ML20043D796
| ML20043D796 | |
| Person / Time | |
|---|---|
| Site: | Neely Research Reactor |
| Issue date: | 06/05/1990 |
| From: | Neely Research Reactor, ATLANTA, GA |
| To: | |
| Shared Package | |
| ML19298E157 | List: |
| References | |
| NUDOCS 9006110182 | |
| Download: ML20043D796 (3) | |
Text
. 4-
- g MODIFIED =PAGES OF THE TECHNICAL SPECIFICATIONS PER AMENDMENT REQUEST Yf ' l PDC L.
-17 3.4 LIMITATIONS OF EXPERIMEWS APPLICADILITY These speci ficat. ions apply to experiments performod at the GTRR.
QBJECTIVE A, To prevent damage to the reactor and to limit radiation dose
to facility personnel and the public in the event of experiment failure.
SPECIFICATIOjiS l a. "The potential reactivity worth of each secured removablo experimont shall be limited to 0.0175 Ak/k provided that j the shutdown margin of the reactor relative to the cold i xenon f ree critical condition is at least 0.0275 Ak/k '
with the most reactive shim safety blade and regulating rod fully withdrawn."
- b. The magnitude of the potential reactivity of each
. unsecured experiment shall be limited to 0.004 Ak/k .
- c. The rate of change of reactivity of any unsecured experiment, any movable experiment, or any combination i
of such experiments having a total reactivity worth in oxcess of 0.0025 Ak/k introduced by intentionally setting the experiment (s) in motion relativo to the reactor shall not exceed 0.0025 Ak/k-sec.
- d. The sum of the magnitudes of the static reactivity worths of all unsecured experiments which coexist shall not exceed 0.015 A k/k. t
- o. The surface temperature of the material which bounds or supports any experiment shall not exceed the lowest of the following, whero applicables (1) The saturation temperature of liquid reactor coolant at any point of mutual contact.
(2) A temperature conservatively below that at which the corrosion rate of the boundary material at any surface would lead to its failure, or, I
(3) A temperature conservatively below that at which tho strongth of the boundary material would be reduced to a point predictably leading to failure.
- f. Materials of construction and fabrication and assembly techniques utilized in experiments shall be so specified and used that assurance is provided that no stress f ailuro can occur at stressos twice those anticipated in the manipulation and conduct of the experiment or twico i thoso which could occur as a result of unintended but credible changos of, or within, the experiment.
I u - )
s
,- ,-18 : ,
h= g. The radioactive material content, including fission l products, of any singly encapsulated experiment shall be limted so .that the complete release of all gaseous, [4 particulate, or. . volatile components from- the :j encapsulation will.not result.in doses in excess of 10%
of the equivalent annual doses stated in 10 CFR Part 20. f This done limit- applies._ to. persons - occupying (1) 9 unrestricted areas continuously for two. hours starting R at time-of release or-(2) restricted areas during the- 1 length of time required >to evacuate the restricted area. -
Q;
- h. The radioactive material content, ' including fission y products, of any doubly encapsulated or vented experiment R shall be limited so. that the complete release _ of all
~
- gaseous, -particulate, or volatile components from the e encapsulution or confining ' boundary of. the experiment l' could not result in (1) a dose to any person-occupying an . unrestricted crea continuously for a' period. of two hours ::tettina at the time or release in excess of ' 0.5 rem to the wh' ole-body or:1.5 tem to.the thyroid'or (2) a dose to any person occupying a restricted area during-the length of time required to evacuate the restricted-area in excess of fives rem to the whole-body or 30 rem to the thyroid.
- 1. Explosive materials in ' excess of 25 milligrams of TNT g equivalent shall not be irradiated in the GTRR. ]
- j. Explosive . materials inL excess of' 25 milligrams TNT
- equivalent may be stored within the containment- building --
only if they are encapsulated in suchla' manner to assure full compliance with 10 CFR 50, Appendix.B..
- k. Experiments which could increase reactivity by flooding, shall- not remain in or adjacent :to . the core unless measurements are made to assure that the shut down margin -
required in Specification- 3.1.a would be satisfied af ter flooding.
BASIS Limiting the. potential. reactivity worth or secured removable experiments to 0.015 Ak/k assures that any transient crising _
from the instantaneous removal of such experiments will not result in cladding failure and concomitant release of radioactive- material. which coulC had to doses in excess of the limits set forth in 10 CFR Pact-20.
9 l-w <
j,M - f R
- p In Reply Refer to:
Dockets: 50-313/90-01 50-368/90-01 Arkansas Power & Light Company
~-
ATTN: Mr. Neil S. Carns, Vice President Nuclear Operations P.O. Box 551 Little Rock, Arkansas 72203 Gentlemen:
SUBJECT:
NRC INSPECTION REPORT.50-368/90-01 -
This refers to the Nuclear Regulatory Commission (NRC)' special team inspection conducted during the period February 27 through April 6, 1990, of activities authorized by NRC Operating License NPF-6 for Arkansas Nuclear One, Unit 2 (ANO-2) and to the discussion of our findings with you and members of your staff at the conclusion of the inspection.
The purposes of the inspection were to verify that your emergency operating procedures were technically accurate; that their specified actions could be meaningfully accomplished using existing equipment, controls, and instruments; and that the available procedures had the usability necessary to provide the operators with an effective operating tool. The areas examined during the inspection are identified in the enclosed report. Within these artas, the inspection consisted of a selective examination of procedures and gg representative records, plant walkdowns, interviews with personnel, and
.g - l observation of the use of ANO-2 emergency operating procedures on the Unit 2 plant-specific simulator.
[
The team determined that the ANO-2 emergency operating procedures, when used by trained operators, could preclude serious damage to plant systems. However.
the procedures did not readily facilitate transitions to optimal recovery actions and the operators had to rely on their experience and diagnostic skills. As such, the team concluded that the emergency operating procedures were only marginally adequate. The team also concluded that the verification and validation program for the Unit 2 emergency operating procedures appeared
, inadequate.
I Within the scope of the inspection, it was found that certain of your activities were in violation of NRC requirements. The violation involved .the failure to establish and maintain appropriate emergency operating procedures.
Consequently, you are required to respond to the violation, in writing, in accordance with the provisions of Section 2.201 of the NRC's " Rules of Practice," Part 2, Title 10, Code of Federal Regulations. Your response should o
G be based on the specifics contained in the Notice of Violation enclosed with this letter.
RIV:0PS* C:0PS* 0:DRS* D:
TOMcKernon- JEGagliardo LJCallan SJ ins
/ /90 / /90 / /90 b '/90.m. :
- previously concurred 900611G171 900604 '
{DR ADOCK 05000313 PDC
/[q
.c .,,
, s 9
Arkansas Power & Light Company I During the course of the inspection, you and other members of your staff made commitments regarding immediate, short-term, and long-term actions you would implement to resolve some of the concerns identified by the inspection team.
These commitments were discussed with you during the exit interview and you were requested to provide, in writing by April 20, 1990, your understanding of
'the agreed upon commitments, planned corrective actions (both short-term and l long-term), and specific implementation time tables to include major ;
milestones. Your letter of April 20, 1990, which documents these commitments, !
is included as an attachment to the enclosed report, j During the exit interview, an unresolved item was discussed that raised the !
question of whether appropriate emergency operating procedures had been established. After subsequent reviews, we concluded that you have not .
established appropriate emergency operating procedures pursuant to the l appropriate regulatory requirements. This position is cited in the enclosed .
Notice of Violation.
It is our view that your staff had received ample prior notice of the types of concerns identified by this inspection. Of particular concern to us is that your staff had not acted in a timely manner with respect to previous assessments of your emergency operating procedures performed by your consultants and by the NRC (ANO, Unit 1 emergency operating procedures team inspection, May 31 through June 10,1988). These previous assessments had highlighted concerns very similar to those discussed in the enclosed report. ;
We consider this matter significant enough to warrant your review, !
Consequently, you are requested to address our concern in this matter as part i of your response to the Notice of Violation, i This report does not include specific inspection followup for selected i Diagnostic Evaluation Team findings (reference Diagnostic Evaluation Team Report issued December 21,1989).
The response directed by this letter and the accompanying Notice is not subject to the clearance procedures of the Office of Management and Budget as required ,
by the Paperwork Reduction Act of 1980, PL 96-511.
Should you have any questions concerning this letter, please contact us.
Sincerely, Original Signed By:
Samuel J. Colins Samuel Collins, Director Division of Reactor Projects
Enclosures:
(see next page)
r-- ,
S .'
a ,
Arkansas Power & Light Company .
l
Enclosures:
i
- 1. Appendix A - Notice of Violation
- 2. Appendix B - NRC Inspection Report
> 50-313/90-01 w/ Attachment 50-368/90-01 w/ Attachment cc w/ enclosures:
Arkansas Nuclear One ATTN: Early Ewing, General Panager Technical Support and Assessment :
P.O. Box 608 Russellville, Arkansas 72801 Arkansas Nuclear One ATTN: Jerry Yelverton, Director Nuclear Operations P.O. Box 608 Russellville, Arkansas 72801 Combustion Engineering, Inc.
ATTH: Charles B. Brinkman, Manager Washington Nuclear Operations 12300 Twinbrook Parkway, Suite 330 Rockville, Maryland 20852 Honorable Joe W. Phillips County Judge of Pope County Pope County Courthouse Russellville, Arkansas 72801 Bishop. Cook, Purcell & Reynolds ATTN: Nicholas S. Reynolds, Esq.
1400 L Street, N.W.
Washington. 0.C. 20005-3502 Arkansas Department of Health ATTN: Ms. Greta Dicus, Director '
Division of Environmental Health Protection 4815 West Markam Street Little Rock, Arkansas 72201 ,
Babcock & Wilcox Nuclear Power Generation Division ATTN: Mr. Robert B. Borsum 1700 Rockville Pike, Suite 525 l Rockville, Maryland 20852 1
\
l
e r '%
e.
Arkansas Power-& Light Company U.S. Nuclear Regulatory Commission ATTN: Senior _ Resident Inspector 1 Nuclear Plant Road Russellville, Arkansas- 72801 U.S. Nuclear Regulatory Commission -
ATTN: Regional Administrator, Region IV 611 Ryan Plaza Drive, Suite.1000 Arlington, Texas 76011 bcctoDM8(IE01) t; bec distrib. by RIV:
- R. D. Martin
- Resident Inspector .
- DRSS-FRPS *SvetionChief(DRP/A)
Lisa Shea, RM/ALF *RIV Cile
- DRP
- MIS ivstem
- RSTS Operator *ProjettEngineer(DRP/A)
- 0RS- .
- T. O. McKernon
- J. E, Gagliardo *S. McCrory
- R. Haag *S. 8. Sun, NRR- ,
- S D. Butler l
- T. Alexion, NRR Project Manager (MS: 13-E-21)
- C, Poslusny, NRR Project _ Manager (MS:
13-D-18).
- w/766 i
e APPENDIX A NOTICE OF VIOLATION Arkansas Power & Light Company Docket: 50-368 Arkansas Nuclear One, Unit 2 Operating License: NPF-6 During an NRC inspection conducted from January 27 through April 6,1990, a violation of NRC requirements was identified. The two part violation involved the failure to establish and the failure to maintain appropriate plant procedures: the licensee's emergency operating procedures (EOPs) were technically inadequate and the E0P verification and validation program failed to function to maintain the procedures. In accordance with the " General Statement of Policy and Procedure for NRC Enforcement Actions," 10 CFR Part 2, '
Appendix C (1990) (Enforcement Policy), the violation is listed below:-
Failure to Establish and Maintain Appropriate Plant Procedures
^
Unit 2 Technical Specification 6.8.1 requires that " written procedures be established, implemented, and maintained," covering a list of activities including the applicable procedures recommended in Appendix A of Regulatory Guide 1.33, November 1972. Appendix A to Regulatory Guide 1.33, November 1972 l lists typical safety-related activities such as combating emergencies (Section F) which should be covered by written procedures. Licensee Procedure E0P 2202.01, " Emergency Operating Procedure," had been promulgated as the procedure for combating operational emergencies.
- 1. FjQ1_ure To Establish Appropriate Plant Procedures Contrary to the above, the licensee did not establish procedures for certain aspects of operational emergencies. Specifically, Procedure E0P 2202.01 did not appropriately establish the process to achieve plant recovery for certain operational emergencies, nor did it adequately consider multiple failures as stipulated in NUREG-0737, Item I.C.1, and implemented by the order of December 17, 1982, pursuant to 10 CFR 50.54(f). The following examples pertain:
- a. While responding to a simulated reactor coolant system leak using Procedure E0P 2202.01, Section 9.0, SIAS (safety iniection actuation signal), recovery actions could not be completed because the procedure did not provide guidance for natural circulation cooldown in the saturated condition with partial voids. The recoverability of pressurizer level and subsequent subcooled margin was assumed, but no procedure was provided in the event these conditions could not be achieved,
- b. While responding to a simulated inadequate core cooling event following a feed line rupture, the emergency core cooling system (ECCS) was to be used to establish cooling in accordance with Procedure E0P 2202.01, Section 12.8. When emergency feedwater was. restored, the E0P gave no guidance for securing ECCS cooling and continuing recovery using g61go179 900604 g &DDCK 05000333 PDC
emergency feedwater. Further, the long-term recovery actions using the CCCS took the plant to the cold shutdown condition. Shutdown cooling was achieved using Operating Procedure (0P) 2104.04,
" Shutdown Cooling System," without terminating the vent release path,
- c. For a simulated steam line break inside containment concurrent with a tube rupture in the same steam generator, main steam isolation signal, ,
recovery could not be completed using Procedure E0P 2202.01, Section 8.0.
The E0P failed to account for the inability to recover pressurizer level and restore pressure and, thus, did not permit recovery in the j saturated condition. The procedure also failed to provide for an ,
evaluation of a tube rupture and did not direct the operator to proceed to either Section 10.0, " Steam Generator Tube Rupture Greater .
