneous actual levels. 1he RCS water level was drained to a point where vortexing produced air binding as evidenced by the residual heat removal pump performance. The operators turned the pump off. The operating crew initiated abnormal and emergency procedures to restore water level and re-establish shutdown cooling. The temperature increased from 133 to 221'F during the 21 minutes shutdown cooling was not available. This report describes the human factors involved in this event as identified from an onsite analysis.
1.2 Scope The human factors analysis focused on the factors that influenced the performance of operations staff and technical support personnel throughout this event. The analysis was based on data derived from plant logs and recordings, interviews with operations personnel, and review of operations procedures and training lesson plans. The Idaho Natio al Engineering Laboratory (INEL) provided assistance to the AIT as part of the program at the.
NRC Office for Analysis and-Evaluation of Operational Data (AE00) to study
. human performance during operating events.
W
1.3 Onsite Analysis The human performance specialists were at the site February 22 to 25.
The onsite AIT consisted of the following members:
Bruce Jorgensen, NRC/ Region 111, team leader James D. Smith, NRC/ Region lit, assistant team leader Helvyn Leach, NRC/ Region ill David Gamberoni, NRC/NRR Warren Lyon, NRC/NRR Armand Masciantonio, NRC/NRR John Kauffman*, NRC/AE0D/ROAB William Steinke', INEL/EG&G Idaho, Inc.
Individuals that analyzed the human performance of this event.
2
- 2. DESCRIPTION OF THE EVENT ANALYSIS 2.1 D1hground The Prairie Island Nuclear Generating Plant, located in southeastern Minnesota, is owned and operated by Northern States Power Company. The two, nearly identical, pressurized water reactors are rated at 1650 MW-thermal each with Westinghouse Nuc'. ear Steam Supply Systems and dry containment butidings.
The units are operated from a common control room and have been in commercial operation since 1973 and 1974, respectively.
On February 20, 1992, the Unit I reactor was at power and the Unit 2 reactor was in a cold shutdown condition, approxiMateiy two days into a scheduled refueling outage. Peactor core t,coling was being provided by the residual heat removal (RHR) system, with the 22 RHR pump and heat exchanger in service and maintaining temperature. Temprature was being monitored by eight thermocouples, three of which were trended on the emergency response computer system (ERCS), with indication in the control room. Indication on all eight thermocouples was approximately 133*F.
Draining of the reactor coolant system (RCS) was initiated on dayshift and then terminated for shift turnover at 5:40 p.m. The Unit 2 control iaom on-duty operating crew consisted of a shift manager /shif t technical advisor (SM/STA), a shift supervisor (SS), a lead reactor operator (LRO), and a reactor operator (RO). Three extra R0s were also present in the control room to assist with outage activities (see Figure 1). Two of the ex,tra R0s were assigned to draining the RCS to midloop for installing nozzle dams. The third extra R0 was assigned to drain / fill operations of a steam generator. The duty crew was performing normal shift activities unrelated to the draindown.
A non-licensed systems engineer (SE) was on duty to assist in the draindown. During previous draindnwns, an engineer had given continuous direct support to the operatir.g crew, providing guidance on nitrogen pressure and drain rates and performing required calculations. A pre-operation work package for ERCS level instrumentation had been assigned as a c?llateral duty of the SE, to be completed during the draindown.
3
The draindown process required knowledge of water level in the RCS at all times during the evolution. Operating Procedure 02, "RCS Reduced Inventory Operation," identified electronic level indications LO460A and LO470A as primary inputs to the ERCS which was required to be operable prior to draining the reactor coolant system (see Figure 2). This level indication n the control room on the ERCS eas in service but was failed in an "N Cal" condition (i.e., no compensated value was being calculated). The control room personnel accepted this over ranged condition as an expected response durirg the early stages of_ draining when water level was above the range of the instrument.
