ML20246E463
| ML20246E463 | |
| Person / Time | |
|---|---|
| Issue date: | 04/30/1989 |
| From: | Lapinsky G Office of Nuclear Reactor Regulation |
| To: | |
| References | |
| NUREG-1358, NUDOCS 8905110267 | |
| Download: ML20246E463 (30) | |
Text
-
l NUREG-1358 Lessons Learned From the l Special Inspection Program for Emergency Operating Procedures Conducted March-October 1988 l
l 1
U.S. Nuclear Regulatory Commission Office of Nuclear Reactor Regulation a atc pa oq,?+
yy j
23
- . e i
eyS1 og 890430 1358 R pan
i AVAILABILITY NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited in NRC publications will be available from one of the following sources:
1.
The NRC Public Document Room, 2120 L Street, NW, Lower Level, Washington, DC 20555-2.-
The Superintendent of Documents, U.S. Government Printing Office, P.O. Box 37082, Washington DC 20013-7082 1
3.
The National Technical information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publica-tions, it is not intended to be exhaustive.
j Referenced documents available for inspection and copying for a fee from the NRC Public Document Room include NRC correspondence and internal NRC memoranda: NRC Office of inspection and Enforcement bulletins, circulars, information notices, inspection and investi-gation notices; Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence.
1 The following documents in the NUREG series are available for purchase from the GPO Sales Program: formal NRC staff and contractor reports, NRC-sponsored conference proceed-ings, and NRC booklets and brochures. Also a"ailable are Regulatory Guides, NRC regula-tions in the Code of Federal Regulations, and Nuclear Regulatory Commission issuances.
Documents available from the National Technical Information Service include NUREG series reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.
Documents available from public and special technical libraries include all open literature items, such as books, journal and periodical articles, and transactions. Federal Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries.
l Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference proceedings are available for purchase from the organization sponsoring the publication cited, Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the Office of Information Resources Management. Distribution Section U.S.
Nuclear Regulatory Commission, Washington, DC 20555.
Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library,7920 Norfolk Avenue, Bethesda, Maryland, and are available there for reference use by the public. Codes and standards are usually copy-righted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards institute,1430 Broadway, New York, NY 10018.
Lessons Learned From the Special Inspection Program for Emergency Operating Procedures Conducted March-October 1988 ateIu ished Apr i 989 Division of Licensee Performance and Quality Evaluation Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Weshington, D.C. 20555
,s ~a.
/
ABSTRACT The results of the team inspections conducted during during the EOP team inspections and restates the staff's 1988 for the Nuclear llegulatory Commission (NRC) previous guidance in a format that more clearly illustrates Emergency Operating Procedures (EOPs) Inspection the consequences of programmatic weaknesses.
Proc. ram are summarized in this report. Inspection results The information contained in this report is provided so are discussed in relation to past staff guidance provided to that licensees may take advantage of the lessons learned utilities for upgrade of EOPs. In this report the NRC pre-from the EOP inspection effort.This report does not im-sents information of particular interest to the nuclear pose any new requirements related to the upgrading of power iadustry regarding concerns that were identified EOPs.
i l
I fii NUREG-1358 i
.--------------__j
i 1
CONTENTS Abstract.
iii Acknowledgement...
.. vii 1
In trod uction...........................
1 2
Backgrou nd.....................
.1 3
Discussion..........
2 3.1 B asis Docu m e n t s......................................
..... 2 3.1.1 Technical Guidelines
..... 3 3.1.2. writer's Guide 4
3.2 EOP Production................
5 3.3 Verification And Validation.......
......... 6 3.4 Training...............
7 3.5 Maintenance And llevision...
.8 3.6 Management Issues.......................
...... 9 4
Conclusions...................
9 5
It eferences.......................
..... 10 Appendices A Temporary Instruction 2515/92 B
I.ist of Plants Inspected in 1988 C
Commonly Found Weaknesses in EOP Structure o
Findings llegarding Containment Venting l
l l
I y
NUltEG-1358
l l
l ACKNOWLEDGEMENT This report was prepared through a joint effort of person-ence Applications International Corporation (SAIC).
nel from the iluman Factors Assessment Branch, Divi-The Human Factors Assessment Ilranch acknowledges sion of Licensee Performance and Quality Evaluation, the efforts of Anne Sutthoff of SAIC for her contribu-Nuclear Regulatory Commission (NRC) and from Sci-tions in developing this report.
vii NUREG-1358
l l
l l
I 1
INTRODUCTION these owners' groups developed generic technical guide-lines that set forth desired accident mitigation strategies.
j in this report, the Nuclear Regulatory Commission These generi'c technical guidelines were to be used by the (NRC) staff summarizes and discusses findings from the licensees in the development of plant-specific guidelines Emergency Operating Procedures (EOPs) Inspection that would subsequently provide the technical basis of the Program.The purpose of this report is to inform the nu.
EOPs.
1 clear industry of the state of EOPs at the 30 plants that were inspected during 1988, to reiterate NRC guidance Generic Letter 82-33 transmitted Supplement 1 to for utility programs to upgrade EOPs, and to re-NUREG-0737, Requirementsfor Emergency Response Ca-emphasize the importance that the NRC places on high pability, and directed each licensec to submit to the NRC quality EOPs and their supporting programs, a PGP that includes plant-specific technical guidelines including plant-All four major types of reactors consistently exhibited the problems identified in EOPs during this initial phase of specific information justifying safety-significant dif-the inspection program. The most significant finding, ferences from the generic technical guidelines however, is that the root cause of these problems was pro-a plant-specific writer's guide for preparing EOPs grammatic, that is, weaknesses within the EOP programs e
that were established for EOP development,implemen-a description of the program to be used for valida-tation, maintenance, and training. Licensee programs generally did not implement the available guidance for tion of the upgraded EOPs upgrading EOPs. Because of the apparent confusion and a description of the training program for the up-e misunderstanding regarding the intent of the staff's guid.
ance for developing and implementing EOPs, this report graded EOPs has been organized to restate the staff's guidance and re-quirements and to clarify theintent of the staff'sguidance Using this PGP, licensees were to develop function, or by providing examples in which programmatic weak-symptom-based. EOPs that would provide the operator with directions f.or mitigating consequences of a broad nesses resulted in actual problems with plant EOPs.
range of accidents and multiple equipment failures.
These upgraded EOPs were to be developed using human In the Discussion section of this report, the staff describes factors engineering principles.
in detail the elements of EOP development,implementa-tion, maintenance, and training that are essential to the The NRC staff's early reviews of EOP programs and pro-process of upgrading EOPs. Examples of the specific cedures identified potential concerns with their imple-problems found during the inspections are used to illus-mentation. In response to these findings, the NRC staff trate the consequences of programmatic weaknesses in conducted inspections at five plants to monitor the indus-these areas.
,s procedure upgrade programs. During these inspec-tions, a number of problems were identified. Information 2
BACKGROUND Notice 86-64 was issued in August 1986 to alert licensees Following the Three Mile Island (I'MI) accident, the NRC Office of Nuclear Reactor Regulation developed The staffinspected six more plants over the course of the theTMI Action Plan (NUREG-0660 and NUREG-0737),
next year with similar results. Information Notice 86-64, which required licensees of operating reactors to Supplement 1, was issued on April 20,1987, to describe reanalyze transients and accidents and to upgrade EOPs further problems with EOPs and PG Ps, and to inform the (Item 1.C.1). The plan also required the NRC staff to de-industry that the inspection effort would be intensified. In velop a long-term plan that integrated and expanded ef-late 1987, the NRC developed and implemented an accel-forts in writing, reviewing, and monitoring plant EOPs crated pilot inspection program. The program empha-l (Item I.C.9). N URI:G-0899, Guidelim sfor the Preparation sized a detailed, performance-based inspection, in con-ofEmergency Operating Procedures, provides the N RC staff trast to past EOP inspections and audits that had empha-guidance for upgrading EOPs, including the use of a pro-sized the review of programs and supporting documents.
cedures generation package (PGP) to prepare upgraded The primary focus of the inspection program, which has EOPs.
now been extended to all operating reactors in the United States,is to assess the adequacy of the EOPs themselves In response to the TMI Action Plan, the firensees formed and then, as a secondary issue, to establish that the sup-four vendor-based owners' groups corresponding to the porting programs and documents are sufficient to ensure four major reactor types in the United States: lkbcock &
the integrity and continued adequacy of the EOPs. NRC Wilcox, Combustion Engineering, General Electric, and Temporary Instruction 2515/92 was issued in April 1988 Westinghouse. Working witn the vendors and the NRC.
and specifically defines the objectives of the inspection.
This temporary instruction is attached as Appendix A.
New requirements and guidance, such as that included in The primary objectives are Supplement I to NURIIG-0737, specifically identify the interdependent nature of initiatives such as the perform-to determine whether the EOPs are technically cor.
ance of a detailed control room design review, the design e
rect (That is, to determine if the plant-specific of a safety parameter display system, and the upgrading of guidelines generally conform to generic guidelines 1: ops and associated instrumentation.
of the specific vendor and if technical justification has been provided for safety significant deviations The staff addressed the four basic factors mentioned from vendor guidelines.)
above in its requirements for function-oriented procc-dures. The new function orientation of the EOPs is in-to assess whether the IIOP3 can be physically carried tended to de-emphasize the need to diagnose abnormal e
out in the plant (For example, to determine that ref-events and, therefore, reduce the potential for over-crenced instruments and controls are present and reliance on operator skill and experience. In addition to accessible, the environment in which actions must be directly addressing the need to upgrade I! ops in a way taken is safe for operations, time constraints do not that would more realistically complement operator needs hamper plant personnel from taking designated ac-and capabilities, the staff described programmatic cle-tions, and necessary tools, personnel cids, and pro-ments to address the other three basic factors as well. Li-tective equipment and dothing are availabic.)
censees are required to upgrade emergency procedures in both content and form, to analyze emergency tasks to de-to evaluate whether the plant personnel can cor-terminc operator needs, and to train operators on the use e
rectly perform the procedure (For example, to de.
