Information Notice No. 84-51: Independent Verification

                                                 SSINS No.: 6835           
                                                 IN 84-51

                                 UNITED STATES
                         NUCLEAR REGULATORY COMMISSION
                     OFFICE OF INSPECTION AND ENFORCEMENT
                            WASHINGTON, D.C. 20555

                                 June 26, 1984

Information Notice No. 84-51: INDEPENDENT VERIFICATION

Addressees:

All nuclear power reactor facilities holding an operating license (OL) or 
construction permit (CP).

Purpose:

There has been a continuing incidence of personnel errors or procedural
errors  that have resulted in inadvertent reactor trips and safety-related
equipment  inadvertently placed in an inoperable status. These events are
considered by  the NRC to be avoidable contributors to risk to the public
health and safety.

This notice is being issued to emphasize the importance of independent 
verification to reduce the rate of occurrence of such errors.

It is expected that recipients will review the information in this notice for 
applicability to their facilities and consider actions, if appropriate, to 
preclude similar problems occurring at their facilities.

Description of Circumstances:

A number of significant events have occurred in which personnel error by
plant  staff has contributed to the severity of an event. Perhaps the most
notorious  example is the mispositioned auxiliary feedwater valves at Three
Mile Island  Unit 2 (TMI-2).

As a result of the TMI-2 accident, the NRC developed a comprehensive plan to 
improve safety at power reactor facilities; this plan was published in 
November 1980 as NUREG-0737.

Task Action Plan, Item I.C.6 (NUREG-0737), required that licensees review 
their procedures and revise them, if necessary, to require independent 
verification of proper actions when releasing active systems and equipment
for  maintenance, surveillance testing or calibration, and subsequent return-
to-service. Excerpts from the detailed requirements listed in NUREG-0737 are 
presented in Attachment 1 to this notice.


.

                                                 IN 84-51
                                                 June 26, 1984             
                                                 Page 2 of 3

Personnel errors causing improper system operation have continued to occur
at  an excessive rate during 1982, 1983, and thus far in 1984. Systems are
still  being incorrectly removed from service or returned to service when
they are  not operable. Some examples for which the NRC has taken elevated
enforcement  actions are presented in Attachment 2. Other examples, dealing
with  containment spray systems, are discussed in Information Notice 84-39, 
"Inadvertent Isolation of Containment Spray Systems." In addition,
Information  Notice 84-37, "Use of Lifted Leads and Jumpers During
Maintenance or  Surveillance Testing," lists other recent examples of
problems with improper  use of jumpers and lifted electric-leads.

Inspection activities and associated discussions with licensees disclose that 
independent verification programs and related implementation procedures and 
practices have been found lacking to the extent that substantial improvements 
are either being planned or are in progress at certain plants. Improvements 
have been found to be necessary in the definitions being used for the terms 
"independent verification" and "qualified personnel," the scope of
independent  inspection activities, the use of working procedures during the
independent  verification process, the clarity of language used in procedures
to clearly  specify exactly what personnel must complete before signing off
a section of  the procedure, and the importance that management places on
independent  verification activities. In some cases, the breadth of these
weaknesses may  call into question the adequacy of management controls to
ensure that its  directives associated with independent verification are
being observed.

Some utilities seem to have programs that are successful in avoiding the
types  of problems illustrated in Attachment 2. Such utilities appear to have 
developed, verified, and used explicit procedures and checklists for all 
recurring operations. Personnel have been trained in what to do, how to do
it,  and why it must be done that way.

Functional tests used in lieu of independent verification, should be examined 
to ensure they test the entire portion of the system affected by the previous 
actions. For example, performing a normal surveillance by running a pump on 
recirculation may not verify correct alignment of all valves in the system.

Independent verification should be independent with respect to personnel, 
i.e., two appropriately qualified individuals, operating independently,
should  verify that equipment has been properly returned to service. Both 
verifications are to be implemented by procedure and documented by the 
initials or signature of the two individuals performing the alignment and 
verification.

In certain instances it may be possible to accomplish one verification from 
observing control room instruments, annunciators, valve position indicators, 
etc. This is acceptable as long as the control room indication is a positive 
one and is directly observed and documented.


