IR 05000397/1998005

Insp Rept 50-397/98-05 on 980312-17.Violations Noted.Major Areas Inspected:Operations,Maint & Engineering

ML17292B356
Person / Time
Site:	Columbia
Issue date:	04/24/1998
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV)
To:
Shared Package
ML17292B354	List: IR 05000397/1998005 ML17292B353 ML17292B355
References
50-397-98-05, 50-397-98-5, NUDOCS 9804300238
Download: ML17292B356 (57)

Text

ENCLOSU E 2 U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket No.:

License No.:

Report No.:

Licensee:

Facility:

Location:

Dates:

Team Leader:

'Inspectors:

Reviewed By:

Approved By:

50-397 NPF-21 50-397/98-05 Washington Public Power Supply System Washington Nuclear Project-2 Richland, Washington March 12-17, 1998 William B. Jones, Senior Reactor Analyst Thomas O. McKernon, Senior Reactor Engineer Gary W. Johnston, Senior Project Engineer John L. Pellet, Chief, Operations Branch Arthur T. Howell III, Director Division of Reactor Safety ATTACHMENTS:

Attachment 1:

Special Inspection Charter Attachment 2:

Detailed Sequence of Events Attachment 3:

Listing of Documents Reviewed During the Special Inspection Attachment 4:

Supplemental Information 9804300238 980424 PDR ADOCK 05000397 PDR

-5-XEC TVE A Y Washington Nuclear Project-2 NRC Inspection Report 50-397/98-05 Qger~ii n The licensee's actions prior to the main steam line isolation valve nitrogen supply line failure were appropriate.

No specific actions were identified that should have been taken prior to the nitrogen supply line failure. The sequence of events was consistent with the expected plant response to the failed main steam line containment instrument air supply line (Section 2.1).

A violation with two examples of inadequate procedures was identified for a Division II logic system functional test and the Division III emergency diesel generator restoration.

Temporary Change Notice TCN 98-113, made to Procedure TSP-DG2/LOCA-B501, Step 7.1.33, Substep a, to override the opening of the injection valve, was inadequate and resulted in low pressure coolant injection to the reactor vessel during the conduct of the March 12, 1998, logic system functional test.

Procedure PPM 2.7.3, "High Pressure Core Spray Diesel," Revision 29, did not provide adequate direction for the shutdown of the high pressure core spray system (Section 2.2 and 3.1).

Reactor pressure vessel level-shrink and swell were not modeled well on the plant-specific simulator for dynamic evolutions. The licensee had initiated corrective actions to update the simulator model to more consistently reflect the plant's operation (Section 2.3).

The operators demonstrated the ability to respond to a complex transient and maintain the plant in a safe configuration while proceeding with a coo!down to Mode 4 (Section 3.1).

Several operator knowledge and performance weaknesses were identified including:

recognizing expected plant response; verifying the appropriate engineered safety feature and emergency core cooling system actuations had occurred; and management oversight (command and control). Weaknesses in management oversight were illustrated by a lack of focus on evolving plant conditions and assuring recovery actions were appropriately implemented (Section 3.1).

A violation was identified for the failure to verify and maintain the reactor vessel temperature and upper head pressure indications within the acceptable area of the temperature/pressure curve provided in Procedure OSP-RCS-C102,

"RPV Vessel Cooldown Surveillance," Revision 0, Attachment 9.1, "Minimum Vessel Metal Temperature VS Reactor Vessel Pressure" (Section 3.1).

-6-Operator workarounds contributed to operator performance concerns through distractions and the need to implement alternate means to operate needed systems and components.

The operator work around issues appeared in significant areas involving vessel level and pressure control, and the ability to reestablish temperature monitoring and forced circulation (Section 3.2).

The licensee appropriately considered the emergency plan prior to determining no declaration was necessary.

The failure to recognize that the high pressure core spray and reactor core isolation cooling system had actuated did not affect the emergency classification (Section 4).

Communication within the control room and again with the NRC.headquarters operations officer regarding the overall status of the plant was poor and did not ensure that key control room personnel were cognizant of the overall plant and systems status.

Information conveyed was sometimes erroneous and required subsequent clarification and correction.

The poor communications within the control room contributed to inappropriate decisions regarding resetting equipment and also contributed substantially to NRC concerns that the event and plant response were not well understood (Section 4).

A violation was identified for the failure to provide the required one hour. event notification in accordance with 10 CFR 50.72, paragraph (b)(1)(iv) for the valid high pressure coolant injection into the reactor vessel (Section 4).

The team determined that the licensee's initial postscram review had not been fully effective in providing a comprehensive understanding of the event.

This included procedural, performance and equipment problems experienced as demonstrated, in part, by the missed reactor core isolation cooling turbine trip (Section 5).

The licensee's 10 CFR 55.59, "Licensed Operator Requalification Program," did not address reduced operating crew complement used between the control room and in simulator training, and was considered a significant weakness in the licensed operator requalification training program (Section 5).

Min nnce The licensee aggressively addressed concerns with the Division II logic system performance during the event and verified the Division II logic system functionality.

However, the licensee did not effectively control or implement the surveillance test that demonstrated the logic performance.

Effective management control was not implemented for the procedure temporary change process and control of infrequently performed tests and surveillance (Section 2.2).

0

~En ineerin

~

A violation was identified for changing the intent of the logic system functional test to allow low pressure coolant injection into the reactor vessel (Section 2.2).

~

The licensee effectively addressed the cause of the main steam line isolation valve containment air supply line failure. Seismic and material fatigue concerns were

,appropriately addressed.

Common cause failure of the other main steam line isolation valve'instrument air lines was reviewed and determined not to be a concern.

Identified deficiencies were corrected before plant restart (Section 2.2).

~

An unresolved item was identified for the reactor core isolation cooling system test return line throttle and isolation valves. The item involves whether the valves'erformance should have been effectively controlled through the performance of appropriate preventive maintenance in accordance with the requirements of 10 CFR 50.65(a)(2)

(Section 2.2).

The effectiveness of the system walkdowns was mixed. The licensee appropriately identified concerns with the containment instrument air system; however, concerns with the reactor core isolation cooling system performance and postoperation condition were not promptly identified by walkdowns or plant data review (Section 5).

The plant restart evaluation effectively utilized the information obtained from the reactor scram report in determining the corrective actions that were needed; however, the information provided was incomplete.

The plant restart evaluation process was needed to fully identify the operator and equipment performance issues that were missed by the post scram review. The team noted that this resulted in the restart evaluation process using an iterative approach to identify and review operator and equipment performance issues in determining the corrective actions that were needed (Section 5).

-8-DETAILS

INTRODUCTION r

can sc of heins e

i n The Region IV, Director, Division Reactor Safety, dispatched a special inspection team to the Washington Nuclear Project-2 reactor facilityto review the circumstances surrounding a main steam isolation valve closure (V 22D) and automatic reactor scram on March 11, 1998.

The special inspection team consisted of three NRC personnel, including the team leader and specialists in operations and engineering.

In the special inspection team charter (Attachment 1) the Director, Division of Reactor Safety, directed the team to conduct fact finding to determine the following:

The initial conditions prior to the event.

The sequence of events that resulted in the reactor trip.

The performance of plant equipment during the event.

The licensee's emergency response.

The operator response during the event.

The licensee'esponse and assessment of the event.

In addition, in keeping with the NRC's emphasis on encouraging licensee self assessment and corrective actions, the special inspection team was directed to utilize the findings of the licensee's postreactor scram and plant restart evaluation teams to the maximum extent possible.

Licensee-provided information was not independently developed; however, some of the information was verified to confirm the licensee's investigation.

The special inspection, team developed a detailed sequence of events provided in Attachment 2 based upon a review of the licensee's documentation, personnel interviews, and briefings by plant management personnel.

A list of documents that the special inspection team reviewed is contained in Attachment 3. Attachments 4 and 5 identify the principal attendees at both the inspection entrance and exit meetings, as well as, the list of personnel contacted during the inspection.

EVENT DESCRIPTION (37551, 61726, 93702)

a.

~Sco e

The team reviewed the March 11, 1998, sequence of events related to the main steam isolation valve closure and subsequent reactor scram (event). The review included the plant conditions prior to the event, status of safety-related equipment and the overall sequence of events.

A detailed sequence of events is provided as Attachment b.

bse i n d Fin in s Plan ondi ions P ior o h In pard Mai S e m I ola ion Valve Closure The team noted that all safety-related systems were available prior to the reactor scram.

The previous day, the licensee noted an increase in the usage of containment instrument air (nitrogen) in the drywell. The increase was from approximately 1 to 1.5 scfm.

Although the licensee had initiated a review of the increased nitrogen usage, no indications were available that the increased nitrogen usage may have been associated with the nitrogen supply line to Main Steam Isolation Valve 22D or that the valve would fail closed.

iia in Even a d lan e

ns On March 11, 1998, at 0516 PST, a reactor scram was automatically initiated on high average power range monitor flux at 118 percent.

The high average power range monitor flux was caused by the rapid reactor vessel pressure increase which resulted from the failure of the inboard main steam isolation valve (22D) nitrogen supply line and rapid closure of the valve. Steam flow through the remaining steam lines increased, causing a closure of the remaining main steam isolation valves.

Two safety relief valves initiallyactuated to control reactor vessel pressure.

The safety relief valves were subsequently manually actuated for pressure control. The position indication for four control rods was initiallylost. The operators subsequently utilized the rod worth minimizer to verify the rods were fully inserted.

The high pressure core spray, its emergency diesel generator, and reactor core isolation cooling systems actuated on low reactor vessel level (Level 2) caused mainly by an indicated reactor vessel level decrease as measured in the reactor vessel annulus area.

Approximately 1 minute later, these systems automatically isolated or secured on high reactor vessel level (Level 8). The increased level resulted from the subsequent water level swell and feed from the two injecting systems.

A high drywell pressure occurred as a result of the reactor closed cooling water system isolating on the initial low level. The Division I and II emergency diesel generators started, but did not load, on the high drywell pressure.

