ML20209H338
| ML20209H338 | |
| Person / Time | |
|---|---|
| Site: | River Bend  |
| Issue date: | 12/31/1986 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20209F526 | List: |
| References | |
| NUDOCS 8705010198 | |
| Download: ML20209H338 (53) | |
Text
o O
, 6 s
3 -
?
e
)
'T
'l J
e>
ENCLOSURE EMERGENCY OPERATING PROCEDURES GENERATION PACKAGE IMPLEMENTATION AUDIT REPORT RIVER BEND STATION DECEMBER 1986 8705010198 870424 PDR ADOCK 05000458 PDR p
,_.7 y.
v.
y,,,
_,,,,w.--
y, y
e.
, s EXECLTPIVE SLRNARY INIPODUCTION Ebliowing the %ree Mile Island ('IMI) accident, the Office of Nuclear-Reactor Regulation developed the "'lNI Action Plan" (NUREG-0660 and WREG-0737), which required licensees of operating reactors to reanalyze transients and accidents and to upgrade emergency operating procedures (EDPs) (Item I.C.1).
%e Plan also required the NRC staff to develop a long-term plan that integrated and exynnded efforts in the writing, reviewing, and nonitoring of plant procedures (Itan I.C.9). NUREG-@899, " Guidelines for the Preparation of Dnergency Operating Procedures", represents the NRC staff's long-term program for upgrading EDPs and describes the use of a " Procedures Generation Package" (PGP) to prepare EDPs. Each PGP is to include technical guidelines, a writer's guide, a discussion of the program for verification and validation of the procedures, and a description of the operator training program for the upgraded EDPs. Subnittal of the PGP was made a requirement by Generic letter 82-33, " Supplement 1 to NUREG-0737 - Requirenents for Dnergency Response Capability."
Atdits of the emergency operating procedures generation package implenentation process are undertaken to determine whether the PGP approach results in EDPs that are of high quality, usable, and technically accurate. A secondary purpose is to determine what changes, if any, should be made to the NRC's long-term program for ensuring that high quality, upgraded IDPs are being developed by the irdustry.
REVIEW PROCESS /Pfn10D An audit of the River Bend Station (RBS) PGP implementation process was conducted by the NRC, with assistance frtm Battelle Pacific Northwest Laboratories (PNL) and Battelle Memorial Institute (MI) ps a usel, during July and August of 1986 (a site visit was made on August 19-21, 1986). %e atdit consisted of three major tasks:
o A desk review was conducted on a sample of the RBS EDPs to determine if the Boiling Water Reactor Oaner's Group (NBOG) Bnergency Procedure Guidelines (EPGs) were adapted appropriately and if the EOPs followed the guidance provided in the RBS writer's guide portion of the PGP. RBS and General Physics staff, training consultants to RBS, were interviewed about the discrepancies identified during the engineering and human factors technical reviews RBS and General Physics staff were interviewed about the verification, o
validation, and training programs for EDPs We RBS plant specific simulator and an operating crew were used in o
evaluating a sample of EDPs to determine whether the EDPs, as written, would mitigate simulated emergency mnditions and were usable by the operators.
i l
0 o
e, FINDINGS Desk Review. 'Ihe desk review involved a ocrnparison of a sanple of the EDPs to the BGOG EPGs to determine technical accuracy and a cmparison of the EDPs with the RBS writer's guide to determine Whether the EDPs were written in accordance with accepted htsnan factors practices described in the plant-specific writer's guide approved by the NRC.
'Ihe technical review identified discrepancies between the IDPs and th,e SiROG EPGs that can be classified into the following four main areas:
o Dcungrading of Several BWROG EPGs into RBS Abnormal Operating Procedures (AOPs). 'Ihe RBS AOPs are not adnunistratively reviewed, validated, trained on, or revised to the same rigorous guidelines as the EDPs. 'Iherefore, these emergency procedures may be produced to a lower standard of technical and htsnan factors adequacy than acceptable for EDPs.
o Incorporation of BWROG Contingencies within the RBS EDPs. Four of the seven Ocmtingencies to the BWROG EPGs were incorporated directly into the RBS EDP-0001 procedure (ENERGENCY PROCEDUPE - RPV CNTROL). RBS had General Electric review three of the contingency incorporations but not the fourth. 'Ihe audit team suggests that since a vendor
~
review was not performed on the last contingency incorporation the possibility exists that the intent of the contingency could have been misinterpreted and that it should receive an independent review, perhaps by the vendor.
o Procedure Transitions. 'Ihe RBS EOPs are written in such a fashion that concurrent implenentation of several RBS EOPs and/or subsections of the EDPs most likely will occur in the mitigation of an emergency event. Pbr this reason, the pics. dural branching, transitions, and step-logic flow control must be written as specific as possible. 'Ihis is not the case with the RBS procedures.
Justifications for Procedural Deviations / Additions. 19 tile RBS o
provided a majcrity of the necessary justifications for deviations i
frm the EPGs, the audit team discovered a few inconsistencies. Ibr exanple, the latest justification 'h -mt: 1) did not contain all of the previous justifications, 2) lacked adequate supporting information for sane of the changes, and 3) had no evidence of authorship for sme of the justifications.
('Ihis last iten is being addressed by a new justification policy which RBS is starting to implernent.)
3 Cmparing the sample of the EDPs with the RBS writer's guide format and content instructions indicated that the EDPs sampled, in their current form, are consistent with the PGP writer's guide. 'Ihe differences between the IDPs and the writer's guide instructions have been categorized into six areas:
Inconsistent placanent of notes, and inclusive of action statements o
within Cautions Steps that contained more than one action step o
Incorrectly and inconsistently written referencing and branching o
instructions o Use of undefined action verbs Use of vague terms, such as "if required" oo Other differences dealing with pmetuation, check marks, and miscellaneous misspelling and typographical errors.
However, the audit team also identified a few areas which need to be included in the writer's guide, as well as a few areas which are smehat confusing and should be better explained.
l 11
k 4
g 1
Site Visit. W e site visit included interviews with RBS and General Physics ctaff to discuss the verification ani validation and training programs, reviewing docunentation for those pru.g.4, exercising a portion of several EDPs and AOPs using the plant-specific simulator, and conducting a control roon walk-through which ocupared the instrunents and controls in the control roon with those designated in the EDPs.
Review of Verification / Validation Program: W e audit team determined the follcwing important points about the RBS verification / validation (V/V.)
program:
o We current RBS V/V program appears to be very good, well doctrnented, and matches the program included in their PGP.
o he ecmbination of desk-top reviews by multidisciplinary teams, simulator exercises by minimtn crew sizes, and control roczn controls, instrunentation and ncnenclature (although differences were found in our walk-through) provides a valid and effective V/V program.
o We method by which RBS plans to verify and validate revisions to EDPs is briefly describad in the writer's guide, not in the V/V doctrnentation where it should be located.
o RBS has not identified the method, within the V/V docunentation, that will be used to validate EDPs that cannot be exercised in the simulator. Hcuever, RBS did indicate to the audit team the method that was used, such as stopping the simulator during a scenario and discussing the actions and the expected results.
o RBS verification / validation scenarios were developed to exercise individual procedural steps or specific sections of a given procedure.
We methcx1 by which BBS plans to ensure the validity of the entire procedure following the exercising of the V/V scenarios needs to be described in the V/V docunentation.
Review of Training Program: Training crt the EDPs was found to ccuply with det had been specified in the PGP. %e training program is an effective rxnbination of classroon instruction, simulator exercises, and control rocn walk-throughs with student evaluations at the end of classroce instructicrt, at the end of simulator instruction, and through ocmmittee reu.Adations. We follcuing iten, however, was noted as needing attention:
We training program outlined in the RBS PGP indicated that control o
rocn walk-throughs would be used for team training, for refresher training and for major EDP revisions. Wese activities were not carried out, because of the interference they would have caused in the control recra, and because the simulator very closely models the actual RBS control rocrn.
iii
t Exercise of Procedures he procedures were exercised using simulator scenarios cm the plant specific sbnulator and a control rocm walk-through.
Simulator Exercise
%e results of the simulator exercises identified scme proble$s in the o
use of the procedures particularly in the areas of logic flow control and branching. Durir.g the simulator exercises, when mulitiple procedures were being used, the operators were procedurally d'irected to several locations in different procedures to perform the same task (e.g. level control). In order to deal with this problem, the operators would branch to another procedure, retrace steps within a procedure, or exit and then re-enter a procedure at their own discretion.
(% e concern with branching and handling multiple procedures appears to be generic in nature with the BWPDG ems and is more evident with the two coltunn format.) RBS staff mnfirmed this problen and indicated to the audit team that they were exploring the conversion of the EDPs to a flow chart format which they believe will help eliminate scme of the above concerns.
o he reactor operators maintained control of the emergency event even when they could not folicw the procedures verbatim.
Cbntrol Roczn Walkthrough me control rocm walk-through identified a few inmnsistencies, such as instrirnentation that could not be read to the accuracy indicated in the EDPs, and equipnent labels that did not match the EDPs.
COCIUSIONS From the above findings the audit team concludes that the RBS PGP inplenentation process largely follows the implementation program delineated in the PGP. Mcwever, the sample of procedures reviewed by the audit team contained scme technical errors, htrnan factors weaknesses, and lacked transitional control guidance necessary for an operating crew to successfully handle simulated energency conditions if the procedures are implenented, step by step. he lack of adequate transitional guidance may be a problem contained in the BWBDG ems. It was identified during the simulator exercises that the efficient and effective usage of the RBS EOPs may be overly dependent upcn operator experience, operational knowledge, and understanding of the facility's response to the energency event.
iv
,s REC 09ENDATIONS It is recomended that:
e 'Ihe licensee address, in the next revision to their EDPs, these audit items that are not identified as requiring respense by NRC Inspection Report 50-458/86-24, dated October 23, 1986.
e RBS correct the deficiencies identified by this audit using, as a minimum, the guidance provided in this report.
RBS should place additional emi asis en the successful performance of t
e transitiens and branching between precedures during simulater training.
Since RBS is considering changing the format of their EOPs to e
flewcharts, RBS should not implement the flew chart EDPs until the IGP process has been revised to accomodate flew charts, and reviewed by the NRC staff.
RBS should increase the awareness in their staff that are develeping o
the EOPs that the cautions, notes, and steps in the generic guidelines do not necessarily follow acceptable htsnan facter principles.
Since the EOPs have been revised twice previcusly, RBS should ensure o
that operators are adequately trained en the revised procedures before they are implemented in the centrol reem.
O a
TABLE OF CONTENTS EXECUTIVE
SUMMARY
i
1.0 INTRODUCTION
1 2.0 REVIEW PROCESS / METHOD........................ 1 2.1 Desk Review........................'... 2 2.2 Site Visit 2
2.2.1 Review of Desk Top Reviews................. 3 2.2.2 Review of Verification, Validation, and Training Programs. 3 2.2.3 Exercise of Procedures..................
