05000000/LER-1986-038-02, :on 861209,reactor Scram Occurred Due to Low Condenser Vacuum.Caused by Personnel Error.Discussions W/Operating Personnel Involved Will Be Held.Procedure Qgp 1-1 to Be Revised
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2) 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(1) 10 CFR 50.73(a)(2)(iv), System Actuation |
| 0001986038R02 - NRC Website | |
text
- - - - _ _ _ _ _ _ _ - - _ _ _ - _ - _ _ _ - _ _ _ _.
LICENSEE EVENT REPORT (LER)
Facil tty Rane (1)
Docket N m r (2)
Pace f3)
CUAD-CITIES. NUCLEAR POWER STATION. UNIT ONE Of El 91 of of 21 El 4 1
of 0 4
- II LOW VACUUM $ CRAM DURIN0 $f AFTUP DUE TO PERSONNEL ERROR t Date f5)
LER NEter (6)
ReDort Date (7)
Other Facilities Involved fa)
P.
Day Year Year Sequential
/// Revision Month Day Year Facility Rames Dockel Numberfs)
Nuster
///
Number 01 El 0! 01 of f i
~~~
~
112 019 ' al6 816 013 la Cl0 112 213 al6 01 51 01 01 Of f I THIS REPORT 15 suBMITTI.D PuR$UANT TO THE REQUIREMENTS OF 10CFR OM RATING (Check ont or store cf the fnllowine) (11)
EW t
4 20.402(b) 20.40$(c)
_)L 50.73(a)(2)(tv) 73.71(b) wtR 20.405(a)(1)(1) 50.36(c)(1)
_ 50.73(a)(2)(v) 73.71(c) 0l1 20.405(a)(1)(ii)
_ 50.36(c)ft)
_ 50.73(a)(2)(vti)
Other (Specify LEVEL s
,,_ 20.405(a)(1)(tii)
_ 50.73(a)(2)(1) 50.73(a)(2)(viit)( A) in Abstract below (10)
//// //////////////// ////
20.405(a)(1)(iv) 50.73(a)(2)(11) 50.73(a)(2)(v111)(B) and in Text)
//////////////////// //////
- 20. 405 ( a )( 1 ) ( v )
50.73(a)(2)(tii) 50.73(a)(2)(n)
LICENSEE CONTACT FOR THIS LER (12)
Name TELEPHONE NupeER AREA CODE K. 3. Hill. Tech Staff Enaineer Ent. 2150 3lal 9 6l El dl -l 21 21 41 COMPLETE ONE LINE FOR EACH COM 0 FAILURE DESCRIBED IN THIS REPORT (13)
CAust SYSTEM COMPCNINT MANuFAC-REPORTABLE
CAuSE
SYSTEM COMPCNENT M MufAC.
REPORTABLE TURER TO NPR05 TURER TO NPRDS l
1 I I I I I I I
I I I I I l l
I l l I I i l
l I I I l l SyffLEMENTAL REPORT EXPECTED (14)___
Espected Month ! Day I Year Submission es (If vet. comolete EXPECTED SUEMISSION DaTE)
YiNO l
l l
AnTRACT (Limit to 1400 spaces, i.e. approximately fif teen single-space typewritten lines) (16)
Abstract:
On December 9,1986, Unit One was in the proce5s of 5 tarting up per QGP l-1, Normal Unit Startup. Unit One was at 15 percent thermal power and 925 psig reactor pressure.
At 1733 hours0.0201 days <br />0.481 hours <br />0.00287 weeks <br />6.594065e-4 months <br />, a reactor scram occurred due to low condenser vacuum. Condenser vacuum had been significantly lower than normal since vacuum had been established.
The decision was made to continue the unit startup even though vacuum was not adequate.
The belief was that rolling the turbine and synchronizing the generator would improve condenser vacuum because the heat load on the condenser would be less.
The root cause for this event was determined to be personnel error in that it was decided that condenser vacuum would improve when the main turbine was rolled and the generator was synchronized. Contributing to this event was poor communication and procedure deficiency.
Corrective action for this event will include discussions with the operating personnel involved.
Stressed at these discussions will be the need to adhere to all procedures and the need to give adequate information at shift turnover and when sending personnel out to perform a job. Procedure QGP l-1, Normal Unit Startup, is also being revised to clarify the steps needed to start up the off-gas system.
This report is submitted to comply with 10CFR50.73 (a)(2)(iv).
8709160363 e70914 FOIA PDR PDR GORDONB7-512 0766H
Uff h 5E t EVE N7 R[PJL( L E R ) 9Er? CONTINUATION j
F AC8L3TY mAMt (1)
DOCKET NUMBER (2)
LER NUMBER f6) i Page f31
//pp,/secuential
///
Revision
//
Year c
,// /
/
Numter Number
- n ties unit one oi5 l0 10 10 l 21 $1 4 816 013 la 0 Io 012 or c's
PLANT AND SYSTEM IDENTIFICATION
General Electric - Boiling Water Reactor - 2511 MWt rated core thermal power.
Energy 2ndustry Identification System (EIIS) codes are identified in the text as [XX).
EVENT 10ENTIFICATION:
Unit One reactor scrammed due to personnel error in continuing the reactor startup with poor condenser vacuum.
A.
CONDITIONS PRIOR TO EVENT
Unit: One Event Date: Decemter 9,1986 Event Time:1735 Reactor Mode: 4 Mode Name: RUN Power Level:
151 This report was initiated by Deviation Report D-4-1-86-133 RUN Mode (4) - Run - In this position the reactor system pressure is at or above 825 psig, and the reactor protection system is energized, with APRM protection and RBH 1aterlocks in service (excluding the 15% high flux scram).
l B.
DESCRIPTION OF EVENT
1 December 9,1986, Quad Cities Unit One was in the process of starting up per
.ormal Unit Startup Procedure. QGP l-1.
At 1733 hours0.0201 days <br />0.481 hours <br />0.00287 weeks <br />6.594065e-4 months <br />, Unit One was in the RUN mode at approximately 15 percent core thermal power and 925 psig reactor pressure with-too turbine bypass valves open. At this time a reactor scram occurred due to low j
condenser vacuum.