The Division III emergency diesel generator started with the initial low vessel level, but did not load. The low pressure safety injection systems'igh drywell pressure set point (slightly higher than the engineered safety features a'ctuation set point)

was not reached and the systems did not initiate. The Division I low pressure coolant injection system was in operation for suppression pool cooling and was not effected by the high drywell pressure.

The safety relief valves were manually cycled to control reactor pressure.

The reactor core isolation cooling system was manually started and stopped to control reactor vessel

-10-described in the operating procedure because of an isolation valve that could not be

.

opened. This resulted in the operators having to manually start and stop the system for reactor vessel level control.

The operators also had difficultlywith restoration of several systems following the event.

These included the reactor water cleanup system and Division III emergency diesel generator.

During the cooldown, the operators exceeded the allowable temperature and pressure limits established in the technical specifications based on the indications available at the time. Approximately 2 l~ hours after the reactor scram, the main steam isolation valves were reopened and reactor vessel level and pressure were controlled using the condensate system and steam bypass valves (preferred method).

~Concl si

The licensee's actions prio~-to the main steam line isolation valve nitrogen supply line failure were appropriate.

No specific actions were identified that should have been taken prior to the nitrogen supply line failure. The sequence of events was consistent with the expected plant response to the failed main steam line containment instrument air supply line.

a d Plant In ec ion co e o en R

o s th M

i S

am solaionValv C

sur The team reviewed the licensee's post scram and restart evaluation committee equipment performance analyses related to plant system and component response to main steam isolation valve closure.

The team independently verified important system and equipment component performance.

The systems and equipment reviewed included:

main steam isolation valves; safety relief valves; control rods; electrical load shedding as a result of engineered safety feature actuation signals; low pressure coolant injection initiation logic; drywell pressure switches; and, the reactor core isolation cooling system.

Observ io s and Findin s MainS amlsol i

Va eP rfor ance The event of March 11, 1998 was initiated from a closure of the inboard Main Steam Isolation Valve 22D. The closure occurred when the instrument air supply line (nitrogen)

to the control solenoid manifold failed, allowing the main steam isolation valve to close as designed.

The failure of the instrument air line was attributed to high cycle fatigue induced cracking of the tubing at the swagelock fitting to the solenoid valve manifold.

The solenoid valve was located on the main steam isolation valve. The line fractured just inside the ferrule's outer contact area of the fitting. Licensee and NRC team inspections of the other instrument air lines on both the inboard and outboard valves did not show

-11-similar indications.

However, a minor leak was detected during a licensee inspection in the instrument air line to the solenoid manifold on Main Steam Isolation Valve 28B, an outboard main steam isolation valve. The licensee utilized a borescope to examine the line. No cracking was observed.

The problem was attributed to poor fit up of the instrument air line to the swagelock fitting on the solenoid valve manifold rather than from high cycle fatigue cracking. The leak was repaired prior to restart of the reactor.

Corrective action to preclude other instrument air lines from experiencing similar fatigue cracking was not deemed necessary by engineering personnel.

The licensee found the containment instrument air line configuration to the Main Steam Isolation Valve 22D was different than the air lines to the other inboard main steam isolation valves. The line to Main Steam Isolation Valve 22D was substantially longer, therefore, it had a larger moment arm and, consequently, a lower natural frequency.

A licensee materials specialist surmised that the air line to Main Steam Isolation Valve 22D was excited from vibrations in the main steam line, and that these vibrations led to the eventual high cycle material fatigue induced failure of the air line. The lines to the other main steam isolation valves were configured differently and had not shown evidence of vibration induced cracking. The licensee changed the air line configuration to Main Steam Isolation Valve 22D to preclude the potential of high cycle fatigue. The line to Main Steam Isolation Valve 22D was replaced, and configured in a similar manner as the other three inboard main steam isolation valves.

The team reviewed the design packages that described the configuration of the instrument air lines to the main steam isolation valves.

The team noted that the air lines were installed as field runs, with drawings supplied in the work control package which described the general arrangement.

The field run instruction required the work to be routed in the most expeditious manner, and only required that the line conform generally with the drawing. A field sketch was made of the actual installation, and the design drawings were updated to reflect the actual as built configuration of the line. The use of the field run installation instruction was apparently how the configuration of the instrument air line to Main Steam Isolation Valve 22D varied from the other main steam isolation valves.

The team verified that the licensee had appropriately considered seismic design requirements in evaluating the previous and current air line

.

configurations. The license identified that the previous and current configuration was bounded by previous seismic analysis.

I'he rapid closure of the Valve 22D was expected given the failure of the air supply line.

The performance of the main steam isolation valves in response to the closure of Main Steam Isolation Valve 22D was as expected.

The valves closed appropriately from high steam flow conditions in the other steam lines following the closure of Main Steam Isolation Valve 22 S f Reli Valve e

a The safety relief valves opened to relieve reactor vessel pressure a total of eighteen times. Two of these actuations were automatic in response to high reactor vessel pressure.

The other sixteen actuations were manually initiated valve openings to maintain reactor pressure and to commence a reactor cooldown according to emergency operating procedure instructions.

The two automatic lifts on safety relief Valves 1B and 1C lasted 15 and 19 seconds, respectively, at 1085 and 1082 psig. The valve set point for these two valves was 1091 psig. The lifts exhibited normal blowdown characteristics, showing closed indication at 1015 and 1011 psig, within the expected 100 psig of the liftpressure.

The team compared the reactor pressure trace curves with each valve blowdown. The valves exhibited a steady relief of pressure with no indication of a change in curve profile that would show a nonlinear response.

Subsequent lifts of the safety relief valves were for vessel pressure control and cooldown. The operators rotated discharge of the valves to ensure even heating of the wetwell. Sixteen manual valve actuations were initiated, all of which exhibited similar characteristics of a linear response.

The actuations lasted from 50 to 110 seconds.

No indications of excessive safety relief valve leakage were noted for any of the tailpipe temperature indications.

nr IR cr mPe rm n The licensee conducted post event Surveillance Procedure TSP-CRD-C101, "CRD Scram Timing with Autoscramtimer System," Revision 1. This procedure required the compiling of data on control rod scram times from the autoscramtimer and comparison to scram time acceptance criteria following a reactor scram. A review of the surveillance test results indicated that all of the control rods performed as expected.

From full out at position 48 to position 5 (the last position monitored by the autoscramtimer) the slowest rod was 10-47 with an insertion time of 2.692 seconds.

The acceptance criteria was 2.936 seconds.

The average time was 2.415 seconds from full out to position 5. For control rods that were not full out, an extrapolation of scram times was done from their

'last position. Thirteen rods were between positions 32 and 46 and had extrapolated times ranging between 2.20 seconds to 2.55 seconds.

One control rod (30-31) was full in at the time of the scram and did not have a scram time.

Immediately following the scram the operators noted that one control rod group did not have indication of four control rods being inserted.

From the results of the autoscramtimer surveillance it can be concluded that the group did insert fully. The licensee determined that the lack of indication was most likely caused by rod overtravel.

Later (1-2 minutes) the four control rods indicated they were in the full in positio om I

oval of Elec i al ads Following the reactor scram from high reactor flux, two conditions eventually occurred from reactor vessel water Low Level 2 (-50"), and high drywell pressure (1.68 psig) that caused the shedding of electrical loads.

The start of the Division I and II emergency diesel generators led to the shedding of four minor motor control centers that did not significantly contribute to problems during plant recovery.

Other loads were shed as the result of isolation signals generated from the Level 2 condition of less than -50 inches and the later high drywell pressure conditions. The Level 2 signal caused the reactor water cleanup system to isolate from the containment and the reactor water cleanup pumps to trip; further, the reactor closed cooling water system also isolated from the containment and the reactor closed cooling pumps tripped due to this signal. The reactor closed cooling isolation eventually led to the drywell pressure increase due to heating of the drywell air space, in part, from the safety relief valve tailpipes.

The isolation of the reactor water cleanup system compli'cated plant recovery because of procedural complications with restoring the system with high nonregenerative heat exchanger outlet temperature (an expected condition). Had only a high drywell pressure signal been present, the reactor water cleanup system pumps would have, tripped, but a system isolation would not have occurred.

i hD eIIP ssur wich During the event on March 11, 1998, the Division I and II emergency diesel generators started on high drywell pressure and the alarm printer indicated that Channel C of high drywell pressure residual heat removal low pressure coolant injection initiation logic had actuated.

However, the low pressure coolant injection systems did not start.

Post event channel calibrations performed on the drywell pressure switches indicated that all of the switches were within calibration.

Each drywell pressure switch had two pairs of microswitch contacts.

Channel C had one pair of contacts that actuated.

The other contacts in the same channel and the contacts in the other three channels did not close.

The pair of contacts in Channel C that closed provided output only to the plant computer systems as indication of pressure switch actuation.

This pair could actuate prior to the required set point for the drywell pressure actuation set point for the low pressure coolant injection initiation logic. The licensee determined that the actuation set point of 1.68 psig was never reached, and that the pressure had risen only high enough to actuate the one pair of contacts in Channel C. To illustrate the situation, the pair of contacts for the computer output in Channel C was determined to be set at 1.61 psig, while the engineered safety features actuation contacts were set at 1.63 psig. The administrative limits for calibration tolerance for the drywell pressure switches are 1.61 to 1.68 psig. The team also verified the last as-found set points for Division I were above the actual drywell pressure observed and that their actuation was not expecte However, because of uncertainty about the residual heat removal/low pressure coolant injection initiation logic performance, the licensee opted to perform Surveillance Procedure TSP-DG2/LOCA-B501 to confirm the Division 2 residual heat removal/low pressure coolant injection logic system was functional. The team concluded that the residual heat removal/low pressure coolant injection initiation feature of the high drywell pressure switches were not called upon to actuate.