3 2.2.3.1 Simulator...................... 3 2.2.3.2 Control Room.
4 3.0 FINDINGS............................... 4 1
3.1 River Rend Station PGP Implementation Process.......... 4 3.1.1 General Findings..................... 4 3.1.1.1 Downgrading of BWROG EPGs into River Bend Station AOPs......................
4 3.1.1.2 Incorporation of BWROG Contingencies into River Bend Station E0Ps...............
5 i
3.1.1.3 Procedural Transitions.............
5 3.1.2 Specific Findings.................... 5 3.1.2.1 Desk Review 5
3.1.2.1.1 Comparison of E0Ps with Technical Guidelines 6 3.1.2.1.2 Comparison of E0Ps with the Writer's Guide. 7 3.1. 2. 2 S i t e V i s i t...................
8 3.1.2.2.1 Comparison of the Verification / Validation Program with the PGP..
8 3.1.2.2.2 Comparison of the Training Program with the Program Description in the PGP 9
3.1.2.2.3 Simulator Exercises............ 9 3.1.2.2.4 Control Room Walk-through........
11 3.1.3 Summary of River Bend Station PGP Audit Findings....
11
4.0 CONCLUSION
S............................
11 5.0 RECOMMENDATIONS..........................
12 vi e
t
+
_,,,.--,..w
. s Attacf1 ment A-Audit Team Menbers ard Site Introductory and Exit Briefing Attendees.................... A.1 B.1 Attim.3.wat B-Desk Review of EDPs.....
C.1 Attachnent C-Verification / Validation Checklist...
D1 Attactrnent D-Training Checklist.
E.1 Attim.i.=rit E-Simulator Exercise Checklists.
F.1 Attachment F-Control Rocm Walk-Through Checklist.
J vii
a l
1.0 INTR 0[XXTION Following the 'Ihree Mile Island ('IMI) accident, the Office of Nuclear Reactor -
Regulation developed the "'IMI Action Plan" (NUREG-0660 and MJREG-4737), which required licensees of operating reactors to reanalyze transients and accidents l
and to upgrade emergency operatinc' procedures (EDPs) (Item I.C.1).
'Ihe plan c1so required the NRC staff to dervelop a long-term plan that integrated and experx5ed efforts in the writing, reviewing, and mcnitoring of plant procedures (Itern I.C.9).
NUREG-4899, " Guidelines for the Preparation of Bnergency l
Operating Procedures", represents the NRC staff's long-term program for upgrading EDPs and describes the use of a " Procedures Generation Package" l
(PGP) to prepare EDPs. Subnittal of the PGP was made a requirement by Generic Intter 82-33, " Supplement 1 to NUREG-4737 - Requirements for Bnergency Procedure Capability." Each PGP is to include technical guidelines, a l
writer's guide, a discussion of the program for verificatien and validaticn of l
the procedures, and a description of the operator training program for the upgraded EDPs.
Audits of the energency cperating procedures generation package implenentation process are undertaken to detennine whether the PGP approach results in EDPs that are of high quality, usable, and technically accurate.
'Ihis report describes the audit of the Gulf States Utilities (GSU) PGP implenentation for the River Bend Station (RBS). Section 2 of this report discusses the methodology used to de: ermine the technical accuracy of the procedures that were developed in accordance with the approved PGP and to assess the application of htsnan factors principles. Secticm 3 describes the findings of the audit in terms of the RBS PGP implenentation process.
l Sections 4 and 5 provide conclusions and reccmmendations regarding the RBS PGP inplanentation process.
2.8 REVIEW PROCESS /ME'IHOD f
'Ihe audit of the RBS PGP implenentation sv:gemu was conducted by the NRC, with assistance frcan Battelle Pacific Northwest Iaboratories (PNL) nad Battelle Wecrial Institute (INI) perscnnel, during July and August of 2986 (a site visit was made on August 19-21, 1986). Audit team members and attendees at the site introductory and exit briefings are listed in Attachntnt A.
'Ihe audit consisted of three major tasks. First, a desk review was conducted on a sample of the RBS EDPs to determine if the Boiling Water Reactor Oaner's Group (twa0G) Dnergency Procedure Guidelines (EPGs) were adapted appropriately and if the EDPs follwed the guidance provided in the RBS writer's guide. At RBS, staff manbers were interviewed about the findings frei both the technical and I
htsnan factors portions of the desk top reviews. h od, RBS staff members were interviewd about the verification, valMWcn. arx3 training programs for EDPs using interview protocols. 'Ihird, usi49. A3 F simulator with both 1
o minirtra arr3 typical (3 and 4 perscn) operating crews, various simulated emergecies were conducted to detennine the usability of the EDPs and Whether the IDPs, as written, would mitigate several ernergencies. 'Ihe third step also used a control room walk-through protocol to determine Whether the ocmtrol and -
display ncrnenclature in the EOPs matched that in the control roon. 'Ihese three tasks are discussed in more detail in the pages follcwing.
2.1 Desk Review
~
'Ihe desk review consisted of a acrnparison of a sample of RBS EDPs against the IMOG EPGs and the RBS writer's guide, and a concurrent evaluation of the adequacy of the iDPs based on the reviewers' professional expertise, work experience ard $adcynent. 'Ihe same three procedures were used for the two l
different desk-:.op reviews:
o IDP-GOO 1 INERGENCY PROCEDURE - RPV CCNrROL o EDP-0002 EMERGENCY PROCEDURE - PRIMARY CCNTAINMINT 03frROL o AOP- 0021 ANTICIPATED TRANSIENT WITHOUT SCRAM During the desk review, the EDPs were compared for consistency with Rev. 3 of the IMOG EPGs, noting major differences between the generic technical guidelines and RBS EDPs. 'Ihis review was conducted by two NRC-certified operator license examiners. 'Ihese examiners have conducted written and operating (simulator and oral) examinations at nunerous BWR (General Electric) plants.
'Ihe 10Ps were also reviewed to determine the extent to Which they followed the format and content instructions in the RBS writer's guide. 'Ihis review was conducted by a hunan factors specialist with several years of experience working cn NRC projects related to EDP evaluations.
It should be noted that the RBS EDPs were in a state of change When the audit was conducted. 'Ihe desk review had to be performed twice, because RBS released a revised version of their EDPs cne week prior to site visit. 'Ihis new release incorporated major technical as well as hunan factors differences brought abcut frczn recently ccurpleted INPO and internal audits. In addition, upcn arriving cn site, the audit team was confronted with another set of approved IDP revisions, all new justifications for differences, and were told by the RBS staff that a major revision to flow charts is being considered for the near future.
2.2 Site Visit
'Ihe site visit consisted of interviews with RBS and General Physics personnel, training consultants to RBS, about the verification and validation, and training p%iarrs; a review of the docunentation for those r ugc.c.; and a discussion of the concerns that were identified during the desk review.
Several simulator scenarios were conducted, using licensed operators, to exercise a portion the EDPs. A control roczn walk-through was conducted to check on the consistency between the IDPs and the control rocn instrunentation.
3 2.7.1 Review of Desk 'Ibp Mviews
'Ihe findings of the desk top reviews were discussed with RBS and General thysics personnel. Consequent to these discussions, the audit team clarified the desk review ocrrnents and added additional ecmnents which were the result of the latest facility EDP revisions that were received when the auSit team arrived on site.
l 2.2.2 Review of Verification Validation, and Training Programs While at the plant, operations and training personnel were interviewed ainut implementation of the pr%=ns, using the previously developed Verification, validation, and Training protocols, so that a ccrnparison of the PGP program could be trade to the program actually inplenented.
2.2.3 Exercise of Procedures ite procedures were exercised using the two techniques described below.
2.2 3.1 Simulator
'Ihe first type of exercise of the procedures was conducted on the RBS plant-specific simulator. 'Ihe exercise had three objectives:
j c to determine whether the EDPs are usable for the given level of qualifications, training and experience of the operating staff o to detennine whether the EDPs are ccrnpatible with the minimtzn ntsnber,
)
qualifications, training and experience of the operating staff o to detennine whether the EDPs werv able to effectively mitigate various emergency situations.
)
Two simulator ecenarios were developed to cover the subset of EDPs that had been reviewed for the audit. One scenario had multiple failures which l
occurred during the transient. A second scenario was chosen frczn the I
scenarios RBS used for validation / verification of their EDPs. A list of the scenarios folloas:
o Turbine Trip without Bypass - 2 SRVs stuck open o loss of High Pressure Feedwater - A'IWS Subsequent Ioss of I m Pressure Feedwater (i.e. Station Blackout) o Decreasing Suppression Pool Water Imvel
(
'1he first two scenarios were chosen because they exercised a major portion of the EDPs under review, they covered a variety of emergency situations, and they highlighted weak or questionable areas of the EDPs uncovered daring the desk review.
'Ihe additional scenario (Decreasing Suppression Pool Water Level) was corxiucted at the request of an NRC observer frcm Region IV who was watching the exercises as part of the performance of a Ternporary Instruction Mex1ule which he was implenenting concurrently with the audit visit.
3
Annotated procedures and checklists were used to evaluate the sinulator exercises. An audit team member answered the questions in the checklist for each scenario based on the actions of the operator using the EDPs. 'Ihe audit -
tema msnber's respcoses were then reviewed with the other mernbers of the audit team for concurrence.
2.2.3.2 Centrol Rocra
'Ihe second type of exercise of the procedures was conducted in the control rocn using a control rcon walk-through protocol. 'Ihe exercise had three objectives:
to determine whether the controls / displays that are identified in the o
EDPs as being in the control rocm are indeed there to determine whether the control / display namenclature described in the o
EDPs was canparable to that in the control rocra to determine whether the displays muld be read to the accuracy o
desired in the IDP.
In order to meet these objectives, a control reczn check of a sample of the rrnnelature and accuracy requirenents in EDP-0001 and IDP-0002 was corducted with the assistance of an operator frcm RBS.
3.0 FINDINGS 3.1 River Berd Station PGP Implementation Plocess General and specific firdings regarding the RBS PGP implenentation prccess are presented in the follcuing sections.
3.1.1 General Findings
'Ibere were three general findings regarding the developnent and use of the RBS EDPs: downgrading of several BRFOG EPGs into RBS AOPs; incorporation of BWROG contingencies within RBS EDPs; and procedural transitions.
3.1.1.1 DtNngrading of BWROG EPGs into River Bend Station ADPs RBS made the decision to develop three (3) portions of the WROG EPGs as abnormal operating procedures (AOPs) [AOP-0020,(ALTERNATE SHUPDOWN WrIBOUT BGEN I!UEXXION); AOP-0021, (ANTICIPATED TRANSIENT WITHOUP SCRAM); AOP-0022, (RADIQACTIVE REEASE)]. 'Ihis type of procedural developnent is of concern because:
the RBS AOPs are developed using a different writer's guide and may o
not be written in a consistent format and style as the EDPs. 'Ihis could lead to confusion during concurrent implementation in an energency event.
the RBS AOPs are not administrative 1y reviewed, validated, trained on, o
or revised to the same rigorous guidelines as the EDPs, thereby providing the potential for the existence of a lower quality 4
procedures.