A normal scram recovery followed and all systems functioned as designed.
While the Unit One reactor startup had been in progress, the condenser [KE] vacuum had not improved to less than approximately 25 inches of mercury (hg) absolute.
Normally with the off-gas system [WF) functioning properly, condenser vacuum will be approximately 29 inches Hg.
The operating crew during this event believed that with the condenser vacuum lower than normal, it would be best to roll the turbine [TA) and put the generator (TB) on the system.
Their belief was that this would improve condenser vacuum because the energy content of the steam entering the condenser from j
the turbine would be lower, and therefore the heat load on the condenser would be less.
The reactor scram occurred when a third turbine bypass valve was opened prior to initiating a turbine roll.
Subsequent to the reactor scram, operations personnel cere dispatched to the off-gas system area and it was discovered that the motive steam to the two primary steam jet air ejectors was still valved closed.
The valves eere opened at approximately 1900 hours0.022 days <br />0.528 hours <br />0.00314 weeks <br />7.2295e-4 months <br /> and condenser vacuum immediately improved to a normal value of approximE 4 '9 inches of mercury.
C.
APPARENT CAUSE OF EVENT:
This report is submitted to you in accordance with the requirements of the Code of r deral Regulations. Title 10, Part 50.73(a)(2)(iv), which requires the reporti"g of e
sny event or condition that resulted in manual or automatic actuation of any ngineered Safety Feature, including the Reactor Protection System".
0966H
N Et1EE EVE 07 REPDPT fLEP) TEXT CM13OUAVIoa FAc!b!?Y NAM [ (1) 00tK6T CuMBin (2)
L En NtMB E R f 6 )
pace (3) l Year segueetial Revision
///
NLett'
///
Number g es unit one eisIoIoIo 1 21 51 4 als 011 la oIo 013 or ele f>.
j The cause of the reactor scram has been attributed to personnel error.
Realizing that condenser backpressure was significantly higher than normal, operating department personnel erroneously judged that if the turbine-generator was rolled and synchronized, the backpressure would improve.
This judgment error caused the j
reactor scram to occur.
1 There were several contributing factors to this event.
Following operations department shif t change at 1500 hours0.0174 days <br />0.417 hours <br />0.00248 weeks <br />5.7075e-4 months <br />, there was an uncertainty about the status of l
the Unit One Off gas system. The center desk Nuclear Station Operator (NS0) and Unit One Equipment Attendant (EA) therefore reviewed the off-gas system startup j
procedure (QOP 5400-1). The Unit One EA then went to the off-gas system area and l
noted that the system flows and pressures were adequate.
A valve lineup check was not performed.
i Another contributing factor to this event has been determined to be a procedure deficiency. QGP l-1, kraal Unit Startup, states to lineup the secondary steam jet air ejectors at approximately 200 psig reactor pressure.
This was done per the procedure.
The step in the startup procedure also refers to 00P 5400-1, Off-gas System Startup procedure.
QOP 5400-1 states to lineup the primary steam jet air ejectors at 400 psig reactor pressure.
The normal unit startup procedure, QGP l-1 does not address this valve lineup at 400 psig reactor pressure.
Since the two lineups are done at different pressures, they are performed at different times. Due o other activities that are necessary as part of the normal unit startup, the valve
,ineup required at 400 psig reactor pressure was overlooked and was not performed.
Following shift change, the lineup was assumed to have been done because reactor pressure was over 500 psig. As mentioned, there is no checkoff provided in the normal unit startup procedure, QGP l-1, regarding the primary steam jet air ejector lineup at 400 psig.
D.
SAFETY ANALYSIS OF EVENT:
The safety of the public and plant personnel was never affected during this event.
I The failure to line up the primary jets did not affect the ability of the system to process the gas. At all times, release rates were within limits as specified in Technical Specifications Section 3.8/4.8. A.
The off-gas system uses two primary air ejectors and two secondary air ejectors to remove non-condensable gases from the main condenser.
The two primary air ejectors draw a suction from the main condenser and discharge into a common intercondenser.
i The two secondary air ejectors then draw a suction from the intercondenser and discharge into the off-gas system.
Each air ejector consists of a jet pump which uses reactor steam as notive steam.
The operation of the air ejectors maintains a low condenser backpressure (or high condenser vacuum).
A high condenser i
backpressure (low condenser vacuum) will cause a reactor scram when the reactor mode switch is in RUN, if backpressure increases past 9 inches Hg absolute (condenser vacuum decreases past 21 inches Hg).
q 0766H
Lffgif [VINT REPOPT f LEP ) VEK7 CONQi(UA MDN F ACIL I ?9 C AM,E '1 )
DOCKET NU>S[R (3)
L ER NUMBER (6 )
pace (3)
Year
//
sequential //
Reviston p/,,/
,/,/,
//
Number
//
Number e aq fities Ur it One 0 !$ 1010 l0 l 21 El 4 816 013 la 0 10 134 0F 014 r
E.
CORRECTIVE ACTIONS
The details of this event will be discussed with the personnel involved.
The operators will be eminded to review all applicable procedures prior to operating a component or a systen. to ensure that all steps are followed correctly and that all valve lineups are correct.
Reminders will be made that when sending an EA to perform a task on a system or a component, he should be given adequate information about the system in order to recognize and/or prevent a problem.
Also, it will be emphasized that the operators should provide adequate information at shift turnover 50 that the next shift will know the exact status or change in status of plant systems.
As an additional corrective action, the step which places the primary jets in operation at 400 psig in the Off-gas System Startup, QOP 5400-1, will also be addressed in QGP l-1, Normal Unit Startup.
Additional caution statements will also be added to warn the operators against a high condenser backpressure.
The statement aill note that if condenser backpressure does not decrease as expected, startup should not proceed until the problem is identified and corrected.
These corrective actions will be tracked using Commonwealth Edison's Open Item Tracking Trending Action Item (0ITTAI) computer program.
The number assignment for this event is 25418086038.
t REVIOUS EVENTS:
There has been no previous occurrence in which an error in off-gas valving has caused a reactor scram.
G.
COMPONENT FAILURE DATA
There was no component failure involved in this event.
All systems operated as designed.
0966H
CommonweaRh Ediwn Ovad Cities Nuclear Power Station 22710 206 Avenue North Cordova, Illinois 61242 i
TeWphone 309/8 % 2241 RLB-86-282 December 23, 1986 U.S. Nuclear Regulatory Commission Document Control Desk j
i Hashington, DC 20555 Refercisce: Quad-Cities Nuclear Power Station Docket Number 50-254, DPR-29, Unit One Enclosed please find Licensee Event Report (LER)86-038, Revision 00, for Quad-Cities Nuclear Power Station.
This report is submitted to you in accordance with the requirements of the Code of Federal Regulations, Title 10, Part 50.73(a)(2)(iv), which requires the reporting of "any event or condition that resulted in manual or automatic actuation of any Engineered Safety Feature, including the Reactor Protection System."
1 Respectfully, COMMONWEALTH EDISON COMPANY QUAD-CITIES NI)GtTAR POWER STATION
/
R. L. Bax Station Manager RLB/MSK/cir
- ~ D*M Enclosure YY cc: 1. Johnson A. Morrongiello l
INPO Records Center I
NRC Region III I
JAN 9198h l
i
\\
k TENNESSEE VALLEY AUTHonlTY Browns Ferry Nuclear Plent P.O. Box 2000
/
Occatur, A16bucha 35602
- - fi 3
A8: a3 j
January 21, 1987 s
U.S. Nuclear Regulatory Commission Document Control Dost Washington, D.C.
20555
Dear Sir:
TENNESSEE VALLEY AUTHORITY - BROWNS FERRY NUCLEAR PLANT UNIT 1 - DOCKET NO. 50-259 - FACILITY OPERATING LICENSE DPR REPORTABLE OCCURRENCE REPORT BFRO-50-259/86035
)
~
A Licensee Event Report will not be prepared under numbe 50-259/86035.
Please be advised of this vacancy in our accounting sequence.
l very truly yours, TENNESSEE VALLEY AUTHORITY driginal Signed By Robert L. Lewis Robert L. Lewis Plant Manager Browns Ferry Nuclear Plant i
J Enclosures cc (Enclosures):
Regional Administration INPO Records Center U.S. Nuclear Regulatory Commission Suite 1500 Office of Inspection and Enforcement 1100 circle 75 Parkway Region II Atlanta, Georgia 30339 101 Marietta Street, Suite 2900 Atlanta, Georgia 30303 NRC Resident Inspector, Browns Ferry Nuclear Plant l
I For sp - e 7 -s/,2.
CVs' s
gqo (p
)
s KANSAS GAS AND ELECTRIC COMPANY
~ < a : u.c : a.......
4,. E % *e 5
moi 6*( #
eenig:<%*
.#e*
June 13, 1986 I@[II0VP "
U.S. PAJclear Regulatory Cortrnission Doctrnent Control Desk JIJN l 7 E WashirrJton, D.C.
20555 Mr. C.H. Johnson, Director N"
J Division of Reactor Safety and Projects U.S. Nuclear Regulatory Corrrnission Region IV 611 Ryan Plaza Drive, Suite 1000 Arlirgton, Texas 76011 IMRRC 85-109 Re:
Docket No. STN 50-482 Subj: Licensee Event Report 86-031-00 Gentlemen:
We attached Licensee Event Report is sebnitted pursuant to 10 CFR 73.71
{
(c) concerning a physical security event at Wolf Creek Generating Station.
We attachment to this letter contains Safeejuards Information in accordance with 10 CFR 73.21 and therefore should be withheld from public disclosure.
This letter when separated from the attachment, does not contain Safeguards Inforation and should be handled as decontrolled.
Acknowledgement of receipt of this letter, via the enclosed form, would be appreciated.
Yours very truly, Glenn L. Koester Vice President - Nuclear GLK:see information in this tcCord was deMcd Attachrtent in 2CCordance wi[h the freedom Of Inicrm Act, exemptions -
4 Enclosure F0lA. A7 - 611 Ef/
cc: JTaylor, w/a P0'Connor (2), w/o g't JCLmnins, w/o 9 bCG/900 +.yareer - w.cma. xansas - unitsacross po ao 20e : Wichtts. Kansas 67201 - Telephone: Area Code (316) 26
}
2a, N Y d4,p
x.c ~. m.
um ovetcA. n..v u to., ~ -
APPROvto Ohm ho 8tm.eges UCENSEE EVENT REPORT ILER) sAcias anies eacitiTV mAME ni OOC 81IT Immet A (31 PAag cm Wolf Creek Generatino Station 0l5l0lclcl4]gl2 1 lorl O l3 rifLS Hi Moderate Loss Of Physical Security Effectiveriess even oarsis osa --a e menant oars m on an raciumes sevotvso se tsOes'T M oAy ytA.
vtAm esowTw oAv YEAn
'80Litv maases occagTansemente og5lclctog ; g 0l6 1l0 86 8l 6 0l 3l1 0l 0 l
l l
~
~
0 is o go g og i i s
rn.. cont e er iveo ruimmrt ro n.e neouene=<ms oc ie un t w, =
.<== w nu esDDe *'
3 se dans >
a d=**='
- s mHmaa rasim num se_ wn manru g
r Ju.,
= ***"**
"m*
" ~ * ~ "
W l 10 m"g, 747,,,,
7c m awnism aswaws seaucrw.anw assu 6
[k 3e essenMOest mJhMIHER SpJ3taJtI3Melme g;;
mawnu um>eam ses w ax.
