Text

Revised Electrical Distribution Sys Design Assessment
	ML17304B215
Person / Time
Site:	Palo Verde
Issue date:	05/22/1989
From:	Barrow J; ARIZONA PUBLIC SERVICE CO. (FORMERLY ARIZONA NUCLEAR
To:	;
Shared Package
ML17304B213	List: ML17304B212; ML17304B214; ML17304B215;
References
	TAC-73246, NUDOCS 8906050220
	Download: ML17304B215 (122)
	v • d • e

,1 ELECTRICALDISTRIBUTION SYSTEM DESIGN ASSESSMENT May 22, 1989 Pre ared b:

K.L. V

~tzzfz.~

Reviewed b:

A roved b:

Conr rzrrrd 5r:

/

8906050220 S90525 PDR ADOCK 05000530 P

PDC

0 Cl i~

EXECUTIVE

SUMMARY

./f In response ta~NRC concerns regarding PVNGS electrical distribution system design ade-rtj.

quacy and reiiabiiity, particularly as'it relates to involvement in complicated reactor trips andfor natural circulation cooldown, Arizona Public Service Company (APS) has completed an evaluation of the historical performance of this system, as documented herein, with rec-ommendations for enhancement modifications.

A review of PVNGS reactor trip history reveals that the Fast Bus Transfer (FBT) scheme has functioned as designed during plant trips initiated at power levels up to 100% reactor power.

On four occasions natural circulation entry has occurred when FBT did not take place; however, three of these events involved circumstances under which FBT operation would not be reasonably expected.

The fourth resulted in a design modification to enhance FBT performance.

Coastdown of the turbine-generator and Reactor Coolant 'Pumps (RCPs),

with subsequent blocking of FBT, has resulted in natural circulation cooldowns and compli-cated recovery actions.

An examination of electrical distribution'."system alignment and/or design alternatives was perfoimed to identify potential enhancements, and has resulted in the following tlmee-part action plan:

1)

Operate with one RCP bus powered from the Unit Auxiliary Transformer and with the other RCP bus powered from the Startup Transformer.

2)

Revise the FBT scheme to initiate bus transfer upon the receipt of signals from the Subsynchronous Oscillation (SSO) relays and the generator back-up distance relays.

3)

Provide direct tripping of the reactor in the event of any turbine-generator trip, as well as. evaluate the feasibility of disabling Steam Bypass Control System (SBCS) and Reactor Power Cutback System (RPCS) operation above some reactor power level to be established.

APS is still evaluating the SSO relay operation experienced at PVNGS Unit 3 on March 3, 1989; however, interim actions pending completion of this evaluation have been established.

They include adduig these relays to the FBT scheme, and using digital fault recorders to as-sist in future diagnostic activities.

APS has determined that other electrical distribution system relays have not unreasonably contributed to historical reactor trips or their complexity.

~h

APS has evaluated the vendor-recommended maintenance for electrical distribution system equipment and has identified six items which are considered mandatory precursors to unit re-start.

These items are in addition to other required maintenance, such as Equipment Qualifi-cation-related activities.

Furthermore, APS has initiated a long-term electrical distribution system evaluation project..

This multi-phase project incorporates a historical, industry-wide nuclear plant and electrical system reliability evaluation; studies on specific current issues such as 'Station Blackout',

'Relay Coordination', and 'Lightning Protection',

and a detailed design bases review of the current electrical distribution system.

All of the above are being conducted to enhance PVNGS design, reliability, availability, and safety.

l

~

ANALYSISANDEVALUATION PVNGS REACTOR TRIP HISTORY Introduction APS reviewed unanticipated, automatic PVNGS reactor trips to determine "lessons learned" 6'om complicated trips; special emphasis was placed on natural circulation cool-downs and events that involved operation of the Fast Bus Transfer (FBT) scheme.

Reac-tor trips occurring as a result of power ascension tests were included if the reactor trip oc-curred upon receipt of an unanticipated protective signal. APS excluded plaimed and manual reactor trips from consideration (including planned natural circulation tests) to ensure that the "lessons learned" depend upon PVNGS equipment and personnel response to unfore-seen events.

I

. Summary Analysis Fifty-three (53) PVNGS reactor trips met the criteria for the "lessons learned" evaluation.

Table 1 (Attachment

1) identifies these reactor trips in chronological order, the Unit in-volved, associated Licensee Event Report (LER) number and title, operating mode, reactor power at the time of the event, and whether the reactor trip involved natural circulation cooldown or FBT operation. The followingbullets summarize the data contained in Table 1:

Of the 53 reactor trips evaluated, 35 involved Unit 1 (66 percent);

16 involved Unit 2(30percent); and2 involved Unit3 (4Percent).

~

Of the 53 reactor trips evaluated, 47 (89 percent) occurred from op-erating Mode 1 (Power Operation);

1 (2 percent) occurred from Mode 2 (Startup); 3 (6 percent) occurred from Mode 3 (Hot Stand-by); and 2 (4 percent) occurred from Mode 5 (Cold Shutdown).

The Mode 3 and Mode 5 events are reactor trip events because the Re-actor Trip Switchgear (RTSG) opened; reactor power was at zero percent in each case. These events were included not only for com-pleteness, but because one nf the trips from Mode 3 also involved natural circulation cooldow>>.

Of the trips evaluated, 7 (13 percent) involved entry into a natural circulation cooldown.

As stated

above, one of these occurred in Mode 3; the remaining six occurred in Mode l. APS has estimated

the time spent in natural circulation based on post-trip documenta-tion..

The natural circulation duration during these events has var-ied from approximately 43 minutes to approximately 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 25 minutes. The mean natural circulation duration predicted from these PVNGS trips is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 4 minutes, if the longest duration event is excluded from the calculation, or 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months 33 minutes ifit is included.

An analysis ofthese natural circulation events is provided below.

~ Of the 53 reactor trips, 30 (57 percent) occurred while the house loads for the affected unit were being fed from the Startup Trans-formers; therefore, no attempt was made to initiate an FBT.

For 11 (21 percent) of the events, APS has not determined the electrical distribution system alignment at the time of the reactor trip.

The unavailability of this data is not considered crucial to this evaluation because of the following:

a)

Had failure of the FBT scheme occurred during these events, the failure would have been reported in the docu-mentation or the failure would have manifested itself as a natural circulation event.

b) If each of these 11 events is assumed to have occurred while house loads were powered from the Startup Trans-formers, the number of FBT attempts would be underes-timated,"and the reliability of FBT as estimated from these events would be conservative.

I

~ Of,the 53 reactor trips, FBT was attempted but did not occur on 4 (8 percent) occasions;

however, FBT was attempted and did occur during another 7 (13 percent) of the events.

In an additional event, FBT occurred for one bus, but the feeder breaker for the other bus from the Unit AuxiliaryTransformer (UAT) failed to trip. (The LER for this event does not provide a definitive root cause for the break-er failing to trip.) Of the 7 completely successful FBTs, 6 occurred during reactor trips from 99-100 percent reactor power and the sev-enth occurred during a trip from 50 percent reactor power. 'This data does not indicate low FBT reliability.

Rather, it indicates that. any.

concerns with FBT design should be limited in nature.

'Natural Circulation Events The followingprovides a brief summary of each of the seven PVNGS natural circulation events that occurred during unanticipated. automatic reactor trips. The role of the FBT scheme during these events is also described.

September 12, 1985 PVNGS Unit 1 was in Mode 1 at 53 percent reactor power when a main generator output breaker was opened to initiate a planned load rejection test.

APS anticipated that the tur-bine would reduce speed and maintain house loads; however, the Electro Hydraulic Control (EHC) system did not maintain turbine control and main generator frequency decreased.

The RCPs were being powered from the main generator along with other house loads, via the UAT. A reactor trip occurred when protective devices sensed the coastdown of the RCPs and projected an unacceptable RCS condition ( i.e., a low Departure from Nucleate Boiling Ratio (DNBR)). The reactor trip generated.a turbine trip and, as generator speed continued to decrease, the RCP breakers. opened as designed.

Fast transfer of the RCPs to the offsite power source did not occur because of the low frequency on the RCP buses.

The duration of natural circulation for this event was 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 19 minutes.

Restoration of forced RCS flow was delayed because the charging pumps which supply RCP seal injection had become gas-bound due to inaccurate Volume Control Tank (VCI') level indication and control.

As a re-sult of the lessons learned from this event, design changes were implemented in all 3 PVNGS Units to preclude a similar loss ofVCTlevel and gas binding ofthe charging pumps.

October 3, 1985 PVNGS Unit 1 was in Mode 1 at 52 percent reactor power when a reactor trip occurred due to a low DNBR condition projected by all 4 Core Protection Calculators (CPCs).

At the time of thip. event the RCP buses were being powered Rom offsite via the NAN-S05 and NAN-S06

buses, as required in preparation for a subsynchronous resonance test.

An apparent malfunction of the Plant Multiplexer (PMUX) caused 13.8 kv startup switchyard breakers to open and the resultant loss. of power led to RCP coastdown and reactor trip. The duration of natural circulation for this event was 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months 34 minutes.

To prevent recurrence, the switch-yard breakers affected by the apparent PMUX malfunction were hardwired, bypassing the PMUXbreaker control.

October 7, 1985 PVNGS Unit 1 was in Mode-3, at zero percent reactor power, with the RCS at approximately 2250 psia and 565 degrees Falmenheit, and with the part-length and shutdown Control Ele-ment Assemblies (CEAs) withdrawn in preparation for startup.

Troubleshooting was being conducted on the PMUX to determine the cause of the problem which led to the reactor trip on October 3, 1985.

Another apparent PMUX malfunction occurred,,re'suiting in a loss of off-site power to the RCP buses and a reactor trip on the loss of forced RCS flow as sensed by steatn generator differential pressure instrumentation.

The duration of natural circulation for this event was 44 minutes.

To prever>t recurrence, the switchyard breakers affected by the apparent PMUX malfunction were,hardwired, bypassing the PMUX'breaker control.

Janu:uy 9, 1986 PVNGS Unit 1 was in Mode I at 100 percent reactor power, with the Reactor Popover Cutback System in "Auto-Actuate-Out-of-Service,"

when a turbine trip and subsequent reactor trip

were initiated as part of a scheduled power ascension program test.

The turbine trip was ini-tiated by manual actuation of the unit differential generator, protection relay.

The 525-kV generator output breakers opened as designed but, due to a sensed frequency mismatch be-tween the UAT and the offsite power source, a synchronization check relay blocked the antic-ipated FBT.

Reactor trip occurred due to a CPC-projected low DNBR condition, rather than on an anticipated high pressurizer pressure condition.

The duration of natural circulation for this event is 43 minutes.

Following this event and on an interim basis, the Unit was operat-ed with house loads aligned to the Startup Transformers; The design and operation of the synchronization check relay was reviewed by APS and an enhanced design was incorporated into the PVNGS FBT scheme.

July 12, 1986 PVNGS Unit 1 was in Mode 1 at 100 percent reactor power, when a reactor trip occurred up-on the Plant Protection System (PPS) sensing low RCS Qow through.steam generator P2.

Although this reactor trip was generated by 2-out-of-4 coincidence logic circuitry, subse-quent investigation revealed that an actual low RCS Qow condition did not exist.

Rather, the PPS setpoints were close to the safety analysis limits and did not provide sufficient operat-ing margin to preclu'de this type of event.

At that time the undervoltage relays on the 13.8-kV NAN-S03 and NAN-S04 buses were set at 95.65 percent of rated signal voltage and, im-mediately following the reactor trip, the undervoltage relays sensed a grid perturbation.

(The Transmission Control Center indicated that grid voltage can vary as much as 5 percent, plac-ing nominal grid voltage within the range of the trip setpoint.)

RCP buses NAN-SOl and NAN402 were load shed from NAN-S03 and,NAN-S04, placing Unit 1 in a natural circula-tion,cooldown.

The duration of natural circulation for this event was 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 23 minutes.

Corrective actions have included the establishment of new PPS and undervoltage relay set-poltlts.

p July 6, 1988 PVNGS Unit 1 was in Mode 1 at 100 percent reactor power when phase "B" of the 13.8-kV NAN-S02 bus faulted to ground, immediately followed by ground faults on the other 2 phas-es.

The feeder breaker to the bus did not immediately trip because protection is afforded by a time-overcurrent scheme.

The time-overcurrent protection was set to trip in 0.7 second (42 cycles) on a 3-phase fault; however, the UAT also experienced a fault and began to fail at 12 cycles.

The UAT ruptured and caught fire.

The RCPs were being powered from the UAT, and FBT could not be achieved because of frequency and voltage mismatches due to the ground faults. The duration of natural circulation for this event was 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 25 minutes.