RBS stated in their deviation doctznent (1-15-85 letter) that the AOPs o
were developed because the situations which the AOPs handled were event-based, not symptom-based. '1hia should not be the sole justification for a deviation in the BW50G precedural design basis because the entire spectrun of potential " event" based accidents may or may not be easily identified to the operator at a particular mcment in time.
~
3.1.1.2 Incorporation of BWROG Ccntingencies into the River Bend Station EDPs RBS chose to incorporate in the developnent of EDP-0001 (DERGENCY PROCEDURE -
RPV CINTROL) four (4) of the seven (7) IMROG RPV OCNTROL GUIDELINE Contingencies. Tnree of the four contingencies were reviewed by General Electric to insure that the incorporation of the contingencies did not alter the intent or context of the generic technical guidelines. 'Ihe audit team reviewed the process used by RBS to verify the correctness of the incorporation of the three (3) contingencies and believes that a similar review should have been performed for the fourth contingency (BOP-0004, DfERGENCY PROCEDURE - LEVEL RESIORATICN). It abould be ernphasized that the audit team indicated the " review process" used by RBS was acceptable and the team did not review the intent / context correctness of the incorporations.
3.1.1.3 Procedural Transitions
'1he RBS EOPs are written in such a fashion that concurrent inplanentation of EDPs and/or subsections of EDPs will occur in the mitigation of an many energency events.
(This is a generic concern which originates frcm the BWRCX3 EPGs). Ebr this reason the procedural branching, transition, and step inplementing control must be written as specific as possible. 'Ihis is not the case with the RBS procedures. During the simulator exercises the operators were procedurally directed to multiple locations to perform the same control task. Other times, the operators would branch to other procedures, backup within a procedure, or exit and then reH!nter a procedure without any written gocedural guidance.
3.1.2 Spacific Findings A sumnary of the findings are presented in the following sections. 'Ihe findings are divided into two subsections: the Desk Review and the Site Visit.
3.1.2.1 Desk Review
'Ihe follcuing sections incitxle a strimary of the findings of the desk review, which included a ccrnparison of the EDPs with the Technical Guidelines and the RBS writer's guide. Detailed ccmnents are provided in Attachnent B.
5
3.1.2.1.1 Ccrqarison of EDPs with 'Ibchnical Guidelines
%e technical review involved a ccrnparison of the EDPs with the IMROG EPGs.
%e technical review resulted in the follcwing specific findings, two having been previously mentioned as General Findings and are elaborated upon.here.
Conversion of BWROG EPGs into River Bend Station AOPs. %e IMROG EPGs were developed within a set of guidelines and usability constraints. RBS deviated frem the guidelines and converted three IMIOG EPGs into RBS AOPs, which is a concern to the audit team. RBS indicated they recognize the potential problens this could cause and are currently cc,nverting ADP-0021 (AWICIPATED
'IRANSIENT WI'IHOW SCRAM) back into an EDP. RBS stated they are considering converting the other two (2) AOPs back into EDPs but have not oxinitted to this at the time of this report.
Imration of BWROG Contingencies within River Bend Station EOPs. Four BWIOG contingencies were incorporated into EDP-0001 (EMERGENCY PROctu]RE - RPV CIN. POL). Directions as to when to or when not to incorporate contingencies within a procedure were not adequately identified in the verification /
validation doctmentation. Additionally, the doctanentation did not provided assurances that the incorporation of the contingencies into the RBS EOPs had properly been validated / verified and did not alter the original intent or usability of the BWBOG EPGs.
Justification for Procedural Deletion / Additions. Upon arriving at the site the audit team was given a new set of EDPs and deviations (dated August 18, 1906) for our consideration and review. During a review of a sample of these deviations indicated the following:
o Sczne EPG steps were not included in the RBS EDPs. Sufficient justification for these deletions / revisions was not always doctraented.
%e justifications showed an inconsistency of degree in detail and o
scrne just reiterated the changes made without any justification for the change.
he latest deviation doctrnent did not include all the previous o
deviations.
he format used to doctraent deviations had been changed a ntrnber of o
times and there were inconsistencies in the author / reviewer signature and date of signature. Also, the changes in format were not reflected in changes in the EGP.
6
3.1.2.1.2 Otmgarison of EDPs with the Writer's Guide
%e burnan factors review involved a ccrnparison of the EDPs with the writer's guide. We discrepancies between the EDPs and the writer's guide were grouoed into the follcuing areas. Detailed ccmnents are provided in Attachnent B.
We following is a stmmary of the major findings for each area.
Notes and Cautions. According to the writer's guide, cautions should be used to denote a potential hazard to equipnent er personnel. Notes are used to present information. Cautionc and notes should not contain action statements.
We writer's guide states where to place cautions, references to cautions, notes, but not references to notes. We htman factors review found that the cautions, references to cautions and notes were placed according to the writer's guide. We references to notes were placed in an unusual place -
enbedded in ocmditional statements. References to notes were not placed in the IDP the same as the references to cautions. Scme cautions contained action statenents taken directly frcm the Generic Guidelines.
Iogic Terms. We writer's guide presents definitions and format instructions regarding the writing of conditional (logic) statements using defined logic terms. Were were a few instances where the guidance was not folloed and where steps were overly cmplex.
Actico Steps. The writer's guide states that action steps should be short, exact, contain cnly one idea, and identify exactly what is to be done and to what.
It further states that ccinplex evolutions should be prescribed in a series of steps with each step made simple. Although there were a few ocrnplex logic statenents, most action steps were short and contained cne idea.
However, they lacked detail as to what was to be done and to what. %ere is much reliance on operator mencry in carrying out the steps, which can be risky during an emergency.
Referencing and Branching. We writer's guide states specifically how references to other procedures are to be written. We EDPs follow this fornet, but rarely include the title of the procedure as required by the writer's guide.
Acticn Verbs. W e writer's guide contains an approved verb list. Dut, there wre many verbs used that were not on this list. Many of the verbs used that were not cn the list, if not all, came frcm the Generic Guidelines when steps were taken verbatim. %ese verbs can be changed by using the verbs cm the approved list or by adding these verbs to the list and defining then.
Definitions. Scrne phrases used in the EDPs were ambiguous and could be unclear to the operator. For example, the phrase "following steps" ws used, but there was no indication as Wich of the steps were being referra$ to.
7
Checkoffs. We writer's guide required that checkoffs be used with each action step. Although checkoffs were provided for all steps in the left hand colan, only a few were provided in the right hand coltmn.
Punctuation and Drphasin. %ere were a ntsnber of instances in the EDPs where the punctuation and emphasis did not agree with the guidance provided in the writer's guide. For example, all verbs are to be in all caps, but several were not.
3.1.2.2 Site Visit we site visit included interviews the RBS and General Physics staff to discuss the verification and validation and the training gspa, review doctsamtation for those programs, and the exercising of a portion of the EDPs by performing scenarios cn the plant-specific sirulator and a conducting a contz,ol rean walk-through.
3.1.2.2.1 Ccrparison of the Verification / Validation Program with the Program Description in the PGP he verification and validation processes are separate programs at RBS and are described in their SOP-0008, " Verification and Validation of Bnergency Operating Procedures". W ese two programs are discussed separately in this section.
Verification. Verification determines that the EDPs follow the Generic GIIBelines and that the EDPs are written in accardance with the writer's guide. his RBS program consists of a multidisciplinary tems reviewing the procedure against the Generic Guidelines and the Verification Checklist. Any discrepancies are noted on the Procedure Discrepancy Form and sent to the Operations Supervisor for disposition and resolution. Corrections are then made by the writers.
A review of the RBS verification program, through interviews and doctrnentation review, shcwed that they followed the program described in their SOP-0008 and PGP. Wey do have a description of the program for verification / validation for revisions to IDPs in SOP-0009 (writer's guide) but, it is not detailed enough and is not included in sop-0008.
Validation. Validation determines that the procedures are usable by the operators and that the procedures can guide the operator's actions so as to l
mitigate energency events. his RBS program is executed by using a minimtra staff operating team and simulator personnel exercising the IDPs with a set of scenarios which contain multiple failures (to the extent possible with their simulator) on their plant specific simulator. Each scenario was developed to i
validate a particular step or set of steps within a given procedure. We operators are told the nature of the scenarios and they review the steps prior to the actual exercise. When steps cannot be exercised because of simulator limitations, the exercise is stopped and the steps are discussed. 'Iwo foms are used; the Observation Checklist used by observers of the exercises and the Debriefing QTecklist used by the operators. %ese forms are sent to the 8
, -,,,,.,.., ~. - - -... - -.,, -
Operations Supervisor for disposition and resolution. Control rocn walk-throughs are used to validate controls, instrtrnentatico, and meter readings.
A review of RBS's validation program through interviews and docunentation review showed that they followed the program described in their SOP-0008 and PGP. Were are two aspects missing frcm their written description. %ese although a mininun crew size is used, crew size is not specified in the are:
written description to ensure that the EDPs are usable with a mininug control recrt crew, and the method of how EDPs will be validated to their fullest extent when the simulator cannot model scrne aspects of EDPs is not described.
Additional, discussions with RBS staff and evaluation of the RBS V/V scenarios indicated that the validation process focused on validating individual steps or set of steps within any one procedure, with the underlying asstanption that if all the steps are valid than the entire procedure is valid. he concept of validating any one step could potentially lead to another portion of the procedure beccming invalid without it being discovered.
We ccmpleted checklist that was used to evaluate the verification and validation programs is presented in Attachnent C.
3.1.2.2.2 Ccmparison of the Training Program with the Program Description in the PGP he training program as described in the PGP, except for a minor aspect, is effectively carried out at RBS. %ey provided classrocm training, simulator exercises and control rocm walk-throughs with formal and informal evaluations throughout. Wey provide initial training for new trainees ard requalification training for licensed operators. Training cn minor and major revisions to EDPs is also provided. All operators are trained prior to EDP inplanentation.
We cnly exception was where they said in the PGP that control roan walk-throughs were used for team training.
Ocntml rocm walk-throughs are only used during initial training for the trainees to locate controls and instrunen'ation, and read off values. RBS c
staff stated that the mcdeling of the simulator is such that it can be used for the control rcon walk-through portion of training, but this was not included in the training program description.
We completed checklist that was used to evaluate the training program is presented in Attachnent D.
3.1.2.2.3 Simulator Exercises We simulator scenarios, for testing the usability of the EDPs, were developed folicwing the ccupletion of the desk-top technical and htrnan factors reviews.
%e process used in the developnent was to meet the objectives identified in section 2.2.2.1 (Simulator) of this report, as well as exercise the procedures for perceived procedural deficiencies. W e three major deficiencies which were identified by the audit team have been previously discussed in oeMon 3.1.1 (General Findings) of this report.