The only available level indication to the operators was a tygon tube placed
'n service by procedure D2. It was being monitored locally in the containment building. One of the R0s in the control room was in constant communication with an outside auxiliary equipment operator in the containment at the tygon tube. Level readings were requested by the control room about every ten minutes. The tygon tube level had to be corrected by the draindoun R0s for nitrogen overpressure effects to obtain the actual level in the RCS. Nitrogen pressure was varying from 4.0 to 6.6 psig. Conversion from tube level to actual level involved several different units of measurement, and calculations were necessary (see Appendix A). Table 4 had been developed in Operating Procedure D2, which went_from 0 psig to a maximum pressure value of 1.5 psig, to aid the op rators in the conversion process. The SE had performed calculations beyond the range of the table in past draindowns.
The level in the tygon tube had been about eye level at the containwit station on previous draindowns. On this occasion, the nitrogen pressure on i
the system was elevating the level in the tube approximately 10 to 15 feet, it was difficult for the operator to read because of poor lighting and tube markings, and penetration of the tygon tube up into the next floor level.
T6e draindown R0s were concerned over the lack of electronic level measurement as the draining progressed and expressed their concern to the SE, p who then left the control room at approximately 9:30 p.m. to verify the level L instrumentation transtdtter valve lireup in containment. The SH was aware of the level indication problem and had three different conversations with the SE and the Instrument and Control Technician concerning the electronic level indication before the SE left the control room. After the SE left the control 4
z._.. -
i-room, the R0s experienced difficulty with the conversions to obtain corrected level (see Appendix f.).
Plant behavior was different, with respec'. to the " burping act an" q
(draining) of steam generator tubes compared to previous drai;ioowns (see Figure 3). Several distinct increases in indkated level due to burping had been observed on previous draindnwns. This 'iire, the onset of steam generator tube burping was difficult to identify. Thh burping appeared to be a single continuous action to one of the R0s. His past experience told him that the draining process was almost done when the Surping stopped. The RO was uncertain when the burping stopped during this draindown.
The SM performed a backup calculation at 10:50 p.m. to determine the time remaining before completion of the draindown, based on total volume drained, by using the indicated level of the holdup tank, which was collecting the ,
reactor coolant. The SM used a conversion number, from the plant tank data book of 622 gal to one percent indicated level in the holdup tank. An -
estimated time to completion of 30 minutes was obta"ed and announced to the h crew, U
e I
The differences in burping act'lon of the steam generator tubes and associated RCS water luel changet, caused the draindown R0s to check the condition of the RHR system. The draindown R0s dispatched a containment -
operatar to open a vent in the suci f on line of the operating RHR pump to verify no air (nitrogen) present at appeoximately 10:55 p.m. tt the same time, a reactor vessel head vent was opened from the control room to lower r.itm. gen pressure. The report-back from the containment was "ncthing but air comini cut of the RHR veri valve." The draindown R0s ordered the drain valves closed at approximately 11:01 p.m.
Alarms on the ERCS for RHR pump low suction pressure, low motor amps, and low flow were received within a short time span after ordering the drain valves closed. Level indication on the ERCS came on-scale at this time and bawd on interview data, indicated about 722 ft 6.5 in. (10 in. below midloop). The SM and the SS were present at the control boards verifying alarm conditions. At 11:10 p.r1., the SM ordered the 22 RHR pump secured. The 5
~ SS ?ntered Abnormal Procedure D2 A0P1, " Loss of Coolant While in a Reduced Inventory Condition," and began directing the actions of- the control room operators._ Charging pumps 21 and 22 were started in accordance with the abnormal procedure to raise reactor vessel water level from about 722 f t 6 in, to 723 ft 4.5 in. Indicated temperature rose from 133*F at a rate of about 5'F per minute. Based on the rate of increase of reactor vessel water level and core exit temperature, the SS directed the duty LR0 to review Emergency Procedure 2E-4, " Core Cooling Followino : 1: of RHR Flow," in preparation for using it.
Entering Emergency Procedure 2E-4 was considered by the licensee as taking aggressive action. The philosophy was to let the abnormal procedures try and correct the situatica before initiating a higher level emergency procedure. The SS and a draindown R0 discussed the possibility of starting the other RHR pump. Based on the interviews, it could not be established whether the pump would have been started in the :ame system configuration or realigned before starting. A decision was made by the SS to wait ontil 190*F (an entry condition) and implement Emergency Procedure 2E-4, " Core Cooling Following Loss of kHR Flow."' The transition was made to the emergency procedure and 21 RHR Pump was aligned to inject water from % refueling water storage tank (RWST) to the reactor vessel. At 11:29 p.m., the level was restored to the reactor vessel flange elevation. The 21 RHR pump was realigned to re-establish shutdown core cooling, and the plant n turned to pre-event conditions.