Re-covery of forced circulation cooling for the RCS was dependent upon the actions necessary to restore power to the RCPs safely, given the nature and extent of damage to the electrical dis-tribution system.

March 3, 1989

'I PVNGS Unit 3 was in Mode 1 at approximately 98 percent reactor power, when the main generator output breakers opened.

A Reactor Power Cutback occurred as designed; howev-10

er, the control system for 4 of the 8 Steam Bypass'ontrol System valves did not operate properly and the reactor tripped on steam generator 42 low pressure.

Certain Engiheered Safety Features (ESF) actuations occurred (e.gSafety Injection) so, 2 RCPs were tripped in accordance with plant operating procedures.

The RCPs were being powered from the Unit Auxiliary Transformer at the time, and their power did not automatically fast transfer to the offsite power source because of the degrading

&equency and voltage as main generator speed decreased.

The two operating RCPs tripped on electrical protection.

The duration of natural circulation for this event was 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months 42 minutes. Operation of subsynchronous pro-tective relaying resulted in the opening of the main generator breakers.

The APS investiga-tion of the root cause for relay operation is ongoing (see Subsynchronous Oscillation (SSO)

Relay Scheme section for details).

Discussion Of the 7 natural circulation events, 3 (43 percent) were initiated while the RCPs were pow-ered from the Startup Transformers; therefore, FBT was not attempted.'he remaining 4, (57 percent) natural circulation events involved an attempted FBT which did not succeed'e-cause of mismatched &equency or voltage on the affected buses.

The three events that occurred while power was supplied to house loads from the Startup Transformers include the October 3 and October 7, 1985, and July 12, 1986, Unit 1 reactor trips:" As indicated in the event summaries above, the Unit was aligned to offsite power on October 3, 1985, in preparation for a subsynchronous resonance test; on October 7, 1985, be-cause the Unit was,in Mode 3 with the UAT out-of-service; and on July 12, 1986, pending re-view of the FBT scheme following the January 9, 1986, event.

Since the Unit was powered from offsite during these three events, it was vulnerable to natural circulation upon loss of off-site power.

The four natural circulation events which occurred while the RCPs were powered from tlie UAT include the September 12, 1985, January 9, 1986, July 6, 1988, andi March 3, 1989, reac-tor trips. The July 6, 1988, event involved more than one electrical ground fault and resulted in the UAT rupturing and catching fire.

Clearly FBT would not be expected to occur during this event because of the extent of electrical distribution system problems.

Additionally, the January 9, 1986, event involved an attempted FBT which was blocked by a synclironization check relay.

The design and operation of the synchronization check relay was reviewed by APS and an enhanced design was incorporated into the PVNGS FBT scheme.

The remau>ing two events (i.e., the September 12, 1985, and March 3, 1989, events) are the most significant in terms of identifying potential electrical distribution system enhance-ments.

In both cases the main, generator output breakers

opened, disconnecting the inai>>

generator from the switchyard.

Under such circumstances, the plant's control systems (e.g.,

Reactor Power Cutback

System, Steam Bypass Control System, Turbine Electro Hydraulic Control System, etc.) should reduce reactor iuid turbuie power such that house loads are con-tinuously supplied from the main generator via the UAT. The plant should arrive at a stable operating plateau with all systems in balance and with the RCPs maintaining forced RCS cir-

culation.

Although the plant control systems have operated properly on other occasions, even prevent-ing reactor trips, they did not achieve and maintain a stable condition during the September 12, 1985, and March 3, 1989, events.

On September 12, 1985, the turbine EHC system did not maintain turbine speed, causing main generator frequency to decay.

The RCPs were still connected to the main generator at the tune and the reactor tripped when the protection sys-tem sensed the RCPs slowing down.

On March 3, 1989, the control systems (principally the Stean Bypass Control System) could not maintain an adequate balance between primary and secondary

systems, and the reactor tripped on low steam generator pressure.

In both cases the main generator had coasted down as designed and had slowed sufficiently such that FBT would have been blocked.

The goal of this evaluation is to enhance the PVNGS ac electrical distribution system, over and above the current license basis, to prevent complicated trips.

The identification of alter-natives and the selection of options is described in the Electrical Distribution Alignment &

Design Alternatives section ofthis report.

12

ELECTRICALDISTRIBUTIONALIGNMENT8c DESIGN ALTERNATIVES Introduction APS examined the PVNGS electrical distribution system to identify conceivable, alternative distribution alignments and design changes (particularly protective relaying modifications).

The purpose of this review was to minimize natural circulation cooldowns, by maintaining a reliable source of power to the RCP buses.

The following ten alternatives were identified as a result ofthis activity:

~ Alternative 1 - Operate with both NAN-S01 and NAN-S02 aligned to the Unit AuxiliaryTransformer.

~ Alternative 2-Operate with both NAN-S01 and NAN-S02 aligned'o redundant Startup Transformers.

~ Altemative3-Operate with both NAN-S01 and NAN-S02 aligned to a single Startup Transformer.

~ Alternative-Operate with one RCP bus powered from a Startup Transformer and the other RCP bus powered from the Unit Auxilia-ry Transformer.

~ Alternative 5-Modify the SSO relay to initiate FBT, and power the RCPs from the Unit AuxiliaryTransformer.

~ Alternative 6-Disable the RPCS.and SBCS functions, while power-ing the RCPs from the Unit Auxiliary Transformer or.Startup Trans-former(s).

~ Alternative 7-Combine Alternative 2 with the SSO relay modifica-tion ofAlternative 5.

~ Altemative8-Combine Alternative 3 with the SSO relay modifica-tion ofAlternative 5.

~ Alternative 9-Combine Alternative 4 with the SSO relay modifica-tion ofAlternative 5.

~ Alternative l0 - Disable ail >>o>>-direct turbine-generator trips.

i i

Evaluation ofAlternatives Of the ten alternatives listed above, APS determined that only three were viable options; the others either violated regulations, contained internal contradictions, or did not provide reli-ability improvement. The three viable Alternatives are Alternatives 1, 4, and 5.

Alternative 5 was expanded to include two phases, "a" and "b".

Phase "a" will be comprised of a change to the initiation requirements of the turbine and reac-tor trip sequences.

The tripping of the generator breakers will initiate a turbine trip which in-tum will initiate a

reactor

trip, when the plant is operating above an as-yet-to-be-determined reactor power level.

Phase "b" willbe comprised of modifying the FBT circuitry to initiate FBT upon receipt ofSSO relay signals.

Avoidance of complicated trips was determined to be at least as important as avoidance of reactor trips and/or natural circulation events.

On this basis, Alternative 5 was determined to be the preferred Alternativ.

Alternative 1 exposes the plant to complicated trips due to its reliance on FBT, RPCS, and SBCS, on generator trip events.

Alternative 4 requires additional operator monitoring of electrical distribution system interactions, as well as its reliance on FBT for the RCP bus aligned to the Unit AuxiliaryTransformer.

This also leads to undue complexity, which is pref-erably avoided for a permanent solution.

Implementation Alternative 5 is to be implemented in two phases.

Although it also relies on FBT, it minimiz-es natural circulation by initiating FBT at the first indication of a potential disturbance.'affect-ing the power supply to the RCPs.

Figure 1'is provided to clarify the implementation schedule ofAlternative 5 in its entirety.

14

FIGURE 1 Implementation ofAlternative 5 COMPENSATORY PHASE 1 PHASE 2 Restart Interim 15

0 0

UntilAlternative 5 can be implemented Alternative 4, to power two RCPs from the Unit AuxiliaryTransformer and two irom a Start-up Transformer, willbe employed. Tliis align-ment practically excludes natural circulation entry forinitiating events that do not involve the Start-up Transformer. It also prevents tripping two PVNGS Units upon an initiating event involving one Start-up Transformer, as would happen ifRCPs for all three Units RCPs were powered Rom the preferred (offsite) power source. The current-design and license bases for PVNGS are not affected for restart.

The first phase to be implemented is Alteinative 5(b), that is, initiate FBT upon receipt of signals from the SSO relays and generator back-up distance relays. This interim modification is currently being designed as a Design Change Package(DCP) with a target issue date of June 1, 1989. Itwillthen be implemented either at the next refueling outage of each unit or sooner, ifpossible.

Operation. of the Units without this DCP does not present a challenge to any design bases, since Alternative 4 virtually precludes natural circulation as well as other complicated trips.

The second phase to be implemented is Alternative 5(a), the use ofRPCS and SBCS up to some predetermined, but as yet undetermined (e.g.,50-60 percent reactor power) power level. The exact level willbe determined upon corn'pletion of a detailed engineering study of the RPCS, SBCS, Feedwater Control System( PvVCS) and the Plant Protective Systems PPS. Among the factors to be considered in the study are system interactions and human responses to plant transients (e.g., a main feedwater pump trip).

", Once the exact level is determined,'he RPCS and SBCS would be kept out ofservice whenever the reactor is at or above this level. In order to achieve this the turbine tripping scheme would be modified to operaie on the tripping of the generator breakers and the PPS would be modified to initiate a direct reactor trip upon a turbine trip.

Operation of the Units without this portion of Alternative 5 does not present a challenge to any design bases, since Alternatives 4 and 5(b) virtuallypreclude natural circulation and other complicated trips.

16

SUBSYNCHRONOUS OSCILLATION(SSO) RELAYSCHEME Design Basis Review APS included the SSO relays in the original plant design to protect the turbine generators from the adverse affects of subsynchronous resonance (SSR).

SSR has caused catastrophic failures of turbine-generators.

The original design for the SSO relay tripping scheme was to sense a SSR event, isolate the turbine-generator, and permit continued operation of the reac-tor, turbine, and generator to supply the house loads.

March 3, 1989, in Unit 3, SSO relay op-eration initiated a chain of events that led to coastdown of the RCPs, resulting in a reactor trip and natural circulation cooldown. This event is discussed below with alternatives to en-hance the SSO relay scheme.

All three PVNGS Units are equipped with two SSO relays.

Operation of either or both of the relays will initiate the opening of the 525-kV breakers, Opening these breakers, isolates the main generator from the 525-kV transmission system.

The application and. setting of SSO relays at PVNGS was a result of extensive modeling, testing, and analysis.

The SSO relay settings for each PVNGS Unit is different to prevent simultaneous tripping of all three Units. During the occurrence of one SSR event, the isolation of one Unit wiu detune the electrical system; therefore, the other two Units would not be expected to trip.

At PVNGS, the Unit 3 SSO relays are.set to be the most sensitive, then Unit 2 and Unit 1, re-spectively'.

Unit 1 trips. last, since its control room contains the switchyard mimic bus, the use of which may be necessary following an SSR trip event to prevent a joint Unit/switchyard transient control room response requirement.

PVNGS has experienced two Unit trips involving operation of the SSO relays.

The first trip occurred on January 10, 1987, in Unit 1. The "1A" SSO relay had an internal design problem in its phase-lock-loop circuitry, that generated a false trip action which isolated the Unit 1

turbine-generator from the 525-kV transmission system.

APS worked with the SSO relay manufacturer, Westinghouse, toresolve thephase-lock-loopcircuitryproblem..

The second trip occurred on March 3, 1989, in Unit 3.

Printouts from the Plant Monitoring System indicate that an SSO relay-initiated trip signa', opened the main generator 525-kV,.

breakers.

Initial investigation and analysis of a simulation of the condition on the 525-kV transmission

system, at the time of the event, indicated that the SSO relay should not have operated.

Functional tests performed on the SSO relays at PVNGS showed no apparent fail-ure of either relay.

Based on these findings, "bench" tests were performed:on the SSO relay circuit boards. The results of these tests did not indicate component malfunction or failure.

Since test results of the Unit 3 SSO xelavs themselves have not identified the cause of the SSO relay(relays operation, APS ii>vestigated possible sources of erroneous signals to the SSO relays.

The turbine-generator Power System Stabilizer (PSS) was reviewed as a pos-sible source of erroneous input sign;ds to the SSO relay. A malfunction of the PSS could ge>>-

crate a signal which could cause SSO relay operation; however, test results indicate ih'at the PSS is not a likely source for the problem. Additionally, APS is testing the noisy generator 17

0 0

0

current transformer circuits as a potential source of an erroneous signal.

APS is also moni-toring the Unit 3 SSO relay performance in its plant environn>ent with a synthetic stimulus (i.e., a stimulus that simulates the input to the relays at the time the Unit 3 SSO relay opera-tion occurred) being applied during the refueling outage.

Upon discovery of the cause of im-proper SSO relay operation, APS willtake action to reduce or eliminate recurrence Based on experience and analysis, an SSO relay operation will occur in the future.