of upgraded !! ops. Licensees are required to document termine that plant staff understand the procedure, these actions in a procedures generation package that in-functions are appropriately alk)cated, sufficient staff cludes are available to perform functions in time available, plant-specific technical guidelines that provide the and procedures can be used under adverse environ.
e mental conditions.)
technical basis for the actions called for in the up-graded liOPs (I.icensees using generic technical A sample of 16 plants representing the four vendor guidelines are only required to justify plant-specific groups was selected for the pilot phase (EOP-1)of the in-deviations from the generic technical guidelines.)
spection program.'lhe first of these inspections began on a writer's guide that details the form and structure e
March 14,1988. Soon after EOP-1 begrm, a second phase of inspections (l!OP-2) was initiated at all boiling water that the EOP writer should follow in preparing IIOPs reactors with Mark I containments, with special focus on containment venting procedures. Following the comple-tion of the EOP-1 and EOP-2, one additional Westing-a description of the validation program to be used to e
house plant was inspected in late 1988 at the request of an confirm that the EOP system (i.e., operator /proce-NRC regional office. Although the inspections included a dure / equipment /traueng) performs adequately so distribution of plants very different in design, many of the that the identified needs of the operator are satisfied problems manifested in the emergency operating procc-and the operator tasks identified in the EOPs can ac-dure programs were common across all groups. There-tually be accomplished fore, the results discussed in this document encompass a description of the training program for upgraded e
findings from a total of 30 inspections. A list of the plants EOPs thM will ensure that all operators receive ade-inspected is provided as Appendix B to this report.
quate training on the use of EOPs prior to imple.
mentation 3
DISCUSSION This is the conceptual framework upon which the staff When systems are designed to incorporate a human op-based its expectations for development of upgraded crator as a system component, there are several basic, in-EOPs. Further discussion of the various program ele-terdependent factors that must be properly addressed if ments is provided below, along with a summary of the ac-the system is to perform its function successfully. These tual state-of-the. industry as represented by the 30 plant factors are (1) operator capabilities, (2) procedures, (3) sites inspected in 1988.
plant / equipment design, and (4) training.
Subsequent to the accident at TMI, the NRC staff recog-nized the need to address these and other human factors Two main documents constitute the basis for developing at nuclear power plants in order to minimize the potential liOPs. The first, the plant-specific technical guidelines, for human error in plant operation and maintenance.
establishes the technical foundation of the procedures.
NUREO-1358 2
I s
format for the procedures that integrates principles of hu-who are responsible for writing and maintaining EOPs.
man performance, such as information processing and de-Information on tne methods and assumptions used to cision making. Details regarding the development and adapt the generic guidelines to plant-specific guidelines j
maintenance of these two documents are contained in and justification for all deviations from the generic tech-j N U R EO-0899, Guidelinesfor the preparation of Emergency nical guidelines also should be available. Once devel-
]
Opcrating Procedures.
oped, plant-specific technical guidelines should be con-1 sidered a living document. Changes to plant design, con-
)
trol room inst rumentation, technical specifications, or ge-l 3.1.1 Technical Guidelines neric technical guidelines, may require that the plant-spe-j Technical guidelines are documents that identify the cific technical guidelines be revised. The revision and equipment or systems to be operated and list the steps maintenance proecss should be formally controlled to en-necessary to mitigate the consequences of transients and sure the timeliness and accuracy of future revisions to the accidents and to restore safety functions. Technical guide.
EOPs. One way of accomplishing this is to include the lines provide the basis to translate engineering data de.
plant-specific technical guidelines m the plant's overall rived from transient and accident analyses into informa, quality assurance program.
tion that can be used to write EOPs.The guidelines are l
function-oriented so that EOPs written in accordance The majority of the plants mspected in 1988 did not have with them can be used by an operator to mitigate the con-complete, up-to-date documentation of the justificatmn for deviations from the generic technical guidelines.This sequences of an emergency without first having to diag-problem ranged from minor (a few unjustified deviations nose tlw event causing the emergency.
from the generic technical guidance) to major (no i
auditable technical documentation at all). Many utility Oencric technical guidelines are those developed by a re-actor vendor owners' group for those plants using its pgrsonnel were unaware that documentation of the tech-meal basis was necessary, others did not see its value, design.
whether required or not. Most did not understand that the technical guidance documents should be controlled Plant :gecific techm. cal guidelines are those developed and kept current because they are the basis for the devel-exclusively for use at an individual nuclear power plant.
opment of and revision to EOPs. As a result of these Plant-specific techmcal guidelmes are generally based on weaknesses in technical basis documents, the EOPs at an integration of the generic guidelines with plant-many plants contained incorrect or unnecessary steps that specific mformation, mcludmg specific justification for were inconsistent with the generic technical guidelines.
deviation from the applicable generic techmcal guide-
\\Veaknesses in the plant-specific technical guidelines lines.
were often complicated by other programmatic weak-nesses such as inadequate technical review or poor verifi-As part of the EOP upgrading process, the staff required cation and validation (V&V) programs. (See Section 3.3 that an analysis be conducted to identify the operator for further discussion of staffing and V&V concerns.)
tasks that are necessary to support the functions required to restore the plant to a safe state. By using information During the inspections, the NRC staff identified many in-from this task analysis, EOP developers can specify the stances in which the EOPs and their corresponding con-characteristics of the instrumentation and controls neces-trols and displays were inconsistent. In some cases the in-sary to accomplish cmergency tasks. In addition, such is-strumentation and equipment referred to in the EOPs sucs as the environmental conditions under which the was not capable of providing the intended function; in tasks must be performed, the roles and responsibilities of other cases it was inaccessible or could not be located.
plant personnel, and the identification of any required 10-Often the operator action setpoints provided in the EOPs cal actions also are considered.The staff encouraged that had not been accurately documented and subsequently the same systems review and task analysis that was con-were not confirmed as being supported by control room or ducted as part of the control room design review be incor-local instrumentation. As a result, setpoints and entry porated into the development of the plant-specific tech-conditions given in the EOPs were sometimes incorrect nical guidelines and EOPs-and often were not supported by suitable instruments-tion.
The development of technical guidelines should be suffi-ciently documented to show the flow of information from During the inspections, the staff found that some licen-the analytical basis to the guidelines. This documentation sees did not adequately control and update their technical should address (1) the assumptions upon which the analy-guidelines.This led to inconsistencies between the EOPs sis was based, (2) the results of the analysis, and (3) the and the technical guidance that sometimes could not be actual process used to generate the technical guidelines, resolved by plant personnel. For example, there were no including the verification and validation process. This provisions for checking revisions to the EOPsagainst documentation should be available to plant personnel the technical basis documents to ensure that analytical 3
NUREO-1358
l technical basis documents to ensure that analytical as-ture of the EOPs. Use of such a writer's guide ensures sumptions were not violated. In a few cases this resulted consistency of the EOPs over time, no matter how many in setpoints being revised in a nonconservative direction.
revisions and personnel changes take place.
In addition, at a few plants it was difficult to determine which was correct, the basis document or the EOP.
Many of the problems identified in EOPs during the in-spections resulted from omissions or vaguely stated, non-I
**'i'*I"* P'i"'I I'8 I" *'I' 8 8"Id'8' I ' * " P "*
P 3.1.2 Writer's Guide most of the plants using a flowchart format for the EOPs, the writer's guide either provided incomplete guidance The second major basis document used to develop the for the development of flowcharts or did not address flow-EOPs is the plant-specific writer's guide. The writer's charts at all.The staff recently issued NUREO/CR-5228, guide should establish plant policy for the presentation of Tecimiquesfor Preparmg Flowchart Format Emergemy Op-information within the EOPs based on human factors cratmg Procedures Volumes 1 and 2, to provide such guid-principles and defined plant-specific conventions. The ance.
writer's guide should contain all the necessary directions for structuring technical information into usable EOPs.
In addition to omissions, other problems exist with regard Therefore, available guidance and human factors exper-to the development and use of plant-specific writer's tise should be applied to the development of the writer's guides. Iluman factors principles were often not consis-guide so that available knowledge about effective presen-tently applied in the writer's guide. In some cases the writ-tation is considered in the development of EOPs. Use of a er's guide was not used at all during the development of complete and explicit writer's guide will help ensure that EOPs, or the writer's guide was developed after the pro-the EOPs are readable, convenient to use, and under-duction of the EOPs. Some deficiencies could have been stood by personnel.
avoided if licensees had adhered to their own writer's gu des.
The structure and format of procedures can contribute significantly to their comprehensibility and can minimize Instances were identified in which the wording, sequence, operator confusion and errors. Structure and format can or organization of EOP steps was potentially mister. ding.
aid the operator in quickly finding the necessary informa-Of particular concern was the high incidence of problems tion. Conversely, structure and format of EOPs can im-with cautions and logic statements. For example, cautions pede operator performance and directly contribute to cr-were sometimes found following rather than preceding ror.
the related action. In these cases there is a high likelihood of an operator missing the critical information at the time There are some basic principles that should be considered it is needed. In many cases action statements were found in the development of the writer's guide that are applica-embedded in notes and cautions. Again, this increases the ble to all EOPs. EOPs should be consistent in organiza-chance that the step will be overlooked and that an error tion, style, and content. Consistency is important to en-will occur. Ambiguously worded logic statements also ap-sure readability and smooth transition within and be-pear to be widespread. Operators had difficulty perform-tween procedures. Movement withm and between proce-ing some emergency actions during the simulator scenar-dures should be minimized to reduce the possibility of an los because the logic statements were poorly worded or operator losing his/her place in the procedure. Uccause had more than one possible meaning.
stress increases the difficulty with which decisions are made, every effort should be made to minimize and sim-Excessive transitions or incorrect transitions that increase plify the decisions that the EOP user must make. Critical the possibility of operator error were found at many information reh ting to equipment damage or danger to plants. At one plant an incorrect transition, which had human life must be presented in a way that ensures it will been previously identified but not corrected, caused an not be overlooked.
operator to inadvertently skip 12 steps. Use of a thorough writer's guide could have prevented this problem at its in-Performance shaping factors such as Ihe characteristics of ception; a good verification and validation (V&V) pro-the environment (e.g., lighting and control room layout),
gram could have corrected it before it was incorporated the particular emergency situation (e.g., time pressure into the EOP.
