Information Notice No. 84-51: Independent Verification
SSINS No.: 6835
IN 84-51
UNITED STATES
NUCLEAR REGULATORY COMMISSION
OFFICE OF INSPECTION AND ENFORCEMENT
WASHINGTON, D.C. 20555
June 26, 1984
Information Notice No. 84-51: INDEPENDENT VERIFICATION
Addressees:
All nuclear power reactor facilities holding an operating license (OL) or
construction permit (CP).
Purpose:
There has been a continuing incidence of personnel errors or procedural
errors that have resulted in inadvertent reactor trips and safety-related
equipment inadvertently placed in an inoperable status. These events are
considered by the NRC to be avoidable contributors to risk to the public
health and safety.
This notice is being issued to emphasize the importance of independent
verification to reduce the rate of occurrence of such errors.
It is expected that recipients will review the information in this notice for
applicability to their facilities and consider actions, if appropriate, to
preclude similar problems occurring at their facilities.
Description of Circumstances:
A number of significant events have occurred in which personnel error by
plant staff has contributed to the severity of an event. Perhaps the most
notorious example is the mispositioned auxiliary feedwater valves at Three
Mile Island Unit 2 (TMI-2).
As a result of the TMI-2 accident, the NRC developed a comprehensive plan to
improve safety at power reactor facilities; this plan was published in
November 1980 as NUREG-0737.
Task Action Plan, Item I.C.6 (NUREG-0737), required that licensees review
their procedures and revise them, if necessary, to require independent
verification of proper actions when releasing active systems and equipment
for maintenance, surveillance testing or calibration, and subsequent return-
to-service. Excerpts from the detailed requirements listed in NUREG-0737 are
presented in Attachment 1 to this notice.
.
IN 84-51
June 26, 1984
Page 2 of 3
Personnel errors causing improper system operation have continued to occur
at an excessive rate during 1982, 1983, and thus far in 1984. Systems are
still being incorrectly removed from service or returned to service when
they are not operable. Some examples for which the NRC has taken elevated
enforcement actions are presented in Attachment 2. Other examples, dealing
with containment spray systems, are discussed in Information Notice 84-39,
"Inadvertent Isolation of Containment Spray Systems." In addition,
Information Notice 84-37, "Use of Lifted Leads and Jumpers During
Maintenance or Surveillance Testing," lists other recent examples of
problems with improper use of jumpers and lifted electric-leads.
Inspection activities and associated discussions with licensees disclose that
independent verification programs and related implementation procedures and
practices have been found lacking to the extent that substantial improvements
are either being planned or are in progress at certain plants. Improvements
have been found to be necessary in the definitions being used for the terms
"independent verification" and "qualified personnel," the scope of
independent inspection activities, the use of working procedures during the
independent verification process, the clarity of language used in procedures
to clearly specify exactly what personnel must complete before signing off
a section of the procedure, and the importance that management places on
independent verification activities. In some cases, the breadth of these
weaknesses may call into question the adequacy of management controls to
ensure that its directives associated with independent verification are
being observed.
Some utilities seem to have programs that are successful in avoiding the
types of problems illustrated in Attachment 2. Such utilities appear to have
developed, verified, and used explicit procedures and checklists for all
recurring operations. Personnel have been trained in what to do, how to do
it, and why it must be done that way.
Functional tests used in lieu of independent verification, should be examined
to ensure they test the entire portion of the system affected by the previous
actions. For example, performing a normal surveillance by running a pump on
recirculation may not verify correct alignment of all valves in the system.
Independent verification should be independent with respect to personnel,
i.e., two appropriately qualified individuals, operating independently,
should verify that equipment has been properly returned to service. Both
verifications are to be implemented by procedure and documented by the
initials or signature of the two individuals performing the alignment and
verification.
In certain instances it may be possible to accomplish one verification from
observing control room instruments, annunciators, valve position indicators,
etc. This is acceptable as long as the control room indication is a positive
one and is directly observed and documented.
.
IN 84-51
June 26, 1984
Page 3 of 3
Clearly, all components that provide a safety function should be
independently verified when alignment changes have been made in a mode where
the system is required. Similarly, the alignment of safety systems and
individual components relating to safety, made in preparation for entering
a mode in which the systems or components are required, must be independently
verified. Following a plant outage where maintenance was performed, all
safety system lineups should be performed using independent verification
before entering the mode where that equipment is required to be operable.
Independent verification is vital to the safe operation of nuclear
facilities. The concern that independent verification is too time consuming
and shows a lack of confidence in operators is shortsighted. Independent
verification is simply a recognition that even the best operators will make
an occasional error. Where the risks and consequences of such an error are
extreme, a second check is required. This is an important and potentially
beneficial requirement resulting from the TMI Action Plan. Many escalated
enforcement actions since TMI involved events that could have been prevented
had the licensee adequately applied independent verification.
No written response to this notice is required; however, it is suggested that
licensees and holders of Construction Permits review this information for
applicability to their facilities.
If you have any questions about htis matter, please contact the Regional
Administrator of the appropriate NRC regional office or the Technical Contact
listed in this notice.
Edward L. Jordan, Director
Division of Emergency Preparedness
and Engineering Response
Office of Inspection and Enforcement
Technical Contact: J. B. Henderson, IE
(301) 492-9654
Attachments:
1. Excerpts from NUREG 0737 Item I.C.6
2. Examples of Escalated Enforcement Actions
3. List of Recently Issued Information Notices
.
Attachment 1
IN 84-51
June 26, 1984
Page 1 of 2
EXCERPTS FROM ACTION ITEM
I.C.6 OF NUREG-0737
I.C.6 GUIDANCE ON PROCEDURES FOR VERIFYING CORRECT PERFORMANCE OF
OPERATING ACTIVITIES
Position
It is required (from NUREG-0660) that licensees' procedures be reviewed and
revised, as necessary, to assure that an effective system of verifying the
correct performance of operating activities is provided as a means of
reducing human errors and improving the quality of normal operations. This
will reduce the frequency of occurrence of situations that could result in
or contribute to accidents.
Clarification
Item I.C.6 . . . and Recommendation 5 of NUREG-0585 propose requiring that
licensees procedures be reviewed and revised, as necessary, to assure that
an effective system of verifying the correct performance of operating
activities is provided. An acceptable program for verification of operating
activities is described below.
The American Nuclear Society has prepared a draft revision to ANSI Standard
N18.7-1972 (ANS 3.2) . . . A second revision . . . to Regulatory Guide 1.33
. . . endorses the latest draft revision to ANS 3.2 subject to the following
supplemental provisions:
1. Applicability of the guidance of Section 5.2.6 should be extended to
cover surveillance testing in addition to maintenance.
2. In lieu of any designated senior reactor operator (SRO), the authority
to release systems and equipment for maintenance or surveillance testing
or return-to-service may be delegated to an on-shift SRO, provided
provisions are made to ensure that the shift supervisor is kept fully
informed of system status.
3. Except in cases of significant radiation exposure, a second qualified
person should verify correct implementation of equipment control
measures such as tagging of equipment.
4. Equipment control procedures should include assurance that control-
room operators are informed of changes in equipment status and the
effects of such changes.
.
Attachment 1
IN 84-51
June 26, 1984
Page 2 of 2
5. For the return-to-service of equipment important to safety,/*/ a second
qualified operator should verify proper systems alignment unless
functional testing can be performed without compromising plant safety,
and can prove that all equipment, valves, and switches involved in the
activity are correctly aligned.
/*/The NRC staff is developing guidance to clarify the scope of the term
"important to safety" and the requirements applicable to this class of
equipment.
.
