ML20059C980

Intervenor Exhibit I-MFP-122,consisting of Rev 00, NRC DC1-91-N059,mgt Summary,

ML20059C980
Person / Time
Site:	Diablo Canyon
Issue date:	08/21/1993
From:	AFFILIATION NOT ASSIGNED
To:
References
OLA-2-I-MFP-122, NUDOCS 9401060284
Download: ML20059C980 (9)

Text

. _ _ _ . _ _ _ -

l j

[_g NUCLEAR REGULATORY COMMISSICN

~ '

Docket No 50 4%"OL A na ne me w a J M '/ Eld R S Dfhcial Ex No.N EL k' ?Ridb WN \k Mb

!,m

' .,/

'y VL3fl93 '"E VsHe&

NCR hDC1-91-OP-N059 Rev. 00 l

. _ _ . . _ ' - - ---~~

July 23, 1991 1 wuav V 2 --_.-__

'93 E 28 P5 J,8  :

c. m c> r ~d er._[/q.lh_ec_!se 2 2/- 9_?  !

~

Other _

nirness Reporter f f MANAGEMENT

SUMMARY

l l l l

On July 5, 1991, at 0103 PDT, with Unit 1 in Mode 1 (Power Operation) at 100 percent power, an ung'.anned start of Engineered Safety Feature (ESF) equipment occurred when a licensed operator inadvertently actuated the wrong Solid State Protection System (SSPS) test switch. The control room operators returned all actuated equipment to normal status. On July 5, 1991, at 0133 PDT, a four-hour, non-emergency report was made to the NRC in accordance with 10 l CFR 50.72 (b) (2) (ii) .

The root cause of this event was personnel error, inattention to detail. The operator performing the test had I the test procedure in hand, but failed to pay adequate attention to the test content or to the steps requiring alarm verification to discover that the test procedure did not test relays in both trains of SSPS.

Corrective actions to prevent recurrence will' include: (1) preparation of an Operations Incident Summary on this event, l reviewing the requirements for and stressing the importance of proper attention to the concurrent verification process, (2) counseling of the operators involved, concerning their  ;

failure to perform their duties with adequate attention to  ;

detail, (3) issuance of an Operations Department Policy on control of the SSPS keys, requiring'that the SSPS keys will '

be issued only for one train at a time on a job by job basis, and (4) issuance of an Operations Department Policy to specify in detail which type of verification'is to be }

l utilized for various operating activities. I l

I l

l 91NCRWP\910PN059.PSN Page 1 of 9  ;

94010602B4 930821 gg.- 2 76 32 3 .

EN ' D PDR ADDCK 05000275 -

O PDR f -. ) Q f=)0 ,t z.2 k

i l

• l *

! NCR DC1-91-OP-N059 Rev. 00 July 23, 1991 ,

NCR DCl-91-OP-N059 I. PLANT CONDITIONS Unit one was in Mode 1 at approximately 100% power. Plant Operators were in the process of performing STP M-16E, Operation of Train A Slave Relays K609 (Safety Injection) and K633 (Motor Driven Auxiliary Feedwater Pump Start) in the Unit 1 Solid State Protection System (SSPS). Communication between the SSPS room and the Control Room had been established using telephones in the " speaker phone" mode of operation.

The first portion of the test procedure (Train A slave relay K633-AFW Pump Start) had been successfully completed.

II. DESCRIPTION OF PROBLEM A. Problem:

The operators closed and locked the SSP 9 Train A test cabinet and moved to the Train B test cabinet, which was contrary to the test procedure which stated that the next step was to test Train A slave relay K609. Test Switch S822 was actuated in'this cabinet, which actuated SSPS Train B slave relay K609 rather than the intended Train A relay. To actuate a slave relay using the SSPS Test panel, the test switch is first turned.to the " test" position, then the test button is depressed to actuate thgs relay.