and workload), and the operator (e.g., individual training and experience) may affect the usability and acceptability During these inspections, the staff found that operators of the EOP.These issues also should be considered in the normally did not have difficulty following steps in the development of the writer's guide.
main sequences, but often neglected to read or consis-tently check cautions, notes, tables, and graphs if they The issue of overriding importance is the completeness of were placed outside the main flow of the action and deci-the writer's guide, it should address every aspect of the sion steps. This was more commonly observed at plants EOPs and should be restrictive in defining form and struc-using EOPs with a flowchart format.
l 1
Generally, peacekeeping in the text of EOPs was either sider the human performance aspects of the procedures.
not considered or was left to the discretion of the opera-Technical writers can contribute expertise in a clear and tor. When operators were required to execute several text concise writing style, but they lack expertise in the way hu-procedures concurrently, difficulties in peacekeeping man beings perform in a man-machine system. Human were common.
factors specialists sometimes lack expertise in plant per-formance, but are able to integrate knowledge about hu-Commonly, readability standards for EOPs were not ad.
man performance and information processing into procc-dressed in writer's guides at plants inspected. At many dures in a way that will optimize usability and minimize human error Through the involvement of staff with skills plants poor reproduction quality or glossy lamination drawn from various disciplines, procedures can be devel-made reading the EOPs difficult for operators. Size of the page, orientation of the information on the page, and oped to maximize reliability anJ safety through the con-placement of critical information outside the flowpath sideration of capabilities and limitations of both the me-were all found to contribute to operator performance dif.
chanical and human components of the system. It also is important to involve the operating personnel in this proc-ficulties.
ess. Not only does this increase usability of the EOPs, but personnel involvement in the development process helps Hecause licensees often did not understand the signifi-in cance of format problems within the EOPs," Commonly E [ case their acceptance of the procedures wh Found Weaknesses in EOP Structure,"is provided as Ap-pendix C to this report. 'lhe appendix describes some of the more common problems in EOP structure that are This team approach generally was not utilized. EOP de-potential causes of operator error.
velopment efforts commonly lacked human factors skills.
A few also had no plant engineering involvement.
3.2 EOP Production EOPs developed without the benefit of a multidiscipli-The production of EOPs is based on two primary cle-nary team approach were found to be lacking in a number l
ments. The first, technical content, is developed from the of ways. Although most EOPs were technically technical guidelines along with additional sources of in-adequate-that is, the content was correct-many were formation such as plant-specific design characteristics, poorly organized, formatted, and written. These transient and accident analyses, reference plant analyses, procedures were difficult for operators to use; occasi-plant-specific task analysis, engineering judgment, and onally the lack of usability of these procedures caused operating experience.The second, the presentation of in-confusion, delay, and errors during the execution of formation in the EOPs, is determined by the principles emergency actions.
defined in the plant-specific writer's guide. As described in the previous section, use of a writer's guide that ad-dresses all aspects of the structure of EOPs and defines EOP program staffing usually consisted of one individual, who often had other concurrent duties, thus his/her devo-clearly how the EOPs are to be designed will ensure con-sistent production of high quality procedures over time tion to the EOP program was a part-time effort. Few and through personnel changes. In addition, of a thor-plants had full-time EOP program managers. The indi-ough writer's guide that integrates human factors princi-viduals responsible for the EOPs sometimes were aware plcs is necessary to convert technical guidelines into ac-of the problems in the procedures, but simply did not have the resources available to make the necessary improve-ceptable EOP form, ments. At a number of plants, operators were not in-volved in the review of EOP revisions, nor were their The technical guidelines are not procedures. Because hu-comments solicited as part of the review process. During man factors principles were not applied to the generic the inspections at these plants, operators often told the technical guidelines, EOPs identical to these guidelines inspection teams that they had previously commented on are not designed in a manner that takes into consideration the same problems the mspectors were identifymg, but the way in which people process information during an with no resulting action from plant management.
emergency.
Appropriate staffing is extremely important to the devel-At many of the plants inspected,the staff found problems opment of good emergency procedures. Because of the within the EOPs that were caused by writers using the need for correct technical information within procedures, wording from the generic technical guidelines as instruc-senior operators or engineers often are given the task of tional steps in the EOPs. At several plants operating writing procedures. Ilowever, individuals so focused on crews were not sufficiently involved in EOP development the technical information and so familiar with the opera-and review processes. This resulted in poor operator un.
tion of the plant are not always able to objectively con-derstanding and acceptance of EOPs at these plants.
3.3 Verification and Validation simulator should be revalidaica on a piant-specific simu-lator when one becomes available.
Verification is the process of checking that the proce-dures are technically correct, that there is a coirespon-
'.lhe team approach that the staff encourages in the writ-dence between the procedures and the hardware, and mg of procedures is also advisable for V&V to ensure that that the procedures accurately adhere to the go.idance the vanousaspects of the content and use of thc EOPs are found in the writer's guide. Validation is the process of tested. The V&V process and results should be docu-excreising procedures to ensure that they are usable, that mented for future reference as part of the EOP design ba-the language and level of information is appropriate for sis so that future revisions will not undo any improve-the people for whom they are intended, and that the pro-ments that are identified during V&V.
cedures will function as intended.
Major omissions in the verification and validation of EOPs were pervasive at the plants inspected-incorrect, There are several methods for accomplishing verification unnecessary, or missing steps were identified at every one and validation (V&V). Desk-top review, control room of these plants. Such errors ranged in number from 8 to walkthroughs, operating team review, and simulator exer-more than 50 at an individual plant and varied in severity, cises are all useful in these processes. Verification can ranging from an unnecessary step that duplicated a previ-best be accomplished by directly comparing the EOPs ous action step to more serious errors that could result in with the plant-specific technical guidelines, writers inadvertent depressurization or potential radiation re-guide, and plant and control room hardware. This com-leases.
parison will ensure that the EOPs are technically accu-rate, that all referenced control room and plant equi -
The NRC staff identified EOP steps that required the P
ment is in place, is correctly labeled, and matches that same actions at different setpoints and dead-end steps hardware referenced in the procedures. Verification that could not be followed through because pertinent in-against the writer's guide results in consistent and com-formation was missing or incorrect. EOPs were found that I
plete procedures that maximize usability and minimize made reference to instruments, equipment, and procc-I the potential for confusion and error.
dures that were no longer in use at the plant. Infrequent actions that were not identified in the EOPs as locally Validation should be conducted in a dynamic environ-controlled actions misicd operators into scarching the ment, either through control room walkthroughs or control room for instruments that were actually located through use of a simulator. Because actual physical exe.
out in the plant. In some cases the EOPs called for an op-cution of the steps in the EOPs may be hampered by a crator to take action at a precise value that could not be number of different elements in the control room and the discriminated on the available control room instruments.
plant, full walkthroughs are necessary to ensure that all Operators were frequently required to convert instru-potential problems are addressed. Validation should in.
ment readings to the value specified in the EOPs (e.g.,
clude walkthroughs of actions that are to be executed in percent to feet).
the plant or at kwal control stations as well as actions that are executed from the control room. Simulator limita.
Control rooms often lacked sufficient table top or desk tions may be accommodated by performing walkthroughs space to allow operators to physically spread out the pro-of those portions of the procedures that cannot be veri.
cedures.This was especially a problem in those plants us-fied directly on the simulator.
ing large flowcharts or w here several EOPs had to be used concurrently. Operators were forced to resort to leaning flowcharts against the sides of the desk, where the procc-
.To ensure that all procedures that may be used durm.g an emergency are of the same quality as the EOPs, V&V dures were sometimes knocked over by passing operators.
should be performed on the full set of procedures that constitute the EOP system; that is,if actions from an ab-normal procedure are required, that abnormal procedure V&V of EOP actions that were required to be performed outside of the control room were seldom conducted. At should be checked for accuracy, usability, and so forth. To several plants, tools required for kical actions were not ensure that future revision of procedures does not duph-cate previously resolved problems, documentation of all placed at the location where required and dedicated to EOP related use only (prestaged) or were inaccessible be-verification and validation is necessary.
cause t hey were locked in a tool crib and no key was locally available. Prestaged equipment was not adequately The V&V process may be coordinated with IIOP training tested: hose couplings were found difficult to engage, such that validation on the simulator can be carried out valves were stuck closed, and hose lengths were insuffi-concurrently with the training of experienced operators.
cient. Operators were required to lift leads from termi-To ensure that all aspects of the EOPs have been thor.
nals t hat had several leads attached, but no identifiers for oughly validated, EOPs originally validated on a generic the correct leads: in other cases terminals were either not NUREG-1358 6
1 l
accessible or the jumper connectors that were provided review. Independent review is important because the l
were not correct for the circumstances. At the majority of great familiarity developers have with the EOPs desensi-plants with boiling water reactors, adequate amounts of tizes them to errors and problems. Individuals providing a boron and boric acid for alternate boration procedures fresh look at the EOPs are more likely to identify needed l
were not available.
changes. The lack of independent review found at most plants often allowed deficiencies to go unidentified At some plants the level of detail and the scope of the through the review cycle.
EOPs rcquired that all operating resources be dedicated l
to monitoring critical safety function parameters and At the plants inspected, V&V docuraentaiion was poorly control board manipulations.Thus,it appeared that these maintained and lacked details on the implementation of I
plants did not have the staffing to execute EOPs and con.
the V&V process and its results. Resolution of the V&V currently implement emergency preparedness plans.
findings also was not well documented.
Thorough validation of the EOPs would have confirmed the adequacy of plant technical specifications for mini.
The many problems identified with V&V of procedures mum control room staffing.
are especially significant because a comprehensive V&V process can serve as a check against weaknesses in devel.
Required procedurcs or valve line up sheets often were "P*C"I UI the technical guidelines and the writer's guide as well as m. the procedures themselves. lhe importance not available locally. For example, some EOPs stated that interlocks would have to be bypassed to perform specific of a gmd V&V program can hardly be overstated. At steps, but the EOPs failed to tell the operators how this many plants, implementation of the V&V program de-was to be donc, resulting in a delay while the operator scribed m the licensee's procedures generation package went to procure the necessary document. Other informa-(PGP)would have corrected most of the mspection find-tion necessary for the executica of local actions often was ings I ng before the NRC mspection teams arrived on site.
not provided. For example, vent hose pressure and tem-perature ratings were not addressed, hose couplings were not specified, and hose lengths were not verified.