The Unit 2 duty LR0 initiated containment evacuation of no,nessential personnel, as directed by Emergency Procedure E-4 at 11:22 p.m. Security and Health Physics coordinated their efforts in evacuat:ng 42 personnel from the containment building. Two auxiliary operators assisting in the draindown remained in the containment building. Containment integrity was verified to
'be intact as required.
The SM, Unit I and 2 SSs, together with technical support personnel who had arrived onsite, discussed the classification of the event. The classification descriptions in the procedure did not in their o::11on meet the conditions they had experienced. Their interpretation of the procedure led to 6
I a no classification. Industry event training had covered alert classifications at other facilities where loss of shutdown cooling had been experienced (e.g., Diablo Canyon). Their conclusion was this event warranted Emergency Plan classification. After some deliberation, it was decided item 19 of the event table was appropriate for the situation. it allowed the emergency director to classify an event at his discretion. This decision to declare a notification of an unasual event was reached about one hour after the loss of shutdown cooling occurred.
2.2 Tim _g_Ljne of thg_fyent The foMowing event time line sequence was developed from interviews with the on-duty shift personnel, technical staff, copies of the control room logs, and plant computer printouts.
Note: - all times are Central Standard Time 02/20/92 5:04 p.m. Plant operators commenced reactor coolant draindown to nozzle centerline per Operating Procedure D2, "RCS Reduced Inventory Operation."
5:16 p.m. Operators placed the tygon tube in service when pressurizer level indication reached 5%.
5:45 p.m. Operators secured the draindown for (approx.) shift turnover.
6:00 p.m. The evenir.g shift assumed control room responsibilities with extra R0s assigned to the reactor vessel draindown.
i7:34_p.m. Operators recommenced RCS draindown per Operating Procedure 02 using the tygon tube-level corrected for
~
pressure as actual level indication. The SE was present in the control room. Manual calculations for obtaining 7
I .
- actual level were being performed by the engineer and draindown R0s. Nitrogen pressure was being maintained per the engineer's direction from 5 to 6 psig.
8:00 p.m. Operators suspected problems with the (approx.) ERCS level instruments because the instruments had not come on-scale as anticipated. Draindown continued, relying on tygon level, while attempts were made to diagnose the problem.
9:30 p.m. . The SE, after discussions with the draindown R0s and the Instrument Technician, lef t the control room to check the valve alignment for the electronic level instrumentation transmitter.
. Draining continued. Actual level values were derived from calculations, Difficulty was experienced verifying values because of rounding off pressure values and converting feet to inches. This resulted in delays in determining the corrected level values.
10:00 p.m. The draindown R0s have calculated a corrected level value of 723.6 feet for about an hour. The R0s believed that tube burping was maintaining level constant.
10:50 p.m. The SM eses the indicated volume in the liquid holdup tank and conversion values from the plant tank book to estimate time remaining to drain the required amount. Thirty minutes is announced to the control room personnel as estimate to completion.
10:52 p.m. The draindown R0s calculated corrected level at 723.2 f t (see Figure 3). Procedure terminates draining at 723 ft.
4.5 in. (middle of hot leg pipe).
8
,1 . .
10:55 p.m. Operators vented the suction line to the 22 RHR (approx.) pump. The report back is nothing but air in the line. A reactor vessel head vent is opened to lower nitrogen pressure, 11:00 p.m. RHR flow oscillations began to develop and coolant temperature increases. (RHR pump suction pressure was ,
less than required due to low level in the RCS hot leg pipe and entrained nitrogen, causing cavitation). ,
l l
11:01 p.m. . The operators decided to stop the draindown. This l instruction was relayed by radio to an auxiliary operator i inside containment to close a valve manually, l
. The ERCS loop A electronic level instrument came on scale -
and indicated level was approximately four inches below l nozzle centerline. This also resulted in a low level alarm, 11:03 p.m. The loop B electronic level instrument came on scale and indicated level was approxir,iately two inches below nozzit centerline. This also resulted in a low level alarm. '1 11:08 p.m. RHR low flow, RHR pump low suction pressure, and RHR pump low motor current alarms actuated.