Than Charging Pump Capacity," or Section 11.0, " Inadequate' Core !
Cooling." In addition, the recovery actions specified in Section 8.0
- of the procedure would have worsened recovery by increasing the loss ,
of reactor coolant and containment radiation levels. -
- d. While responding to a simulated steam generator tube rupture (with ;
coolant loss greater than charging capacity) that was compounded by a blackout condition, recovery could not be made using the E0P as !
structured. Section 11.0 of Procedure E0P_2202.01 provided guidance ;
for the tube rupture, but made no provision for handling the blackout condition. Therefore, plant conditions could be worsened and core integrity could be challenged unless experienced operators intervened to compensate for the E0P inadequacy.
{
- 2. Failure To Maintain App,ropriate Plant Procedures ,
Contrary to the above, the licensee failed to maintain certain aspects of the '5 plant procedure for combating operational emergencies. Specifically,
- Procedure E0P 2202.01 had not been adequately verified and validated as demonstrated by the following examples:
- a. The verification and validation (V&V) process failed to ensure that previously identified technical issues, such as the use of the reactor vessel level monitoring system (NUREG-0737, II.F.2), void formations in the reactor coolant system, and the verification of adequate safety injection flow, had been incorporated in the E0Ps.
- b. The V&V process failed to include sufficient plant walkthroughs to identify safety hazards that could negate in plant recovery evolutions.
- c. The V&V process failed to provide for complete and comprehensive -
feedback to management to ensure that inadequate conditions, such as resource allocation, were corrected. '
I e
t i
6 i
- d. The V&V procest failed to ensure that the E0Ps were modified following the installation of the diverse scram system and the control room annunciator upgrade .iodifications installed during refueling outage 2R7 (October 1989).
The above examples constitute a Severity Level IV violation. (Supplement I)
(368/9001-01)
Pursuant to the provisions of.10 CFR 2.201, Arkansas. Power & Light Company is hereby required to submit to this office, within 30 days of the date of the letter transmitting this Notice, a written statement or explanation in reply, including for each violation: (1) the reason for the violation if admitted, (2) the corrective steps which have been taken and the results achieved, (3) the corrective steps which will be taken to avoid further v'olations, and (4) the date(s) when full compliance will be achieved. Wher4 Qhvi cause_is -
shown, consideration will be given to extending the response tiene. ,
Dated at Arlingtep, Texas, the </& day of <g , 1990
(
b
e 0
APPENDIX B ,
U.S. NUCLEAR REGULATORY COMMISSION .
REGION IV Inspection Report: 50-313/90-01 Licenses: DPR-51 50-368/90-01 NPF-6 Dockets: 50-313 50-368 :
Licensee: Arkansas Power & Light Company (AP&L)
P.O. Box 551 Little Rock, Arkansas 72203 Facility Name: Arkansas Nuclear One (ANO)
Inspection At: ANO Site, Russellville, Arkansas Inspection Conducted: February 27 through April 6,1990 -
Inspector: - - / d*
- 1. O. McKernon, Team Leader, Operational Date /
Programs Section, Division of Reactor Safety Region IV Team Members: S. L. McCrory, Examiner, Operator Licensing Branch Division of Reactor Safety, Region IV R. Haag, Resident Inspector, ANO S. B. Sun, Reactor Engineer, Reactor Systems Branch Division of Systems Technology, Of fice of Nu:: lear Reactor Regulation S. D. Butler, Resident Inspector, Waterford-3
- M McWjlliams, Human Factors Specialist, Consultant Approved By:
JK E. Gap)lardo,. Chief, Operational Date I Programs Section, Division of Reactor Safety, Region _IV 9006110184 900604 PDR ADOCK 0S000313 o PDC l
t
Inspection Summary Inspection Conducted February 27 through April 6,1990 (Report 50-313/90-01)
Areas Inspected: No inspection of Arkansas Nuclear One, Unit 1, was conducted.
Inspection Conducted February 2] through April 6,1990 (Report 50-368/90-01)
Areas Inspected: This special, announced inspection was conducted of the Arkansas Nuclear One, Unit 2 ( AND-2), emergency operating procedures (EOPs) by reviewing the plant specific E0Ps, the E0P training program, and the quality assurance activities related to the development, implementation, and maintenance of the E0Ps. Further, evaluations were made of technical and human factors considerations incorporated into the E0Ps and the use'of the E0Ps during simulator exercises and plant walkthroughs. '
Results: Within the areas inspected, one violation was identified (failure to establish and maintain procedures, paragraphs 2.1, 2.3, 2.6, and Attachment D).
The team concluded that the emergency operating procedures were marginally adequate. Furthermore, the team concluded that the E0P verification and validation program was inadequate.
b ii l-
O .,
]
.. )
. t.
EXECUTIVE
SUMMARY
from February 27 through April 6,1990, an NRC inspection team evaluated the I Arkansas Nuclear One (ANO) emergency operating procedures (E0Ps) for the Unit 2 !
' plant. The inspection was conducted to verify that the E0Ps were technically ,
accurate; that their specified actions could be l plant using existing equipment, instrumentation, andphysically carried controls; and out in.the that the '
staff could correctly perform the procedures. The inspection was conducted in ;
accordance with the guidelines in Temporary Instruction 2515/92, Revision 1, i
" Emergency Operating Procedures Team Inspection." l Conclusions The team considered the E0Ps sufficient in structure to preclude serious damage to plant systems by not exacerbating plant conditions and to place the plant in -
some interim stable condition, but the team found that the procedures did not readily facilitate transitions to optimal recovery actions. Recovery strategy '
was dependent upon the experience and diagnostic skills of the operators. As such, the team concluded that the E0Ps were only marginally adequate.- Furthermore, the team concluded that the licensee's E0P verification and validation (V&V) >
pro aam appeared inadequate (see endorsed Notice of Violation, Part 2). The following strengths and weaknesses were identified:
Strenaths The licensee's strengths are summarized below and discussed in more detail in Sections 2.3, 2.4, 2.7, and Attachment D of the inspection repoi't.
Operators' diagnostic skills were good and compensated for the weaknesses ,
in the E0Ps 0perator crew's interactions and communications were good.
Control board operators had a good knowledge of the-plant and their overall responsibilities.
Weaknesses Weaknesses were grouped according to the three key purposes of the E0P team inspection and are summarized-below under each category. The specific weaknesses are referenced to the applicable sections of the report.
Technical Adequacy of the E0Ps The licensee failed to incorporate previously identified safety issues into the E0Ps (Sections 2.1, 2.2, 2.6, and Attachment A).
E0Ps lacked adequate self-corrective features (Sections 2.1 and 2.2 and Attachment A),
s L iii l:
- m. _ t _ u- -
. k*
., a 6
Capability of Physically Carryina Out the E0Ps in the Plant The E0Ps were only marginally adequate for meeting their intended function because the verification and validation program had significant weaknesses (Sections 2.2, 2.3, 2.6, and Attachment C).
- Ability of the Staff to Correctly Perform the E0Ps The E0P Writers Guide lacked adequate guidance (Section 2.2 and Attachment A).
The E0Ps contained numerous human factors deficiencies (Sections 2.2 and 2.3 and Attachment B).
The staf fing level for nonlicensed operators was inadequate (Sections 2.3, 2.4, 2,6, 2.7, and Attachments C and D). -
E0P training, as structured, did not ensure complete recovery capability over the long term (Sections 2.5 and Attachment D).
Commitments As a result of the inspection findings, the licensee committed to take specific corrective actions to correct the weaknesses discussed above. These commitments were of an immediate, short-term, and long-term nature, were discussed in the exit interview, and are described below:
Immediate Action' The licensee will take appropriate actions to ensure that adequate staffing levels of nonlicensed qualified operators exist on all shifts to provide immediate response to emergency conditions.
Short-Term Actions The licensee will take those corrective actions necessary to perform a critical self-assessment and revision of the existing E0Ps to ensure that technical inadequacies are corrected, procedural insufficiencies are resolved, and adequate V&V are implemented. This action should be performed in a timely but orderly manner to ensure E0P revision adequacy and comprehensiveness.
The licensee shall take those actions necessary to upgrade E0P training.
Lesson plans or other training material should formally incorporate prerequisite knowledge and skills currently residing in the memory or experience of individual instructors. This action shall be taken to ensure uniform and consistent training to sustain operators' performance levels to compensate for the present weaknesses in the E0Ps.
iv l
7- -
t
'., . . *, ' : ?
j
- Long-Term Actions The licensee will revamp and upgrade.the E0P program and procedures to be !
consistent with the vendor's guidelines (Combustion Engineering Owners Group Generic. Guidelines Document ~CEN-152).' The NRC did not specifically direct. endorsement of the vendor guidelines, but.the' licensee stated their llr intent to upgrade to the CEN-152 guidelines and subscribe to the vendor's~
E0P maintenance program. ;
Through the E0P upgrade program, the licensee committed to take those actions necessary to ensure.a complete and comprehensive, multidiscipline .
.V&V process including a 100 percent control room and plant walkthrough In' addition, evaluations and conclusions related to backshift,-nonlicensed-operator staffing levels. shall be established and. delineated in a revision.
to the Technical Specifications.
At the exit interview on April 6, 1990, the licensee agreed to provide these and any other commitments related to the Unit 2 E0Ps in. writing by April 20, 1990. The licensee's Letter 0CAN049012 of April 20,-1990, (Attachment H) documents its commitments in this area. .,
l; i
I I
i l
1y
F , ,
CONTENTS.
.P. age y
EXECUTIVE
SUMMARY
i
- 1. INTRODUCTION . . . . . . . . . . . . ... . . . . . . . . . . . . 1
- 2. FINDINGS . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2.1 Technical Guidelines Adequacy)of (Task 1 .Plant
. . . .Specific
............... 1
- 2. 2 Technical Adequacy of E0Ps and Consideration of Human Factors (Task 2). . . . . . . . . . . . . . . . .-
3 2.2.1 Technical Adequacy. . . . . . . . . . . . . . . . .. 3 2.2.2 Human Factors . . . . . . . . . . . . . . . . . . . 4 2.3 Review of<E0Ps by Control Room and Plant Walkthroughs (Task 3) . . . . . . . . . . ... . . . . . . . . . . . . .
. 7 2.4 E0P Evaluation Using the Plant-Specific Simulator (Task 4) . . . . . . . . . . . . . . . . . . . . . . . . . 9
- 2. 5 E0P Training . . . . . . . . . . . . . . . . . . . . . . . 10 2,6 On-Going Evaluation of E0Ps (Task 5) . . . . . . . . . . . 11.
- 2. 7 Personnel Interviews (Task 6). . . . . , ,.. . . . . ... . 12
- 3. EXIT MEETING AND PERSONS CONTACTED . . . . . . . . . . . . 13 ATTACHMENTS A. TECHNICAL ADEQUACY DEFICIENCIES B. HUMAN FACTORS DEFICIENCIES C. CONTROL ROOM AND PLANT WALKTHROUGH DEFICIENCIES D. SIMULATOR AND E0P TRAINING
' E. . PERSONNEL CONTACTED AND EXIT MEETING ATTENDEES F. DOCUMENTS REVIEWED G. ACRONYMS H. ARKANSAS POWER & LIGHT COMPANY LETTER OCAN049012 vi
DETAILED INSPECTION i
- 1. INTRODUCTION The purpose of the announced team inspection was to evaluate the licensee's emergency operating procedures (EOPs). The team reviewed the E0Ps, the '
documents used to develop the E0Ps, the plant-specific guidelines, and the E0P writer's guide; performed plant walkthroughs of the E0Ps; evaluated the E0Ps during the performance of accident scenarios on the site-specific simulator; and performed a human factors evaluation of the E0Ps during all phases of the inspection. The objective of this inspection was to determine that the E0Ps ,
were technically adequate, could be physically carried out in the plant, and would be correctly performed by plant personnel. ,
The tasks referred to in the report are described in TI 2515/92, Revision 1, July 5, 1989. Attachments A through 0 support the findings discussed below, Attachment E lists personnel contacted and attendees of the exit meeting, t Attachment F lists the documents reviewed, Attachment G provides definitions 2 for the acronyms used in this document, and Attachment H is a copy of Arkansas Power & Light Company Letter OCAN049012. ;
- 2. FINDINGS 2.1 Technical Adequacy of Plant-Specific Guidelines (Task 1)
The Arkansas Nuclear One, Unit 2 (ANO-2) plant-specific guidelines (PSG) were not developed on the basis cf the Combustion Engineering (CE) Owners Group generic guidelines (CEN-152). Rather, the ANO-2 PSG was developed as guidelines to prepare the E0Ps for ANO-2 in a similar procedural structure and approach as those for ANO-1. The ANO-1 reactor was designed by Babcock & Wilcox, ANO-2 was designed by Combustion Engineering (CE). This unique approach precluded using the CE Owners Group generic guidelines for the review. The inspection team, therefore, decided to assess the technical adequacy of the ANO-2 PSG on the basis of the guidelines specified in Item I.C.1 of NUREG-0737, " Clarification of TMI Action Plan Requirements."
The ANO-2 PSG guidelines for the E0P consisted of "Immediate Actions" and ten recovery procedures. The procedures encompassed reactor trip recovery, degraded power recovery, blackout recovery, overcooling recovery, main-steam isolation recovery, safety-injection action recovery, steam generator tube rupture less than charging pump capacity, steam generator tube rupture greater thar charging pump capacity, and inadequate core cooling.