Perfor ance of Lo ic S s em Func ional T for En ineered Safe uards Fea ur Division 2 esidual Hea R moval Low Pre re o

a I

e ion The team reviewed the performance of Surveillance Test Procedure TSP-DG2/

LOCA-B501, "Standby Diesel Generator DG2 LOCATest," Revision 0, performed on March 12, 1998. This included observation of the test and discussions with personnel associated with the test activity.

The licensee conducted a logic system functional test in accordance with Surveillance Test Procedure TSP-DG2/LOCA-B501. The test was conducted to verify the Division II logic system functionality following channel calibration tests of the drywell pressure switches and that the observed system performance with the high drywell pressure was appropriate.

The test was to establish functional performance of the actuation logic for Division II residual heat removal/low pressure safety injection equipment from a high drywell pressure condition.

Two temporary procedure changes were made to the Procedure TSP-DG2/LOCA-B501, intended to facilitate the test while the plant was in Mode 4. The first temporary change notice,98-110, was initiated on March 12, 1998, to change a requirement to close residual heat removal Valves 111B and C. Closure of these two valves would require a containment drywell entry, which presented a radiological concern from an as-low-as-reasonably-achievable aspect.

The valves are located in the drywell, in a high radiation area, and required manual operation, therefore, radiation dose was a factor because of the length of time necessary to close then open the valves manually.

Procedure TSP-DG2/LOCA-B501, provided for logic system functional testing and response time testing.

Establishing injection flow to the reactor vessel at the discretion of the control room supervisor or shift manager had not been included in the test purpose.

The team found that the Temporary Change Notice TCN98-110 to Procedure TSP-DG2/LOCA-B501, which changed the previous requirement to close Residual Heat Removal Valves 111B and C, to allow closure at the discretion of the control room supervisor or shift manager changed the intent of the procedure as described in its purpose statement.

Procedure OSP-RHR/IST-R702, "RHR B Check Valve Operability/Refueling Shut Down," Revision 0, provided for testing the low pressure coolant injection flow path to the reactor vesse Licensee Plant Procedure Manual Procedure SWO-PRO-02, "Preparation, Review, Approval and Distribution of Procedures," Revision 3, Section 3.10.1, stated that, "A temporary change shall NOT alter the intent of the procedure."

Paragraph 5.9 defines intent as the stated purpose or scope of a procedure as defined in the purpose section of the procedure.

Procedure TSP-DG2/LOCA-B0501, Section 1.0, purpose stated that the procedure provides instructions for operating personnel to perform surveillance testing of Diesel Generator 2 during simulated emergency core cooling initiation (loss-of-coolant accident) conditions in accordance with the technical specifications surveillance requirements.

The identified technical specification surveillance requirements involved logic system functional testing and response time testing.

The use of the temporary change notice to change the intent of the procedure to allow core injection was a violation of Technical Specification 5.4.1.a, which required written procedures to be established, implemented, and maintained for those activities outlined in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978 (50-397/9805-03).

Subsequently, the licensee identified that the temporary change notice had altered the method by which the acceptance criteria test data would have been obtained.

Specifically, Procedure TSP-DG2/LOCA-B501, Section 7.2.32, Steps c and d, to determine the time to peak residual heat removal discharge pressure for Pumps B and C were altered.

These steps were appropriately "N/A'd"and did not affect the outcome of the test..

Licensee personnel decided that the test could be conducted by overriding the open signal of the injection valves for the low pressure safety injection mode for the residual heat removal Trains B and C rather than closing the manual valves in the containment.

This required another change to the test, with Temporary Change Notice 98-113, a one time only change, to prevent the opening of the residual heat removal injection valves.

The change, however, resulted in unintended actions during the conduct of the test. A substep was inserted following the Step 7.1.33, which stated, "Perform Substeps a, b, and c simultaneously."

Substep a stated, "Hold RHR-V-42B and RHR-VP2C control switches in the CLOSE position until RHR-P-2B and RHR-P-2C start and the manual override lights are on." This change created the circumstance that the actions in Substeps b and c could be inadvertently performed before the intended override function of Substep a took effect. Substeps b and c initiated a test signal downstream of the drywell pressure and reactor vessel low level actuation signals.

Once the Residual Heat Removal Valves 42B and 42C began to open they would not return to close on the override signal until they stroked full open.

This would allow the injection valves Residual Heat Removal Valves 42B and 42C to cycle full open to full close.

Because these are large motor-operated valves, a full open to close cycle would take approximately 1 minute.

During the test, this circumstance occurred and resulted in approximately 5,000 gallons of wetwell water being injected into the reactor vessel as evidenced by an increase in reactor vessel water level from 33 to 59 inche The team discussed the test change with the.author', who acknowledged that the change did not adequately describe his intent. The original intent was to have the Residual Heat Removal Valves 42B and 42C control switches in the CLOSE position, b~ fore the test signal was introduced to the logic circuit. This would have precluded the valves from opening because the override function would be in place prior to the valve open signal.

During a shift turnover, the proposed test conduct was reviewed by the oncoming shift manager and control room supervisor with the author, who was the offgoing shift manager.

During the turnover, the intent of the test was discussed, and the method of conduct was reviewed.

However, the realization that performance of the procedure, as written, could result in the injection valves opening was apparently lost.

Temporary Change Notice 98-113 made.to Procedure TSP-DG2/LOCA-B501, Step 7.1.33, Substep a, resulted in a procedure inadequate to the task of preventing inadvertent injection to the reactor vessel.

The procedure, therefore, was not appropriate to the circumstances.

This is an example of a violation of Technical Specification 5.4.1.a, which required written procedures to be established, implemented, and maintained for those activities outlined in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978 (50-397/9805-04).

During the prejob briefing on the night shift, the process of the test was reviewed with all test participants present.

A standard prejob briefing was performed, rather than the prejob briefing described in Procedure PPM 1.16.6C, "Conduct of Infrequently Performed Tests or Evolutions." When queried about the reason the test was not conducted under the provisions of Procedure PPM 1.16.6C, licensee managers indicated that the test Procedure TSP-DG2/LOCA-B501 had not been previously performed under Procedure PPM 1.16.6C and that it was not deemed to be necessary for this particular occasion because the intent was only to establish functionality of the Division 2 residual heat removal low pressure safety injection mode.

The team reviewed the licensee's established good practice for the conduct of infrequently performed tests.

The team noted that Procedure PPM 1.16.6C, "Conduct of Infrequently Performed Tests or Evolutions," Revision 6, Section 5.1 defined infrequently performed tests and evolutions as tests or evolutions which have the potential to significantly degrade the plant's margin of safety or meets any of the established criteria.

The team identified that the test met the requirements for an infrequently performed test.

Specific'ally, Section 5.1.1 identified evolutions not specifically covered by existing normal or abnormal operating procedures and Section 5.1.3, defined "Special, infrequently performed surveillance testing that involves complicated sequencing or placing the plant in unusual configurations, (e.g., Complex Logic System Functional Tests)."

Section 3.2.1 stated that the work week supervisor should complete Attachment 7.1 to Procedure PPM 1.16.6C if a test met the criteria in'Section 5.1 for an infrequently performed test. This attachment provided for the appointment of a test coordinator.

Section 3.3.2 provided that a test coordinator complete Attachment 7.3 to Procedure PPM 1.16.6C, which established the use of a prejob briefing checklis Attachment 7.3 was not utilized to screen the test procedure.

The team reviewed the test against the criteria in Attachment 7.1 and concluded that the scoring would have indicated that a test coordinator be designated and, therefore, a prejob briefing should have been conducted in accordance with Attachment 7.3. This appears to be the minimum good practice for the conduct of a test of this nature.

Although a prejob brief was conducted prior to the conduct of the test, it was not done in accordance with Attachment 7.3 of Procedure PPM 1.16.6C.

The team noted that the control room supervisor performed the function of a test coordinator, however, the function was not identified as an infrequently performed test.

The team identified the failure to implement the infrequently performed test procedure good practice as a weakness with the overview and control of the complex test.

Reacor rel olai n lin S s 0 era ion The reactor core isolation cooling system automatically initiated on Level 2 water level (-50 inches) following closure of the main steam isolation valves. The system along with the high pressure core spray injected into the reactor vessel for approximately 1 minute before the reactor core isolation cooling system steam supply isolated and the high pressure core spray injection valve closed on high water level (+54 inches).

Emergency Operating Procedure 5.1.1, "RPV Control," Revision 12, provided for reactor pressure vessel level, reactor pressure vessel pressure and reactor power control.

Reactor pressure vessel level control required the verification of all isolations, emergency core cooling system initiation and emergency diesel initiation. Subsequently, reactor pressure vessel level was to be maintained between +54 and+13 inches using several injection systems, including reactor core isolation cooling. The licensee implemented the use of the reactor core isolation cooling system for reactor vessel level control.

Approximately 10 minutes after the main steam isolation valves closed, the operators attempted to manually initiate the system for level control. The reactor core isolation cooling system trip and throttle valve (Valve 1) tripped on the initiation. The valve was manually run back to the closed position and slowly jogged open.

The system subsequently responded as expected and there were no further problems observed with the performance of the trip and throttle valve for the remainder of the event.

Work Order, "Reactor Core Isolation Cooling-V-1 Low Risk Troubleshooting Pl," was initiated on March 15, 1998, to troubleshoot the trip and throttle valve. The licensee subsequently identified several items, which in the aggregate, the licensee concluded resulted. in the trip and throttle valve tripping. These items inc!uded:

The locking screws for the trip hook assembly pin had loosened; There was only 50 percent engagement between the trip hook and the latching-up lever;

-18-The connecting rod between the over speed trip and the trip and throttle valve radius lever was too short (adjustment), reducing the required 1/8 to 3/16 inch impact space to essentially zero; and The interface of the trip hook and latching-up lever had an accumulation of an unknown foreign material.

The team reviewed the work history for the reactor core isolation cooling trip and throttle, valve for the past 5 years.

No work activities were identified which would have resulted in the above conditions. The licensee was continuing to review the cause for these identified conditions as part of their maintenance rule process evaluation.