The pos-sibility of going into complicated trip.situations (such as natural circulation) for these events must be minimized.

Tl6s possibility can be minimized by realigning the power supplies to the reactor coolant pumps as discussed in the Electrical Distribution Alignment Alternative sections.

In addition, 5 alternative actions have been identified as long term means to mini-mize the negative impacts of a SSO relay operation, to enhance the capability to identify the cause of a SSO relay operation, and to improve SSO relay security.

These alternatives are described in the following sections.

A summary of these alternatives is contained on Figure 2

0

~

FIGURE 2 Evaluation of SSO Rela Desi n Alternatives ALTERNATIVE NUMBER DESCRIPTION ACTION COMPLETION DATE Unit 1 Unit2 Unit3 Initiate and implement design change to Issue design change pkg include initiation of fast bus transfer Implement desighn change for SSO relays operations 6/15/89 6/15/89 6/15/89 Next Scheduled Refueling Initiate and implement design change to provide for SSO relay quantities to be recorded on digital fault recorders Issue Temporary Mod Implement Temporary Mod Issue design change pkg Implement design change pkg cmplt cmplt cmplt e~aaaa~reStarta~eeeeeeeeaeaa 1/1/90 1/1/90 1/1/90 Next Scheduled Refueling

~

Initiate and implement design change to provided a voltage reference circuit which ivillallow only that target initiated by the relay operation to be displayed......

Issue Temporary Mod Implement Temporary Mod Issue design change package Implement design change pkg cmplt cmplt cmplt

restart--

1/1/90 1/I/90 1/1/90 Next Scheduled Refueling Initiate and implement design change to NONEaSee A'nalysis/'SSO Relays revise SSO relay tripping logic Initiate and implement design change to NONEeSee Analysis /SSO Relays disable the SSO relay tripping schenie Note: RF is Refueling Outage

~Anal sls The following subsections describe potential SSQ relay enhancement alternative.

APS de-termined that the following alternatives are viable.

These subsections describe the logic be-hind the decision to implement or not.

Alternative I Initiate and implement design changes to include initiation of fast bus trans'fer for SSO relay action.

This is not a restart item since the alternate alignment of the reactor coolant pumps (described'n Identification of Electrical Distribution Alignment Alternatives section of this report) addresses the complicated reactor trip/natural circulation concerns.

This enhance-ment willbe completed during the next refueling outages for the tliree units.

Alternative 2 Initiate and implement design changes to provide for SSO relay quantities to be recorded on digital fault recorders.

This change willbe implemented in Unit 2 prior to restart and in Units 1 and 3 during the current refueling outages via a temporary modification.

The temporary modification will provide identical information on the SSO relay as will the design change Package.

The scope of the design change package includes many other areas; therefore, re-quiring'additional evaluation prior to completion.

Alternative 3, Initiate and implement design change to modify the existing voltage reference circuit so it will allow only that target initiated by the relay operation to be displayed.

This change will be implemented in Unit 2 prior to restart, and in Units 1 and 3 during the current refueling outage on a temporary mod.

This modification provides immediate indication of the section of the SSO relay that operated. The modification providing for digital fault recording capability for the SSO relays, alternative ¹2, willprovide the same information; however, this iitforma-tion is not immediately available.. The design change package completion will be given ap-propriate priority, scheduled and worked as indicated in Figure 2.

Alternative 4 Initiate and implement a design change to revise the SSQ relay tripping logic.

This alterna-tive is not considered as a desirable option at this time.

This proposed modification will not necessarily reduce significantly the probability an event similar to the Unit 3 trip in March 3,1989..

The actual cause of the Unit 3 relay operation is, and may continue to be. unknown.

APS believers the cause could either be a result of an intermittent component failure in the relay or a noise problem in the system.

For a noise problem in the system a logic modifica-tion would have no positive effect. In addition, a logic modification could reduce the proba-bility of tripping for an actual SSR event since the scheme would have to be more complex (i.e. more than one relay would have to operate to protect the units from the hazards of a SSR event).

20

0 0

Alternative 5 P>itiate and implement a design change to disable the SSO relay tripping scheme.

This would make all three units vulnerable to an SSR event, which could'result in catastrophic fail-ures of the turbine-generators.

Detailed

studies, simulations, and tests have justified, based on the probability of a SSR event occurring, that SSO relay tripping schemes are re-quired on each unit, as second contingency protection.

First contingency protection is not re-quired.

21

~li

KVALUATlONOF THE RELIABILITYOF OTHER RELAYS AT PVNGS Introduction APS reviewed the list of PVNGS unanticipated reactor trips, especially those that resulted in an entry into Natural Circulation, to identify trips in which relay problems were deter-mined to be the root cause of, or a contributor to, the event.

The purpose of this evaluation was to confirm that the logic configuration of the other power system relays did not unreason-ably contribute to those trips or trip complexity.

Summar Anal sis of Rela Contribution to Reactor Tri A total of 53 PVNGS reactor trips met the criteria for this evaluation; of these, 10 reactor trips or 9 events (one event involved the tripping of two units) were considered to be relay failure/misoperation related.

Two of the Unit trips resulted from,SSO relay problems and are addressed in the Subsynchronous Oscillation (SSO) Relay Scheme section of this report.

This leaves a total of seven events due, in part, to other relay problems.

The following sec-tions summarize those seve'n events:

December 4, 19S5 Unit 1 was in mode 1 at 54 percent power when a reactor trip occurred due to Low Depar-ture from Nucleate Boiling Ratio (DNBR): All four channels of Core Protection Calculators actuated; the trip was attributed to a high penalty factor being inserted by the Control Ele-ment Assembly Controller due to the dropping of sub-group 12 (part length control element assemblies). All equipment functioned as designed and no safety system actuated.

No Tech-nical Specification [Tech. Spec.] limits were exceeded.

During the resultant turbine-generator trip, bus.lENAN-S02 experienced a momentary loss of voltage.

This was subsequently attributed to a dip of the supply voltage, caused by the loss of Maiun Generator output from the system in combination with a less than optimal tap setting of the Startup Transformer (SUT) supplying 1ENAN-S06, S04 and S02.

No distur-bance was encountered on buses IENAN-S05, S03 and S01.

APS 'reset the (SUT) tap set-tuigs to the same value as the other (SUT) feediiig the unaffected buses.

This problem was setting related and did riot involve relay failure. All equipnient aiid protec-tive devices functioned as designed.

Natural Circulation entry was avoided.

22

January 9, 1986 Unit 1 was in mode 1 at 100 percent power when a turbine trip and subsequent reactor trip were initiated as part of a scheduled power ascension test program test.

The turbine trip was initiated by manual actuation of the unit generator differential protection relay.

Fast bus transfer (FTB) from the Unit AuxiliaryTransformer (UAT) to offsite power was blocked by a frequency mismatch between onsite and offsite power.

Upon the loss of RCP power, Natural Circulation was initiated.

The device which inhibited the transfer block was the Sync Check relay which performed as designed during a subsequent investigation; APS found no indication of malfunction of FBT devices.

Sync Check reset time (1.5 sec) may have been the primary contributor to this anomaly,.

An engineering investigation determined that the original Sync Check relay, an electro-me-chanical induction type, was not suitable for high-speed, bus transfer applications because of slow performance characteristics.

Consequently, APS replaced the Sync Check relay with a high-speed, solid-state device.

f' May31,1986 Unit 2 was increasing in power when the Turbine Generator (TG) set tripped at approximate-ly.35 percent power.

Approximately 12 seconds after the TG trip, the reactor tripped on high pressurizer pressure (all 4 PPS channels tripped).

RPS response times were within required values.

Safety functions were maintained and the event was classified as an uncomplicated reactor trip. The SBCS did not prevent the reactor trip, due to master controller not being in REMOTE AUTO, but it did support the subsequent cool-down.

Natural circulation was not entered.

The event initiator was the TG trip on negative sequence. current.

The actual cause has not been determined, but it is believed to be false operation of the phase current imbalance pro-tection relay.

The relays performed as designed during post trip diagnostics; however, pre-trip alarms had been received during the week prior to the event and PR&C had been involved in troubleshooting.

July 12, 1986 PVNGS unit 1 was in Mode 1 at l00 percent power, when a reactor trip occurred on low RCS fiow as indicated by Steam Generator P2 differential pressure.

APS determined that an actu-al RCS low fiow condition did not exist; rather the PPS setpoints did not provide sufficient operating margin to preclude this event.

The undervoltage relays on the 13.8KV NAN-S03 and NAN-S04 buses were set at 95.65 percent of rated system voltage and immediately fol-lowing the reactor trip, the undervoltage relays sensed a dip in the grid voltage.

RCP buses 23

Cl

~

NAN-S01 and NAN-S02 were shed on undervoltage placing unit 1 in a Natural Circulation cooldown.

The Systems Operations Department indicated that the grid voltage can normally vary as much as five percent, which places the nominal grid voltage within the range of the UV trip setpoint.

As a result, APS lowered the relay settings temporarily 2.5 percent to 93.2 per-cent of rated voltage and initiated an investigation of the system grid and plant distribution models to determine a permanent relay setting.

August 6, 1986 Unit 2 was operating at seven percent reactor power when water from a leaky valve resulted in a fault/failure of load center NAN-S02.

Subsequently, the SUT, NAN-X03, feeding both units 2 8c 1 tripped on differential current resulting in the loss of two RCPs,and consequent trip of each unit.. A current transformer (CT) was later found to have failed, (the project's failure history for CT is consistent with nuclear industry history, as given in IEEE std. 500-1984).

All other devices operated acceptably.

Natural Circulation entry was avoided during the course of the event in both units.

September 2, 1986 Utiit 1 experienced a

reactor trip on Steain Generator (SG) low flow (RPS channels B and D). Following the reactor trip, the TG tripped and -a generator coastdown trip occurred shed-ding 13.8KV bus NAN-S02. A fast bus transfer occurred maintaining power,to the RCPs.

The loss of NAN-S02 was attributed to an undervoltage relay (type 227-1) trip under volt-age transient conditions. Natural Circulation cooldown entry was avoided.

The problem has been corrected; relay setting of the undervoltage (UV) relay was changed to 90 percent of rated voltage fxom the previous 95.6 / 93.2 percent values to inhibit under-voltage trips durhsg grid disturbances.

As a result of the actions taken here, reactor'trips from this cause have not recurred.

Aprill6, 1987 Unit 2 was operating at 100 percent power when a reactor trip and turbine trip occurred due to interaction between the RPS system, CPCs and.

troubleshooting of a suspected ground fault in the B train 120V AC (class.lE) system.

Natural Circulation entry was avoided.

A relay problem was encountered during the recovery actions.

This problem i>>volved an overcurrent trip of loadcenter breaker 2ENGNL0882, when no faults (i.e.: overcurrent) were present.

APS found that the shunt trip (SST) device in the breaker protection circuit was de-fective due to silicon controlled rectifier (SCR) leakage.

Replacement of the breaker/SST de-vice completed action on this item.

Conclusion and Action Plan Two of the eight events (25 percent of relay-related trips or 4 percent of all trips) considered to have been affected by other relay problems resulted in unanticipated entry into Natural Circulation.

These two events involved Fast Bus Transfer and Undervoltage (UV) Trip problems.

Both of these trips occurred in Unit l.

APS has taken corrective actions which provide a reasonable assurance that these problems have been resolved.

Of the other Reactor trips, where Natural Circulation was not entered one trip was complicat--

ed by Undervoltage relay actuation under transient conditions (corrective activities'onduct-ed as a result of this event also resolved the problems identified in the UV,trip-Natural Circulation event addressed above).

Another trip involved a possible maintenance induced scram during troubleshooting.

Another trip occurred. during postcore power ascension test-ing, and involved SUT tap settings.

Three events, involving four reactor trips, were the re-sult of random component failures/spurious actuations. A Phase Current Imbalance relay in the Main Generator Protection System, a CI'n SUT X03 and a SST overcurrent device in a non IE Load Center Based'on the historical data presented

above, APS has determined that modifications to Power System relaying design are not warranted.

The corrective actions taken to date have minimized the potential for a recurrence of those problems deemed preventable.

The relay-related problems, that resulted in entry into Natural Circulation have been essentially elimi-nated.

'Random failures cannot be absolutely prevented; the use of a multiple (redundant) relay logic schemes would add significantly to the cost and complexity of the relay systems with little (if any) gain in reliability. Given the minimal consequences of the randoin relay failures to

date, changes to the existing Generator, SUT, or Load Center Protection. systems are not justified.

As discussed irt the preceding

section, the investigation regarding upgrades/betterments to the SSO relay system is continuing.

25

~Histor LONG TERM EVALUATION APS initiated this evaluation February 1989 to coordinate a number of PVNGS projects and ensure compatibility of recommended enhancements.

The evaluations and results document-ed in this Electrical Distribution Design Assessments report are one part of phase 1 of the Iong term evaluation.

Overview Currently, APS is coordinating a number PVNGS studies and evaluations to enhance power system reliability. This effort is comprised of the followingfour Phases:

Phase 1 - Evaluation of PVNGS performance on its own base and against the industry, including a thorough review of possible distri-bution alignment and protection configurations Phase 2 - Incorporation of the results of the Electrical Reliability Stud-ies Phase 3 - Incorporation of the results of the Engineering Excellence Program 1E System Reviews Phase 4 - Incorporation of the results of the Engineering Excellence Program non-1E System Reviews

~Summar PHASE 1 - PVNGS UnitTri Stud APS, under Phase 1, is reviewing all PVNGS plant trips and evaluating Electrical Distribu-tion System involvement. This data will be compared with statistics from other US nuclear

.plants. The PVNGS unit trips will be evaluated to determine severity of electrical system contributing factors. The contribution of the Electrical Distribution system will be grouped in-to one of the followingfour categories:

1) Electrical Root Cause - Root cause determined to be entirely elec-trical

2) Other Root. Cause

- No>>-electrical root cause resulting in a unit trip as a result of an electrical co>>tributi>>g cause

3) Electrical Problem-not a

cause

- Electrical problems related to plant trips

4) No Electrical Involve>>>e>>t

The PVNGS trip data willbe compared with industry trip data to determine ifPVNGS is ex-periencing a higher number of trip incidences involving the Electrical Distribution system than the industry. The followingfour comparisons willbe made:

1) PVNGS Electrical Trips vs. PVNGS Total'Unit Trips

2) PVNGS Trips vs. other Bechtel-GE Plants (licensed since 1980)

3) PVNGS Trips vs. all Region 5 Plants

4) PVNGS Trips vs. US Plants(licensed since 1980)

The PVNGS Electrical Distribution system will be evaluated to determine any unique sys-tem design characteristics. If unique characteristics are identified they will be reviewed for any impacts they may have had on reactor trips. The PVNGS design will be compared with other Bechtel plants using similar designs.

As noted above, the results of this Electrical Distribution System Design Assessment re-port is also included in the long term evaluation phase 1.

PHASE 2 - PVNGS Electrical Reliabilit Studies As a result of recent events at PVNGS, the followingadditional studies have been initiated:

~

Electrical Power'S stems Reliabilit Stud As a result of failures ex-perienced in the non-class 1E power systems in the Power Block and the 525 kV Switchyard, APS initiated a reliability analysis.

APS is coordinating this effort between APS and SRP to perform this reliability analysis and recommend any enhancements to im-prove the reliability of the power systems.

~

Station Blackout Stud In accordance with the requirements delin-eated in 10CFR 50J53 Station Blackout, APS evaluated PVNGS us-ing guidance from NUMARC 87-00

document, "Guidelines and Technical bases for NUMARC Initiatives Addressing Station Blackout at Light Voter Reactors", except where Regulatory Guide 1.155 takes precedence.

~ 'Rela Settin Coordination Evaluation In response to IE Notice 88-45, "Problems in Protective Relay and Breaker Coordination", APS is reviewing the relay setting and coordination efforts at PVNGS.

- Li htnin Evaluatio>> Due to the J;u>uary l989 Unit 2 ESF transform-er failures, APS perfonued an evaluation to determine if lightning was the root cause or a contributing factor. APS completed a light-ning protection design evaluation July 28,1986. This evaluation was initiated in response to INPO Significant Event Report (SER)

No.84-76.

27

~

Fast Bus Transfer Desi n Review Following the March 3, 1989, Unit 3 trip during which a Fast Bus Transfer did not occur, APS ini-tiated an evaluation of the Fast Bus Transfer design.

PHASE 3 -

Electrical S'tems The Engineering Excellence Program (EEP) system review working groups for the Q class electrical systems will factor the findings of the Phase 2 report into the evaluation of the de-sign basis review and their overall review findings into the Phase 3 report. The Q class elec-trical systems are as follows:

~ PB - Class 1E 4.16-kV Power System

~ PE - Class.1E Standby Generation System

~ PG - Class 1E 480-V Power Switchgear System

~ PH - Class 1E 480-V Power MCC System

~ PK - Class 1E 125-v DC Power System

~ PN - Class 1E Instrument AC Power System PHASE 4-Non-Electrical S stems The Engineering Excellence Program system review working groups for the Non-Q electrical; systems will factor the findings of the Phase 2 report into the evaluation of the design basis review and their overall review findings into the Phase 4 report. The Non-Q class electrical systems are is follows:

~ MA-Main Generation System

~ MB - Excitation and Voltage Regulation System

~ NA-Non-Class 1E 13.8-kV Power System

~ NB - Non-Class 1E 4.16-kV Power System

~ NG - Non-Class 1E 480-V Power Switchgear

~ NH - Non-Class 1E 480-V Power MCC System

~ NK-Non-Class 1E 125-V DC Power System

~ NN - Non-Class 1E 120-V Instrument AC Power System

~ NQ - Non-Class 1E 120-V Uninterruptible AC Power System Conlpietloll APS will issue a report at the completion of each Phase.

The schedule completion dates for these reports are subject to chiuige based on completion of the individu;d activities iiicluded in that Phase

. The current scheduled conipletion dates and Report outputs are listed below.

06/Ol/89 Phase 1 - Lessons Learned

- Preliminary Recomn>endations for Consideration 28

07/14/89 Phase 2 - Lessons Learned

- Recommendations for Implementation 03/12/91 Phase 3 - ReQnement ofPhase 2 Recommendations 08/05/93 Phase 4 - Refinement ofPhase 2 Recommendations Phases 3 and 4 are considered to be confirmatory and additional lessons-leariied informa-tion. The results of phases 3 and 4 willprovide in-depth review of the plant changes required or recommended during Phases 1 and 2.

29

'lk

<g

ELECTRICALDISTRIBUTIONSYSTEM MAINTENANCE Introduction Arizona Public Service Company (APS) conducted a thorough investigation of the PVNGS Electrical Distribution System maintenance requirements.

This investigation consisted of re-view of the vendor instruction and maintenance manuals to identiEy pertinent functional crite-ria and maintenance recommendations for system components.

Functional criteria are the tasks required to be performed (whether performed recently or not) prior to the restart of a unit. APS determined the functional criteria based on the operational history of specific criti-cal electrical system components or engineering recommendations (IEEE and other estab-lished standards).

These functional criteria may exceed the normal preventive maintenance requirements and scope.

APS compared the maintenance recommendations and functional criteria with the current electrical preventive maintenance program.

The implementation schedules of these tasks were reviewed to determine the overall technical adequacy of the current PVNGS Electrical Distribution System Maintenance Program.,

APS reviewed the PVNQS restart activities related to Electrical Distribution System mau>-

tenance'recommendations and functional criteria, including immediate and future enhance-ments. This review included safety analyses as applicable to the maintenance program.

The following report describes the scope, methods

used, and results of the investigations described above.

Discussion APS reviewed PVNGS Electrical Distribution System vendor. instruction and maintenance manuals to identify vendor-recommended preventive maintenance.

This review included the followingElectrical Distribution Systems:

- 525-kV system (in-plant switchyard area only) kV system (system designator MA)

- 13.8 kV system (system designator NA)

- 4.16-kV system (system designators NB and PB)

- 480-V load centers (system designators NG and PG)

- 480-V motor control centers (system designators NH and Pg)

- 120-V power and u>strumentation (system designators NN and PN)

-125-VDC power and instrunie>>tation (system designators NK c% PK)

- Miscellaneous electrical couiponents associated with the Fast Bus Transfer (FBT) and the Reactor Power Cutback System (RPCS).

30

I 0

APS'eviewed the vcndiir-recon>>ncnded niaintcnance and PVNGS operational Iiistory 'for critical 'electrical system equipment and components to determine tlie functional criteria.

APS identified the six restart requirements described in the following subsections (a through f)

~

(a) Cleanin ofallev osed hi h 525-kVac and medium 24and 13.S kV volta ~e insulators. bushin~~s and li htnin > arrestors.

APS identified cleaning of all high and medium voltage'insulators,

bushings, and lightning arrestors as a restart requirement based on the electrical flashover'incidents experienced on the Unit 2 Engi-neered Safety Features (ESF) transformer, and on the Unit 3 main transformer.

Based on investigation and analysis

results, APS de-termined that the, above flashovers resulted from the accumulation of salt drift contaminants (from the cooling towers and evaporative ponds) and the presence of a misting rain; lightning at the time of the incidents may also have contributed to the flashovers.

Exposed Phin'l lnsulatoN, bushlllgs, aluf liglltnlllg affestors will be cleaned prior to restart of;uiy PVN(3S uiiit.

(b) Lubrication and c clin ofFBT associated breakers I

APS identified lubrication and cycling of Fast Bus Transfer breakers as a restart requirement, since the failure of one of the Unit 1 Auxil-iary Transfoimer Y-winding,'eeder breakers (13.8 kV breaker 1ENANSOI) to trip after a reactor/turbine trip caused an incomplete fast bus transfer sequence.

The failure of the breaker to trip was caused by coil failure, or failure of the mechanical

&damages in the breaker.

APS reviewed the maintenance history for the above breaker and found no previous failures had been experienced; how-ever, scheduled mauitenance had been waived twice consecutively just prior to the failure due to operational considerations.

APS has not yet determined if waiving the scheduled mau>tenance contribut-ed to the failure of the breaker to trip; however, performance of the scheduled mau>tenance may Iiave identified potential or existing problems.

Tlie FBT breakers E-NAN-SOIA, E-NAN-S02A, 'E-NAN-S03B 8c E-NAN-S048 will be inspected, lubricated, and cy-cled prior to restart of any PVNGS unit.

(c) Oil sain )le evaluation froiiilar ~c uil-tilled transformers APS klentified sai>><)ling aiiil evaluating oil from large, oil-filledtraiis-fonners as a restan requireinent based on n>anufacturers recom-mendations.

Oil siuiip)es will be evaluated to detennuie the current oil characteristics and possible degradation which could inhibit per-31

formance and lead to.transformer failure.

Oil samples will be taken from the large, oil-filled transforiners (Main, Start-up, Auxiliary, Normal Service 8c ESP) and tested prior to restart of any PVNGS unit.

(d) Ins ect Lar e Oil-FilledTransformers and the Salt River Pro ect SRP Cascade Potential Transformer for Oil Leaks APS identified inspecting large, oil-filled transformers (including the SRP cascade potential transformer) for oil leaks as a restart re-

,quirement since oil leaks from large, oil-filled transformers may re-flect or lead to transformer operational problems. Transformer oil leaks can lead to low transformer oil level and failure, including fire and explosion.

Large, oil-filled transformers, including the SRP cas-cade potential transformer w'ill be inspected for oil leaks prior to re'-

'tart of any PVNGS unit.

(e) Verif Pro erO erationoftheDehvdratin Breatherfilteronthei>Iain Transformer APS identified verification of proper operation of the dehydrating breather filter-on the main transformer as a restart requirement, since filter saturation can cause degraded transformer performance or failure.

The dehydratingi breather filter of the main transformer removes moisture from 'ransformer intake air.

When saturated with moisture, the dehydrating material in. the breather should be replaced.

Over-saturation may eventually lead to transformer fail-ures or inadequate performance.

Proper operation of the dehydrat-ing breather filter on the main transformer willbe verified prior to re-state of any PVNGS unit.

(Q Performance of a Service Test on the Non-1E Batter S stem APS identified performance of a service test on the Non-'1E Battery System as a restart requirement to verify the ability of the system to satisfy design requirements (battery duty cycle).

The non-lE batteries provide control power to a multitude of breakers and pro-tective relays.

Improper operation of these breakers or relays could affect plant performance and reliability.

The service test is one of the recomniendations of IEEE standard 450 (IEEE Recornrnended Practice for Maintenance.

Testing and Replacement of L;irge L.cad Storage Batteries for Generatiiig Stations and Substations).

A ser-vice test of the Non-IE Battery System will be conducted prior to restart of;uiy PVNGS unit.

32

Review of PVNGS PM Tasks and Scheduled Im lementation APS compared the maintenance recommendations described above with the existing Electri-cal System Preventive Maintenance Program.

This comparison indicated that the existing Preventive Maintenance Program for the Electrical System equipment reviewed technically meets or exceeds vendor recommendations.

