IR 05000287/2005010

IR 05000287-05-010; 9/06-08/2005; Oconee Nuclear Station Unit 3; Special Inspection IP 93812 for a Reactor Trip and Safety Injection Event

ML052790046
Person / Time
Site:	Oconee
Issue date:	10/05/2005
From:	Casto C Division Reactor Projects II
To:	Rosalyn Jones Duke Energy Corp
References
IR-05-010
Download: ML052790046 (26)

Text

ber 5, 2005

SUBJECT:

OCONEE NUCLEAR STATION UNIT 3 - NRC SPECIAL INSPECTION REPORT 05000287/2005010

Dear Mr. Jones:

On September 8, 2005, the Nuclear Regulatory Commission (NRC) completed a Special Inspection at the Oconee Nuclear Station Unit 3. The enclosed report documents the inspection findings which were discussed on September 8, 2005, with you and other members of your staff.

Based on the criteria specified in Management Directive 8.3, NRC Incident Investigation Procedures, the Special Inspection was initiated on September 6, 2005, in accordance with NRC Inspection Procedure 93812, Special Inspection. This inspection was chartered to inspect and assess the circumstances associated with a Unit 3 reactor trip and safety injection event which occurred on August 31, 2005. The Special Inspection charter is included as attachment 2 to the enclosed inspection report. The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license. The inspectors reviewed selected procedures and records, conducted field walkdowns, observed activities, and interviewed personnel.

Based on the results of this inspection, we have determined that the overall response of your staff to the reactor trip and safety injection was adequate, in that the plant was taken to a safe shutdown condition. However, several issues related to modification reviews and identification of issues requiring corrective actions were identified. This report documents one finding concerning the corrective action program which was directly related to the cause of the rapid cooldown experienced following the reactor trip. This finding has potential safety significance greater than Green (very low significance) and is currently pending a Significance Determination Process review. The finding does not present an immediate safety concern, because your staff subsequently completed the installation and testing of modifications which corrected the design problems that triggered the event. Three additional findings of very low safety significance (Green) were identified. Two of these issues were determined to involve violations of NRC requirements. However, because of their very low safety significance and because they were entered into your corrective action program, the NRC is treating these findings as non-cited violations (NCVs) consistent with section VI.A of the NRC Enforcement Policy. If you contest any NCV in this report, you should provide a response, stating the basis for your denial within 30 days of the date of this inspection report. Responses should be sent to

DEC 2 the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001; with copies to the Regional Administrator Region II; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at the Oconee Nuclear Station.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web-site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Charles A. Casto, Director Division of Reactor Projects Docket No.: 50-287 License No.: DPR-55

Enclosure:

Inspection Report 05000287/2005010 w/Attachments: 1. Supplemental Information 2. Oconee Special Inspection Charter 3. Event Time Line

REGION II==

Docket No: 50-287 License No: DPR-55 Report No: 05000287/2005010 Licensee: Duke Power Company Facility: Oconee Nuclear Station Unit 3 Location: 7800 Rochester Highway Seneca, SC 29672 Dates: September 6-8, 2005 Inspectors: G. Hopper, Senior Operations Engineer (Lead Inspector)

A. Hutto, Resident Inspector - Oconee Approved by: Charles A. Casto, Director Division of Reactor Projects Enclosure

SUMMARY OF FINDINGS

IR 05000287/2005-010; 9/06-08/2005; Oconee Nuclear Station Unit 3; Special Inspection IP 93812 for a reactor trip and safety injection event.

The inspection was conducted by a senior operations engineer and one resident inspector.

Two Green non-cited Violations (NCVs), one Green finding (FIN) and one finding with potential safety significance greater than Green, were identified. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC)0609, Significance Determination Process (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 3, dated July 2000.

Cornerstone: Initiating Events

Green.

A self-revealing finding was identified for using an undersized breaker in an inadequate modification of the Unit 3 control rod drive system which led to a reactor trip during routine maintenance of the alternate power supply breaker 2X2-5D.