During subsequent operation of the reactor core isolation system, the operators attempted to establish reactor core isolation cooling flow back to the condensate storage tank using the test return line. This mode of operation was allowed by the licensee's system operating procedure and would have better facilitated level and pressure control by maintaining a higher steam demand but diverting part of the injection flow back to the condensate storage tank. When the operators attempted to open the test return line isolation valve (Reactor Core Isolation Cooling Valve 59), in accordance with System Operating Procedure 2.4.6, "Reactor Core Isolation Cooling System," Revision 25, the valve failed to open. Additional attempts to open the valve with the reactor core isolation cooling system shutdown were unsuccessful.

The team noted that in 1988 there was difficultyexperienced in establishing the reactor core isolation cooling system in the recirculation mode when the Reactor Core Isolation Cooling Valve 22 could not be closed and Valve 59 was used to maintain the appropriate flowto the reactor vessel.

Final Safety Analysis Report, Section 5.4.6.2.5.1, Amendment 49, "Automatic Operation,"

described the operation of the reactor core isolation cooling system in the condensate storage tank to condensate storage tank mode and allowed for shifting between the injection and condensate storage tank mode of operation.

However, the licensee was required to declare the reactor core isolation cooling system inoperable with the test

~

return line valves open (Reactor Core Isolation Cooling Valves 22/59) because their passive safety function was not met while open.

This function included maintaining the extended containment isolation boundary and ensuring the reactor core isolation cooling system was capable of supporting decay heat removal and short-term cooling.

The licensee had established the reactor core isolation cooling system within the scope of the maintenance rule and classified it as risk significant. Performance criteria were established for system reliability and availability. The criteria for reliability were no more than three maintenance preventable functional failures within a 2-year period or one repeat failure. Availabilitywas based on the system being out-of-service for no more than a 1000 hours0.0116 days <br />0.278 hours <br />0.00165 weeks <br />3.805e-4 months <br /> during an 8-quarter period.

From July 10, 1996, through March 11, 1998, the reactor core isolation cooling system had been classified as an 10 CFR 50.65(a)(2) system which stated that monitoring, as specified in 10 CFR 50.65(a)(1), was not required where it has been demonstrated that the

-19-performance or condition of a structure, system, or component was being effectively controlled through the performance of appropriate preventive maintenance, such that the structure, system, or component remains capable of performing its intended function. No specific industry experience relative to operation of the test return line valve (Reactor Core Isolation Cooling Valve 59) was identified other than the licensee declaring the reactor core isolation cooling system inoperable when the test return line valves were open.

The licensee had established surveillance and preventive maintenance requirements for the test return line valves. A 72-week inspection and valve stroke test had been established for the Reactor Core Isolation Cooling Valve 22. A 96-week lubrication and inspection was established for Valves 22 and 59. Surveillance Procedure OSP-Reactor Core Isolation Cooling-IST-Q702, "Valve Stroke Test," to stroke the valves and verify the valves'ndications was established on a 2-year schedule.

The team noted that the licensee had not established preventive maintenance or surveillance requirements that would demonstrate performance of Valves 22 and 59 for the conditions required by the emergency operating procedures, as implemented by the system operating procedure.

The licensee identified that the reactor core isolation cooling system was declared inoperable whenever the Reactor Core Isolation Cooling Valves 22 and 59 were open, in accordance with Generic Letter 96-05, "Periodic Verification of Design-Basis Capability of Safety-Related Motor-Operated Valves." This is in recognition that the valves were outside the scope of their Generic Letter 89-10, "Motor-Operated Valve Testing and Surveillance, " program. The licensee stated that the previous design of Reactor Core Isolation Cooling Valve 59 was not to be able to open against system operating pressure.

Generic Letter 89-10, "Consideration of Valve Mispositioning in Boiling Water Reactors,"

Supplement 4, dated February 12, 1992, did not require establishing testing of valves for conditions caused by operational errors from the control room.

The operating guidance provided was to open the Reactor Core Isolation Cooling Valve 59 first, prior to the upstream Reactor Core Isolation Cooling Throttle Valve 22.

The licensee indicated that Valve 59 failed because Valve 22 either leaked by or was opened coincidently with the Valve 59. The licensee's evaluation of the Reactor Core Isolation Cooling Valve 59 failure determined that the valve thrust was not adequate to ensure it could be opened and closed against the system operating pressure.

The licensee has also removed the shifting from the injection mode to the condensate storage tank to condensate storage tank mode of operation from the system operating procedure.

The maintenance rule required that the licensee monitor the performance of components included within the scope of the maintenance rule against established goals, in a manner sufficient to provide reasonable assurance that components are capable of fulfillingtheir intended functions.

Such goals shall be established commensurate with safety.

The

-20-maintenance rule also provided that monitoring is not required where it has been demonstrated that the performance or condition of a component is being effectively controlled through the performance of appropriate preventive maintenance, such that the system or component remained capable of performing its intended function.

The licensee had identified that the Reactor Isolation Cooling Valves 22 and 59 should not be included within the scope of the maintenance rule. The basis was that the valves were outside the scope of Generic L'etter 89-10, "Motor-Operated Valve Testing and Surveillance," and Supplement 4, "Consideration of Valve Mispositioning in Boiling Water Reactors," does not require testing of valves because of inadvertent operation of motor-operated valves from the control room. The NRC staff willreview the licensee's position on this matter as an unresolved item (50-397/9805-05).

on Iusions The licensee effectively addressed the cause of the main steam line isolation valve containment air supply line failure. Airsupply line seismic and material fatigue concerns were appropriately addressed.

Common cause failure of the other main steam line isolation valve instrument air lines was reviewed and determined not to be a concern.

Identified deficiencies were corrected before plant restart.

The safety relief valves initial operation was within the established relief set points.

Additional manual operation was effective in controlling reactor pressure and appropriately sequenced to distribute the heat load evenly throughout the wetwell.

Observed indications showed that the safety relief valves functioned as expected in the automatic mode and during manual actuations.

Initial operator response and plant recovery were complicated by problems experienced with the control rod position indication and inability to operate the reactor core isolation cooling system in accordance with the system operating procedure.

An unresolved item was identified regarding implementation of the maintenance rule for the reactor core isolation cooling system.

Additional NRC review of the licensee's contention that the valves are excluded from the maintenance rule based on Generic Letter 89-10 and its supplements and that the system was declared inoperable when the valves were opened is needed to resolve this issue.

The licensee aggressively addressed concerns with the Division II logic system performance during the event and verified the Division II logic sy'tem functionality.

However, the licensee did not effectively control or implement the surveillance test that demonstrated the logic performance.

Effective management control was not implemented for the procedure temporary change process and control of infrequently performed tests and surveillances.

Two violations were identified for changing the intent of the logic system test and revisions which resulted in an inadequate procedure using the temporary change notice proces.

2.3 Com arison f h Plan Re nse o he Desi n Basi and imul or M del The team reviewed the plant response to the main steam isolation valve closure and reactor scram to the final safety analysis report and previous main steam isolation valve closures.

The plant-specific simulator response was assessed for fidelity issues.

b.

Obse a i n an indin s Re r

r ssure andi velre ons The license had not experienced Level 2 actuations of the high pressure core spray and reactor core isolation cooling systems during previous main steam isolation valve clo."ures. The difference in the plant level response appeared to be the result of the one main steam isolation valve closing seconds before the others and the higher thermal power in 1998 (power uprate since last main steam isolation valve closure).

The team reviewed the Final Safety Analysis Report and engineering analysis (MAAP)of the current plant conditions.

The main steam isolation valve closure was determined to be properly bounded by the Final Safety Analysis Report.

Plan-ecifi i

ula or Through discussions with simulation facility and training department key personnel, the team determined that the reactor pressure vessel level response was not properly modeled on the simulator. This modeling deficiency affected any dynamic simulated evolution related to varying pressure and level such as main steam isolation valve closure, safety relief valve opening and closing, or operation of the reactor core isolation cooling system.

Once the simulated event progressed to the point of reactor pressure vessel level stabilization, the simulated event consistently modeled the actual plant event.

For example, the heat up and pressurization of the drywell to the 1.65 psig set point after the loss of the reactor closed cooling system was consistent with the time line of the actual event.

It was noted that the licensee had previously identified a simulator modeling deficiency related to core shrink and swell during safety relief valve operation in August 1997. Similar event scenarios conducted on the simulator indicated that reactor pressure vessel level decreased only to -40 inches and no Level 2 isolations or actuations occurred.

As a result of the March 11, 1998, event sufficient plant data existed such that the simulator can be more accurately updated.

This update is expected to take place within the next 6 month In addition to the above, the team was informed that operation of the reactor core isolation cooling system to control reactor pressure vessel level using the Reactor Core Isolation Cooling Steam Admission Valve 45, as required during the event because of the inability to open Reactor Core Isolation Cooling Valve 59, was not an evolution trained for on the simulator.

c.

Qgn(~li i~n Reactor pressure vessel level shrink and swell were not modeled well on the plant-specific simulator for dynamic simulated evolutions. The licensee has initiated corrective actions to update the simulator model to more consistently refiect the plant's operation.

3.

Licensed and Nonlicensed Operator Performance ( 71001, 71701)

onr IR m

a n

in se o

Ev t

The team reviewed the control room staff response during the event based on the available plant indications (computer data), control room logs, system actuations and personnel interviews. Further, the team ascertained the extent to which the control room staff was aware of the initial reactor vessel level transient and the automatic actuations of the emergency core cooling and engineered safety feature systems.

erva io s nd Findin eraorEv n R The team discussed the event with the control room staff on shift during the event, reviewed the post scram report and reviewed the operating crew debriefs conducted on March 11 and later updated on March 15. During the event there were several equipment issues, including operator work around issues, which proved a distraction to the operators.

During the first minute of the event, the operators'ttention was focussed on control rod position indication problems, assuring nuclear instrumentation was operable, and valve position indications that were not illuminated.

As previously described, there were four control rods which initiallydid not have position indication that they were fully inserted.

This problem had been experienced previously.