~11:09 p.m. The containment operator. stopped draindown by shutting-manually operated loop drain valve and reporting back to the control room.
11i10 p.m.- SM and fi are present at the control panels and order the 22 RHR pump stopped. In' ;cated RCS temperatur e is 133*F.
j; 9
11:12-p.m. Operators entered Abnormal Operating Procedure D? A0P1,
" Loss of Coolant w':i'.e in a Reduced Inventory Condition."
The SE returns to the control room, 11:13 p.m. Operators: started 21 charoing pump per procedure 02 AOPl.
This pump was aligned _to take suction on the RWST.
11:15 p.m. Electronic level indication read approximately 8 in, below the nnzzle centerline (722 ft 8 in.).
11:19 p.m. Operators started 22 charging pump per procedure, aligned to the RWST.
II:20'p.m. Core exit temperature reached 190*F. Operstors entered Emergency Procedure 2E-4, " Core Cooling Following Loss of RHR Flow."
11:22 p.m. Operators ordered nonessential personnel to evacuate containmer.t per Emergency Procedure 2E-4. -
11:25 p.m. Core exit temperature reached 200*F, the (average) temperature that defines hot thutdown mode.
11:26 p.m. Operators aligned 21 RHR pump to take suction from the RWST and'to discharge to the reactor vessel and started the pump.
11:27 p.m. Core Exit temperature reached 221.5'F. (This was_the highest recorded temperature during the event.)
11:29 p.a.. Level reached vessel flange elevation. Operators shut off 21 RHR pump.
11:32 p.m. Operators realigned the RHR system for-shutdown cooling and restarted 21 RHR pump.
10
..: - s .
p 1
7 11:34 p.m. The core exit temperature decreased to less than 200*F.
11:33 p.m. Operators shut off both charging pumps.
11:40 p.m. The NRC senior resident inspector was informed of this event.
92/21/92 12:01.a.m. Unit 2 personnel drew a reactor coolant chemistry sample.
(The sample did not indicate any dose equivalent iodine.
This indicated no evidence of fuel damage.)
12:25 a.n. The licensee declared and exited a notification of an unusual event. .
2.3 An al ysis 2.3.1 Procedures and.Trainino The procedure available-for the draindown activity, D-2, "RCS Reduced Inventory: Operation," and the associated training on some procedural aspects were contributing factors to the event. The crew had been trained on the abnormal:and emergency 1 procedures in a classroom setting as the simulator does not.have.midioup' capability. The training included practice in making
. -conversion calculations for tygan tube level. However, the practice L calculations were within .he limits of the tabled talucs, which only went to 1.5 dsig. During the event, the pressure varied around 6 psig, the tabled
. values were not useful, end th9 crew had not had practice making the higher pressure calculations. During training, the operators were not informed about.
the sensitivity of.the calculations .to roundoff errors. Rounding values to the nearest whole number had a potential of introducing errors on the order of one foot-when accuracy to the nearest inch was needed. Training did not provide sufficient proficiency and scope for the calculations required in the control room.
11 o
I l
Several factors associated with the 02 procedure were identified as event contributors. The procedure used contained sparse information on nitrogen pressure control, with only the start and end points noted. In the procedure (step 4.18), a nitrogen blanket is maintained at approximately 6 psig. No further discussion or directien is given w' thin the procedure concerning the nitrogen pressure until later (step 5.3.4), where nitrogen pressure should be allcwed to decrease to approximately 1 psig. No intermediate direction is given as to the control of the nitrogen pressure. An associated problem with the nitrogen prcssure control is that the water level (adjusted for nitrogen pressure) would not be c'iculated and displayed on the ERCS until the pressure was at 3.5 psig (see Figure 2). There was no indication of this within the procedure, and the operators and SE were not aware that the adjusted level would not be calculated and displayed when there was more than 3.5 psig of pressure. These elements regarding the nitrogen pressure suggest that the procedure writer assumed tnat the interuediate nitrogen pressure would be gradually decreasing from the initial 6 psig, the level would be calculated and displayed on the ERCS during this intermediate process when the pressure reached 3.5 psig, and then towards the end of the draindown, the pressure would decrease to approximately 1 psig. However, the personnel were not aware of the assumed nitrogen pressure trend as it was not directed by the procedure. On the job training apparently did not include enough observation time of the process for the SE to be familiar with nitrogen pressure control from beginning to end.
