ML20237D299
Text
_ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _
1 March 19, 1986. i i
Paul Col I i ns #93-VROC KMC Inc.
801 18th Street N. W.
Washi ngt on, D. C. 20006
Dear Paul,
3 Encl osed i s a copy of the SECY paper on the Emergency Response Data' System
( ERDS) as a f oll ow up of your conversat i on wi th Ken Perki ns. We woul d li ke to i nvi te you, and any of your associ ates who mi ght be i nt erest ed, to come to the Operati ons Center to see our new f acili ty and tal k to us about the ERDS project. Shoul d you wi sh t o come out or if you have any other questions pl ease call me at 492-4155.
Si neerel y; John B. Hiekman I nci dent Response Branch
,A U. S. Nucl ear Regul at ory Commi ssi on.
'U Washi ngt on, D. C. 20555 1
O
'B712230176 871210 PDF FOIA PDR y SHOLLYB7-737
f SSINS No.:- 3 I
UNITED STATES . lM.
FUCLEAR REGULATORY COMMISSION 0FFICE OF INSPECTION AND ENFORCEMENT ( [g - gg Q, ,,. g WASHINGTON, D.C. 20555 /vff/6c/)g g February 13, 1986 444bM[ hp '7 h
IE INFORMATION NOTICE N0. 86-10: SAFETY PARAMETER DISPLAY SYSTEM MALFUNCTIONS h MOM g Addressees:
All nuclear power reactor facilities holding an operating license (OL) or a constructionpermit(CP).
Purpose:
done to This notice determine the is to inform status recipients and quality of safety of the r'esults parameter displayofsystems a recent survey (SPDS) a operating reactors. It is expected that recipients will review this information for applicability to their facilities and consider actions, if appropriate, to preclude a similar problem from occurring at their facilities. However, suggestions contained in this notice do not constitute NRC requirements; therefore, no specific action or written response is required.
h The information herein is being provided as an early notification of a significant matter that is still under review by the NRC staff. The NRC is continuing to obtain and evaluate pertinent information. If NRC evaluation so indicates, further licensee actions may be requested.
Background:
Prompt impismentation of the SPDS in operating reactors is a design goal of prime importance. The NRC staff does not review operating reactor SPDS designs for compliance with the requirements of Supplement 1 of NUREG-0737 prior to implementation unless a pre-implementation review has been specifically requested by the licensee. The licensee's Safety Analysis and SPDS Implementation ~ Plan are reviewed by the NRC staff only to determine if a serious safety question is posed or if the analysis is seriously inadequate.
If no serious safety question is identified and the licensee's analysis is reasonably adequate, the staff directs the licensee to continue implementation.
Final acceptability of the licensee's SPDS is conditional to a satisfactory post-implementation audit.
To determine the appropriate level of technical effort needed for post-implementation audits, the staff decided in mid-1985 to survey a sample of six operating plants to determine the state of SPDS implementation and to ascertain the scope and depth of review necessary for post-implementation audits, n== s
February 13, 1986 Page 2 of 2 O
The sample selected for the survey was chosen to represent the major reactor and SPDS types. Five of the six plants in the sample had been issued Commission orders or license conditions that stipulated the SPDS was to be operational.
At the time of the survey all five of these plants had declared their SPDSs operational in accordance with their orders or license conditions. At two of these five plants the SPDS was, in fact, not operational.
Discussion:
The survey included onsite evaluations of licensee documentation and hardware, as well as interviews with operations personnel.
presented in Attachment 1. The major deficienciesDetailed survey findings are identified from the survey results include:
Lack of SPDS availability because of gross system malfunctions,
- Display of unreliable or invalid data and alarms,
- Poor acceptance of SPDS by operators b'ecause of reliability problems.
- Failure of management to integrate SPDS into the operational environment.
Changes and interruption of SPDS display from outside the control room, Inadequate documentation of SPDS and failure to control system testing and modifications, and Slow SPDS response to some operator commands.
Problems similar to those described above als,o have been identified by the O'h staff during the evaluation of the emergency data acquisition systems as a part {'j of the Emergency Response Facility appraisals. These appraisals have been conducted at six different plant sites.
The following reference materials provide information on the individual guidance and requirements for SPDS and emergency data acquisition systems:
NUREG-0737, Supplement 1 January 1983.
NUREG-0800, Chapter 18.2, November 1984.
NUREG-0696, February 1981.
No specific action or written response is reovired by this information notice.
If you have questions about this matter, please contact the Regional Administrator of the appropriate NRC regional office or this office.
. ra 'ector Division mergency Preparedness and Eng ering Response Office of Inspection and Enforcement Technical Contacts: Roger Woodruff, IE (301) 492-7205 George Lapinsky, NRR O Attachments:
(301) 492-8166
()
- 1. Survey Results
- 2. List of Recently Issued IE Information Notices
Attachment 1 IN 86-10 l February 13, 1986 O SURVEY RESULTS I C/
- 1. Reliability / Availability '
Three of the six plants were identified as having serious problems regarding SPDS availability. Some systems were found to be unavailable because of gross system malfunctions. Others were providing invalid and unreliable data and were considered to be nonfunctional because operators, justifiably, avoid using them. Because no records or logs of SPDS performance are currently kept at these plants, the extent of the problem could only be judged by the verbal descriptions of the users and technical staff; e.g.,
"The system has never run for twenty-four hours straight without a failure."
Supplement I to NUREG-0737 calls for the SPDS to " continuously display infomation from which the plant safety status can be readily and reliably assessed. . ." Plants that have declared the SPDS to be operational are expected to have reliable displays portraying. accurate values on a continuous <
basis. This was not the case at half of the plants in the sample.