We nore specific problems identified during the simulator exercises follow:
o Transitions (entry and exit) between procedures or other action steps of the RBS EOPs were often made based on different criteria during 9
different situations and seened to greatly depend on the operators training and assessnent of the critical plant parameters. At times the operators were faced with a ntuber of multiple paths without procedural guidance as to which direction to proceed.
he EDPs were planned for use in the control rom in an interactive o
and dynamic fashion with the Sao acting as the coordinator of-the recovery process. During each of the three seemrios, the SRO directed operator actions prior to being instructed to by the EDPs.
It was also observed that the R0s would also take actions in an anticipatory fashion before being directed to by the procedures, thereby creating a potential for procedure steps to be incorrectly j
performed, skipped or performed out of order. It also created a situation where the operators were using the sucMures to verify j
actions already performed.
he branching specification to ADP-0021 (ANTICIPA'IED TRANSIENT WI'lHXJP o
SCRAM) frm EDP-0001 (RPV CXNISOL PROCEDURE) is nonspecific. %e branch point occurs at two locations (i.e. level control and pcur control) and the operator could enter AOP-0021 frm power control while renaining in EDP-0001 level control. his creates a problem of control in that ADP-0021 also contains level control action steps which may or may not contradict those in EDNE01. We BWROG EPGs indicate branching for this condition.
o We execution Ihilosophy of the AOPs is different frm the EDPs in that the AOPs direct the operator to proceed through the procedure even if a step is not executable. Rus, the operator could proceed past a step which, at a subsegaent time, may beame active and need to be performed (e.g. autcnatic depressurization or boron injection).
%e use of vague statements instead of specific action statements o
(e.g. for the following steps, section or procedure) may cause the operators to beccme confused as to what action should be taken and more specifically for which steps the override condition existed.
%e operators believed that notes related to action st.eps (e.g. RPV o
FLOODING IS REQUIRED IF...) only pertained to the subeection of the procalure that was being implemented at that specific time. hia causes a delay in branching tmtil the operator implemented the subsection of the procedure which dealt with the entry condition. For example, the operators stated that branching to the RPV FLOODING subsection could be done frcm the RPV level control subsection only if the required condition for flooding was a function of level. We operator also stated that any other flooding condition would be dealt with in another active procedure and that the operator would exit to the flooding procedure frcn there. W e action described by the operator is contrary to the IMHOG EPG.
During cne emergency simulation where entry into IDP-0002 (PRIMARY o
CXNIAI!EENT CCNTROL PROCEDJRE) was required due to decreasing suppression pool water level, the operator only entered the portion of the procedure dealing with water level. Eblicwing the transient, the operator stated that entry into the other subsections was not required because entry conditions into EDP-0002 did not exist that dealt with the other subsections. W is action is contrary to the BWBOG's philosorhy of concurrent procedure implementation.
In spite of the procedural problens encountered by the operators during the sinulator exercises, they were able to maintain control of plant and mitigate the simulated events in a timely fachion.
10 t
l I
-. _ _,., - _ _ _. _,. _ - - -,, _ _ _ _ _ - -. _ _. _- -,, _ ~. _ _ _ _, -, - - _,, _ _ _ _ _ _ _ _ _ _ _ _ _ _ - -,. _ _
'Ihe cx:mpleted checklists that were used to evaluate the simulator exercises are presented in Attachrnent E.
3.1.2.2.4 Control Rocrn Walk-through
'Ihe cmtrol roon walk-through uncovered several discrepancier including certain labels in the procedures were inconsistent with those in the o
control rnan.
Sme of the display increnents on control recm instrumentation would o
not allcw an operator to read at the required accuracy.
'1hese discrepancies were considered of minor importance.
'Ibe specific findings of the control roon walk-through are presented in Attactsnent F.
3.1.3 Stmnary of River Bend Station PGP Audit Findings
'Ihe three procedures that were reviewed by the audit team were found to have a ntriber of differences frcrn the BWEG EPGs and frcm the RBS writer's guide.
Sars of the differences fran the EPGs followed sound engineering judcynent arx1 are aansidered by the audit team as iriprovements. While most of the htsnan factors findings were of minor safety importance (e.g., misspelling and typographical errors), the discrepancies frcm RBS writer's guide instruction regartling branching and conditional statenents could lead the operators to make improper judcynents regarding how to pcct-ed through the procedures, and were therefore judged as being important to plant safety. Scme of the discrepancies between the IDPs and the RBS writer's guide resulted fran verbatim use of the IMHOG EPGs.
'Ihe RBS verification and validation processes, though they did not find the above discrepancies did, for the most part, follcw the outline for the pxwx-s that was listed in the PGP. Discussions with RBS staff and evaluation of the RBS V/V scenarios indicated that the validation process focused cm validating individual steps or set of steps within any one procedure, with the underlying asstrnption that if all the steps are valid than the entire procedure is valid. 'Ihe concept of validating any one step could lead to another portion of the procedure becaning invalid without it being disecuered.
Training cn the philosophy, technical basis, and intent of the V/V exercises of the EDPs is performed prior to the exercising and evaluation of the scenarios by the V/V team.
4.0 CWCIDSIONS
'Ihe audit team concludes fran the findings of the technical and htsnan factors desk-top reviews of a sample of the RBS EOPs, that the RBS PGP implementation is achieving its desired goals, with the exception of adequately training the operators on EDP transitions (branching). Greater care should be taken by RBS staff during the training process to ensure that the operators know when to:
enter or exit an EDP or AOP procedure during an entrance, exit, or o
branching corx11 tion proceed to the next action step or when to remain on a given action o
11
s step if the action step is not executable at time the operater reaches it in the precedure retrace a sequence of action steps er skip a series of action steps e
due to changing plant conditions.
5.0 RECOP9MRTIONS Recemendations are presented regarding RBS's precedures and PGP implementation precess.
It is recomended that RBS address these issues that are identified as requiring response by NRC Inspection Report 50-458/86-24, dated October 23, 1986. W e licensee should address these issues that are not identified by the Inspection Report in the next revision to their EOPs. Mere specifically, it is reccamended that:
o RBS censider recenverting the three (3) emergency ACPs back into EOPs RBS perform a review of the incorporation of contirgency 94 (Level e
Restoration) inte EDP-001 as they did for the three other contingency incorporations te ensure that the incorporation of the contingency did not alter the intent er the centext of the generic technical guidelines RBS provide additienal training en precedure usage, in particular, in e
the areas of precedural branching and transitions Greater care to consistency be given to the deviation documentation e
he validation process used by RBS place err @ asis en the entire o
precedure validatien while performing the simulater exercises
% e V/V scenaries be executed and evaluated without prior operater e
review RBS revise the PGP verification and validation section te include e
addressing revisions to the EOPs e RBS revise the PGP to address flow charts before the EDPs are converted to the new fermat and implemented, and sutait the revised PGP to the NRC staff for review.
I l
l 12
~ --
.e
ATTACfMDTTS Attachment A-Audit Team Mernbers and Site Introductory and Exit Briefing Attendees Attachnent B-Desk Top Review of EDPs Attachnent C-Verification / Validation 01ecklist Attachnent D-Training Checklist Attachnent E-Simulator Exercise Checklists Attachnent F-Control Rocrn Walk 'Ihrough 0)ecklist t
1 f
13
-n
-_-,...,.,..-.n..--c,..
e e
O O
9 O
w ATTACHMENTS
Attachment A Audit Team Members and Site Introductory and Exit Briefing Attendees '
1 Audit Team Members Name:
Affiliation:
James Bongarra NRC Leo J. Defferding PNL l
Louis B. Myers BMI Gary A. Sly PNL Introductory Briefinc Attendees j
(in addition to aucit team)
Name:
Affiliation:
William 8. Jones NRC W. R. Bennett NRC Jon H. Peters General Physics David M. Imlay Gulf States Utilities Eddie R. Grant Gulf States Utilities Ronald R. Smith Gulf States Utilities J. E. Booker Gulf States Utilities Dale L. Andrews Gulf States Utilities John G. Cadwallader Gulf States Utilities Douglas R. Gipson Gulf States Utilities Exit Briefing Attendees (in addition to audit team)
Name:
Affiliation:
William B. Jones NRC W. R. Bennett NRC Jon H. Peters General Physics David M. Imlay Gulf States Utilities Eddie R. Grant Gulf States Utilities Ronald R. Smith Gulf States Utilities J. E. Booker Gulf States Utilities Dale L. Andrews Gulf States Utilities John G. Cadwallader Gulf States Utilities Douglas F,. Gipson Gulf States Utilities William J. Cahill Gulf States Utilities J. Normand Gulf States Utilities R. King Gulf States Utilities K. E. Suhrke Gulf States Utilities William H. Odell Gulf States Utilities T. F. Plunkett Gulf States Utilities A. O. Fredieu Gulf States Utilities E. R. Oswood Gulf States Utilities C. W. Walker Gulf States Utilities J. E. Spivey Gulf States Utilities J. D. Gore Cajun A.1
RIVER BEND PGP AUDIT E0P-0001 EMERGENCY PROCEDURE - RPV CONTROL PROCEDURE Technical Review RBS Step EPG (Rev. 3)
Comment 1.13 Purpose RBS did not include the conditions for cold shutdown condition as suggested by the BWROG EPG.
- Entry RBS deleted the entry condition "A condition Conditions which requires MSIV isolation" without justification.
(Not all the MSIV isolation signals directly initiate a reactor scram.)
3.0.1 RC-1 RBS is inconsistent throughout the emergency procedures in the use of underlining to highlight or identify action verbs. This is inconsistent with the directions provided in the writer's guide.
AOP-0021 RC/Q-2 Dropped from E0P-0001, Section 3.1 and moved to (4.1)
A0P-0021, step 4.1.
Generic justification provided in latest justification document.
AOP-0021 RC/Q-3 Moved from E0P-0001, Section 3.1 to A0P-0021 (4.2) step 4.2.
Generic justification provided in latest justification document.
EPG steps RC/Q-3 and RC/Q-4 were not reversed in the A0P-0021 as stated in Attachment I, page 11.
AOP-0021 RC/Q-4 Noved from E0P-0001, Section 3.1 to A0P-0021, (4.3) step 4.3.
Alternate modes of boron injection have been deleted from this step with generic justification provided in latest justification document. See EPG step RC/Q-3 above, for remainder of coment.
Step added: Justification was provided in latest 3.1.3 C3.1.3 justification document. Directs the operator to AOP-0021 (Anticipated Transient Without Scram) if all rods are not in. BWROG EPG steps RC/Q-2 to RC/Q-4.2 and RC/Q-5 are moved to AOP-0021 and will be reviewed there.
3.2.1
- RC/L-1 RCIC is to be initiated in both E0P steps 3.2.1 and 3.2.3.
RCIC was added to step 3.2.1 without inclusion of EPG Caution f8.
[Also,ithasbeen seen in othe$ Mark III containments. A total l
containment isolation also inhibits the control air necessary to actuate critical safety values (i.e., CRD control valves).]
B.2
_ _ _. _ _ _ _ _ _ - _ _. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _, _ _ _ _ - - _ _ _ _ _ _ _ _ _ _ _ _ _ ~ _. _.
3.2.2 RC/L-2 The BWROG EPG override statement is directed Override to apply only to EPG step RC/L-2 not the entire level control section as indicated in RBS E0P, step 3.2.2.
Justification for the change in the overriding directive was not provided.
(Need to ensure that the override statements apply to BWROG EPG Contingencies #1, #2, #3, and #4 which have all been incorporated within E0P-0001.)
3.2.3 RC/L-2 Cautions referenced to individual systems or substeps were deleted without justification being provided. Additionally the order in Table A is different from E0P step 3.2.3 and needs to be corrected.
3.2.5 Contingency #1 "If while executing step 3.2.6, RPV water level C1-4 Override drops below -143 in. THEN PREVENT initiation of bullet #2 ADS." follows the actions provided at -160 in.
This step is generic in the BWROG EPGs and should be made more clear to ensure that ADS initiation i
is prevented prior to -160 and after -143 in.
Water level of -160 in, was an entry condition to l
Contingency #1 (Level Restoration), so the operator would have already exceeded the -143 in, water level prior to entering Contingency fl.
3.2.7
- Contingency #1 Direction to operator as to when to EMERGENCY RPV C1-7, Cl-8 DEPRESSURIZE or STEAM COOL is vague if one injection system.or subsystem is lined up.
t l
(GenericEPGs) The reference to "RPV pressure is j
greater than the pump pressure range (Table A)"
is non-specific in that the pressures in Table A range from 1600 psig to 0 psig. Additional the reference to "AND EXECUTE concurrently with this section." does not provide enough infomation to the operator to make a valid decision as to which j
step or steps should be performed next.
C3.2.7 Contingency #1 BWROG EPG Contingency f3 (Steam Cooling) has Cl-7 been incorporated into E0P-0001, step C3.2.7.
j Contingency f3 This incorporation is inconsistent with the intent of the EPGs in that RBS has eliminated the exiting override statement which allows the i
operator to exit the procedure if " EMERGENCY RPV DEPRESSURIZATION" is required. NOjustification was provided for this intent change.
3.2.9 RC/L-2 The criteria for entering A0P-0020 are presented RC/P-4 within the procedure step. Format is inconsistent with RPV flooding and boron injection requirements in that they were l
presented as notes.
(EOP-0001, p. 7 of 45.)
3.3.1.1 RC/P Checkoff mark is missing.
3.3.3.3 RC/P-1 The criteria for STEAM COOLING differ from those 1
presented in Section 3.2.
I B.3
- =
Caution #12 Caution #12
" Rpm" (sic) " RPM" C3.3.4.5
- RC/P-2 "Other steam driven equipment" does not provide the operator with a direct action to perform.
RBS should designate the system or subsystems to be used here.
3.3.7.3 C2-1.2 The wording "other" was dropped from part 2.
"Open SRVs until a total of 7 are onen."
Operator could open six (6) ADS valves and then seven (7) SRVs for a total of thirteen (13) versus a total of seven (7) ADS or other SRV valves combined, or the operator may close any ADS valve if less than seven (7) are open and open seven (7) other SRV valves. No justification was provided.
C3.3.7.3 C2-1.3 RBS has reordered the EPG order of alternate depressurization modes without justification.
Assurances need to be made that the new order will enhance safety.
B.4
e Human Factors Review i
1.
Notes and Cautions According to the Author's Guide, cautions should be used to denote a potential hazard to equipment or personnel. The caution note is to be placed before the instructional step, or that portion it refers to, with the caution.-itself in the left hand page, and it cannot be used instead of an instructional step.
Notes are to be used to present infomation, not instructions, and placed in the left hand page as close to the applicable instruction as possible. There is no guidance as to where the note note is to be placed. The human factors review found that although the cautions are placed and fomatted as required by the Author's Guide, some contained action steps. These steps were taken directly from the Generic Guidelines (River Bend assumed that the Generic Guidelines were acceptable from a human factor's viewpoint which is not true).
River Bend can rewrite these steps to avoid actions as long as the technical nature of the caution is not changed. The notes are all placed in the left hand column with the note note placed just prior to the THEN part of the i
instruction step, except in 3.3.8 where it is placed just after the instruction ste In all other E0Ps and Writer's Guide specifications (seen by this author)p.the note or note note is placed prior to the step itself, not embedded within the step, as in these E0Ps. This method requires the operator to read a note in between parts of a logic statement.
This is disruptive to the reading process.
It would seem easier on the operator to refer to the note as cautions are referred to, i.e., prior to the step itself. Specific results are listed below:
CAUTION 1 Page 8 (Containsanactionstep,lastsentence)
CAUTION 2 Page 8 (Contains an action step, last sentence and the word AUTOMATIC / should be placed before STANDBY)
NOTE 9 Page 22 (Contains an action step in last sentence and is referredtoafterthestep,notbefore.)
2.
Logic Terms and Conditional Statements The use of logic terms and conditional statements is very important, because they are nomally profusely used in E0Ps and therefore it is very important that they be written clearly and correctly for operator understanding. The i
Author's Guide defines logic tems and how to fomat conditional statements.
Further it discusses the two column format and provides an example that implies that action steps are placed in the left hand column and conditional statements are placed in the right hand column. A review of the procedures showed that conditional statements appear in both columns. The review also showed that some statements are overly complex (nested conditional statements) or several statements are strung together in a single step; no commas are used before the THEN (as suggested by the Author's Guide); and sometimes the format is not quite correct. The specific results are listed below.
Step 3.0.1
-InsertTHENintheappropriateplace(although this is copied from the Generic Guidelines, it can bechanged).
i Steps 3.2.7, C3.2.7 - The phrase " PROCEED to Step 3.0" appears to be incorrect. Use Section 3.0.
I Step C3.2.7
- The step is a complex set of nested logic l
]
B.5 j
I statements which should be separated into simpler statements.
Step 3.3.3
- Identify "following steps". The substep 3.3.3.3 is very complex (especially with the "when" thrown in) and should be simplified.
Step 3.3.5
- Identify the "following steps". There is no indication as to which these steps are.
j l
Step C3.3.6
- Underline IF and THEN; the actual action here is i
" verifying 3651 gallons..." and this phrase should l
follow the THEN, e.g.,
"THEN VERIFY that 3651 l
gallons have been injected into the RPV, to determine if 643 lbs have been injected".
3.
Action Steps The Author's Guide states that action steps should be short, exact, contain only one idea, and identify exactly what is to be done and to what.
It further states that complex evolutions should be prescribed in a series of steps with each step made simple. The review of the E0P action steps revealed that most action steps were short and contained one idea, but lacked detail in I
what was to be done and to what. The action steps rarely state the controls or instrumentation to use or specify the tasks required to meet the objective of the action step. The procedure writers are apparently relying on operator knowledge, experience and mostly memory to perform these generalized steps, but this reliance can be risky during an emergency situation. Further the Author's Guide implies more detail, particularly in paragraph 4.3.5, than what is provided. The specific results are listed below:
All Steps: Consider adding tasks and subtasks required to perform the step with controls and instrumentation added which may not be commonly used.
4.
Referencing and Branching Referencing of and branching to other procedures and sections of procedures can be disruptive and cause unnecessary delays. Therefore, it is important that fomat and structure be consistently applied. The Author's Guide requires that the words " proceed to " be used, along with the procedure number and title (with the title in quotes). The review of the procedures showed that the words " proceed to" were not always used, and rarely was a procedure title included. The specific results are listed below.
Step 3.1.3
- No number or title Step C3.1.2
- No title Step 3.2.2
- No title Step 3.2.9
- No title Step 3.3.1
- No title Step C3.3.6
- Incorrect format for the reference to A0P-0021 and state why the operator should see it Step 3.3.7
- No title B.6
Step 3.3.9
- No title, and the word " enter" is used instead of
" PROCEED to".
5.
Action Verbs In a number of locations in the E0Ps, action verbs or terms are used that are not included in the Author's Guide.
If these verbs were u:ed because they were included in the Generic Guideline steps, they can still be changed as long as the technical nature of the step is not changed. The following should either be added to the list (and defined) in the Author's Guide or replaced with verbs from that list:
Initiate Steps 3.0.1, 3.2.1, 3.3.8 Execute Steps 3.0.2, 3.2.7 Restore Step 3.2.3 Maintain Steps 3.2.3, C3.2.3, 3.3.3 Line up Step 3.2.4.2 Prevent Steps 3.2.5, C3.2.3.1, 3.3.7 Commence Step C3.2.4 Place Step 3.2.8 Rapidly Step C3.3.7 Complete Step 3.3.4 Control Step 3.3.4 Terminate Step 3.3.7 Depressurize Steps 3.3.1, 3.3.6, C3.3.7 Cycle Step C3.3.4 6.
Abbreviations and Acronyms No problems noted.
7.
Definitions A number of statements in the E0Ps are worded in a vague manner or use tenns that are undefined, resulting in an action statement that may be unclear to the operator. The following phrase should be revised to be more explicit:
Steps 3.3.3 Define "following steps" 8.
Checkoffs The Author's Guide, and a later response to a letter from NRC, made it clear that action steps and substeps would have checkoff spaces for the operator to use. The review of the E0Ps showed that checkoffs were used on all the steps in the left hand column, but not the right hand column. The right hand column also contains action steps and should therefore have checkoff spaces opposite each step.
9.
Punctuation and Emphasis In a number of places in the E0Ps, punctuation or emphasis techniques are used that conflict with the instructions listed in the Author's Guide. The following should be corrected as noted:
a)
In nearly all conditional statements a comma was not placed before the THEN, as suggested by the Author's Guide.
B.7
b)
Not all the verbs and logic terms are in all caps as required by the guide. These are noted:
Step 3.2.4 LINE UP Step 3.2.8 PLACE Step 3.2.10 WHEN
~
Step C3.3.4 EVEEE Step C3.3.6 VERIFYING Step 3.3.7 OPEN Step 3.3.10 PROCEED c)
Some action steps end in a period and others do not--be consistent.
d)
In some places phrases are in all caps for emphasis to explain what is required. This is not called for by the Author's Guide and may not be needed. If these came from the Generic Guidelines they can still be changed to lower case if deemed appropriate.
Examples are in Steps 3.2.7, C3.2.7, 3.3.1, and 3.3.7.
- 10. Miscellaneous a)
The quality of some of the figures are poor, because of copying.
(The Author's Guide does not discuss copy quality.)
b)
Contingency step C3.3.3.4 is not numbered appropriately.
Put "C3.3." on top of right column.