The PSG required the operator to follow a proceduralized algorithm to determine which event had occurred. When any entry condition was met, the E0P provided the operator with the safety function parameters expected for an uncomplicated reactor trip in the "Immediate Actions." Based upon the existing safety function parameters, the operatcr performed the reactor trip recovery procedure to determine the safety functions and was directed by the E0P to the 4
i applicable recovery procedure (s) to be entered for further instructions. The t recovery actions provided methods to restore and maintain safety functions to safe conditions for events in which the reactor trip was complicated by malfunctions of systems or components, lhe safety functions used in the ANO-2 PSG were reactivity control, reactor coolant system (RCS) inventory control, 1 RCS pressure control, core heat removal, RCS heat removal, containment !
integrity, and maintenance of vital power. I Following the algorithm in the PSG, once the operator had assessed a safety function by a decision step implementing a supporting recovery procedure, the operator generally did not ,eassess safety functions during later action steps.
The team evaluated.the PSG for technical accuracy, internal consistency, and engineering and operational practices to ensure that the PSG incorporated the guidelines of IMI Action Item I.C.1.. The team identified the following major technical deficiencies:
The PSG were insufficient for response to multiple failures. The team found that the PSG were collectively a set of event-based procedure ,
guidelines. The PSG did not recommend that the E0Ps require operators to !
monitor the status of safety function parameters continuously. Therefore, I the operator could fail to detect subsequent additional malfunctions i impairing safety functions that were previously-verified as adequate. i Also, the PSG did not explain how to diagnose degraded conditions and l multiple events and did not provide contingency actions in the event that i primary actions were unsuccessful.- Without guidelines to check the status of safety functions continuously and without procedures to respond to conditions when the safety functions were not within acceptable parameters, the team's major concern was.that the operators did not have sufficient guidance to respond to a multiple-failure event.
Examples of multiple-failure events that were reviewed during the inspection are discussed in Section 2.4 and Attachment D. For those scenarios, the PSG did not address the intended recovery procedure; therefore, the operator could not determine the apptopriate response for optimal recovery. A number of observations regarding the inability to ,
respond to a multiple failure event were discussed with the licensee and-L are described in Attachment D. During these discussions, the licensee agreed with the team's findings related to PSG deficiencies and committed l to take long-term corrective actions. As such, the licensee committed to preparing a new PSG consistent with the CE Owners Group guidelines i
< (CEN-152, Revision 3), subscribing to the CE Owners Group E0P maintenance !
program, and upgrading the E0P procedures to comply with the new PSG.
The PSG did not fully address important safety issues. TMI Action Item 11.f.2, which requires the reactor vessel level monitoring system (RVLMS) to be used during voiding conditions, was not incorporated in the PSG operator action instructions for the E0Ps. ;
l
+
i J
~
, ~ 'mmwwwwwkm I
Although operators were instructed to eliminate voids by pressurizing and depressurizing the RCS, there was no instruction in the E0Ps about methods for identifying void formation. Success paths for pr % ritai.iun e.d depressurization for void elimination were not included. Furthermore, the ,
need and methods to remsve voids in the steam generator tubes and the treatment of nonconderuible gases were not discussed.
The PSG did not~ discuss the need to'ved fy the safety injection system (SIS) flow according to the SIS performance curve. In addition, no !
justification was provided for not using the SIS performance curvu figure in the E0P. ,
The PSG was vague in specifying the use of instruments or valves for key parameters being monitored.- For example, the subcooling margin (SCM) was i used throughout the PSG for determining the high-pressure safety. !
injection (HPSI) throttle criteria. restart conditions for the reactor coolant' pumps, and the existence of natural circulation core heat removal. ,
However, the specific instrument for monitoring SCM and its associated '
display were not indicated in the procedure.
Although the procedure for pressurized thermal shock instructed operators. :
'to maintain.the RCS temperature within a specified pressure-temperature (P-T) curve, the key parameter (Th/Tc) was not given to determine overcooling by using the P-T curve. '
Although the tempe;ature difference between the core exit thermocouples ,
and RCS hot-leg resistance temperature detector was used to determine the ,
adequacy of natural circulation for core heat removal, the acceptable temperature difference was not specified in the procedure, ,
The above deficiencies constituted an apparent violation (368/9001-01) of Technical' Specification 6.8.1 requirement to maintain procedures. Other -
examples also were discussed with the licensee during the inspection. ,
The inspection team concluded that the current PSG contained a number of technic'al inadequacies. The licensee committed to resolve these. inadequacies ,
through short-term and long-term corrective actions. The licensee's approach
- and responses to resolve the discussed concerns and other potential deficiencies appeared adequate.
2.2 Technical Adequacy of E0Ps and Consideration of Human Factors (Task 2) 2.2.1 Technical Adequacy The team reviewed the E0Ps and supporting procedures listed in Attachment F to ,
ensure that the E0Ps were. technically adequate and appropriately incorporated- -
the licensee's Emergency Operating Procedure Technical Guidelines (Revision 2) !
by considering:
The prioritization of accident mitigation strategies in the E0Ps 3-I b
4 The extent of E0P deviation from the licensee's technical guidelines The step sequence of ti.e licensee's technical guidelinas Procedure entry and exit points Transitions between and within the procedures
- b Noies and caution statements j Plant-specific values and set points and adverse containment values The clarity of decision points The human factors aspects of the E0Ps and the E0P structure and format
}
The team identified a number of general and specific technical concerns.
Comments pertaining to the more significant concerns are given in Attachment A, and the issues discussed below are representative of the concerns.
Safety function monitoring was not adequate af ter entry into the E0Ps. For example, the safety function monitoring that was to be performed periodically 1 in accordance with Procedure 1010.003, "STA [ shift technical. advisor] Duties 1 and Responsibilities," only provided success criteria for the normal post-trip values and did not address successful maintenance of the safety functions in degraded conditions.
The E0Ps did not contain sufficient safety function recovery guidance and, diagnostic strategy necessary for degraded conditions and multiple' events, nor did they provide contingency actions in the event that primary actions were unsuccessful. The E0Ps assumed that all actions'taken by the operators during an emergency were successful.
Although avoiding or mitigating pressurized thernial shock was extensively discussed in the licensee s technical guidance, minimal guidance was provided in the E0Ps.
Reference in the E0Ps to the reactor vessel monitoring system (RVLMS) and reactor coolant system (RCS) high point vents and instructions for usage during conditions of RCS voiding were inadequate.
Procedure OP 2203.13, " Natural Circulation Cooldown," did not adequately address conditions other than loss of offsite power during the cooldown. The possibility of having to cool down with significant voiding in the RCS or with saturated RCS conditions had not been addressed.
4 U
i
. I 2.2.2 Human Factors The ANO procedure writer's guide (PWG)- and selected E0Ps and abnormal operating procedures (AOPs) were reviewed for consistency with the PWG and human factors principles as described in NUREG-0899 and NUREG-1358. The desktop review identified numerous human factors concerns, many of which could be traced to ;
the lack rf specific guidance provided in the PWG. Specific examples of human factors deficiencies are provided in Attachment 8.
General guidance for the development of' operations procedures and E0P usage was provided in Procedure 1015.04A, "ANO Operations Procedure Writer's Guide."
Additional documents referenced by the PWG appeared to contain requirements relevant to the E0Ps, including Procedures 1000.04, 1000.05, 1015.10.
There was a concern regarding the lack of a single, cohesive document that contained all requirements related to writing the E0Ps, as well as other auxiliary procedures such as A0Ps. Guidance provided in the PWG lacked sufficient detail to ensure that human factors principles were consistently ;
applied in soveloping and maintaining the E0Ps and other related procedures.
The PWG was also found to lack prescriptive wording and relied heavily on the writer's discretion to incorporate PWG guidance. For example, the introduction to the PWG stated that it was a guidance document, and as such, it did not contain definitive requirements. Furthermore, Appendix B of the PWG, which provided guidance specific to the E0Ps, stated that the guidance was not intended to place restrictions on departures from features of the procedures.
These statements, in effect, allowed the procedure writers to adhere to guidelines as they saw fit. In addition, the PWG often presented guidance by describing " commonly used" practices or methods that "should be considered" by the writer. rather than providing specific instructions that must be followed.
The team was particularly concerned because many of these same findings were identified during the ANO-1 E0P inspection performed in 1988 (NRC Inspection Report 50-313/88-17). The issues found in that inspection had not been ,
addressed; in fact, no revision to the ANO-2 PWG had been made'since the Unit 1 inspection even though 16 specific deficiencies had been identified at that time.
The ANO E0Ps employed a two-column format in which the left-hand column (LHC) briefly described the objective to be accomplished and the right-hand column (RHC) provided the specific actions to be performed to accomplish each objective. While this may be a useful format, AN0's procedures did not effectively implement the intended design. Instead, AN0's E0Ps contained abbreviated action steps in the LHC rather than high-level objectives, which resulted in significant duplication of information and created a procedure that ,
was cumbersome to use. Operators stated that the current format inhibited-their ability to orient themselves quickly within the procedures and to deduct :
the overall path of the recovery action. In simulator scenarios (discussed in Section 2.4 and Attachment 0), senior reactor operators (SR0s) were observed often to review both columns before formulating their direction to the reactor operators (R0s).
Another problem was the inconsistencies in the information provided in the two columns. For example, the LHC of Step 10.1.2 directed the operator to " isolate letdown" while the RHC directed the operator to " isolate letdown if required to maintain pressurizer level." The wording of this particular step led to inadver-tent letdown isolation during one of the simulator exercises. In other cases, the LHC directed the operator to verify a specific parameter value while the RHC added an approximation symbol in front of the value, giving a slightly different message.
AN0's E0Ps used directives in the form of "go to" statements to transition the ,
operator to other procedures or other steps within the same procedure. In some cases, the operator was directed to "go to" another procedure and perform it in conjunction with the current procedure. One problem that was noted was the lack of clear guidance as to which "go to" statement took precedence after the initial transition was made. There also were a number of cases identified where transi-tions needed to be added to direct the operator to bypass inapplicable steps. In some cases, contingent "go to" directives did not clearly or fully describe the conditions that would warrant the transition.
Logic statements were used to describe a set of conditions that, if observed, required the operator to take specific actions or a sequence of actions. Because I decisions could be difficult to make during emergency situations, it was critical that logic statements be clear. To aid the operator -in recognizing and interpreting logic statements, proper structure and highlighting of key terms should be consis-tently applied.
The procedures relied extensively on operator interpretation and used vague phrases such as "if required" and "as necessary" to direct operator actions and " adequate,"
" normal," abnormal," or " proper" to describe parameter conditions or equipment status that the operator was supposed to assess. One example was the statement,
" Verify no abnormal differences between CETs and hot leg RTDs."
Approximation symbols were used extensively to indicate desired parameter readings.
Instead, specific ranges should have been provided so that the operator would not have to determine if the reading was "close enough."
Caution statements should have been used to alert operators to hazardous conditions that could cause injury or equipment damage; they should have described the con-sequence of the hazard. Notes should have been used to present supplemental infor-mation to the operator. AN0's E0Ps, however, contained caution statements and notes that were actually recurrent or contingent action steps. Hazards or poten-tial consequences of actions (or inactions) were presented infrequently. Caution statements also were found that contained noncritical information, which served to dilute the importance given them by the operators. Caution statements and notes '
were found on pages preceding and following the steps to which they applied. ;
Numerous problems related to step structure were found in the E0Ps. Steps and substeps at the same level were ef ten inconsistent in structure. For example, some steps were written as full sentence action statements, some were statements of plant conditions, and some merely identified affected equipment or relevant parameters to be checked.
4
, .'N^
AN0's'E0P structure typically provided high-level steps followed by lower level substeps that described the specific actions to be performed to accomplish each high-level step. However, in some instances, the performance of lower level action steps were required as prerequisites to performing actions of the high level step, (i.e. , verification of pump start criteria before actually starting the pump).
In a number of-cases, steps were identified in the procedures as equally acceptable steps (an either/or situation). For example, " Verify EFW pump suction flow path - Suction from CST.open OR SW open"; but for a given set of circumstances, one alternative was preferable to another. E0Ps should reflect when a specific path is preferred.
Procedures should have provided methods for place keeping to track the current step while performing designated activities. Aids such as checkoff boxes should have been provided to assist operators in tracking steps that had been performed or parameters that had been verified. E0Ps did not have a formal, standardized method for place keeping within a procedure or between different tabs. Operators reported that they were using fingers, pens, or yellow
. stiSkers to keep their place between tabs.
Overall, the tet.m concluded that the procedure writer's guide did not adequately delineate requirements for E0P development and many human factors principles were not considered.
2.3 Review of E0Ps by Control Room and Plant Walkdowns (Task 3)
Selected procedures were walked down in the control room and in the plant with licensed and nonlicensed operators who would normally perform the procedures.
The objective of the walkdowns was to verify that all operator actions called for in the procedures could be performed in a time'y manner with minimal potential for error. The results of these walkdowns are summarized below and examples of specific findings are provided in Attachment C.
The control room indication and controls called for in the E0Ps were available and the labeling of the control panels was consistent with the terminology used in the procedures. There were some inconsistencies in the identification
! number prefixes for radiation monitors located on back panels and electrical breakers. Nonetheless, operators were able to locate all required instrumentation and controls. Two bound sets of the E0Ps were available in the control room. Both sets were of the current revision, were legible, and contained no handwritten changes.
l In walking down the procedures with the operators, a number of deficiencies were identified with regard to the adequacy of the information provided in the procedural steps. These included omission of task performance details and j substeps in the right-hand column, inconsistent identification of local actions, tasks identified as local actions that were preferably performed from l
1
' ,I i
the control room, and incomplete component identification (10 numbers not provided). Many of the deficiencies found during the desktop review were confirmed through discussions with operators during the-walkdowns.
1 One task identified as needing additional guidanc.c (and training) was resetting of engineered safety features (ESF) signals. Although some operators reported that the task was performed by only instrument and control technicians, under emergency conditions, the operators should have the capability of performing 4 this task. Information on performing this task should be provided either in the procedures or incorporated into a control room job aid. Steps requiring the~ operator to assess if a particular alarm had been actuated should have.
annunciator title numbers provided to help the~ operator _quickly make the determination.