The finding is greater than minor because it affected the initiating events cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions, in that the undersized power supply breaker led to a reactor trip when the digital control rod drive control system (DCRDCS) was placed in a single power supply configuration during maintenance on the alternate feeder breaker for the Unit 3 DCRDCS. The finding was determined to be of very low safety significance, since it did not contribute to both the likelihood of a reactor trip and the likelihood that mitigation equipment or functions would not be available. The licensee modified the system with a suitable breaker. (Section 4OA3.2)

• TBD. The inspectors identified a finding for the failure to adequately assess and correct the adverse impact of an identified vulnerability with the digital control rod drive system to integrated control system (ICS) interface following a loss of all power to the rod control system. This condition led to the overcooling of the reactor coolant system and an engineered safeguards (ES) actuation following a reactor trip.

The finding is greater than minor because it affected the initiating events cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions, in that the uncorrected DCRDCS to ICS interface resulted in the overcooling of the reactor coolant system (RCS)and subsequent ES actuation. ES actuation invokes a probability that operators will not manually terminate or reduce high pressure injection flow (HPI) prior to lifting a primary relief valve that, if failed to reseat, would lead to a primary system loss of coolant accident (LOCA). A phase 2 analysis was performed with results greater than green and a subsequent phase 3 analysis is in progress.

This finding also involved the crosscutting aspect of problem identification and resolution. The licensee has modified the system to remove the vulnerability.

(Section 4OA3.3)

Cornerstone: Mitigating Systems

Green.

A self-revealing NCV was identified for failure to have a restoration procedure for ES components as required by Technical Specification (TS) 5.4.1.

Following a valid actuation signal, the licensee did not restore ES channels 1 and to operable status for more than seven hours due to a lack of specific procedural direction.

The finding is greater than minor because it adversely impacted the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences and affected the human performance attribute of the same cornerstone. Specifically, the failure to have a restoration procedure resulted in the operators using their knowledge and skill of the craft to restore ES alignment and resulted in the Safety Injection actuation circuitry being inoperable for more than seven hours. The licensee has entered this finding into their corrective action program and was reviewing a new draft procedure, ES Recovery, at the time of the inspection. (Section 4OA3.4.b(1))

Green.

A self-revealing NCV was identified for not maintaining Emergency Operating Procedure (EOP)5.1, ES Actuation, in accordance with TS 5.4.1.

5.1 contained unnecessary steps to open BS-1 and BS-2 which allowed borated water storage tank (BWST) water to drain to the reactor building normal sump and compelled the operators to take actions outside their written EOP guidance to secure the loss of water to the sump.

The finding is considered to be of more than minor significance because it adversely impacts the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences and affected the procedure quality and human performance attributes of the same cornerstone. Specifically the failure to remove the steps to open the valves from the procedure resulted in operators having to take actions outside the procedure to stop the loss of BWST water.

(Section 4OA3.4.b(2))

Licensee Identified Violations

None.

REPORT DETAILS

Initial Plant Conditions On August 31, 2005, Oconee Nuclear Station was operating with all three units at 100% power.

Breaker maintenance was in progress on the Unit 3 digital rod control systems alternate power supply. At time 14:00, nuclear equipment operators were dispatched to rack-out 600 VAC breaker 2X2-5D. The breaker testing was a first time performance of this procedure after a modification had been performed to the digital rod control system control power.

Event Description On August 31, 2005, at time 14:21, nuclear equipment operators opened and racked out the Unit 3 alternate Control Rod Drive (CRD) breaker (2X2-5D) for replacement. Seven minutes later (14:28), Unit 3 experienced a reactor trip due a CRD DC cabinet breaker (SB-1) tripping open, which resulted in the removal of power to the CRD mechanisms. Due to a known communication problem which existed upon a loss of power to the CRD system, the ICS did not receive a reactor trip signal and did not respond as it normally would for a reactor trip. This resulted in the Turbine Bypass Valves set point, as controlled by the ICS, not increasing by 125 psig to its designed post trip set point of 1010 psig. The ICS ran the secondary side back at 20% / min vice 600% / min and secondary side pressure control was set at 885 psig vice 1010 psig. The opening of the Turbine Bypass Valves and the response of the feedwater system resulted in the overcooling of the RCS and the resultant increased density of the RCS water, caused pressurizer level to decrease to 0% with a reduction in pressure to approximately 1597 psig. The minimum RCS Tc temperature reached was 535 EF. The overcooling caused the actuation of ES channels 1 and 2 (set point 1600 psig) and a high pressure safety injection.

Control room operators entered the EOPs and performed the immediate manual actions, symptom checks, and steps for ES actuation (Enclosure 5.1). When pressurizer level reached 120 inches, the operators took manual control (14:33) of high pressure injection (HPI), and throttled HPI to control level by securing 3C HPI pump. Pressurizer level reached a maximum value of approximately 225 inches, at which time letdown was restored. The plant was placed in a stable configuration at time 15:14, when 3B HPI pump was secured. At this time Unit 3 had one HPI pump running with letdown in service, RCS pressure approximately 2190 psig with Tc temperature stable at 541 EF. Operators spent the next two hours planning the recovery and restoration of ES equipment. Procedural guidance did not exist for resetting ES and restoring systems to their normal lineup. The Operations Shift Manager (OSM) and Unit 3 Senior Reactor Operator (SRO) referred to Operations Management Procedure (OMP) 1-2, Rules of Practice, and determined that the conditions for bypassing a safety system (ES channels 1 and 2) were met. The Station Manager and Operations Superintendent concurred with bypassing ES 1 and 2. Per procedure OMP 1-2, "Equipment may be overridden and repositioned with the approval of two licensed personnel, one of whom is an SRO, if both of the following are true: 1; The safety system is not required to perform its intended safety function (i.e., adequate subcooling margin exists, SG pressures within acceptable limits, etc.) and 2; Continued operation of the safety system could increase the severity of the transient, damage equipment, or cause an unnecessary operator burden." In this case, the unit was stable and in a condition where safety injection was not required along with continued operation in ES causing an unnecessary operator burden. The OSM and Unit 3 SRO concurred to restore equipment from its ES alignment. The EOPs were exited at time 17:15, and restoration of equipment continued following turnover with the evening shift. Both ES channels 1 and 2 were reset at time 2206.

During the event, the operators opened valves 3BS-1 and 3BS-2 in accordance with step 4.59 of Enclosure 5.1. Reactor Building Normal Sump (RBNS) level was observed to be increasing and the RCS was verified to be intact (no leakage). The operators determined that the RBNS level increase was due to 3BS-1 and 3BS-2 being open, resulting in the BWST draining to the RBNS through one inch drain lines. The operators decided that 3BS-1 and 3BS-2 should be closed since they were not needed to be open at that time. Valves 3BS-1 and 3BS-2 were closed per the guidance on procedure OMP 1-18, Implementation Standard During Abnormal and Emergency Events, guidance at time 14:58.

Special Inspection Team Charter Based on the criteria specified in Management Directive 8.3, NRC Incident Investigation Procedures, a Special Inspection was initiated in accordance with NRC Inspection Procedure 93812, Special Inspection. The objectives of the inspection, described in the charter, are listed below and are addressed in the identified sections.

(1) Develop a time line of events including applicable management decision points from the time of the modification through restoration from the event. (Attachment 3)

(2) Assess the design capacity of the feeder breakers to the digital rod control system (DCRDCS). (Section 4OA3.2)

(3) Assess the design of the turbine bypass controller interface with the digital rod control system to determine why the bypass controller set-point did not reset to the post-trip value of 1010 psig after the reactor trip. (Section 4OA3.3)

(4) Review the licensees corrective action documents (PIPs) on this issue and assess whether the licensee knew about this problem prior to the event. Assess any corrective action the licensee took as a result of any previous PIPs to determine whether the actions were timely. (Section 4OA3.3)

(5) Assess whether operations procedures for bypassing emergency safeguards and resetting emergency safeguards after a safety injection are adequate to ensure that automatic safety injection is available when called upon. (Section 4OA3.4.b(1))

