ML20150B595

Insp Repts 50-348/87-35 & 50-364/87-35 on 871202-04.One Violation & No Deviations Noted.Major Areas Inspected: Licensee Actions in Response to 871127 Event Involving Spill Inside Containment from RHR Sys

ML20150B595
Person / Time
Site:	Farley
Issue date:	02/08/1988
From:	Shymlock M, Stadler S NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II)
To:
Shared Package
ML20150B585	List: ML20150B581 ML20150B587 ML20150B595
References
50-348-87-35, 50-364-87-35, NUDOCS 8803170072
Download: ML20150B595 (13)

See also: IR 05000348/1987035

Text

__ ___________- _ _

.. ..

CM{Cuq .

uni?ED STATES

-

jo,, MUCLEAR REGULATORY COMMISSION

,

,' \

o REGION 11

7 'j

'

101 MARIETTA STREET,N.W.

ATL ANT A, GEORGI A 30323

-

• f

%g . . . . . j

( Report Nos.: 50-348/87-35 and 50-364/87-35

l. Licensee: Alabama Power Company

600 North 18th Street

Birmingham, AL 35291-0400

i Docket Nos.: 50-348 and 50-364 License Nos.: NPF-2 and NPF-8

Facility Name: Farley 1 and 2

Inspection Conducted: December 2-4, 1987

Inspector: .

(,b. 2 /T /gl'

S. Stadler, Team Leader Date Signed

1

l Accompanying Personnel: P. Moore i

l T. O'Connor  ;

l L. Watson I

Approved by: Y YN 7 [ /988

M. Shymlock, C Uef Date Signed j

Ooerational Programs Section i

Division of Reactor Safety

'

SUMMARY

Scope: This reactive, unannou< iced inspection was conducted to assess licensee

actions in response to an event which occurred on November 27, 1987, involving

a spill inside containment from the residual heat removal (RHR) system.

Results:

establish and One im:)1ement

violation was identified

procedures (paragraph involving)two

7 .. examples of failure

No deviations were to l

identified.

8803170072 880219

PDR ADOCK 05000348

G PDR

_ _ - _ _ _ _ - _ - _ _ _ _ _ _ _ _ _ _

__ _ __ . ,_.

+

. ,

,_

-

.

. .

.

'

REPORT DETAILS

1. Persons Contacted

Licensee Employees

• R. Hill, Operations Manager

• D. Morey, Assistant General Manager - Operations

• J. Osteaholtz, Supervisor - Safety System Analysis and Engineering

• W. Shipman, Assistant General Manager - Support

• J. Thomas, Maintenance Manager

• L. Williams, Training Manager

• J. Woodard, General Manager

Other licensee employees contacted included cra ftsmen, engineers,

technicians, operators, mechanics, and office personnel.

i NRC Resident Inspector i

• B. Miller ,

• Attended exit interview on December 4,1987. ,

2. Exit Interview

The inspection scope and findings were summarized on December 4,1987,

with those persons indicated in paragraph 1 above. The inspector

described the areas inspected and discussed in detail the following '

'

inspection findings.

t

(0 pen) Violation 364/87-35-01. Failure to maintain and implement

procedures for the use of "NA", the control of procedure deviations,

and the restoration of an RHR train to service. (paragraph 7)

(0 pen) Unresolved Item 348,364/87-35-02. Control of maintenance and

tagging activities.- (paragraph 8)

i

No dissenting comments were received from the licensee. The licensee did i

not identify as proprietary any of the materials provided to or reviewed

by the inspe: tors during this inspection.

3. Licensee Action on Previous Enforcement Matters

This subject was not addressed in the inspection.

4. Unresolved Items *

One unresolved item was identified during this inspection concerning

control of maintenance and tagging activities (paragraph 8).

i *An Unresolved Item is a matter about which more information is required to ,

determine whether it is acceptable or may involve a violation or deviation. i

1

t

. . , - . , ,- - . - - ,- - _ , - - . - . - , , ~ . .

._

,

.:

.

.

,

~

, .

,

- j

2

.

l

S. Sequence of Events

On November 27 1987, Unit 2 was start lng up in Mode 5, and approaching

Mode 4. Reactor. coolant system (RCS) conditions were approximately 192 F

and 380 psig, with both trains of the RHR in operation. Two maintenance-

work request (MWRs) requiring stroke-time testing of the "A" train RHR

containment sump isolation valves 8811A (outboard) and 8812A. (inboard)

remained to be completed. . At approximately- 4:45 a.m. operators were

directed to perfonn these tests utilizing surveillance test procedure

(STP) FNP-2-STP-11.6, Residual Heat Removal Inservice Test.

STP-11.6 is normally accomplished quarterly to stroke test a large number

of valves within the RHR system. For this particular application, all

RHR valves except 8811A and 8812A were "NA'd" as not applicable. Initial

condition 3.2 of the procedure required that thr: train to be tested not

be in operation and that the system be aligned per system operating

procedure (S0P) FNP-2-S0P 7-0, Residual Heat Removal. System. S0P 7-0

required the pump suction isolation valves, 8701A and 8701B, be in the

closed position. The Shift Supervisor "NA'd" initial condition 3.2, thus

allowing the containment sump valves to be stroke tested with the "A"

train of RHR in operation and with isolation valves 8701A and 8710B in the

open position. When the operator opened the inboard 8812A for testing,

RCS pressure and pressurizer level rapf dly decreased. The operator

immediately reclosed the valve and noted RCS pressure to be approximately

300 psig. With the valve closed, pressurizer level continued to decrease

reaching a minimum level of zero percent on the narrow range hot

calibrated indication and approximately three percent on the wide range

cold calibrated instrument. In addition, the pressurizer relief tank'

(PRT) level, pressure, and temperature indicators were rapidly increasing

causing control room alarms within about two minutes. PRT pressure

increased to 100 psig and then dropped to zero psig indicating the PRT

rupture disc had ruptured.

Based on the available indications and the valve evolution that had taken

place, the Shift Supervisor diagnosed that the "A" RHR train suction

relief valve 8706A lifted and stuck open. The Shift-Supervisor directed

operators to trip the "A" RHR pump and to close suction isolation valves

8701A and 8701B to isolate the RCS leakage. The Shift Supervisor noted an

increased waste processing sump level of approximately 1.5 feet and

directed operators to evacuate personnel from containment.

With the RCS leakage isolated, the Shift Supervisor initiated efforts to

restore pressurizer level. The normal charging path.was tagged-out for

valve maintenance requiring the use of either flow through the boron

injection tank (BIT) or the BIT bypass. The BIT is no longer borated

above nominal injection water boration levels at the Farley facility. Due

to a much lower flow rate and a desire not to cause a low volume control -

tank (VCT) level, the Shift Supervisor elected-to utilize the BIT bypass

!

I

'

, - - . .. -. _

. . .

'

-

.

. .

'

3

.

flowpath. The initial flow through the bypass, however, was still too

high resulting in a low VCT level and a subsequent transfer to the

refueling water storage tank . (RWST). The operators retransferred the

suction to the VCT and began restoring pressurizer level. At approxi-

mately 18 percent on the cold-calibrated instrumentation, the hot-

calibrated instruments returned to scale and the pressurizer heaters

were reenergized. Normal pressurizer level was restored within

approximately 35 minutes into the event.

During this time period, operators attempted to drain the PRT level but

were unable to operate the drain valve due to a lack of control power and

position light indication. An MWR had been written earlier in the shift

due to a loss of control indication lights on the valve. Instrumentation ,

and

MWRcontrol (I&C)the

(bypassing technicians

normal MWRwere directedand

processing to expeditiously

planning route) .implement

The lac the

technicians replaced a blown control power fuse and the operators were

then able to open the valve and drain the PRT.

The Operations staff dispatched operators into containment to verify that

the outbocrd containment sump valve, 8811A, had not been partially opened

or had leaked by. There were no indications of water in the area of the

containment sump indicating that 8811A was fully closed. The licensee  ;

also directed personnel to walk down the "A" RHR system to ensure that a  !

suspected pressure surge had not resulted in damage to components,

instrumentation, pipe hangers, etc. Upon completion of the system

walkdown, the licensee concluded that no damage had occurred. Independent

walkdowns of portions of the system by an NRC inspector also confirmed

these conclusions.

6. Event Analysis

The licensee's initial report on this event indicated that when the

containment sump valve was stroke tested with the "A" RHR train in

operation, a void downstream of the valve may have initiated a pressure

surge. The pressure surge may have then caused the "A" train suction

relief valve to lift and stick open, allowing RCS water to discharge to

the PRT. The initial report also indicated that the rupture of the PRT e

rupture disc resulted in approximately 5000 gallons of water being i

discharged to the containment floor sump. The amount of water discharged -

through the rupture disc was later determined to be approximately 2200 -

gallons.

The inspection team arrived on site on December 2,1987. The initial

licensee briefing indicated that subsequent evaluations supported the

conclusions conveyed in the initial notification report to the NRC. The

incident investigation was being conducted by the Operations staff. The

"A" RHR suction relief valve had been removed for analysis and replaced by

an operable relief valve from stock.

I

t'

-.

-

. . ,

'

. .

'

4

.

Aftcr the initial briefing, the inspectors and members of the licensee's

Operations and Training staffs attempted to reproduce this event on the

simulator. As anticipated, the simulator modeling would not allow

duplication of opening the containment sump valve with a resultant

pressure surge and relief valve opening. The simulator instructors were

able, however, to simulate the stuck open relief valve with RCS conditions

of approximately 192' F and 380 psig. With the relief valve open, the RCS

pressure and pressurizer level began decreasing. Within approximately 60

seconds, the pressurizer heaters tripped on' low pressurizer level. RCS

pressure also decreased but at a significantly slower rate than observed

during the actual event. RCS pressure after approximately 2 minutes was ,

360 psig versus 300 psig during the event. Pressurizer level and pressure

also began decreasing but also at a slower rate. Attainment of 100 psig

in the PRT and subsequent rupture of the PRT disc did not occur for

approximately 10 minutes into the simulation.

1

The simulator instructors subsequently simulated both the "A" and "B"

suction relief valves in the open positions. The rate of pressurizer

level decrease, RCS pressure decrease, and PRT level and pressure increase

under these conditions more closely resembled the actual plant transient.

At the request of the inspectors, the instructors also simulated partial

opening of the outboard containment sump isolation valve, 8811A, and then

opening of the 8812A valve. This evaluation was utilized to determine if

a leaking 8811A valve in conjunction with the 8812A valve open could have

initiated this event. This scenario did not result in any resemblance to

the transient that was observed during this event. ,

1

Operations personnel interviewed indicated several possible causes for

the suspected pressure surge and initial lifting of the RHR suction relief

valve. All of these theories centered around a suspected void between the ,

containment sump isolation valves 8811A and 8812A. The most popular

theory appeared to be that when 8812A was opened, the void between the

valves was compressed resulting in a decrease in the RHR pump suction -

pressure. Upon maximum compression of the void, a pressure surge resulted

which propogated through the system causing the relief valve to lift. .

There are still several circumstances, however, which discredit this

theory. The "A" suction relief valve had recently passed a bench test

'

lifting at the required 450 psig Technical Specification setpoint and

reinstalled. Subsequent to this event, this relief valve was again

removed and bench tested, lifting at the required 450 psig setpoint. It ,

was noted, however, that initial attempts at bench testing were  !

<

unsuccessful due to the valves failure to properly reseat. A review 1

of the RCS pressure strip chart during the event period indicated that the

RCS pressure never exceeded approximately 400 psig, 50 psig less than the

relief valve setpoint. Operators also indicated that they never received

the "Solid RCS Pressure Hi" alarm. The setpoint for this alarm is 440

psig. In addition, the distance between valve 8812A and the suction

relief valve is extensive with many elbows and elevation changes in

between which would have _significantly dampened a pressure surge ,

sensed by the relief valve. j

l

!

!

l

- . ,_. ._ _ _ _ __

~

. .

,

,

. .

'

5

.

~

Several Operations personnel interviewed also expre'ssed the theory that

the decreat. 'l the RHR pump suction pressure due to the suspected void

resulted in flashing of the fluid and lifting of the ' relief valve. With

the RCS temperature at 192'F and RCS pressure 330 psig, the RCS pressure

would had to have decreased substantially for flashing to occur. In

addition, the operators did not observe any indication of pump cavitation.

The third scenario indicated by plant personnel was that the void resulted

in train "A" of RHR decreasing to approximately 50 psig less than train

"B". The higher pressure in the "B" train pump discharge then slammed

shut the check valve on the discharge of the "A" RHR pump. The "A" and

"B" RHR trains are cross connected through valves 8887A and 88878. With

the check valve closed, the "A" minimum flow valve FCV-602A would open

putting discharge pressure back to the suctions of the pump and lifting

the relief valve. This minimum flow line, however, is designed to ensure

pump flow, and the functioning of FCV-602A in the past has not resulted in

the relief valve lifting. This minimum flow line is also equipped with

an orifice which should reduce pressure going back to the suction of the

pump and prevent relief valve operation.

In an effort to detennine the source of the suspected void, the inspectors

noted that a local leak rate test (LLRT) had been performed between valves

8811A and 8812A on November 16, 1987. The clearance (87-1514-2) and test

package associated with this LLRT directed technicians to:

- allow operators to drain areas between valves 8811A and 8812A

- pressurize between the two valves to 49 psig with nitrogen and

conduct the LLRT,

- vent off the nitrogen, and

- close vents and drains and return control to Operations.

The clearance and test package did not contain directions to fill and vent

the six foot eight inch section of 14 inch pipe between the two isolation

valves after the test. Interviews with Operations and test personnel and

a review of logs and records indicated that the area between valves 8811A

and 8812A was never filled with water and vented prior to the November 27,

1987 event. The licensee's investigation concurred with this determina-

tion. The fatiure to fill and vent this area between the two valves

established a void in the pipe, and appears to have been the major

, contributing cause to the event.

This large void also had the potential to cause damage to, and a loss

of, the RHR system during a LOCA event. During a large break LOCA the

containment sump would fill with water up to the outboard containment

isolation valve, 8811A. When automatic transfer to the containment sump

suction on low RWST level occurs, this void would then be introduced into

the suction of the RHR system. The effects of such a void under these

conditions should be evaluated for potential damage to the system due to

water hammer, relief valve lift and failure, and vortexing and cavitation

.

,

-

. . ,

,

,

. .

'

6

.

of the RHR pump. IE Information Notice 87-10, Potential for Water Hammer

During Restart of RHR Pumps, warned Boiling Water Reactor (BWR) facilities

of the potential water hammer damage on restart of RHR systems. The

source of the water hammer was the draining of portions of the RHR lines

while shutdown resulting in voids and severe water hamer upon system

restart. NRC Analysis and Evaluation of Operational Data (AE00)

Engineering Evaluation E309, April 1983, also addressed this problem at

BWR facilities. Water hammer damage in a PWR secondary system was

addressed in NUREG-1190 and Generic Letter 86-07 which discussed the San

Onofre Unit 1 November 21, 1985 event. Due to these safety concerns, the

licensee is encouraged to enlist the tissistance of their plant or

corporate engineering staffs in the analysis of this E. vent and to ensure

adequate short and long-term corrective actions.

7. Administrative Control

The licensee's failure to establish adequate administrative controls, or

to implement existing procedural controls, appeared to have contributed

significantly to this event. In addition, the control of post-maintenance

testing including scheduling, return to service, and the interface between

Operations and Engineering / Planning appeared to be deficient.

During the Unit 2 refueling outage, maintenance work was completed on the

outboard containment sump isolation valve 8811A. Additionally, contain-

ment sump isolation valve 8812A Limitorque motor operator was opened to

replace non-environmently qualified jumper wires under clearance

87-1204-2. The instructions to stroke-time test valve 8812A were written

in Section 48, Test and Restoration, of the clearance. The instructions

. required verification of valve stroke time per, continuation sheet 4 of 5

and FNP-2-STP-11.6, Residual Heat Removal Valves Inservice Test.

The licensee's administrative procedure FNP-0-AP-52, Equipment Status

Control and Maintenance Authorization, Section 6.1, indicates that the

planning and scheduling group will be responsible for scheduling

maintenance activities. "Planners will provide job sequence planning

which will include: applicable prints, technical manuals, and procedures; J

proper plant conditions including any necessary pre-testing and

clearances; identification of Limiting Conditions for Operation and/or

radiation work permits if applicable; parts needed and parts available; 1

testing necessary for functional acceptance; and restoration." This 1

'

procedure did not appear to be fully implemented for the stroke-time

testing of valves 8811A and 8812A in that the clearance did not establish

the conditions necessary for testing including the requirement that the i

RHR "A" train be out of service with the suction valves closed. I

Section 3.1.2 of administrative procedure FNP-0-AP-5, Surveillance Program l

Administrative Control, indicates that the Planning Supervisor is

responsible for scheduling all surveillance testing. The clearance also

did not establish a testing schedule such as a specific date and time or

operational mode. As a result, the stroke-time testing was not completed

until November 27, seven days after the work on valver_8811A and 8812A was ,

completed. 1

l

l

_ ,- - -

. .

.

,

. .

'

7

.

By the time that the Shift Supervisor noted these uncompleted test

requests, Unit 2 was approaching Mode 4 with the RCS at approximately

192 F and 380 psig and both trains of RHR in service. At this point,

compliance with initial condition 3.2 of STP-11.6 would have required the

shifting of cooling loads from the "A" to the "B" train, shutting down the

"A" train, and closing the "A" RHR pump suction isolation valves. The

Shift Supervisor reviewed the RHR drawing and since the valve to be

stroke-tested was not in the main flowpath, determined that it was not

necessary to comply with initial condition 3.2 of STP-11.6. Although a

licensed operator questioned the advisability of perfonning the valve

tests with the "A" train in operation, the Shift Supervisor elected to

"NA" initial condition 3.2 in a manner similar to the "NA" utilized for

all the unnecessary individual steps in STP-11.6.

Administrative procedure FNP-0-AP-1, Development, Review and Approval of

Plant Procedures, Surveillance Program Administrative Control Section

3.4.7, defines initial conditions as "independent actions which shall be

completed and plant conditions which shall exist prior to procedure use."

Additionally, FNP-0-AP-5, Section 7.2, requires that surveillance

procedures will include conditions that must exist prior to a test

including initial conditions. Neither of these procedures, or other

existing licensee procedures, addressed the use of "NA" entries in system

operating or surveillance procedures, and particularly the use of "NA" to

omit procedure system initial conditions.

The only procedural guidance and controls that appeared to be established

over the use of "NAs" in procedures appeared to be in the unit operating

procedures (U0Ps) such as U0P-1.1, Startup of Unit From Cold Shutdown to

Hot Standby. Due to the many plant conditions that can exist on a

startup, these procedures allow the Shift Supervisor to "NA"

non-applicable initial conditions. Unit operating procedures are

generally considered guidelines at most facilities and do not require

verbatim compliance as do operating and surveillance procedures.

Clearly, if only one section of a surveillance procedure is utilized, as

it was in STP-11.6, the rest of the steps which are not utilized need to

be marked not applicable as well as any step specific precautions,

limitations, or initial conditions for steps not performed. An example

would be initial condition 3.3 of STP-11.6 which is applicable only to

encapsulated valves. Since valve 8812A is not encapsulated, this

particular initial condition would not be applicable.

This lack of administrative controls over the use of "NA" in surveillance

and operating procedures was also exhibited in several other areas

associated with this event. The procedure steps not utilized in STP-11.6

were "NA'd" without initials to document the author, and the data page

contained "NAs" without initials and with curved arrows down through

various steps to be "NA'd". In addition, licensed reactor operators and

senior operators interviewed felt that operators could "NA" procedures,

while Operations management indicated only Shift Supervisors had this

perogative.

,

<

,

~

.

. .

~

8

.

In the absence of defined procedural guidance on the use of "NAs", the

Shift Supervisor evaluated the test to be accomplished and determined that

the RHR system being in operation would not present a problem. Had, in

. fact, the void not been in existence between valves 8811A and 8812A and

the subsequent suction relief valve had not failed, the testing of the

valves with the "A" RHR train in service may not have caused a problem.

There are three significant concerns with this deviation from an initial

condition of an approved procedure. First, the Shift Supervisor was not

aware of the basis for this particular initial condition requirement. The

licensee indicated that the basis for initial condition 3.2 of STP-11.6

was not for concern of potential voiding and resultant pressure surge or

water hammer damage. The requirement for the system to be shutdown during

stroke-time testing was, according to the licensee, to prevent discharging

RCS coolant to the containment sump should the outboard isolation valve

leak while testing the inboard valve. The containment sump is normally

dry during non-LOCA conditions. Since it would be very difficult for a

Shift Supervisor or operator to be cognizant of the basis behind all

procedural precautions, limitations and initial conditions, departure from

these requirements should receive adequate review to ensure that the

deviation would not potentially degrade the operability of the system or

validity of the surveillance test.

The second concern is that the licensee's approved procedures, in place at

the time of this event, did not appear to permit this deviation.

FNP-0-AP-6, Procedure Adherence, Section 3.0, requires adherence to all

plant procedures except under emergency conditions or a temporary

procedure change as allowed by FNP-0-AP-1, Development, Review and

Approval of Plant Procedures. FNP-0-AP-1 and Technical Specification 6.5.3.1 allow temporary changes to procedures which clearly do not change *

the intent of the procedure. These temporary changes must be approved by l

two members of the plant staff, at least one of whom holds an SR0 license.  ;

FNP-0-AP-16, Conduct of Operations, Section 5.5, defines a temporary  ;

procedure change as applicable to a system not performing in a manner l

covered by existing procedures or in such a manner that portions of l

existing procedures do not apply. FNP-0-AP-16 also requires that plant )

procedures shall be adhered to in the conduct of all plant operations

except where adherence to the procedures will create an undue hazard to

personnel, equipment, or public health and safety. FNP-0-AP-57, ,

Preservice and Inservice Inspections, Section 4.12, requires Operations to  !

perform inservice testing in accordance with plant procedures. l

'

FNP-0-AP-5, Surveillance Program Administrative Control, Section 3.2.4,

requires that each group will ensure that test procedures are performed as

written. In the deviation from initial condition 3.2 of STP-11.6 on

November 27, 1987, a plant emergency did not exist, and the deviation was

not processed as a temporary procedure change. The licensee indicated

that they believed that even if the deviation had been treated as a j

temporary change, the required second approval would have probably been j

i

l

I

l

!

.

i

'

.

.-

,

. .

'

9

obtained and the results would have remained the same. This conclusion is

difficult to ascertain after the fact, but the . reactor operator did

question the decision at the time, and an SR0 licensed staff member on

shift during the event indicated that he would have been reluctant to

approve the "NA" of an initial condition.

The failure to provide adequate administrative controls over the use of

"NA" in approved procedures, and the failure to comply with existing

administrative controls in deviating from an approved procedure, is a

violation (364/87-35-01).

The third concern associated with the utilization of STP-11.6 for stroke

testing valves 8811A and 8812A is that step 5.1.5 does not stipulate the

sequence in which the two valves should be cycled, or for fill and vent

following testing. Due to the piping configuration, it appears that

cycling of the 8811A and 8812A valves, regardless of sequence, could lead

to the establishment of a void. With 8812A and 8811A closed, this void

would be trapped until the automatic transfer of RHR from the RWST to the

containment sump under LOCA conditions. Therefore, upon completion of the

valve testing, filling and venting may be required to eliminate the

possibility of a void and the potential for water hammer and system damage.

Operators interviewed indicated that the only reason they elected to test

8812A before 8811A was that 8812A required local visual verification

(non-encapsulated) and an operator was already in the area. The licensee

should review this procedure to determine whether a sequence should be

specified, or whether post-testing fill and vent is required following

stroke testing of these valves.

As addressed in paragraph 6 of this inspection report, one of the primary

contributing causes of this event appears to be an air void trapped in

approximately 7 feet of piping between valves 8811A and 8812A. Due to

work on these containment isolation valves during the Unit 2 outage, a

local leak rete test (LLRT) was required under the licensee's inservice

valve testing program. The leak rate test was performed by the test group

under clearance 87-1514-2 on November 16, 1987. The continuation sheet

associated with this clearance directed operators to drain the section of  !

piping between the valves. The technicians were then directed to

pressurize the area to 49 psig with nitrogen, perform the LLRT, vent off

the nitrogen, and turn the system back to Operations for functional

restoration. FNP-0-AP-52, Section 6.1 requires planners to provide

directions for functional acceptance testing and for restoration to

service. FNP-0-AP-5, Section 7.2.8, requires that instructions be

provided for returning equipment and systems tested to a normal operating

status. Instructions for the return to service of the portion of the RhR

"A" train system between valves 8811A and 8812A were not provided on

_ _ _ _

'

,

'

a .

~

10

November 16, 1987, and the clearance did not reference an approved

procedure for this purpose. The system was turned over to Operations for

restoration to service and Operations failed to ensure the area between

the valves was properly filled and vented.

As previously addressed there is also a potential that this trapped void

could have resulted in a loss of the RHR "A" train during LOCA conditions

either due to water hammer damage or due to a stuck-open suction relief

valve. The failure to provide adequate procedural guidance for the

restoration of the "A" RHR train to service and to ensure fill and vent is

an example of violation (328/87-35-01).

This event highlights a need for the licensee to increase their

management controls over post-maintenance and surveillance testing and to

improve the interface between the testing group, the work planners, and

Operations. Existing procedures require the planners to provide

applicable permits, procedures, proper plant conditions, Limiting

Conditions for Operation (LCOs), functional acceptance testing, and

directions for restoration to service. In actual practice, the licensee

generally prefers to turn the system or equipment over to Operations

following test completion. Operations then determines the method of

system restoration. In addition, the licensee utilizes a surveillance

procedure covering the entire system to perform post-maintenance testing

on a small portion of the system (in this case two valves) versus writing

a specific post-maintenance test procedure or instruction. This

methodology requires Operations to "NA" numerous other steps within the

surveillance procedure, a practice, which in this case, was extended to a

procedure initial condition.

The scheduling of post-maintenance testing also appears to require improve-

ment. In this particular case the work on valvas 8811A and 8812A was

completed on November 20 while the plant was still in an outage. Since

the clearance did not rpecify a date, time or plant mode for the

stroke-time testing, the testing did not occur until November 27 with the

plant approaching Mode 4 operation. With all the activities required to

support plant start-up and both trains of RHR already in operation, this

lack of specific scheduling appears to have contributed to the decision to

test the valves with the "A" train in operation.

8. Control of Maintenance and Tagging Evolutions

In May 1986, inspectors conducted a reactive inspection to review the

circumstances surrounding a wrong unit / wrong train tagging error involving

the RHR system (Inspection Report 348, 364/86-10). As part of this

inspection, the inspectors reviewed the licensee's incident reports

(potential reportable events) for 1985 and 1986. This review noted

approximately 33 personnel errors associated with maintenance activities

including tagging and wrong train / wrong equipment errors. The licensee

subsequently determined that 18 of these errors were significant enough to

, - . .- _ ________

'

.

'

a. ,

.

11

require additional corrective actions such as additional training,

required reading, and prucedure changes. The inspection report identified-

two causes which appeared to contribute to the apparent continuing level

of similar personnel errors:

- Inadequate specific directions on the maintenance work requests,.

and

I

- Each event appeared to be treated as an isolated event without

adequate trending of similar events and errors or. programmatic

corrective actions.

The cover letter associated with the escalated enforcement for the RHR

wrong unit / wrong train event requested the licensee's response to describe

the particular actions for improving performance in this area. The

licensee's response, in addition to event specific corrective actions such

as color coding and labeling of unit access doors, indicated that:

- each incident involving personnel error would be investigated

individually.

- corrective actions would be taken for each case as required.

- corrective actions would include counseling or retraining of

appropriate individuals and revision of appropriate procedures. l

As part of this inspection of the RHR event of November 27, 1987, the

inspectors briefly reviewed recent event reports in the area of

maintenance and tagging personnel errors. Although the scope of this ,

review was significantly less than that conducted by inspectors in 1986,

the following similar personnel errors were noted:

a. On November 9,1987, while working on a system relief valve for the

Unit 2 "A" train RHR pump, the "B" train relief valve drains were

inadvertently opened by a maintenance journeyman resulting in a

discharge of water.

b. On November 9,1987, two maintenance personnel disassembled the Unit

2 "A" train seal injection return filter outlet valve instead of the

"B" train valve. The wrong valve was disassembled even through three

protective red tags were attached to the valve to prevent manipula-

tion.

c. On November 27, 1987, during replacement of the Unit 2 "A" train RHR

suction relief valve, as a result of the relief valve failure earlier

on November 27, PRT level was inadvertently raised by operators

resulting in a discharge of 400 gallons of water to containment. 1

1

- . _ -,

. . ,-

.

.

'

. .

12

d. On October 20, 1987, during recovery from M0 VATS testing on Unit 2

valve LCV-115D (charging system), a second tag on breaker FV-T5 was

removed without adequate review of the MWR and system status

resulting in a discharge of water from open vents. ,

e. On October 20, 1987, while attempting to restart Unit I charging pump-

IB following electrical maintenance, the pump amps were zero and no

flow was indicated. Operators opened the breaker door and observed

that the power cables were disconnected even though electrical

maintenance had presented the equipment to the Shift Supervisor for i

test. This event is nearly identical to one discussed in Inspection

Report 348, 364/86-10 where electricians signed the MWR request as

complete before reconnecting cables, and the maintenaace electrical i

foreman signed the work complete without adequate verification of

the work being completed.

f. On October 13, 1987, electrical maintenance disconnected the Unit 1  ;

"B" train post accident hydrogen recombiner, while the "A" train

recombiner was tagged out resulting in both trains being inoperable

and entry into Technical Specification 3.0.3. In this event the

licensee indicated that the approved drawings were in error.

'

g. On September 3,1986, the Unit 2C diesel generator air dryer outlet

valve was found tagged in the wrong position (open vs closed). The

journeyman mechanic had operated the red-tagged valve in violation of

procedures and left the valve open.

The licensee appeared to perform well in the investigation and documenta-

tion of plant events. Consequently, the licensee believes that this makes

them more vulnerable to criticism in this area. The inspectors have  :

continuing concerns, however, that most of these events and errors appear '

to be preventable; that the corrective actions may be too limited in

scope. In addition, the licensee does not appear to have increased their

trending capability for tracking personnel errors or repetitive failures

to allow assessment of the need for programatic corrective actions.

l Many of these personnel errors involve non-licensed maintenance personnel  ;

removing the wrong equipment for work or operating red-tagged valves or  !

breakers. In addition to the personnel hazards associated with these type  :

of errors such as pressurized fluids, steam, electricity, and increased

exposure or contamination, a number of the events in 1985, 1986, and 1987,

involved the removal from service of safety-related equipment such as

redundant RHR trains. This safety-related equipment should be under the ,

strict control of licensed operators to ensure continued operability. l

This is particularly important where one train is already out of service '

for maintenance or repair and an error could result in a loss of both

trains. Pending further inspection and review of the licensee's

performance and corrective actions in this area, the management

control of maintenance and tagging activities is identified as an

unresolved item (348, 364/87-35-02).  :

.