During the walkdown of. plant tasks, the=nonlicensed operators were generally i able to locate required equipment in a timely manner. Operators were able to describe the tasks that they would need to perform. However, in several cases, operators stated that they had not actually performed or walked down the particular task.- Access to required equipment was generally good although an opening in the access platform for-the atmospheric dump valve upstream .i
-isolation valves was observed that could pose a serious _ safety hazard, there were minor discrepancies in equipment labeling. Operators reported that plant response to correcting any observed deficiencies was good. Telephone operation and radio transmission were checked at various locations in the plant, and no problems were observed with regard to in plant communications.
Relatively few of the local actions that took place during the walkdown were called out in the E0Ps, which confirmed the desktop review finding that contingency actions _were lacking in the E0Ps.for local operation of-equipment in response to potential failures of primary control mechanisms.
The team also reviewed AN0's vertfication and validation (V&V) program. The V&V process was required to ensure that the' procedures could be accurately and efficiently carried out.
The V&V' program applicable to the E0Ps was described in Administrative Procedure 1015.11,_" Operations Department Procedure Revision Control." While i ~ this document described the overall objectives of the V&V process, specific guidance for performing V&V and the specific requirements of'the V&V effort were distinctly lacking. As a result of these weaknesses, numerous deficiencies were found in the V&V efforts that followed the E0P revisions performed in 1985 and 1989. These deficiencies included the following:
Failure to have a multidisciplinary team' validate the procedures Failure to perform control room and in plant walkdowns.of procedures ,
(principal method of validation was desktop with some simulator t validation)
Failure to ensure that comments from the V&V process were resolved and that resolution activities (when performed) were documented p, i
- q. -.~
i Failure to include E0P-related or- referenced procedures (0Ps, A0Ps) in the V&V process Many of the deficiencies in the E0Ps were indicative of. weaknesses in the V&V !
program. For example,. a concern was raised during the inspection that staffing i levels of nonlicensed operators may have been inadequate-to perform numerous tasks required during certain events. This same cor.cern also'was raised during s the validation of several procedures during the V&V efforts following the 1985- -
.and 1988 revisions to E0Ps. The need for including more' guidance-on resetting _
the main steam isolation signal also was made during the 1988 V&V effort.
Corrective action was not taken in either case to resolve the concerns ident'ified by the V&V process. These deficiencies.are another example of the apparent
' violation (368/9001-01) of TS 6.8.1 regarding the licensee's failure to maintain appropriate plant procedures.
The licensee had recently cnntracted a consultant to perform an independent assessment of their V&V process. The findings of the. independent assessment corroborated many of the observations made during this inspection. ' Although the licensee's independent assessment was a positive step toward resolving V&V program weaknesses, the assessment report referenced several-previous reviews that also had found AN0's V&V program to be lacking. Given the amount of.
-industry guidance and previous findings of problems,-the licensee's failure to take corrective actions before this time was a significant concern.-
The team concluded that operators could perform the tasks of the E0Ps in the control . room and plant although numerous inforniation deficiencies were apparent -
~
in the procedures. The team further concluded that AN0's V&V program had numerous weaknesses and that recent V&V efforts had been ineffective in resolving deficiencies in the E0Ps. As such, the V&V program appeared-inadequate. _.!
- 2. 4 E0P Evaluation Using the Plant-Specific Simulator (Task' 4)
As a stand-alone means of responding to a diversity of casualty situations, the E0P was inadequate'. It was not structured to perform an on going or recurrent assessment of critical safety functions. Therefore, it did-not, provide guidance for response to casualty events occurring after an initiating accident. As a result, recovery was often incomplete, stopping at some intermediate plant condition because further recovery actions, which accounted
~
for existing plant conditions, were not specified in the E0P. In the scenarios conducted by the team on the_ licensee's plant-specific simulator, plant conditions did not_ degrade to the point of exceeding a safety limit .or further
~
l
. jeopardize.public health and safety'when recovery was stopped at an i intermediate point by the E0P. However, time constraints and simulator 1 modeling limitations prevented evaluation of how stable the intermediate conditions were and how plant parameters would trend.
1 Similarly, the E0P did not provide guidance for altering the recovery strategy.
In many cases, a better recovery option existed to restore equipment or-systems than the one being used, however, guidance was not provided for an alternative l
I l
t
.c option. This tended to lead to protracted recovery time and increased the complexity of long-range recovery actions. This was particularly evident when the E0P directed recovery strategy that left the reactor coolant system vents
-open and did not secure a release path.
The inadequacies discussed above were identified by limiting the operators and having them follow the E0Ps exactly as written. In subsequent scenarios, the operators were permitted to respond to casualties as they had been trained.
Under the latter condition, recovery was generally complete and satisfactory, ilw (serators demonstrated-good diagnostic skills and the ability to identify l those portions of the E0Ps from which a viable recovery strategy could be assembled to deal with multiple casualties. In some cases, the recovery actions in the E0Ps were incomplete or open-ended. In those instances, the operators were able to formulate general recovery strategies although details varied f rom one operator to the ne> t. ,
The simulator evaluation of the E0P also confirmed that backshift staffing' levels may be inadequate to accomplish E0P recovery actions in a timely or effective manner. Reducing the availability of in plant operators because of injury or because the operator was limited to operating specific equipment significantly prolonged recovery and may have led to unacceptable degradation in some cases. During the inspection, the licensee took'immediate corrective action and added qualified auxiliary operators and/or nonlicensed trainees who were qualified in specific A0 tasks to the backshif t crews.
-The team further noted that no assessment of critical waste control operator (WCO) tasks to E0P recovery had been made to ensure that sufficient- 1 expertise and availability in crew compliments existed.
The scenarios that were conducted during the simulator evaluation of the E0Ps are outlined in Attachment D and the'significant observations associated with each scenario are given.
. The team concluded that safe plant operations were ensured by the combination of the E0Ps and observed operator skills. However, until long-term corrective actions have been implemented any observed decline in overali licensed i
operator performance' could result in a reassessment of the facility's emergency response capability and adequacy.
2.5 E0P Training Operator use of the E0Ps during the inspection scenarios was satisfactory. . E0P training was credited for the observed level'of operator performance in E0P use. The high level of proficiency in E0P use relied heavily on the skills and-knowledge of individual personnel rather than the formal training program I,
1 structure.
I Most E0P training was conducted on the simulator using accident scenarios.
. Classroom training in E0P areas may have accompanied new E0P revisions or i analysis of industry events. The lesson plan used to support E0P training was l L .
l' -
L
.]
somewhat generic-in content and lacked depth. The focus was mostly on recognition of entry conditions and immediate actions. Basis documents, such i; as the E0P technical guidelines, were not identified in the lesson plan as either reference or instructional aid. Training supervisors expressed a perception that the E0P technical' guidelines were not available for training purposes, i
Most of the operational practices taught in simulator training concerning E0P 1 use were not captured in the lesson plan or other training material'. Much of- 1 the guidance on how to interpret and apply'the E0P was passed on as lore or {.
k tradition. It depended on the memory and experience of individual instructors and operators. The results were that consistent application of the E0P was_not assured and complacency over deficiencies in E0P construction existed so that no significant effort was made to make the E0P construction match intent and actual use. As a result of the above finding, the licensee-agreed'to a j corrective' action commitment to upgrade the E0P training to formally i incorporate prerequisite knowledges and skills that the individual instructors relied upon from their memory or experience.
While most facility operators and staff personnel' recognized the deficiencies in the E0Ps to deal with multiple accidents, scenarios were not being used to {
focus on this area in the facility E0P training cycle. For example, the i scenario cutlines for the two most recent training cycle evaluations did not contain multiple-accident situations similar to those in the second, fourth, sixth, and eighth scenario described in Attachment D. In discussions with several operators throughout the inspection, there was contradictory feedback concerning the use of multiple-accident scenarios _in simulator training. Some said that the scenarios used'for the inspectio'n were very similar to what they.
had seen in training while others stated that they could not recall ever being given multiple-accident scenarios in training.
During interviews and discussions, training supervisors and instructors indicated that scenarios used for E0P- training focused mostly on ensuring that all sections of the E0P were covered in a requalification cycle. While the number of component and instrument malfunctions increased through the cycle, there was no apparent conscious attempt to develop scenarios with multiple accidents of a design-basis nature. For the most part, the Unit 2' operations training supervisor prepared a list of scenario topics to-be covered in a 4 6-week cycle and gave it to the simulator supervisor for detailed. scenario development. The list was mostly taken from the ~ training schedule with occasional input by a training evaluation action request (TEAR). TEARS were usually submitted by the operations manager. Cycle evaluation results were reportedly not used to provide feedback for future scenario focus.
The team concluded that E0P training was generally effective but that reliance on individual memory and experience to communicate the knowledge' and skills needed for E0P applications did not ensure long-term safety. Until,E0Ps consistent with the CEN-152 guidelines were developed, the E0P training materials should-contain sufficient details and guidances to ensure consistency, convey intent and expected application, and provide continuity to remove the dependency on specific individuals.
i 1
' 'A (;y Q (
3} Q 7 ,
2.6 ' Ongoing-Evaluation of E0Ps (Task 5)/
Section 6.2.3 of NUREG-0899 requires that licensee's establish a program for, the-ongoing evaluation of-E0Ps. NUREG-0899 further requires tnat the ongoing evaluation program include the evaluation of the technical adequacy of the EOPs
- on the basis of operational experience and use, training experience, simulator exercises, and control room walkdowns of the procedures.
Operations Administrative. Procedure 1015.11 provided-administrative guidelines
- for the preparation and review of revisions to the E0Ps. The-licensee.had several programs that identified items requiring E0P revision.= Attachment 8,
" Procedure Improvement Identification," to Procedure 1015.11 was used to document procedural inadequacies, including E0P problems. identified during; individual study, classroom training, simulator exercises, or. control room f-wal kdowns. The team was unable to assess the. effectiveness of this feedback '
mechanism because there were no records of its past use. The'. licensee, however, said that items included in previous E0P-revisions had-resulted from procedure l improvement comments.
Procedure.6030.1 required a review of plant modifications for the identification'of applicable E0P changes. The modification turnover process included a verification that required procedural changes' had been approved.
However, the team noted that instructions' related to the diverse stram system
. modification installed during-the last refueling outage (2R7 in September and October 1989) had not been incorporated-into the E0Ps.- The' control room annunciator upgrade modification ~ also was not incorporatedLinto the .EOPs.
However, Revision 8 to.the E0P, which coincided with 2R7, had incorporated two. -
other modifications which were completed during the outage. The team concluded j that while the licensee had a program for identification of r,equired E0P changes related to modifications, the level of detailed review for E0P applicability was not adequate to ensure timely revisions to the E0Ps.
Industry experience, contained in NRC information notices and bulletins,.
NUREGs, and other documents, was reviewed for assessment of E0P applicability.
and needed E0P revi's ion. The team identified the following two' examples of the licensee's failu're to incorporate' applicable information into the E0P:
Information Notice (IN) 88-75 identified .a potential. problem in which the -
capability to close circuit breakers either automatically.or manually from the control room may be lost as a result of antipump circuitry lockout.
During its review, the licensee identified 4160-volt and 480-volt.
safety-related circuit breakers that had antipump relays that would prevent breaker reclosure if the breaker had opened after the initial closure. -Operators received training on actions required to clear the antipump relays; however, the E0Ps were not revised to include'these instructions for reclosure of the breakers.
1 I
_' i
% w 1
NUREG-0737, " Clarification of TM1 Action Plan; Requirements,"
Section II.F.2,: requires that information regarding displays and alarms for inadequate core cooling be integrated into emergency procedures. The team found no instructions _in the E0Ps on the'use of inadequate core ,
cooling instrumentation. I t
q The above findings are additional examples of violation (368/9001-01) of !
TS 6.8.1 for failure to establish and maintain appropriate procedures, j During the NRC inspection for Unit 1 E0fs (NRC Inspection Report 50-313/88-17),
j a lack of QA involvement was noted for E0P development and in the ongoing !
program' In response, the licensee revised the QA program for plant operations l to include E0Ps and A0Ps. In 1988, the QA department implemented an audit schedule that. included a complete review of- all Unit 2 E0Ps and A0Ps during the 1988-1990 operations QA audits.
Because of?aclack of QA involvement during tne-initial Unit 2_E0P development' process, the-teem reviewed the-1988 and 1989 QA audits. . These audits included 1 five E0P tabs and eight A0P procedures which meant that completion of the !
remaining 6 E0P tabs and 23-A0P procedures during the 1990 audit would require ,
a significant' effort by the QA department. The audit results involved an '
administrative deficiency and a concern dealing with the two-column format of !
the E0Ps. :0ther problems that the team identified during the E0P inspection '
were not included in the audit results. Therefore, although the licensee had an active QA review program for the E0Ps,'the; team was concerned that the QA audits did not provide an in-depth review that was necessary for a comprehensive E0P assessment.
2.7 Personnel Interviews (Task 6).
The team intersiewed six licensed shift operators and four licensee management.
or supervisory personnel to discuss their understanding and knowledge of the l E0Ps, their experience in actual E0P usage, their EOP training, and:their ;
thoughts on the adequacy of shift staffing to perform the E0Ps and other related topics. The interviews = offered a good cross-section of the disciplines {
involved and indicated general agreement in the following areas:
The E0Ps did not adequately deal with multiple casualties. ;
Backshift staf fing levels were not sufficient to implement the E0Ps effectively. There were not enough nonlicensed operators qualified for in plantLresponses, The shift technical advisor's contribution to recovery efforts, using the-EGPs, was not significant. '
Training was sufficient to prepare operators to use the E0Ps effectively.
The operators found the E0Ps technically adequate.