4OA3 Event Followup

1. Chronology of Event (Objective 1)

a. Inspection Scope

The inspectors reviewed available plant event data, control room logs, computer data, and interviewed operations personnel to develop a time line for the event which is included as Attachment 3. The inspectors were formally briefed by licensee management and key event investigation team members on September 6, 2005, as to their findings and conclusions concerning the event. The inspectors reviewed the licensees corrective action documents related to this event, personnel event summary statements, time lines, failure mode analyses, and various logs and procedures to evaluate the effectiveness of the licensees cause determinations. The specific documents reviewed are listed in Attachment 1.

b. Observations The time line for the events is included as attachment 3. The inspectors noted that the licensee performed an adequate post-trip review and had assembled an independent review team to assess root cause and long term corrective actions. Prompt corrective actions had been completed by the time of the inspection for the circuit breaker and CRD to ICS interface issues to eliminate the physical component deficiencies which caused the event. The inspectors noted that a thorough evaluation of the operators actions had been completed and some minor deficiencies in performance were identified. The inspectors also noted that the post trip review and PIPs associated with the event correctly identified the cause of the overcooling as the ICS running the unit back at 20%/min and controlling header pressure at 885 psig vice its normal post trip response. The review specifically identified the lack of a reactor trip signal as causing the ICS not to increase the main steam header bias by 125 psig. However, the analysis did not specifically address the effect on the feedwater response and its potential contribution to the rate of overcooling due to the feedwater pumps and feed regulating valves not responding in the normal post trip manner.

2. Contributing Cause Due to Equipment Failure: Modification Implementation of the Unit 3

Digital Control Rod Digital Control System (Objective 2)

a. Inspection Scope

The inspectors assessed the adequacy of the licensees modification for the Oconee Unit 3 DCRDCS implemented during the fall 2004 outage. The inspectors reviewed the modification package, associated factory acceptance testing documentation and post modification testing and held discussions with contractor and licensee personnel involved with the modification implementation. The inspectors also reviewed corrective action documents associated with the modification.

b. Findings

Introduction:

A Green self-revealing finding was identified for an inadequate modification related to the Oconee Unit 3 digital control rod system. CRD DC power supply breaker SB-1 was installed in the new system and was undersized for its required duty in that, it did not meet the vendors specification for design margin. This breaker tripped on August 31, 2005 during single power supply operation and initiated a reactor trip. The overall risk was very low since it did not affect the likelihood that mitigation equipment or functions would not be available.

Description:

A new digital control rod drive and digital control system was installed on Unit 3 during the 3EOC21 refueling outage which ended on January 4, 2005. Oversight and testing did not identify a marginal CRD Control system DC power supply breaker in that the breaker was rated for 63 amps and actual system current, during single power supply operation, was measured to be near this value. A subcontractor delivered the digital control portion of the system to the primary contractor and no independent review of the subcontractors circuit design and analysis was performed. The system was designed with dual redundant power supplies. However, the system was also expected to be fully functional when one of the redundant power supplies was out of service for maintenance. With one power supply out of service, the remaining power supply draws roughly twice the current in this configuration. Factory acceptance tests by the primary contractor or post modification testing by the licensee were inadequate in that, they did not test the system in the single power supply configuration for which it was designed.

This represented a missed opportunity to identify the marginal breaker. When 600 VAC breaker 2X2-5D was opened on August 31, 2005, for maintenance, DC breaker SB-1 tripped on a thermal overload seven minutes later and initiated a reactor trip. As part of the corrective actions, the licensee performed a circuit analysis of the power supplies and replaced the SB-1 supply breaker with a 100 amp-rated breaker. Several other breakers within the system were also identified as having marginal capacity and were subsequently replaced with higher capacity breakers.

Analysis:

The finding is a performance deficiency because the licensee is expected to ensure, through design control and testing, that modifications of plant systems important to safety will perform satisfactorily under all conditions for which they are designed. The finding was considered to be more than minor because it affected the initiating events cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions in that, the undersized DC power supply breaker led to a reactor trip when the DCRDCS was placed in a single power supply configuration during maintenance on the 600 VAC alternate feeder breaker for the Unit 3 DCRDCS.

Using the phase 1 screening worksheet of Manual Chapter 0609, Appendix A, the finding was determined to be of very low safety significance (Green), as it did not contribute to both the likelihood of a reactor trip and the likelihood that mitigation equipment or functions would not be available.

Enforcement:

This finding was not a violation of regulatory requirements because the control power supply of the DCRDCS is not considered to be safety-related and, therefore, not under the requirements of 10 CFR 50, Appendix B. This issue is in the licensees corrective action program under PIP O-05-5613. This finding is identified as FIN 05000287/2005010-01, Inadequate Unit 3 Digital Control Rod Drive System Modification.

3. Contributing Cause due to Problem Identification and Corrective Action (Objectives 3

and 4)

a. Inspection Scope

The inspectors assessed the licensees actions with regard to the identification and corrective action of a DCRDCS to ICS interface inadequacy that was introduced as part of the Unit 3 DCRDCS modification. The inspectors reviewed corrective action documents and held discussions with licensee personnel involved in the implementation of the modification which changed the way the ICS received a reactor trip confirm signal from the DCRDCS. In Addition, the inspectors carefully reviewed all pertinent control wiring diagrams associated with the CRD system to include the individual loads and relay protection schematics to verify the cause of the CRD to ICS communication problem.

b. Findings

Introduction:

A finding was identified for the failure to adequately assess and correct the adverse impact of an identified vulnerability with the DCRDCS to ICS interface, following a loss of all power to the rod control system. As a result, the ICS did not control the turbine bypass valves at the appropriate post trip setting following a reactor trip which resulted from the loss of all rod control power. This occurred during breaker maintenance on August 31, 2005. The lack of a trip confirm signal to the ICS caused an overcooling condition of the RCS and subsequent actuation of the ES system.

Description:

On December 24, 2004, prior to Unit 3 startup following its Fall 2004 outage, licensee personnel from the Oconee Refurbishment Group (ORG) discovered a problem with the DCRDCS to ICS interface if all power was lost to the DCRDCS. Prior to the DCRDCS modification, the rod control system sent a reactor trip confirm signal to the ICS, following a reactor trip, by de-energizing relay K-19 in the rod control circuitry.

The ICS used this reactor trip confirm signal to bias the turbine bypass valve position to control secondary pressure at 1010 psig vice 885 psig to keep RCS post trip temperature at 555 EF. As part of the DCRDCS modification, the K-19 relay was reconfigured to be energized, following a trip, to send the trip confirm signal to the ICS.

This modification was implemented as part of a transient reduction effort to reduce the potential of spurious or unwanted reactor trips. However, during reboot of the system, the licensee recognized that a loss of all power to the DCRDCS would disable the K-19 relay in that, the processors in the DCRDCS could not energize the K-19 relay following a trip. The ICS would control secondary pressure at 885 psig via the turbine bypass valves which would result in the RCS being overcooled.

The licensee wrote PIP O-04-9072 to document the discrepancy discussed above.

However, during the screening process, the operational impact was not recognized and as a result, Operations was not involved in the evaluation either through an operability evaluation or through development of corrective actions. Furthermore, the PIP was classified as a category four PIP. The licensees corrective action program did not require a problem evaluation for category four PIPs, and no problem evaluation was performed. This was another missed opportunity for this deficiency to get an appropriate evaluation of its operational significance. The problem description in the PIP lacked clarity as it was written in technical jargon rather than plain English, and this may have contributed to the inadequate screening process.

Corrective actions for PIP O-04-9072 only addressed fixing the problem for the upcoming Unit 1 modification, which was the next unit for which the design change was to be installed. No corrective actions for the installed Unit 3 modification were proposed at that time. On April 21, 2005, the licensee generated PIP O-05-2785 to document DCRDCS open issues identified during installation and testing of the system on Unit 3.

The DCRDCS to ICS interface problem was not included in the issues listed in this PIP.

On August 1, 2005, a line item was added to PIP O-05-2785 to include the problems identified in PIP O-04-9072. Corrective action number two, in the modified PIP, specified a proposed corrective action to develop a modification package to correct the DCRDCS to ICS interaction for Unit 3 with a due date of December 6, 2005. An implementation date had not yet been determined. Without an adequate evaluation of the problem, and with no input from the Operations organization when PIP O-04-9072 was originated, the corrective actions to eliminate the adverse DCRDCS/ICS interaction were not appropriately prioritized and implemented commensurate with the safety significance of the condition. On August 31, 2005, during routine maintenance on the alternate AC power supply feeder breaker to the DCRDCS, a trip of the 24V DC supply breaker to the operating DCRDCS trains resulted in a loss all DCRDCS power.

Consequently, a reactor trip resulted, and the ICS did not receive a trip confirm signal.

The failure to correct this vulnerability with the K-19 relay directly contributed to overcooling of the RCS and subsequent ES actuation which unnecessarily challenged safety-related equipment.

Analysis:

The finding was considered a performance deficiency because the licensee is expected to correct conditions adverse to quality and particularly those that can result in unnecessarily challenging plant safety systems. The finding was considered to be more than minor because it affected the initiating events cornerstone objective to limit the likelihood of those events that upset plant stability and challenge critical safety functions in that, the uncorrected DCRDCS to ICS interaction resulted in the overcooling of the RCS and subsequent ES actuation. ES actuation invokes a probability that operators will not manually terminate or reduce HPI flow prior to lifting a primary relief valve that, if failed to reseat, would lead to a primary system LOCA. Therefore, SDP Phase 1 worksheet question 1 under LOCA initiators, assuming worst case degradation, would the finding result in exceeding the TS limit for identified leakage?,

was answered yes, and a phase 2 analysis was performed. Results from the phase 2 analysis were greater than green using the worksheet for stuck open power operated relief valve (PORV) as a surrogate for a stuck open safety relief valve. Key assumptions were that the initiating event likelihood was one, no credit for block valves was given, and an operator credit of one was assigned. Therefore, a phase three analysis is required to be performed. The finding does not represent an immediate safety concern because the licensee has corrected the problem and installed a modification which corrected the DCRDCS to ICS interface. The final safety significance of the issue has yet to be determined.

Enforcement:

This finding was not a violation of regulatory requirements because the DCRDCS to ICS interface is not considered to be safety-related and, therefore, not under the requirements of 10 CFR 50, Appendix B. This issue was entered into the licensees corrective action program as PIP O-05-4613. This finding is identified as FIN 05000287/2005010-02, Inadequate corrective actions for an identified deficiency with the Unit 3 Digital Control Rod Drive System, pending determination of the safety significance.

4. Human Factors and Procedural Issues (Objective 5)

a. Inspection Scope

The inspectors evaluated the operators response to the event and their use of procedures. The inspectors reviewed the event time lines, control room logs, instrument parameters recorded during the event and the event debrief statements of personnel involved in the event. The inspectors evaluated procedure use and adherence, adequacy of the procedures and the application of skill of the craft training.

b. Observations and Findings

(1)

Introduction:

A Green self-revealing NCV was identified for failure to have a restoration procedure for ES components as required by Technical Specification 5.4.1.

Following a valid actuation signal, the licensee did not restore ES channels 1 and 2 to operable status for more than seven hours due to a lack of specific procedural direction.

Description:

The inspectors concluded that the overall procedure use during the event was adequate and conformed to the guidance contained in procedures OMP 1-2, Rules of Practice, and OMP 1-18, Implementation Standard During Abnormal and Emergency Events. Operators made several conservative decisions in the implementation of EOPs that were appropriate for the circumstances. In one case, the operators decided not to control steam generator (SG) pressure at 1010 psig in accordance with step 4.8 of procedure EP/3A/1800/01 since they had identified a malfunction in the ICS and the plant was automatically controlling at 890 psig, in a stable configuration. Increasing SG pressure would have raised RCS temperature and complicated pressurizer level control. In another instance, the operators concluded that the plant was stable and not in an excessive heat transfer condition when the procedure stated, Verify primary to secondary heat transfer has been excessive. The past tense of the verify statement could have led to a decision to enter the Excessive Heat Transfer Tab, since for a brief moment, the plant had experienced an excessive cooldown. The operators concluded that SG pressure was stable and no further mitigation actions were necessary for this symptom. The licensee has generated a PIP O-05-5774 to readdress the wording of this step in the procedure. In addition, the inspectors concluded that the operators appropriately bypassed ES channels during the event. This action is specifically directed by procedure (EOP) Enclosure 5.1 as part of the mitigation strategy which allows operators to take control of ES components to control pressurizer level (prevent solid plant conditions), RCS pressure, and cooldown.

Following the stabilization of the plant, the operators recognized that they did not have specific procedural guidance to restore ES components to their normal standby readiness condition. Operators used the administrative instructions contained in OMP 1-2 and OMP 1-18, knowledge of systems, and skill of the craft, to slowly restore ES systems to their standby readiness condition. Despite their efforts, the operators neglected to reset ES digital channels 1 and 2 and analog channels A and B until time 2206. The inspectors concluded that the restoration lineup took more than seven hours to complete and was performed without specific procedural direction. Some components were taken to manual that may not have been necessary. Several ES 1 and 2 components at various times were in a state of technical specification inoperability when placed in manual during the recovery of the plant. The complete reset of ES components took more than seven hours from the point in the event where the plant was in a stable configuration. A draft procedure (Enclosure 5.41) is currently under review by the licensee which will provide specific steps for restoring ES components to operable status.

Analysis:

The failure of the licensee to have an adequate procedure for restoration of the ES equipment is a performance deficiency, because the licensee is required to have procedures which restore ES components to their normal condition. Traditional enforcement does not apply because the event that occurred did not result in an actual safety consequence; it did not impact the NRCs regulatory function; and was not the result of willful actions. This self-revealing finding is considered to be of more than minor significance because it adversely impacts the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences and affected the procedure quality and human performance attributes of the same cornerstone. Specifically, the failure to have a restoration procedure resulted in the operators using their knowledge and skill of the craft to restore ES alignment and resulted in the Safety Injection actuation circuitry being inoperable for more than seven hours. Since there was no actual loss of safety function, the finding was determined to be Green (very low safety significance) in accordance with IMC 0609, Appendix A, Phase 1 SDP worksheet for at-power situations.

Enforcement:

Technical Specifications 5.4.1 required that written procedures shall be established, implemented and maintained in accordance with Reg Guide (RG) 1.33, Revision 2, Appendix A, dated February 1978. RG 1.33 Appendix A specified that procedures are required for startup, operation, and shutdown of safety related PWR systems including Emergency Core Cooling Systems. Contrary to the above, on August 31, 2005, the licensee did not have a procedure for the restoration and reset of the ECCS components which were actuated by ES channels 1 and 2. Because this finding was of very low safety significance and was entered into the licensees corrective action program (PIP O-05-5623), this issue is being treated as a non-cited violation consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000287/2005010-03, Failure to Have a Procedure for the Restoration of ES Components.

(2)

Introduction:

A Green self-revealing NCV was identified for not maintaining EOP 5.1, ES Actuation, in accordance with Technical Specification 5.4.1.

5.1 contained unnecessary steps to open valves BS-1 and BS-2 which allowed BWST water to drain to the reactor building normal sump and forced the operators to take actions outside their written EOP guidance to secure the loss of water to the sump.

Description:

On November 22, 1999, a procedure change was made to Enclosure 5.1, ES Actuation, which added steps in the procedure to open valves BS-1 and BS-2.

This was added to prevent over pressurization of the LPI suction piping in anticipation of a failure of either the A or B Low Pressure Injection Pump, since the suction piping relief valves might lift when exposed to LPI pump discharge pressure. Lifting of the relief valves would cause a loss of water inventory to the HA Waste Tank. In December 2004, a modification was installed (NSM-33106) that upgraded the relief valves 3LP-100 and 3LP-101 with a new set point and removed this vulnerability for a loss of water inventory. Upon completion of the modification, however, the Enclosure 5.1 procedure was not revised to remove step six which opened BS-1 and BS-2. On August 31, 2005, Oconee Unit 3 experienced a reactor trip and safety injection. During the event, the operators noted high level alarms for the Reactor Building Normal Sump (RBNS) which were not anticipated. The operators noted RBNS level had risen to twenty inches and, to their credit, recognized that the increase in sump level was due to the draining of the BWST to the RBNS through valves BS-1 and BS-2. The operators then took steps outside the EOP and closed the valves to conserve BWST inventory and prevent an overflow of the sump. The consequences of this step remaining in the procedure were loss of BWST water and potential compromise of leak detection by the operators.