Leotasess cosrtacT Pon twas Lan ite Merlin G. Williams - Superintendent of Regulatory, Quality ansacons and Administrative Services 31116 31614 l -lR l A i 411 coms tria one une son sAoM w _ i eutume oescameo = n.as aspoer na
"**#d "Io IsS*
d run C^*'
8"""
CC"'0"*"7
"#E**'
ear $$s
cAuee systsw couro"a"'
l l l l 1 l i I
I I I l i I g
l l l 1 1 1 l
l i I l l l
_. m o.
o.y
] vas sir sneerro sawasee marsi
] mo N
e g
g
,,,,,,c, ew,, a, n. nA. _
z **m= **>== = = *.=* n o At approximately n June 10 an intrusion alarm was received from the taut wire intrusion detection system Upon insediate investiga n, it was determined that the system was malfunct ing. At approximately the same time, high winds and heavy rains necessitated the establichnent of full compensatory censures. The storm soon dissipated, and the compensatory measures wer ters vi at approximately{$
During shift turnover at approximately Es oncoming lieutenant recognized the absence of compensatory measures for he inoperable detection system and initiated the proper compensatory measures.
This moderate loss of physical security effectiveness was the result of a procedural ission in that this situation was not covered by procedure.
In
- addition, A design change is being developed to provide intrus on ec on along the t ee foot section in question independently of the operability of the taut wire system.
During the time period that the system was inoperable, the unit was in Mode 3.
Hot Standby, llo unauthorized access to the protected area occurred.
Licensee Event Report 85-016 discussed a previous similar occurrence.
~
" - " ~ ~
0 ?d 9/ 6?y P g,y c
..c v s auct s.... 44,o.,,
a UCENSEE EVENT REPORT (LER) TEXT CONTINUATION m.ovioo,
.o s..
t apesf 8 64'46 eacsu,y maa.t ttI oOCEGT WUhS,. 91 4(8 SVhSiS edd
~~
gggg g
'1f,;;.
g=,;;
.e..
Wolf Creek Ceneratino Station 0 l5 lo lo j e j 4lg J2 al6 01311 oln ol 7 oF nl1 r,,,,,,._
, e a amee On June 10, 1986, at approximately it was discovered that proper compensatory measures for an approximate y hree foot section of the protected area boundary containing an ino rable trusion detection system had not been implemented since approximately n June 10 Upon review, it was determined that this situation constituted a moderate loss of physical security effectiveness, reportable pursuant to 10CFR 73.71(c).
On June 10, 1986, at approximately an intrusion alarm was received from the taut wire intrusion detection system. An armed responder was dispatched to the area immediately and discovered no unusual conditions in the area.
Because the intrusion alarm could not be reset, the shift lieutenant also inspected the area, and likewise found no discrepant conditions.
It was concluded that the Laut wire intrusion detection system was malfunctioning.
At approximately the same time, high winds and heavy rains, which interferred with other intrusion detection systems, necessitated the establishment o full compensatory seasures for the protected area boundary.
At approximately
% the compensatory measures were terminated as the storms had dissipated.
At approximately during shift turnover, the oncoming shift lieutenant recognized a potential void in the protected area perimeter since no co*:>ensatory measures were being implemented to compensate for the inoperable taut wire detection system, and established the proper compensatory measures.
Subsequently it was determined that the incessant intrusion alaru was the result of As per design when a constant intrusion alarm was generated.
$as replaced during the morn ng of June to, the alarm was reset, and the compensatory seasures were terminated shortly thereafter.
The absence of compensatory measures for the inoperable intrusion detection systes
)was result of a procedural error caused by an omission in an approved procedure.
l While the doors are clused and locked, i
another etection systes is 1112ed to protect the protected area boundary.
However, there is approximately a three-foot section of the taut wire intrusion l
detection system that is required to maintain the protected area boundary. Thia l
fact was not considered during the initial assessment of the necessity for I
nsatory acasures because it was not mentioned in the applicable ocedure com an
e
~
l m,-
v.
uci...... u UCENSEE EVENT REPORT (LERI TEXT CONTINUATION movie o=e e neo-e
........m.
,.c.u, - m
= ev -m. m a,
)
t... -..
=* a%'.a 6 l
"J,.J[
{
wolf Creek Ceneratino Station 015101010 l 41812 816 01311 010. 013 0F 0 13 7,,,,,
. r _ : _ -_ c =c a = w m A design change is being developed to provide intrusion detection capabilities along the three foot section in question independent of the operability of the taut wire intrusion detection system.
The applicable procedure is being revised to state the appropriate compensatory measures whenever the taut wire intrusion detection system is out of service.
During the time period the taut wire detection system was inoperable and the proper compensatory measures were not in eff et, no unauthorized access into the protected area occurred.
doors were closed and locked throu hout this time period, and a security trained individual was presentM The three foot wide area wh h had no intrusion detection is bordered on the exterior which showed no visible signs of damage upon inspection.
Throughout this time period, the plant was in Mode 3, Hot Standby.
A previous similar occurrence of a failure to establish compensatory measure for an inoperable vital area barrier because of a procedural inadequacy is discussed in Licensee Event Report 85-016-00.
i J
I l
i 1
i i
~13.o..us.
i
^
i 1
s n ANsAS GAS AND ELECTRIC COMPANY
' ' ',2 )
September 8, 1986 U.S. Nuclear Regulatory Commission
@@M 0W[2 K1 Document Control Desk
ashington, D.C.
20555 El2E j
Mr. E. H. Johnson, Director F
U U
Division of Reactor Safety and Projec ts U.S. Nuclear Regulatory Commission Region IV l
611 Ryan Plaza Dri ve, Suite 1000 Arlington, Texas 76011 KMLNRC 86-163 Re Docket No. STN 50-482 Subj Licensee Event Report 86-045-00 Gentlemen:
':te attached Licensee Event Report is submitted pursuant to 10 CPR 73.71 (c) concerning a physical security e vent at Wolf Creek Generating Station.
"h e attachment to this letter contains Safeguards Information in accordance with 10 CPR 73.21 and therefore should be withheld from public disclosure.
This letter when separated from the attachment, does not contain Safeguards Information and should be handled as decontrolled.
Acknowledgement of receipt of this letter, via the enclosed form, would be appreciated.