1
4
.Most E0P training occurred on the simulator and classroom training was !
limited to reviewing revisions _and perhaps analysis of a recent industry ! .
event. 4 Most operators understood the terms used in the E0P except that operators.
had an inconsistent interpretation.of the= term "as necessary" and an !
inconsistent interpretation as to whether "in conjunction with" meant to ~{
perform the actions simultaneously or in. sequence. ;
i The interviewees expressed confidence that Unit 2 operators could respond effectively to accident conditions'using the E0Ps. The team concluded that the ;
level of understanding and familiarity with the E0Ps was generally consistent .j and satisfactory. '
q
- 3. EXIT HEETING AND PERSON CONTACTED l
- On April 6,1990, the team and other NRC representatives held an exit interview l with Mr. N. S. Carns and other members of the AP&L staff. The inspection' o scope, findings, and commitments were discussed. Persons contacted by the team I are identified in Attachment E and those who' attended the exit meeting are .i designated by an asterisk' preceding their name. .i The licensee did not identify as proprietary any of the material provided to or reviewed by the team during this inspection.
i t
t
ATTACH _ MENT A TECHNICAL ADEQUACY DEFICIENCIES Supplemental information from the technical adequacy review of the Arkansas '
Nuclear One, Unit 2 (ANO-2) emergency operating procedures (EOPs) and other .
supporting procedures is-provided herein. The licensee agreed that these i k comments were valid and committed te resolve the specific items.
i 2202.01 Emeroency Operating Procedure
.i The priority check of safety functions was different between Sections 2.0, i "Immediate Actions," and 3.0, " Recovery Actions for Reactor Trip," of this 2l procedure and both the Combustion Engineering Owner's Group generic s J '
guidelines (CEN-152) Land the AN0 E0P technical; guidelines (e.g... reactor 1 coolant system (RCS) pressure control was checked,before inventory' control and i RCS heat removal was checked before core heat removal). .
To address the issue of instrument error in a harsh containment environment properly, caution statements should be added for appropriate-use of all important instruments to address the effect on the instrument indication.during i harsh environment conditions or instrumentation safety margins should be 1 incorporated in the E0Ps.
The use of auxiliary, spray was inconsistent throughout the E0Ps and the abnormal operating procedures (A0Ps). OP 2103.05, " Pressurizer Operations,"
addressed several concerns that needed to be considered in other procedures- !
(e.g., the temperature differential limit between spray water and pressurizer and qualification temperatures should have been specified as 275 F for the auxiliary spray line. The criterion for:using auxiliary spray needed to be consistent throughout the procedures to ensure that the use of auxiliary spray was properly evaluated and analyzed-after the termination of the event,
, The Emergency Procedure Technical Guidelines (Revision 2) were not periodically assessed as.a living document should be. Supposedly, this document was to'be reviewed each-time a revision to an E0P procedure was made but there was no 4 assurance that this review was done. -In addition, this document, which should 1 have been a good training tool, was not available to the training department.
Step 3.3.3.of this procedure directed the operators to " crack" open both spray valves when using auxiliary spray to provide " finer" pressure control.
However, the E0Ps did not include this guidance.
The use of RCS temperature indication was not sufficiently explained for monitoring the subcooling margin and natural circulation. The E0Ps should'have indicated the specific instrument to be used to determine the temperature difference between core exit thermocouples and RCS hot-leg resistance
-temperature detectors. Further, the E0Ps should have specified the temperature differences that indicated a loss of normal circulation, v
^
t
, e C 6 Procedures should have given instructions-to verify operation of the containment recirculation fan (CRF) by monitoring the containment cooling actuation signal. Running the CRF could reduce the possibility of concentrated combustible hydrogen gas spots forming if. hydrogen gas generation occurred.-
The E0Ps should have contained additional guidance for resetting the safety-injection actuation signal-(SIAS) and the main steam isolation signal (MSIS) if l
- associated parameters were below their respective. set points. InstructionsL were needed to ensure that these instruments- could have been reset in a timely manner even if instrumentation and control technicians could not be dispatched :
to perform the task. '
Instructions contained in various parts of the'EOPs (under tabs) were not I adequate to monitor activity levels in the steam generator to ensure that'a tube rupture had not been misdiagnosed or had not occurred concurrently with another accident. y Step 3.4.1.A of Procedure 2202.01 needed more detail'to explain what-conditions
- would merit a reduction in plant pressure to make HPSI available. The step also needed a caution statement to ; alert operators to other actions that accompanied pressure reduction _(e,g., reducing the engineered safety features .
low pressure set point to prevent inadvertent actuation).
Step 3.5.3 showed a set point of 23 percent for the emergency feedwater actuation signal. The correct set point should have been 25 percent (i.e., the same as the low SG level set point for an automatic reactor trip).
Step 4.1.2 had not been revised to include activation of the diverse scram system that had been installed daring the 2R7 refueling outage (DCP 85-2073).
Section 6.0 did not explain that manual initiation of vital _ loads to the buses could cause lockout conditions, which would require resetting the control
~
1 switch (i.e., pull-to-lock to reset). The E0Ps did not address problems associated with antipump circuitry (IN 88-75) for vital loads.
The caution statement preceding Step 6.1.1 directed the operator to monitor emergency diesel generator ~(EDG) temperatures closely in the event that the service water bus did not energize. However, no guidance was given to indicate how long the diesel generators could run without service water or at what temperature they should be shut down. ;
Step 6.1.2 did not contain a caution statement or note to the operator-to watch for undervoltage conditions when loads were being returned to the bus.
Step 6,9.6 directed the operator to start Pumps 2P9A or 2P98. This action assumed that Bus Al was energized and no contingency was provided if it was not.
Step 6.3.5 directed the operator to verify RCS heat removal by one of three methods. This action should have been stated as a contingency and the preferred method should have been specified.
e
B 4, ,-
The overcooling tab should have recognized T-ave as less than 540 F and should have given a broader temperature range as acceptable so that there could be no question if heatup was required.
Steps 8.3.3 and 9.2,1 should have provided guidance with regard to seal !
temperature to control opening the cooling water isolation valves to limit '
thermal shock to the mechanical seals of the reactor coolant pumps.
Another step (Step 8.12.2) should have been added to direct operators to {
locally operate the atmospheric dump valve (ADV) in order to address RCS heat ! \
removal during a steam line break or station blackout. , ,
Steps should have been added between the two "go to" statements after :
Steps 8.6.3 and 8.7.1 to identify the affected steam generator. '
Steps 8.9.1.H, I, and J gave detailed instructions to verify that service _
i water (SW) was available to the EDG while Step 3.2.3.A.4 stated only to." verify SW available." The E0P procedures should have been consistent in verifying-that components were operable. l Step 8.12-gave instructions to use ADVs if instrument air (IA) was not available, but Step 7.2.1.C did not provide instructions if'the IA was lost.
4 Step 8.5.1.A did not direct the operators to close the steam isolation valve to the turbine-driven emergency feedwater (EFW) pump from the steam generator (SG) if a tube rupture occurred concurrent with an upstream main stem line break (MSLB). Without the steam isolation valve closed. a check valve would be the only barrier to prevent an offsite release through the turbine-driven emergency feedwater (TDEFW) exhaust. Subsequent action in the procedure- ;
directed a partial isolation of the af fected SG; however, initial isolation of '
the affected SG should have been standardized throughout the E0Ps.
The SIAS (safety injection actuation signal) tab should include pump ;
performance curves to enable the operators to verify adequate flow following initiation of the emergency core cooling system (ECCS). l Step 9.5.1 should have been followed by instructions with regard to superheated core exit thermocouples instead of directing the operator to Step 12.7 for the brief instructions.
Step 9.7.1 directed operators to use the subcooling margin (SCM) to determine throttle criteria for high pressure safety injection (HPSI). However, RCS inventory control and heat removal requirements should also have been included to secure HPSI.
Step 9.15.5 should have instructed operators to take radiation measurements and should have established criteria for accessing the shutdown tooling system. <
s
.. .t
... a,
( mi Step.9.18 required the H2 recombiner to be started within 72 ho'urs of a loss-of-coolant accident (LOCA).or if H concentration 2 reached 2 percent. However, the procedure needed to specify requirements to monitor H 2 concentration of_the containment earlier in the event to determine when the concentration reached 2 percent, q The SI S tab did not direct the operator to first start charging and HPSI. pumps for long-term cooling when the reactor coolant pumps (RCPs) were. restarted to counter possible loss of RCS inventory if RCS voiding existed at the timt of the restart. This possibility should have been addressed in the procedures to restart the RCPs.
Following Step 10.6.5, Section 10.0 incorporated son.a. but.not all, of'the imme -
diate actions of Section 2.0 and did not address all of the safety functions as in:Section 3.0. Response to a reactor trip (automatic-or normal) should have ;
been standard and consistent'throughout the E0Ps.
Step 10.1.2 directed isolation of letdown without directing operators to: assess the conditional requirements in the right-hand column. The directions in the left-hand column needed to indicate that the action was conditional, j The ICC tab directed operators to open the RCS and pressurizer (PZR) ven'ts for ECCS cooling. However, the SIAS tab gave no direction to shut these vents once an alternate cooling method was established.
Step 12.2 directed the operator to " attempt to maintain SG_ level (s) >70 incnes (WR)"
without specifying how to accomplish the desired condition.
Step 12.4.3.A directed the operator to reset the overspeed trip device on EFW Pump 2P7A, if it had tripped. Instructions should have been added directing the operators to turn down the speed controller before rusetting the device so that another trip would not be received after the reset.
l Step 12.4.3.B_ directed the operator to open steam to the EFWP Turbine 2K? valve.
l The operator first needed to verify that Supply Valves 2CV10050-1 and 2CV1000 ,
l were open. This information was not included'in the step. '
l l' Step 12.4.3 C directed the operator to " manually operate EFW Pump 2P7A turbine l l trip throttle valve locally to control-pump speed " The preference should have l- been to first attempt this from the control room and then to attempt-it locally.
only if necessary.
I Step 12.5.2 directed the operator to " verify MSIVs open" and gave equipment l- identification numbers. However, if the valves needed to be opened, there was no information given for the additional switches that should have been operated.
l Step 12.5.4 provided instructions to the operator to establish hot standby l conditions contingent with restoration of main feedwater (MFW) to the steam i- generators (SGs). The step should have directed the operator to go to Step 12.5.6 if MFW could not be restored. There were a significant number of steps following Step 12.5.4 that were not applicable if MFW was,not restored.
1
' 4-I
n, n.,
o .,
Steps 12.8.5.B and C should have provided the minimum combination of valves that needed to be opened to satisfy the intent of the steps, unless all of the valves needed to be opened to establish adequate vent paths. !
At the end of the ICC tab, the "go to" statement. instructed operators to "go to" the SIAS tab after ECCS vent valves were closed._ However, the actual procedure gcVe contingencies to open other valves if the ECCS valves could not g be opened. The "go to" statement should have included the opening of the other :
4 valves as an alternative condition, j The narrow focus.of the "go to" statement-before Step 12.1 made it necessary '
for_the operators to go through with the recovery actions of Steps 12.1 through 12.6 t'efore going to Step 12.8.- The recoverability of feedwater would have been known to the operator when they enter Section 12.0 and an immediate q transition to 12.8 may have been warranted.
2203.13 Natural-Circulation Cooldown The procedure did nnt lend itself to use during abnormal conditions - i (i.e. , conditions other than when the only problem was loss of offsite~ power.) '
Guidance for use during cooldown= af ter a small-break loss-of-coolant accident (SBLOCA), when requirements for restarting RCPs could not be met, t needed to be provided. Also during certain conditions, voiding in the upper i head may not have been preventable or correctable but cooldown needed to proceed. Guidance for natural' circulation (NC) cooldown with RCS voiding are needed.
Upper head temperature and reactor vessel level were availabic on the safety parameter display system (SPDS) and should have been included as an alternate method to ensure that head voiding was prevented during NC cooldown.
Steps 4.10 and 4.14 and their associated caution statements were used to reduce MSIS and SIAS set points, and were not in'the correct location. The caution statements come after the steps directing the SG and RCS pressure to be reduced.
The operator should have been cautioned to monitor condensate storage tank (CST) level before Step 4.12. Spitching to the other CST would have taken too long if the operator waited until the low suction pressure alarm was received, if the transfer were necessary,. it should have been done at some minimum level in the CST to prevent a transfer to SW.
The note at the bnttom of page 6 of 9 contained instructions.to operate the llPSI pumps. Whereas the writers guide specifically stated that action steps should not be contained in a note.
The pressure-temperature curve in Attachment A of the procedure was not legible, and the procedure needed a better reproduction. ,
'p '
2203.14 Alternate Shutdown In Step 11, Section.I, the control room supervisor (CRS) should not have been instructed to_close the breaker for 2P4A (SW pump) if the "B" SW pump was loaded on that bus. '
In Step'12,Section I, the CRS should not have been instructed to open the.
breaker for 2P4B if the SW pump on that bus was operating. The motor-driven EFW pump should not have been stopped until the turbine-driven EFW pump had been verified to be running.
Step 13,Section I, for safe shutdown provided no contingency steps if NC'could. !
not be verified.
For Steps 13 and 14, the above comments with regard to breaker position would ,
apply for the "B" and "C" SW pumps in . lieu of the combination of "A" and "B" SW pumps.
Step.24,Section I, directed the shift senior reactor operator t0 place the -
inverters on normal ac to reduce battery loads but no instruction was given on .
how to' accomplish this action. 1 Step 16,Section I, did not provide instructions to the reactor ';
operator (R0 No.1) for coordinating electrical alignment per Attachments 1 and 3. This action needed to be completed before continuing with the procedure. This comment also applied for R0 No. 2 in Step 16,Section I.-
2203.30 Remote Shutdown The procedure did not provide instructions for the operator to obtain radios in the alternate S/0 locker, The radios'would have provided the best communications for operators out in the plant.
Immediate Actions 2.3, 2.4, and 2.5 provided instructions for positioning Valves CV-5091 and CV-5093 in the shutdown (S/0) cooling position, but no additional actions were given for positioning these velves if the immediate action could not be completed.
