IR 05000423/1987012
| ML20237H731 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 08/10/1987 |
| From: | Mccabe E NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML20237H709 | List: |
| References | |
| 50-423-87-12, NUDOCS 8708170329 | |
| Download: ML20237H731 (12) | |
Text
- _ _ _ _ _ _ _ _ . _ - _ _ _ _
J
,
U.S. NUCLEAR REGULATORY COMMISSION
REGION I
Report N /87-12 Docket N License N NPF-49 Licensee: Northeast Nuclear Energy Company P.O. Box 270 Hartford, CT 06101-0270 Facility Name: Millstone Nuclear Power Station, Unit 3 Inspection At: Waterford, Connecticut
'
i Inspection Conducted: May 12 - July 10, 1987
'
Inspector: .J. T. Shediosky, Senior Resident Inspector Approved by: $0b E. C. McCabe, Chief, Reactor Projects Section 3B NI8[I 7 Date Inspection Summary:
Areas Inspected: Routine on-site resident inspection (196 hours0.00227 days <br />0.0544 hours <br />3.240741e-4 weeks <br />7.4578e-5 months <br />) of shutdown planning, plant operations, radiation protection, physical security, fire
..
protection, surveillance and maintenance, i Results: This inspection identified satisfactory performance in all areas. An i Unresolved Item was identified as the result of the inadvertent discharge of-the Carbon Dioxide fire suppression system'into the East Motor Control Center :
Rod Control Area (Report Detail 2.g). Another unresolved item was identified as the result of two licensee-identified failures to establish required fire watches, (Report Detail 3). On this unresolved item, it has not yet been estab-lished whether corrective action on the earlier event or on similar previous events should have prevented either or both of these occurrence PDR G ADOCK 05000423 t PDR g I-
_____ .
,
l l
TABLE OF CONTENTS PAGE 1. Summary of Facility Activities....................................... 1 2. Review of Specific Activities........................................ 1 i
! Reactor Trip - May 14........................................... 2 Partial Loss of Condenser Vacuum - May 28....................... 4 Reactor Trip - June 5........................................... 4 Failure of Main Steam Isolation Valve Operator.................. 5 Inadvertent Reactor Mode Change - June 8........................ 6 Reactor Trip - June 14.......................................... 7 Discharge of Carbon Dioxide System - July 6..................... 7 3. Licensee Event Reports...................................... .... ... 9 4. Management Meetings.................................................. 10 l
l l'
i
- _ _ - _ _ _ - - _ _ __ _ _ _ - _ . ___ _ _ _ _ . .__ - _ _ _ _ _ _ _ _
-_ - _ _ -___ _ ___ _- - _-
.
DETAILS Summary of Facility Activities The plant was operating at 69% power at the beginning of the inspection period because of recuring problems with feed water pump shaft seals. Plant opera-tion at that reduced power provided stability while shifting feed water pump The primary cause for the seal failures was found to be check valves plugged with foreign materia A reactor trip occurred during trip breaker response time surveillance testing at 10:07 a.m., May 14. Licensee actions and possible causes are addressed in report paragraph 2.a. The reactor was made critical on May 16 at 3:28 p.m. ; the plant reached full power at 11:00 p.m. , May 18. (The feed water pump seal injection check valves were repaired by that time.)
The plant operated at full power until a reactor trip at 1:28 p.m., June This trip was due to low steam generator level which resulted from the closure of all four Main Steam Isolation Valves (MSIVs). This accompanied the loss of a.c. power to one safeguards electrical division when a distribution breaker was tripped. The circumstances are discussed in report paragraph The reactor was made critical at 5:56 a.m., June 6. A reactor shutdown was commenced at 1:00 p.m. the same day after the "A" MSIV failed to close when called for from the "B" Safety Division. Repairs were completed and the reactor made critical at 12:03 p.m., June 10. The plant reached full power at 2:18 a.m., June 1 The plant tripped from full power again at 3:20 a.m., June 14. At that time, the reactor trip followed a turbine trip on momentary low oil pressure which occurred during surveillance operation of the standby turbine lube oil pump The reactor was again made critical at 6:35 p.m. the same day and reached full power at 7:00 a.m. , June 1 . Review of Specific Activities !