3.4 Trairiirig A well-designed EOP training program, if properly im-Some EOPs did not adequately account for operator safety during execution of the emergency actions. l'or ex-picmented, will ensure that personnel have a common understand, gof(1)theconceptualbasisof the EOPs,(2) m ample, some scenarios have a potential for high-radiation the terminology and structure of the EOPs,(3) their roles levels around certain equipment such as the emergency and responsibilities during execution of the EOPs, and (4) diesel generators. High levels of radiation could make an area inaccessible and thereby prohibit execution oflocal actyal use of the EOPs. Training on EOPs is especially entical in order to overcome the degradation of perform-actions called for in the EOPs. In addition, insufficient ance that can occur during stressful situations. Specific lighting in some local areas of the plants led to difficulty in training is needed to ensure that EOP usage,includmg h>cating and controlling equipment in those areas.
terminology and format, is sufficiently understood so t hat plant operators will interpret the EOPs consistently and At most of the plants inspected, licensees did not consider correctly. Ilecause the specific effects of stress on an indi-the need for V&V beyond the designated EOPs. As a re-v dual's performance cannot be accurately predicted, sult, there were mstances m which satellite procedures training operators to have a common understanding of (e.g., abnormal, normal, annunciator response, and re-and familiarity with what the procedures look like and mote shutdown procedures) were not usable, did not pro-how they work will increase the likelihood that all opera-i vide the intended function, or were in conflict with the tors will execute the procedures in the same way.
EOPs.
After initial training on the EOPs, the type of continuing When EOPs in text format that had been previously vali-training may vary depend;ng on circumstances. Training dated were used as the basis for the des clopment of flow-on minor procedural changes may be conducted through a chart format EOPs, licensees usually did not conduct ad-program of required readings, preshift briefings, or lec-ditional V&V. However, because of the extensive differ-tures in the requalification program. Training on signifi-ences between flowchart format EOPs and text format cant changes should be conducted by the use of EOPs, validation of the flowcharts is necessary.
walkthroughs in the control room and/or on plant-specific simulators.
An independent, multidisciplinary team usually did not perform the V&V. In most cases the same individual or As evidenced by the staff's inspections, there appears to the same organization that wrote the EOP also per-be insufficient focus on EOP training at a number of formed the V&V, which climinated one of the primary plants. Operators frequently told NRC staff that they i
benefits of the V&V process-the independence of the had never gone as deeply into the EOPs as during the 7
simulator exercises carried out as a part of the inspec-dition, a policy should be established for determining tions. During simulator demonstrations and EOP when additional verification and validation should be walkdowns, it was apparent to the staff that operators at done.
several plants were not familiar with the EOP steps or the cautions that should apply. At one plant operators were A system for notifying operators of any changes to procc-only given 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> of EOP training over a 2-year period.
duru is an important part of any EOP maintenance and As a result, some of the operators were unable to execute revisien process. Unless operators and other personnel the procedures during simulator scenarios.
are made fully aware of changes to the procedures, the potential for confusion and error is substantial.
At a number of plants, operators showed or stated confu-sion regarding how to use the EOPs. In some cases these A method of soliciting and utilizing feedback from indi-same operators contradicted each other on some princi-viduals who hwe received training, as well as from train-plcs of usage.The stress of emergency conditions is likely ing instructors should be established and the results tdncrease rather than reduce operator confusion; there-documented. In addition, some ongoing mechanism for ford, these plants should either intensify operator train-soliciting and reeiving comments from operations per-ing on EOh or simplify EOP usage, or both, sonnel with regard to the accuracy and usability of the EOPs also can previde useful information.
All personnelinvolved in the execution of EOPs were not always familiar with cr trained on the EOPs. For example, Some plants had not established a program for revising at some plants shift technical advisors (STAS) are not in-tmd evaluating EOPs on a continuing basis; others had m-cluded in team training on the simulator. During the in-complete programs. At these plants no program existed spections, some STAS were unable to effectively aid the to verify revisions against the basis documents, nor was shift supervisor in maintaining critical safety functions there a system m place to ensure that changes in set-during simulated accident scenarios.
pomts, instrumentation, plant equipment, or procedures were systematically evaluated for direct and indirect ef-EOPkraining was sometimes constrained by plant simula-fccts on the EOPs or their technical basis. As noted prevf tor capability. Modeling limitations of the plant-specific msly, sgme plants did not have adequate or casily accessi-simulatcrs often prohibited the full exercise of EOPs.
ble basis documents (techmcal guidelines and writer's Utilitics lacking plant specific simulators had even more guide). Licensees often did not control thesc documents difficulty in training operators on EOPs. The NRC staff or keep them current. Therefore, even those basis docu-believes that the limitations of some simulators may bias ments that were originally correct and complete became training and EOP validation. For instance, at one plant, n dequate over time, leading to inconsistencies between the basis documents and the EOPs.
the simulator could not model decreases in reactor vessel water level-the water level always recovered without an During the inspections, the staff discovered approved re-operator actually having to provide for the injection of v sions that had never been incorporated into the EOPs, more water; consequently, the operators never had to b and required changes that had been made to only one pro-concerned with vessel mventory. Additionally, most simu-cedure when as many as five were actually affected by the f ators could not accurately model transients affecting sec-change. At one plant there was a backlog of 50 operator ondary containment or the turbine building.
change requests; another had a similar backlog of more than 100 changes. At one plant an equipment modifica-3.5 Maintenance and Revision tion was not reflected in the EOPs until months after it was completed. Usually these problems existed because A formal program for ongoing evaluation and revision of there was no easy method ofincorporating minor changes EOPs is recommended to ensure that changes in plant de-into the EOPs.
sign, technical specifications, technical guidelines, writ-er's guide, other plant procedures, or the control room Documentation supporting EOP revisions generally was are reflected in the EOPs. The program also should con-poor, and revisions to the EOPs were seldom verified and sider the technical adequacy and structure of the EOPs in validated. In such cases, revisions to the procedures be-light of operational experience and use, training experi-came more and more inconsistent with the original EOP ence, and simulator exercises and control room and plant basis documents and the justification for these inconsis-walkthroughs. Staffing and staff qualifications relevant to tencies became more and more maccessible. (In some the use of the EOPs also chould be regularly reviewed.
cases justification became non-existent because its only repository was the mind of an EOP manager who had When incorrect or incomplete information is identified in since vacated the position.) At the inspected plants, the the EOPs, the EOPs should be revised on a timely basis NRC staff found that training on changes was not always and the changes should be reviewed to ensure consistency provided to operators before the revisions were issued. In with the technical guidelines and the writer's guide. In ad-one instance, the operators were surprised by changes to NUREG-1358 8
the EOPs that were described to them by an NRC inspec-4 CONCLUSIONS tor. They were not aware of the changes that had been made in procedures that were already in place in the con-The great majority of EOP problems that were identified trol room.
by the EOP inspections resulted from inadequate or ir.
complete implementation of EOP programs. Althoupu 1
the inspections focused on the EOPs themselves, tl.e At many plants, different quality standards had been ap-kinds of problems that were identified led to an examin t-plied to EOPs than to other procedures even when the tion of the programmatic weaknesses that caused tho;e l
other procedures were referenced and used as part of the problems and allowed them to go uncorrected.
l emergency actions. Typically, this resulted in EOP refer-ences to supporting procedures that were not written or The root cause of the widespread program weaknesses is reviewed m accordance with basis documents. This, in that licensees have generally not followed the publis ied turn, resulted in procedures that did not provide the in-guidance regarding the upgrading of EOPs. It appears
]
tended function, were in conflict with other EOPs, or sim-from the inspection findings that, rather than intenti mal i
ply could not be executed.
disregard, there is lack of understanding of the prine plcs
)
included in the staff's guidance.The most significant pro-The revision programs at some of the inspected plants grammatic problems are (1) lack of a multidisciplinary were ineffective because there were insufficient re-team approach, especially a lack of human factors (xper-sources to support the program. Quite often one person tise; (2) lack of an independent review to assurg that was totally responsible for maintaining the EOPs. This in, EOPs are ccrrect and can be performed;(3) lack of a sys-1 dividual was usually from the operations department, but tematic process for ensurmg that the quality of EOPs
{
was occasionally an outside consultant. Few plants had a does not degrade over time; and (4) lack of adequate man-full-time EOP program manager.
agement commitmerrt and sufficiently high pricrity for the EOP program within the licensee orgamzation.
3.6 Management Issues To correct the general problems identified, the NRC in-tends to take action to further clarify its expectations to licensees and to assist licensees in meeting those expecta-This document describes some of the necessary elements tions. Meetings have been held with appropriate repre-of a solid, wc!!-designed EOP program and some of the sentatives from each of the owners' groups (usually the consequences of an inadequate program. IIowever, even operations subcommittee or equivalent) to discuss the in-a good EOP program must have the ongoing support and spection findings and their implications for each of the commitment of management to ultimately ensure con-groups.
tinuing production and maintenance of high quality EOPs that complement the man-machine system in which they To provide licensees with the opportunity for further are used.
clarification, workshops also are being planned. The workshops will allow for two-way communication be-tween the industry and the NRC.'Ihese efforts should en-The development and implementation problems identi-ficd during the inspections were often linked to a lack of hance the industry's understanding of the issues and of staffing and resources. At a number of plants, the one m, -
potential means of improvement.
dividual responsible for the EOP program was aware of To provide licensees with a complete review of their EOP deficiencies but was unable to address the problems with-programs, the NRC staff has begun an accelerated review out further support from management.
of the procedures generation packages submitted by li-censees. Review comments are being forwarded to licen-Similarly, in those plants where responsibihty for EOP sees as spon as possible. The staff does not plan to request development and maintenance was turned over to a con, further mformation from licensees. Adequacy of the im-tractor, managensent sometimes had little knowledge of plementation of the PGP commitments will be assessed and involvement in its own plant's program. in some cases through onsite inspections, rather than further paper re-it appeared that greater involvement of the plant's onsite new.
review committee might haveled toidentification of some of the problems in the EOPs.