When turned to the test position, a main annunciator alarm (SSPS in Test Train A or SSPS in Test Train B) is initiated. The test l procedure requires that the proper alarm be verified prior to l

actuating the slave relay. When requested by the operators performing the test, the control room responded that alarm PK 02-24 (which is the Train B in test alarm number) had been received, The step in M-16E states that the receipt of alarm number PK 02- i l

19 is to be verified. The operators perforring the test did not '

notice that the alarm received was not cort and proceeded with the test. The actuation of SSPS Train B K609 caused an unplanned start of Component Cooling Water Pump 13, Auxiliary Feedwater Pump 12, and Containment Fan Cooler Units 14 and 15. If the correct slave relay had been actuated Component Cooling Water Pump 13, Auxiliary Feedwater Pump 13, Auxiliary Salt Water Pump 11, and Containment Fan Cooler Units 12 and 14 would have  !

i started. Component Cooling Water Pump 13 and Containment Fan Cooler Unit 14 are started by either SSPS train.

B. Inoperable structures, components, or systems that contributed to the problem.

I None.

l 91NCRWP\910PN059.PSN Page 2 of S i

I a l NCR DC1-91-OP-N059 Rsv. 00 July 23, 1991 C. Dates and approximate times for major occurrences.

1. Jul. 5, 1991, 0103 hrs. Event Date: Inadvertent actuation of SSPS l Train B Slave Relay l K609 causes AFW Pump i 12, CCW Pump 13, and CFCUs 14 and 15 to start or shift to low speed operation.

2. Jul. 5, 1991, 0105 hrs. Event Date: All equipment actuated by SSPS Train B Slave Relay K609 is returned to pre-event status.

3. Jul. 5, 1991, 0133 hrs. Report Date: Event is raported to the NRC as 4 Hour Non-Emergency Report over the ENS.

D. Other systems or secondary functions affected.

l None.

E. Method of Discovery.

l The event was obvious to Control Room Personnel due to numerous alarms and indications.

F. Operator Actions:

The Control Room Operators reset SSPS Train B Slave Relay K609 and returned all equipment to pre-event status.

G. Safety System Responses:

1. Auxiliary Feedwater Pump 12 Started.

2. Component Cooling Water Pump 13 started.

3. Containment Fan Cooler Units 14 and 15 started in low speed.

III. CALSE OF THE PROBLEM A. Immediate Cause:

The immediate cause of this problem was'that SSPS Train B-test switch S822 was actuated instead of the intended SSPS Train A test switch S822.

l l

91NCRWP\910PN059.PSN Page 3- of 9 _

t i NCR DC1-91-OP-N059 Ray. 00 l July 23, 1991 ,

B. Determination of Cause:

1. Human Factors:

a. Communications

The operators involved were performing the task using proper communication techniques in accordance with-Operations Policy B-1, so proper communication was not a factor in this event.

b. Procedures:

The procedures involved in this event were correct'and were being followed "in hand" , procedures did not contribute to this event.

c. Training:

Both Operators involved in this event were experienced Senior Reactor Operator Licensed Operators and had successfully completed this type of surveillance test procedure in the past. During this event, they did not perform concurrent verification properly; however, the STP M-16E procedure does not specifically require concurrent verification to be performed. Training did not contribute to this event.

d. Human Factors:

l The test procedure clearly specified which train was to be tested. The M-16 test program consists of 24 separate test procedures. Of these procedures, 19 tests are conducted by testing a. Train A relay and then the l corresponding train B relay. Only 5 of the tests are l

presently train specific where all relays tested are in

! the same SSPS Train. The operator was very familiar l with the test program, and had a " mind set" that the test procedure was one that tested relays in'both trains. Although the procedure clearly stated that the next relay to be tested was in Train A, the operator, conditioned to the Train A-Train B test program, incorrectly assumed that the next relay to be tested was in the Train B test cabinet. The two operators admitted that, because of a previous slave relay 1

testing problem where the incorrect test switch in the correct train was actuated (NCR DC1-91-OP-NO38) they l

were very focused on actuating the correct relay number. The SSPS cabinets are located in a common room, but are clearly labelled as "A" or "B" Train both inside and outside of the cabinet door. The area is well lit and free of noise or other distractions. The two operators were working their normal night shift and i

had not been working excessive overtime or had an '

! 91NCRWP\910PN059.PSN Page 4 of 9 I

l.

ls NCR DC1-91-OP-N059 Rev.-00 July 23, 1991 abnormally high workload during the shift preceding this event.

The primary human factor that contributed to this event was that this procedure was different than the familiar slave relay tests.