APS has developed a Preventive Maintenance schedule to ensure that the restart require-ments listed in the preceding paragraphs are completed prior to restart of any PVNGS unit.

The identified PM tasks and functional criteria do not provide relief from the Equipment Qual-ification (EQ) related special maintenance requirements.

These Special Maintenance Re-quirements are provided in the PVNGS Equipment Qualification List (EQL), a controlled document which prov'ides required maintenance directions for electric equipment within the scope of 10 CFR 50A9.

ReviewofPVNGSDesi n Chan esIm actin PMTasks APS reviewed current PVNGS design changes that affect the PM tasks.

This review indicat-ed that due to the flashover occurrences (subsection (a))'

design change package (DCP 0 1,2 & 3FE-NA-041) has been initiated to install creepage extenders on the ESF trans-formers.

This change willhelp minhnizing the flashover incidents and willextend the mainte-nance intervals for the clean-up of the bushings.

The ESF transformer bushing creepage extenders installation is scheduled prior to a unit restart.

A design clarification currently being implemented at PVNGS is the installation of'a drip loop on conductors connected to the ESF transformer bushings.

This drip loop will prevent water carrying salt drift contaminants from running down the conductors onto the bushings; thereby, helping to minimize flashover incidents.

Installation of the drip loops on the ESF Transform-er is scheduled prior to unit restart.

In addition to the immediate enhancements described above, a long-term study is being initi-ated to investigate the possibility of adding special insulator coatings which could also have a measurable effect on minimizing the flashover incidents and prolong the maintenance inter-vals.

CONCLUSION The review of vendor-recomniended prcverrtive rrraintenance. corrrbincd with the review of tire existhrg Electrical Distribution System Preventive Maintenance Progranr indicates that tire existing program technically meets or exceeds the vendor-recommended requirements.

Tire mainterr:urce requirements and furrctionrrl criteria identified in the preceding sectiorrs will be performed prior to unit start-up to assure reliable operation of the Electrical Distributiorr sys-tem.

In the future, the existing Preventive Mairrtenance Program in combination with tire pro-33

posed design and procedural changes will be sufficient to assure enhanced operational reli-ablity of the Electrical Distribution system.

CONCLUSIONS ANDACTIONPLAN Conclusions APS,review and evaluation of the reactor trip history on PVNGS (specifically complicated trips and natural circulation events) with electrical systems scheme involvement, has result-ed in a recommended enhancement action plan which, when implemented, willhelp in the minimizing of complicated reactor trips and the preclusion of natural circulation events. This review and evaluation focused primarily on electrical control and protection schemes in partic-ular, with direct oi indirect reactor trip involvement, and on the electrical distribution system alignment and reliability in general.

The specific areas of the above study included; identifi-cation of electrical distribution alignment alternatives, subsynchronous oscillation (SSO) re-lays, evaluation of the reliability of other relays at PVNGS and the electrical distribution system maintenance.

The followings summary includes the review. arid evaluation conclu-sions for each of the above specific areas:

Identification of Electrical Distribution Alignment Alternatives Of the ten identified electrical distribution alignment alternatives, APS determined that one alternative is most feasible for minimizing natural circulation and complex trips.

This alter-native entails a change to the initiation requirements of a turbine trip and a reactor trip when the plant is operating above a predetermined. reactor power level.

The turbine trip will be ini-tiated by the tripping, of the generator breakers and the turbine trip will intiate a reactor trip. It will also include the initiation of a FBT upon the receipt of SSO relays signals.

As a compensatory measure, in all three unit, one of the unit's reactor coolant pump buses will be supplied by the UATand the other reactor coolant pump bus willbe supplied from the SUT.

Subsynchronous Oscillation (SSO) relays Of the five identified SSO relays operation enhancement alternative, APS has determined that only tliree of the alternatives are presently desirable means to.minimize the negative unpact of an SSO relay operation and to improve SSO relay security, thus minimizing compli-cated reactor trip situations. The three proposed recommendations are:

~ Initiate and implement design change to include initiation of I OT for SSO re lay operation; also add diverse reactor trip in a second phase.

Initiate and implement desig>> change to provide for SSO relay quantities to be be recorded on digital fault recorders Initiate and iinpleo>ent design cluu>ge to provide a voltage reference circuit which willonly allow the target initiated by the relay operation

to be displayed I,

Evaluation ofThe Reliability of Other Relays at PVNGS Based on this evaluation, APS has determined that further modifications to PVNGS power system relaying design are not warranted.

The corrective actions taken to-date have mini-mized the potential for a recurrence of those problems deemed preventable.

The relay-relat-ed problems that have resulted in entry into natural circulation have been essentially eliminated.

Electrical Distribution System Maintenance APS review'of vendor-recommended preventive m'aintenance combined with the review of the existing Electrical Distribution System Preventive Maintenance Progr'am indicates that the'xistii>g program technically meets or exceeds the vendor-recommended'equirements!

The maintenance requirements and functional criteria identified in the maintenance section will be performed prior to unit start-up'to assure reliable operation of the Electrical Distribu-tion system.

In the future, the existing'Preventive Maintenance Program in combination with the proposed design and procedural changes will be sufficient to assure continued reliable op-eration of the Electrical Distribution System.

Based'.on the above conclusions, APS believes that this review and evaluation, with respect to PVNGS Electrical Distribution System contribution.to',the units complicated reactor trips and natural circulation events, has been adequately addressed.

The implementation of the proposed recommendations (alternatives) should enhance PVNGS Electrical distribution system, reliability and provide a major contribution to the minimization of complicated reactor trips and natural circulation events.

Action Plan The APS proposed action plan is to implement the recommended alternatives as detailed in their respective sections of this report and outlined in the above conclusion The Action Plan implementation schedule is summarized in figure 3 (ACTIONPLAN SCHEDUL'E).

37

Cl

~li

3 ACTIONPLAN SCHEDULE TASKlACTIONS REQUIRED Electrical Distribution System Alignment Alternatives Revise operating proceedures to specify operation of two RCPs on UATwith the other two on SUT power SSO and Gen. back-up distance relay initiated FDT modification restart next scheduled refueling Integrated system (inc. RPCS & SBCS) study and design enliancernent subsequent refeuling SSO Relay Systcn> inodifications Mod to initiate FBT on SSO actuation next scheduled refueling Digital fault recorder addition to SSO relays restart Rcfcrence circuit modification to SSO system restart Electrical Distribtition System Preventa-tive bl:tintenance restart

URE 3

ACTIONPLANSCHEDULE TASK/ ACTIONS REQUIRED Functional Criteria a) Cleaning of high voltage bushings, insulators and arrestors restart b) Lubrication and cycling ofFBT breakers restart c) XFMR oil sample evaluation d) Oil tilled XFMR leakage checks restart restart e) lvlain XFb IR dehydrating breather filter check restart f) Service testing of non-IE Battery System restart

0 0

0

TABLE)

PYNGS REACTOR TRIP EYENTS Event Date LER Unit Number LER Title Reactor Mode Power (%)

Natural FBT Circulation Occurred 03/12/85 1

528-85-012-00 Erroneous. Actuation of Low Steam Gen-erator Pressure Reactor Trip 0

Note 1

03/21/85 1

528-85-009-00 Inadvertent Reactor Trip 0

Note 1

06/14/85 07/01/85 07/17/85 528-85-019-01 I

528-85-043-00 I

528-85-049-01 Reactor Trip Reactor Trip on High Pressurizer Pressure inadvertent Reactor Protection System Actuation 19 43 Note 2 Note 2 Note 2 09/12/85 I

10/03/85 I

10/07/85 I

10/24/85 I

528-85-071-00 Reactor Trip Initiated by Load Rejection Test From 80% Power 528-85-063-01 Reactor Trip During Load Rejection Test 528-85-058-00 Reactor Trip Due to Loss of Offsite Power 528-85-076-00 Reactor Trip Due to Loss of Offsite Power 53 52 0

81 2 hr 19 min Note 3 3 hr 34 min Note 1

0 hr 44 min Note 1

Note 1 12/04/85 I

12/16/85 I

12.'20/85 1

01/09/86 I

i 528-85-088.01 528-85-090-00 528-85.080-00 528-86-006.00 Reactor Trip Due to Defective Phase Syn-chronizing Card Unit 1 Reactor Trip Initiated by Feedwater Anomaly at Low Power Reactor Trip Due to Out-of-Tolerance Set-point in Turbine Demand Runback Module Reactor Trip Caused When a Synchroniza-tion Check Blocked the Transfer of Non-Essential Loads During Testing 40 1

~

100 Note 2 Note 1

Note 2 0 hr 43 min Note 3

TABLE )

(Continued)

PVNGS REACTOR TRIP EVENTS Event Date LER Unit Number LER Title Reactor Natural FBT

.Mode

..Power (%)

Circulation Occurred 02/03/86 1

02I07/86 1'28-86-020-01 Reactor Trip Initiated by Feedwater Anom-aly 528-86-024-00 Reactor Trip Due to Low SteamiGenera-

~

tor Level 60 18 Note 2 Note 1

03/07/86 1

04/04/86 2

05/25/86 2

528-86-018-00 Reactor Trip on Low Steam Generator 1

Level Due to Feedwater Pump 529.86-015.00 Reactor Protection System. Actuation in 3

Response

to Loss of Seal injection Flow 529-86-025.00 Reactor Trip Due to Low Steam Genera-tor Level, with Main Steam Isolation Sig-nal, Safety Injection Actuation Signal, and Containment isolation Actuation Signal Actuation s 18

'5 Note 1 Note 2 Note 1

Q5/31/86 2

06/ I0/86 2

06/17/86 I

07/1 2/86 I

07/25'6 2

529-86.027-00 529-86-034-OQ 528-86-042-00 528-86-047-00 529-86.047-00 Reactor Trip Caused by.Improper Posi-tioning of Steam Bypass Control System Reactor Trip Initiated by an Unanticipated Turbine T/ip Low Departure From Nucleate Boiling Ra-tio Reactor Trip Due to CEA Misalignment Too Conservative Low Reactor Coolant 1

Flow Trip Setpoints Cause Reactor Trip invalid Ffoating Point Fault in Core Pro-1 tection Calculator Causes Reactor Trip 41 100 100 50 Note 1 Note 1 Note 1

1 hr 23 min Note 1

Note 1

TABLE 1 (Continued)

PVNGS REACTOR TRIP EVENTS t" y

~

t

~

Event Date LER Unit Number LER Title Reactor Natural FBT Mode Power (%)

Circulation Occurred 08/06/86 528-86-003-00 Reactor Trips and Engineered Safety Fea-1 ture Actuation System Actuations Due to Loss of Power 100 Note 1 08/06/86 2

528-86-003-00 Reactor Trips and Engineered Safety Fea-ture Actuation System Actuations Due to Loss of Power 1 ---.-

7 Note 1

08/15/86 1

08/25/86 2

08/28/86 2

08/30/86 1

09/02/86 1

09/11/86 1

09/11/86 2

09/23'86 528-86-045-00 529-86-026-00 529-86-033-00 528-86-033-00 528-86-044-00 528-86-053-00 529.86-017-00

'29-86.049-00 Reactor Trip fnitiated by Manual Genera-tor Trip Reactor Trip initiated by Main Turbfne Generator Trip incorrect Wiring in Generator Results in Reactor Trip Reactor Trip Due to Spurious Low Reac-tor Coolant Flow Trip Reactor Trip Due to Spurious Low Reac-tor Coolant Flow Signals Maintenance Activity on Circuit Card Re-sults in Reactor Trip Reactor Trip Initiation by Reactor Protec-tion System Roactor Trip Due to Low Steam Genera-tor Level Accompanied by Auxiliary Feed-water Actuation Signal 50 80 80 100 100 100 99 40 Yes Note 1

Note 1 Yes Yes Yes Yes Note 1

TABLE 1 (Continued)

PVNGS REACTOR TRIP EVENTS

\\

~

C Event Date LER Unit Number LER Title Reactor Natural FBT Mode Power (%)

Circulation Occurred 10/06/86 1

528-86-056-00 Reactor Trip Due to Excessive Reactor 1

Coolant System Coo!down 24 Note 1

11/I 9/86 1

528-86-061-00 Reactor Trip Followed by Entry Into Tech-1 nical Specification Limiling Condition of Operation 3.0.3 Due to an Inoperable Main Steam Isolation Valve 100 Note 1

12/24/86 2

=-

529-86-023-01 Ot/1 0/87 I

528-87-003-00 04/16/87 2

529.87-004-00 Reactor Trip initiated by Loss of Power to the Plant Protection System Operator, Error During Feedwater Tran-sient Results in a Reactor Trip Reactor Trip While Performing Ground 1

Isolation Due to Inadequate Information 100 40 100 Note 1 Note 1

Note 2 05/30/87 1

06/04/87 2

08/27/87 1

528-87-014-00 529-87-010-00 528-87-018-01 Reactor Trip During Main Feed Pump Tur-bine Testing Due to a Failed LimitSwitch A Reactor Trip Occurred Due to a Malfunc-1 tion in the Feedwater Control System Reactor Trip Occurs During Shutdown 1

Due to Pressure Boundary Leakage 100 100 Yes Note 1

Note 1 11/22i87 2

529-87-019-00 Reactor Trip Occurs During Startup Due 1

to Axial Shape Index Out-of-Bounds 7

Note 1 1 2!17/87 3

530.87-004-00 Reactor Trip Occurs Due to Control Ele-1 ment Assembly Subgroup Deviation 50 Note 1

1

'0 0

TABLE 1 (Cohtinued)

PVNGS REACTOR TRIP EVENTS" '

~

4 g

C.