Procedure NSD 301, Engineering Change Program, step B.5.3.5, required that the Operational Control Group complete procedure revisions prior to a modified system, structure, or component being returned to service.

Analysis:

The failure of the licensee to maintain Enclosure 5.1 with the most current engineering information is a performance deficiency, because the licensee is required to make changes to their EOPs when necessary, and complete procedure revisions prior to a modified system, structure, or component being returned to service. Traditional enforcement does not apply because the event that occurred did not result in an actual safety consequence; it did not impact the NRCs regulatory function; and was not the result of willful actions. This self-revealing finding is considered to be of more than minor significance because it adversely impacts the Mitigating Systems Cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences and affected the procedure quality and human performance attributes of the same cornerstone. Specifically the failure to remove the steps to open the valves from the procedure resulted in operators having to take actions outside the procedure to stop the loss of BWST water. The finding was determined to be Green (very low safety significance) in accordance with IMC 0609, Appendix A, Phase 1 SDP worksheet for at-power situations.

Enforcement:

Technical Specifications 5.4.1 required that written procedures shall be established, implemented and maintained covering the emergency operating procedures required to implement the requirements of NUREG-0737 and NUREG-0737, Supplement 1, as stated in Generic Letter 82-33. Contrary to the above, prior to August 31, 2005, the licensee did not revise Enclosure 5.1 to remove the steps that opened valves BS-1 and BS-2 following completion of the modification on the relief valves 3LP-100 and 3LP-101. Because this finding was of very low safety significance and was entered into the licensees corrective action program (PIP O-05-5744 ), this issue is being treated as a non-cited violation consistent with Section VI.A of the NRC Enforcement Policy: NCV 05000287/2005010-04, Failure to Maintain Enclosure 5.1, ES Actuation.

4OA6 Meetings

On September 08, 2005, the inspectors presented the inspection results to Mr. Ron Jones, and other members of the licensee staff who acknowledged the findings. The inspectors reviewed proprietary information during the inspection, but such information is not specifically referenced in this report.

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

L. Azzarello, Modification Engineering Manager

S. Batson, Operations Superintendent

M. Bailey, Digital Process Systems Supervisor

D. Baxter, Site Engineering Manager

S. Capps, MCE Manager

N. Constance, Manager, Operator Training

J. Fuller, Refurbishment Manager, Oconee Refurbishment Group

R. Hall, Director Nuclear Projects

P. Gillespie, RES Manager

H. Harling, Duke EIT Team

R. Jones, Site Vice President

P. Liddle, Manager, Electronic Systems, Areva

T. Mills, Refurbishment Engineering Manager

L. Nicholson, SA Manager

P. North, Shift Operations Manager

W. Rostron, Engineer, RES

J. Smith, Regulatory Compliance

P. Stoval, Oconee Safety Review Group Manager

D. Taylor, Engineer, Oconee Refurbishment Group

D. Williams, Duke EIT Team Leader

NRC Personnel

C. Casto, Director Division of Reactor Projects Region II

M. Shannon, Senior Resident Inspector

LIST OF ITEMS

OPENED , CLOSED, AND DISCUSSED

Opened

05000287/2005010-02 FIN Inadequate corrective actions for an identified deficiency with the Unit 3 Digital Control Rod Drive System. (Section 4OA3.3)

Opened and Closed

05000287/2005010-01 FIN Inadequate Unit 3 Digital Control Rod Drive System Modification. (Section 4OA3.2)

05000287/2005010-03, NCV Failure to Have a Written Procedure for the Restoration of ES Components. (Section 4OA3.4.b(1))

05000287/2005010-04, NCV Failure to maintain Enclosure 5.1, ES Actuation. (Section 4OA3.4.b(2))