I..mally, the EOP Inspection Program will continue in a very similar mode to that used thus far.The program will include all remaining plants and return visits to any plants To ensure high quality EOP programs, management must with identified problems in implementation of appropri-place a high priority on providing necessary staffing and ate corrective actions. Because Revision 4 of the Boiling resources to the effort. A permanent commitment must Water Reactor Owners' Group guidelines was approved be made with ongoing attention to program needs, on September 12,1988, the remaining HWR inspections 9
l l
may be delayed some,what, in order to allow sufficient Pian Requirements, Requirements for Emergency l
time for implementati%n of Revision 4.
Response Capability," Supplement I to NUREG-0737, December 1982.
l
'Ihe staff expects that these actions will result in both im-l mediate and long-term improvements to EOP upgrad programs and to the EOI s themselves.
--, Information Notice 86-64, " Deficiencies in Upgrade Programs for Plant Emergency Procedures,"
August 14, m6.
5 REFERENCES U. S. Nuclear Regulatory Commission, NUREG-0660,
--,Information Notice 86-64, Supplement 1 "Defi-NRC Action Plan Developed as Result of the TMI-2 Acci-ciencies in Upgrade Programs for Plant Emergency Pro-dent, Volumes 1 and 2, May 1980, Revision 1, August cedures," April 20,1987.
1980.
--, NUREG-0737, Clarificatwn of TM/ Action Plan
--, NUREG/CR-5228, V.E. Barnes, C.J. Moore, Requirements, November 1980.
D.R. Wieringa, C.S. Isakson, U.K. Kono, R.L Gruel, Bat-telle Human Affairs Research Centers, Pacific Northwest
--, NUREG-0899, Guidelinesfor the Preparation of isboratory, Techniques for Preparing Flowchart-Format Emergency Operating Procedures, August 1982.
Emergency Operating Procedures, Volumes I and 2, Janu-g7, gygg,
--, Generic Ixtter 82-33, D. Eisenhu' (NRC) to all licensees, December 1982," Clarification of TMI Action NUREG-1358 10
APPENDIX A TEMPORARY INSTRUCTION 2515/92 Nats: This TI is sent for immediate implementation. Change Notice CN 88-0$ is being issued to officially transmit this'Il.
EMERGENCY OPERATING PROCEDURES TEAM INSPECTIONS 2515/92-01 PURPOSE outline of the Reactor Inspection Program Concept as ac-scribed in the James IL Sniczek memorandum dated Oc-To conduct a team ins; Won of licensee emergency op-tober 1,1987.These inspections are an integration of re-erating procedures (EOPs).
gional and NRR activities to accomplish an important complementary purpose.The focus of these inspectionsis 2515/92-02 OBJECTIVES n nume ver 11 ad quacy f EOPs wi,Il be separately examined on a generic basis usmg these mspections as a basisA inspectors sheuld recognize that their inspec-The objective of these inspections is to establish the an-tions will cover matters that relate to ecmphance with swers to three general 9ucstions, NRC requirements and industry guidelmes that may be reflected in the EOP.
l 1.
Are the procedures technically correct?
A number of assumptions are inherent in the items de-a.
Do they generally conform to vendor gencric scribed above. In particular, it is assumed that it takes 2 to guidelines?
3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, on the average, for the team to walk through an EOP with the appropriate utility personnel. The inspec-b.
Have they provided technical justification for tions should be announced in order for the licensee,'s per-safety significant deviations from vendor guide.
sonnel to properly support the team effort. In particular, lines 9 these are EOP mspections and not operator examma-tions. Attendant problems with operator execution can be 2.
Can the procedures be physically carried-out in the referred to the regions for separate action.
plant?
Also, the product of all of the inspections will be an NRR staff report based on a collation of inspection findings, a.
Are referenced instruments and controls pre-Therefore, the inspection reports should specifically ad-sent and accessible?
dress the results of the inspection in regard to the objec-tives of this T1. Since the mspection reports will be the I
b.
Will the environment in which actions must be bases for the staff reports, they should be issued in accor-taken be safe for operations?
dance with typical regional practice.
c.
Will plant personnel be prevented from taking An appropriate level of effort for these inspections would designated actions due to time constraints?
be five to six professionals for 1 week on site.The regions are to be in control of these inspections and will provide d.
Are necessary tools, personnel aides and pro-the team leaders.
tective equipment and clothing available?
The teams are to be operations expenenced regional m.-
3.
Can plant staff correctly perform the procedure?
spectors capable of inspecting EOPs (typically senior in-spectors or licensed operator examiners). Ihc NRR members are to,be systems oriented personnel who can, a.
Do plant staff understand the procedure?
based upon their knowledge of the accident sequences, rovide estimates of the environmental conditions, as a b.
Arc functions appropriately allocated?
function of time,in those spaces and at the times that the steps would actuMiy have to be performed, and a human c.
Are enough staff available to perform func-factors speculist who can determine usability. A resident tions in time available?
inspector fiom the plant also is expected to participate to pr vida plant-specific knowledge, d.
Can procedures be read under adverse envi-ronmental conditions?
The itinerary for the inspection is envisioned to be typi-cally as follows:
2515/92-03 BACKGROUND site familiarity, badging, and EOP overview e
Problems with the adequacy of EOPs have come into one day of observation of scenario performance at sharper focus recently. This Tl defines a team approach e
to the inspection of EOPs, which is consistent with the the simulator (if available)
A-1 NUREG-1358
walk through of a sample of EOPs to complete the 1.
Perform walkdowns and simulations of the selected o
week EOPs to determine:
interviews with operators, EOP program trainers, o
If it can be physically implemented, including a.
and others as time permits during the first week consideration that the spaces involved may be an exit interview based on the results of the first subject to extreme environmental conditions.
I o
week's inspection effort b.
If it can be implemented within the time frames allotted considering the actual accident course report preparation during the second week o
of events and availability of the spaces involved The above is an estimate of the schedule needed to be ccmsistent with the basic requirements of this TI. How-If environmental conditions (temperature, c.
ever, the actual scope of t,he mspcction could on the EOPs selected for inspection and readm. vary based steam, flooding, etc.) that would exist during ess of the the even licensee to support the EOP walkthroughs.
from bem.t would not prevent a. and b. above g accomplished.
2515/92-04 BASIC REQUIREMENTS d.
If procedures can be effectively used by plant ThisTI shall be conducted for those plants previously se-personnel in the control room and other parts lected in consultation between NRR and the regional of-of the plant as necessary, fices.
If training with use of EOPs is adequate.
e.
64.01 Conduct review of EOPs, and select a sufficient number of procedures to provide for a week's inspection f
If a program exists to update and improve effort, and which are considered to be of high safety sig.
EOPs.
nif nee, especially as related to human error contribu-P inteniews with appropriate plant staff to determine utility staff views on development and 04.02 Review the EOPs to assure that procedures are useability of EOPs.
technically adequate and accurately incorporate the
$d"II"$8 o the Vendo 25I5/92 05 REPORTING REQUIREMENTS 1 Gui e nes in accor-ee, h 04.03 Assure that the EOPs can be successfully and cor-The results of the inspection shall be documented in a rectly accomplished in accordance with Tasks 3 through 6 routine inspection report. A copy of the report should be attached to this TI.
sent to DLPO.
NUREO-1358 A-2
TASK 1 1
Basic EOP/GTG Comparison GL 82-33, NUREG-0737, Supplement 1
]
Purpose IN 86 64, Deficiencies in Upgrade Programs for Plant Emergency Operating Procedures To ensure that the licensee has developed sufficient pro-cedures in the appropriate areas to cover the broad spec-trum of accidents and equipment failures.
NUREG-0800, Standard Review Plan, Section 13.5.2 References Setpoint document Index of vendor-approved generic technical guide-e lines (GTGs)
Instruct,ons i
1.
Assess the technical adequacy of the EOPs.
Index of licensee's currently implemented emer-e gency operating procedures (EOPs)
Verify that recommended vendor step se-e Licensee correspondence on safety significant devia-quence is followed.
e tions Verify that recommended vendor placekeep-e Level of Effort ing aids are utilized.
This task can be performed during the inspection prepa-Verify that entry / exit points are correct and ration phase and is intended to be one-half day maximum.
easily followed. Determine whether transfer between procedures is well defined and appro-Instructions priate.
Compare the GTGindex(tableofcontents) to the e
Determine that use of notes and cautions is index of plant-specific EOPs.
correct.
Reviewlicensee letters that compare plant EOPs to 2.
Verify prioritization of accident mitigation strategies vendor GTGs.
in the procedures.
. Review questions on incorporation of GTGs int 3.
Verify that where major identified deviations exist
' EOPs with licensee representative.
between the plant-specific EOPs and the generic technical guidelines that these deviations have ade-TASK 2 quate technical justification. (See Generic Letter 82-33.)
Independent Technical Adequacy Review of the Emergency Operating Procedures 4.
Assess the safety-significance of identified devia-tions. Determining by sampling if safety significant Purpose deviations were reported to the NRC. Ensure that safety significant deviations in the sample had safety Revie,w the EOPs in office to assure that procedures are evaluations performed per 10 CFR 50.59.
techmcally adequate and accurately mcorporate the guidelines of the GTGs.
5.
Determine if a deviation is warranted by the plant-References specific design, but a deviation was not incorporated.
Selected EOPs.
6.
Select five plant-specific values from the procedure Plant-specific procedure genertion package reviewed and determine by review of the setpoint document that the values are correct. Determine if Plant-specific EOP writer's guide adverse containment values are provided. Verify that changes in setpoints are revised in the setpoint Procedure and step deviation documents document and in the EOPs.
A-3 NUREG-1358
i TASK 3 la. Verify that the procedures have been validated and verified in accordance with the program set forth by l
Review of the EOPs by Control Room Plant the licensee in the procedure generation package.
1 Walkdowns 2a. Verify that all the validation and verification pro-Purpose gram documents are signed off as complete, have been reviewed by the designated individuals or To assure that the EOPs can be successfully accom-onsite safety committee, and document a compre-I plished.
hensive review.