+r

~

Event Date LER Unit Number LER Title Reactor Natural.

FBT Mode Power (%)

Circulation Occurred 04/1 9/88 1

528-88-011-00 Reactor Trip Due to Personnel Error and 1

Equipment Malfunction 100 Yes 05/12/88 1

05/1 4/88 1

528-88-015-00 528-88-016-01 Reactor Trip Due to Test Power Supply Failure Reactor Trip Following Earlier Than Antici-pated Criticality 3

91 Note 2 Note 1 07/06/88 l

08/21/88 1

528-88-010-00 528-88-021-00 Ground Fault in 13.8-kV Bus Causes Fire 1

in Unit Auxiliary Transformer and Reactor Trip Reactor Trip Due to High Pressurizer 1

Pressure 100 75 12 hr 25 min Note 3 Note 2 528-88-024-00 Reactor Trip Due to Low Steam Genera-tor Level tor Level 08/27/88 l

11/1 6/88 I

2 529-88-014-00 Reactor Trip Due to Low Steam Genera-1 12 10 Note1 Note 1 02/1 6/89 2

529-89-003-00 Reactor Trip Due to Low Steam Genera-1 tor Level 100.

Note 2 03/03/89 3

530-89-001-00 Reactor Trip Due to Low Steam Genera-tor Level 98 3 hr 42 min Note 3 03/05/89 528-89.004-00 Reactor Trip Due to Control Element As-1 sembly Calculator Failure 100 Note 4

TABLE 1 (Continued)

PVNGS REACTOR TRIP EVENTS NOTES'ote 1 House loads powered from Startup Transformer(s); no fast bus transfer attempt made.

Note 2 Specific electrical distribution system alignment has not been determined through review of Licensee Event Report and post-trip review documentation.

Had house loads been powered from the Unit Auxiliary Transformer, however, fast bus transfer must have worked.

(If fast bus transfer did not work when called upon to do so, the event would be reported as a natural circulation cooldown event.)

Note 3 Fast bus transfer could not be achieved because of frequency and/or voltage mismatches.

Note 4 - Fasl bus transfer of bus NAN-S01 was successful; NAN-S02 did not fast transfer because its feeder breaker from the UAT did not trip.

LER 50-528/89-004-00 does not provide a definitive root cause for the breaker failing to trip.

IJote 5 PYNGS Operational Modes are defined as follows:

Morle t.

Power Operation 2.

Startup 3.

Hot Standby Hot Shutdown

~Reacliva ik

<~)

> 0.99

< 0.99

6. Relueling"

< 0.99 5.

Cold Shutdown

< 0.99

> 5'/o

< 5%

0'/o 0%

0'/

0%

>350 F

350 F > T ld > 210 F

< 210'F

< 135 'F

% Rated Thermal Power'CS Cold L'e Tem erature

'xcluding decay heat

- Fuel in the reactor vessel with the vessel head closure bolts less than fully tensioned or wilh the head removed.

PAGE 77 IIR 2-3-89-001-EVENT DATE: MARCH3, 1989 UNIT3 REACTOR TRIP FOLLOWINGLARGE LOAD E EJECTION ISSUE 88 (cont'd)

9) 'he loss ofinstrumentation delayed recognition of increased leakage from the RCP seal and CHV-435 (due to a failure of the furmanite repair) until power was restored to the indicators.

10)

The operators performed appropriately in not cross-connecting Nuclear Cooling Water (NC) and Essential Cooling IVater.(EW) systems.

This would have rendered EW inoperable and may have resulted in the loss of EW.

CORRECTIVE ACTIONS CORRECTIVE ACTION 8. 1 Implement the Engineering Action Plant recommended corrective actions.

a) WO 0338162 - Rework CHV-435 Flange/gasket leak b) XVO 0346503 - Inspect RCP 1B seals per 31iVTT-9RC26 c) WO 0316360, 316361, 316362. 316363 - Inspect RCP journal bearings as necessary and replace seal cartridges on all 4 RCPs as originally planned during the refueling outage.

d) Conduct a design review or develop and implement a procedure to test CHA-HV-507, seal bleedoff isolation valve, to ensure it willperform as designed, including under a loss of Instrument Airconditions.

- -"RESPONSIBLE ORGANIZATION a) Unit 3 Work Control, C. D. Churchman b) Unit 3 Work Control, C. D. Churchman c) Unit 3 Work Control. C. D. Churchman d) NSSS - EED, G. Waldrep/G. Sowers MODE RESTRAINT/DUE DATE a) Unit 1 and Unit 3 - Mode 4/Following Refueling Outage b) Unit 1 and Unit 3 - Mode 4/Following Refueling Outage

" c) Unit 1 and Unit 3 - Mode 4/Following Refueling Outage d) Unit 2-Mode 4.

CORRECTIVE ACTION 8.2 Evaluate significance of RCP-2A high pressure cooler inlet high temperature condition for root cause of failure determination and for any inspection and/oi'ework requirements.

(EER 89-RC-038)

. RESPONSIBLE ORGANIZATION NSSS - EED, G. Waldrep/G. Sowers 4

MODE RESTRAINT/DUE DATE NONE/30 days followingreport approval

0

PAGE 78 IIR 2-3-89-001 EVENT DATE: MARCH 3, 1989 UNIT 3 REACTOR TRIP FOLLOWINGLARGE LOADRF~CTION ISSUE ¹8 (cont'd)

CORRECTIVE ACTION 8.3 Perform an evaluation (e.g. risk-based analysis) on a design change to automatically protect the RCP seals on a loss of non-class power (EER 89-RC'-023)

RESPONSIBLE, ORGANIZATION Mechanical - NED, M. Hodges/E. C. Sterling

,MODE RESTBAZNT/DUE DATE NONE/90 days followingreport approval CORRECTIVE ACTION8.4 Perform a HPES evaluation to address the operator action in securing seal bleedoff with seal in)ection still being supplied.

RESPONSIBLE ORGANIZATION STA-PS&C, M. L. Clyde/R. Younger MODE RESTXUZNT/DUE DATE NONE/90 days followingreport approva1 CORRECTIVE ACTION'.5 Implement DCP 3FE-RD-037 during this refueling outage, to provide, reliable power to the containment sump level indicators.

f RESPONSIBLE ORGANIZATION Unit 3 Work Control, C. D. Churchman MODE RESTEUIZNT/DUE DATE Complete CORRECTIVE ACTION8.6 Initiate a design change (PCR or Site Mod) for a reliable power supply to the containment temperature and humidity recorders.

RESPONSIBLE ORGANIZATION I & C - EED, J. Summy/G. Sowers MODE RESTRAINT/DUE DATE

.NONE/90 days following report approval

PAGE 79 IIR 2-3-89-001 EVENT DATE: MARCH3. 1989 UNIT3 REACTOR TRIP FOLLOWINGLARGE LOADREACTION ISSUE 88 (cont'd)

CORRECTIVE ACTION8.7 Plant Management shall re-evaluate the use of Furmanite for primary system leaks.

RESPONSIBLE ORGANIZATION Plant Director, %'. C. Marsh MODE RESTRAINT/DUE DATE Mode 2-U-l, U-2, U-3

PAGE 80 IIR 2-3-89-001

. EVENT DATE: MARCH 3, 1989 UNIT3 REACTOR TRIP FOLLOWINGLARGE LOADRFM'TION ISSUE 89 - POTENTIALMBtIANPERFORMANCE DEFICIENCIES DURING POST-TRIP RESPONSE BYRADIATIONPROTECTION CHEMISTRYTECHNICIANS

Background

During the course ofthe event on 3/3/89. a loss of non-class power occurred. This resulted in an inabilityto use normal methods to assess plant conditions. This was particularly important when it became necessary to complete the post-trip tasks assigned to Radiation Protection and Chemistry.

The actions of the Radiation Protection and Chemistry Technicians were analyzed by the Incident Investigation Team.

One inappropriate action was identified. However, the investigators uncovered several items which led to difficulties in the performance of the assigned tasks. Itshould be noted that the Chemistry and Radiation Protection Technicians were able to successfully overcome these difficulties and correctly complete all requirements with the excepuon of the calculation of the off-site dose assessment.

ACTIONPLAN Engineering Action Plan:

None Interviews and Personnel Statements The followingin'dividuals were contacted in the course of this investigation:

I), Operations Crew Members

2) Radiation Protection Technicians Techniques Utilized:

3) Supervisor of Chemistry Standards

4) Lead Site Emergency Planner Human Performance Evaluation (HPES) techniques were utilized to evaluate the identified inappropriate action and difficulties encountered by the Technicians

ik~

PAGE 81 IIR 2-3-89-001 EVENT DATE: MARCH3, 1989 UNIT3 REACTOR TRIP FOLLOWINGLARGE LOAD REJECTION s

ISSUE ¹9 (cont'd)

REFERENCES 1)

EPIP-14. Dose Assessment.

2)

DCP 3FE-SQ-058-Reliable Power to Unit 3 RMS mini-computer.

3)

WO 304785-DCP 3FE-SQ-058 implementation.

4)

WO 317270- DCP 3FE-SQ-058 implementation.

5)

WO 317273-DCP 3FE-SQ-058 implementation.

6)

DCP 1 FE-SQ-058-Reliable Power to Unit 1 RMS mini-computer.

7)

WO 284976-DCP 1 FE-SQ-058 implementation.

8)

Memo M. R. Oren to G. W. Sowers, March 14. 1989. IIR 2-3-89-001 Issues. 9101-00432 MRO/MLC.

9).. Memo T. D. Shriver to W. F. Quinn. NRC AITPrelimin Exit Meetin, March 12, 1989, ¹102-01161-TDS/RLMC.

10)

Memo M. R. Oren to W. C. Marsh, dated March 21. 1989, Dose Caicuiation Concern-Unit 3 Investigation: 2-3-89-001.

¹ 101-00437-MVL/MRO 11)

Memo T. J. Warren to P. W. Hughes

. Dated March 23, 1989. ~Meetin with NRC on March 23 1989.

¹237-00160-TJW/JBC.

RESOLUTION/ANALYSIS The HPES evaluation identified the following causal factors which contributed to the following:

1.)

The incorrect calculation of off-site dose assessment 2.)

The difficulties encountered by the Technicians in the performance of their post-trip tasks:

VERBALCOMMlJNICATION 1.) The information exchange between the RP Technician in the STSC and the Control Room Staff was less than adequate.

The RP technician based his initial calculation on a steam release through the Atmospheric Dump Valves.

The. actual release was through one Main Steam Safety Valve (The default value per EPIP-14.

Appendix B, for flow through a MSSV, 2.39 curies/sec, is larger than the default valve for flow through an ADV. 0.0387 curies/sec.

due to highly conservative assumptions used in the Safety Analysis.

No attempt to verify the actual release path was made.

The RP

0 il 0

PAGE 82 IIR 2-3-89-001 EVENT DATE: MARCH 3, 1989 UNIT3 REACTOR TRIP FOLLOWINGLARGE LOADREHECTION, ISSUE ¹9 (cont'd)

RESOLUTION/ANALYSIS 2.

Technician utilized the ADVs as the release path based on conversations overheard in the Control Room. XVhen the RP Technician reported to the Control Room. he did not receive any specific plant data related to release paths from the Emergency Coordinator. The RP Technician did not communicate the conservative assumptions (i. e. 1% failed fuel, 1 ruptured Steam Generator tube, and a stuck open Main Steam Safety for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ) utilized in his manual calculation per EPIP-14.

This communication is important because the Emergency, Coordinator is tasked with making the appropriate Protective Action Recommendations (PARs) to offsite organizations based on actual plant conditions and recommendations of the RP Technician.