)
Yours very truly, h'h Glenn L. Koester 4
Vice President - Nuclear OLK:see Information in th'.S ECC:d V.CI dOItiBd-'
~~
Attachment in accordance with thijiie65ckef !n'ctnblien U i iN Act, exemptions N Enclosure pg. g% 5 M' R/J
./,,:
s.
ec: JTaylor, w/a p
P0'Connor (2), w/o i
I JCummins, w/o a
% D ho, d urnet -w,cnota. Kansas - Mad Ad$ess PO Bos 206 WscMa. Kansas 67201 - klepho s o t S H4 P-
e,sc 8e
- 388
't 4 J '
v I mucLE am agovtatORY comes4useoes I
AP'8*ov t 0 oug eso 3 i te p en tlCENSEE EVENT REPORT (LER)
'""'s=
, y 7 y... n i i
'mca a t = van a u, e *= a Wol f Creek Generat 2 nc station oislolotol4l gly t jod ol3 vi,6 e i.,
Moderate Loss Of Physical Security Effectiveness Due To Comat er Malfunction
{
tvses? OAYSISI Lea arases e it s t eoa f OA f t 17) ovuta e Acitsfits estvo(vgo ggs "0
ucagT m DAV VIAp vgaa [M
Wa im QAv vtam WaoW " ~
s DOCKET NVW$(R(3) 0 16lololoi I
Ol9 0l3 8
6 8l 6 0l 4l 5 0l 0 0l9 0l8 8l 6
"~
~
o ispo so,o, g,
v
.t,on, amerTTio evaeus=7 To Tai aiovineuauf o, ie C,n e o
-,,, e ; nu oei nAf me i
moos =>
1
..i
= = = >
m. main.
ruini a
38 8"4U H8 M 3B(*It1$
73WOBh8
{
71.?Het teve' 1, q o
... n nii w w ius
{
m mm.
ome n,s-w. A
~
n.
= remaini
~
.m w
7.25 '" " '"' * *' '-'"
. ~
3g assist (IHut 8073elGHHH M736e#Gits Lacissal CoorTACT PCA TWts LS A (121 TgLtpHoevg asyuggm Herlin G. Williams - Superintendent of Regulatory, Quality aa A Coos and Administrative Services 311I6 31614l-18 181311 CohrttTE Dent LNE POR EACM COMPosstaff, AILumf DESCA$50 no Ties apost? 113e CAU33 sv3Ttu Cons *Oht NT Tung 70 Og CAWE B Y STE W ComPOWEt*
f A k8 I k h(
79 g
4eh.
i 1 1 1 1 1 1 s
QA I
I I I l l l Nf' Ms l
1 i 1 I i I I
I I f I l l m;prLstatNTAL A8 Poet 8KPtcf 30 ttas (K90CTto YI$ (f#,*. esmpee, txncTyp Mefss$scur 04 W 88 0
,,,7,Ac,,,.,.,..=
.==- = =
" *
- o m g
g On September 3,1986, at approximately
__I.) toth Seccity Data Management System computer terminals became inoper"f51e (i.e., "locke! up"). 'Ite system continued to control access, but alarm processing had ceased.
The master Central Processing Unit (CPU) was halted, which forced tta slave (7) to assume the functions of the master at approximately JU 'Ibe re:;uired satory measures were in place by approximately it became 2=
apparent that the switchwer attempt at been ansiIccessf An
_.m.
automatic restart of the system was attempted, t this effort was likewise unsuccessful in ef fecting the switchover. geCPU d and the other CPU restored as slave at B,.
as restored as master %
1 Following verificat on of r ccrnputer functioning, the compensatory measures were terminated at 3ro
\\
The two malfunctions during this event (terminal inoperability and unsuccessful switchover) are believed to be at least partially caused tri sof tware problems.
A potential correction to the terminal " lockup" problem is u-der develognent, and a sof tware change that should serve to resolve the switchover problem was implemented Septenber 7,1986. As a long term corrective measure, desion enhancements to the computer system are being e raluated.
~
' Itis event has been classified as a major loss of physical security effectiveness properly compensated ard thps considered. a pioder, ate loss of physical security effectiveness in accordan::e with 10CFR 73.11(c).
^
A w.p ab4A tiCENSEE EVENT REPORT (LIR) TEXT CONTINUATION W I *dC' LA 8 "#4AA Af D8 ' CW
- --c.ie:
.e v
{
f a r e.g 3 s ? at
=="**"m 1
u. u u.
's.a
" R'/J.
W,7; a f creek Generating Station 01510 l o l o l 4 I 812 816 01415 0 10 :!2 0F ol3 m_w,_-
- - e % = wnn
~.,
on September 3.1986, at approximately
' both Security Manasement System computer terminals tmsme inoper le (i
" locked up").
In the normal mode of ope ~ ration, cne of these units serves as the master uni ne other Central Processing Unit is on standby as a slave unit.
the SAS terminal operator, attempting to acknowledge an alarm, disevvered the nability to acknowledge alarms from the The operator, unable to quickly restore functioning of the terminal, SAS.
contacted the CAS terminal operator and requested that the alarm be acknowledged from the CAS. %e CAS terminal operator then discovered that the CAS terminal was also unable to acknowledge alarms. At this point, actions were initiated to establish the required compensatory measures.
%e computer system continaed to control access (i.e., only authorized personnel could access vital doors), but the alarm processing function of the ccupater system was disabled.
At approximately Central Processing Unit ' A', which was serving the function of the master unit, was manually halted, forcing the slave Central processing Unit 'B' to assume master control. Wis switchover was completed, and Central Processing Unit 'B' appeared to be operating satisfactorily in its capacity as the master.
ccuputer sy} stem malfunction was in progress.
full ecupensatory measures were in place, and tros les ng of the At approximately Central y
Processing Unit 'B' ased ocessing alarms and access contro...
It was determined that the switchover had been unsuccessful.
{
An autcnatic restart of the crmputer system was initiated in order to restore the system as rapidly as possible. However, this effort was also unsucx essful in forcirvg Central Processing Unit 'B' to assume master control. At this point, it was decided to halt Central Processing Unit 'B' to initiate a reboot of Central Processing Unit ' A'.
Following correction of a syntactical data error, Central Processing Un
'A' master trol. System functioning was restored at pCentral Processing Unit 'B' was restored to approximately slave status, and device esting was subsequently initiated. Following successful ccepletion of device te
, the ccupensatory measures were terminated at approximately During this event, efforts were focused towards rapid restoration of system functioning, and limited data was gathered to evaluate the source of the system malfunction. After evaluatire the available data, potential corrections for the two malfunctions encountered during this event were identified.
%e initial event, a two terminal " lockup", is believed to have been partially caused by a sof tware error in the terminal access program. A correction for this error is under development and will be implemented in the near future.
m
^
\\
= a r... a66 4 LICENSEE EVENT REPORT (LER) TEXT CONTINUATION V 1 %JC(I A A.t GWL A T C# V C OMU $5 4".o.i::ve u m m.
eacig s t e wout s i, c...n v.3 i poca t e seswaga 2 gg, gyw3g e.6r SaGI '3 l
I" M..' t ' l t',y t**
Wolf Creek Generatinc Station 015101010 ! 4 ! E; 2 8!6 014 l 5.
010 013 0'
sur ~.m.<
- - m~-~~c'e ws~".
01 3 We second malfunction, unsuccessful switchover to Central Processing Unit both by halting the master unit and by automatic restart,
'B',
is believed to b least partially caused by an error in the sort routine associated with the order e at of device scanning.
A correction to this sort routine was installed on September 7,1986, during a planned system outage.
System computer, the feasibility of a design modification is b In accordance with 10CFR 73.71(c), this event has been classified as a major loss of physical security effectiveness which was properly compensated in a timely manner, and therefore is considered to be a noderate loss.
i based, in part, on the fact that the required compensatory measures were in%is concl effect shortly after the initial event and provided a level of security equivalent to that previously in existence.
i
)
During the time period of this event, i
Operation, at approximately 100 percent Reactor truer.the unit operated in Mode 1, Po ef festiveness properly cmpensated and are documented in accordance with 10CFR 73.71(c).
I i
l i
l 3 0)F
^
KANSAS GA ~ AND EL EC TRIC CO%4PANY Septender 29, 1986
%@@@ 0W2 Y d) m-l U.S. Nuclear Regulatory Commission N
Document Control Desk
'4ashington, D.C.
20555 j
Mr. E.H. Johnson, Director Division of Reactor Safety and Projects U.S. Nuclear Regulate *y Commission Region IV 611 Ryan Plaza Drive, Suite 1000 Arlington, Texas 76011 KMLNRC 86-174 Re:
Docket No. STN 50-482 Subj:
Licensee Event Report 86-049-00 Gentlemen:
The attached Licensee Event Report is submitted pursuant to 10 CFR 73.71 (c) concerning a physical security event at Wolf Creek Generating Station.
The attachment to this letter contains Safeguards Information in accordance with 10 CFR 73.21 and therefore should be withheld from public disclosure.
This letter when separated from the attachment, does not contain Safeguards Information and should be handled as decontrolled.
Acknowledgement of receipt of this letter, via the enclosed form, would be appreciated.
Yours very truly, M
/
N Glenn L. Koester Vice President - Nuclear GLK:see
'-""" ""- ' ne u.. ra u.s u r.d in acccrdance with the ficcdom of ki ormation f
Attachment Act, CIemptions _ S FolA 2 '1 ' SI 0..
E/'3 Enclosure
~
~
+tsa.(
cc: JTaylor, w/a
\\
P0'Connor (2), w/o
~~'
JCummins, w/o y
y avp g a o gc-..x.,,,,- ~,as,....
o u.m wc~.x.,,.,em,-r.,.,
.. ~.a,ene,.u,,
Q
(
em N
v2== tu
.vuto,
g UCENSEE E' VENT REPORT (LER)
NGC o.e tuo pggg, i
- * ** **' m
,wur, numa m Wolf Creek Generating Station OOCK E1 - ". pl
,g,, q,
, o 16 l c lc l c l 4lg lp i l0Fl013 fatLa les Maderate less Of Physical Security Effectiveness Caused By Computer Malfunction
~
,en 6...u
.po., un m omia,wuria tv o hsoerTDs OAT FEAA YEAA se tsoevm oa, vtA.
'*O UT ' A nese Docati asunseems 8 1518 lel8: i i 0l 9 2l 4 8
6 8l6 0l 4l 9 0l0 0l 9! 2l9 8l 6
~
~
,,. mon, e es.wrno --t to me neousamann oe w con 6 o e
e sgo e e, e, ;,
m 1
mmena
- ou umw q
essawem m.mwom tunne wiewm Y
I 91 8 semwnwa unwsw
~
[
x tu.w
[
es2.we
[ cman y.
ennwone y
y m mm.inimi anwee miswee w
.y me.,
mmen>,
ennwem senwawaim O
semwme.i sanween unwow L8ctadBti ConrfACT Poe 7144 L84,13,
"' Merlin G. Williams - Superintendent of Regulatory, Odality
]
anna coa.
l and Administrative Services conetavs one tse eos saae consomewr eutuas ossemeen,= vi.e aero.t sta311 16 316141-1818 n 11 crues evere=
co w o==t "Oa'n*
TET $
- - Puemenemmauem c** 'v're*
co'**'at T"
T,,l
_j_
l 1 1 1 1 I
,,,_ L I I I I I I
- - e, -,.b
_ L
_L I I I IIl II I
.I 1.. I o,
l vos er severso suonaamr Mrs
."il =o ll ]
.,r
. =
, n.
l l
On September 24, 1986, at approximately Ia switchover from Security Data Management System Central Processing Uni (CPU)
A' as master to CPU
'B' as master was initiated.
CPU 'B' failed to configure as necessary for the switchover.