3a. Ensure that during the validation and verification References progr.m if discrepancies were noted they were ade-EOPs quately addressed and corrected.
4a. Determine the different methods by which the vali-Techm. cal Specifications, Section 6 dation and verification program was implemented.
Assure that walkdowns in the control room and Note: It is the inspection goal to wal,k down as many EOPs plant were conducted and documented. Confirm as possible in the allowed time. Durmg walkdowns ensure that these reviews included human factor analyses of that the list of walkthrough attributes exists in the EOPs.
the procedures.
)
Instructions TASK 4 1.
For selected EOPs, perform control room and plant walkdowns to confirm that procedures can be ac.
Simulator complished.
Purpose Verify that the instrument and control designa-To ensure that EOP training provides the operators with e
tions are consistent with the installed equip-the necessary information bac'kground and to ensure that ment and the EOPs. For example, both de-the EOPs can be correctly implemented under emer-scriptive (i.e., MAIN FW ISOL VLV) and nu.
gency conditions.
merical (i.e., FW-102A) identifiers as well as units of measure are provided.
References Ensure that indicator, annunciators, controls, EOP lesson plans etc., referenced in the EOPs are available to the operators.
Simulator scenarios used for EOP training 2.
Review the location of the EOPs in the control room Level of ElTort and verify that they are usi!y accessible to opera-tors. Confum that EOI s t..re the latest reuston.
S mulator scenarios should be accomP shed in one day.
li l
3.
Note any r.ctivities that would occur outside of the control room based on tne accident scenario as pos-1.
Run EOP exercise scenarios on the simulator to ob-tulated and follow up as appropriate.
serve performance in real time.
4.
For selected EOPs, perform in1Mant walkdowns to 2.
Determine that the procedures provide operators assure tasks can be accomplished.
with sufficient guidance such that their responsibili-l ties and required actions during the emergencies, 5.
Note any discrepanices, report them to the team both individually and as a t eam, are clearly outlined.
{
leader and attempt to resolve them with the licen.
see.
3.
Verify that the procedures do not cause operators to physically interfere with each other while perform-Nnic Items la through 4a below are tasks that can be ing the EOPs.
completed if time permits or if a deficien is noted during the mspection. These tasks, if required, ill assist the in.
4.
Verify that t he procedures do not duplicate operator spectors in determining programmatic breakdowns or actions unless required (i.e., independent verifica-root-cause identification.
tion).
I NUREG-1358 A-4 4
5.
When a transition from one EOP to another EOP or N_ ate: Contact Team Leader or Resident Inspector other procedures is required, verify that precautions for this information, are taken to ensure that all necessary steps, pre-Is there a common control room?
requisites, initial conditions, etc., are met or com.
pleted and that the operators are knowledgeable Are EOPs shared between units?.
about where to enter and exit the procedures.
What is shift staffing?
l-6.
Note any activities that would occur outside the con-What are roles of each operations staff mem-trol room based on the scenario as presented and follow up as appropriate.
ber?
Who in control room uses EOPs?
N_nig: Items la through 3a below are tasks that can be ac-l complished if a deficiency is noted during the inspection.
Who outside control room is involved in imple-These tasks will assist the inspectors m determmmg pro-menting procedures during emergency opera-grammatic breakdowns or root-cause identification.
tions?
la. Audit the EOP lesson plans developed by the licen-Auxiliary operators?
l-see to determine their technical adequacy. Assure Health Physics?
l that training covers both the technical basis behind Chemistry?
the procedures as wel! as the structure and format.
2.
Review plant-specific PGP, where applicable.
2a. Review the simulator scenarios to ensure sufficient coverage of all EOPs and that multiple malfunctions Which version of the vendor guidelines are ref-e are included.
crenced?
What are the deviations from the generic 3a. Ensure that operators received training on revised EOPs before implementation.
guidelines?
Copy and deliver to team technical members.
e TASK 5-Familiarization with:
On-Going Evaluation of EOPs Writers Guide Purpose Verification and Validation Program EOP training program Determine if the licensee has established a long-term 3.
Review current copy of EOPs' evaluation ram for EOPs as recommended m Sec-tion 6.2.3 of REG-0899.
Familiarization with content and format References Identify and document potential areas of per-fonnance concerns NUREG-0899 EOP evaluation program 1.
Interviews with relevant plant staff, as assigned, in-Instructions cluding but not limited to:
Procedure writers Determine if the program evaluates the technical ade-quacyof the EOPsin light of operational experienceand Reactor operators use, trammg expenence, and any simulator exercises and Senior reactor operators control room walkthroughs.
Shift supervisors e
' TASK 6
'l..raming instructors e
l Human Factors Related Guidance Auxiliary operators l
Ilealth physics technicians Pre-Inspection-Preparation 1
2.
Participate in the following as assigned by the team l
1.
Plant-specific background information.
leader.
A-5 NUREG-1358 i
Control room walkdownis
- 12. Are procedurally required or orally requested re-e Simulator exercises mote operations prohibited by environmental condi-local control station walkdowns tions (accident conditions such as temperature, ra-l e
diation levels, emergency lightmg levels, etc.)?
Post Inspection Tasks 1.
Participate in post-inspection team meetings.
14.
2.
Prepare draft input for team inspection report.
y s operator training / knowledge cover informa-tion gaps m the flowcharts (Phase A, safeguards in-3.
Review final report as directed by team leader.
itiation, containment isolation)?
WALKTIIROUGIIitITRIllUTES
- 15. Are numerical values too precise to be read by the operator?
1.
Peacekeeping method exists and is usable.
- 16. Do temporary emergency measures cause other 2.
Notes and cautions contam sufficient emphasis ta at-safety significant problems?
tract operators' attention.
- 1. Are Dowcharts (especially llWR) readable by the 3.
Terminology is clear cut.
operators with the least visual acuity?
4.
Use of abbreviations and acronyms is consistent.
- 18. Ile sure to include in walkthrough plans full inspec-5.
Continuously monitored situatior:s are adequately tion of procedural adequacy for alternate end point dealt with.
actions such as containment venting (llWR).
l 6.
Indications are available as required for verification,
- 19. Tools, jumpers, and test equipment are available to I
c.g., Th less than 545.
the operator on the back shift, can be found and used 7.
Control room and procedure nomenclature consis-tent (plant cun'es, panel charts).
- 20. Where possible, verify ability to dress out and make
""# #'9" 8.
Does confusion exist about procedure exit and entry points?
- 21. Use the predicted post-accident radiation survey 9.
Are operator aids under administrative control map to ascertain the reasonableness of in-plant op-(plant curves, panel charts)?
crator actions.
- 10. Do operators interfere with each other pcysically?
- 22. In considering EOP sequencing during the control room and plant walk-throughs, use the guidance
- 11. Does logic flow direct operators to correct procc-contained in the priority listing of high probability dure / step?
scenarios.
NURI!G-1358 A-6
I APPENDIX B LIST OF PLANTS INSPECTED IN 1988 UNDER TEMPORARY INSTRUCTION 2515/92 (GROUPED BY NSSS VENDOR)
PILOT PHASE (EOP-1)
Prairie Island Trojan Wolf Creek llabcock & W.ilcox:
PHASE 2 (EOP-2)
Crystal River Oconee General Electric (Mark 1 Containment):
Combustion Engineering:
Ilrowns, Ferry Ilrunswick Millstone 2 Cooper San Onofre I]uan,e Arnold St. l ucie I: cat 2 Waterford I itzpatrick Hope Creek Millstone 1
$ " Iec l<
General Electric:
r Peach Ilottom Dresden Quad Cities Grand Gulf Vermont Yankee liatch Nine Mile 1 CURRENT PHASE (EOP-3)
Westinghouse:
Westinghouse:
D.C. Cook Indian Point 2 South Texas i
11-1 NURIIG-1358
1 i
APPENDIX C COMMONLY FOUND WEAKNESSES IN EOP STRUCTURE During the emergency operating procedure (EOP) in-1,1 Inconsistent or Incorrect Structure spections, the Nuclear llegulatory Commission (NRC) staff identified a number of problems with the structure Because of the difficult nature of decision making during of the EOPs.These problems were found across all ven-emergencies, it is important that the decisions be clearly l
dor groups for the four major types of reactors. Structural identified and simply and consistently structured. During problems within the EOPs make the procedures more dif-many inspections, logic statements were often found to be ficult to use and increase the possibility of operator error.
overly complex, containing secondary embedded or im-Because of this, licensees should consider evaluating plied logic statements and transitions. In flowchart format their EOPs with particular focus on the problems de.
EOPs, decisions were sometimes presented using deci.
l scribed below.The participation of a person trained in hu-sion symbols, sometimes as text logic sequences encased
{
man factors principles is recommended to increase the ef-in action step symbols, and sometimes embedded within festiveness of such an effort.
action steps, cautions, or notes. In addition, "and" and "or" were often emphasized as logic terms when actually functioning as conjunctions, and the logic terms WHEN 1
DECISION STEPS / LOGIC and THEN were often applied incorrectly.
l STATEMENTS The following example illustrates ernbedded logic se-quences in an overly complex step:
When individuals are subjected to emotional or environ-mental stressors such as those that may be present during E RC,Ps are available, an emergency, normal thought processes may be de-Tl/EN ensure-graded in a variety of ways.1 or example, mformaton drawn from long-term memory may be incomplete or in-g,,j jyj,c,jgy accurate, short-term memory capacity may be reduced.
Seal return and the ability to accurately perceive and assess the im-gg cggjjyg portance of mcommg mformation may be degraded. Any or all of these problems will lead to difficulty in decision jyf7 making. Because decisions play an important role in the execution of EOPs, it is critical that decision and logic a.
IF OTSGs available, steps be clearly, consistently, and appropriately struc-tured.
THEN establish 1 RCP in each loop running M establish 2 RCPs in oneloop running Imgic statements are used in procedures to describe a set g
of conditions or a sequence of actions. By both their con-tent and structure, logic statements indicate to operators b.