) The Chemistry Technicians did not receive any plant specific information from the Control Room because the Chemistry Technicians did not.go to the Control Room. They believed, based on past e~eriences, that they would not be able to "get in", This

'aused the Chemistry Technicians to p'erform tasks which were not required (e.g. sampling main condenser air removal exhaust followingthe Main Steam Isolation).

WRITTEN COIUQEUNICATION 1.) EPIP-14 (CALCULATIONOF OFFSITE DOSE ASSESSMENT) contains a step which causes the performer to complete an Appendix which is not required when using default values.,This can lead to an incorrect solution. In this case, this did not cause an incorrect calculation because this step was omitted. It should be noted that had EPIP-14 been completed as written using the specified conservative default values for failed fuel. steam generator leakage, and a stuck open safety, Protective Action Recommendations (PABs) consistent with a General Emergency would have been derived. This would have been inappropriate since no actual release was in progress and the actual plant conditions supported no Protective Action Recommendations.

2.) The Chemistry Technicians had several post-trip tasks to complete.

The required tasks are contained in parts of several procedures which are not adequately cross-referenced.

There is no method to ensure that all required tasks are completed in the appropriate time frame. In this event. the Chemistry Technicians were able to identify and complete all required tasks but the potential exists for important tasks to be omitted in future events.

Some of these tasks are required for regulatory compliance with the plant Technical Specifications but there is no central procedure <<

ensure these are performed.

lit 0

PAGE 83 IIR 2-3-89-001 EVENT DATE: MARCH3, 1989 UNIT3 REACTOR TRIP FOLLO~G LARGE LOAD REJECTION ISSUE ¹9 (cont'd)

RESOLUTION/ANALYSIS(continued)

INTERFACE DESIGN OR E UIPMENT CONDITION

) The Mesorem and RMS mini-computer both lost power as a result of the initiating event. This was a major causal factor in the incorrect calculation of the off-site dose calculation.

ADesign Change Package (DCP 3FE-SQ-058) had been approved to provide a class 1E power source to the RMS mini-computer.

However. this modification had not been fullyimplemented in Unit 3 and is scheduled for the current refueling outage.

The unavailability of actual radiation readings for the plant effluent monitors made it necessary to utilize conservative default values in the offsite dose assessment.

The MESOREM program for calculating off-site dose assessment is kept on the IBMPC in the Satellite Technical Support Center (STSC).

Power to the computer is provided by a non-class 120 VAC source which was unavailable due to the initiating event. The capability to utilize the preferred method for calculating offsite dose (MESOREM) was not available necessitating the use of the manual calculation per EPIP-14.

EPIP-14 is adequate for off-site dose assessment.

Had the RMS values been available. a Protective Action Recommendation consistent with plant conditions would be calculated assuming the

. procedure was completed correctly.

2.) Atthe time of the event, RU-141 (Condenser AirRemoval Exhaust Monitor) was inoperable.

The auxiliary sample cart was in service as required by Technical Specifications.

The au~liary sample cart is powered via an eMension cord to a non-class receptacle.

When non-class power was lost. the ability to monitor the air removal'xhaust was also lost. The Chemistry Technician obtained a portable generator to power the auxiliary sample cart but could not get the generator started.

The generator was in-place and compatible with the sample cart. however, it was not a design requirement to have the cart available.

The loss of capability to sample the air removal exhaust was not consequential in this event due to the MSIS isolating this release path via the condenser.

However. for other events. such as a Steam Generator Tube Rupture coincident with a Loss of Power (LOP), the ability to monitor air removal exhaust is important to ensure offsite dose commitments are satisfied.

PCR 88-13-ZZ-008 was submitted in April 1988 to change the auxiliary sample cart receptacle to a class power supply.

0 II'

PAGE 84 IIR 2-3-89-001 EVENT DATE: MARCH3, 1989 UNIT3 REACTOR TRIP FOLLOWINGLARGE LOAD RFM CTION ISSUE 09 (cont'd)

RESOLUTION/ANALYSIS(continued)

ENVIRONMENTALCONDITIONS 1.) The lighting in the area of the Post Accident Monitoring Unit (PAMU) contributed to the inabilityof a Radiation Protection Technician to obtain actual Main Steam Line Monitor readings.

The Technician unsuccessfully attempted to locate a Kaman Electronic Portable Indicating Controller (KEPIC) in a storage box utilizing a flashlight. These readings are critical to performing a realistic off-site dose calculation. The lack ofthis information resulted in the use of conservative default values in the EPIP-14 calculation.

2.) The Chemistry Technician reported that the Hot and Cold chemistry labs were dark initiallyafter the event.

Essential Lightingwas restored with the re-energization of D90 and D91. Additionally, the chemistry lab instrumentation was lost until D90 and D91 was restored.

The Chemistry Technicians

. were able to complete all required sampling following the restoration of power to M-19 and M-20.

- WORE PRACTICES 1.) The failure of the RP Technician to utilize effective work practices was the primary causal factor involved in the incorrect off-site dose calculation.

Several math errors were made and not caught by the Technician prior to communicating the Protective Action Recommendations to the Emergency Coordinator. The Technician did not correctly followthe steps contained in EPIP-14.

The combination ofmath errors and procedure non-compliance resulted in an incorrect calculated 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months child thyroid dose at the site boundary.

As mentioned above, had the calculation been performed correctly utilizingthe required default values, PARs consistent with a General Emergency would have resulted.

2.) Not applicable TRAININGMETHODS CONTENT 1.) The Radiation Protection Technicians are required to receive annual training in off-site dose assessment and the use of EPIP-14.

This is accomplished in a General Training Course.

The individual involved had successfully completed this course in August 1988. A review of the course content and objectives was performed by the Investigation Team. The course adequately covers methodology'nd required background information to successfully complete an off-site dose assessment utilizing either the MESOREM or EPIP-14.

The Technicians are instructed that it is necessary to complete the

PAGE 85 IIR 2-3-89-001 EVENT DATE: MARCH 3, 1989 UNIT3 REACTOR TRIP FOLLOWINGLARGE LOAD RIM'ECTION ISSUE 09 (cont'd)

TEEING METHODS CONTENT (continued) assessment within 15 minutes. A review of applicable references was performed by the Investigation Team and it is unclear whether it is necessary to complete the calculations within 15 minutes.

The perception by the technician that the calculation had to be completed in 15 minutes and the length oftime since he had performed EPIP-14 contributed to the incorrect calculation.

2.) Not applicable CORRECTIVE ACTION 9. 1 Ensure that DCP 3FE-SQ-058 is installed by implementation ofWOs 304785. 317270 and 317273. (Reliable Power to Unit 3 RMS mini-computer).

RESPONSIBLE ORGANIZATION Unit 3 Work Control, C. Churchman (Unit 3 Nuclear Construction. WO 304785)

(Unit 3 Electrical Maintenance, WO 317270, 317273)

MODE RESTRAINT/DUE DATE Mode 4 followingUnit 3 first refueling CORRECTIVE ACTION9.2 Ensure that DCP 1FE-SQ-058 is installed by implementation ofWOs 284976. (Reliable Power to Unit 1 RMS mini-computer).

.. RESPONSIBLE ORGANIZATION Unit 1 Work Control, J. Dennis (Unit 1 Nuclear Construction - WO 284976)

MODE RESTRAINT/DUE DATE Mode 4 followingUnit 1 second refueling CORRECTIVE ACTION 9.3 Provide an uninterruptible power supply with a capacity of at least 1

hour duration for the MESOREM computer in the STSC.

RESPONSIBLE ORGANIZATION Emergency Planning, H. Bieling MODE RESTRAINT/DUE DATE U-1 Mode 2 U-2 Mode 2 U-3 Mode 2

PAGE 86 IIR 2-3-89-001 EVENT DATE: MARCH 3, 1989 UNIT3 REACTOR TRIP FOLLOWINGLARGE LOAD RP~CTION ISSUE ¹9 (cont'd)

CORRECTIVE ACTION 9.4 Change EPIP-14 to include the following provisions in the event that manual default values have to be used a)

Direct that field radiation level measurements be immediately obtained, ifusing default values for Dose Assessment calculations.

b)

To direct the EPIP-14 performer to advise the Emergency Coordinator that value obtained are based on:

1) 1% failed fuel condition

2) A 400 gpm primary to secondary. leak

3) A MSSV is 'fullyopen'and has been" or willbe open for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months t

c)

Review EPIP-14 for any deficiencies or enhancements.

e RESPONSIBLE ORGANIZATION Emergency Planning, H. Bieling MODE RESTRAINT/DUE DATE a) Mode 2 b) Mode 2 c) Mode 2 CORRECTIVE ACTION 9.5 a)

Implement a Job Performance Measure (JPM) for RP Technicians to perform EPIP-14 manual calculations under a variety of scenarios.

Training Department to develop JPM and train selected Lead RP Technicians in use ofJPMs to monitor and document performance by the individual Technicians.

b)

The Training Department Management Action Center will evaluate EPIP-14 and conduct an assessment of the adequacy of continuing training on EPIP-14.

Implement the appropriate recommendations.

RESPONSIBLE ORGANIZATION Training Department. W. Fernow MODE RESTRAINT/DUE'ATE a) Mode 2 - U-l. U-2, U-3 b) NONE/within 90 days followingreport approval

PAGE 87 IIR 2-3-89-001 EVENT DATE: MARCH 3, 1989 UNIT 3 REACTOR TRIP FOLLOWINGLARGE LOAD REJECTION ISSUE ¹9 (cont'd)

CORRECTIVE ACTION9.6 Evaluate the creation of a procedure to address post-trip response for Chemistrv Technicians (ICR "08532 submitted).

/'ESPONSIBLE ORGANIZATION Chemistry Standards, J. Cederquist MODE RESTRAINT/DUE DATE NONE/60 days followingreport approval CORRECTIVE ACTION 9.7 Initiate and complete the design change proposed in PCR 88-13-ZZ-008 (class power to effiuent monitor au~liary sample

'carts)

RESPONSIBLE ORGANIZATION EED. G. Sowers MODE RESTRAINT/DUE DATE NONE/180 days followingreport approval CORRECTIVE ACTION 9.8 Review and modify, as appropriate, the training course for Emergency Coordinators and RP Dose Assessment Technicians in relation to the human performance deficiencies identified in this report.

RESPONSIBLE ORGANIZATION Training, W. F. Fernow MODE RESTRAINT/DUE DATE NONE/60 days followingreport approval CORRECTIVE ACTION9.9 Evaluate the 15 minute requirement for generation of PARs to determine ifan actual off-site dose calculation is required or can be based on the. default NUE-PARs until radiation level measurements are available; Update E-Plan Procedures accordingly based on the evaluation.

RESPONSIBLE ORGANIZATION Emergency Planning, H. Bieling MODE RESTEVGNT/DUE DATE NONI./60 days following report approval

Il

PAGE 88 1

IIR 2-3-89-'001 EVENT DATE: MARCH3, 1989 UNIT3 REACTOR TRIP FOLLOWINGLARGE LOAD REJECTION I

i.

ISSUE N9 (conk',d)

CORRECTIVE ACTION9. 10 Review requirements for Control Room Access with Chemistrv Personnel stressing that the Lead or Acting Lead Chemistry technician is part of the on-shift team and is allowed into the Control Room when it is necessary to communicate pertinent information to the Shift Supervisor.

RESPONSIBLE ORGANIZATION Unit Chemistry Managers, D. Fuller U-I R. Ferro U-2 J. Scott U-3 MODE RESTRAINT/DUE DATE Mode 2 - U-l, U-2, U-3 CORRECTIVE ACTION 9. 1 1 Review Emergency/Essential lighting requirements and design for the chemistry labs and area around the PAMU to ensure adequate lighting exists to support required post trip analyses.

',RESPONSIBLE ORGANIZATION Electrical - NED, J. Barrow/E.,C. Sterling MODE RESTRAINT/DUE DATE NONE/120 days followingreport approval

PAGE 89 IIR 2-3-89-001 EVENT DATE: MARCH 3, 1989 UNIT3 REACTOR TRIP FOLLOWINGLARGE LOAD REJECTION ISSUE ¹10 - MISCELLANEOUS E UIPMENT ISSUES During this event other equipment abnormalities occurred.

These and other equipment issues identified during the invesugauon are listed in this section.

/

Each issue is listed along with a descrip'tion of the abnormality. When appropriate, a follow-up document or due date is also included.

Item 10.1 SGE-PSV-579 actuated at a pressure lower than its design setpoint.

CONCLUSION Main steam Safety Valve SGE-PSV-579 cycled several times. Itwas observed by a Control Room operator to be liftingat about 31 psi below its nominal setpoint of 1250 psig (+/- 1%). The PMS Alarm Typer recorded the Main Steam Safety Valve liftingon 4 occasions.