Another factor associated with the 02 procedure concerned the most appropriate conversion factor to use in the calculation of the time remaining for draindown based upon percent level in the holdup tank. A conservative conversion factor of 637.5 gal /%, which had been used in previous draindowns by an experienced engineer, had not been included (inferred from other values) in the procedure. Rather, a value of 622 gal /% was obtained by the SM from a plant data book. The procedure did not include any conversion factor and certainly not the more conservative, and more appropriate, conversion factor.
The 02 procedure did not require the logging of actual water level during the draindown, althourh it is evident from the event analysis that the crew 12 1
needed this trending infsrmation to maintain an awareness of plant response and whether or not the draining was continuing.as expected.
The emergency operating procedure, 2E-4, " Core Cooling Following Loss of RHR Flow," was reviewed when the crew anticipated its use. It has been observed that'few neclear power plants have emergency operating procedures for use during shutdown. However, in this evunt there was an emergency procedure and,-once entered, the procedure was effective in restoring shutdown cooling.
Three conditions were listed'for entry into procedure E0P 2E-4. One of the 2E 4 entry conditions was RLS temperature of 190*F. This entry condition allowed approximately two minutes of operator response before 200'F was reached, where the plant changes status from cold shutdown to hot standby.
The procrjure did not state whether all three conditions were required or any one was :cfficient to implement the procedure. This ambiguity led to an interpretation by the crew which delayed the entry into the E0P until 190*F was reached. As a result of this event, the procedure entry condition temperature has been changed by the utility from 190 to 150*F.
2.3.2 Command and Contr_o1 It appears that command and control issues were not identified and addressed before initiating the draindown process. The draindown crew was composed of three extra R0s scheduled for this evolution. The junior R0 was placed in charge of the draindown crew because he was the first to arrive on duty. Interviews indicated some unsureness of the draindown crew regarding who was really in charge. There was an apparent hesitation of the draindown crew to communicate some concerns to the SM and the SS. This may'have been due in part to the fact that the draindown crew was not working with their normal crew supervision.
Past draindowns had been st.ccessfully completed by R0s with constant technical guidarce by SEs. There was an assumption by the SM and SS that the R0s_were experienced in the draindown procedure. As a result, there was infrequent supervision by the SM and the SS because they felt the crew was experienced enough to proceed with the procedure.
13
The lack of command and control was al.m evident in the apparent uncertainty as to who had the responsibility and authority to make the decision to stop, or at least hold, the drair.down activity. The SM and the SS would have authority to discontinue the activity but did not exercise the authority. The unsureness in the c'raindown crew as to who was in charge was also a contribution.
The infrequently performed draindown operation is the type of uperation where operator performance can be enhanced by an emphasis on briefings and review of command, control, and communication at the initiation of the operation and after shift changes.
The command and cocrdination of the operating crew during recovery from the event was a- positive factor in the crew's response, possibly because it was then clear that the shift supervisor was in direct command of the procedures. The emergency operating procedure was well executed ance entered.
2.3.3 Situational Awaren There was a lack of awareness on the part of the draindown crew as to exactly what was happening in the piant and an uncertainty on their part as to the actual level at times. The crew whs calculating the water level from the tygon tube level readings because the ERCS had not come on scale until shutdown cooling was lost. The water level was being recorded informally as a formal-logging was not required by the procedure, 02. The procedure expected ,
the electronic -level to be operable at this time with an alarm capability for the operator. Several sources contributed to the lack of level awareness.
'The calculations were lagging because of the delay between receiving the tygon tube reading and making the necessary calculation. In addition, the calculations were rounded off, leading to inaccuracies in the levels. The lack of awareness of actual water level and how that related to what it should be'(based on knowledge of what was happening during drain down) suggests that the crew members did not have an appropriate mental image of the draindown process. Such a mental image would have included a model reflecting a decrease in level as draining continued. lw.vever, as the draindown continued, the calculated level remained nearly the same. This information, compared 14
against an appropriate mental image, likely would have pointed out the discrepancy.
The draindown R0s showed a lack of questioning attitude regarding the safe progress of the evolution. For example, the draindown crew did not question the lack of elactronic display indicators until much later in-the evolution. The crew apparently assumed that it was a normal rispense of the display to be out of bounds, It may be more significant that there appeared to be a lack of awareness on the parts of the SM and the SS for some of the concerns of the draindown crew regarding the progress of the draindown evolution. Although the SM and the SS were aware that the electronic display of IEvel was not present and that the SE and-instrumentation and control technician were discussing the lack of level indication, the supervisors did not question the progress of the draindown and intervene to hold or stop the activity.
When the SE and the SM were convinced that the electronic level display was not responding as-expected, a command to temporarily stop the drain down at approximately 9:30 p.m. in order to permit an assessment of the situation would ha e been appropriate.
7 2.3.4 Dee j onmakina j Decisionmaking concerns the ability of the personnel to process the
- j. information available to them into a coherent and correct understanding of the
. status of the plant and act upon that understanding. In this case, an appropriate decision to take a cautious action and hold or stop the draindown was not made. It-appears that the SM was aware of conversations that the SE and instrument and control technician were having regarding the lack of k electronic water level display. There was the opportunity to make the decision to hold the process, but the decision was not made. Lack of situational awareness on the parts of the draindown crew and the supervisors, as well as commana and control weakness, ontributed to the indecision.
l 15
The decision by the SE to leave the R0s in order to check out the valve line-up was evidently made without discussing criteria for terminating the draindown with the R0s. The decision was made based on the feeling that something was not right because there was no electronic display of calculated water level on the ERCS, The SE apparently did not consider the impact his absence in the control room would have on the R0s' aoility to make necessary calcu'ations to continue safely with the draindown. However, it is not clear whether or not the SE would have suggested a hold or stop of the draining procedure to the SM or SS before the event even if he had remained in the control room with the R0s.
2.3.5 Shift Staffina There was an assumption that the SE assisting in the draindown had experience in draindown process. He had only been present in the beginning portions of a previous dralndown. The SE's lack o' experience was not compensated for by detailed procedure guidance. Also, the SE was assigned a collateral duty during the draindown.
There was also an assumption regarding the experience of the R0s in the draindown process. The extra R0s were assigned the duty of draining rather a than the regular duty R0s because of their previous participation in Howe"cr, in the past, there had also been a very experienced SE
~
draindowns.
that assisted them and made most or all the calculations and provided constant technical guidance.
2.3.6 Human-Machine Interface L
Although human-machine interface is most often thought of in terms of control room displays, it can also be viewed as any interface where the human user must obtain information from a physical display. A human-machine interface issue occurred in the ability of the local operator to read the level in the tygon tube in order to convey information back to the control room draindown crew. The tube level was approximately 10-15 ft from the floor and there were reported parallax problems with reading the level, the lighting was poor, and the ability to see the level was degraded by the tube 16 l
1 ll -
penetrating the next floor, The difficulty in reading the tygon tt% level correctly was p.rticularly critical in this event because this reading was the only source of information regarding level. So, in this case, poor data from the difficult readings was used coorly in calculations (as discussed earlier),
making the resulting level infcrmation ewn more suspect. There is also the question of reliance on the tygon tubing for level information because of all the possible (and actual) sources of unreliabiitty that is inherent with tygon tubing use.
The information displayed on the ERCS is anM her human-machine interface issue. The ERCS 60es not provide level indication when the nitrogen pressure is above 3.5 psig. This lack of electronic level information required the crew to rely on tygon tube level readings and manual calculations for water level indication. Having the ERCS continually presenting water level (i.e.,
never being off scale) would provide the crew with needed level information.