E OTSGs NOT arallable, that they must make a decision and that, depending on the outcome of that decision, they must perform an action or THEN establish one RCP running.
sequence of actions. The format or structure of a logic statement visually signals the operator of an impending The following step contains multiple logic sequences, re-decision, even before the content of the statement is read.
quires several transitions to one other procedure, and the Therefore, consistent presentation of logic statements content must be remembered by operators throughout contributes to the speed and case with which the operator the respective leg of the procedures. This step actually is understands and executes the procedure.1ikewise, pres-an " override," or continuous monitoring step, rather than entation of a decision in a structure other than that which a discrete decision step. It incorrectly uses the logic term the operator expects will make the procedure more diffi-AND as a conjunction. When simply used as a conjunc-cult to use and increase the possibility of error.
tion, the word should be in ordinary type and not high-lighted.
The types of problems in decision and logic steps that Example:
have been commonly found throughout the industry are discussed below.
E while executing thefollowing steps C-1 NUREG-1358
all control rods are inserted to or beyond VERIFY /OPEN the SUV vent and drain valves position 02 AND drain the SDV THEN terminute boron injection and enter scram proce-Is levelin more than 1 area {}11 sump above the maxsafe dure AND exit RCIQ operating level?
the reactor is determined to be shut down The following two examples illustrate incorrect uses of AND no boron has been injected ti'e logic terms ELEE and llEN, respectively:
THEN enter scram procedure AND exit RCIO.
IVHEN inward rod motion stops, close XXXX-yyyyy The following example includes multiple embedded deci-(Ihis example should include the term :IHI:N prior sion statements. layering decision statements in this to the action.)
manner greatly increases the complexity of the step, as well as the possibility of error, in addition, using the non-Downshift recirc pumps to LFAIC then initiate AR#
logic term "before" as if it were a logic statement is im-RPT proper. 'the step should be written in a manner that clearly defines when to perform the action rather than (Ihis example should be broken into two discrete ac-providing a threshold after which the action will be late.
tion steps without the term "then.")
Use of a WiiENTIllEN logic sequence is consistent with i
existing guidance and will minimize potential error.
I 1.3 Use of Syanbols Example:
Ily definition, the decision symbols used in flowcharts BEFORE any area rad level reaches its mar should climinate the need for most, if not all, logic se-quences. For example, an "lF A, TliEN 11" statement can be easily converted into a decision symbol sequence by be-THEN execute thefollowing ginning with a decision symbol encasing the question "is
'A' ?" The answer "yes" leads to "B", while a negative re-reduce recirc. flow to minimum (if time sponse directs the user elsewhere. Ilowever, most flow-permits) charts inspected use a mix of methods to present decision transfer to LFAfC (if time permits) or logic steps. Use of logic statements within an action manually scram (unless executing RC/G) statement symbol fails to take advantage of the inherent meaning of flowchart symbols. However, most important is that one method for presenting decisions should be 1.2 Incorrect Use of Logic Term and used consistently throughout the EOPs.
Non-logic Terms Terms that are not formal logic terms, such as "before,"
"until," and "except," are often found defined as formal Operators are often required to perform movements logic terms within writer's guides and used as such within within and between procedures (transitions) during the the EOPs. Use of these terms increases the complexity of execution of an emergency procedure. An operator may decision steps and therefore increases the potential for be directed to concurrently perform more than one flow-error-path, or more than one procedure, or to completely exit the procedure being executed and move to a different Steps including these terms should be rewritten to use procedure. An operator also may be required to refer-designated formal logic terms and actual logic format ence tables, charts, supplemental information, or non-(e.g., using WHENfl1IEN in place of"until")or to add a EOP procedures. Movement within and between procc-note when providing qualified supplemental information dures can be disruptive and confusing and can cause un-(e.g., "except" to introduce a qualifier). The logic terms necessary delays and error. 'Iherefore, it is particularly AND and M should not be used as simple conjunctions important that these transitions be minimized. When but should be reserved for describing necessary AND or transitions cannot be avoided, it is important that the sufficient M conditions of a logic statement. When sim-transition directions to the operator be clearly and consis-ply used as conjunctions, they should be in ordinary type tently structured.
and not highlighted.
The types of problems in transition steps that have been The following two examples illustrate the incorrect uses commonly found throughout the industry are discussed of logic terms AND and 2:
below.
NUREG-1358 C-2
2.1 Incomplete and Unclear Transitions bol, execute : concurrently symbol, and dotted lines from steps to referenced tables and curves.
Operators must have sufficient and clear directions to en-sure correct execution of transition steps. liowever, the 2.3 Excessive Transitions manner in which other procedures and steps were refer-enced was often incomplete and unclear. For example, al-Many EOPs were found to contain transitions so numer-though references to non-EOP procedures were often by ous that the resultant movement within and between pro-number only, operators usually recognized these proce-cedures confused the operators exercising the liOPs. For dures by name rather than number. References to steps example, in one E9P operators were instructed to make within an EOP were often by step number only, with no some sort of tramition 17 different times, another in-information as to the location of the step, in those cases structed operators to make 26 transitions, and another di-where a flowchart format is used, this location informa-rected 16 transitions. Transitions should be viewed as op-tion is particularly critica!
portunities for error and, therefore, should be reduced in l
In addition, directions for transitions were found embed-l ded within action steps, or simply listed in parentheses following an action step, this lack of clear structure and 3
CAUTIONS AND NOTES format caused transitions to be overlooked in some cases.
Cautions are used to describe hazardous conditions that The following example illustrates the w,e of an improper can cause injury or equipment damage. The caution also j
transition term:
should describe the consequences of the hazard. Notes j
are intended to provide supplemental information to the Check RMWand1M Flow Controllers setfor coldshut-operator. Neither cautions or notes should contain direc-down baron concentration. USE Plant Curve Book.
tives to the operator--that is, action steps. llecause of the critical nature of the mformation contamed in cautions,it The following exampic illustrates an implicit transition:
is important that cautions be emphasized in a way that dis-tinguishes them from notes, and that they be located Maintain reactor vessel head subcooling greater than where operators will not overlook them.
10F'subcooled line of Addendum F.
The types of problems related to cautions and notes that were found industrywide are discussed below.
2.2 Inconsistent Transition Directions n lusn Mc&ns lhe least number of transition terms possible should be used to indicate different types of transitions. 'lhese Cautions and notes are not intended to direct operator ac-should be used consistently to minimize confusion and en-tion, but rather to warn of possible consequences or to sure operator recognition of transition structure. For ex-provide supplemental information to the procedure ample, (1)"GO TO" could be used to indicate movement steps. Inclusion of actions in a caution or note can be dis-entirely out of one procedure or step and into another, ruptive and confusing to an operator. More importantly, and (2)" REFER TO" could be used to indicate concur-the action could be entirely overlooked if embedded in a rent execution of another procedure, step (s) or supple
- caution or note. Any cautions or notes containing opera-mental material with the procedure in use. In many tor actions, including conditional actions or transitions, plants, numerous inconsistent methods were in use-in-should be restructured so as to provide an action step plus cluding both plant-approved and unapproved methods.
a note or caution.
For example, one plant used eight different transition The following example illustrates the inclusion of actions methods including: " return to, enter, proceed directly to, in a caution:
go to, execute, perform, per, as in." Another plant in-cluded seven plant-approved methods in its writer's cAg779y guide, and its EOPs also used the tollowing unapproved methods:" execute, execute concurrently, refer to, in step This system may be placed in manualifby at least two independent indications (1) mesoperanon m automatic mode is con-At still another plant the following methods were used in firmed, or (2) adequate core cooling is as-their flowchart format EOPs: " enter, using, in accordance sured. If an injection system is placed in with, go to, per entry into as required, as required manual it will not initiate automatically.
by." This plant also provided reference by using proce-Make frequent checks of the initiating or dure numbers in parentheses, in addition, several sym-controlling parameter. When manual op-bots were used to indicate transitions including exit sym-eration is no longer required, restore the C-3 NUREG-1358 A
system to automaticistandby mode ifpossi-The following example illustrates the improper location
- ble, of a caution following the relevant step.
The following example illustrates the inclusion of actions 4.0 Establish feedwaterflow to steam generator (s).
in a note:
CAUTION NOTE Feedwaterflow should be initiated slowly to minimize thermal stress on the steam if the dieselgenerator output breakerfails to automatically close, then verify diesel generators and associatedpiping.
generatoris at rated speed and voltage and attempt to close the output breaker by any CAUTION or allof thefollowing methods:
Excessive steaming or feedwater addition rates will result in overcooling the RCS.
1.
Place output breaker controlswitch on This could result in prolonged makeup Panel 49 to close.
from safetyinjection and/or MSIS.
2.
Lower dieselgeneratorfrequency to 57 Hz and then readjust to 60 Hz and 4
PRESENTATION OF checkfor breaker closure.
INFORMATION 3.
Locally close the output breaker by Many performance variables can increase the potential pushing up on the lift to closeplunger for error during execution of emergency operating procc-at the breaker cabinet.
dures. To minimize the potential for error, it is important that information be present ed to the operator in a straight f rw rd, clear, and consistent manner. EOP structure and 3.2 No Distinction Between Cautions and format should therefore be clearly defmed and consis-Notes tently applied throughout the procedures. In addition to A number of plants failed to distinguish at all between making the procedures easier to understand, a consistent structure and format will increase the effectiveness of cautions and notes on flowchart format EOPs. Typically, both cautions and notes were included under the heading training. When operators are trained to have common ex-l
" CAUTIONS AND NOTES" at the perimeter of the pectations about how the procedures look and how they chart.The nature of the critical information contained in are to be used, variations in operator performance will be cautions requires that they be immediately distinguish, minimized. Therefore, consistency of structure and con-tent in the EOPs is essential to both individual operator l
able from the supplemental information found in notes.
In addition, the placement of cautions outside the flow-understanding of the actions required and conformity of path is undesirable, as discussed below.
performance across operating personnel.
In NUREG-0899 the staff indicates that sentences should 3.3 Improper Caution Placement be simple and short and should avoid presenting more than one idea per sentence. During the inspections, the In order to minimize error, it is important that the critical staff found that most EOPs were written in a complex information contained in cautions be absolutely clear and manner, using multiple action verbs, unnecessary supple-casily available to the operator. A caution should be mental information, and inconsistent terminology.
placed before the step to which it applies. Even in cases where the caution applies to the outcome of a step, the Complex and indirect language was often used in the critical information it contains must be provided to the EOPs as well (e.g., irrespective, regardless, and thus).
operator before the execution of the step. This will en-Some steps used action verbs that are more complex than sure that allinformation relevant to the action is available necessary and that can be simplified. For example, "ter-before the action step is performed. However, in many minate" can be "stop" and " commence" can be " start" or EOPs cautions and notes followed the step to which they "begin." Some steps are written in a negative mannert for applied.
example, " perform action unless x" or "use all except y."
In addition, EOPs using a flowchart format often do not Abbreviations and acronyms often were used inconsis-include the text of each caution in the flowpath before the tently throughout the procedures, conflicting with those step or steps to which the caution applies. This lack of listed in the writer's guide or in other places within the special emphasis and location out of the flowpath could procedures. In addition, abbreviations and acronyms were cause operators to overlook information critical to the commonly found that conflicted with those used on label-execution of a step.
ing in the control room and in the plant.
NUREG-1358 C-4
l proced ures. In addition, abbreviations and acronyms were E BWST volume is determined to be insufficient for commonly found that conflicted with those used on label-completion ofplant cooldown due to a large type of tube ing in the control room and in the plant.
Icak/ rupture, i
l The following example illustrates a step that is overly THEN it is permissible to steam the affected OTSG, as cornplex, including numerous embedded actions and de-necessary, as long as 100 "F/HR cooldown rate is not ex-l cisions:
cceded.
Reduce DW Press with the following as appropriate:
5 FLOWCIIART FORMAT All available DW cooling (including RBCCW) Fan trips may be by-I'lowchart format is being widely adopted as the EOP for-passed using EOF XXXX mat for boiling water reactors; it is also being used more frequently than in the past for EOPs at other types of re-SBGTS (only when DW Temp is below actors.
212 *F)
I lowchart format is extremely difficult to develop and im-l
/solate failed Recirc pump seals plement properly. Ilecause of its heavy reliance on sym-Backseat DW MOVs with high acoustic bology, context, and structure to communicate informa-monitor readings (except Recirc MOVs) tion, the conversion of technical guidelines into EOPs with a flowchart format requires greater visual and edito-Isolate RWCU main Stm sample / drain rial changes to the source material than does develop-lines and Recirc sample line ment of text format for EOPs. Ilecause cach element of the structure and content in a flowchart interacts, every Normal RPV depressurization to cold decision made about how to present the information im-shutdown (only if boron injection is not pacts the rest of the flowchart, and this results in tradeoffs required) of some type. Because of this, the end product is far more Y'
be anticipated by those experienced w? e"v"elo
' ' " ' * '" 'U" U
Torus sprays (isolate SBGTS before ith d Spraying)
EOPs in the text format.
'Ihe following example illustrates a logic statement that As a result, flowcharts are being developed that are diffi-includes three action verbs that are not clearly formatted cult to read, understand, and physically ux, with a high as an action sequence:
potential for confusion and operator error. Many flow-E RPVinjection is required charts currently in use are so difficult to use that they im-pede rather than support operator performance.
THENterminate injection into the RPVfrom allsystems that take a suction from the SUPP Pool, line up AND To assist licensees in the improvement of flowcharts that injectfrom systems that take a suction extemal to con-are under development and being revised, NUREG/
tainment.
CR-5228, Techniques for Preparing Flowchart-Format Emergency Operating Procedures Volumes 1 and 2, was is-The following example illustrates a step that uses overly sued.1.icensees that are using or considering the flow-complex terminology and structure as well as imprecise chart format for their EOPs should find the guidance of terminology:
NUREG/CE 5228 very helpful in designing flowcharts.
C-5 NUREG-1358
l i
4 i
l r
\\
li 1
)
1.
i
1 i
l APPENDIX D FINDINGS REGARDING CONTAINMENT VENTING During the second phase of EOP inspections involving At three of the plants inspected,it was assumed that the General Electrie (GE) plants with Mark I containments, duct work would fail ifit was subjected to the design pres-special emphasis was placed on the review of licensecs' sure of the primary containment. In other plants, duct approaches to containment venting during emergency op-work also probably would fail at the piimary containment crations. The teams assessed each plant's ability to vent design pressure, but evaluations had not been performed.
containment as required by the Boiling Water lleactor At all of the plants inspected the most limiting compo-Owners Group (BWROG) emergency procedure guide-nent was the filter train itself. The maximum leak tight-lines (EPGs). The inspection teams anticipated that the ness pressure of the filters was approximately 2 psig.
licensees would take the following steps to implement the venting provisions of the EPGs:
Three plants vented from the drywell rather than the sup-(1) identify all existing systems that could potentially be pression pool air space. Venting from the suppression used for containment venting pool air space appears to be desirable because it takes ad-vantage of the scrubbing effects of the suppression pool.
(2) evaluate cach identified path for pressure and flow However, some plants found that the suppression pool to capabilities and radiological effects reactor building vacuum breakers did not have the capa-bility to equalize pressure when venting from the sup-(3) prioritize the vent paths based on the evaluations pression chamber. The suppression chamber pressure and identify any modifications required to enhance could then become negative causing the suppression the containment venting capabilities chamber to collapse. New calculational met hods provided with Revision 4 to the HWROG EPGs have indicated that the vacuum breakers do have the capacity to prevent the With the exception of one plant, which addressed con, tainment venting in a study that resulted in several modi.
suppression chamber pressure from going negative.
fications and the identification of 32 alternative vent Plants should evaluate venting from the suppression pool paths, the teams found that plants had not adequately when EOPs are upgraded to Revision 4 of the EOPs.
evaluated the venting of containments under postulated accident conditions. The licensees typically relied on Most plants inspected, especially older designs, have only venting through the standby gas treatment (SHGT) sys-the capability of venting the suppression pool and drywell tem, usually via a 2-inch hard pipe that discharges into through vent paths that are approximately 2 inches in di-18-inch, or larger, sheetmetal ducting. The ability of the ameter. These plants may not have the abdity to control ducting to withstand the resulting pressures was not ade-containment pressure at or near the design pressure. Li-quately evaluated. Most licensees could not provide de-cemees should evaluate pressure control methods for tailed engineering evaluations to substantiate the chosen scenarios affecting primary containment pressure.
containmem venting approaches. This left unanswered questions involving: (1) the ability of the downstream pip-At least one plant controlled pressure between approxi-ing to handle the pressures anticipated during the con-mately 2 sig and 60 psig regardless of the radiological re-P duct of vent operations,(2) the ability of the chosen vant lease rate.,l'his practice is potentially m. violation of the paths to pass flow at rates sufficient to depressurize and EPG basis.
maintain containment given the assumed core residual heat levels, (3) the ability of isolation valves to open and reclose against anticipated pressures, and (4) the ability of The inspection teams concluded that licensees have not operators to manually operate required valves under sta-sufficiently evaluated the SHGT system to ensure that it tion blackout conditions or with post-LOCA (loss-of-will retain integrity when operated at or near the contain-coolant accident) radiation levels present. Licensees gen-ment design pressure or that it will have sufficient flow to crally had made little effort to identify viable alternative adequately control the pressure. In addition, with one ex-vent paths and to identify their availability to operators ception, the plants have not thoroughly identified or pri-through the procedures.
oritized alternate methods of venting the containment.
D-l NUREG-1358
haC PORJ 33 W E. IfuCL E.2 s.1 ult.f oA V Cookst96aose
- i. A. PORT NUu.EA (Assyrmer er Pet 48: 0P3, aulif Muf. Alo., f saFl un
' 7,',;','-
BIBLIOGRAPHIC DATA SHEET NUREG - 1358 l
set lesstavCTsCarlON f *se at,tasi
- 3. TITLE A8so SvelsTLi y gg,yg ggg,,g Lessons Learned From the Special Inspection Program for Emergency Operating Procedures Conducted March-October 1988
. oaf s as,oav Co.,6svio oo v-g
. auf oais' March 1989 George Lapinsky a oA's an.oa' 'avio g
oo T.
April 1989
,... o....
o.s...:.i.o......
...t....co..
,,... E,C
. A iCTn
.u,,o.
v...v Division of Licensee Performance & Quality Evaluation
.,,,,o.oi.
.,vo..
Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Comission Washington, DC 20555 12 SPossSomsNo omoANi2 Afjon seawi amo WAeLe*so Aoomiss t,ncen te C.si.i 11aTyreofR,ont Same as item 7. above.
,,,,,oo C o,,,0,,,,,,,,,,,,,
March 1988 to October 1988 l
i, svettiointaav holis
- 3 assimACT 000 =orm.,8. ass The results of the team inspections conducted during 1988 for the Nu;: lear l
Regulatory Commission (NRC) Emergency Operating Procedures (EOPs) Inspection Program are summarized in this report. Inspection results are discussed in relation to past staff guidance provided to the utilities for upgrading E0Ps.
In this report the NRC informs the nuclear power industry of concerns that were identified during the E0P team inspections and restates the staff's previous guidance in a format tLat more clearly illustrates,the consequences of programmatic weaknesses.
The information contained in this report is provided so that licensees may take advantage of the lessons learned from the E0P inspection effort. This report does not impose any new requirements related to the upgrading of E0Ps.
la oOCoudNT Amat v$is. a Kivvvomps/DiSCmirtom8 is avastas,LsTv STAT.. INT human factors, emergency operating procedure, inspection report l
l UNLIMITED l
16 SICumf7VCLA38tfoCATeON n,
l
.oi.,ti.
as,o,iN i~oso m :
UNCLASSIFIED g..,
UNCLASSIFIED l
i,..u a o...c a
...C.
UNITED STATES '
- EONOEUEN$c" NUCLEAR REGULATORY COMMISSION
. WASHINGTON, D.C. 20555 PERMf7 ede, G.67 OFFICIAL BUSINESS PENALTY FOR PRlVATE USE,4300.-
120555139531 1 1AN1RXIXAIT01 US NRC-0ADM DIV FOIA & PUBLICATIONS SVCS TPS PDR-NUREG P-209 D ",
20555 WASHINGTON b'
=.
m-E; Eg z4 O!
O ':
h.
=4 Ol 8;
81 Cc f
(
f L
j j.
c 1