ACCELERATEDDISTRIBUTION DEMONS~TION SYSTEM

T

REGULATORY INFORMATION DISTRIBUTION SYSTEM (RIDS)

ACCESSION NBR:9108130186 DOC.DATE: 91/08/01 NOTARIZED: NOFACIL:50-275 Diablo Canyon Nuclear Power Plant, Unit 1, Pacific Ga

AUTH.NAME AUTHOR AFFILIATIONHUG,M.T. Pacific Gas & Electric Co.SHIFFER,J.D. Pacific Gas & Electric Co.

RECIP.NAME RECIPIENT AFFILIATION

DOCKET05000275

R

SUBJECT: LER 91-011-00:on 910705,unplanned start of ESF equipmentoccurred. Caused by actuation of wrong test switch due topersonnel error. operators counseled re failure to performduties w/adequate attention to detail.W/910801 ltr.DISTRIBUTION CODE: IE22T COPIES RECEIVED:LTR ( ENCL I SIZETITLE: 50.73/50.9 Licensee Event Report (LER), Tnciden&Rpt, etc.NOTES:

RECIPIENTID CODE/NAME

PD5 LAROOD,H

INTERNAL'CNWAEOD/DOAAEOD/ROAB/DSPNRR/DET/EMEB 7ENRR/DLPQ/LPEB10NRR/DREP/PRPB11NRR/DST/SICB8H3NRR/DST/SRXB 8ERES/DSIR/EIB

EXTERNAL EG&G BRYCE iJ HNRC PDRNSIC POORE,W.

COPIESLTTR ENCL

1 11 1

2 21 12 21 11 12 21 11 11 1

3 31 11 1

RECIPIENTID CODE/NAME

PD5 PD

ACRSAEOD/DSP/TPABNRR/DET/ECMB 9HNRR/DLPQ/LHFB10NRR/DOEA/OEABNRR/DST/SELB 8DNRR/+ST/NPLB8 D1

+REG~FILE 02GN FILE 01

L ST LOBBY WARDNSIC MURPHY,G.ANUDOCS FULL TXT

COPIESLTTR ENCL

1 1

2 21 11 11 11 11 11 11 11 1

1 11 11 1

D

D

D

NOTE TO ALL"RIDS" RECIPIENTS:

PLEASE HELP US TO REDUCE WASTE! CONTACT THE DOCUMENT CONTROL DESK,ROOM P 1-37 (EXT. 20079) TO ELIMINATEYOUR NAMEFROM DISTRIBUTIONLISTS'OR DOCUMENTS YOU DON'T NEED!

D

D

S

FULL TEXT CONVERSION REQUIRED,TOTAL„NUMBER OF COPIES REQUIRED: LTTR 33 ENCL 33

P

Pacific Gas and Electric Company 77 Beafe Street

San Francisco, CA 94106415/973-'4684TtVX 9]0-372-6587

James D. ShifterSenior Vice President andGeneral fv1anager

Nuclear Power Generation

August 1, 1991

PG&E Letter No. =DCL-91-195

U.S. Nuclear Regulatory CommissionATTN: Document Control DeskWashington, D.C. 20555

Re: Docket No. 50-275, OL-DPR-80Diablo Canyon Unit 1

Licensee Event Report 1-91-011-00Actuation of Wrong Test Switch Due to Personnel Error CausesUnplanned ESF Actuation

Gentlemen:

Pursuant to 10 CFR 50.73(a)(2)(iv), PGLE is submitting the enclosedLicensee Event Report (LER) concerning an unplanned start of EngineeredSafety Features (ESF) equipment when a licensed operator inadvertentlyactuated the wrong test switch.

This event has in no way affected the health and safety of the public.

Sincerely,

g G3 ~ giornoJ. D. Shiffer

CC: Ann P. HodgdonJohn B. HartinPhillip J. HorrillPaul P. NarbutHarry RoodCPUCDiablo DistributionINPO

DC1-91-OP-N059

Enclosure

5439S/0085K/JHA/2246

9108130186 9i080iPDR ADOCK 05000275s PDR

Z$a

LICENSEE EVENT REPORT (LER)