Ib11owing initiation of a manual reconfigure, CPU 'B' process of continous autcnatic reconfiguration.
an a actions to establish the required compensatory measures were initiaAt approximately anticipation of a system failure, and an attempt was made to restore CPU ' A' as in initialize, CPU'A' failed to assume master control, causing CPU 'B' to re-master.
approximate' At a switchover to CPU 'A' as master was s completed, compensatory measures ully were terminated at approximately%, in effect since approxbnately On September 25, 1906, following relocation of the Camputer Interface multiplexer boards to a spare backplane and installation of a different fault board and moden board, the system switchover capabilities were tested satisfactorily.
' Itis event has been classified as a major loss of physical security effectiveness properly compensated, and thus a moderate loss in accordance with 10 CFR 73.71(c).
A previous similar oxurrence is discussed in Licensee Event Report 86-045-00.
=umamenme
~
3@ no4h w k
Ima 3 *C 8 W
UCENSEE EVENT REPORT (LER) TEXT CONTINUATION US huC6EAA.40WtatDasgo.nw %^
anaovio ove e veo.e
. 4,5,,,
. n,
Espeats spgg om a ' avie a ie =vw.aa +
t "dM"
?f."J:
Wolf Creek Generating Station 01510 l o lo { 4 I 812 816 01419i O lo i Ol2 0'
O 13-w.,,
-. w e w s""'
On September 24, 1986, at approximately Data Management System !IA-04P) Central Yrocessing Units was initiated fora verification of proper functioning.
On September 23, 1986, camputer interface multiplexer for Central Processing Unit (CPU)a fault board in the replaced, and in order to verify proper functioning of system s
'B' had been tehover capabilities, a switchover to CPU 'B' as master was necessary.
At approximately the unit failed to initiate its own reconfigure which is necessary o
'B' as master had empleted, but switchover.
A manual reconfiguration comand was entered by the terminal At this time, the manual reconfiguration of CPU 'B' completed operator.
normally, but the unit then began a process of automatic reconfiguration followirg completion of the previous reconfiguration.
In anticipation of a system failor acti to establish full compensatory measures were initiated at approximately the compensatory measu s wer in place within approximately Also at approximately in an effort to return the sy to its normal configuration, a sw hover to CPU 'A' as master was initiated.
Although the terminal switching unit indicated that the switchover had been successful, CPU 'A' failed to assme master control.
failure resulted in automatic re-initialim. ion of CPU 'B' Bis causi the system to cease processing alarms By CPU 'B' had restarted and was processing alarms, but the continuous r Extensive data was obta ned from CPU 'A' figu tions began aga in.
the slave unit at approximately rior to br nging it on-line as the continuous reconfiguration of CPU 'B' recommenced and continued until approximately Wat which time the system terminated the data loop in a manner which a'M' the system to stabilize.
llowed I
At approximately satisfactorily.
a switchover to CPU 'A' as master was empleted verification of proper functioning was initiated.ollow ng this switchover, the syst Upon completion of this verification at approximately the compensatory measures were terminated.
We problems causing the unsuccessful switchover and the continuous reconfiguration of CPU 'B' while in master status have been corrected.
hardware diagnostic run on CPU 'B' revealed a faulty RLll Controller Board, which A
is the interface between the CPU ard the disk drives. Following replacement of this board cm September 24, a switchover could be acccuplished without a system 1
failure, although the overall switchover results were still not empletely i
satisfactory. Troubleshooting efforts continued, and on September 25, 1986,
{
backplane and installation of a different fault board and mo\\
switchover capabilities of the system were satisfactorily tested.
I N
i gecaw 3e.
3
..e.. m.
~
t.lCENSEE EVENT REPORT ILER) TEXT CONTINUATION
...x n...i n.,o.. eo
..g
..o.c o o.
o 3..o.m
..c.u,.
. n,
.,n.,
ac e i -. in n...,
"cl;;;'
- .?:
~
e*
Wolf Creek Generatin m,,
. = =..,~ __ g Stat 2on 0151010lo141812 816 014) 9 c w w. o 0 10. O l3 0' O JL In accordance with 10 CTR 73.71(c),
bsence of cmputer alarm processing discussed in this report Tras been classifed as a major loss of physical security effectiveness which was prope.ly compensated in a timely manner, and therefore is considered to be a rooderate loss.
'Ihis conclusion is based, in part, an the fact that the required compensatory measures were in effect shortly after the initial event, and provided a level of security equivalent to that previously in existence.
l One previous cmputer system malfunction is discussed in Licensee Event Report 86-045-00.
Other previous occurrences were defined as no$erate losses of physical security ef festiveness properly empensated and are documented in plant records in acmrdance with 10 CPR 73.71(c).
(
i 6
N m.....
KAN$AS CAS AND ELECTRIC COMPANY
- .6EC'C*C CO# M *
- l out== 6 acts?ta October 10, 1966
.n......%,..
T I@@DUE S i
U. S. Nuclear Regulatory Commission OCT I 5 s Document Control Desk Washington, D.C.
20555 Mr. E. H. Johnson, Director i
Division of Reactor Safety and Projects COPY)TO uc. 2
)
U.S. Nuclear Regulatory Commission i
~
Region IV 611 Ryan Plaza Drive, Suite 1000 Arlington, Texas 76011 KMLNRC 86-187 Re:
Docket No. STN 50-482 Subj:
Licensee Event Report 86.055-00 Gentlemen:
i l
The attached Licensee Event Report is submitted pursuant to 10 CFR 73.71 (c) concerning a physical security event at Wolf Creek Generating Station.
I The attachment to this letter contains Safeguards Information in accordance with 10 CFR 73.21 and therefore should be withheld from public disclosure.