I
+
\\
l 1
i B.8 l
RIVER BEND PGP AUDIT E0P-0002 EMERGENCY PROCEDURE - PRIMARY CONTAINMENT CONTROL Technical Review RBS Step EPG (Rev. 3)
Coment 3.1.2 SP/T-2 Action verb "when" not emphasized.
3.1.3 SP/T-3 BEFORE changed to IF. No justification was provided for this deviation in latest deviations.
Context of action statement has been changed by this modification and should be rereviewed by RBS. The same comment applies if WHEN is replaced by IF (i.e. E0P-0002, step 3.2.2).
3.2.2
- DW/T-1.
There is no contingency if primary leakage is present how the operator is to control drywell temperature.
3.2.3 DW/T-2 By elimination of BWROG, Rev.3, Step DW/T-2, RBS DW/T-3 does not require RPV flooding if drywell temperature reaches RPV saturation. RBS needs to provide justification for eliminating step DW/T and the direction to flood the reactor if level indication is lost.
3.3.1 CN/T-1 "When" was changed to " Monitor AND Control". RBS needs to ensure that the action verbs use is are consistent with the Author's Guide.
Caution #6 CN/T-4 BWROG, Step CN/T-4, "If containment temperature (near the cold reference leg instrument vertical runs) reaches the RVP saturation temperature, RPV flooding is required," has been converted into a caution.
RBS needs to provide adequete justification for this conversion as well as why the action to flood was moved to an enclosure.
4 3.4.2 PC/P-4 RBS eliminated the reference to Pressure C3.4.2 Suppression Pressure and refers to containment pressure (+19.7 psia) and RPV pressure (+300 psig) as the deciding criteria for RPV depressurization. No justification was provided for this change. NOTE: The plus sign in front of psia is redundant as there can be no negative pressures.
I 3.4.5 PC/P-5 RBS eliminated the reference to the Primary l
Containment Design Pressure and refers to l
containmentpressure((29.7 psia)asthedeciding criteria for RPV FLOODING. No justification was I
provided for this change.
3.5.1 SP/L-1 BWROG EPG, Step SP/L-1, contains the branching criteria if suppression pool level were either B.9
too low (execute Step SP/L-2) or too high (execute Step SP/L-3). This concept was del ted from E0P-0002, Step 3.5.1, without proper justification.
3.5.3 SP/L-3.1 Deletion of EPG reference to "teminate injection into the RPV from sources external... Srior to Emergency RPV Depressurization was not justified.
B.10 v ---, -,,
., ~. - -,, - - -... -, -.. _. - -
..--,,,.------.--,,-n--
,----------,.,-s
.--,-.-,-,n---,
i.
Human Factors Review 1.
Notes and Cautions CAUTION 5, p. 6 (Explain why the operator should turn.to Enclosures 7 and 8)
CAUTION 6, p. 8 (Explain why the operator should turn to Enclosures 7 and 8)
NOTE 1, p. 4 (This note is referred to at the end of the title of section 3.1.
This is not consistent with E0P-0001 or the Author's Guide) 2.
Logic Tems All logic terms No commas prior to the THEN Step 3.4.6 This statement is not formatted as the others.
This is a sentence fom. Reformat to match the others.
3.
Action Steps l
r All action steps There is little to no detail provided in the steps with regard to the tasks and subtasks to complete the step and no reference to controls and instrumentation to be used.
i Step 3.2.3.2 In 3.2.3.1 the operator is told to proceed to another procedure and consequently the operator should not even get to 3.2.3.2.
Perhaps 3.2.3.2 belongs prior to 3.2.3.1.
Throughout this procedure the operator is referred to Step 3.0 in E0P-0001,0005, but 3.0 is a section and not a step.
4.
Referencing and Branching Step C3.1.4 No title Step 3.2.3 No title Step 3.4.2 No title Step 3.4.5 No title Step C3.5.2 No title Step C3.5.3 No title 5.
Action Verbs Operate Steps 3.2.1, 3.2.2 Initiate Steps 3.2.3, 3.3.2 l
Monitor Steps 3.3.1, 3.4.4 i
Attempt Step 3.4.3 Reduce Step C3.4.2 Bypass Step 3.4.7 Execute Steps 3.0, C3.1.4, 3.2.3, 3.3.3, 3.4.5, C3.5.2, C3.5.3 Maintain Steps 3.1.4, 3.4.1, 3.5.1, 3.5.2, 3.5.3, C3.5.3, 3.5.4 B.11
Terminate Step 3.3.1 Depressurize Step C3.5.4 Perform Step 3.4.2 6.
Abbreviations and Acronyms No problems noted.
7.
Definitions
~
Step 3.2.3.2 Define "as necessary" 8.
Checkoffs The steps in the right hand column should also have checkoff spaces.
9.
Punctuation and Emphasis a)
In nearly all conditional statements a comma was not placed before the THEN as suggested by the Author's Guide.
b)
Not all the verbs are in all caps as required by the guide. Here are those noted:
Step 3.5.1 REQUEST Step 3.5.4 EXIT c)
In some places phrases are in all caps for emphasis to explain what is required. This is not called for by the Author's Guide and may not be needed.
If these came from the Generic Guidelines they cane still be changed to lower case if deemed appropriate.
Examples are in Steps C3.1.4, 3.3.3, 3.4.2, 3.4.5, C3.5.2.
d)
In Step C3.4.2 parentheses are used instead of brackets.
e)
In Step 3.4.7.7 parentheses are not used around the control number.
f) Some action steps end in a period and others do not--be consistent.
- 10. Miscellaneous No other problems noted.
B.12
RIVER BEND PGP AUDIT A0P-0021 ANTICIPATED TRANSIENT WITHOUT SCRAM Technical Review The following connents were based on the old RBS E0P step numbers because RBS did not provide an updated AOP-0021 version referencing the latest E0P revisions. Additionally a delay in AOP updating could be of an operational concern due to the impact the AOPs (0020, 0021, 0022) would have on the effective and efficient implementation and training requirements governing the E0Ps. Additional a new justification document was not provided to the audit team upon site arrivial so the technical review was compared against the Attachment I document dated July 15, 1985. It should also be noted that the RBS conversion of AOP-0021 into E0P-0012 was not under consideration due to E0P-0012 still being in the review and implemention process.
Comment RBS states that "It is assumed that the operator 1.2 is concurrently implementing E0P-0001 and will execute all applicable steps in this procedure".
While the operator would infact have entered A0P-0021 from E0P-0001 power control and level control (if boron is injected), he is not directed back to those two (2) subsections from AOP-0021 for concurrent execution. Pressure control and, possibly, level control are the only sections of E0P-0001 that would be executed concurrently with A0P-0021. Therefore A0P-0021 step 1.2 should be more explicit concerning this direction.
4.1 RPV CONTROL The phrase "and the MSIVs are open" was deleted RC/Q-2 from AOP-0021 step 4.1 without justification.
4.3 RPV CONTROL RBS does not consider or justify the deletion of RC/Q-4 alternate boron injection mode if the SLC pumps are unavailable. Also RBS has not included or justified the exclusion of the override contingency which allows the operator to terminate boron injection and enter the scram procedure if the reactor can be shown to have all rods in and shutdown.
i 5.1 Contingency #7 A0P-0021, step 5.1 was added without proper Initial Override justification.
It also specifies that the operator should " control injection into the RPV l
to maintain reactor power above [8%) but as low as practical." as well as address why the RPV i
FLOODING precedure is not referenced as in A0P-0021, step 5.2.
j C5.3.1.2.b RPV CONTROL The directive " Proceed to Step 5.3.1.6" l
RC/Q-5.2.2 branches procedural control from A0P-0021, step j
C5.3.1.2b to step 5.3.1.6 and A0P-0021 steps C5.3.1.2.c to C5.3.1.2.e will not be performed.
B.13
This directive to branch was not justified by RBS.
C5.3.1.2.c RPV CONTROL BWROG EPG Caution f20 (defeating RC & IS RC/Q-5.2.3 interlocks) was omitted from this step without -
proper justification due to RBS still reviewing the Caution for applicability to the A8S facility.
C5.3.1.3.b RPV CONTROL "E the vent and drain do not open THEN manually RC/Q-5.2.3 open; using the manual handswitch on each valve" needs to be moved to A0P-0021, step 5.3.1.3.c to maintain consistency with the BWROG EPG RPV CONTROL GUIDELINES.
C5.3.1.5.a RPV CONTROL RBS eliminates the BWROG EPG RPV CONTROL step RC/Q-5.5.2 RC/Q-5.5.2 without justification.
5.4 Contingency #7 AOP-0021 Caution #1 is located following the Caution #1 C7-1 steps to which it applies (step 5.4 and 5.5).
Cautions within all of the RBS AOPs have been imbedded in the text, thereby providing an inconsistency in fomat with the RBS E0Ps. No justification was provide for either j
inconsistency in format and style.
5.5 Contingency #7 RBS reference to " step 5.4 and 5.9" should C7-2 to C7-4 read " steps 5.6 and 5.11".
Reference to " Step Override 3.3.6 should reed " Step 3.3.7".
Both changes are consistent with the latest revisions of the RBS i
E0Ps.
5.6 Caution #11 RBS addresses the BWROG EPG Caution fil as both an action step (A0P-0021, step 5.6) and a Caution (EOP-0001, Caution #1). This inconsistency in i
fomat needs to be addressed by RBS.
Contingency #7 The BWROG EPG Override statement branching C7-2 Override procedural control to EPG step C7-1 (A0P-0021, step 5.4) was deleted without justification.
5.7 Contingency #7 RBS A0P-0021, step 5.7 is written upon A0P-0021, C7-2 step 5.4 being true (RPV level was delibrately lowered). This is not the intent of BWROG EPG Contingency #7, step C7-1. No justification was provided by RBS for changing of the intent of EPG j
step C7-2 not considering the case where "RPV level was not delibrately lowered". Additionally RBS needs to provided justification for not including a list of " preferred" injection system to be used for level recovery as indicated in EPG step C7-2.
5.8 Contingency #7 RBS did not provide adequate justification 4
C7-2.1 for the deletion of " Terminate and prevent all l
injection systems and CRD" prior to execution of j
A0P-0021, step 5.8.
j l
B.14
,.e
.m.
,..._,_.,-._m--_
5.8.1 Contingency #7 Reference to A0P-0021 " Step 5.7" should be C7-2.2
- Step 5.9".
Contingency #7 Reference to procedural branching to A0P-0020 C7-4 Override (ALTERNATE SHUTOOWN COOLING) has been deleted -
without adequate justification. RBS does state ta Attachment I, page 18, of the 1-15-65 letter that the " intent of this step is incorporated into River Bend Station Operating Procedures.",
but fail to f:irther discuss as to how.this intent is ensured.
I' B.15 e.
Human Factors Review The following comments were based on the old Writer's Guide, but should still be valid. There would be additional comments, if this procedure was reviewed 4
according to the new Author's Guide.
l 1.
Notes and Cautions CAUTION 2, p. 5 Contains an action step)
CAUTION 5, p. 6 Contains an action step)
NOTE, P. 7 Referstoapreviousstep,nobox)
NOTES, P. 8 Appear to refer to the previous step)
NOTE, P. 9 Appears to refer to the previous step)
I l
2.
Logic Terms There is a mixture of conditional statement formats in this procedure ranging from paragraphs such as Step 5.1 to lists such as 5.3.1 and a combination of the two styles such as Step 5.4.
The other procedures use the list fonnat and so should this one.
Step 5.4 This step is overly complex and should be simplified by separating its componer.ts. Further it contains and/or combinations.
Step 5.3.4 This step contains two conditional statements, but the second one is not written correctly.
Step C5.3.5 This step contains a sovnewhat confusing "and/or" combination.
In step cs.3.sa. the "Ir" antecedent should be placed before the command " Proceed to es.3.1.6".
3.
Action Steps There are some action steps in this procedure which contain a number of actions strung together such as 5.3.3, 5.3.4, and 5.3.6 -- an action step should contain only one action.
4.
Referencing and Branching Step 5.2 does not use " proceed to", no title Step 5.5 no title Step 5.7.3 no title Step 5.10.1 no title Step 5.11 no title 5.
Action Verbs Rapidly Step 4.1 Inject Step 4.3 Control Step 5.1 Confirm Step 4.3.4 Prevent Step 5.6 Maintain Step 5.7, 5.9 Observe Step 5.8 Terminating Step 5.4 Comence Step 5.8.1 Slowly Step 5.8.1 Restore Step 5.9 B.16
4 Deenergize Step 5.3.1 Isolate Step C5.3.1 Reset Step C5.3.1.d Bypass Step 5.3.6 6.
Abbreviations and Acronyms No problems noted.
7.
Definitions Step 5.1 Define "but as low as practicable" Step 5.3 Define "by all possible means" Step 5.6.1 Define "high drywell pressure clears" 8.
Checkoffs No checkoffs were provided.
9.
Punctuation and Emphasis a) Some conditional statements do not have a comma before the THF" b)
In Step 4.3.3 the use of THEN makes the step appear as a conditional statement--use "and" instead.
B.17
Attachment C--Verification / Validation Checklist The verification and validation programs will be analyzed to detemine whether the programs address each of the following specific elements.
1.
Review the procedure that specifies the verification process to determine whether it includes the documentation listed below.
In addition, review the completed documentation for each of the activities to determine whether the requested actions /infomation are sufficient to cover the intent of the verification review as requested in NUREG-0899.
The documentation available which describes the Verification / Validation program is OSP-0008 Verification and Validation of Emergency Operating Procedures and the various foms which are filled out during the verification / validation process.
This documentation was reviewed and except for a few minor aspects covers the intent of NUREG-0899.
Verification method used River Bend used the verification process described in OSP-0008.
Discrepancies that were identified Yes, some discrepancies were identified and noted on the Verification Checklists.
Resolution of the discrepancy Yes, resolution for the discrepancies were noted. The Procedure Discrepancy Form is used for this purpose and is quite complete.
Bases for the resolution of the discrepancy A resolution for the discrepancies was requested on the verification fom.
Certification of verification of written correctness The Verification C'1ecklist is very complete and lists detailed aspects of the Author's Guide to be examined in the verification process.
Certification of verification of technical accuracy.
The Verification Checklist is very complete End lists detailed aspects of a technical review of the E0Ps.
2.
Detemine to what extent the verification / validation process used the following methods:
Desk-top reviews Desk-top reviews were carried out by a 5-6 member multidisciplinary team for the verification process.
Operating team review C.1
Operating teams did not review the procedures. During training, of course, teams do exercise the E0Ps and have the opportunity to note problems. Operators and instructors are represented on the verification team.
Simulator exercises
~
The River Bend plant-specific simulator was used to validated the E0Ps.
Control room walk-through The control room walk-throughs are used to verify that the controls and instrumentation exist and that nomenclature is the same.
i -
3.
Detemine who (from a technical expertise perspective) was involved in the verification / validation program. Specifically determine how plant operators, subject matter experts, and procedure writers were involved.
A multidisciplinary team is involved; including operators, instructors, and technical staff (engineers). The writers are not involved, because it is felt that they would be biased. They of course receive the results of the verification / validation process for corrections.
4.
Determine what roles were played by the participants.
The multi-disiplinary team perfomed the desk-top reviews of the E0Ps, and operators and the simulator supervisor handled the validation.
5.
Determine that a list of scenarios had been developed for the verification / validation process. More specifically, detemine that the following had been carried out:
~
Specific criteria were used to select the scenarios The scenarios were chosen to fully exercise the E0Ps. They were not necessarily realistic, but chosen to exercise as much of the E0P as possible.
The scenarios included multiple failures (simultaneous and sequential)
Yes, to the extent the simulator can model them.
The scenarios were broad enough to verify / validate all of the E0Ps.
Yes, all but one of the procedures (EOP-0003 SecondaryContainment) could not be exercised.
If the simulator could not be used to verify / validate all E0Ps then detemine what method was used to verify / validate the E0Ps that could not be done not be simulator.
The E0P which could not be exercised on the simulated was not updated and was dropped.
6.
Determine that an administrative mechanism exists to receive feedback on the accuracy, readability, usability, and/or completeness of the E0Ps C.2
from the following:
Simulator exercises Two forms are used as part of the validation process, the observation Checklist used by the observers of the simulator exercises and the Debriefing Checklist used by those involved in the simulator exercises. These forms are filled out and sent to the Operations Supervisor. He determines the next actions.
Control room walk-throughs This was used to verify the controls and instrumentation in the control room. No forms were used as such.
Desk-top reviews The Verification Checklist form and Procedure Discrepancy Form are used and submitted to the Operations Supervisor for review and final disposition and resolution.
Operating team reviews Operating teams as such did not review the procedures.
Operator training There is feedback from the Training Director as to their experience during training of operators on the E0Ps.
7.
If different from the administrative mechanisms analyzed for checklist item 6., determine what kind of plan exists for correcting and revising the E0Ps as a result of the validation / verification processes.
No additional administrative mechanism.
8.
Determine that there is written commitment and criteria (probably in plant Administrative Procedures) for verifying / validating revisions to the E0Ps.
Yes, in 50P-0009 Authors Guide / Control and Use of Emergency Operating Procedures, paragraph 7.0, there is a written commitment to review the E0Ps using Attachment 1 which is presumably the Verification Checklist.
This is filled out and sent to the Operations Supervisor for further action. If appropriate, verification / validation will be done on the revisions.
9.
Determine what process was used to take into account differences between Units 1 and 2 in the E0P development and verification / validation process.
Not applicable.
- 10. Determine what methodology or rationale was used to guarantee that the E0Ps are compatible with minimum control room staffing.
4 The E0Ps are validated using minimum control staffs. But there is nothing in their documentation addressing this important aspect.
C.3
.w,.
r -
~
11.
Determine whether there was a methodology used to determine the adequacy (i.e., availability, readability, and usability) of control rocm instrumentation and controls that are needed to carry out the steps in the E0Ps.
This is accomplished using control room walk-throughs and presumably was done during the Control Room Design Reviews.
- 12. Determine what kind of process was used to verify the correspondence between E0Ps and control room displays and controls.
Same as item 11.
C.4
Attachment D--Training Checklist The PGP described a training process on the E0Ps that included classroom instruction, control room walk-throughs, simulator exercises and tr.aining on E0P revisions. The training is to be given to all operators.
Interviews with cognizant training (personnel; and analysis of training program lesson plans and documentation Attendance Records, Course Critiques, Student Progress Evaluations, Training Program Descriptions, Lesson Plans) was carried out to detemine whether the following training elements were addressed.
1.
Determine how the lesson plans for E0P classroom training meet the following objectives:
Operators will be trained regarding the general format and structure of the procedures.
The training as reportedly perfonned with respect to the E0Ps is a i
combination of classroom training, simulator exercises, and control room walk-throughs. A wide variety of scenarios are provided including multiple failures within the constraints of the simulator.
The trainees are evaluated at the end of classroom training with written tests; at the end of simulator exerciset through instructor _
evaluations, self-critique, and team critique; and throughout control room walk-through by their assigned licensed operators. This approach and the documentation used for the training and the evaluations appear to be adequate to achieve this objective and all of the objectives listed below.
Operators will be trained on the technical bases for each of the procedures.
See above.
Operators will be trained on the content of each procedure.
See above.
Operators will be trained on guidelines on the use of the E0Ps.
See above.
Operators are evaluated on their classroom training.
See above.
2.
Determine how the simulator training meets the following objectives:
That a wide variety of scenarios (i.e., incorporating :;1multaneous and sequential multiple failures) will be used during timulator training i
j so that all E0Ps are exercised.
During initial operator training simple failures are used which get increasingly more difficult as training progrestes. During requalification training, more complex scenarios are used with some multiple failures within the constraints of simulator capabilities.
D.1
,,,-,_m
_--,-----.m,-
i
- That all operators are trained on all procedures.
All operators are trained on all E0Ps, but not necessarily on all steps, because of simulator limitations.
That operators are evaluated on their simulator training. -
Durir.g initial operator training, each operator is evaluated by a committee (composed of the Operations Director and the training staff). During requalification training an instructor fills-out an evaluation sheet for each operator.
Further self-critique and team critiques are used. Sometimes video tapes are used for team reviews 4
and instructor reviews as part of the evaluation process.
3.- Detemine what type of continuing training will be carried out regarding 1
both classroom and simulator training.
The requalification training is the continuing training which includes both classroom and simulator training. With respect to E0Ps, training is provided for E0P revisions.
d Detemine what criteria exist for deciding what kind of training ()i.e.,
4.
4 self-taught, shift briefings, classroom. instruction, and simulator needs to be carried out with regard to revisions on the E0Ps.
l When major revisions occur to E0Ps, the operators are given immediate classroom and simulator training. When minor revisions occur the operators are required to read the changes and then the changes are reviewed during the next requalification training.
5.
Determine whether all of the E0Ps can be trained on the simulator. If such is not the case, detemine what type of training is planned for those E0Ps or parts of E0Ps.
All E0Ps can be trained on the simulator, but not all steps. They will stop a simulator exercise where they cannot model steps and will discuss these steps. The classroom training will also cover these steps.
6.
Detemine whether and to what extent control room walk-throughs will be used for training purposes.
Control room walk-throughs are used during initial training. Each operator will walkdown the E0Ps with a licensed operator who also evaluates progress. The operator is required to repeat the walkdown if errors have been committed. The walk-through primarily consists of the operator pointing out the controls, and indicators, and reading values.