- 2. Potentially Misleading Information At half of the plants, the staff identified invalid data and alarms that j l could mislead users. This problem is most critical at those plants that {
Q (' use the SPDS as a part of the emergency data acquisition system to provide information to the technical support center (TSC) and emergency operations ,
facility (E0F). .In,most. cases. thasa ersoneous indications.were causeLby {
l not-maintaining SPDS.sof.tware-to-reflect-the.most curr.e & state Jf,,the '
,_plantfe.g.,newalarmsetpointswerenotenteredintoSPDSsoftware, ands SPDS compensation and calibration were not routinely checked and corrected.) '
In one case, the major problem was that the system was simply not complete ~--
teyjsjon.and, debugging of theJo{tware was on i hile the SPDS was purportedly the1TSC2jridf the10Fi
- Nomally any. o e ational nstrument that is notJEthe,,conthiiroom, functional is appropriately go ng, w tigged-out l and repaired, but this was not done in this case. In addition, using the I control room as a test-bed for SPDS creates the potential for misleading )
operators and of destroying operator confidence in the SPDS.
- 3. Poor Operator Acceptance i Because of the problems stated above--unreliable, inaccurate, and invalid data.-some operations personnel stated that they did not trust the SPDS b and would not use it under any circumstances. This_ptpblem, appeared.$o be '
further exacerbated,at_those plants where the. operators .were not actively ~
i,nvol ved i n2DLdes j ga.dec((i_ogs . l
- 4. Management Support At two plants the staff observed a lack of management support for the SPDS concept. At one plant this lack of support was evidenced by a 9
Attachment 1 IN 86-10 February 13, 1986 g p Page 2 of 2 disinterested attitude toward an obviously useless system. There was no delegation of responsibility to put somebody in the lead to correct the system and make it a useable tool' for control room operators. At a second plant several high-ranking managers voiced their opinion that the SPDS was only an aid and that its use was entirely optional regardless of plant mode or condition. As a result, the SPDS was not_wellintegrated into the operational environmgot of the control room at this plant. In facti ~l W ~
operations personnel interviewed at this plant did not know who, if j anyone, was assigned to monitor plant status using this SPDS. j
- 5. Miscellaneous Findings Display Security - At one plant where the SPDS had been operable for 2' i years, control room SPDS. displays.were. routinely,being. changed,and_Iout,.
interrupted from outside_the, control room. This was being done witt the knowledge or consent of the controLroom.. crew_ and without,"taggli!g
~ # ~~ ~
'out""the'SPDS"for*maint Haddi I System Documentation and Maintenance - Five of the six plants had one or more of the following problems: incomplete or missing elements in the 1 f
system documentation, especially those that would be.aggded to correct,)y maintain,SPDSefunctions as-originally. designed; inadeguate
~w ithout deria 4-><c 9taace cratec2>; 1eck of software evecrier.,s_ testing, often O procegg,and appr 7iew. C'i changes; andbility ina_opria,te_rgyjewerg; to produce currgdRumentationno plans tarforgetes.th texistinsting _A.fterJo '
s.ystem.
Response - At one plant the response of the SPDS to-operator commands varied from 3 seconds to several minutes depending on the type of comand and the number of other active terminals. The staff has observed that respon,se_ times of over_10 seconds are, generally. perceived by., users.as,a, system or communication failure. ~Therefore.- suc1 long response times
~
may"cause frustration'and keying errors as the user tries to " correct" the situation. l Critical Safety Functions - At one plant the SPDS did not provide sufficient information to monitor the radioactivity control safety function (remote- )
area radiation monitors). l 1
Training - At thr'ee plants operators felt that their_$,ra101Dg regarding l the use of SPDS was iy dequaje. l Integration Into Emergency Operations - At three plants thezq]e.0Lthe SPDS during, emergency operations.Was,undefged and g imargus,er could.
'be identified.
O U
y Attachment 2 IN 86-10 February 13, 1986 LIST OF RECENTLY ISSUED IE INFORMATION NOTICES Information Date of Notice No. Subject Issue Issued to 86-09 Failure Of Check And Stop 2/3/86 All power reactor Check Valves Subjected To facilities holding Low Flow Conditions an OL or CP 86-08 LicenseeEventReport(LER) 2/3/86 All power reactor Format Modification facilities holding an OL or CP J
86-07 Lack Of Detailed Instruction 2/3/86 All power reactor And Inadequate Observance Of .
facilities holding Precautions During Maintenance an OL or CP And Testing Of Diesel Generator Woodward Governors 86-06 Failure Of Lifting Rig 2/3/86 All power reactor Attachment While Lifting The facilities' holding Upper Guide Structure At an OL or CP St. Lucie Unit 1 86-05 Main Steam Safety Valve Test 1/31/86 All PWR facilities Failures And Ring Setting holding an OL or l
Adjustments CP 86-04 Transient Due To Loss Of 1/31/86 All power reactor Power To Integrated Control facilities holding .i System At A Pressurized Water an OL or CP l Reactor Designed By Babcock
& Wilcox 86-03 Potential Deficiencies In 1/14/06 All power reactor Environmental Qualification facilities holding l Of Limitorque Motor Valve an OL or CP Operator Wiring 86-02 Failure Of Valve Operator 1/6/86 All power reactor Motor During Environmental facilities holding Qualification Testing an OL or CP 86-01 Failure Of Main Feedwater 1/6/86 All power reactor Check Valve Causes Loss Of facilities holding Feedwater System Integrity an OL or CP And Water-Hammer Damage OL = Operating License CP = Construction Permit
~
- _ - _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _