g,: ,

a :, I-

Duk 1%nt Company IIO4)8IMUOO,AlcGuire Nuclear Station.12700 Hagm Terry R,adHuntmeille, NC280iS 89M

i

i

DUKEPOWER' ,

November 14, 1990,

U.S. Nuclear Regulatory Commissioni

Document Control DeskWashington, D.C. 20555

.;

Subject: McGuire Nuclear Station Unit 1 jDocket No. 50-369 ;Voluntary Special Report

!

Gentlement

Attached is Voluntary Special Report concerning an incident involving the Standby-Shutdown' System in which compensatory measures were not established as required by -|nthe McGuire Physical Security Plan. This' report is being submitted as a VoluntarySpecial Report. This event is considered to be of no significance with respect tothe health and safety of the public,

i

Very truly yours,,

6 i/np .tq % |JT.L. McConnell i

:

DVE/ADJ/chl ')1

]9Attachment

xc: Mr. S.D. Ebneter Mr, Darl HoodAdministrator, Region II' U.S. Nuclear Regulatory CommissionU.S. Nuclear Regulatory Commission Office of Nuclear Reactor Regulation -,101 Marietta St., NW, Suite 2900 Washington, D.C. 20555Atlanta, GA 30323

. ,

Mr. P.K. Van Doorn |INPO Records Center NRC Resident InspectorSuite 1500 McGuire Nuclear Station ,1100 circle 75 Parkway 'Atlanta, GA 30339

M&M Nuclear Consultants1221 Avenue of the AmericasNew York, NY 10020

!

. . . ,

9011260014 9011g4 i{DR ADOCK 05000369 I I- pdc (\

.

__ _ ___ _ _ . . . _ _ _ _ . . _ _ . . . . . . . . . .. ..;. .

,

:(. ...-.

ji McGUIRE SAFETY REVIEW GROUP INPLANT REVIFW REPORT,

1.0 REPORT NUMBER: 90-28

2.0 DATE OF REVIEW: November. 1990

3.0 SUBJECT DESCRIPTION: A review was conducted of the circumstances relating tothe incident described on Problem Investigation Report (PIR) 1-M90-0268. Thecspecific purpose of the review was to determine the cause of the incident andpossible solutions to prevent further problems of the type described by thePIR.

4.0 EVALUATION AND COMMENT: PIR 1-M90-0268 documented an incident in which-compensatory measures were not established as required by the McGuire PhysicalSecurity Plan (PSP). -

4.1 Background

The Standby Shutdown System (SSS) provides an alternate and independentmeans to_ achieve and_ maintain a Hot Standby condition for one or bothunits. Through the SSS, capability is maintained for both units to remainin Hot Standby.for a conservative period of three days without damagecontrol measures being implemented. SSS instrumentation and controls arelocated in the Standby Shutdown Facility-(SSF). The SSF also contains aDiesel Generator.to provide assured power for SSS operation shouldexternal power be lost.

The SSF controls the secondary side volume by utilizing the AuxiliaryFeedwater System (CA) Turbine Driven Pump. This supplies feedwater to the-Steam Generators, thereby providing a heat sink for the Reactor. CoolantSystem-(NC).

The McGuire PSP states that compensatory measures shall be provided duringperiods when the SSF is considered degraded. The SSS is required to beoperable in Modes 1-(Power Operation), 2 (Startup), and 3 (Hot Standby), {per Selected Licensee Commitment 16.9.7. A note is attached to 16.9.7

:

.. . - _ - - ,

4..:

,

I'

' ' DPC/MNS _r Inplant Riview No. 90-28

Page 2 |.describing required actions whenever one or more SSS components become jinoperable, which states: ,

Note - THE SRO SHOULD ENSURE THAT SECURITY IS NOTIFIED 10 MINUTES I1-

PRIOR TO DECLARIN0 SSS COMPONENTS INOPERABLE (EXAMPLE: TDCA i

PUMP) OR ASAP IF SSS COMPONENTS ARE DISCOVERED OR RENDERED

INOPERABLE SO THAT COMPENSATORY MEASURES CAN BE IN EFFECT

WITHIN 10 MINUTES OF THE TIME OF INOPERABILITY. OTHEP. WISE,

A 1 HOUR NOTIFICATION TO NRC IS REQUIRED BY SECURITY.