Management expectations and continuing licensed operator training established the use of operator peer checks to verify bottom control rod indications on the rod sequence control system, four rod display, the full core rod display, and the "N-1" plot screen from the plant process computer.

Although the control room supervisor and the shift manager took up positions at the emergency operating procedures table immediately following the scram, their attention was directed towards verifying the control rod positions and not the

-23-oversight of the plant response to the transient.

During this period the reactor vessel level decreased to the Level 2 engineered safety feature and emergency core cooling system actuation set point.

While not proceduralized, it was the licensee's expectation to have a second individual verify the control rod full-instatus.

However, it was not the licensee's expectation to have all individuals in the crew focused solely upon the control rods.

Discussions with key training managers indicated that typically during operator training in the simulator the second verifier of control rod status is the shift technical adviser while the secondary plant operator verifies status of the balance of plant systems, turbine tripped, and other secondary operator immediate actions.

During the first minute of this event, the reactor operators, as well as, the control room supervisor, shift manager, and the shift technical adviser focused their attention solely on the control rod status and missed other key plant operating parameters (i.e., level shrinking to -50 inches).

Additionally, it was the licensee's expectation that the control room supervisor and shift manager focus on all key plant parameters (reactor power, reactor pressure vessel level, and reactor pressure vessel pressure).

It was the responsibility of the control board operators and the shift technical adviser to provide this information.

Subsequently, the shift manager directed the control room supervisor to focus on reactor pressure vessel level and pressure control. By this time, reactor vessel. level had already decreased to -50 inches (Level 2) and then swelled to +70 inches because of reactor core isolation cooling and high pressure core spray injection and the swell associated with the two safety relief valves lifting on increasing reactor pressure above 1076 psig.

None of the operators recognized that level had decreased to the -50 inches.

The team was concerned with the initial failure of the operators to recognize that the reactor core isolation cooling and high pressure core systems had automatically initiated on Level 2 given that Emergency Operating Procedure 5.1.1, "RPV Control," Revision 12, provided for reactor pressure vessel level, reactor pressure vessel pressure and reactor power control. Reactor pressure vessel level control required the verification of all isolations, emergency core cooling system initiation and emergency diesel generator initiation.

Later into the event, one of the operators went to the high pressure core spray control board and observed the "High Pressure Core Spray Actuated" and the "Reactor Core Isolation Cooling" annunciator windows illuminated as well as the "Amber High Pressure Core Spray Initiation Seal-in" light illuminated on Control Board H13-P601. The operating crew did not observe the reactor pressure vessel Level 2 annunciator windows illuminate or slow flash once the condition had cleared.

The control room supervisor directed the crew's actions from Emergency Operating Procedure PPM'5.1.1 to control pressure between 900 to 1000 psig using the safety relief valves.

Service Water Pump 1A and Residual Heat Removal Pump 2A were started for wetwell cooling. The control room supervisor observed that reactor closed cooling pumps had tripped and the valves to the drywell isolated.

This occurred when the vessel level initiallydropped to -50 inches.

Discussions with the reactor operators indicated that they had a "Green board" (i.e., auto valves in the closed position) on

-24-Control Board H13-P601.

Attention was directed to regain reactor closed cooling water to the drywell coolers to preclude drywell pressure from reaching the 1.65 psig set point.

The control room supervisor directed resetting the nuclear steam supply shutoff system when drywell pressure reached 1.4 psig and also had the operators start the second Residual Heat Removal Pump 2B for wetwell cooing. Approximately 10 minutes into the event, the Standby Gas Treatment Fan SGT-FN-182 was started to help lower drywell pressure which had risen to 1.52 psig. Shortly thereafter, one of the reactor operators manually started the reactor core isolation cooling pump to control vessel level; however, the turbine tripped at about 5400 rpm (below the overspeed trip set point). A second operator ran back the reactor core isolation cooling trip and throttle valve and successfully restarted the reactor core isolation cooling pump.

Engineered safety feature actuations occurred when the drywell pressure reached approximately 1.65 psig.

Both the Division I and II emergency diesel generators started.

Drywell pressure was subsequently reduced through operation of the reactor closed cooling water system and drywell venting using the standby gas treatment system.

Drywelll pressure was maintained below the set point for full emergency core cooling system actuation.

The operators also observed that intermediate Range Monitor G indication was out (i.e.,

light off), Source Range Counter C failed to drive in initiallybut was later inserted, and several valve position indications were not available due to light bulb failures (approximately 10). This included five lights associated with the reactor, core isolation cooling system and three for the safety relief valves.

The operators had checked the control board indications bulb status at the beginning of the shift; however, many of these bulb indication problems did not become apparent until the valve positions changed.

The licensee was reviewing the potential cause for bulb failures.

The operators established vessel level and pressure control using the reactor core isolation cooling system and manual actuation of the safety relief valves.

The operators were unable to establish reactor core isolation cooling recirculation flow back to the condensate storage tank because of the inability to open the test'return line isolation valve (Valve 59). This resulted in the operators manually starting and stopping the reactor core isolation cooling system using Steam Supply Valve 45. This mode of operation was not explicitly described by the system operating procedure or used in simulator activities. This created a difficultoperator work around for controlling vessel level between+13 and+54 inches, as required by the emergency operating procedures.

This operation was further complicated by a second reactor operator attempting to control pressure between 900 to 1000 psig by opening and closing the safety relief valves.

The team noted that the operators had not established an effective plan for controlling vessel level prior to resetting the reactor scram.

Subsequently, a second reactor protection signal was initiated when vessel level could not be recovered prior to reaching

+13 inches following safety relief valve manual actuation for pressure control and the need to manually restart the reactor core isolation cooling syste At approximately 38 minutes into the event, an operator was directed to secure the high pressure core spray pump and the Division III high pressure core spray emergency diesel generator.

Procedure PPM 2.7.3, "High Pressure Core Spray Diesel,"

Revision 29, was utilized, but did not provide adequate direction for the shutdown of the high pressure core spray system.

The procedure did not direct verifying the high pressure core spray initiation seal-in on P601 control board was reset.

However, because the high pressure core spray initiation signal was sealed in and the operator did not observe the amber seal-in light illuminated on Control Board H13-P601 and reset the push button, the high pressure core spray diesel automatically reinitiated. While Procedure PPM 2.7.3, Section 5.12, directed a check to ensure that no emergency core cooling system signal was present (Annunciators 4.601.A1-1.7, 1.8, and 2.3), it did not mention the high pressure core spray initiation seal-in on P601 control board. The team identified the inadequate procedure for shutdown of the Division III emergency diesel generator as an example of Violation 50-397/9805-04.

Subsequently, the operator reset the seal-in and secured the high pressure core spray diesel.

Discussions with operations management and a training department representative indicated that the ability to shutdown the high pressure core spray diesel is an expected operator knowledge and ability even though the procedure did not address the amber high pressure core spray initiation seal-in light and reset push-button.

~

The team also noted similar operator knowledge deficiencies with regard to the performance of the logic system functional test on March 12.

In this case the operators failed to recognize the override feature interaction with the valve's design for emergency core cooling system injection override. This resulted in the low pressure coolant injection system injection into the vessel until the injection valve could be overridden and closed.

In addition to the above, other instances of weak operator attentiveness were noted from the event. As a result of safety relief valve operation, the wetwell temperature hovered around 88'

and at times increased to above 92', with the emergency operating procedure entry condition of. 90'

for Procedure PPM 5.2.1 "Primary Containment Control." At one point, the shift technical adviser missed the fact that wetwell temperature rose above 90'. An NRC inspector also observed that the control room operators did not identify when an emergency operating procedure entry condition was again met. The licensee has established a management expectation that the control room operators and shift technical advisor willspecifically identify when an emergency operating procedure entry condition is met. The team verified that the emergency operating procedure required actions had been taken.

Within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the event, the operators were able to reestablish normal pressure and level control using the condensate system and bypass valves.* The plant was subsequently placed in Mode 4 (less than 200').

-26-r Pre r V ss ICo I own During the plant cooldown, the operators implemented Surveillance Procedure OSP-RCS-C012,

"RPV Cooldown Surveillance," Revision 0, paragraph 7.11. This procedure required the control room operator to verify the minimum reactor vessel metal temperature and pressure were within the acceptable area of the curve established by the minimum allowable temperature and pressure (Attachment 9.1, Minimum Vessel Metal Temperature V.S. Reactor Vessel Pressure) at least once per 30 minutes and initial Attachment 9.4, "Coo!down Temperature and Pressure Log."

During the event, the reactor water cleanup system isolated.

This resulted in the normal temperature indications not being available.

The operators were not able to reestablish the reactor water cleanup system for temperature monitoring because of high nonregenerative heat exchanger temperatures, which prohibited placing the system in service based on the procedural guidance provided. Therefore, the operators utilized reactor pressure vessel metal temperature indication as directed by the procedure.

During the period the vessel temperature was being monitored by metal temperature, the indicated minimum temperature for the given pressure was exceeded.

The team identified the failure to appropriately verify and maintain the cooldown within the limits established by surveillance Procedure OSP-RCS-C012 as a violation (50-397/9805-02).

The licensee's subsequently performed an engineering analysis, based on the vessel water temperature measured after the reactor water cleanup system was restored, which indicated that the cooldown curve had not been violated and no adverse thermal effects were experienced by the vessel.

As part of their corrective actions, the licensee developed a table of digital data in 5'

increments as an operator aid. The operators were trained on the revised procedure prior to the startup of the plant.

~Conci sions The operators demonstrated the ability to respond to a complex transient and maintain the plant in a safe configuration while proceeding with a cooldown to Mode 4.

However, several operator performance weaknesses were identified based on operator knowledge deficiencies in recognizing expected plant response and verifying that the appropriate engineered. safety feature and emergency core cooling system actuations had occurred.

These included recognizing plant conditions for: emergency operating procedure implementation; required actions prior to resetting equipment and actuation signals; and expected system responses.

A violation was identiTied for the failure to maintain the reactor vessel pressure and temperature within the limits established by the cooldown surveillance procedur A second example of a violation of an inadequate procedure was identified for the shutdown of the Division III emergency diesel generator.

3.2 0 er or Work r u ds WhichAffe ed sem and 0 era r Perform nce a.

~op The team reviewed operational workarounds, which resulted in distractions to the operators during the initial event and implementation of recovery actions.

b.

b ervaion an F

i s

The team noted that several operational workarounds existed based on known plant problems, procedural deficiencies, or had been proceduralized because of regulatory requirements and/or decisions not to qualify system components. These time consuming and confusing situations infused additional challenges to the operators.

Examples included: reactor core isolation cooling system operation in the recirculation mode and later operation of the system in a manner not specifically described by the system operating procedure because of a valve failure; backup verification method needed to verify control rod positions; inability to restore the reactor water cleanup system in accordance with the procedure; and declaration of the main steam leakage control system inoperable with the main steam bypass valves open.

In order to control vessel level with reactor core isolation cooling within a narrow level band (+13 to +54 inches) the operators attempted to open the condensate test return line, which required the system to be declared inoperable during the period the system was being used to maintain vessel water level. Subsequently, the isolation valve failed to open which required the use of an alternative method of reactor core isolation cooling system control. Specifically, the turbine steam admission valve (V 45) was used to start and reinitiate the turbine. This mode of operation is not specifically proceduralized and posed an additional challenge to the operator in attempting to maintain vessel level control between +13 to +54 inches.

The operator's task was further complicated by the fact that a second operator was maintaining pressure between 900 to 1000 psig by opening and closing the safety relief valves. As a result, the plant experienced a second scram signal initiation when level fell to +13 inches.

Discussions with training department staff indicated that the operator task of controlling reactor core isolation cooling with the steam admission valve was not one for which the operators were specifically trained on the simulator (but within the knowledge and abilities of the operators).

Therefore, this operator work around represented a first time performed evolution by the operator.

In another instance, the operators were distracted by concerns with thermal stratification in the lower reactor pressure vessel head region. The operators wanted to reopen the reactor water cleanup system to allow for more accurate reactor water temperature measurement during cooldown and to assist with resolving reactor recirculation pump

-28-start cavitation interlocks.

However, because the nonregenerative heat exchanger outlet temperatures were above the isolation set point, the operators could not unisolate the reactor water cleanup system even with the demineralizers bypassed.

The crew appropriately chose not to bypass the demineralizers, but were still challenged in that only reactor vessel metal temperatures were available for them to monitor the cooldown.

~nl~io Operator workarounds contributed to operator performance concerns through distractions and the need to implement alternate means to operate needed systems and components.

The operator work around issues appeared in important areas involving vessel level and pressure control, and the ability to reestablish temperature monitoring and forced circulation.

3.3

'on IMan me v

i ru ur Im e

d ur'

v nt The team evaluated the management oversight structures implemented by the licensee during the event, with emphasis on overall effectiveness, unity of command, compliance with license conditions, and relevant procedures.

bserv i

Fi din s While the operating crew was successful in addressing the plant transient and stabilizing the plant, several instances were identified where management oversight (command and control) exercised during the event was not adequately focused.

The team found that the shift management initiallywas focused on the control rod position indication problem and actively engaged in resolving the concern.

During this period the severity of the level transient was not identified and subsequent use of the emergency operating procedures failed to adequately assure that all the appropriate actuations had occurred.

Subsequently, the shift management did not assure that plant conditions were appropriately established for resetting reactor protection system and engineered safety feature actuations. Specifically, the initial conditions for resetting the Division III emergency diesel generator were not recognized and adequate pressure and level control had not been established prior to resetting the reactor protection system.

Communications to the NRC (as discussed in Section 4 of this report) were of an extremely poor quality and did not provide an accurate overview of plant conditions.

Essential equipment status was not understood and communicated to the NRC operations officer. Communications within the shift were not effective as indicated by the cooldown procedural violation and the low pressure coolant injection to the vessel during testing activities the following da c

~Concl sions While the operating crew successfully responded to the event and stabilized the plant prior to proceeding with the cooldown, shift management had difficultyin prioritizing the crew's efforts. Weaknesses in shift management oversight were illustrated by a lack of focus on evolving plant conditions and assuring recovery actions were appropriately implemented.

4.

Effectiveness of Licensee Emergency Response and Notifications (71707, 82201)

The team reviewed the adequacy of,the licensee's emergency event response and their communication of the plant event to the NRC staff.

bserv ion and Findin The shift manager reviewed Procedure PPM 13.1.1, "Classifying the Event," Revision 24, and determined that no emergency action level declaration was required.

This activity was later peer checked by a second licensed operator.

~

The team reviewed the initial and followup reports made to the NRC operations officer regarding the March 11 reactor scram.

The team found that the identification and dissemination of critical plant status information to the NRC was inadequate and did not properly reflect the plant status or the conditions which led to the reported conditions.

Of particular concern was the apparent lack of understanding of the plant status and actuations that had occurred.

For example:

The low vessel level engineered safety feature and emergency core cooling system actuations were not identified or reported as required.

Initial problems with control rod position indication were not identified.

Whether the plant was on natural circulation.

Whether the emergency diesel generators that had started had actually loaded.

The notification of the reactor protection system actuation to the NRC headquarters operation officer was performed by two shift technical advisers.

This was atypical from practiced emergency plan exercises and drills in which an equ!pment operator conducts the notifications.

In this event, it was the first time that either shift technical adviser had performed the notification tasks and acted as a communicator with the NRC. Confusion about the event existed because the operating crew did not notice reactor vessel level shrink to below -50 inches (automatically actuating high pressure core spray and reactor core isolation cooling) and then swell to+70 inches with reactor core isolation cooling

-30-and high pressure core spray injection securing as reactor vessel level passed

+54 inches.

Additionally, the shift foreman received an alarm of a main generator lockout relay trip as seen on the control room alarm typer printout, which later reset prior to the scram.

As a result, a 4-hour event notification report was made to the NRC which lacked many details of the event and incorrectly described the event initiator as a main generator lockout. A followup event notification also added confusion to the situation because the licensee reported that all engineered safety actuations associated with high drywell pressure (1.65 psig) and Level 2 reactor vessel level (-50 inches) appeared to operate correctly. This second report was in error and misleading because had all engineered safety actuations occurred upon drywell pressure reaching 1.65 psig then both low pressure Safety Injection Pumps A and B and the low pressure core spray pump would have started.

At the time the event notificatio report was made, the operators did not have actuation of all emergency core cooling system pumps, only the engineered safety feature actuation of the emergency diesels, and did not understand all details regarding the event.

Further, the notifications were not reviewed by the shift manager prior to transmission.

The event notification reports were supplemented and corrected by the licensee on March 12, 1998.

10 CFR 50.72 Section (b)(1), "Non-Emergency Events," requires that the licensee provide a report (ifnot reported as an emergency class under Section (a)), to the NRC as soon as practical and within one hour for occurrences included in paragraphs (b)(1)(l-vi).

Paragraph (b)(1)(iv) identifies any event that results or should have resulted in emergency core cooling system discharge into the reactor coolant system as a result of a valid signal.

The team identified that the 10 CFR 50.72 report provided to the NRC at 0611PST (stated event time 0507 PST), on March 11, 1998, did not identify that the high pressure core spray had actuated and discharged into the reactor coolant system because of a valid low water level signal. The 10 CFR 50.72 report and its update did not accurately reflect the integrated plant response during the event.

The team found that the 10 CFR 50.72 report provided to the NRC at 0611 PST (stated event time 0507 PST), on March 11, 1998, did not identify that the high pressure core spray had actuated and discharged into the reactor coolant system because of a valid low water level signal. The 10 CFR 50.72 report and its update did not accurately reflect the integrated plant response during the event and was a violation of 10 CFR 50.72(b)(1)

(50-397/9805-01).

Qgnclu~sio The licensee appropriately considered the emergency plan prior to determining no classification was necessary.

The failure to recognize that the high pressure core spray and reactor core isolation cooling system had actuated did not affect the emergency classificatio Communication within the control room and with the NRC headquarters operations officer regarding the overall status of the plant was poor and did not ensure that key control room personnel were cognizant of the overall plant and systems status.

Information conveyed was erroneous and required subsequent clarification and correction.

This contributed to inappropriate decisions regarding resetting equipment and contributed substantially to the NRC concerns that the event and plant response were not well understood.

A violation was identiTied for the failure to provide the required one hour event notification in accordance with 10 CFR 50.72, paragraph (b)(1)(iv).

Licensee Event Assessment and Corrective Actions (40500, 93702)

~Sco e

The team reviewed the licensee's assessment of the event and performed independent verification of selected areas with particular emphasis placed on operator performance issues.

The review included the adequacy of the licensee's review, the timeliness in assessing the pertinent event findings and corrective action implementation. The findings were reviewed against the proposed corrective actions, their scope and adequacy.

Obs rva ion Find'

Effec iven ss of he li nsee's ons and asse men f h v

The team reviewed Procedure PPM 3.3.1, "Reactor SCRAM," Revision 26, and its attachments to asses the adequacy of the post scram review. The team found that the procedure had been appropriately implemented with respect to the immediate actions and the subsequent actions.

These actions provided protection of the reactor and turbine generator following an unplanned shutdown.

This procedure also provided for the collection of'plant response data, including the computer data points and plant personnel statements.

The team noted that important equipment and operator performance information was not obtained following the reactor scram in a timely manner.

The crew debrief statements did not provide a comprehensive perspective of the event, suspected malfunctions, and recommendations to prevent recurrence, including procedural deficiencies or personnel performance problems.

The post scram review did not provide a comprehensive understanding of the event or ensure that the necessary data and equipment and performance issues Were promptly identified and addressed.

The post scram data review and operator critiques did not identify that the reactor core isolation cooling turbine had tripped during the first manual initiation. Other examples included:

The high pressure core spray diesel generator reinitiated after being shut down

-32-The high pressure core spray diesel generator and reactor water cleanup operating procedures were not adequate and required temporary change notices to be implemented for shut down and startup of the systems respectively A detailed debrief was held with the crew prior to their returning to the shift that evening.