FACILITY WUR: (1) DOCKET MMSER 2 PAGE 3

DIABLO CANYON UNIT 1 0 5 0 0 0 2 7 5 1" 6

TITLE (6) ACTUATION OF WRONG TEST SWITCH DUE TO PERSONNEL ERROR CAUSES UNPLANNED ESFACTUATION

YR

07 05 91

EVENT DATE (6)YR

91

IER IRMBER (6)SEOUEHTIAL

IRONS ERREVISICH

NMBER

0 1 1'- 0 0

REPORT DATE (I)IKN DAY YR

08 01 91

FACILITY ITS DOCKET HIRER (S)

0 5 0 0 0

0 5 0 0 0

OTHER FACILITIES INVOLVED (6)

OPERATINBHOOE (9)

THIS REPORT IS SVBHITTED PURSUANT To THE REQVIREHENTS OF 10 CFRE (11)

POWERLEVEL 100 R 10 OFR 50.73 a 2 iv

OTHER

(Specify in Abstract below and in text, HRC Form 366A)

LICENSEE CONTACT FOR MIS LER 12TELEPHONE ABER

HARTIN T. HUG — SENIOR= REGULATORY COMPLIANCE ENGINEER AREA CODE

805 545-4005CCHPLETE ONE LINE FOR EACH COHPONENT FAILURE DESCRIBED IN THIS REPORT 13

CAUSE SYSTEH COHPONENT HANUFAC-TVRER

REPORTABLETo NPRDS

CAUSE SYSTEH CCHPONENT HANUFACTVRER

REPORTABLETo NPRDS

SUPPLDKNTAL REPORT EXPECTED (16)

) I YES (if yes, complete EXPECTED SUBHISSIOM DATE) i X I HO

ABSTRACT (16)

EXPECTEDSUB)IISSI OilDA'TE (15)

HONTH DAY YEAR

On July 5, 1991, at 0103 PDT, with Unit 1 in Mode 1 (Power Operation) at 100 percent power, anunplanned start of Engineered Safety Features (ESF) equipment occurred when a licensedoperator inadvertently actuated the wrong Solid State Protection System (SSPS) test switch.The control room operators returned all actuated equipment to normal status.

On July 5, 1991, at 0133 PDT, a four-hour, non-emergency report was made to the NRC inaccordance with 10 CFR 50.72(b)(2)(ii).

I

The root cause of this event was personnel error (inattention to detail). The operatorperforming the test had the test procedure in hand, but failed to pay adequate attention tothe test content or to the steps requiring alarm verification. The operator did not discoverthat the test procedure did not test relays in both trains of the SSPS.

Corrective actions to prevent recurrence include: (1) preparation of an Operations IncidentSummary on this event, reviewing the requirements for and stressing the importance of properattention to the concurrent verification process, (2) counseling of the operators involvedconcerning their failure to perform their duties with adequate attention to detail, (3)issuance of an Operations Department Policy on control of the SSPS keys, requiring that theSSPS keys will be issued only for one train at a time on a job-by-job basis, and (4) issuanceof an Operations Department Policy to specify in detail which type of verification is to beutilized for various operating activities.

rR" ~ „~ FQF Ic

5439S/0085K

FACILITY NAME (I)

LICENSE ENT REPORT (LER) TEXT CO INUATION

DOCKET NVMSER (E)

TEXT (17)

DIABLO CANYON UNIT 1 05 0 0 0 2 7 5 91 011 0 0 2 '" 6

I. PLANT CONDITIONS

Unit 1 was in Hode 1.(Power Operation) at approximately 100X power.

II. DESCRIPTION OF EVENT

A. Event:

On July 5, 1991, plant operators were in the process of performingSurveillance Test Procedure (STP) H-16E, "Operation of Train A SlaveRelays K609 (Safety Injection) and K633 (Hotor Driven AuxiliaryFeedwater Pump Start)," in the Unit 1 Solid State Protection System(SSPS)(JC). Communication between the SSPS room and the control roomhad been established using telephones in the "speaker phone" mode ofoperation.

The first portion of the test procedure (Train A Slave Relay K633-AFW Pump Start) had been successfully completed.

The operators closed and locked the SSPS Train A test cabinet andmoved to the Train B test cabinet. This action was contrary to thetest procedure which stated that the next step was to test Train ASlave Relay K609. At 0103 PDT, Test Switch S822 was actuated in thiscabinet. This actuated SSPS Train B Slave Relay K609, rather than theintended Train A relay.

To actuate a slave relay using the SSPS test panel, the test switch isfirst turned to the "test" position, then the test button is depressedto actuate the relay. When turned to the test position, a mainannunciator alarm ("SSPS in Test Train A" or "SSPS in Test Train B")is initiated. The test procedure, requires 'that the proper alarm beverified prior to actuating the slave relay.

When requested by the operators performing the test, the control roomresponded that alarm PK 02-24 (alarm for Train B in test) had beenreceived. The:step in H-16E states that the receipt of alarm PK 02-19is to be verified. The operators performing the test did not noticethat the alarm received was not correct and proceeded with the test.The actuation of SSPS Train B K609 caused an unplanned start ofComponent Cooling Water (CCW) Pump 1-3 (CC)(P), Auxiliary Feedwater(AFW) Pump 1-2 (BA)(P), and Containment Fan Cooler Units (CFCUs) 1-4and 1-5 (BK)(CLR). If the correct slave relay had been actuated, CCWPump 1-3, AFW Pump 1-3, Auxiliary Salt Water Pump l-l (BI)(P), andCFCUs 1-2 and 1-4 would have started. CCW Pump 1-3 and CFCU 1-4 arestarted by either SSPS train.

Both operators involved in this event were experienced Senior ReactorOperators and had successfully completed this type of surveillancetest procedure on numerous occasions in the past.

439S/0085K.

LlCENSE ENT REPORT (LER) TEXT CO INUATION

FACiLITY NAME (I) DOCKET NUMBER (2) LER NUMBER

)?ji> NMRCtlNUMMX

PAGE 3

TEXT (17)

DIABLO CANYON UNIT 1 0 5 0 0 0 2 7 5 91 011 0 0 3 0F

The test procedure clearly specified which train was to be tested.The M-16 test program consists of 24 separate test procedures. Ofthese procedures, 19 tests are conducted by testing a Train A relayand then the corresponding Train B relay. Only 5 of the, tests arepresently train-specific where all relays tested are in the same SSPStrain. The operator was very familiar with the test program, and hada "mind set" that the test procedure was one that tested relays inboth trains. Although the procedure clearly stated that the nextrelay to be tested was in Train A, the operator, conditioned to theTrain A-Train B test program, incorrectly assumed that the next relayto be tested was in the Train B test cabinet. The two operatorsadmitted that, because of a previous slave relay testing problem wherethe incorrect test switch in the correct train was actuated(LER 1-91-005) they were very focused on actuating the correct relaynumber. The SSPS cabinets are located in a common room, but areclearly labeled as NAN or "BN Train both inside and outside of thecabinet door. The area is well lit and free of noise or otherdistractions. The two operators were working their normal night shiftand had not been working excessive overtime or had an abnormally highworkload during the shift preceding this event.

NPAP C-104, "Independent Verification," requires that evolutions suchas SSPS slave relay testing be accompli'shed using a "ConcurrentVerification" technique. This technique utilizes an operator readingsteps and agreeing that the second operator in fact has the correctcomponent prior to the component being actuated. Proper use of theconcurrent verification process should have prevented this event, butthe verification was not correctly performed, since the "verifier" wasnot reading the procedure. A discussion with the operators involvedrevealed that the verification was not performed properly because theywere uncertain as to the requirements. They were aware that some sortof verificati'on was required; however,,since the H-16 procedures didnot specifically state that concurrent verification was to be used,and no independent verification signoffs were provided in the H-16procedure, they were not certain as to the specific requirements.

Although the doors for the SSPS cabinets are normally locked closedand are keyed with different keys for Trains A and 8, no system was inplace to separate these keys to take advantage of this installedsystem. The SSPS keys for Trains A and B are stored and issuedtogether on the same key ring. If the keys were issued separately ona job-by-job basis, train errors such as this would be prevented.

439S/0085K

LICENSE ENT REPORT (LER) TEXT CO INUATION

FAC!L(TY NAHE (1) DOCKET NUN8ER (8) LER NW8ER 6$EQUEMlIAL ? 8

NUMBER

TEXT (17)

DIABLO CANYON UNIT 1 05 0 0 0 2 7 5 91 011 0 0 4 " 6

B. Inoperable Structures, Components, or Systems That Contributed to theEvent:

C.

None.

Dates and Approximate Times for Major Occurrences:

1. July 5, 1991, 0103 PDT: Event/Discovery Date — Inadvertentactuation of SSPS Train B Slave RelayK609 causes AFW Pump 1-2, CCW Pump 1-3,and CFCUs 1-4 and 1-5 to start or shiftto low speed operation.

2. July 5, 1991, 0105 PDT: All equipment actuated by SSPS Train BSlave Relay K609 was returned to pre-event status.

D.

E.

3. July 5, 1991, 0133 PDT: A four-hour, non-emergency report wasmade to the NRC in accordance with10 CFR 50.72 (b)(2)(ii).

Other Systems or Secondary Functions Affected:

None.

method of Discovery:

The event was immediately apparent to control room personnel due tonumerous alarms and indications in the control room.

F.

G.

Operator Actions:

The control room operators reset SSPS Train B Slave Relay K609 andreturned all equipment to pre-event status.

Safety System Responses:

1. Auxiliary Feedwater Pump 1-2 started.

2. Component Cooling Water Pump 1-3 started.

3. Containment Fan Cooler Units 1-4 and 1-5 started in low speed.

439S/0085K

0

FACILITY NAME (I)i

LICENSEE ENT REPORT (LER) TEXT CO NUATION

DOCKET NEER (2) PAGE 3

TEK'T (17)

DIABLO CANYON UNIT 1 05 0 0 0 2 7 5 91 01 1 0 0 5 'F 6

III. CAUSE OF THE EVENT

A. Immediate Cause:

The immediate cause of this event was that SSPS Train B Test SwitchS822 was actuated instead of the intended SSPS Train A Test SwitchS822.

B. Root Cause:

The root cause of this event was personnel error (inattention todetail). The operator performing the test had the test procedure inhand, but failed to pay adequate attention to the test content or tothe steps requiring alarm verification. The operator did not discoverthat the test procedure did not test relays in both trains of theSSPS.

C. Contributory Causes:

1. No system was in place to properly control the issuance of theSSPS cabinet keys. The existing key control procedures causedthe keys to both trains of the SSPS to be issued for each SSPStask.

2. The concurrent verification process was improperly performedbecause the operators involved were not clear as to the specificverification requirements for this type of testing.

IV. ANALYSIS OF THE EVENT

V.

Since all equipment performed as designed during this event, the inadvertentactuation of several ESF-related components did not adversely affect thehealth and safety of the public.

CORRECTIVE ACTIONS

A. Immediate Corrective Actions:

B.

The control room operators reset SSPS Train B Slave Relay K609 andreturned all equipment to pre-event status.

Corrective Actions to Prevent Recurrence:

l. An Operations Incident Summary will be prepared on this event,reviewing the requirements for, and stressing the importance of,proper attention to the concurrent verification process.

2. The operators involved were counseled concerning their failure toperform their duties with adequate attention to detail.

439S/0085K

LICENSEE ENT REPORT (LER) TEXT CON INUATION

FACTElTY NAME (1) OOCXET ee8ER (2) LER NUM8ER

MWISICtl;: $ NVLOEL

PAGE 3

TEXT (17)

DIABLO CANYON UNIT 1 05 0 0 0 2 7 5 91 01 1 00 6" 6

3. An Operations Department Policy will be issued on control of theSSPS keys. This policy will require that the SSPS keys will beissued only for one train at a time on a job-by-job basis.

4. An Operations Department Policy will be developed and issued tospecify in detail which type of verification is to be utilizedfor various operating activities.

VI. ADDITIONAL INFORMATION

A.

B.

Failed Components:

None.

Previous Similar Events:

1. LER 1-91-005 (Actuation of Wrong Test Switch Causes UnplannedDiesel Generator Start (ESF Actuation) Due to Personnel Error)describes an event where improper self-verification caused aninadvertent ESF actuation. Corrective actions were taken to re-emphasize the importance of self-verification and concurrentverification. These corrective actions did cause the operator inthe current event to double-check the switch in his hand. Inaddition, a second operator accompanied him for independentverification. However, these checks were not properly performedas neither operator verified their actions against the procedure.

2. Several other previous events have been reported that were causedby improper self-verification and concurrent verificationtechniques, including LER 1-90-004 (Technical Specification 3.0.3Entry due to Personnel Error), LER 1-89-012 (Fuel HandlingBuilding Ventilation System Transfer to the Iodine Removal ModeDue to Personnel Error), LER 1-88-030 (Failure to Meet TS LCO Dueto an Improper Valve Alignment), LER 1-88-023 (ContainmentVentilation Isolation Inadvertently Initiated due to OperatorError), and LER 1-88-020 (Reactor Trip from Overtemperature-Delta Temperature Protection Logic Due to Personnel Error).

439S/0085K