i l
The resident inspectors observed plant operations, maintenance and surveil- I lance during regular and back shift hours including inspections made on May 15 and 16, June 9 and 27. Control Room instruments were observed for cor-relation between channels, proper functioning, and conformance with Technical Specifications. Alarm conditions in effect and alarms received in the control room were reviewed and discussed with the operators. Operator awareness and response to these conditions were reviewed. Operators were found cognizant )
of board and plant conditions. Control room and shift manning were compared j with Technical Specification requirements. Posting and control of radiation, l contaminated and high radiation areas were inspected. Use of and compliance ;
with Radiation Work Permits and use of required personnel monitoring devices !
were checked. Plant housekeeping controls were observed including control of flammable and other hazardous materials. During plant tours, logs and records were reviewed to ensure compliance with station procedures, to deter-mine if entries were correctly made, and to verify correct communication of
_ _ _ _ _ _ -__ _ _ _ _ _ _ _ _ _ _ _ - - _ ___ . _ _ _ _
?
i'
'
i equipment statu's. These records included various operating logs, turnover sheets, safety tag and jumper logs, process computer printouts and Plant In-formation Reports. The inspector observed selected actions concerning site security including personnel monitoring, access control, placement of physical barriers, and compensatory measures. No unacceptable conditions were identi-fle A meeting of the Plant Operations Review Committee was attended on May 1 The May 14 reactor trip was the principal item of discussion at that meetin A routine monthly meeting of the Nuclear Review Board was also attended on June 17. No unacceptable conditions were identifie The following specific activities were also addressed during routine inspec-tions: Reactor Trip - May 14 A reactor trip occurred at 10:07 a.m., May 14, during response time testing of the Reactor Trip Breakers (RTBs). Prior to the trip, reactor power was stable and at 69%. Power was at that level to allow shifting of feedwater pumps during a period when problems with seal water injec-tion was causing frequent failures of the steam generator feedwater pump seals. Active testing of the "A" RTB was in progress at the time of the trip; it was reclosed 11 seconds prior to the "B" RTB openin The first event associated with the reactor trip was the opening of the
"B" RT There were no events logoed in the sequence of events prior to the opening of the RTB. There were no reactor protection signals processed by the protection system prior to the Turbine Trip signa The turbine trip was initiated by the opening of the RT Following the reactor trip, there was a 192 millisecond delay between the opening of the "B" RTB and the "A" Bypass Reactor Trip Breaker (BRTB). 1 The time difference between the opening of these two breakers is norm- l ally much smaller. (Subsequently, it was measured at 10 milliseconds.)
In this case, the trip was processed by the protection system to both breakers simultaneously. The 192 second time difference indicated that i the "A" BRTB was opened by the protection system and followed the turbine tri The inspector observed the licensee's investigation, which included de-tailed reviews of pre-trip post-trip data, personnel interviews, inspec-tion of wiring and components associated with the reactor trip breakers, testing o,f the trip breakers and protection system components, and re-creation of the test in progress at the time of the tri ;
__-_
- _ _ _ _ __ _ _ _ _ _ - _ _ _ _ - _ _ _ - _ _ - _ _ _ _ - _
,
.