The crew debrief provided a significantly more comprehensive debrief of the events than were provided in the scram report. The sequence of events was developed, which identified several equipment challenges that had not been identified through the scram report or subsequent reviews. This debrief significantly improved on the sequence of events, emergency core cooling system response, nuclear steam supply shutoff system performance and the procedural and diagnostic challenges because of the observed system responses and equipment operating problems.

For example, the operators identified the need to reset the scram within 15-20 minutes of the event; however, the scram was not reset until approximately 55 minutes later after attempting to establish level control within the high and low level set points. The inability to utilize the reactor core isolation cooling recirculation mode was identified as a contributor to the subsequent reactor protection system actuation on low level. Procedural guidance concerns were identified for the Division III emergency diesel generator guidance on resetting the actuation signal and reestablishing reactor water cleanup.

The need to declare the main steam leakage control system inoperable to equalize pressure around the main steam isolation valves was identified as a distraction.

However, the team noted that the problems with operator conduct of the initial cooldown and the reactor core isolation cooling system trip following the initial manual start were not identified until 2-3 days after the scram.

The identity of the four control rods for which position indication was lost immediately following the scram, was not saved for later evaluation.

The post scram reviews performed to verify the systems'erformance also did not identify the performance issues.

The team was concerned that the licensee moved from the fact finding to resolution of the issues prior to completing the initial event review.

The performance of system walkdowns following the event was mixed. The system engineer responsible for the containment instrument air system noted increased nitrogen usage for the system following post-maintenance restoration.

Subsequent troubleshooting identified the source of the nitrogen usage as two relief valves leaking past their seats.

This finding was significant in that one of the relief valves was associated with the A train of the automatic depressurization system.

Leakage from this relief valve compromised the 30-day supply of nitrogen to the A automatic depressurization system valves, a design requirement for meeting long-term decay heat removal capability. The team performed an independent walkdown of the residual heat removal, high pressure core spray, and reactor core isolation cooling systems.

The oil level on the reactor core isolation cooling turbine bearing reservoirs was found to be below the low level mark on the sight glass.

This condition was significant in that the reactor core isolation cooling system operating procedure requires the turbine bearing oil level to be maintained between the low level mark and 1/8 inch above the low level mar When oil level is below this range, the procedure directs the operators to consider declaring reactor core isolation cooling system inoperable due to the potential for inadequate lubrication to the bearings on initial turbine startup.

During this period the reactor core isolation cooling system was inoperable because of the plant being in Mode 4. The licensee stated that an operator would verify the turbine bearing oil levels prior to returning the system to operation.

Procedure PPM1.1.7, "Restart Evaluation Process," Revision 8, provided for evaluating the data obtained from the post scram review and determining the corrective actions that needed to be implemented, including any generic or common cause issues prior to plant

~ restart.

The team found that the restart evaluation process was initiated without having all the necessary equipment and personnel performance issues identified. This resulted in the restart evaluation process identifying plant and personnel performance issues that should have been identified during the post scram review. The scope of the corrective actions needed to address these issues expanded considerably during the restart evaluation process because of generic and specific concerns being identified. Most important were the operator performance issues which expanded to include crew specific and generic knowledge deficiencies.

The plant restart evaluation effectively utilized the information obtained from the reactor scram report in determining the corrective actions that were needed.

However, the plant restart evaluation process was needed to fullyidentify the operator and equipment performance issues that were missed by the post scram review. The team noted that this resulted in the restart evaluation process using an iterative approach to identify and review operator and equipment performance issues in determining the corrective actions that were needed.

The team verified that the restart issues identified by the licensee and NRC had been appropriately resolved prior to plant startup.

Con r I R m S a Defi iencies an Asso ia ed Correc ive Ac io The team independently assessed the operator performance issues and reviewed the corrective action taken prior to plant restart.

The team found the license had addressed each of the short-term operator performance issues identified by the their internal event assessment and the team's independent assessment.

The areas identified included management oversight, operator knowledge deficiencies, and communications with the crew and the NRC. Long-term actions which were initiated following the event were a training needs analysis to identify remedial training requirements and simulator exercises by each of the crews.

In addition to the above, through discussions with operations personnel and training department staff, it.was learned that during licensed operator requalification training in the simulator three reactor operators are used on the control boards for the entire length of the scenarios.

This condition is inconsistent with normal shift manning complement in the control room where two reactor operators are used to man the control boards while the third reactor operator performs duties in the operations support center outside the

-34-control room. When an event occurs or ifneeded to support some evolution the third reactor operator is called to report to the control room. The licensee has not, to date, practiced delayed entry of the third licensed operator in simulator scenarios.

However, discussions with training department staff indicated that scenarios would account for the third operator delay in the near future.

In this event, additional operators reported to the control room within 10-12 minutes after the reactor scram.

While the additional operators may have been helpful to the operating crew for establishing plant cooldown conditions, they were not available during the initial event conditions.

10 CFR 55.59, "Licensed Operator Requalification Program," did not address the makeup of crew complement used in simulator training to such specificity. However, the practice of routinely using three reactor operators on-the-boards in lieu of actual control room conditions (i.e., delayed entry of the third reactor operator) was, along with the failure of the licensee to identify this condition, a significant weakness in the licensed operator requalification training program.

This matter will be reviewed further during a future inspection (Inspection Followup Item 50-397/9805-06).

The licensee has initiated corrective actions to address both the generic and crew-specific areas for training. Allcrews received training prior to assuming their next shift. The operating crew involved in the event was to be involved with developing a training needs analysis and receive remediation training for several weeks.

~Con Iu ions The team determined that the post scram review had not been fullyeffective in providing a comprehensive understanding of the event and the procedural, performance, and equipment problems experienced.

The effectiveness of the system walkdowns was mixed. The licensee appropriately identified concerns with the containment instrument air system; however, concerns with the reactor core isolation cooling system performance and post operation condition were not promptly identified by walkdowns or plant data review.

The plant restart evaluation effectively utilized the information obtained from the reactor scram report in determining the corrective actions that were needed; however, the information provided was incomplete.

The plant restart evaluation process was needed to fullyidentify the operator and equipment performance issues that were missed by the post scram review. The team noted that this resulted in the restart evaluation process using an iterative approach to identify and review operator and equipment performance issues in determining the corrective actions that were needed.

The licensee appropriately addressed each of the short term operator performance issues before plant restart.

However, the licensee's 10 CFR 55.59 program did not address the reduced crew complement used between the control room and in simulator training, and was considered a significant weakness in the licensed operator'equalification training progra ATTACHMENT1 SPECIAL INSPECTION CHARTER

MEMORANDUMTO FROM:

SUBJECT:

UNITED STATES NUCLEAR REGULATORY COMMISSION

REGION IV

611 RYAN PLAZA DRIVE, SUITE. 400 ARLINGTON,TEXAS 76011 6064 starch 13, 1998 William B. Jones, Senior Reactor n lyst xi/~~

Division of Re tor Safety SPECIAL INSPECTION TEAM CHARTER AT WASHINGTON NUCLEAR PROJECT-2 On March 11, 1998, at about 5:16 a.m. (PST), WNP-2 experienced a reactor trip as a result of an inadvertent closure of one of the main steam isolation valves. The unexpected closure of the inboard main steam isolation valve on Steam Line D resulted in a high steam flow isolation signal on the other three steam lines. The subsequent closure of the main steam isolation valves resulted in a reactor protection signal to trip the reactor.

The main generator tripped.

In response to this event, a special inspection team is being dispatched to ensure NRC fully understands the event and license response.

The team should address the following:

(1)

Wihres ec o hecondiions ea in o heeven:

Determine the conditions which led to the event.

Identify the plant conditions prior to the main steam line closure and whether any precursors existed which could or should have resulted in licensee action.

W'hres ec o heinte rated lan es onseand even ch on Io Develop and validate a detailed sequence of events associated with the event.

Identify the specific cause of the reactor scram and how it was determined.

Review and determine ifthe plant response was predicted by the facility's design basis or accident analysis.

Determine ifthe event was properly modeled on the plant reference simulation facility. If simulator fidelityissues existed, determine ifthey had been previously identified by the licensee in its validation and certification process.

(3)

Wihr s ec othe erforma e

e ui men rio pand durin even:

Determine ifthe inboard Main Steam Isolation Valve (MSIV)for main steam line D responded as expected.

Review the performance of instrumentation and control systems and components that responded to the event, with special emphasis on such devices used as inputs to engineered safety features (ESF) or emergency core cooling system (ECCS) actuation logi William B. Jones-2-Assess the adequacy of the licensee's corrective actions, including the generic and maintenance rule implications, relative to the failure of the inboard MSIVfor main steam line D.

D Determine whether ESF actuation logic, ECCS, reactor core isolation cooling (RCIC),

and safety relief valve systems actuated during the event and functioned as designed.

This should include a specific review of the low pressure coolant injection actuation logic and whether the safety relief valves operated and reseated properly.

Determine whether the control rod position indication anomalies associated with four control rods represented a rod position indication problem or a rod performance problem.

(4)

Wihre e

o e

er e c r s s

ofthe lie nse Determine whether the licensee appropriately implemented its emergency plan implementing procedures.

Evaluate the communication channels which were exercised between the licensee and the State/local response organizations and the NRC.

Assess the adequacy of the licensee's process for reporting information to the NRC's Headquarters Operations Officer.

(5)

With res ec o li ns andnonli en edo er or rfo mance:

Identify the indications available to the plant staff (licensed and nonlicensed operators, maintenance technicians, engineers, etc.) during the event of plant status and automatic actuations and to what extent the staff aware of them, with special emphasis on understanding of control room crew awareness of reactor vessel level and actuation of automatic systems during the first few minutes of the event.

Assess the appropriateness of the actions taken by the plant staff (licensed and nonlicensed operators, maintenance technicians, engineers, etc.) in response to the event.