A secondary factor is that the test switches in the SSPS are not labelled uniquely, the train A test switches are numbered in a manner identical to the train B switches. -

e. Management System:

1. NPAP C-104, Independent Verification, requires that evolutions such as SSPS Slave Relay Testing be accomplished using a " Concurrent Verification" technique. This technique utilizes an operator reading steps and agreeing that the second operator in. fact has the correct component prior to the component being actuated. Proper utilization of the Concurrent Verification Process' should have prevented this event, but the verification was not correctly performed, since the " verifier" was not reading the procedure. A discussion with the operators involved revealed that the verification was not performed properly l because they were uncertain as to the requirements. They were aware that some~ sort of verification was required, but, since the M-16 procedures did not specifically state that concurrent verification was to be used and no j independent verification sign-offs were provided in the M-16 procedure, they were not certain as-to the specific requirements.

2. Although the doors for the SSPS cabinets are normally locked closed and'are keyed with L different keys for Trains A and B, no system was I in place to. separate these keys to take advantage-of this installed system. The-SSPS keys for both Trains A and B are stored and issued together on the same key ring. If the keys were issued.

separately on a job by job basis, wrong train errors such as this would be prevented.

l Improperly implemented or non-existent management I

systems contributed to this event.

2. Equipment / Material:

Since this event represented no equipment failures or degraded conditions, material ~ conditions, design, or

! installation did not~ contribute'to.this event.

91NCRWP\910PN059.PSN Page 5 of 9 i

i

l l NCR DC1-91-OP-N059 Rsv. 00 1 July 23, 1991' l C. Root Cause: -

The root cause of this event was Personnel Error, inattention to detail. The operator performing the test had-the test procedure in hand, but failed to pay adequate attention to the test content or to the steps requiring alarm verification to discover that.the- '

test procedure did not test relays in both trains of SSPS.

D. Contributory Causes:

Two separate contributory causes to this event were:

1. No system was in' place to properly control the issuance of-the SSPS cabinet Keys. The existing key control procedures caused the keys to both trains.of the SSPS to be. issued for each SSPS task.

2. The concurrent verification process was improperly.

performed, because the operators involved were not clear as to the specific verification requirements for this type of. testing.

IV. ANALYSIS OF THE PROBLEM f A. Safety Analysis:

Since all equipment performed as designed during this event, the inadvertent actuation of several ESF related components did not l have any impact on the public health and safety.

B. Reportability:

This event represents an unplanned actuation of an Engineered Safety Features System, and is therefore s reportable as a 4 Hour l Mon-Emergency Report in accordance with 10CFR50.72 (b) (2) (ii) ' and .

10CFR50.73.

V. CORRECTIVE ACTIONS A. Immediate Corrective Actions:

None.

B. Corrective Actions to prevent Recurrence.

An Operations Incident Summary will be prepared on this

~

1. i event, reviewing the requirements for and stressing the importance of proper attention to the concurrent verification process.

l

2. The operators involved were counselled concerning their failure to perform their duties with adequate attention to-detail.

i 91NCRWP\910PN059.PSN Page 6 of 9 l

l e, i NCR DC1-91-OP-N059 Rev. 00 July 23, 1991

3. An Operations Department Policy will be. issued on control of the SSPS Keys. This policy will required that the SSPS keys will be issued only for one train at a time on a job by job i basis. I l

4. An Operations Department Policy will be developedLand issued- I to specify in detail which type of verification is to be utilized for various operating activities.

(All corrective actions assigned to Operations with an ECD of 8/1/91. Tracking'101: A0235762) l VI. ADDITIONAL INFORMATION l A. Failed Components:

! None.

B. Previous Similar Events:

l 1. LER 1-91-005 (Actuation ofLWrong Test Switch Causes ,

l Unplanned Diesel Generator Start (ESF Actuation) Due to Personnel Error) describes an event where improper self-verification caused an inadvertent ESF actuation.

Corrective actions were taken to-re-emphasize'the importance l of self-verification and concurrent verification. These -

corrective actions did cause the operator in.the current event to double-check the switch in his hand. LIn addition, a second operator accompanied him for independent verification. However, these checks.were not properly performed as neither operator verified their actions against the procedure.

2. Several other previous events have been' reported that were caused by improper self-verification and' concurrent verification techniques, including LER'l-90-004-(Technical Specification.3.0.3 Entry due to Personnel Error), LER'l 012 (Fuel Handling-Building Ventilation ~ System Transfer to the Iodine Removal Mode Due:to Personnel Error),.LER.1 030 (Failure to Meet TS LCO Duefto-an~ Improper Valve Alignment), LER 1-88-023 (Containment. Ventilation Isolation.

Inadvertently Initiated due to Operator Error), and LER 88-020 (Reactor Trip ' from Overtemperature ~-- : Delta-Temperature Protection Logic 1Due to. Personnel Error). 'As j discussed above, the importance.of self-verification 1will be re-emphasized with plant operators and-technicians.

C. Operating Experience Review:

1. NPRDS:

Not applicable.

91NCRWP\910PN059.PSN. Page. 7- ofE 39-

.i

NCR DCl-91-OP-N059 RSv. 00  ;

July.23, 1991 I i

2. NRC Information Notices, Bulletins, Generic Letters:

None. A search of the Operating Experience Assessment database under keywords (OPERATOR ERROR and TEST (ING) and SWITCH), and (SURVEILLANCE add SWITCH add HUMAN ERROR) found no items.

3. INPO SOERs and SERs:

None. A cearch of the Operating Experience Assessment database under keywords (OPERITOR ERROR and TEST (ING) add SWITCH), and (SURVEILLAhCE add SWITCH and HUMAN ERROR) found no applicable items. None dealt with actuation of the wrong train of equipment in SSPS.

l D. Trend Code:

Responsible department QE (Operations), and cause. code al (Personnel Error, Lack of Mental Attention).

E. Corrective Action Tracking:

1. The tracking action request is A0235762.

2. Are the corrective actions outage related? No.

F. Footnotes and Special Comments:

I None.

G.

References:

1. Diablo Canyon Power Plant Event Notification Form, dated 7/5/91

2. Initiating Action-Request A0235686

3. Personnel statements dated 7/5/91

4. Surveillance Test Procedure M-16E, " Operation of Train A Slave Relays K609 (Safety Injection) K633 (Motor Driven AFW Pump Start)"  ;

Surveillance Test Procedure M-16F, " Operation of Train 5.

B Slave Relays K609 (Safety Injection) K633 (Motor Driven AFW Pump Start)"

6. Prior Nonconformance. Report DC1-91-OP-NO38, "ESF Actuation"

7. Control room logs dated 7/5/91

8. Memorandum from J. Vranicar (NOS) to K. Oliver (DCPP) dated April 26, 1991 (CHRON 169451)

9. Licensee Event Report (LER) 1-91-011

10. Action Request A0238585 H. TRG Meeting Minutes:

On July 12, 1991, the initial TRG convened and considered the following:

91NCRWP\910PN059.PSN Page 8 of 9 l

\

lA l NCR DC1-91-OP-N059 Rsv. 00 )

July 23, 1991  !

[

• l l

! 1. The TRG discussed the human factors in this event,'as described in section III.B, " Determination of.Cause,"

on p. 4 above. . Communication was not a problem - this-is still an " inattention to detail" because the operator did not correctly verify.the annunciator-reported by the control room. .Also, as noted in the personnel statements, the' concurrent verifier realized 1 only:in hindsight that he should have been holding the procedure, instead of the other operator. .j

2. The TRG discussed root cause and contributory.causes. i' More information will be added about contributory cause.

1. 2.  !

3. The TRG discussed corrective. actions and remark (below). System Engineering has plans to revise the STP M-16 series. procedures to make them all train-specific; however,.this does not directly~ affect this NCR and w!11 not be a corrective action.

4. This TRG will not reconvene. 'Overall ECD for the NCR will be 10/1/91.

(Subsequent to.the TRG meeting, contributory cause #2-was revised and additional corrective action #4 was added.)

I. Remarks:

Because of this and previous events, the Operations Department will request that a human factors review of the SSPS test cabinets be conducted by NOS personnel. This study will be utilized to determine if future changes may be-necessary to improve operation in these cabinets. ,

Tracking AR: A0238585 l

l l

t 91NCRWP\910PN059.PSN Page 9 of 9

. ,- ,. _ . . . . _ . . . . _ . . . . - . __ , . .