~; 3 The results were that'there were no deficient conditions identifie All systems and components associated with the protection system:func-tioned properly. .A solid state timer which did not start properly.durin the initial test operated satisfactorily when the test was re-run. Since this-timer operates on breaker auxiliary contacts, it does not appear to.have had an effect on the original tes An extensive investigation was conducted of.the. plant process computer and its. interface with the protection system. Following the reactor trip, the licensee discovered that large numbers of digital inputs from the protection system were changing stat This indicated a failure within a portion of multiplexed input from the protection system. The problem was evaluated as being entirely within the process computer. A' link failure between redundant input devices combined with a software def1-ciency created a series of events which circumstantially appeared to.be hardware interaction. The inspector noted that potential interaction between the process computer and the protection system was' thoroughly investigated prior to allowing a reactor restar The inspector con-siders it significant that personnel within the computer services. group recognized a potential interaction between the reactor' protection system l and the plant process computer and that this issue was promptly brought '
to licensee management attention. The reactor startup was not commenced until the process computer multiplex system was proven to be isolated from the reactor protection syste The root cause of the trip was not identified. There were no hardware deficiencies found and the test was re-created successfully. It is ;
possible that activities adjacent to the "B" RTB created a mechanical shock, causing the trip breaker to open. Another possibility is that the breaker was inadvertently tripped locally. Only a mechanism which tripped the breaker locally, at the switchgear, would have resulted in the particular sequence of events recorded in this cas The personnel involved with testing were interviewed to determine if their activities caused the trip. Those people were knowledgeable and experience They had employed a technique which exceeded the pro-cedural requirements to avoid mixing up the two reactor trip breaker Most of the activities, such as connecting the solid state timer, are performed through a rear access panel. To help assure testing the right reactor trip breaker, the electricians place a tape marker on the breaker under test. As this technique enhances human performance, it has been endorsed by the license All of the suspect equipment has performed properly since this inciden There were no unacceptable conditions identifie During this event, several problems occurred in non-safety system In I addition to the problem with process computer digital inputs, failures occurred in piping associated with feed water heater relief valve The supply lines to two thermal relief valves associated with the IB and 1C L..... . .. .
.
. .
.
. _._________ _ _ 9
_ __-____ -__ _ _ _
1 .
!
.
feedwater heaters cha nel heads (that is the tube on feedwater side)
failed during a pressure transient which accompanied the post-trip feed-water isolation (FWI). Those three quarter inch lines failed at socket welds on the heater channel heads. These lines were replaced with new pipe of the same design pending the results of engineering analysis and metalographic examination. The third relief line was inspected and found acceptabl An additional problem was found following the trip and may have resulted from the hydraulic shock associated with FW Seal ring leakage occurred on the 1A feedwater heater, feedwater outlet isolation valve (3FWS V12, MOV 19A). Repairs were completed prior to plant restart on May 1 The reactor was made critical at 3:28 p.m., May 16; the plant was at full power at 11:00 p.m., May 18. There were no unacceptable conditions identifie b. Partial Loss of Condenser Vacuum - May 28 A partial loss of condenser vacuum occurred at 10:02 a.m., May 28 during the process of shifting the steam generator blowdown flash tank vent line from a path to the atmosphere to the main condenser. The reactor was at full power when the decrease in vacuum occurred. The control room operators acted to stop the air inleakage to the condenser through the flash tank. They also reduced turbine load by 170 MW(e). The lowest value of condenser vacuum was 23.5 inches Hg. The turbine is tripped at about 7 inches H The cause was a deficient procedure which allowed parallel vent paths from the blowdown flash tank to both atmosphere and the condense This procedure had been performed in the past and this problem had not been identified. A procedure change, Number 3, was implemented on May 28 to correct the procedure problem. This changed the sequence of valve operations of OP3316C, Steam Generator Blowdown section 7. The licensee has generally had a good record of processing procedure changes when deficient conditions were identified. In regard to this case, licensee management has stressed the importance of identification f l
of procedure problems to the operations personnel. There were no un- l acceptable conditions identified. The resident inspectors will continue 6 to review procedure changes during routine inspection >
c. Reactor Trip - June _5
A reactor trip occurred at 1:28 p.m., June 5 when power was lost to 4160 1 volt safeguards electrical bus 34C. The loss of power resulted in the I closure of all four Main Steam Isolation Valves (MSIVs) and a reactor trip due to low steam generator level . The reactor had been at full power prior to the event. All safeguards equipment functioned properl j
- -- -
.
.
.
i The safeguards bus was de-energized when an operator. dropped a switchgear '
breaker elevator motor within the Reactor Plant Closed Cooling Water Pump
"C" cubicle. The shock of the motor striking the side of the cubicle is believed to have momentarily closed the contacts of a relay mounted on the door of an adjacent cubicle. That relay, Type 62AR, would have l actuated the " seal-in" Type 86E Bus Lockout Relay. The 86E relay was found actuated. This action caused the normal feed breaker from Bus 34A to Bus 34C to trip and lock-out the alternate feed to Bus 34C from the Reserve Station Service Transforme Each safeguards division powers redundant operating solenoids for each MSIV. The loss of power to either solenoid will cause the MSIV to shu i This action resulted in the reactor trip. Because of the significance of this transient, the licensee has an engineering study in progress to investigate the addition of an uninterruptable power supply for the MSIV operating solenoid ,
i The plant equipment operator had been instructed to lower the "C" i Reactor Plant Closed Cooling Water Pump breaker to establish the nor- ;
mal power supply alignment. The operator was not able to energize j the breaker elevator motor. After exchanging the power supply fuses and the motor, the operator made the error of holding the motor in his hand while having it energized. When the motor energized, its ,
torque caused it to spin out of the operator's hand. It struck the !
inside of the cubicle, apparently initiating the sequence of events leading to the reactor tri The inspector expressed concern to licensee management because the equipment operator had begun to troubleshoot the apparent inoperable elevator motor without receiving instructions from shift managemen Safety related 4160 volt switchgear needs to be operated and main-tained in accordance with written procedures not only because of its safety application within the plant but also because it may present a personnel hazard. This aspect of operator performance, individually and collectively, will be further evaluated during routine inspection The breaker cubicle was inspected after the reactor trip; the elevator mechanism was found to operate satisfactorily. The operator may have experienced an alignment problem with an interlock lever witiiin the mechanism. That interlock can interrupt power to the elevator motor if not properly aligne The reactor was made critical at 5:56 a.m. , June I Failure of Main Steam Isolation Valve Operator During plant startup, the "A" Main Steam Isolation Valve (MSIV) failed l to close from a signal initiated in the "B" safeguards division during surveillance testing conducted at 11:16 a.m., June 6. The licensee commenced a reactor shutdown and plant cooldown at 1:00 p.m. to comply ;
with Technical Specification 3.7.1.5 and also to allow repairs of the MSIV components. The MSIVs were shut when the plant was placed in Mode 4 at 9:43 I i
l
'
____
- ___ -
.
.
6 The licensee inspected and rebuilt all sixteen normally energized sole-noid operated valves associated with the MSIVs. The valve shaft of "A" '
MSIV solenoid valve 2B was found bent by about 0.060 inches. This piece may have been damaged during valve operation; it was replaced. Addi-tionally, the air gap between the fixed and moveable pieces of the mag-netic circuit was measured in all sixteen valves. The gap, which can only be measured when the valve is disassembled and cold, facilitates the ability of the solenoid to drop out. The clearance specified by the vendor was between 0.0195 and 0.031 inches. The as-found conditions for each valve were within specifications, but about 0.022 inches. To facilitate valve operation, the clearances were opened to about 0.030 inche This work was completed and the reactor made critical at 12:03 p.m. , June 10. The valves were successfully cycled using components of each safety division prior to commencing power operatio In addition to these actions taken to repair the defective solenoid operator, the licensee is conducting an independent design review of the solenoid valves. The inspector had no further questions at this tim e. Inadvertent Reactor Mode Change - June 8 While shutdown on June 8 at 1:40 p.m. , reactor coolant system temperature was allowed to increase above 200 degrees F._ This resulted in a reactor mode change from Mode 5, Cold Shutdown, to Mode 4, Hot Shutdown. The incident occurred during an investigation into a problem with the remote operation of a Residual Heat Removal suction valve. The valve was closed during that investigation. Operations personnel were standing-by locally at the. valve to manually open it and re-establish shutdown coolin However, the control room operator failed to correctly monitor reactor coolant system temperature for about 35 minute The condition was identified by the licensee at 1:45 p.m., and shutdown cooling was promptly re-established. Reactor Coolant System temperature had increased to about 202 degrees F at that time. The cause for the incident was operator error and insufficient management oversight. The licensee's corrective actions included re-instruction of the control room operator The inspector noted that the licensee's investigation was thorough and members of the Operations Department were informed of the errors mad Inspector review concluded that this licensee-identified item was of minor safety significance, appropriately reported and corrected, and not amenable to prevention through corrective action on a previous violatio Therefore, no notice of violation was issue _ __
.