Step 3.3.3 required use of auxiliary' spray if pressurizer pressure remained high, but did not contain the. detailed instructions that were included in the E0P/A0Ps for-the use of auxiliary spray.
Steps 3.6.1 and 3.6.2, and Attachment 1,' Step 2.0, secured the air to the SG blowdown valves so they could be closed, but no instructions were given to l bloed air' to allow the valves to spring close. The existing condition would require. breaking a mechanical joint in the air line to bleed air. l The procedure lacked sufficient instruction for dealing with adverse plant parameters.
., 3
., 7 ATTACHMENT B i 1
HUMAN FACTORS DEFICIENCIES The following are examples of'the human factors deficiencies identified in the emergency operating procedures and related documents for Arkansas Nuclear-One (ANO), Unit-2.
1015.04A Procedure Writer's Guide (PWG)
Requirements for developing emergency operating procedures (EOPs) and related '
procedures, such as the abnormal operating procedures (A0Ps), were contained in several documents rather than consolidated into a single, cohesive document, i- 3 There was no statement of. scope or applicability in the AN0 PWG identifying the '
applicable procedures. At a minimum, guidance contained in this document >
should have been applied to the E0PS and any other_ procedures that must be 'used in carrying out.the tasks called for in the E0Ps.
t The introduction to the PWG stated that it was a guidance document and,'as such, did not contain definitive requirements. Furthermore, Appendix B of the PWG, which provided guidance specific to the E0Ps, stated that it was not intended to place restrictions on departures from features'of.the procedures.
Inaddition,thePWGoftenpresentedguidanceintermsof"commonlyused" -j practices, or methods that 'should be considered" by the-writer, rather than. '
specific instructions that must be followed. The PWG should have delineated specific requirements for E0P writers.
-There was no clear guidance as to acceptable sentence structure of procedural steps. Although some rules of grammar were discussed, there was.no discussion of when it was appropriate to use directive statements rather than lists of plant parameters to be. verified,_ which was commonly done -in the E0Ps.
Section I,1.0, " Format of Instructions," presented .several different formats for procedures but did not identify the specific format to be used for each type of procedure. Although Appendix B of the PWG stated that the double-column format was to be_used for E0Ps, it should have identified the acceptable format for all procedures within the scope of this document. If no other format was used, there was no need to discuss various alternatives.
Step =2.1 in the example on page 8 (Section I) contained embedded and confusing logic. The term "otherwise" was used in_ place of "if not" and it was not clear if the term was referring to plant mode or valve positions.
Step 9.36 on page 9 (Section I) was not clear with regard to what was being- I referred to by the phrase "otherwise N/A." ,
1 Section II, Step 3.3, page 7, gave examples of ccmmonly used methods of ;
printing emphasis; however, it did not provide directions on usage that would ensure a consistent approach. J
c ...
.i Section II, page 14, did~ not clearly explain the format to be used for different levels of steps. ,
Section II, Section 6.0, gave examples of terminology commonly used by operators; however,'the list was not-.all' inclusive and did not define the _ -
words. To ensure that the procedures used consistent terminology and that there was no ambiguity in the meaning of words, an all inclusive list of approved terms' and their definitions should _have been provided.
Section III, page 6,_ directed the writer to " select a preferred method for presenting conditional instructions." The PWG should have given the preferred (required) format for the procedures, such as underlining or capitalization.
This section should have also warned against the highlighting of "and" ~and "or"'
when they were used as simple conjunctives.
Section III, page 10, should have described ~a " complete" reference- .
i
-(i.e., procedure title, number, step number, page number). It should have-given a specific format for references. The examples on page 11 showed two _,
different styles. The_same concern applied.to branching. 3 Attachment B was unacceptable because it to simply directed the procedure ,
writer to study the conventions that were used in different procedures rather i than specifying how:an E0P should be written. :Therefore, dif forent styles could be used by different writers.
In addition, the organization of the E0Ps was significantly different from the i overall organization described in the PWG. Mere details needed to be provided '
regarding the format of E0Ps.
2202.01 Emergency Operation Proceduu:
The following. types of problems were found with the structure and wording _of ,
logic statements in AN0's E0Ps. ,
The initiating condition was presented after the contingent action. For i example, "EDGs should be secured if . . . ." Improper structure such as -
this could have resulted in the initiating condition being overlooked and inadvertent performance 'of the contingent action- .
Logic terms were improperly used. For_ example, transitions to tabs use an implied "then" as in an "if/then"-type statement. There were also instances where statements began with the term "if" but provided no contingent action following the statement of the condition. For example, "if SU #2 is available."
Inconsistent and incorrect highlighting of logic terms was used.
Sometimes "if" was capitalized and underlined; sometimes it was not. In- i transitions, neither "if" nor "and" was underlined. The terms "and" and "or" were often highlighted.as logic terms when in fact they were being used as simple conjunctions.
'c- 1 LLogic terms were used unnecessarily.. The term "and" was needlessly placed between substeps that listed equipment"to be operated.- The-term "or" was. p needlessly used to separate alternate."if/then" conditional statements. '
"then":was. incorrectly used to run two action statements together.
Embedded and confusing logic statements were used. _"and" and "or"~were of ten used in combinations making it difficult to determine the true. 4 r meaning of the step. "If/then" statements were contained as subste'ps to "if/then" statements. x Step 3.6.1.A.1 should have specified the normal range on RCP differential pressure. ;
Numerous incomplete conditional statements were found.for which impliedi logic , !
terms were.used. The transitions to tabs used an implied "then" in=an i "if/then-type" statement. Examples were'found in Steps 3.2.3; 3.3.2, 3.3.3, and 3.4.1.
In Step 3.4.2, B, the word "then" was in' correctly highlighted as a logic term !
when it was used to.run two action statements-_together. Another example of..
this type of problem was found in the left-hand column of Step 3.6.1 B.
Contingency' an "and/or combination making it difficult to determine the true meaning, transitio Step 3.8.7. A LHC provided the contingency action to secure steam-driven EFW Pump 2P7A before stating thetcondition "if EFW Pump 2P78 is operating properly."
Step 4.13 provided no details on the use of auxiliary spray, as' was the case in other parts of the procedure. 1 Step 8.6 directed the operator to isolate an upstream rupture However, the !
step directed the operator to verify that the upstream atmospheric-dump valve or the block valves were closed rather than specifying both had to be closed.
Step 8.9.2.E required verification of " normal" containment spray flow but provided no parameters to define " normal." p Step 9.2.4shouldhaveincludedtagnumbersfortheclosedcoolingwater(CCW).
surge tank level indicators.
Step 9.4.3.E directed the operator to . verify that containment spray flow.was l- " proper" while the MSIS step directed the-operator to verify that the flow was g L " normal." Both steps should have_given values for_ normal and proper flows.-
u -
3 Stop 9.6.8.C and Step 8.17.2.A did not provide detailed instructions for
-resetting MSIS.
1 o
3
- = , ;
+
Step 9.7.1.B-was not'well defined. It was not clear if it was" for total flow f or flow per header. 1 i
Steps 9.11.1' A, B, and C should have clearly stated that the A, B,' an'd C steps
- were "or" requirements ~ so that the operatcr could not mistake them for "and" requirements.
If.the conditions of the "go to"istotement-following Step 11.1.2 were met, the operator was-directed to perform Section 4.0, " Emergency Reactivity Control,"
in' conjunction with section 11.0, If success was achieved by completing- .
Step 4.1.2, another "go to" statement directed the operator to Step 3.2-ofLthe '
Reactor Trip Recovery tab. 'It was _not clear if the operator was then to - 3 perform Section 3.0 from Step 3.2 in conjunction with Section 11.0 or to.-
proceed with Section'11.0 only. A i.imilar problem existed with regard to: 3 performing Section 12.0 in conjunction with 11.0 following Step 11.16.4; ,
Anumberofsteps(11.2,11.5,11.7)intheproceduredirectedtheoperatorto, take actions if the SIAS were actuated.- liowever, other steps, not. dependent on SIAS actuation, were placed between the SIAS. steps rather than grouping SIAS
' a steps together.
It also was not clear in this procedure if the operator should return to a related step for an SIAS actuation _that occurs after he had already passed that step.
Step 11.4 for RCS pressure control. began the process of controlled-depressurization. At the.very end of this high-level. step, the operator was directed to reset SIAS set point if the SIAS did not actuate. This,information '
should have been presented before directions to depressurize if the intent was :
to prevent SIAS actuation during depressurization. ,
The caution statement following Step 11.13.1 was actually a continuous action step requiring the monitoring of RCS margin to saturation throughout the procedure. - There was no method of reminding the operator of this ongoing need.
A;"go to" statement should have followed Step 11.11.4 directing the operator to go to Step 11.13 if the RCPs were running. This would have ensured that the operator did not waste time reading or becoming confused by Step 11.12,lwhich 1 was only applicable if RCPs were not running.
~
l Step 11.11 required continuous.or frequent observation of the affected SG
' level; however, the operator was not directed to revisit this requirement once ,
he moved.on'in-the procedure.
Step 11.6.1 directed the operator to verify proper operation of EFW Pump 2P7B. !
Step 11.6.2 directed the operator to secure EFW Pump 2P7A. However,-there was no indication that-Step 11.6.2 was contingent on the verification of 2P7B.
Also, no quantitative measures were provided.
1
.t l
-=
7 ,
1
.- 4
. -Step 12.6.10 contained vague wording regarding the indications to be used to !
confirm the availability:of the steam dump bypass control system. l The note following Step 12.6.11 was stated differently than the caution statement following Step 12.3 although the intent of the two statements was tho ,
same.
Step 12.6.14 should have indicated the control mechanism by which the operator.
was to maintain SG pressure.
Step 12.6.15 contained vague directions to " slowly" restore S/G level (s).
There appeared to be no condition that required the performance of Step 12.7. ;
If success was achieved by the end of Step 12.6.15, the operator was directed j to Step 3.5; if not (e.g., no feed),-the operator was directed to Step 12.8' j
-I The procedures required numerous calculations to be performed by the operators. 1 Graphs or other aids should have been provided for steps requiring- !
calculations, such as determining condensate inventory to perform natural ;
circulation. ~
l ;
2203.13 Natural Circulation Cooldown t
The second sentence in the note preceding Step 4.1.4 was worded poorly.
Neither the intent of the information nor the information itself was clear.
1 The note preceding Step 4.1.7 contained instructions for action steps-such as- ;
' disable HPSI Pump." It used the term " disable" which was not common to.other steps.
j Step 4.18.1 did not include the descriptive names 01 valves as did other i procedures.
1 2203.30 Remote Shutdown !
In the followup' action for this procedure, Step Numbers 3.1, 3.2, 3.3, 3.4, and 3.5 were repeated and used.for actions unrelated to those in the' steps'with
- the same numbers in the proceduro. This could have caused confusion, especially when communicating over the telephone or radio.
i
=,
ATTACHMENT C CONTROL ROOM AND PLANT WALKTHROIJGH OEFICIENCIES ,
ThE following are examples of_ deficiencies identified during control room and j plant walkthroughs of E0Ps- and related procedures, i 2202.01 Emercency Operating Procedure I
- 3.0 Recovery Action's for Reactor Trip
~The set points on the radiation ' monitors _c'alled for in Section 3.0 were handwritten on the indicators with a marker.' The labeling should have been ,
better controlled. '
. t Under, symptoms of-SG tube rupture (Tab 3.0), 2K10 should have been 2K11. Also, in Items B-D, the 2RE-numbers should have been 2RITS-numbers. !
Step 3.33 should have provided additional detail or should have referred to the appropriate operational' procedure for use of auxiliary spray. ,
Steps 3.2.1 and 3.2.2, page 4, should have listed _the component numbers, i Step 3.4.3, page 7, the 2RE numbers should have been 2RITS numbers, l Steps 4.1.2.A and B needed to be corrected to match plant labeling (2B712 "y
should have been LC-2B7 52-712 and 2B812 should have been LC-288 52-812).
Step'4.20 required certain valves to be deenergized; however, tags were'needed !
on the breakers-to provide'information to alert the operator to have power _ !
returned to the valves after tags wer removed and before the valves were shut. ;
y Breaker designations in the procedure were not the same as those on the control board (e.g., Step 5.1.2.A used 2A309 and 2A409 while the control board had 152-309 and 152-409, respectively;-or Step 5.1.2.C.] us.n' 2A301 and 2B572 while the control board had 152-301 and 52-572, respectiv/.v).
Step 5.13.1 used the breaker designation 52-112 while the designation on the i local panel was 2-112.
Step 6.3.5 directed the operator to locally operate the ADV upstream isolation valves to control pressure. In the_ walkthrough of this step, the operator had to step over a large gap in the grating that was directly on the other side of a steam line_that had to be crossed. The valve station was approximately 20 feet above the floor. It was noted that this condition posed a safety hazard especially in degraded lighting situations.
4
$ i n r
i 4, . .
e .
Step 9.4.'2 directed operators to check for.CIAS indication at valves that were on Panels 2016'and 2017 but there were additional CIAS valves in Appendix C that would not have been checked in this ;tep. '
~ Step 11.11.1 directed the operator to reduce blowdown by locally throttling the -l SG blowdown isolation valve on the affected SG. The operator reported, '
however, that flow control-for the drag valves was available in the control
^
. room, which would be the preferred method of reducing blowdown.. There was no procedural step to cover this even hough controls had been available in-the control room since November 1989.- Upon further investigation, plant management 1
' indicated.that these controls were not reliable and therefore were not l referenced. Either the controls should be. referenced in the E0P or tagged out as nonfunctioning.
Step 12.4.3.0 directed the operator to,open steam to the EFW pump turbine 2K3 valve. However, the operator reported that he would first need:to verify that supply Valves 2CV10050-1 and 2CV1000 were open. This'information was not
.provided in the step. 4 Step 12.4.3.C directed the operator to '! manually operate EFW pump (2P7A) turbine trip throttle valvo locally to control pump speed." Besides being poorly worded, the preference should have been to attempt this action from the control room.