This would also reduce the ambiguity as to whether the ERCS should be displaying level or not; the ERCS would always be scaled to display the water level. If, then, the ERCS was not displaying a water level, the crew would know that something was not right.
In this event, the control room draindown crew relied on a local operator in the containment building to manually open and close the valve involved in dr'ai ni ng. Although the control room draindown crew had responsibility for and -
were tracking the level and progress of the evolution, they did not have any control means (e.g., a remote shutoff valve) in the control room to stop the evolution. In this case, the display and control panel in the control room did not provide a means to directly and immediately control the evolution.
In summary, the Jraindown was a sensitive, manually controlled ope ation with no direct indication of the critical parameter (water level) available to the control room command and with no automatic alarm on decreasing level. The nitrogen pressure of 6 psig versus 1 psig had put the alarm out of calibration in a non-conservative direction. The control room crew did not have a control at hand to terminate directly the draindown, but relied on a local operator in the containment building to manually open ard close the valve. The human-17 l
l
I .'
machine interface was not sufficient to provide reliable, independent support of the operation.
2.3.7 [ punitive Errors There were several instances of cognitive errors, where the person involved took data, manipulated. (or transformed) the data via calculations, and came up with an incorrect answer. One example of such a cognitive error is the SMs calculation of "30 minutes remaining" until the draindown was comnlete. In this case, the SM used a nonconservative conversion factor (compared to what SEs had used in previous draindowns). There was also a error in not identifying that the _ cold calculation (percentage) for the water level had changed from when it was initially reported at 21% to 19% when the draining began. However, the 2% change in starting volume was an insignificant factor when compared with the error introduced by using a nonconservative conversion factor. It should be.noted that the conversion factor used by the SM was from the plant tank book and was technically accurate.
Another cognitive factor that continued through a portion of the event cancerncd the error in calculation of actual level from the level reading from the tygon tube. There were several sources of error. As noted earlier, the calculations were made and significant rcunding-off errors were introduced.
There was no evidence-that'the. crew was aware of the discrepancies between the calculated water level and what would have been expected from the draining process.
Calculations were made and accepted without technical support personnel in the-control room or clear procedure guidance. As a result, there was no opportunity to catch the calculation errors before they were used to support the draindown.
The relative unreliabilty of the cognitive actions in this event is more representative of general knowledge-based behavior than it is a reflection on the operators involved (Rasmussen 1983). Planned operations are most reliable if the procedures preclude the need for knowledge-based behavior.
18 l
____m_______.__._______.-__ _ . _ . _ - _ . _ . .
- . = .
2.3.8 administrative Controls Durina Shutdown This event illustrates the dependence of the control of shutdown risk upon administrative controls. The draindown evolution was performed while the plant was shutdown. During shutdown, the primary means for risk control are thrnugh administrative controls and not through automatic, pre-established control s . In this instance, there were abnormal and emergency procedures available for shutdown cooling, however it has been observed that having shutdown emergency procedures is an exception. Therefore, the control of risk durir.g shutdown, relies directly on human performance. Performance during shutdown can be characterized by manual actions, with limited equipment, procedures, and training to support the actions. Many of these characteristics of shutdown are illustrated in this event. For example, the procedure 02 contained only limited information about the control of nitrogen pressure during the activity. Training did not provide sufficient proficiency in draindown and related activities such as calculations of actual level. No simulator training was available because the midivop level condition is not simulated. The extra R0s and the SE were considered proficient because of experience (not training) and this assumption may have had only limited justification. The loss of shutdown cooling occurred after a series of degradations in safety barriers that were intended to prevent a loss of shutdown cooling. Therefore, human performance issues art ;f particular concern during-shutdown activities because of the limited support systems provided-and the reliance on administrative control-of risk.
3.0 REFERENCES
L J. Rasmussen, " Skills, Rules, and Knowledge: Signals, Signs and Symbols, and
~
Other Distinctions in Performance Models," IEEE Transactions on Systems. Man, and Cybernetics. Vol . SMC-13, No.3.1983, pp.257-266.
l l
19 l
l
Appendix A Control Room Calculation examole Given:
1 psig = 2.307 ft (correction factor)
Tygon tube level = 740 ft 2 in.