4.2 Description of Event

.

At the start of night shift on October 10,'1990, Instrumentation And

!y Electrical (IAE) personnel arrived ~in the Control R: ~ with three workrequests. These work requests involved working on the non-safety relatedvalve operators for valves ICA-36 (Aux Feedwater No. 1 Discharge To Steam

L Generator ID Control) and ICA-52- (Aux Feedwater Pump To Steam tienerator IBi

..

h Control)'. After talking with the IAE personnel, the Operations (OPS)Shift Supervisor determined that it would be better to wait until after-2400 (midnight) to start this work. The Shift Manager was contacted and

| all parties agreed to wait until that time.

E.

1At approximately 0130 on October 11, 1990, the IAE personnel returned to' '

the Control Room for permission to begin work. The Control Room Senior;

.

Reactor Operator (SRO) determined that the, nature of this work would makethe Turbine Driven Auxiliary Feedwater (TDCA) Pump inoperable. !

E|}| At.this time, the Control Room SRO referenced Technical Specification (TS)

L 3.7.1'.2, Auxiliary Feedwater System, to determine the proper actionstatement requirements. He selected action 'a' as the-appropriate one,Action 'a' states as follows:p

With'one auxiliary feedwater pump inoperable, restore the reanired ,auxiliary feedwater pumps to-Operable status within 72 hours or be inat least Hot Standby within the next 6 hours and in Hot Shutdownwithin the following 6 hours.

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ . _ _ . _ . ,

.- . . - - -- - - - - - _ .- _ ,

'. . , - q,

DEC/MNS . )"

*1 .Inplant Review No. 90-28--Page 3*

He then referenced page'1, Section IV of tre TS Reference Manual todetermine if other systems or components would be affected when the;TDCA

pump was declared inoperable. No reference was made to other systems orcomponents. Neither reference used addressed the fact that if the TDCA

pump was declared inoperable, the Selected Licensee Commitments Manual

should also be consulted.

Subsequently, at 0145, on October 11, 1990, the TDCA pump was declared ;inoperable.

.

Approximately twenty minutes later, the OPS Shif t Supervisor returned tothe Control Room.- The Control Room SR0' informed him that he had declared-. , .a-the TDCA pump inoperable. The Shift Supervisor then asked the Control

U Room SRO if he had also consulted the Selected Licensee CommitmentsManual. The response was no.

i

'

At that. time, the Shift Supervisor knew that an error had been made and''{ 'T directed the SRO to reference the Selected Licensee Commitments Manual,

item 16.9.7, entitled Standby Shutdown System.

Based on the note attached to the page of 16.9.7, the Control Room SRO

Lc. realized that when he had declared the TDCA pump inoperable, a subsequent

isecurity notification should have been made.o

L.

At'0222, the Control Room SRO declared the SSF inoperable and notified the-Security Lieutenant of the error. He also informed him that the required-one-hour notification to the NRC had to be made by no later than 0245. J-

Security personnel implemented appropriate compensatory actions at 0231.,

*

This involved opening Fire Door 801J and placing constant SecuritySurveillance at the door. The Security Lieutenant then made the required- ,;one hour notification to the NRC at 0240.

The Shift Manager:was informed of the event, and made appropriate 41 notifications. The NRC Resident Inspector was also notified by Security

personnel.

.

- - - - -- . _ _ _ . - - _ - - - - - - - _ _ _ . _ - _ _ - . _ _ - - _ . _ . -

_ . . _ . . . . . . . . . . . . . . . . . . . . .- . .. - - . . - - . - . - . - - - -

-- .

: 'S.

