ML20150B595
| ML20150B595 | |
| Person / Time | |
|---|---|
| Site: | Farley  |
| Issue date: | 02/08/1988 |
| From: | Shymlock M, Stadler S NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| To: | |
| Shared Package | |
| ML20150B585 | List: |
| References | |
| 50-348-87-35, 50-364-87-35, NUDOCS 8803170072 | |
| Download: ML20150B595 (13) | |
See also: IR 05000348/1987035
Text
__ ___________- _ _
..
..
CM{Cuq
.
uni?ED STATES
,'
jo,,
MUCLEAR REGULATORY COMMISSION
-
,
\\
REGION 11
o
7
'j
101 MARIETTA STREET,N.W.
- f
ATL ANT A, GEORGI A 30323
'
%g . . . . . j
-
(
Report Nos.: 50-348/87-35 and 50-364/87-35
l.
Licensee: Alabama Power Company
600 North 18th Street
Birmingham, AL 35291-0400
i
Docket Nos.: 50-348 and 50-364
License Nos.:
Facility Name:
Farley 1 and 2
Inspection Conducted:
December 2-4, 1987
Inspector:
(,b.
2 /T /gl'
.
S. Stadler, Team Leader
Date Signed
1
l
Accompanying Personnel:
P. Moore
i
l
T. O'Connor
l
L. Watson
I
Approved by:
Y
YN
7 [ /988
M. Shymlock, C Uef
Date Signed
j
Ooerational Programs Section
i
'
Division of Reactor Safety
SUMMARY
Scope:
This reactive, unannou< iced inspection was conducted to assess licensee
actions in response to an event which occurred on November 27, 1987, involving
a spill inside containment from the residual heat removal (RHR) system.
Results:
One violation was identified involving)two examples of failure to
im:)1ement procedures (paragraph 7 ..
No deviations were
l
establish and
identified.
8803170072 880219
ADOCK 05000348
G
_
_ - _ _
_ _ - _ - _ _ _ _ _ _ _ _ _ _
__
_
__
.
,_.
+
.
,
,_
-
.
.
.
.
'
REPORT DETAILS
1.
Persons Contacted
Licensee Employees
- R. Hill, Operations Manager
- D. Morey, Assistant General Manager - Operations
- J. Osteaholtz, Supervisor - Safety System Analysis and Engineering
- W. Shipman, Assistant General Manager - Support
- J. Thomas, Maintenance Manager
- L. Williams, Training Manager
- J. Woodard, General Manager
Other licensee employees contacted included cra ftsmen, engineers,
technicians, operators, mechanics, and office personnel.
i
NRC Resident Inspector
i
- B.
Miller
,
- Attended exit interview on December 4,1987.
,
2.
Exit Interview
The inspection scope and findings were summarized on December 4,1987,
with those persons indicated in paragraph 1 above.
The inspector
described the areas inspected and discussed in detail the following
'
inspection findings.
'
t
(0 pen) Violation 364/87-35-01.
Failure to maintain and implement
procedures for the use of "NA", the control of procedure deviations,
and the restoration of an RHR train to service.
(paragraph 7)
(0 pen) Unresolved Item 348,364/87-35-02. Control of maintenance and
tagging activities.- (paragraph 8)
i
No dissenting comments were received from the licensee.
The licensee did
i
not identify as proprietary any of the materials provided to or reviewed
by the inspe: tors during this inspection.
3.
Licensee Action on Previous Enforcement Matters
This subject was not addressed in the inspection.
4.
Unresolved Items *
One unresolved item was identified during this inspection concerning
control of maintenance and tagging activities (paragraph 8).
i
- An Unresolved Item is a matter about which more information is required to
,
determine whether it is acceptable or may involve a violation or deviation.
i
t
. . ,
- . ,
,-
- . - -
,- -
,
. - -
_ ,
-
- . - . - , , ~ .
.
._
.:
,
.
.
,
~
.
,
,
j
-
2
.
S.
Sequence of Events
On November 27
1987, Unit 2 was start lng up in Mode 5, and approaching
Mode 4.
Reactor. coolant system (RCS) conditions were approximately 192 F
and 380 psig, with both trains of the RHR in operation. Two maintenance-
work request (MWRs) requiring stroke-time testing of the "A" train RHR
containment sump isolation valves 8811A (outboard) and 8812A. (inboard)
remained to be completed.
. At approximately- 4:45 a.m. operators were
directed to perfonn these tests utilizing surveillance test procedure
(STP) FNP-2-STP-11.6, Residual Heat Removal Inservice Test.
STP-11.6 is normally accomplished quarterly to stroke test a large number
of valves
within the RHR system.
For this particular application, all
RHR valves except 8811A and 8812A were "NA'd" as not applicable.
Initial
condition 3.2 of the procedure required that thr: train to be tested not
be in operation and that the system be aligned per system operating
procedure (S0P) FNP-2-S0P 7-0, Residual Heat Removal. System.
S0P 7-0
required the pump suction isolation valves, 8701A and 8701B, be in the
closed position.
The Shift Supervisor "NA'd" initial condition 3.2, thus
allowing the containment sump valves to be stroke tested with the "A"
train of RHR in operation and with isolation valves 8701A and 8710B in the
open position.
When the operator opened the inboard 8812A for testing,
RCS pressure and pressurizer level rapf dly decreased.
The operator
immediately reclosed the valve and noted RCS pressure to be approximately
300 psig. With the valve closed, pressurizer level continued to decrease
reaching a minimum level of zero percent on the narrow range hot
calibrated indication and approximately three percent on the wide range
cold calibrated instrument.
In addition, the pressurizer relief tank'
(PRT) level, pressure, and temperature indicators were rapidly increasing
causing control room alarms within about two minutes.
PRT pressure
increased to 100 psig and then dropped to zero psig indicating the PRT
rupture disc had ruptured.
Based on the available indications and the valve evolution that had taken
place, the Shift Supervisor diagnosed that the
"A" RHR train suction
relief valve 8706A lifted and stuck open.
The Shift-Supervisor directed
operators
to trip the "A" RHR pump and to close suction isolation valves
8701A and 8701B to isolate the RCS leakage. The Shift Supervisor noted an
increased waste processing sump level of approximately 1.5 feet and
directed operators to evacuate personnel from containment.
With the RCS leakage isolated, the Shift Supervisor initiated efforts to
restore pressurizer level.
The normal charging path.was tagged-out for
valve maintenance requiring the use of either flow through the boron
injection tank (BIT) or the BIT bypass.
The BIT is no longer borated
above nominal injection water boration levels at the Farley facility. Due
to a much lower flow rate and a desire not to cause a low volume control
-
tank (VCT) level, the Shift Supervisor elected-to utilize the BIT bypass
!
I
'
,
- -
.
..
-.
_
.
.
.
'
-
.
.
.
'
3
.
flowpath.
The initial flow through the bypass, however, was still too
high resulting in a low VCT level and a subsequent transfer to the
refueling water storage tank . (RWST).
The operators retransferred the
suction to the VCT and began restoring pressurizer level.
At approxi-
mately 18 percent on the cold-calibrated instrumentation, the hot-
calibrated instruments returned to scale and the pressurizer heaters
were reenergized.
Normal pressurizer level was restored within
approximately 35 minutes into the event.
During this time period, operators attempted to drain the PRT level but
were unable to operate the drain valve due to a lack of control power and
position light indication.
An MWR had been written earlier in the shift
due to a loss of control indication lights on the valve.
Instrumentation
,
and control (I&C) technicians were directed to expeditiously ) implement the
MWR (bypassing the normal MWR processing and planning route .
The lac
technicians replaced a blown control power fuse and the operators were
then able to open the valve and drain the PRT.
The Operations staff dispatched operators into containment to verify that
the outbocrd containment sump valve, 8811A, had not been partially opened
or had leaked by.
There were no indications of water in the area of the
containment sump indicating that 8811A was fully closed.
The licensee
also directed personnel to walk down the
"A" RHR system to ensure that a
!
suspected pressure surge had not resulted in damage to components,
instrumentation, pipe hangers, etc.
Upon completion of the system
walkdown, the licensee concluded that no damage had occurred.
Independent
walkdowns of portions of the system by an NRC inspector also confirmed
these conclusions.
6.
Event Analysis
The licensee's initial report on this event indicated that when the
containment sump valve was stroke tested with the
"A" RHR train in
operation, a void downstream of the valve may have initiated a pressure
surge.
The pressure surge may have then caused the "A" train suction
relief valve to lift and stick open, allowing RCS water to discharge to
the PRT.
The initial report also indicated that the rupture of the PRT
e
rupture disc resulted in approximately 5000 gallons of water being
i
discharged to the containment floor sump.
The amount of water discharged
-
through the rupture disc was later determined to be approximately 2200
-
gallons.
The inspection team arrived on site on December 2,1987.
The initial
licensee briefing indicated that subsequent evaluations supported the
conclusions conveyed in the initial notification report to the NRC.
The
incident investigation was being conducted by the Operations staff.
The
"A" RHR suction relief valve had been removed for analysis and replaced by
an operable relief valve from stock.
I
t'
-.
-
.
.
,
'
.
.
'
4
.
Aftcr the initial briefing, the inspectors and members of the licensee's
Operations and Training staffs attempted to reproduce this event on the
simulator.
As anticipated, the simulator modeling would not allow
duplication of opening the containment sump valve with a resultant
pressure surge and relief valve opening.
The simulator instructors were
able, however, to simulate the stuck open relief valve with RCS conditions
of approximately 192' F and 380 psig.
With the relief valve open, the RCS
pressure and pressurizer level began decreasing. Within approximately 60
seconds, the pressurizer heaters tripped on' low pressurizer level.
pressure also decreased but at a significantly slower rate than observed
during the actual event.
RCS pressure after approximately 2 minutes was
,
360 psig versus 300 psig during the event.
Pressurizer level and pressure
also began decreasing but also at a slower rate.
Attainment of 100 psig
in the PRT and subsequent rupture of the PRT disc did not occur for
approximately 10 minutes into the simulation.
1
The simulator instructors subsequently simulated both the
"A"
and "B"
suction relief valves in the open positions.
The rate of pressurizer
level decrease, RCS pressure decrease, and PRT level and pressure increase
under these conditions more closely resembled the actual plant transient.
At the request of the inspectors, the instructors also simulated partial
opening of the outboard containment sump isolation valve, 8811A, and then
opening of the 8812A valve.
This evaluation was utilized to determine if
a leaking 8811A valve in conjunction with the 8812A valve open could have
initiated this event.
This scenario did not result in any resemblance to
the transient that was observed during this event.
,
1
Operations personnel interviewed indicated several possible causes for
the suspected pressure surge and initial lifting of the RHR suction relief
valve. All of these theories centered around a suspected void between the
,
containment sump isolation valves 8811A and 8812A.
The most popular
theory appeared to be that when 8812A was opened, the void between the
valves was compressed resulting in a decrease in the RHR pump suction
pressure.
Upon maximum compression of the void, a pressure surge resulted
-
which propogated through the system causing the relief valve to lift.
.
There are still several circumstances, however, which discredit this
theory.
The "A" suction relief valve had recently passed a bench test
lifting at the required 450 psig Technical Specification setpoint and
'
reinstalled.
Subsequent to this event, this relief valve was again
removed and bench tested, lifting at the required 450 psig setpoint.
It
was noted, however, that initial attempts at bench testing were
,
unsuccessful due to the valves failure to properly reseat.
A review
1
<
of the RCS pressure strip chart during the event period indicated that the
RCS pressure never exceeded approximately 400 psig, 50 psig less than the
relief valve setpoint.
Operators also indicated that they never received
the "Solid RCS Pressure Hi" alarm.
The setpoint for this alarm is 440
psig.
In addition, the distance between valve 8812A and the suction
relief valve is extensive with many elbows and elevation changes in
between which would have _significantly dampened a pressure surge
,
sensed by the relief valve.
j
!
!
- l
-
.
,_.
._
_
_
_
__
~
.
.
,
,
.
.
'
5
.
~
Several Operations personnel interviewed also expre'ssed the theory that
the RHR pump suction pressure due to the suspected void
the decreat.
'l
resulted in flashing of the fluid and lifting of the ' relief valve. With
the RCS temperature at 192'F and RCS pressure 330 psig, the RCS pressure
would had to have decreased substantially for flashing to occur.
In
addition, the operators did not observe any indication of pump cavitation.
The third scenario indicated by plant personnel was that the void resulted
in train "A" of RHR decreasing to approximately 50 psig less than train
"B".
The higher pressure in the "B" train pump discharge then slammed
shut the check valve on the discharge of the
"A"
RHR pump.
The "A"
and
"B" RHR trains are cross connected through valves 8887A and 88878. With
the check valve closed, the "A" minimum flow valve FCV-602A would open
putting discharge pressure back to the suctions of the pump and lifting
the relief valve.
This minimum flow line, however, is designed to ensure
pump flow, and the functioning of FCV-602A in the past has not resulted in
the relief valve lifting.
This minimum flow line is also equipped with
an orifice which should reduce pressure going back to the suction of the
pump and prevent relief valve operation.
In an effort to detennine the source of the suspected void, the inspectors
noted that a local leak rate test (LLRT) had been performed between valves
8811A and 8812A on November 16, 1987.
The clearance (87-1514-2) and test
package associated with this LLRT directed technicians to:
allow operators to drain areas between valves 8811A and 8812A
-
pressurize between the two valves to 49 psig with nitrogen and
-
conduct the LLRT,
vent off the nitrogen, and
-
close vents and drains and return control to Operations.
-
The clearance and test package did not contain directions to fill and vent
the six foot eight inch section of 14 inch pipe between the two isolation
valves after the test.
Interviews with Operations and test personnel and
a review of logs and records indicated that the area between valves 8811A
and 8812A was never filled with water and vented prior to the November 27,
1987 event.
The licensee's investigation concurred with this determina-
tion.
The fatiure to fill and vent this area between the two valves
established a void in the pipe, and appears to have been the major
contributing cause to the event.
,
This large void also had the potential to cause damage to, and a loss
of, the RHR system during a LOCA event.
During a large break LOCA the
containment sump would fill with water up to the outboard containment
isolation valve, 8811A.
When automatic transfer to the containment sump
suction on low RWST level occurs, this void would then be introduced into
the suction of the RHR system.
The effects of such a void under these
conditions should be evaluated for potential damage to the system due to
water hammer, relief valve lift and failure, and vortexing and cavitation
.
,
-
.
.
,
,
,
.
.
'
6
.
of the RHR pump.
IE Information Notice 87-10, Potential for Water Hammer
During Restart of RHR Pumps, warned Boiling Water Reactor (BWR) facilities
of the potential water hammer damage on restart of RHR systems.
The
source of the water hammer was the draining of portions of the RHR lines
while shutdown resulting in voids and severe water hamer upon system
restart.
NRC Analysis and Evaluation of Operational Data (AE00)
Engineering Evaluation E309, April 1983, also addressed this problem at
BWR facilities.
Water hammer damage in a PWR secondary system was
addressed in NUREG-1190 and Generic Letter 86-07 which discussed the San
Onofre Unit 1 November 21, 1985 event.
Due to these safety concerns, the
licensee is encouraged to enlist the tissistance of their plant or
corporate engineering staffs in the analysis of this E. vent and to ensure
adequate short and long-term corrective actions.
7.
Administrative Control
The licensee's failure to establish adequate administrative controls, or
to implement existing procedural controls, appeared to have contributed
significantly to this event.
In addition, the control of post-maintenance
testing including scheduling, return to service, and the interface between
Operations and Engineering / Planning appeared to be deficient.
During the Unit 2 refueling outage, maintenance work was completed on the
outboard containment sump isolation valve 8811A.
Additionally, contain-
ment sump isolation valve 8812A Limitorque motor operator was opened to
replace non-environmently qualified jumper wires under clearance
87-1204-2.
The instructions to stroke-time test valve 8812A were written
in Section 48, Test and Restoration, of the clearance.
The instructions
required verification of valve stroke time per, continuation sheet 4 of 5
.
and FNP-2-STP-11.6, Residual Heat Removal Valves Inservice Test.
The licensee's administrative procedure FNP-0-AP-52, Equipment Status
Control and Maintenance Authorization, Section 6.1, indicates that the
planning and scheduling group will be responsible for scheduling
maintenance activities.
"Planners will provide job sequence planning
which will include:
applicable prints, technical manuals, and procedures;
J
proper plant conditions including any necessary pre-testing and
clearances; identification of Limiting Conditions for Operation and/or
radiation work permits if applicable; parts needed
and parts available;
1
1
testing necessary for functional acceptance; and restoration."
This
procedure did not appear to be fully implemented for the stroke-time
'
testing of valves 8811A and 8812A in that the clearance did not establish
the conditions necessary for testing including the requirement that the
RHR "A" train be out of service with the suction valves closed.
Section 3.1.2 of administrative procedure FNP-0-AP-5, Surveillance Program
Administrative Control, indicates that the Planning Supervisor is
responsible for scheduling all surveillance testing.
The clearance also
did not establish a testing schedule such as a specific date and time or
operational mode.
As a result, the stroke-time testing was not completed
until November 27, seven days after the work on valver_8811A and 8812A was
,
completed.
_
,- -
-
.
.
.
,
.
.
'
7
.
By the time that the Shift Supervisor noted these uncompleted test
requests, Unit 2 was approaching Mode 4 with the RCS at approximately
192 F and 380 psig and both trains of RHR in service.
At this point,
compliance with initial condition 3.2 of STP-11.6 would have required the
shifting of cooling loads from the "A" to the "B" train, shutting down the
"A" train, and closing the
"A" RHR pump suction isolation valves.
The
Shift Supervisor reviewed the RHR drawing and since the valve to be
stroke-tested was not in the main flowpath, determined that it was not
necessary to comply with initial condition 3.2 of STP-11.6.
Although a
licensed operator questioned the advisability of perfonning the valve
tests with the "A" train in operation, the Shift Supervisor elected to
"NA" initial condition 3.2 in a manner similar to the "NA" utilized for
all the unnecessary individual steps in STP-11.6.
Administrative procedure FNP-0-AP-1, Development, Review and Approval of
Plant Procedures, Surveillance Program Administrative Control Section
3.4.7, defines initial conditions as "independent actions which shall be
completed and plant conditions which shall exist prior to procedure use."
Additionally, FNP-0-AP-5, Section 7.2,
requires that surveillance
procedures will include conditions that must exist prior to a test
including initial conditions.
Neither of these procedures, or other
existing licensee procedures, addressed the use of "NA" entries in system
operating or surveillance procedures, and particularly the use of "NA" to
omit procedure system initial conditions.
The only procedural guidance and controls that appeared to be established
over the use of "NAs" in procedures appeared to be in the unit operating
procedures (U0Ps) such as U0P-1.1, Startup of Unit From Cold Shutdown to
Hot Standby.
Due to the many plant conditions that can exist on a
startup, these procedures allow the Shift Supervisor to
"NA"
non-applicable initial conditions.
Unit operating procedures are
generally considered guidelines at most facilities and do not require
verbatim compliance as do operating and surveillance procedures.
Clearly, if only one section of a surveillance procedure is utilized, as
it was in
STP-11.6, the rest of the steps which are not utilized need to
be marked not applicable as well as any step specific precautions,
limitations, or initial conditions for steps not performed.
An example
would be initial condition 3.3 of STP-11.6 which is applicable only to
encapsulated valves.
Since valve 8812A is not encapsulated, this
particular initial condition would not be applicable.
This lack of administrative controls over the use of "NA" in surveillance
and operating procedures was also exhibited in several other areas
associated with this event.
The procedure steps not utilized in STP-11.6
were "NA'd" without initials to document the author, and the data page
contained "NAs" without initials and with curved arrows down through
various steps to be "NA'd".
In addition, licensed reactor operators and
senior operators interviewed felt that operators could "NA" procedures,
while Operations management indicated only Shift Supervisors had this
perogative.
<
,
,
~
.
.
.
~
8
.
In the absence of defined procedural guidance on the use of "NAs", the
Shift Supervisor evaluated the test to be accomplished and determined that
the RHR system being in operation would not present a problem.
Had, in
. fact, the void not been in existence between valves 8811A and 8812A and
the subsequent suction relief valve had not failed, the testing of the
valves with the "A" RHR train in service may not have caused a problem.
There are three significant concerns with this deviation from an initial
condition of an approved procedure.
First, the Shift Supervisor was not
aware of the basis for this particular initial condition requirement. The
licensee indicated that the basis for initial condition 3.2 of STP-11.6
was not for concern of potential voiding and resultant pressure surge or
water hammer damage.
The requirement for the system to be shutdown during
stroke-time testing was, according to the licensee, to prevent discharging
RCS coolant to the containment sump should the outboard isolation valve
leak while testing the inboard valve.
The containment sump is normally
dry during non-LOCA conditions.
Since it would be very difficult for a
Shift Supervisor or operator to be cognizant of the basis behind all
procedural precautions, limitations and initial conditions, departure from
these requirements should receive adequate review to ensure that the
deviation would not potentially degrade the operability of the system or
validity of the surveillance test.
The second concern is that the licensee's approved procedures, in place at
the time of this event, did not appear to permit this deviation.
FNP-0-AP-6, Procedure Adherence, Section 3.0, requires adherence to all
plant procedures except under emergency conditions or a temporary
procedure change as allowed by FNP-0-AP-1, Development, Review and
Approval of Plant Procedures.
FNP-0-AP-1 and Technical Specification 6.5.3.1 allow temporary changes to procedures which clearly do not change
the intent of the procedure.
These temporary changes must be approved by
two members of the plant staff, at least one of whom holds an SR0 license.
FNP-0-AP-16, Conduct of Operations, Section 5.5, defines a temporary
procedure change as applicable to a system not performing in a manner
covered by existing procedures or in such a manner that portions of
existing procedures do not apply.
FNP-0-AP-16 also requires that plant
procedures shall be adhered to in the conduct of all plant operations
except where adherence to the procedures will create an undue hazard to
personnel, equipment, or public health and safety.
FNP-0-AP-57,
,
Preservice and Inservice Inspections, Section 4.12, requires Operations to
perform inservice testing in accordance with plant procedures.
'
FNP-0-AP-5, Surveillance Program Administrative Control, Section 3.2.4,
requires that each group will ensure that test procedures are performed as
written.
In the deviation from initial condition 3.2 of STP-11.6 on
November 27, 1987, a plant emergency did not exist, and the deviation was
not processed as a temporary procedure change.
The licensee indicated
that they believed that even if the deviation had been treated as a
j
temporary change, the required second approval would have probably been
j
i
l
.
i
'
.-
.
,
.
.
'
9
obtained and the results would have remained the same. This conclusion is
difficult to ascertain after the fact, but the . reactor operator did
question the decision at the time, and an SR0 licensed staff member on
shift during the event indicated that he would have been reluctant to
approve the "NA" of an initial condition.
The failure to provide adequate administrative controls over the use of
"NA" in approved procedures, and the failure to comply with existing
administrative controls in deviating from an approved procedure, is a
violation (364/87-35-01).
The third concern associated with the utilization of STP-11.6 for stroke
testing valves 8811A and 8812A is that step 5.1.5 does not stipulate the
sequence in which the two valves should be cycled, or for fill and vent
following testing.
Due to the piping configuration, it appears that
cycling of the 8811A and 8812A valves, regardless of sequence, could lead
to the establishment of a void.
With 8812A and 8811A closed, this void
would be trapped until the automatic transfer of RHR from the RWST to the
containment sump under LOCA conditions.
Therefore, upon completion of the
valve testing, filling and venting may be required to eliminate the
possibility of a void and the potential for water hammer and system damage.
Operators interviewed indicated that the only reason they elected to test
8812A before 8811A was that 8812A required local visual verification
(non-encapsulated) and an operator was already in the area. The licensee
should review this procedure to determine whether a sequence should be
specified, or whether post-testing fill and vent is required following
stroke testing of these valves.
As addressed in paragraph 6 of this inspection report, one of the primary
contributing causes of this event appears to be an air void trapped in
approximately 7 feet of piping between valves 8811A and 8812A.
Due to
work on these containment isolation valves during the Unit 2 outage, a
local leak rete test (LLRT) was required under the licensee's inservice
valve testing program. The leak rate test was performed by the test group
under clearance 87-1514-2 on November 16, 1987.
The continuation sheet
associated with this clearance directed operators to drain the section of
!
piping between the valves.
The technicians were then directed to
pressurize the area to 49 psig with nitrogen, perform the LLRT, vent off
the nitrogen, and turn the system back to Operations for functional
restoration.
FNP-0-AP-52, Section 6.1 requires planners to provide
directions for functional acceptance testing and for restoration to
service.
FNP-0-AP-5, Section 7.2.8,
requires that instructions be
provided for returning equipment and systems tested to a normal operating
status.
Instructions for the return to service of the portion of the RhR
"A" train system between valves 8811A and 8812A were not provided on
_
_
_
_
'
,
'
a
.
~
10
November 16, 1987, and the clearance did not reference an approved
procedure for this purpose.
The system was turned over to Operations for
restoration to service and Operations failed to ensure the area between
the valves was properly filled and vented.
As previously addressed there is also a potential that this trapped void
could have resulted in a loss of the RHR "A" train during LOCA conditions
either due to water hammer damage or due to a stuck-open suction relief
valve.
The failure to provide adequate procedural guidance for the
restoration of the "A" RHR train to service and to ensure fill and vent is
an example of violation (328/87-35-01).
This event highlights a need for the licensee to increase their
management controls over post-maintenance and surveillance testing and to
improve the interface between the testing group, the work planners, and
Operations.
Existing procedures require the planners to provide
applicable permits, procedures, proper plant conditions, Limiting
Conditions for Operation (LCOs), functional acceptance testing, and
directions for restoration to service.
In actual practice, the licensee
generally prefers to turn the system or equipment over to Operations
following test completion.
Operations then determines the method of
system restoration.
In addition, the licensee utilizes a surveillance
procedure covering the entire system to perform post-maintenance testing
on a small portion of the system (in this case two valves) versus writing
a specific post-maintenance test procedure or instruction.
This
methodology requires Operations to "NA" numerous other steps within the
surveillance procedure, a practice, which in this case, was extended to a
procedure initial condition.
The scheduling of post-maintenance testing also appears to require improve-
ment.
In this particular case the work on valvas 8811A and 8812A was
completed on November 20 while the plant was still in an outage.
Since
the clearance did not rpecify a date, time or plant mode for the
stroke-time testing, the testing did not occur until November 27 with the
plant approaching Mode 4 operation.
With all the activities required to
support plant start-up and both trains of RHR already in operation, this
lack of specific scheduling appears to have contributed to the decision to
test the valves with the "A" train in operation.
8.
Control of Maintenance and Tagging Evolutions
In May 1986, inspectors
conducted a reactive inspection to review the
circumstances surrounding a wrong unit / wrong train tagging error involving
the RHR system (Inspection Report 348, 364/86-10).
As part of this
inspection, the inspectors reviewed the licensee's incident reports
(potential reportable events)
for 1985 and 1986.
This review noted
approximately 33 personnel errors associated with maintenance activities
including tagging and wrong train / wrong equipment errors.
The licensee
subsequently determined that 18 of these errors were significant enough to
,
-
.
.- _ ________
'
.
'
a.
,
.
11
require additional corrective actions such as additional training,
required reading, and prucedure changes.
The inspection report identified-
two causes which appeared to contribute to the apparent continuing level
of similar personnel errors:
Inadequate specific directions on the maintenance work requests,.
-
and
I
Each event appeared to be treated as an isolated event without
-
adequate trending of similar events and errors or. programmatic
corrective actions.
The cover letter associated with the escalated enforcement for the RHR
wrong unit / wrong train event requested the licensee's response to describe
the particular actions for improving performance in this area.
The
licensee's response, in addition to event specific corrective actions such
as color coding and labeling of unit access doors, indicated that:
each incident involving personnel error would be investigated
-
individually.
corrective actions would be taken for each case as required.
-
corrective actions would include counseling or retraining of
-
appropriate individuals and revision of appropriate procedures.
l
As part of this inspection of the RHR event of November 27, 1987, the
inspectors briefly reviewed recent event reports in the area of
maintenance and tagging personnel errors.
Although the scope of this
,
review was significantly less than that conducted by inspectors in 1986,
the following similar personnel errors were noted:
a.
On November 9,1987, while working on a system relief valve for the
Unit 2 "A" train RHR pump, the "B" train relief valve drains were
inadvertently opened by a maintenance journeyman resulting in a
discharge of water.
b.
On November 9,1987, two maintenance personnel disassembled the Unit
2 "A" train seal injection return filter outlet valve instead of the
"B" train valve. The wrong valve was disassembled even through three
protective red tags were attached to the valve to prevent manipula-
tion.
c.
On November 27, 1987, during replacement of the Unit 2 "A" train RHR
suction relief valve, as a result of the relief valve failure earlier
on November 27, PRT level was inadvertently raised by operators
resulting in a discharge of 400 gallons of water to containment.
1
1
- .
_
-,
.
.
,-
.
.
'
.
.
12
d.
On October 20, 1987, during recovery from M0 VATS testing on Unit 2
valve LCV-115D (charging system), a second tag on breaker FV-T5 was
removed without adequate review of the MWR and system status
resulting in a discharge of water from open vents.
,
e.
On October 20, 1987, while attempting to restart Unit I charging pump-
IB following electrical maintenance, the pump amps were zero and no
flow was indicated.
Operators opened the breaker door and observed
that the power cables were disconnected even though electrical
maintenance had presented the equipment to the Shift Supervisor for
i
test.
This event is nearly identical to one discussed in Inspection
Report 348, 364/86-10 where electricians signed the MWR request as
i
complete before reconnecting cables, and the maintenaace electrical
foreman signed the work complete without adequate verification of
the work being completed.
f.
On October 13, 1987, electrical maintenance disconnected the Unit 1
"B" train post accident hydrogen recombiner, while the "A" train
recombiner was tagged out resulting in both trains being inoperable
and entry into Technical Specification 3.0.3.
In this event the
licensee indicated that the approved drawings were in error.
g.
On September 3,1986, the Unit 2C diesel generator air dryer outlet
'
valve was found tagged in the wrong position (open vs closed). The
journeyman mechanic had operated the red-tagged valve in violation of
procedures and left the valve open.
The licensee appeared to perform well in the investigation and documenta-
tion of plant events.
Consequently, the licensee believes that this makes
them more vulnerable to criticism in this area.
The inspectors have
continuing concerns, however, that most of these events and errors appear
'
to be preventable; that the corrective actions may be too limited in
scope.
In addition, the licensee does not appear to have increased their
trending capability for tracking personnel errors or repetitive failures
to allow assessment of the need for programatic corrective actions.
l
Many of these personnel errors involve non-licensed maintenance personnel
removing the wrong equipment for work or operating red-tagged valves or
!
breakers.
In addition to the personnel hazards associated with these type
of errors such as pressurized fluids, steam, electricity, and increased
exposure or contamination, a number of the events in 1985, 1986, and 1987,
involved the removal from service of safety-related equipment such as
redundant RHR trains.
This safety-related equipment should be under the
,
strict control of licensed operators to ensure continued operability.
This is particularly important where one train is already out of service
'
for maintenance or repair and an error could result in a loss of both
trains.
Pending further inspection and review of the licensee's
performance and corrective actions in this area, the management
control of maintenance and tagging activities is identified as an
unresolved item (348, 364/87-35-02).
.