PRT pressure = 5.8 psig n Correction level = PRT pressure x correction factor
= 5.8 psig x 2.307 ft/psig
= 13.38 ft
= 13 ft (0.38 x 12) in. '
= 13 ft 4.6 in.
Actual leve' = tygon tube - correction level
= 740 ft 2 in. - 13 ft 4.6 in. (
= 726 ft 9.4 in.
Recuired Trainino Calculation Methodplogy Given:
Tygon tube levnl = 740 ft 2 in.
PRT pressure = 0.5 psig 20
.. . . o-Calculation:
Correction level = 1 ft 2 in. (Table 4 of procedure)
Actual level = 740 ft 2 in. -
1 ft2 in.
= 739 ft.
Eltif,_t Manaaer T_true calculation Total to be drained (procedure D2 5.3.3) = 24925 '.;
Volume drained 37.5% (tank level) x 622 gal /% = 3 ' S g .i -
Volume remaining to be drained = 1590 gal Drain rate (assumed) = 50 gpm ,
Time left 1590 gal /50 gpm = 32 min.
Previous Drain ypwns (SE Calculation)
SE used a conversion of 637 gal /% .
Volume drained 37.5% (tank level) x 637 gal /% = 23888 gal
-Volume to be drained = 1028 gal Time left 1027 gal /50 gpm = 21 min.
21
l I
Shift Manager (Shift. Technical Adviscr)
SR0 - 3 yrs.
l Unit 1 Unit 2 Shift Supervisor Shift Supervisor SR0 - 4 yrs.
Unit 1 Crew Extra Gutage Crew Unit 2 m
~ 3 Reactor Operators Duty Lead R0 RO - 2 to 5 yrs RO - 2 yrs.
I i
Containment Building Unit 2 Operators Reactor Operator Note 1: The shift manager and shift supervisor had beM in charge of the Crew for 6 months.
Note 2: Th Extra R0s had worked this shift the previous 7 nights.
Note 3: The position - time stated are years licensed at that level. Position-time licensed information -
is not givee for personnel that were not intereiewed.
Figure 1. Prairie Island Control Room Staffing.
l
i i
I i
l l
i I FEB 21,1992 .
! SELECT FUNC. KEY OR TURN-OH CODE 1 1': 5 8 : 1 1
! D2 - REDUCED INVENTORY 2,9PSIG *-"**** ,
tw nasse ov-sasse h se l -gg os ws% ,
]
r 22 w~""*"' e X am e
' "o - -s. .,
" ' ~ ~ ' = _-s,.
RHR Rummm1H N-maams vg ov-sseee PUt1PS wyg, sw e sr ms
{ ew-ma n re T/C 120F s.v o.a Acs we '
U8 li*r
= 4---A- :: 54 'N, .
/ ~Tfy--eaee$a Tc=S 161PSIG ,_,,,,.y gg-a-m w me e W-mensa o
p
..-r a..._ 3. _ 2 _- 25.
7a** e.s -
so.s - 1380- 208 ro ~
" ..s 30 -
c-.--__%-___-- z _- - - - ne _ - __1 g-_ v _%. -= 1 ese - 15e tem > e.s 20 -
500 100 e.s 7eas e.s e 8__ _ 50
. . . es. . . . . . ' '
as" " '
'to" '
--s - ' =
axmma H 21 ten 12SF
K B O = HOR t1RL tt10DE= COLD SHUTDOWN UE-98 Figure 2. Emergency Response Computer System.
carmon h
. A>-
y O /' L
/1 c< 756' 9' IRESSUD:7ER SG TUBES T 738' 9'
\ () g COLD EG tOZZE CW" ~
D 'O {
725 4.25' IO UG F
20 (out)
HOI EG tJCEZE CAM OJRE NME
~
Figure 3. Prairie Island RCS Elevations. .
. . - _ _ _ _ _ _ . _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ - _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . . _ _ . - . _ _ _ . -