A08881, Responds to NRC Re Violations Noted in Insp Rept 50-423/90-08.Corrective Action:Operators Directly Involved W/Event Removed from Licensed Duties & Counseled by Operations Manager on Causes of Event

Responds to NRC Re Violations Noted in Insp Rept 50-423/90-08.Corrective Action:Operators Directly Involved W/Event Removed from Licensed Duties & Counseled by Operations Manager on Causes of Event

ML20058L138
Person / Time
Site:	Millstone
Issue date:	07/31/1990
From:	Mroczka E NORTHEAST NUCLEAR ENERGY CO., NORTHEAST UTILITIES
To:	Martin T NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
References
A08881, A8881, NUDOCS 9008060376
Download: ML20058L138 (8)

Text

- - ,

e

[, -

General Othces

• Seiden Street, Bethn. Connecticut 6

"','(("L","Z" '"" P.O. BOX 270

. ., n, . ,a c..,,, HARTFORD. CONNECTICUT o6141-0270 g ' J m*=> mai i. .cw. (203) 665-5000 b

j I

+ July 31, 1990 Docket No. 50-423 A08881  ;

Ret 10CFR2.201 1

Mr. T. T. Martin j Regional Administrator, Region 1 U.S. Nuclear Regulatory Commission 475 Allendale Road-King of Prussia, PA 19406 1 l

References (1) E. C. Venzinger Letter to E, J. Mroczka, Hillstone 3 Routine Incpection 50-423/90-08, dated aiy 3, 1990.

Gentlemen:

Millstone Nuclear Power Station, Unit No. 3 Response to Notice of Violation Inspection Report 50-423/90-08 l l

l In a letter dated July 3, 1990 [ Reference (1)], the NRC transmitted the results of their routine resident safety inspection conducted at Millstone Unit No. 3 from May 3, 1990 to June 11, 1990. In its letter the staff r identified two Severity Level IV Violations. The Staff requested that Northeast Nuclear Energy Company (NNECO) respond to the Notice of Violation within 30 days of the date of the Inspection Report. Pursuant to the provisions of 10CFR2.201, NNECO hereby provides the following response to

'the Notice of Violation contained in Reference (1).

~NNECO Response to Violation Concerning Procedure Use  ;

UNECO's response to the Severity Level IV Violation concerning procedure i use identified by the Staff is set forth below:

l t

l l

l 9008060376 900731 PDR ADOCK 05000423 PDC i

g 1 oS3424 REV. 4484 r60/ ys 1

I - U. S..Nuc100r R:gulotory 0:mmissien JA08881/Page 2

' July 31, 1990 Staff's Statement of the Violation Millstone Unit 3 Technical Specification 6.8.1, requires, in part, that vritten procedures be established, implemented and maintained, as recommended in Appendix A of Regulatory Guide 1.33, Revision 2, February 1978. Main Steam System Operating Procedure, OP 3316, and Accumulator Low Pressure Safety injection, OP 3310B, are procedures recommended by Regulatory Guide 1.33.

(a) OP 3316 states that the main steam isolation valves (MSIVs) are to be opened only when the differential pressure across the valves is less than 25 pounds of differential pressure.

(b) OP 3310B contains a note prior to Section 7.2 which prohibits use of that section while in Mode 3.

Contrary to the above, on May 12, 1990, an operator opened the HSlvs with a 60-70 pound differential pressure. This decreased steam generator pressure and caused a steam generator swell which resulted in an engineered safety feature actuation. On May 18, 1990, while in-Mode 3, operators filled safety injection accumulators using Section 7.2 of OP 33103. Operators failed to complete the restoration actions contained in Section 7.2 and as a result left radundant trains of intermediate pressure safety injection inoperable for approximately four hours.

This is a Severity Level IV Violation (Supplement 1).

,ackground B

(a) On May 12, 1990, at 0906 hours0.0105 days <br />0.252 hours <br />0.0015 weeks <br />3.44733e-4 months <br /> while operating at 0% power in Mode 3 (Hot Standby), 445 psia and 352 degrees Fahrenheit, a feedvater isolation (FVI)- occurred ,due to high-high level in the #2 steam generator. At the time of the event, a plant cooldown to Mode 5 (Cold Shutdown) was ongoing.

The operating shift was asked to test the MSIV closure times at the lowest possible steam generator pressure (i.e., at 140 psig). This time test is not a normal part of the plant cooldown procedure, which was the procedure in use at the time, but it is included in the main steam operating procedure. The operators intended to stroke close and open one MSIV at a time. After the first MSIV had been closed, the operators were unable to open it due to a lack of steam pressure.

The operators then decided to stroke closed all the HSIVs individually and using nitrogen, re-open them simultaneously to reduce the swell in the steam generators. Prior to closing the MSIVs, the steam dumps had been opened, depressurizing the main steam header. Before the

• U. S..Nuclect R:gulatory Co :ission A08881/Page 3~

JJuly 31, 1990 operators opened the MSIVs, they closed the steam dumps and opened the MSIV bypass valves to repressurize the main steam header. When the differential pressure across the MSIVs reached 90 psi, they were opened. The steam generator levels prior to opening the MSIVs vere approximately 45%. The selector switches for all the MSIVs were set

n "AUT0" so that they would all open simultaneously when the "COOLDOWN" button was pushed. The #2 MSIV opened faster than the others resulting in a swell-in the #2 steam generatur. The resulting level was above the trip setpoint, causing the FWI signal. The transient lasted for 2 seconds.

(b) On May 18, 1990, at 1805 hours0.0209 days <br />0.501 hours <br />0.00298 weeks <br />6.868025e-4 months <br /> with the plant shutdown in Mode 3 (Hot Standby), at a temperature of 460 degrees Fahrenheit and a pressure of 900 psia, safety injection cold leg master isolation valve 3SIH*MV8835 (MV8835) was closed to fill safety injection accumulators.

A licensed operator specifically assigned to the task incorrectly followed a procedure that was meant to be used enly if the reactor is shut down with a temperature less than 350 degrees Fahrenheit.

Closure of MV8835 isolated the discharge of both safety injection pumps from the RCS cold leg injection path. This made both high pressure safety injection (HPSI) trains inoperable, and violated the Technical Specification limiting condition for operation (LCO) for emergency cose cooling systems.

At 1820 hours0.0211 days <br />0.506 hours <br />0.00301 weeks <br />6.9251e-4 months <br />, May 18, 1990, the accumulator fill operation was completed, but the operator failed to reopen MV3835 as required by the procedure. The error was discovered at 2217 hours0.0257 days <br />0.616 hours <br />0.00367 weeks <br />8.435685e-4 months <br />, May 18, 1990, by the Reactor Operator while he was reviewing the engineered safety features (ESP) status annunciators. At' this time, MV8835 was reopened. The length of time that the high pressure safety injection trains were inoperable was 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, 12 minutes.

Root Cause (a) The root cause of the FVI event was the failure to use the correct procedure. The operators did consider the effects of opening the HSIVs with more than the normal differential pressure, but incorrectly concluded the change in volume (svell) would be less at 140 psig than at 1000 psig normal pressure. The operating shift did not use the main steam operating procedure to re-open the MSIVs. To perform the cooldown, operating shift personnel vere using General Operating Procedure, OP 3208, " Plant Cooldown." Operating Procedure OP 3316A,

" Main Steam," should have been used to re-open the MSIVs. OP 3316A contains cautions to alert operators to the potential for a FVI. In addition, the notes and o utions require the operators to reduce the level in the steam generators to 40%-45% and to reduce the differential pressure across the HSIVs to 25 psi prior to opening the ve'ves. These actions are intended to minimize the swell effect in the steam generators.

~

U. S..Nucic r Regul0tcry C:mmission.

A08881/Page 4 July 31, 1990 (b) The root cause of 'the inoperable safety injection systems event was a cognitive failure on the part of the licensed operator

specifically assigned to the evolution. The licensed operator failed to observe a note in the procedure which states the procedure can only n be utilized while the plant is shut down with temperature less than 350 degrees Fahrenheit. The licensed operator also did not follow the

~

procedure when he failed to reopen MV8835 after filling the accumulators. i corrective Action  !

(a) The immediate corrective action for the FVI event was to restore the #2 steam generator level to normal. All components required to respond to the FVI~ signal vere already in their isolation position.

In order to prevent recurrence of a FVI subsequent to opening the

. MSIVs, all Operations Department personnel have been instructed to l

always refer to the Main Steam operating procedure to open the MSIVs ,

and to be more cautious when performing concurrent actions involving l different procedures. Personnel directly involved in the event were counseled on using the applicable procedure during planned evolutions.

In addition, a change was made to the Main Steam operating procedure '

sequence of steps so that the operator reads the notes and cautions prior to opening the MSIVs.

(b) Immediate corrective action for the inoperable safety injection

, systems event was to reopen MV8835 to return both trains of HPSI to operable status. Operators directly involved with this event were l

removed from licenr.ed duties and counseled by the Operations Manager on the causes of the event and on the importance of recognizing when an event in reportab 4 Included in the counseling was the importance of notifying the PhNr. Supervisor of any conditions that do not fully comply with Techni m Specifications. Subsequent to investigation of i the event, counseling, and a period of performance with direct l supervision, these operators were returned to licensed duty. Interim

', guidance was issued to disseminate information on using dedicated operators and to ensure timely resolution of Technical Specification 1 issues. The title for the misused procedure was changed to include the fact it shall be used only if the reactor is shut down with temperature less than 350 degrees Fahrenheit.

Actions to Prevent Recurrence L In . light of the subject Notice of Violation, NNECO has extended its  ;

l review of procedure use and compliance with Technical Specification l l_ 6.8.1. Information on these events is being routed to all licensed l operators to emphaaize both the need to reference and use procedures as well as the requirements of Administrative Control Procedure (ACP) i 3.02E, " Procedural Compliance". i 1

J '

l *

• JU. S.. Nuclear Regulatcry C mmissicn A08881/Page 5 July 31,1990 Management vill emphasize the existing procedural requirements with operators during a series of discussions with individual operating shifts. These sessions vill be conducted during training sessions jointly by the Unit Director and the Operations Manager and are scheduled to coincide with the next six veek training cycle beginning

=in mid August. These discussions vill be completed by October 19, 1990.

?

It was also determined that an inadequacy existed in the lack of a detailed turnover by an " extra" operator operating controls on the '

main control board to the Reactor Operator upon completion of the task. Therefore, direction has been given to ensure that turnovers occur in these situations.

In order to address the specific concern related to using dedicated operators, guidance has been incorporated into OP 3260, " Conduct of Operations," discussing this subj ec t . Additionally, all Operations Department system and surveillance procedures vill be reviewed for determination of steps that require a dedicated operator. At these steps, a specific reference to use the dedicated operator guidance in OP 3260 vill be inserted; this task will be completed by December 31, 1990. ]

a NNECO Response to Violation Concerning Inadequate Notification NNEC0's response to the Severity Level IV Violatioi concerning inadequate notification identified by the Staff is set forth bel;;;

Staff's Statement of the Violation 10CFR50.72(b)(2)(iii) states, in part,..."The licensee shall notify 5

the NRC as soon as practical and, in all cases, within four hours of the occurrence of any event or condition that alone could have '

prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident."

Contrary to the above, on March 19, 1990, operators discovered that both trains of the auxiliary building ventilation filters were inoperable. The NRC was not informed of this occurrence until March 28, 1990. On May 18, 1990, operators discovered both trains of the safety injection syster vere inoperable. This event was not reported to the NRC until May 20, 1990. Both systems are required to mitigate the consequences of an accident.

This is a Severity Level IV Violation (Supplement I).

i U. S. Nucle:r R:gulstery C:mmissicn A08881/Fage 6 July 31, 1990

Background

(a) On March 19, 1990, at 100% power in Mode 1, 587 degrees Fahrenheit and 2250 psia, both trains of the auxiliary building filters became inoperable when the "B" train auxiliary building filter circuit breaker motor failed while the "A" train auxiliary building filter had -

, been removed from service for preventive maintenance.

, on March 19, 1990, at 0327 hours0.00378 days <br />0.0908 hours <br />5.406746e-4 weeks <br />1.244235e-4 months <br />, the "A" auxiliary building filter, 3HVR*FLT1A, was removed from service in order to perform its required i six month preventive maintenance surveillance. "Inoperability" of 3HVR*FLT1A invoked a Technical Specification LCO action statement  ;

which required the filter to be restored to operable status within seven days. .

i L on March 19, 1990, at 0720 hours0.00833 days <br />0.2 hours <br />0.00119 weeks <br />2.7396e-4 months <br />, the "B" train auxiliary building i filter 3HVR*FLT1B was placed in service in response to radiological activity caused by reactor coolant system (RCS) sampling. 3HVR*FLT1B .

vas subsequently shut down at 0817 hours0.00946 days <br />0.227 hours <br />0.00135 weeks <br />3.108685e-4 months <br />. At 0851 hours0.00985 days <br />0.236 hours <br />0.00141 weeks <br />3.238055e-4 months <br />, control room I operators received a loss of control power alarm for load center 32X.

I A non-licensed operator (PEO) was immediately dispatched to investigate the cause of the alarm. The PE0 discovered that the circuit breaker motor for 3HVR*FLT1B had failed. Shift management immediately entered Technical Specification 3.0.3 vhich required event resolution within one hour. Plant personnel restored 3HVR*FLT1A to l

service at 0920 hours0.0106 days <br />0.256 hours <br />0.00152 weeks <br />3.5006e-4 months <br /> and Technical Specification 3.0.3 was cleared.

! Both 3HVR*FLT1A and 3HVR*FLT1B had been inoperable simultaneously for a duration of approximately 29 minutes. L The event was not reported immediately per the requirements of 10CFR50.72(b)(2)(iii). On March 28, 1990, a late notification ras performed following a reportability evaluation.

L (b) On May 18, 1990, at 1805 hours0.0209 days <br />0.501 hours <br />0.00298 weeks <br />6.868025e-4 months <br /> with the plant shut down in Mode 3

l. (Hot- Standby), at a temperature of 460 degrees Fahrenheit and a l

pressure of 900 psia, safety injection cold leg master isolation valve 3SIH*HV8835 (MV8835) vas closed to fill safety injection accumulators.

A licensed operator specifically assigned to the task incorrectly followed a procedure that was meant to be used only if the reactor is shut down with a temperature less than 350 degrees Fahrenheit.

Closure of MV8835 isolated the discharge of both safety injection pumps from the RCS cold leg injection path. This made both HPSI L trains inoperable, and violated the Technical Specification LCO for emergency core cooling systems.

y e .

U. S., Nuc10 r R:gulattry C=:issitn

'A08881/Pnge 7 July 31, 1990 1

At 1820 hours0.0211 days <br />0.506 hours <br />0.00301 weeks <br />6.9251e-4 months <br />, May 18, 1990, the accumtilator fill operation was  :

completed, but the operator failed to reopen MV8835 as required by the procedure. The error was discovered at 2217 hours0.0257 days <br />0.616 hours <br />0.00367 weeks <br />8.435685e-4 months <br />, May 18, 1990, by .

the Reactor Operator while he was reviewing the ESP status annunciators. At this time, MV8835 was reopened. The length of time that the high pressure safety injection trains were inoperable was 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, 12 minutes.

This event was not reported immediately per the requirements of 10CFR50.72(b)(2)(iii) due to a Supervising Control Operator (SCO) oversight. The SCO on shift at the time MV8835 was found closed did not recognize the reportability potential of this event at the time.

After discussions with shift supervisory personnel, it was evident that this event required immediate notification. The 10CFR50.72 (b)(2)(iii) notification was completed at 1450 hours0.0168 days <br />0.403 hours <br />0.0024 weeks <br />5.51725e-4 months <br /> on May 20, 1990, i Root Cause l

The subject Notice of Violation took issue with NNECO's failure to recognize a reportable event and failure to notify the NRC vithin 4 ,

i hours of conditions that could have prevented the fulfillment of

safety functions needed to mitigate the consequences of an accident.

The root causes of these failures were insufficient training and t inadequate management guidance available to ensure that these incidents were recognized as having 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> reportability requirements per 10CFR50.72(b)(2).

r Corrective Action ,

L Operations Memo, HP-3-0-319, was distributed to all Unit 3 Licensed Operators and Duty Officers; the subject of the memo was the immediate ,

reporting requirements of 10CFR50.72.

Actions to Prevent Recurrence In the past year there have been three identified cases in which the reporting requirements of 10CFR50.72 and 10CFR50.73 have not been correctly implemented or have been impicmented late. In particular this has involved how to report events in which the plant finds that condiiions require us to log into Technical Specification 3.0.3 or where, even though Technical Specifications cover the condition and

.give us remedial actions, we still have an obligation to issue an immediate report. To ensure that all licensed operators are trained adequately on these reportability requirements, the Operator Training Department vill develop and provide:

{ ,,) o 4

U. S.,Nuc1 = r R:gulotery CImmissign A08881/Page 8

' July 31 , 1990 1)' A review of past operator tests to determine where the deficiencies are in operator knovledge relating to Technical Specifications and reportability. If generic veaknesses are noted, remedial training vill be provided in accordance with Nuclear Training procedures.

2) A classroom test to determine those deficiencies, if sufficient data is not obtained.

3) Simulator scenarios that vill fail redundant trains of equipment and require that the shift log into Technical Specification 3.0.3. '

This vill provide a "real time" test of the operators r.bility to diagnose and respond to equipment problems that require prompt reports in accordance with 10CFR50.72.

The items discussed above vill be accomplished no later than December 31, 1990. Errors and problems identified in these processes vill be handled in accordance with our Training Manual requirements.

Very truly yours, NORTilEAST NUCLEAR ENERGY COMPANY E.J.Kfrcika f -

Senior Vice President cci U. S. NRC Document Control Desk l

D. II. Jaf fe, NRC Project Manager, Millstone Unit No. 3 l' V. J. Raymond, Senior Resident Inspector, Millstone Unit Nos. 1, 2, .

and 3.

E. C. Venzinger, Chief, Projects Branch No. 4, Division of Reactor Projects l

I l=

1