.

                                                 IN 84-51
                                                 June 26, 1984
                                                 Page 3 of 3


Clearly, all components that provide a safety function should be
independently verified when alignment changes have been made in a mode where
the system is required.  Similarly, the alignment of safety systems and
individual components relating to safety, made in preparation for entering
a mode in which the systems or components are required, must be independently
verified.  Following a plant outage where maintenance was performed, all
safety system lineups should be performed using independent verification
before entering the mode where that equipment is required to be operable.

Independent verification is vital to the safe operation of nuclear
facilities.  The concern that independent verification is too time consuming
and shows a lack of confidence in operators is shortsighted.  Independent
verification is simply a recognition that even the best operators will make
an occasional error.  Where the risks and consequences of such an error are
extreme, a second check is required.  This is an important and potentially
beneficial requirement resulting from the TMI Action Plan.  Many escalated
enforcement actions since TMI involved events that could have been prevented
had the licensee adequately applied independent verification.

No written response to this notice is required; however, it is suggested that
licensees and holders of Construction Permits review this information for
applicability to their facilities.

If you have any questions about htis matter, please contact the Regional
Administrator of the appropriate NRC regional office or the Technical Contact
listed in this notice.



                                    Edward L. Jordan, Director
                                    Division of Emergency Preparedness
                                      and Engineering Response
                                    Office of Inspection and Enforcement

Technical Contact:      J. B. Henderson, IE
                        (301) 492-9654

Attachments:
1.    Excerpts from NUREG 0737 Item I.C.6
2.    Examples of Escalated Enforcement Actions
3.    List of Recently Issued Information Notices

.

                                                 Attachment 1              
                                                 IN 84-51
                                                 June 26, 1984             
                                                 Page 1 of 2

                           EXCERPTS FROM ACTION ITEM
                              I.C.6 OF NUREG-0737

I.C.6   GUIDANCE ON PROCEDURES FOR VERIFYING CORRECT PERFORMANCE OF        
 OPERATING ACTIVITIES

Position

It is required (from NUREG-0660) that licensees' procedures be reviewed and 
revised, as necessary, to assure that an effective system of verifying the 
correct performance of operating activities is provided as a means of
reducing  human errors and improving the quality of normal operations. This
will reduce  the frequency of occurrence of situations that could result in
or contribute  to accidents.

Clarification

Item I.C.6 . . . and Recommendation 5 of NUREG-0585 propose requiring that 
licensees procedures be reviewed and revised, as necessary, to assure that
an  effective system of verifying the correct performance of operating
activities  is provided. An acceptable program for verification of operating
activities is  described below.

The American Nuclear Society has prepared a draft revision to ANSI Standard 
N18.7-1972 (ANS 3.2) . . . A second revision . . . to Regulatory Guide  1.33
. . . endorses the latest draft revision to ANS 3.2 subject to the  following
supplemental provisions:

1.   Applicability of the guidance of Section 5.2.6 should be extended to  
     cover surveillance testing in addition to maintenance.

2.   In lieu of any designated senior reactor operator (SRO), the authority 
     to release systems and equipment for maintenance or surveillance testing
     or return-to-service may be delegated to an on-shift SRO, provided    
     provisions are made to ensure that the shift supervisor is kept fully 
     informed of system status.

3.   Except in cases of significant radiation exposure, a second qualified 
     person should verify correct implementation of equipment control     
measures such as tagging of equipment.

4.   Equipment control procedures should include assurance that control-   
 room operators are informed of changes in equipment status and the     
effects of such changes.


.

                                                 Attachment 1              
                                                 IN 84-51
                                                 June 26, 1984             
                                                 Page 2 of 2

5.   For the return-to-service of equipment important to safety,/*/ a second 
     qualified operator should verify proper systems alignment unless     
     functional testing can be performed without compromising plant safety, 
     and can prove that all equipment, valves, and switches involved in the 
     activity are correctly aligned.


/*/The NRC staff is developing guidance to clarify the scope of the term   
   "important to safety" and the requirements applicable to this class of  
   equipment.


.