This letter when separated from the attachment, does not l
contain Safeguards Information and should be handled as decontrolled, l
Acknowledgement of receipt of this letter, via the enclosed form, would be appreciated.
i j
i Yours very truly, l
Glenn L. Koester Vice President - Nuclear GLK:see Attachment
'1 I"Cl 8""'
information in this reccrd was durMd JTaylor, w/a in accordance with ;he Freedom cf Information I\\
cc: P0'Connor (2), w//ct, cKemptions _ '
JCummins, w/o f0!A-3 7 - X l %
1/f h(9/0lh'y0IED
/.
l 201 N Market - Wechris. Kansas - Marl Addreta' PQ @%a @@ Wegm cimam avmg ww w - ~ ~ ~ - - -
0 7
7 I
I i
1
. - -,,+ = = = -, -
w g
r- -
.)
h 9
g 1
I l
i l
l d
g _,,,.
a v,
va.. n.ou, y co.
meo om ao am.e LICENSEE EVENT REPORT (LER) o y g pg QQCRETaRAS$8 gp F.ag 3 Wolf Creek Generating Station o ls l o lo l c I 41812 1lorl012 fif LE 64 Major loss Of Physical Security Effectiveness Durtry: Maintenance Activity m m re.
u a== = =..
n oar oar m orma,w utiu,vomo =
art m -
o s, Y fVIAa
'EA8
.a 6sonth cAv vtam
- *0 La t e ara ants oOCRit tevadstm(gj c1510 10 10 1 I i 1l 0 of 7 a'6 8l6 Oj 5l5 0l0 1l 0 1l 0 8l 6 o isto lo t o, rias em a mme evaeuurt to tw asovimen. ems o. = cn e,cm nn mac* =>
1
..w mmw
.uswinew g
,o, m a wnus mmm somwem Y
11 Q 0 m awn =
amm L
ruiw sunwwwi 75 4 M$m y
m *wam MmWHs ofwearaa=
W " w ="u
%d_$E@";
l eU 3w nHve M Q
a mwme.,
eenwam>
i% $
n.rawan. anno
~
~~~
a.un,,
, esmaan
~
,v,wau,,
om.n eocuc,,o. r u. n.
14erlin G. Williams - Superintendent of Regulatory, Quality TILtPwo.rg osvaggm aaaa coos and Administrative Services 311 16 31614 1-18181311 l
comers one 6me com ucu com.o.ec ruwas os.cmoso a ries menant na
CAUSE
SYSTins Cw ar?
"y g[
to De s 'p'd c CAU.g systgm mmaart "mn
^
TV Yg u @ Y'f@BJ-3.sa%m.4Nhf, l
1 l l l l 1 5 GT I
t l I I l l MD&
4@4$$$$g M%%D 1
Ul I I l Oi'd k' I
i i i I I I smemmu. assoar amereo n.
8x96Creo
~pu rn, emern mumm um
~k'l ~o l
l l
, rue,ru,,..,.
u m.
==_.= n o On October 7,1986, at approximately a Security officer was dispatched to serve as empensation for the planned r al of an Emergene Diesel Generator Fuel Oil Storage Tank access eLcover I
Because o an unexpected delay in the work activity, the Security officer individual remaining at the workeft the area after reminding the non-supervisory a th Security must be notified prior to ccwer remvah At approximately the personnel reassembled at the work area and pecceeded to remove the cover.
offiber present was discovered at approximately f not having a Security n
error Security w sted to dispatch another officer, who arrived at the area at approximately Proper empensatory measures were maintained from this time until the er w reinstalled.
Corrective a:tions to prevent future similar personnel errors by nonlicensed utility personnel and contractors include counselirg of the personnel involved and a special training session for ccotractor foremen and rigging t
personnel, i
nis event has been classified as a major loss c2 physical security effectiveness.
'Ibe area was not lef t unatterd.J at any time during this event.
Were have been no previous similar occurrences.
- =amm r gffh'b~
m" cr~
_n
~
LICENSEE EVENT REPORT (LER) TEXT CONTINUATION
,s
.x.....u.m..o..<o
.u;
.m. u :-. o > w e :.
..c,[, n..,,,
...n....
jwoo==aai>
j u......
..e:;e i
e,.,w Wolf Creek Generating Station l 0 15 ! 0 ( 0 l 0 !4 I 812 81 6 01515 O ! O, O!2 0'
v~~.==--
- <. - - =.
- Ol2 On October 7,1986, preparations were made to remove the access panel cover over an Dnergency Diesel Generator Puel Oil Storage Tank to facilitate a maintenance activity. In accordance with the applicable procedure, Security was notified of the intention to remove the cover, and an officer was dispatched to the area at i
roximately 0946 CI7T to nsate for the removal of the cover.
Removal of the cover constitutes a breench of the barrier, requires the es lishment of proper ccupensatory measures.
Were was an unexpected delay in starting this work activity, and all but one of the involved personnel left the work area.
assigned other duties due to no work in progress.%e Security officer was subsequently non-supervisory individual in the work After notifying the remaining officer left the area at approximately ea of his impending departure, the Security would be rotified prior to the start with the understanding that the work activity.
)
At approximately the personnel involved in the work activity had returned to the area along with additional personnel and proceeded to remove the access panel cover.
Subsequently, the error of not having a Security officer present was recognized and Securi another officer at approximately was qgitacted and requested to dispatch Upon arrival at the area at approximate 1 the Security personnel, noting that the cover ha$ been removed, vertfied that no unauthorized personnel were present in the area.
the proper compensatory measures were maintained.Prca this time until re-establish g
Wis event was the result of cognitive personnel error by nonlicensed utility and f) contractor personnel who neglected to verify the presence of a Security officer i
prior to renoving the access panel cover.
i counseled regarding this error.
We involved personnel have been In addition, a training session will be held for the foremen and rigging personnel who perform this type of work to emphasize the importance of procedural adherence and to emphasize necessity of ensuring that proper __ compensatory measures are in effect when remaving the access panel cx) vers.
l In accordance with 10CFR 73.71(c), this event has been classified as a major loss of physical security effectiveness.
%roughout the forty-five minute perio$ that the proper ccnpensatcry measures were not in place, authorized personnel were present in the area and at no time was the area lef t unattended.
Bis event had no significant effect on the continued safe operaticn of the unit.
%ere have been no previous similar occurrences.
l. l u.,,
d
- ^ -
J