.
f Reactor Trip - June 14 A reactor trip followed a turbine trip fi all power at 3:20 a.m. , June 14. Surveillance testing of the standby feaures of the turbine lubri-cating oil pumps was in progress. A low pressure transient condition was recorded by the plant process computer as the Turning Gear oil pump was secured. Because lube oil pressure is supplied by a turbine shaft driven pump, the flow of oil was not interrupted. The Turning Gear oil pump discharges into the same supply header; when the pump is secured, two check valves would have to stick open to allow oil to back flow through this pum The licensee's investigation failed to identify any deficiencies with the system or procedure However, the weekly surveillance test has been suspended pending the conclusion of the licensee's investigatio All safeguards equipment functioned properly after the trip. The reactor was made critical at 6:35 p.m., June 14 and reached full power at 7:00 a.m., June 1 Potentially unnecessary challenges to safety systems, such as this trip, will be reviewed during future inspections and evaluations of licensee performanc Carbon Dioxide Fire Suppression System Discharge The carbon dioxide fire suppression system automatically initiated to an electrical switchgear area for about four minutes during surveillance testing at 12:32 p.m., July 6. Within that time, the atmosphere within the East Motor Control Center / Rod Control Area (EMCC/RCA) was brought to a concentration of over 50% carbon dioxid There were no personnel injurie The licensee's initial actions were to isolate the adjacent areas for safety and to perform a personnel accountability check through use of the security computer. Operators in Scott Air Packs confirmed that no one had become disabled in adjacent areas. Personnel entry into the EMCC/RCA did not occur until after the atmosphere had been purged later in the evening of July 6. The fire suppression system was placed in standby service for all areas except the EMCC/RCA at 2:20 p.m. on July 6. The suppression system was returned to standby service at 8:35 An investigation found that the system operated as designed. The sur-veillance procedure was found to be deficient in that it did not direct that the carbon dioxide system be isolated or reset during this tes '
l In addition, the Plant Equipment Operators performing the surveillance test were not sufficiently familiar with the system to recognize that their actions would result in a system initiatio l
_
)
-__ _
_ _ -
,..
.
.,
Fire protection is provided by two,sub-systems. The Simplex (detection)
system is composed of detectors, bistables and a display and recording system. The Chemtrol .(carbon dioxide) system provides a fire sup-
'pression gas when initiated automatically or from manual keylocked-stations. Automatic initiation requires that at-least one detector in each of two channels be trippe During the system actuation which occurred on July 6, plant operators sequentially tripped and reset fire detection system bistables of the Simplex system for the EMCC/RCA. The procedure was deficient in that it did not identify that a carbon dioxide discharge would result when the first detector assigned to the second Chemtrol channel was trippe The knowledge level of the operators was.also inadequate in that they did not realize the full implications of their action There were several alternatives. The Chemtrol system could have been reset after each detector bistable was reset within the Simplex syste The carbon dioxide actuation valve for the area under test could have been shut, locking out that area. The carbon dioxide storage tank isolation-valves could have been locked shut. Any or all of these ac-tions could have prevented the actuation of the fire suppression system-during this surveillance test. The test of the detectors did require a system lockout. Although this test had been completed in the'past, this was the first occasion in which the test was run with the' Chemtrol system in standby.
l
.The. Simplex panel for the zone under test is 1.ocated in the-service building. It and the fire system data recorder located in the control room were manned for the surveillance test. Any single tripped de-tector'causes the carbon dioxide system warning alarms to actuate for the'affected area. These include a tonal-horn within the area and fire warning strobe lamps outside the doors.to the affected are The proper operation of these warning devices was verified in a special test on July 8 which was observed by the resident inspector.