$ 4

. .

DPC/MNS_

.

Inplant' Review No. 90-28- Page 4

It was later determined that this event was not reportable under,

10CFR73.71 Appendix G-1. Therefore, the 1 hour notification to the NRC

was not required.

4.3 Safety Evaluation

During the time the SSF was degraded, the area accessed through Fire Door801J was not provided security compensatory measures as required forapproximately 46 minutes. During normal operating conditions when the SSFis not degraded, the equipment in this area is non-vital. When the SSF is

degraded, the equipment in this area becomes vital because the equipmentis necessary to safely shutdown the pl"at.

Pursuant to the McGuire PSP two levels of security protection are requiredfor areas containing vital' equipment: One level of physical protection

and access control for the protected area; and, a second level,of physicalprotection and access control for areas containing vital equipment withinthe protected area. This second level of security protection is providedto prevent. personnel inside the protected area from accessing areascontaining vital equipment for which they have not been authorized access.Personnel are allowed access to areas containing' vital equipment on an asneeded basis. By limiting the. number of personnel accessing vitalequipment, the-probability of insider sabotage is reduced. -During.the 46minutes.when security protection was not'provided at Fire-Door 801J, thephysical protection and access control to the protected area wasmaintained. Additionally, there were no challenges made to gain access to

the protected' area. During the event, there were no ESF actuations or'

challenges to safety systems that required the use of the SSF to shut downthe plant. The plant operated without incident during the: time the

required. security compensatory measure was not fulfilled. Therefore, the

health and safety of the public and on-site personnel were not affected by

this incident.-

-5.0' CONCLUSION

This incident is assigned a cause of Inappropriate Action because the requiredaction as specified by the note attached to Selected Licensee Commitment 16.9.7was omitted. The Control Room SRO failed to recognize the need to consult the

. .. _ _ _ _ _ _ _ _ _ - - _ _

' *. . . .

. . . .

DPC/MNS:*'> Inplant Re cew No.-90-28

*Page 5

f Selected. Licensee Commitments Manual when he declared the TDCA Pump inoperable,l Consequently, the required notification of Security personnel was omitted

because the Control Room SRO did not reference the Selected LicenseeCommitments Manual.

When questioned, the Control Room SRO involved stated that he had never

performed this particular task as an SRO and was, therefore,- unaware of therequirements as specified by the Selected Licensee Commitment. It should benoted that the Control Room SRO involved had only been promoted to thatposition four weeks prior to this event. He also stated that the task was notone that he remembered as being emphasized during training. However,Production' Support Training personnel stated that their lesson plan coversusing the Selected Licensee Commitments Manual whenever the TDCA pump isdeclared inoperable.- Subsequently, the incident has been covered with allappropriate OPS personnel to help preclude recurrence of.similar incidents.Additionally, a copy of Selected Licensee Commitment 16.9.7, and tite attachednote detailing' required actions, has been placed in the TS Reference Manual in '

the Control-Room. This should serve as a reference whenever the TDCA pump isdeclared inoperable in the' future. Compliance personnel will evaluate andsubmit appropriate changes to the Selected Licensee Commitments Manual to

clarify appropriate actions required whenever any component of the SSS is' '

declared inoperable.

J6.0 RECOMMENDATIONS: None, ,

7.0 REFERENCES:

1. .McGuire Technical Specification, Section 3.7.1.2, Auxiliary Feedwater~

-System'

2. |McGuire Technical Specification Reference Manual, Page 1, Section IV3. McGuire Selected Licensee Cossnitments Manual, Item 16.9.7, Standby

Shutdown System

'4. McGuire Senior Reactor Operator's Logbook, Unit 15. McGuire Shift Manager's Logbook, Unit 16. McGuire Technical Specification Action Item Logbook, Unit 17. McGuire Safeguards ENS Event Report, For 10/11/90 at 02228. McGuire Physical Security Plan9. * % ire Security Procedure EXAC-15 |

. . .