Step 12.2 directed the operator to " attempt to maintain SG 1evel(s)
>70 inches (WR)." The step was very vague about how to accomplish the desired condition. The operator was not sure what the step was specifically requiring. ,
He thought it might be a determination made on the spot and,that the general information might be applied to subsequent steps, .t Step 12.5.3.0. required the operator to determine if an alarm had occurred as an ;
initiating condition for the operator to take some action. Identification of the. specific annunciator window (e.g.., 2K9, 83) in the procedure would have served as an aid to the' operator in assessing the alarm status. During the .l walkdowns, the operators confirmed that they would have found this information useful.
Step 12.5.2 directed the operator to " verify MSIVs open" and gave equipment l identification numbers. However, if the valves needed to be opened, there were
'- additional switches that needed to be opened that were not. indicated in the 1 procedure.
l In-Step'12.6.2 the operator assisting in the walkdown indicated that if.no l condensate pumps were running, the discharge valve for the pump to be started ;
would have to be throttled shut to prevent run out and possib1_e< system damage .
resulting from' water slugging. If this was correct, the step should have l directed the throttling of the discharge valve on pump-start. A caution- l statement would also have been appropriate. 1 Step 12.6.12 required a measurement of. flow.-lHowever, the operators said that' I no instrument could register. flow in this-condition, and they would have to '
-rely on a change in the SG level. The step did not reflect this.
Steps 12.8.5.B and C required a number of valves to be opened; however, according to the assisting operator,: not all of the valves needed to be opened ,
to establish an adequate vent path. The steps should have identified the
~
minimum combination that would satisfy the intent of the steps.
2203.14-Alternato Shutdown
- Step 7,Section I [for reactor operator (RO) No.1), required the R0 to i throttle 2P-7A (turbine EFW pump) inlet steam valve until the valve was full open and the pump discharge pressure had decreased slightly. Discharge pressure' indication, however, was in the opposite corner ~of room (not visible fr9m inlet valve) and the room had only two small de lights. . This' would have .
mado iJ.a ink very difficult to perform, especially with limited. lighting. In ,
the sa:n'a section, the RO needed to restart / reset 2P-7A if it tripped, but the instructions did not require the R0 to throttle 2P-7A after it was reset.
Step 16,Section I (RO No.1), contained no instructions to verify that electrical alignments, per Attachments 1 and 3,'had been completed before continuing with the procedure. Additional coordination wording was needed.
The same concern applied to Step 16,Section I (R0 No. 2).
The lighting in the'2P-78 (motor EFW pump) room was poor.
In Attachment 9, Step 1B,. should have had an "and". statement instead of "or "
i Step 24,Section I (for CRS), directed 1the shif t senior reactor operator (SSRO) to place the inverter on normal ac power to reduce battery loads, but no 1 instructions were given on_how to accomplish this task, t No alternate shutdown label plate existed on CBs 2852-B5 and'2862-85, l l
2203.30 Remote Shutdown.
1 i- Attachment 1, Step 2.0, directed the operator to close SG blowdown. valves by i securing the air to the valve operators, but'there was no petcock on thn I
equipment or instructions to bleedoff the air, t Attachment 2 gave duties for " Assistant Plant Operator," but this was not a well known title for any of-the operators'.
The remote features in the remote shutdown SD panel should have been tested periodically to ensure that the' control functions worked.
o ,
ATTACHMENT D SIMULATORANDE0PTRAININGSCEN3RIOSANDDEFICIENCIES The first scenario was conducted using the "B" crew and evaluated operations under the following conditions: 100 percent power, a reactor coolant j
-system (RCS) leak (1000 gpm), failure of one high pressure safety- ,
injection (HPSI) pump, the safety parameter display system (SPDS) stopsL updatirq. and a spurious alarm of the steam line radiation' monitor. The following observations were noted: 1 The operators required about 15 minutes to realize that'the SPDS was not updating. The' operators should not have " locked in" to one instrument'or '
display. More frequent comparison of SPDS to other instruments would-have led to earlier recognition of the failure. The E0P did not generally instruct the operator to look at any particular instrument to' assess the ;
effect of recovery actions.
The recovery._ stopped when natural circulation (NC) cooldown could not be performed because of an insufficient subcooling margin.- The E0P did not '
give specific guidance for' continued recovery using NC cooldown, and A0P 2203.13 required a 50 F subcooling margin, which could not be attained.
The second scenario conducted with the."B" crew evaluated operation.under the following conditions: 100 percent power and equipment out of' service included ,
low pressure safety injection (LPSI) Pump 2P60A, steam generator (SG) radiation: ,
monitor for the unaffected SG, and one of'the offsite sources to the 161-kV ring bus. The initiating event was a steam line break inside the containment followed by a tube r'upture in the same SG. .The following observations.were noted:-
Recovery was attempted using Section 8.0, MSIS, which did not assess
! indications for tube rupture to allow transition to Sections .10.0 or 11.0.
Isolation of the affected SG was directed by Section 8.0 and was not . ,
i- consistent with Appendix K of the E0P, which resulted in a release path j through turbine-driven emergency feedwater (TDEFW) Pump 2P7A,- and exhaust l being blocked only by a check valve. The direction'at the end of i Step 8.5.1 contributed to this condition.
L The recovery was stopped because pressurizer level and pressure could not l.
be restored as required by Steps 8.13 and 8.14. In this situation, l increasing RCS pressure would have been contrar; to the preferred recovery course for a steam-generator' tube rupture (SGTR).
l The third scenario was conducted with the "F" crew and evaluated operations
- l. under the following conditions: 20 percent power, steam geaerator tube rupture (SGTR) flow < coolant charging pump (CCP) flow in "B" SG; after the trip,.SGTR i
flow' <CCP flow in "A" SG with total SGTR flow >CCP flow; SPDS, stopped-updating 1 during recovery. The following observations were noted: [
Recovery proceeded to the directions in the left-hand column of Step 10.1.2 at' which time the shift senior. reactor operator (SSR0) ordered letdown isolated. Assessment of the conditional requirements in the- .!
right-hand column would have indicated that letdown isolation was-unnecessary. Inadequate wording in the lef t-hand column contributed to the unnecessary action.
?
After Step 10.6.5 directed a manual reactor trip, Steps 10.7 and 10.8 directed a partial verification of reactor trip response.- This was j
inconsistent with normal verification of-a reactor trip or protection response to an E0P entry condition, one of which is manual, trip. This i inconsistency created some confusion for the operators. 1 Tripping the reactor at Step.10.6.5 sub,iected-the plant to an unnecessary j transient if it was not warranted by other degraded or accident '
conditions. i The fourth scenario was conducted with the "F" crew and evaluated _ operations -
under the following conditions: 100-percent power, equipment out of service included Diesel Generator 2DG-1, loss of offsite power, turbine' driven- ;
emergency feedwater pump (TDEFWP) 2P7A failed after starting, 2DG-2 trips if it was cross connected to power motor driven emergency feedwater pump (MDEFWP) -
2P7B or when HPI was started for the emergency core cooling system-(ECCS) cooling. Diesel Generator 2DG-2 was recoverable to support ECCS cooling. The i j
following observations were noted:
al The wording in the "go to" statement prior to Step 12.1 influenced the crew to assess Steps 12,1 through 12.'6 before transitioning_to Step 12.8.
The restorability of feed water was known to be on the order of_ hours,at i the time the transition to Section 12.0 was made. This should have {
resulted in going directly to Step 12.8. Delays were further incurred because the crew needed some interpretation on how to use the.EPP-as written. These combined delays allowed RCS pressure to rise to the point of lif ting the pressurizer relief valves several times. '
1 The fifth scenario was conducted with the "F" crew and evaluated operatrion !
under the following conditions: 100 percent power, instrument Bus 2Y1 deenergized, shif t' supervisor injured in: plant, the steam dump and bypass 3 control system (50BCS) valve failed open during' recovery (blockable). The l following observations were noted:
The crew formulated a satisfactory recovery strategy bat had to go outside l the E0P "as written" to do so..
The sixth scenario was conducted with the "F" crew and evaluated operatio'n 0
under the following conditions: '100 percent power, SGTR flow >CCP flow, blackout after trip, auxiliary operator (AO) not'available, one emergency-
.i
6 .-
diesel generator (EDG) recoverable 15 minutes after operator of the control board for the turbine (CBOT) arrived locally, offsite power restored 30 minutes after the trip. The following observations were noted:
No specific guidance appeared to be available in the E0P or elsewhere as
~
to when to send control room operators out to perform local operations during accident recovery. The blackout persisted for about 20 minutes with no response from the A0 before-the CB0T was sent out to attempt recovery of the EDG.
The shift supervisor considered a recovery strategy involving reverse flow through the ruptured tube. The E0P did not address reverse flow either from the deboration aspect or as an alternate interim recovery action. ';
Further, the simulator did not model the reverse flow condition.
The seventh. scenario was conducted.with the "B" crew and evaluated operations t
under the following conditions: 100 percent power, equipment out of service included 2P7B (MDEFWP);' loss of 2026 de bus, main feed line rupture, and the !
CBOT passed out during recovery. The.following observations were noted:
_The shift supervisor (SS)', while functioning as the-shift SRO. used the E0P in a somewhat cursory manner while directing recovery actions. The SS commented to a lack of familiarity with the contents of the.EOP and impl10d that he was apt to rely on his own. diagnostic skills and plant knowledge to determine a recovery course. 'This type of behavior placed.
heavy reliance-on training to maintain these high-level individual skills. ;
The E0P maie no provision for terminating ECCS cooling once- EFW bad been restored.
d Steps-12.5.1 and 12.6.1 directed the-main steam' isolation signals (MSIS)
to be reset. Step 8.17.4.B directed that instrument and' control ~ (I&C) technicians were to reset MSIS if SG pressure was less than the MSIS set < '
point. The crew indicated that this should have been within the i capability of shift operators and suggested that a plaque tue installed to direct operators on how to reset MSIS. Generally, any~ action required by the E0P should have been within the capabilities of the shift operators.
The eighth scenario was conducted with the "B" crew and evaluated operations L under the following conditions: 20 percent-power, equipment out of service included 2P7B (MDEFWP), SGTR flow >CCP flow capacity (60 gpm), manual reactor
! trip button failed to function, three_ control element assemblies (CEAs) ,
l stuck-out once power was interrupted. After the trip, component cooling '
- . water (CCW) isolation to-the RCPs failed shut but could be opened manually l (af ter 5 minutes), 3 minutes af ter the loss of CCW, a RCP seal package failed producing a RCS leak (300 gpm). Coolant-charging Pump 2P36C failed to start on
' demand. The following observations were noted:
l The' crew did not recognize the extent of the stuck condition'of the CEAs l and did not implement Section 4.0, reactivity control. This was partially l
l l L l
~* a i.
because of rod insertion. display-immediately available,at the time-of~
immediate action response appeared marginally adequate.
The E0Ps did not
-specify the instrumentation to be checked for the verification of plant-conditions after a trip in many cases, one of which was CEA' position. -The use of other available displays would have reduced the likelihood.of the !
oversight.
- The E0P did not identify all means available in the control room.to !
interrupt power to the CEAs. The crew used the diverse scram button which '
was not identified in the E0Ps.
The above noted deficiencies and others discussed in Sections 2,1, 2.2 and' Attachment A of this report were indicative of a failure to-establish- '
f appropriate plant procedures. 14s such, when considered in the aggregate, the examples constituted an apparent' violation (368/9001-01).of NRC requirements, (i.e., failure to establish and maintain appropriate plant procedures).-
-f t '
1 i
t t
4 L
. ,- -[
.c ...
ATTACHMENT E PERSONS CONTACTED AND EXIT MEETING' ATTENDEE 0 Those persons whose names are preceded by an asterisk attended the exit meet.ing on April 6, 1990.
AP&L personnel: ,
- N.S. Carns, Vice President, Nuclear
- J.W. Yelverton, Director, Nuclear Operations l
- R.A. Fenech,-Plant Manager, Unit 2
- J,0. Vandergrift, Plant Manager, Unit 1 !
- R.K. Edington, Operations Manager, Unit 2
- E.C.- Ewing, General Manager, Technical Support and Assessment
- L.W.' Humphrey, General Manager, Nuclear Quality
- J.J. Fisicaro, Licensing Manager.
- R.J. ' King, Supervisor, Plant Licensing ;
- C, Anderson,. Superintendent, Nuclear Operations Standards '
- R.D. McBride, Operations Standards 1
- W. Perks, Manager, Nuclear Operations Standards
- E. Force, Manager, Training and Emergency Planning P. Crossland, Training Supervisor, Unit 2 -
- H. Chisum, Assistant Operating Manager, Unit 2 <
"J. D. Jacks, Nuclear Safety and Licensing Specialist J. Williams,-Reactor Operator, Unit 2 R. Modjerich, Reactor Operator, Unit 2 M. Wright, Reactor Operator, Unit 2 R. Golden, Shif t Supervisor, Senior Reactor Operator, Unit 2 l D. Bice, Shif t Senior Reactor Operator, Unit 2 :
L. McLerron, Shift Supervisor, Senior Reactor Operator, Unit 2 R. Carter, Shift Senior Reactor Operator, Unit 2 T. Walfer, Reactor Operator, Unit 2 R. Swanson, Reactor Operator, Unit 2 A. Culver, Operations Trainer, Unit 2 Simulator D. Miller, Nuclear Safety and Licensing Specialist D. Smith, Supervisor, Simulator Training 1 L. McCarty, Shif t Senior Reactor Operator, Unit 2 ,
R. Myers, Waste Control Operator,-Unit 2 '
K. Fancher, Reactor Operator, Unit 2 i R. Donet, QA Superintendent L. McClure, OA Inspector G. King, Operations Instructor, Unit 2 C. Reed, Shift Supervisor, Unit 2 l R. Pierce, Senior Reactor Operator, Unit 2 G. Burghardt, Auxiliary Operator, Unit 2 F. Forest, Reactor Operator, Unit 2 J. Sutterfield, Shift Senior Reactor Operator,' Unit 2
l, = ; ,;.