Despite completion of personnel safety training in dealing with carbon l dioxide protected areas, a security officer opened a door into the af-fected area at the time of the initiation. No injury resulted, however.
l An accidental discharge of carbon dioxide is significant not only from l the aspect of personnel safety but also because it impacts the ability-of the operating crew to access plant equipment. Therefore, this event is identified as an Unresolved Item (50-423/87-12-01). The licensee's l- actions to upgrade procedures and to improve training will be addressed
.during future inspections.
'
_ ___
,
l
L
,
.
- 9 i
l'
l 3. Licensee Event Reports LERs submitted during this report period were reviewed. The inspector as-sessed LER accuracy, whether further information was required, if there were generic implications, adequacy of corrective actions, and compliance with reporting requirements of 10 CFR 50.73 and Administrative Control procedure ACP-QA-10.09. Selected corrective actions were cnecked for thoroughness and j implementation. The LERs reviewed were:
!
87-024-00, Event 1: Failure of the "B" Emergency Diesel Generator to start in less than the T"chnical Specification of 10 seconds on May 6. The licensee discovered that the air start solenoid valve had been set to pick up at 132vd Voltage measured at the solenoid was 134vd Procedures have been changed allowing the solenoids to be adjusted for a pick up voltage of 85 to 100vd This has been implemented for both diesel engines; there have been no ad-ditional problem , Event 2: Trip of the "B" Emergency Diesel Generator due to a momentary high crankcase pressure on May 6. A diesel engine trip on high crankcase pressure is provided for normal machine operatio This trip function is isolated from the engine control circuits during emergency operation in which the machine is started by the load sequencer. The licensee classified this trip as having resulted because an operator failed to adjust crankcase vacuum to one inch of water with the machine at full running load. The switch also appeared to be sensitive to vibration. A replacement has been ordere : Reactor Trip due to low steam generator level on May 7. This trip followed a rapid power reduction made in response to an apparent failed feed water pump bearing. The' power reduction resulted in feed system instabilities, the trip of the heater drain pumps, and eventual low steam generator leve All systems performed correctly following the tri : Reactor Trip due to the spurious opening of the "B" Reactor Trip Breaker. This has been addressed in Detail 2.a of this repor : Reactor Trip due to the loss of 4160v Safeguards Electrical Bus 340. The resultant loss of power caused the closure of all four MSIVs and a resultant low steam generator level reactor tri This event was reviewed in Detail 2.c of this repor ;
!
87-028-00: Control Building isolation due to dust contamination of the ven-tilation system supply air duct chlorine detector probe. The probe was re-placed and the detector channel was returned to servic I
_ -__
,
e
.
, 10 87-029-00: Failure to establish Fire Watches in accordance with Technical Specifications. This occurred on two occasions in areas which are nor- !
mally protected by Carbon Dioxide Fire Suppression systems. In the first event, discovered on June 7, the person performing these duties was not informed that the area being monitored, the MCC/ Rod Control Area of the Auxiliary Building was multi-leve Consequently, only a portion of the area was covered by the watch for 8.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. In the second event, dis-covered on June 24, Fire Watches again misunderstood their instructions, leaving areas uncovered for 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. These deficiencies were discovered by operators in the process of restoring Carbon Dioxide Fire Suppression System To prevent recurrence, the licensee established an additional administra-tive control requiring verification that Fire Watches are in place and multi-level areas are-addressed. This has been incorporated into the work ,
permit used for areas having carbon dioxide fire suppressio The inspector evaluated these events as licensee-identified, of minor safety significance, and appropriately reported and corrected. This item is unre-solved pending further review by the inspector to determine whether the corrective actions are effective, and whether either event could have been prevented based on corrective actions from previous events (Unresolved Item 50-423/87-12-02).
87-030-00: Inadvertent mode change from Cold Shutdown to Hot Shutdown due to operator erro This incident is addressed in Detail 2.e of this repor . Management Meetings During this inspection, periodic meetings were held with senior plant manage-ment to discuss the inspection scope and findings. No proprietary information was identified as being in the inspection coverage. No written material re-lating to inspection findings was provided to the licensee by the inspector.