Control room walk-throughs are not used for team training as indicated in the PGP. Only 2 to 3 trainees are allowed in the control room and each is assigned to a licensed operator. Team training is actually done on i
the simulator because of its fidelity and availability.
s D.2
r---
,,,7,--,
..e
--w,,
.m
,-,,-,-,----,r,----,,,e,---.n,,,,--...-,v-----
_-,----,--,-n-,----,,nnnm.,w,--,--,----_,,---.n-- -, - _
n Attachment E--Simulator Exercise Checklists Simulator exercises were run on the River Bend plant-reference simulator during the day shift on August 20, 1986. Two simulator exercises had been developed to cover the subset of E0Ps that had been reviewed for the audit:
Scenario 1 -- Turbine Trip W/0 Bypass -- 2 SRV stuck open Scenario 2 -- Loss of High Pressure Feedwater -- ATWS -- Subsequent loss of Low Pressure Feedwater (i.e. Station Blackout)
Scenario 3 -- Decreasing Suppression Pool water level (Region IV requested)
In addition to these scenarios, an additional exercise was run at the request of Region IV personnel observing the exercises as part of a regional inspection.
River Bend is a single unit BWR-6 facility with a Mark III containment. The required shift staffing is one Shift Supervisor (SRO licensed), one Assistant Shift Supervisor (SRO licensed), and two licensed Reactor Operators (R0s).
Regarding the two R0s, one is assigned to the front panels and the other to auxiliary and back panels. Only one of the SR0s is required to be in the control room. Thus, when an emergency event first occurs, River Bend's plan is for two R0s and one SRO to staff the unit. The other SRO licensed operator is to report to the control room as soon as possible following an emergency accident, but is not required for the implementation of the E0Ps.
River Bend provided two R0s and two SRO for the simulator exercises. The simulator instructor served as all other plant staff and the STA on all of the scenarios. During the first scenarios, two SRO were allowed to participate, one as the Shift Supervisor and the other as the Chief Control Room Supervisor. During the second and third scenarios the control room operating staff was reduced to one SRO and two R0s to exercise the procedures using minimum staffing.
The simulator exercises were frequently stopped to question the operator on actions, reasons for operational decisions, and to allow the SRO to cpdate his i
bookkeeping. Additional this time was also helpful to determine the criteria used for branching and transitioning within a given procedure or to another procedure.
It was discovered that due to the rapidness of the simulated events and the urge of the operators to control the plant rather than allowing the procedures to dictate the mitigation of the event, that it was necessary to request the operators to not perfonn anticipatory actions without being j
directed to by the procedure.
The following pages contain the checklists that were used to evaluate the i
simulator exercises. The checklists are filled out for the two planned and one requested exercises listed above. Checklist items that were not applicable did not receive a response.
I E.1 i
=
+
SIMULATOR EXERCISE CHECKLIST RIVER BEND POWER STATION SCENARIO 1: TURBINE TRIP W/0 BYPASS -- 2 SRVS STUCK OPEN 1.0 Can the operators follow the procedures as written?
Yes No 2.0 Did the use of the procedures mitigate the transient?
Yes No 2.1 If NO, did the operators have to leave the procedures and wing it?
Yes No 2.2 Did the operator add steps or exit to an unspecified procedure?
Yes No 2.3 Can the procedures handle concurrent multiple failures?
Yes No 2.4 Can the procedures handle sequential failures?
Yes No 3.0 Can the procedures be used effectively by the minimum control room staffing?
Yes No 4.0 Are the transitions to other procedures clear and easily followed?
Yes Ng E.2
,.c---.
,.-,-c
,7
,,,e, n..-,..
SCENARIO 1 (CONT.): TURBINE TRIP W/0 BYPASS -- 2 SRVS STUCK OPEN S.0 Do the diagnostics direct the operators to the correct procedure?
Yes N5-6.0 Are the operators comfortable in using the procedures?
Yes N2 7.0 When the operator is following the procedure is his movement along the control board reasonable?
Yes No 8.0 Are the instruments and labels easily read and understood by the operators?
Yes No 9.0 Are the readings requested in the procedures available directly from the instruments?
Yes No 10.0 Is the relationship between the various procedures understood?
Yes No Operator Comments Observer Comments The " expected" path took the SRO to a decision point where he was required o
to control level by two different methods. The SRO made the decision without procedural guidance as to which method was to be used. An inexperienced operator may not have made the same choice, potentially creating a more serious condition.
o The reactor operators and the SR0s (including the one in charge of executing the procedure) got ahead of the direction in the procedure on occasions when they knew what was coming, potentially creating a situation when steps are misperformed or even left out.
o The SRO when confronted with the execution of an "If" logic statement made the decision as to proceed or hold at that step without specific procedural guidance. When asked for the decision criteria the operator stated it was
" experience dependent".
o The SRO would transition within a given procedure to steps previously passed, due to their not being able to be performed, at the operators discretion then skip back to the current step being executed.
The reactor operators were able to maintain control of the emergency event o
due to experience and training rather than from verbatim procedural adherence.
E.3
,,m
SIMULATOR EXERCISE CHECKLIST RIVER BEND POWER STATION SCENARIO 2:
LOSS OF HIGH PRESSURE FEE 0 WATER -- ATWS -- SUBSEQUENT-LOSS OF LOW PRESSURE FEEDWATER (i.e. STATION BLACK 0UT) 1.0 Can the operators follow the procedures as written?
Yes No 2.0 Did the use of the procedures mitigate the transient?
Yes No 2.1 If NO, did the operators have to leave the procedures and wing it?
Yes No
'2. 2 Did the operator add steps or exit to an unspecified procedure?
Yes No 2.3 Can the procedures handle concurrent multiple failures?
Yes No 2.4 Can the procedures handle sequential failures?
Yes No 3.0 Can the procedures be used effectively by the minimum control room j
staffing?
Yes i
No 4.0 Are the transitions to other procedures clear and easily followed?
Yes Ng E.4
,,o' e
SCENARIO 2 (CONT.): LOSS OF HIGH PRESSURE FEEDWATER -- ATWS -- SUBSEQUENT LOSS OF LOW PRESSURE FEEDWATER (i.e. STATION BLACK 0UT) 5.0 Do the diagnostics direct the operators to the correct procedure?
Yes 1
No j
6.0 Are the operators comfortable in using the procedures?
Yes u,
7.0 When the operator is following the procedure is his movement along the control board reasonable?
Yes No 8.0 Are the instruments and labels easily read and understood by the operators?
Yes No 9.0 Are the readings requested in the procedures available directly from the instruments?
Yes No 10.0 Is the relationship between the various procedures understood?
Yes No Operator Comments o Operators stated following the scenario that they felt uncomfortable with the guidance provided in the procedures for " Steam Cooling mode" as well as transition from E0P-0001 (RPV CONTROL PROCEDURE).
Observer Comments o Items 2.2 and 6.
Transitions were non-specific. The operator in one occation believed that (according the the procedures) they could have been in all AOPs with the core uncovered, but stated that operator experience would prevent this transition from occuring.
o Operator perfomed action steps prior to procedure direction. The SRO order the execution of steps prior to reaching them in the procedure, knowing that they were going to be perfomed. The R0s would, also, suggest future procedure step. Both of these actions necessitated the audit team to intervene and remind the operators that the purpose of the exercise was to evaluate the usability of the procedures and not how well they had memorized them.
During this exercise, as in the first, it became apparent that the o
sucessful execution of the E0Ps was very much dependent upon the SR0s experience, training, and overall plant knowledge.
i E.5
e
?
., e' e
SIMULATOR EXERCISE CHECKLIST RIVER BEND POWER STATION SCENARIO 3: DECREASING SUPPRESSION POOL WATER LEVEL 1.0 Can the operators follow the procedures as written?
Yes No 2.0 Did the use of the procedures mitigate the transient?
Yes Ng 2.1 If No, did the operators have to leave the procedures and wing it?
Yes No 2.2 Did the operator add steps or exit to an unspecified procedure?
Yes Ng 2.3 Can the procedures handle concurrent multiple failures?
Yes No 2.4 Can the procedures handle sequential failures?
Yes No 3.0 Can the procedures be used effectively by the minimum control room staffing?
Yes No 4.0 Are the transitions to other procedures clear and easily followed?
Yes No E.6
/
e
< l' '
o SCENARIO 3 (CONT.): DECREASING SUPRESSION POOL WATER LEVEL 5.0 Do the diagnostics direct the operators to the correct procedure?
Yes No 6.0 Are the operators comfortable in using the procedures?
Yes No 7.0 When the operator is following the procedure is his movement along the control board reasonable?
Yes No 8.0 Are the instruments and labels easily read and understood by the operators?
Yes No 9.0 Are the readings requested in the procedures available directly from the instruments?
Yes No 10.0 Is the relationship between the various procedures understood?
Yes No Operator Comments Observer Comments Operators got ahead of the SR0 on occasions when they knew what was coming o
and were again directed not to perform anticipatory actions.
o Items 2.0 and 2.1 Once the operators had initiated suppression pool make up there was no procedural guidance as what to do. The operators took it upon themselves to take continous corrective action to mitigate the simulated event. The simulator instructor finally made a unrequested announcement to the cause of the suppression pool level decrease, to with the operators responded.
E.7
.o
- . n Attachment F--Control Room Walk-Through Checklist There are three objectives to be accomplished in the control room walk-through:
To detemine whether the control room nomenclature corresponds to the way in which instruments and controls are referred to in the E0Ps To detemine whether the instrumentation can be read to the accuracy required to carry out the. E0Ps 4
To detemine if the E0Ps are readily available to operators and are easi'y identified from other procedures.
In order to meet these objectives, E0P-0001 and E0P-0002 were selected for review. A control room check of E0P l
availability, identifiability, and all nomenclature and accuracy requirements in the procedures were conducted. The review found that the E0Ps were readily available in the control room and easily accessible to the operators. The E0Ps were filed together, in order, and were easily identifiable from the other procedures. The following discrepancies were found between E0P nomenclature or required accuracy levels and control room labeling and instrumentation.
E0P-0001 -- RPV CONTROL Entry Conditions: The E0P used the unit "psig", but the panel used " psi" or " psia".
Note 2:
The E0P used the unit "psid", but the panel used "psta".
Step C3.2.4: the E0P used the control nomenclature "1E121*MOV094", but the panel used IE121*F094.
Note 9:
The E0P states "3651 gal", but the meter is graduated in 10ths, thus the operator must estimate the location of the "1"on the meter.
i E0P-0002 -- PRIMARY CONTAINMENT Note 1:
The E0P states "RHR INLET TO HX Al" and "RHR INLET TO HX B1", but in both cases the "HX" was "HX1" on the panel.
Step C3.4.2: The E0P used valve nomenclature "1HVR*AOD127", but the panel uses" 1HVR-AOD127 which is the correct designation.
Step 3.4.7:
The E0P refers to a set of " Air Isolation Valves",
but the panel used " INST AIR SHUT 0FF VALVE".
4 The above discrepancies are not considered to be a serious threat to operator perfomance while using the E0Ps.
F.1
- - -