Determine the procedural guidance or management expectations that shaped that response.

Determine the command and control structures implemented by the licensee during the event, with emphasis on overall effectiveness, unity of command, compliance with license conditions (e.g., LCOs) and compliance with the relevant procedures.

(6)

Wihres c

o license res onse o

nd assessmen of he even Determine whether the licensee's assessment of the event was completed in a timely manner and ifit was appropriately chartered.

Also determine ifthe licensee's analysis was significantly impacted by agency involvement in the process and, ifso, how.

Assess the adequacy of the licensee's corrective action William B. Jones-3-This memorandum designates you as the special inspection team leader.

The team composition willbe discussed with you directly. During the performance of the special inspection, designated team members are separated from their normal duties and report directly to you. Safety concerns identified that are not directly related to the event should be reported to the Region IVoffice for appropriate action.

The special inspection team should report to the site by March 13, 1998. Tentatively, the inspection should be completed by March 16, 1998, with a report documenting the results of the inspection issued within 30 days of the completion of the inspection.

While the team is onsite, you willprovide daily status briefings to Region IV management, who willcoordinate with NRR to ensure that all other parties are kept informed.

Should you have any questions concerning this Charter, contact John L. Pellet, Chief, Operations Branch, Division of Reactor Safety at (817) 860-8159.

CC:

E. Merschoff J. Dyer A. Howell III P. Gwynn W. Bateman, NRR R. Dennig, NRR D. Lange, OEDO M. Wegner, AEOD C. Poslusny, NRR K. Perkins, WCFO R. Huey, WCFO H. Wong, WCFO G. Johnston, WCFO S. Boynton, SRI T. McKernon

ATTACHMENT2 DETAILEDCHRONOLOGY OF MARCH 11, 1998 MAINSTEAM LINE ISOLATIONVALVECLOSURE ND REACTOR SCRAM March 10 Reactor power at 100 percent Day The licensee noted an increase in the containment instrument air (CIA) usage (from 1 to 1.5 SCFM) and began reviewing the potential causes for the increased usage.

March 11 Reactor power was at 100 percent and all safety systems were available and in standby.

05:16:05 Main Steam Isolation Valve 22D fast closed on loss of containment instrument air (CIA) nitrogen supply to the valve operator.

05:16:10 A reactor scram signal was generated on an average power range monitor (APRM) high flux of 118 percent.

05:16:11 Nuclear steam supply system (NSSSS) isolation and all main steam isolation valves close on high main steam line flows.

05:16:13 Reactor pressure increases to 1085 psig and 2 safety relief valves automatically actuate to reduce pressure.

Each safety relief valve properly reseats.

05:16:14 The high pressure core spray diesel generator started on Level 2 (-50 inches reactor vessel level narrow range).

05:16:15 The reactor core isolation cooling and high pressure core spray systems initiated and subsequently began injection into the reactor vessel.

A main turbine trip was initiated and the reactor closed cooling system pumps tripped and was isolated from the drywell, resulting in a loss of drywell cooling. A slow increase in drywell pressure begins because of the loss of the drywell coolers.

05:16:16 Four control rod position indications were lost, requiring operators to verify the control rods had fullyinserted using the rod worth minimizer. All control rods subsequently indicated full in.

05:16:38 The reactor core isolation cooling system reached maximum flow at 860 gallons per minute.

05:17:17 The reactor core isolation cooling system automatically isolated on high reactor vessel level by closing the steam admission Valve V-4 :17:18 The high pressure core spray injection Valve 4 automatically closed on high reactor vessel level.

05:19:00 The operators started residual heat removal Pump A and service water Pump 1A in the wetwell cooling mode

.

05:26:00 The standby gas treatment system was started to reduce drywell pressure by venting.

05:26:59 The reactor core isolation cooling system tripped when manually initiated.

05:27:21 Drywell pressure increased to approximately 1.65 psig resulting in engineered safety feature actuation of the Division II emergency diesel generator.

05:28:00 The operators were able to restore the reactor closed cooling system and established drywell cooling for pressure reduction.

05:28:29 The operator was subsequently able to reclose the reactor core isolation cooling system trip and throttle valve from the control room and reinitiate the system.

05:28:35 Drywell pressure increased to approximately 1.65 psig and resulted in the engineered safety feature actuation of the Division I emergency diesel generator.

05:29:08 The high drywell pressure engineered safety feature actuation signals cleared on decreasing drywell pressure.

05:38:00 05:54:00 05:58:00 06:00:00 Standby gas treatment system secured.

High pressure core spray pump secured The operators reset the reactor scram.

The high pressure core spray emergency diesel generator was secured.

Earlier, the emergency diesel generator restarted when the system was shutdown prior to resetting the initiation circuitry 06:07:00 A reactor protection action signal initiated on low reactor vessel level. The reactor core isolation cooling system could not be operated in the recirculation mode resulting in difficultyin controlling reactor vessel level between plus 13 inches (low level) and plus 54 inches (high level).

-3-06:11:00 The licensee made a four hour nonemergency notification that a reactor protection system actuation had occurred from a main generator lockout.

07:30:00 Pressure and temperature indicated cootdown had exceeded the allowable pressure and temperature curve 07:37:00 Main steam isolation valves opened (except 22D) and main turbine bypass valves placed in auto.

07:41:00 07:44:00 07:45:00 09:00:00 Operators placed reactor pressure vessel level control in auto.

Reactor core isolation cooling injection secured.

Pressure and temperature within area on the cooldown curve Pressure and temperature exceeds the allowable limits established by the pressure and temperature curve 09:11:00 10 CFR 50.72(b)(2)(ii) 4-hour non-emergency notification of RPS actuation (scram)

10:24:00 Reactor water cleanup system placed back in service with the demineralizes bypassed:

10:28:00 10 CFR 50.72 (b)(2)(ii) and (iii)4-hour nonemergency notification of a second RPS actuation and an engineered safety feature actuation involving a reactor pressure level low level scram 10:30:00 Pressure and temperature returned to the to the right of the pressure and temperature curve (acceptable limits) based on temperature indications provided by the reactor water cleanup system.

11:13:00 March 12 Started reactor recirculation Pump 1A establishing forced circulation.

02:00:00 Plant entered Mode 4.

20:42:00 Event updated report to the NRC operations officer which provided supplemental and corrected informatio ATTACHMENT3 LISTING OF DOCUMENTS REVIEWED DURING THE SPECIAL INSPECTION Procedure TSP-CRD-C101, "CRD Scram Timing with Autoscramtimer System," Revision

Emergency Operating Procedure 5.1.1,"Reactor pressure vessel Control," Revision 12 Surveillance Test Procedure TSP-DG2/LOCA-B501, "Standby Diesel Generator DG2 LOCA Test," Revision 0 Surveillance Procedure OSP-RCS-C102,

"RPV Vessel Cooldown Surveillance," Revision 0 Procedure SWO-PRO-02, "Preparation, Review, Approval and Distribution of Procedures,"

Revision 3 Procedure TSP-DG2/LOCA-B0501,"Standby Diesel Generator DG2 LOCATest," Revision 0 Procedure PPM 2.7.3, "High Pressure Core Spray Diesel," Revision 29 Procedure PPM 1.16.6C, "Conduct of Infrequently Performed Tests or Evolutions" Procedure OSP-RHR/IST-R702, "RHR B Check Valve Operability/Refueling Shut Down,"

Revision

System Operating Procedure 2.4.6,"Reactor Core Isolation Cooling System," Revision 25 Procedure PPM 13.1.1, "Classifying the Event," Revision 24 Procedure PPM 3.3.1, "Reactor SCRAM," Revision 26 Procedure PPM 1.1.7, "Restart Evaluation Process," Revision 8 Procedure TSP-CRD-C101, "CRD Scram Timing with Autoscramtimer System," Revision

Procedure OSP-RHR/IST-R702, "RHR B Check Valve Operability/Refueling Shut Down,"

Revision

Work Order, "Reactor core isolation cooling-V-1 Low Risk Troubleshooting Pl," was initiated on March 15, 1998 Generic Letter 89-10, "Motor-Operated Valve Testing and Surveillance," and Supplement 4,

"Consideration of Valve Mispositioning in Boiling Water Reactors" Generic Letter 96-05, "Periodic Verification of Design-Basis Capability of Safety-Related Motor-Operated Valves"

ATTACHMENT4 SUPPLEMENTAL INFORMATION PARTIALLIST OF PERSONS CONTACTED ANDATTHE PUBLIC EXIT MEETING

~ien<~e D. Coleman, Regulatory Affairs Manager D. Giroux, System Engineering D. Hillyer, Radiation Protection Manager T. Hoyle, Engineering Programs D. Kobus, Fire Protection A. Langdon, Assistant Operations Manager P. Inserra, Licensing Manager S. Oxenford, Operations Manager G. Smith, Plant General Manager J. Kane, Acting Engineering Manager R. Webring, Vice President Operations Support INSPECTION PROCEDURES USED IP 37551:

IP 40500:

IP 61726:

IP 71001:

IP 71707:

IP 82201:

IP 93702:

Onsite Engineering Effectiveness of Licensee Controls for Identifying, Resolving and Preventing Problems Surveillance Observations License Operator Requalification Program Plant Operations Emergency Detection ad Classification Prompt Onsite Response to Events ITEMS OPENED, CLOSED, AND DISCUSSED Qpened 50-397/98005-01 VIO 50-397/98005-02 VIO 50-397/98005-03 VIO 50-397/98005-04 VIO failure to provide 10 CFR 50.72 one hour notification failure to meet surveillance Procedure OSP-RCS-C102,

"RPV Vessel Cooldown " requirements procedure temporary change notice used to modify the intent of logic system functional test inadequate procedures provided for shutdown of high pressure core spray system diesel and Division II logic functional test

-2-50-397/98005-05 URI reactor core isolation cooling test return line valves within the scope of the maintenance rule 50-397/98005-06, IFI 10 CFR 55.59 program did not address reduced operating crew compliment used between the control room and simulator training