.. t., ;<= -
.j- ,
v;x .. :. .,'
t c,1 ..
g S.
,1
~
D' Mason,i ReactorT 0perator;-Unit'21 s 20.! Reed, Waste Control Operator, Unit'2- -
- T.i Russell,- Operations' Standards" Superintendent. L 11 t 2 -
-NRC-Persondel: '
'*L.J. Callan, Director,IDivision of ReactortSafoy
~*C, Warren, Senior-Resident Inspector
- R.' Haag, Res.ident Inspector-:
l g
s b-f
_ l i
a
(
s e
4 4
l A
'Y! F
- l --
e: ,
- e >*.
. s E
ATTACHMENT F 2 DOCUMENTS REVIEWED
-l Procedure Number Revision Title 1010.03 4 STA Duties & Responsibilities 1015.04A- AN0 Operations Procedure Writer's Guide 1015.11 5 Operation Department Procedure-Revision Control 2102.06' 12 Reactor Trip Recovery 7
.f f 2104.36 31 EDG Operation 2105.17 10 Diverse Scram System Operation 2202.01 8 Emergency Operating Procedure 2203.13 4 Natural Circulation Cooldown !
2203.14 0 Alternate Shutdown 2203.17 2 Moderator Dilu, tion 2203.18 0 Inadvertent Safety Injection Actuation i
2203,21 1 Loss of Instrument Air i
2203.25 4 Reactor Coolant Pump Emergencies _ ,
2203.28 2 Pressurizer System Failures l 2203.30 3- Remote Shutdown l
L 2203.32 4 Emergency Boration 6030.01 8 Installation Plah QAP-8 5 Quality Assurance Procedure-Plant Operations 2 Unit 2 Emergency Operating Procedure Technical Guidelines , 1 ES-2-001,2,4,6,7,8 0 Examination Scenario Description !
l AA-22109-000, i g AA-62002-008 2 Abnormal / Emergency Operations Lesson Plans l-l.
1
- . .., .+ .
i .
o j' .*. ,
'In' addition to the above reviewed documents ,. additional observations cited !
during the E0P inspection but not'necessarily elaborated on in the. inspection- l
- rep 0rt were captured and responded'.to by the licensee through the use of a !
- i. computer data base entitled, "ANO-2, 1990 NRC Audit of~the .!
j
. E0P-Question / Resolution Tracking," dated April 5.-1990. g di i
f i
, l
~
u
~
s.. ,
l
~_ , ;
'l l
)
' :j l
4
.\ s i
I voi , - _
s l* y f v i t
k l
j .. 1 e
~f k :'
o l . i.
2- 1 I
.y jJ .-y
' 3 t
.~n.> ?
n /[
S-?! , '
4 .,.,._-__ _ , . . - , . _ _ , _ . . _ . - .
- . - - - - - . - . - - . - - - , . - -. J'
- e '
4 O
s ATTACHMENT G LIST OF ACRONYMS ac Alternating Current ADV Atmospheric Dump Valve ANO Arkansas Nuclear One ANO-1 Arkansas Nuclear One, Unit 1 ANO-2 Arkansas Nuclear One, Unit 2 ANO PWG Arkansas Nuclear One Procedure Writer's Guide A0 Auxiliary Operator AOP Abnormal Operating Procedure AP&L Arkansas Power & Light Company CBOT Control Board Operator for the Turbine CCW Component Cooling Water CCP Coolant Charging Pump CE Combustion Engineering CEA Control Element Assembly CET Core Exit Thermocouples CFR Code of Federal Regulations CIAS Containment Isolation Actuation Signal CRF Containment Recirculation Fan l CRS Control Room Supervisor CST Condensate Storage Tank i
DC Direct Current '
ECCS Emergency Core Cooling System !
EDG Emergency Diesel Generator EFAS Emergency Feed Actuation Signal' EFW(P) Emergency Feedwater E0Ps Emergency Operating Procedures !
ESF Engineered Safety features HPSI High Pressure Safety Injection IA Instrument Air I&C Instrumentation and Control ICC Inadequate Core Cooling IHP0 Institute of Nuclear Power Operations ;
LHC Left-Hand Column 3 LOCA Loss-of-Coolant Accident ;
LPSI Low Pressure Safety Injection i MFW Main Feedwater MSIS Main Steam Isolation Signal MSIV Main Steam Isolation Valve MSLB Main Steam Line Break ;
l 1
l l
- . . i
- a 4
NC . Natural Circulation
,. - ' NLQ Nonlicensed Qualified NRC Nuclear Regulatory Commission NRR Office'of Nuclear Reactor Regulation PSG Plant-Specific Guidelines PT Pressure-temperature PZR Pressurizer -
RIV Region IV RCP Reactor Coolant Pump -
RCS Reactor Coolant System RHC Right-hand Column R0 Reactor Operator- . .-
RVLMS Reactor Vessel Level Monitoring System SBLOCA- Small Break Loss-of-Coolant Accident' SCM Subcooling Margin S/D. Shutdown '
SDBC5 Steam Dump and Bypass Control System SG Steam Generator SGTR- Steam Generator Tube Rupture SIAS Safety injection Actuation Signal SIS Safety Injection System SPDS Safety Parameter Display System SS i Shift Supervisor SRO . Senior Reactor Operator SSR0- Shift Senior Reactor Operator STA Shift-Technical Advisor SW Service Water TDEFW Turbine-Driven _ Emergency feedwater TEAR Training Evaluation Action Request TI Temporary Instruction 1
IMI Three Mile. Island V&V Verification and Validation 4- N 3
r ATTACHMENT H m,n . p,,,, a Liem company
APeL =
bdA AH U6:H Tel SDI %4 31M)
- -- --- - -~
$.__@_._{M_O_N b h,
--Q .
APR 2 4 E Y'I April 20, 1990 BCAN649012 [ J i Robert A. Martin' Reigional Administrator Region lV >
611 Ryan Plaza Drive, Suite 1000 ;
Arlington, Texas 76011 t
SUBJECT:
Arkansas Nuclear One - Units 1 and 2 '
Docket Nos. 50-313/50-368 License Nos. DPR-51 and NPF-6 ;
Unit 2 E0P Inspection ~
Inspection Report 50-313/90-01; 50-368/90-01 -
Dear Mr. Martin:
I This letter is being provided as discussed during the NRC exit meeting for :
i the recent inspection of the Emergency Operating Procedure (EOP) for Arkansas
,_ Nuclear One, Unit 2 (ANO-2). Enclosed is a schedule which includes completed, l
short-term, and long-term actions to improve the E0P and address the concerns -
identified by the inspection team and by our own assessments. The schedule
, encompasses completing the self-assessment of the E0P and E0P-related l documents (e.g., the writers guide), an interim revision to the existing E0P, and the conversion of the ANO-2 E0P to conform to the CEN-152 guidelines, t As appropriate, this information will be added to the existing'ANO Business Plan item for the E0P upgrades.
Although the current E0P requires improvement, AN0 management is confident that the operators are fully capable of performing t,he actions required to maintain the plant in a safe condition _during a transient. To help lessen the dependence on operator experience, the Unit 2 Operations Manager will ,
clarify management's philosophy for accident mitigation using.the existing ,
E0P during upcoming operator training cycles. Continual checking of safety '
functions will be emphasized. Discussions have been held with the Unit l 2 shift operations supervisors.
ANO management had recognized that the ANO-2 E0P was not in line with current industry standards prior to the inspection. Based on an independent ;
evaluation and our own evaluation, the decision had been made to convert the ANO-2 E0P to conform to the CEN-152 guidelines. The E0P upgrade was identified as a task in the AN0 Business Plan (Item C.11.c) and the owner's i
An irvrvoy Congwy TC &S-/27
Robert A. Martin Page 2 April 20, 1990 group contract was initiated which will provide ANO with the products of the CEN-152 development work. Self-assessment is continuing and includes the E0P, the E0P writers guide, the verification and validation process, and E0P-related training, including simulator scenarios. Any safety concerns identified during this assessment will be immediately corrected. Based on the results of this self-assessment and the NRC's findings, revisions will ;
be made as delineated in the attached schedule. '
As a short-term action to address the concern regarding safety function !
verifications, the Shif t Technical Advisors have been directed by memorandum to perform their safety function checklist once every fifteen minutes. This requirement will be incorporated into the applicable procedure. The performance of safety function verifications will be fully resolved by the conversion to !
the CEN-152 guidelines. -9 During the inspection, ANO-2 committed to increase the number of non-licensed positions for the on-shift crews as a conservative measure until further '
verification can be completed. As of March 30, 1990 the number of non-licensed l positionsbeingstaffedforeachcrewonUnit2wasIncreasedtofour. l (The number of non-licensed positions required by the Technical Specifications )
is two.) Operators filling these position will have the following minimum '
, qualifications:
1 qualified Waste Control Operator; 2 qualified Auxiliary Operators; and 1 qualified fire brigade member. I The above shift composition will be maintained until an evaluation of actions required by the E0P is performed to verify the level of staffing necessary to adequately accomplish those actions. Although staffing for ANO 1 is currently considered adequate, a similar evaluation will be performed .
for ANO-1. Changes to the Technical Specification required staffing _ levels !
will be requested as necessary.
In response to NRC comments regarding the effectiveness of present audits of the E0Ps and A0Ps, Quality Assurance will increase the breadth and depth of these audits by develo)ing a separate, " stand alone" annual audit of selected E0Ps and AOPs from eac1 unit. To further enhance the assessment capabilities i
of audit personnel, outside t0chnical assistance will be used to supplement L the audit team. The 1990 addit of E0Ps and AOPs is currently scheduled i to begin in September.
An interim revision to the AND-2 E0P will be prepared for implementation by October 15, 1990. The implementation effort will include development of simulator scenarios and draft lesson plans. Training on this revision will begin September 3, 1990, and the revised E0P will be implemented upon
l . \
5 Robert A. Martin -
Page 3 l April 20, 1990 N, i
completion of the training. This revision will address many ideratified concerns, such as inclusion of more contingency actions, incorporation of *.
certain human factors concerns, inclusion of the Reactor Vessel Level Monitoring System and the Diverse Scram System, and further directio,34 concerning RCS voiding. Clarification of directions for resetting"MSIS-Gon correction of identified labeling discrepancies will also be rp olved either by this revision or by corrections to plant labeling.
In summary, ANO management is confident that the existing ANO-2 E0P can be used by the operating staff to maintain the plant in a safe condition, .k flowever, we recognize that upgrades to the E0P and the E0P-related documents are necessary and these are being pursued. The overall E0P upgrade effort will provide the operators with a much improved document for their use in maintaining the continued safe operation of ANO-2.
If you have any question concerning these ections, please contact James J. Fisicaro at 501-964-3228. j i
Very truly yours, W
er W. verton
[ Director Nuclear Operations !
JWY/JDJ/sgw Attachment cc: U. S. Nuclear Regulatory Commission Document Control Desk Mail Station P1-137 Washington, DC 20555 L. J. Callan, Director Division of Reactor Safety Region IV U. S. Nuclear Regulatory Commission l' 611 Ryan Plaza Drive, Suite 1000 Arlington, TX 76011 ;
( i M
I
l Robert A. Martin Attachment Page 1 COMPLETED ACTIONS 1 f
- 1. Increase number of non-licensed positions being manned on ,
AND-2 operating crews.
- 2. Establish frequency of STA safety functional checks at once every 15 minutes (via memorandum).
- 3. Initiate contract for CEN-152. .
SHORT-TERM ACTIONS ACTION SCHEDULED COMPLETION DATE ,
- 1. Update Business Plan item C.11.c ta include specifics of 05/15/90 E0P action plan as appropriate, i Revise the Shift Technical Advisor transient response procedure 05/30/90 to require the safety function verific0 tion every 15 minutes.
- 3. Complete self-assessment of ANO-2 E0P and associated documents 06/01/90 (writers guide, verification and validation process), including training and simulator scenarios, to determine necessary revisions. Immediately correct any significant identified safety .
Coh*.e rns .
- 4. Discus: Operations management's philosophy for operator action 06/01/90 in situadons not specifically addressed by E0P to reduce reliance on operator experience. (This is and will continue to be an on going process; the completion date reflects the end of t the next training cycle.) ,
- 5. Revalidation of non-licensed operator staffing required 06/30/90 to accomplish the E0Ps for both units.
- 6. Upgrade the verification and validation process (applicable 06/30/90 '
to both ANO-1 and AND-2).
- 7. Revise the E0P writers guide for both ANO-1 and ANO-2. 06/30/90
- 8. Develop simulator scenarios and prepare draft lesson plans 09/01/90 as necessary.
- 9. Develop separate E0P/AOP audit. 09/30/90 ;
- 10. Revise existing E0P to address specific human factors and 10/15/90 technical issues and implement revision (includes required operator training).
l
~*
)Robert A. Martin
- ' Attachment Page 2 LONG-TERM ACTIONS ACTION SCHEDULED COMPLETED DATE i 1
- 1. Based on revalidation results, request change to non-licensed 02/28/91 l staffing level required in Technical Specifications.
- 2. Implement an ANO-2 E0P based on CEN-152 (reference Business 12/31/91 Plan item C.11.c). This process includes the following:
- a. Complete, comprehensive verification and validation of E0P to include a 100 percent plant walkdown;
- b. Completion of operatoi training on the new E0P.
l
- 3. Rewrite the ANO-1 E0P to fully incorporate B&W guidelines 12/31/91 (reference Business Plan item C.11.c) (includes verification of adequacy of technical bases document, development of discrepancy document, etc.). This process includes the following:
- a. Complete, comprehensive verification and validation of E0P to include a 100 percent plant walkdown;
- b. Completion of operator training on the new E0P.
.