                                                 Attachment 2              
                                                 IN 84-51
                                                 June 26, 1984             
                                                 Page 1 of 2

                  EXAMPLES OF PERSONNEL ERRORS WHICH RESULTED
                        IN ESCALATED ENFORCEMENT ACTIONS

At Dresden Unit 2, from August 24 to October 2, 1982, the licensee failed to 
close vent and isolation valves on a torus sightglass, thereby violating 
primary containment integrity. During this period, except for the days of 
September 24 through 30, 1982, primary containment integrity was required. 
After this condition was discovered by the operating staff, reporting 
requirements were not adequately followed.

At Indian Point Unit 2, with the reactor critical, the boron injection tank 
(BIT) was not operated in accordance with the station's procedures for
periods  of time on February 2, 3, 4, 24, 25, 27, 28 and March 1, 2, 3, 4,
5, 1982, so  that

1.   Required BIT overpressure was not maintained and pressure control valve
     operability was not verified for the time periods noted.

2.   Required overpressure was not verified and adjusted to normal on receipt 
     of a low pressure alarm.

3.   Operators and supervisors failed to identify abnormal trends in logged
     data and failed to take appropriate corrective action.

4.   Required overpressure was reduced to zero on February 2, 1982, in     
     accordance with a maintenance work request issued on January 24, 1982, 
     without adequately determining the effect on plant operation.

At Oyster Creek the reactor was operated in violation of technical 
specification limiting conditions for operation during the period from May
14,  1980 to February 26, 1982. A particular valve serves two functions, 
containment isolation and vacuum breaking (between the reactor building and 
the suppression pool). This valve was assembled incorrectly, so that it
failed  to properly perform either of its dual design functions. Inadequate 
maintenance procedures for reassembly and test of the valve caused the 
violation in the first place. Inadequate periodic functional test procedures 
allowed the condition to exist undetected for over twenty one months.

At Rancho Seco, two significant violations of regulatory requirements were 
identified. These violations demonstrated a lack of control of licensed 
activities and the lack of continuous awareness of the status of safety-
related components by shift supervisors and operators. As a result, the plant 
was operated without the control room operators being aware that one of the 
two diesel generators was inoperable for 29 hours and that one of the two 
high-pressure injection pumps was inoperable for 66 hours. Auxiliary
operators had


.

                                                 Attachment 2              
                                                 IN 84-51
                                                 June 26, 1984             
                                                 Page 2 of 2

been recording information on the pertinent log sheet regarding these two 
components without assuring accuracy. Recording of inaccurate information in 
plant records appears to have been a major contributor to continued plant 
operation with the two safety-related components, mentioned above, out of 
service. In addition, operating personnel did not respond properly to the 
diesel generator trouble alarm. Inoperability of the diesel generator for 29 
hours, undetected, occurred on February 10 and 11, 1982. Inoperability of the 
high pressure injection pump existed, undetected, from February 26 through 
March 1, 1982.

At Arkansas Nuclear One, from December 30, 1982, to September 26, 1983, Unit
2  was in violation of its Technical Specifications, because three successive 
quarterly tests for station battery operability had disclosed uncorrected 
violations of parameter limits. The licensee attributed the basic cause of
the  problem to inadequate procedures. The procedures included the limiting 
parameter values, but did not identify them as accept/reject values. Further, 
the procedures were vague about what was required of the tester if limits
were  exceeded.

At Turkey Point, there are three steam turbine-driven auxiliary feedwater 
pumps. Each is supplied with steam from either Units 3 or 4 and can deliver 
feedwater to either Units 3 or 4. Unit 3 was operating at full power, Unit
4  was shut down. New, redundant steam supply lines were being installed for
each  feedwater pump turbine. Pump A was out of service for maintenance;
pumps B and  C were required to be operable in support of Unit 3.

On April 14, 1983 an operator was issued two clearance tags and was
instructed  to verify that valves in the new redundant steam lines were shut
and to hang  the clearance tags on the valves. Five days later, the same
operator realized  and reported that the clearance tags were on the older
steam supply lines to  the B and C pump turbines, and those valves were
closed, rendering both of  these auxiliary feedwater pumps inoperable.


 

Page Last Reviewed/Updated Tuesday, March 09, 2021