Attachment 2
IN 84-51
June 26, 1984
Page 1 of 2
EXAMPLES OF PERSONNEL ERRORS WHICH RESULTED
IN ESCALATED ENFORCEMENT ACTIONS
At Dresden Unit 2, from August 24 to October 2, 1982, the licensee failed to
close vent and isolation valves on a torus sightglass, thereby violating
primary containment integrity. During this period, except for the days of
September 24 through 30, 1982, primary containment integrity was required.
After this condition was discovered by the operating staff, reporting
requirements were not adequately followed.
At Indian Point Unit 2, with the reactor critical, the boron injection tank
(BIT) was not operated in accordance with the station's procedures for
periods of time on February 2, 3, 4, 24, 25, 27, 28 and March 1, 2, 3, 4,
5, 1982, so that
1. Required BIT overpressure was not maintained and pressure control valve
operability was not verified for the time periods noted.
2. Required overpressure was not verified and adjusted to normal on receipt
of a low pressure alarm.
3. Operators and supervisors failed to identify abnormal trends in logged
data and failed to take appropriate corrective action.
4. Required overpressure was reduced to zero on February 2, 1982, in
accordance with a maintenance work request issued on January 24, 1982,
without adequately determining the effect on plant operation.
At Oyster Creek the reactor was operated in violation of technical
specification limiting conditions for operation during the period from May
14, 1980 to February 26, 1982. A particular valve serves two functions,
containment isolation and vacuum breaking (between the reactor building and
the suppression pool). This valve was assembled incorrectly, so that it
failed to properly perform either of its dual design functions. Inadequate
maintenance procedures for reassembly and test of the valve caused the
violation in the first place. Inadequate periodic functional test procedures
allowed the condition to exist undetected for over twenty one months.
At Rancho Seco, two significant violations of regulatory requirements were
identified. These violations demonstrated a lack of control of licensed
activities and the lack of continuous awareness of the status of safety-
related components by shift supervisors and operators. As a result, the plant
was operated without the control room operators being aware that one of the
two diesel generators was inoperable for 29 hours and that one of the two
high-pressure injection pumps was inoperable for 66 hours. Auxiliary
operators had
.
Attachment 2
IN 84-51
June 26, 1984
Page 2 of 2
been recording information on the pertinent log sheet regarding these two
components without assuring accuracy. Recording of inaccurate information in
plant records appears to have been a major contributor to continued plant
operation with the two safety-related components, mentioned above, out of
service. In addition, operating personnel did not respond properly to the
diesel generator trouble alarm. Inoperability of the diesel generator for 29
hours, undetected, occurred on February 10 and 11, 1982. Inoperability of the
high pressure injection pump existed, undetected, from February 26 through
March 1, 1982.
At Arkansas Nuclear One, from December 30, 1982, to September 26, 1983, Unit
2 was in violation of its Technical Specifications, because three successive
quarterly tests for station battery operability had disclosed uncorrected
violations of parameter limits. The licensee attributed the basic cause of
the problem to inadequate procedures. The procedures included the limiting
parameter values, but did not identify them as accept/reject values. Further,
the procedures were vague about what was required of the tester if limits
were exceeded.
At Turkey Point, there are three steam turbine-driven auxiliary feedwater
pumps. Each is supplied with steam from either Units 3 or 4 and can deliver
feedwater to either Units 3 or 4. Unit 3 was operating at full power, Unit
4 was shut down. New, redundant steam supply lines were being installed for
each feedwater pump turbine. Pump A was out of service for maintenance;
pumps B and C were required to be operable in support of Unit 3.
On April 14, 1983 an operator was issued two clearance tags and was
instructed to verify that valves in the new redundant steam lines were shut
and to hang the clearance tags on the valves. Five days later, the same
operator realized and reported that the clearance tags were on the older
steam supply lines to the B and C pump turbines, and those valves were
closed, rendering both of these auxiliary feedwater pumps inoperable.
Page Last Reviewed/Updated Tuesday, March 09, 2021
Page Last Reviewed/Updated Tuesday, March 09, 2021