CORRECTIVE ACTION EED - BOP, K Johnson/G. W. Sowers has initiated an action plan to

.- troubleshoot the valve. The valve was removed and shipped to a test facilityfor evaluation and rework per WO 346108.

MODE RESTRAINT/DUE DATE Unit 3 - Mode 2 Item 10.2 The ¹1 Steam Generator Downcomer Isolation Valve (SGA-UV-172) would not open from the Control Room.

CONCLUSION SGA-UV-172 failed to open due to an apparent equipment malfunction.

This failure prevented use of the non-essential auxiliary feedwater puInp.

CORRECTIVE ACTION EED - BOP K Johnson/G.

W. Sowers willevaluate and generate the appropriate follow-up document. (per memo 101-00432-MRO/MLC of3/19/89)

MODE RESTRAINT/DUE DATE NONE/Within 30 days of report approval

PAGE 90 IIR 2-3-89-001 EVENT DATE: MARCH3, 1989 UNIT 3 REACTOR TRIP FOLLOWINGLARGE LOAD XKUECTION ISSUE 810 (cont'd)

MISCELLANEOUSEQUIPMENT ISSUES (continued)

Item 10.3 SGE-UV-169 (01 Steam Generator MSIVBypass) was manuaLLy opened ajar it was unable to be opened from the ControL Boom CONCLUSION The MSIVbypass did not open in override from the Control Room.

The. valve was subsequently opened manually. Contrary to procedure, the attempt to open the valve remotely and the local operation of the valve was done with the downstream throttle valve open vice closed.

The. purpose of the throttle valve is 'to allow for controlled warming of the steam lines not possible using the MSIVbypass valve alone. The bypass;valve is designed to open with fullsystemIdifferential pressure across it. Closing the throttle valve first willnot reduce that differential pressure; henc'e. the procedural violation had no impact on the bypass valve failing to open remotely.

The manual operator was broken followingthe event. An evaluation will

.be performed.

'ORRECTIVE ACTION 1)

EED - BOP K Johnson/G. W. Sowers willevaluate and generate the appropriate follow-up document. (per memo 101-00432-MRO/MLC of3/19/89).

2)

Inappropriate operator action addressed in Issue 011

~ 3)

Complete EER 89-SG-131 MODE RESTZUZNT/DUE DATE 1)

NONE/Within 30 days ofreport approval 3)

NONE/Within 90 days ofreport approval Item 10.4 Normal Chillers A and B tripped when normaL chiller C

. started when NBN-S02 was energized.

CONCLUSION NormaL Chiller C (WCN-E01C) automatically restarted when NBN-S02 was reenergized.

The resulting chilled water system perturbation caused normal chillers A and B to trip on low cooling water flow. The automatic restart of Normal Chiller C was a proper operation of the chiller controls. The trip of the A and B Normal Chillers is representative of a known problem. This problem is being addressed.

by EER 89-WC-002.

CORRECTIVE ACTION No additional actions required.

i IS

PAGE 91 IIR 2-3-89-001 EVENT DATE: ASARCH 3, 1989 UNIT3 REACTOR TRIP FOLLOWINGLARGE LOAD REJECTION ISSUE 810 (cont'd)

Item 10.5 The Coritrol Room handswitch forRCP 2B had to:be tMen to "stop" tu:ice to secure the pump.

CONCLUSIO¹ The Primary,Operator stated that he had to take the handswitch to stop twice to secure the pump. An analysis of the Unit Digital Fault Recorder trends by Engineering Evaluations - Electrical showed that the RCP 2B trip coil was energized hvice before the pump's circuit breaker opened.

Engineering-Electrical has initiated a troubleshooting action plan to analyze this occurrence. The most likelycause is due to sticking or misalignment of the. armature eMension shaft of the breaker 3ENANS02M. Lack oflubrication on the trip shaft could have contributed to the problem.

A review of maintdnance history shows no corrective maintenance has been performed on this breaker. 32ST-9ZZ06 was last performed on 7/14/87. This ST is performed on a 60 month cycle. Presently, there is no PM task for this breaker.

CORRECTIVE ACTION

-'1)

Unit 3 XVork Control - C. D. Churchman Perform 32MT-9ZZ29 on breaker 3ENANS02M, which includes the trip latch and trip coil armature inspection'and adjustment.

WR0 341326 was initiated to perform this. Perform adjustments, lubricate and/or do corrective maintenance, perform minimum pick-up voltage test for the trip and closing coil and functionally test, the breaker per 32ST-9ZZ06.

2)

PS&C - R. E. Younger Initiate PM task to inspect/test all RCP breakers per 32MT-9ZZ29.

MODE RESTRAINT/DUE DATE

1) Unit 3 - Mode 4 2)

Mode 4-U-l, U-2, U-3 Item 10.6 A circulating water pump discharge valve did notfullyclose following the restoration ofpower.

CONCLUSION Control Room and auxiliary operators reported that C~VN-HV-008 discharge valve for Circulating IVater Pump D. did not fullyclose when power was restored to the valve. The valve was later fullyclosed manually.

CORRECTIVE ACTION Unit 3 Work Control - C. D. Churchman

%0 0348434 was generated by on-shift personnel to troubleshoot and

1 PAGE 92 IIR 2-3-89-001 EVENT DATE: MARCH 3, 1989 UNIT3 REACTOR TRIP FOLLOWINGLARGE LOAD~UECTION ISSUE ¹10 (cont'd)

Item 10.6 rework the problem via the normal work control process.

This was a previously noted problem and the valves are scheduled to be replaced during the Unit 3 outage.

MODE RESTMZNT/DUE DATE Unit 3 - Mode 2 Restraint N

Item 10.7'lT check valve leakage alarms and B02 pressurizer pressure recorder indicate cold leg injection occurred.

CONCLUSION These conditions are normal for SIAS actuation.

Engineering Evaluation-Mechanical NSSS confirmed that these alarms are normal for HPSI pumps runmng and injection valves open, and that injection into

, the RCS is assumed to have occurred on any SIAS actuation initiated by

, low pressurizer pressure.

A pressure of 2250 was noted when the condition alarmed.

This was most probably due to leakage of the

-:"first-off'CS check valve. The leakage of the check valves was

.. subsequently verifie to meet the check valves leakage surveillance requirements.

CORRECTIVE ACTION No corrective actions are required.

Item 10.8 When 'B'harging Pump was restarted, a high seal mater pressure alarm was received with seal pressure locally

.. venjied at 12 psig.

CONCLUSION The charging pump seal pressure Hi-Lo alarm setpoints are 5 psig and 19.5 psig. The alarm was received and pressure verified to be normal locally. The 'B'harging pump seal pressure alarm should not have come in with seal pressure at 12 psig actual pressure. This did not have an impact on the Unit 3 event.

CORRECTIVE ACTION Unit 3 Work Control - C. D. Churchman WR ¹319968 was generated by the IITto troubleshoot and rework the problem via the normal work control process.

MODE RESTRAINT/DUE DATE NONE/Within 90 days of report approval

0

PAGE 94 IIR2-3-89-001 EVENT DATE MARCH 3, 1989 UNIT3 REACTOR TRIP FOLLOWINGLARGE LOADREJECTION ISSUE 810;-(cont'd)

The followingEER's were initiated by the OCS group:

89-RJ-010 - Evaluate desirability ofadding more Sequence of-Events (SOE) alarm points.

89-RJ-011 - Evaluate program priorities with software capability of only 4 alarms/second throughput.

89-RJ-012 - Evaluate hardware output (alarm typer) capacity ofonly 4 lines/second.

89-RJ-013 - Evaluate time tagging capability of PMS.

MODE RESTRAINT/DUE DATE:

NONE/Within 90 days ofreport approval.

I I'tem 10.12 There is no time synchronization be+veen various computer data acquisition systems.

CONCLUSION

'CR.83-AO-SD-001, to synchronize data acquisition systems was previously written. This item has been identified as plant betterment.

The lack. of time synchronization of independent data acquisition systems make manual synchronization of data necessary post event.

OCS has determined that implementation of this PCR would be cost

~ prohibitive and therefore willnot be pursued.

CORRECTIVE ACTION NONE. Manual synchronization is acceptable.

MODE RESTRAINT/DUE DATE N/A

'AGE 95 IIR 2-3-89-001 EVENT DATE: ibTARCH 3, 1989 UNIT3'EACTOR TRIP FOLLOWINGLARGE LOAD HEJECTION ISSUE 011 HUl~PERFORMANCE EVALUATIONSYSTEM The Human Performance issues have been tabulated on a matrLv below identifying the Behavior Shaping Factors (Causal Categories) that led to the inappropriate actions for each case.

These identified errors have been evaluated utilizing HPES techniques.

The Human Performance evaluations associated with the ADVs are addressed in Issue 05.

The Human Performance evaluation associated with the Radiation Protection and Chemistry issues are addressed in Issue C9.

The matrix conclusions are described on the following pages.

INVESTIGATIONACTIONPLAN Action Plan:

Interviews &

personnel statements:

Utilize HPES techniques to evaluate issues.

Plant Standards and Control conducted interviews with the Operations staff; Identification of the causal factors associated with human errors show the following:

" 'A. Verbal Communication RESOLUTION/ANALYSIS (MatrixError 07) Problems were encountered during reclosure of generator output breakers:

. Problems were encountered when the Control Room staff was not able to contact the Electrical System Engineer. This deficiency led them to contact a PR&C representative who may not have been fully qualified to recommend the resetting of the relay.,

CORRECTIVE ACTIONS EED to supply the Units with a current and accurate phone list of qualified Engineers and PR&C representatives.

RESPONSIBLE ORGANIZATION EED-Electrical, G. W. Sowers/L. L. Henson MODE RESTRAINT/DUE DATE Mode 2 - U-l. U-2, U-3

PAGE 96 IIR 2-3-89-001 EVENT DATE: MARCH 3. 1989 UNIT3 REACTOR TRIP FOLLOWINGLARGE LOADRF~CTION ISSUE ¹11 HUMANPERFORMANCE EVALUATIONSYSTEM (continued)

B. Written communication RESOLUTION/ANALYSIS B.l (MatrixError ¹7) Problems were encountered during reclosure of generator output breakers:

Procedure to reset "86" lockouts was less-than-adequate.

The causes for the 186G-9 relay actuation were not identified. The appendices in the "Degraded Electrical" procedure describe the. required action for resetting "86" lockouts in general which is less-than-adequate.

The existing procedure allows resetting of "86" Relays with the concurrence of the System Engineer or PR&C representative without the preferred actions performed (e.g. without inspections).

B.2 (MatrixError ¹8) The procedures which provide guidance for resetting SIAS/CIAS actuations and equipment was less-than-adequate:

The applicable procedures do not provide guidance. for performing the required Surveillance Testing after the Sl valves have been

. cycl'ed.

CORRECTIVE ACTIONS B.l'odifyDegraded Electrical Power Procedure (4XAO-XZZ12).

Appendix G, to included better and more specific guidance on resetting "86" Relays. This guidance shall be developed by EED-Electrical group. The guidance shall include the Plant's philosophy

. on resetting "86"lockouts. strict guide lines on actions required to be performed prior to resetting "86" Relays, and consequences of equipment damage for inappropriate actions.

B.2 ModifyEmergency Operator Procedure (4XEP-XZZ01) Appendix P-Resetting SIAS/CIAS and Inadvertent SIAS and/or CIAS (4XAO-XZZ28) to trigger" the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Technical. Specification requirement.

RESPONSIBLE ORGANIZATION B.l EED-Electrical. G. %V. Sowers/L. L. Benson PS&C Operations, R. E. Younger/R. E. Buzard B.2 PS&C Operations.

R. E. Younger/R. E. Buzard MODE RESTRAINT/DUE DATE B.1 Mode 2 - U-l. U-2, U-3 B.2 NONE/60 days followingreport approval

PAGE 97 IIR2-3-89-001 EVENT DATE: MARCH 3, 1989 UNIT 3 REACTOR TRIP FOLLO~G LARGE LOADIKMCTION ISSUE 011 E~iXANPERFORMANCE EVALUATIONSYSTEM (continued)

C. Work ractices RESOLUTION/ANALYSIS C.I (MatrLz Error "5) MSIVbypass valve SG-UV-169 was not operated in accordance with procedure.

(MatrixError l6) Primary Operator isolated RCP bleed-off with seal injection & loss of NCW (MatrL~ Error-57) Problems were encountered during reclosure of generator output breakers (MatrixError 88) STs for SI valves were not performed within the required 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months s:

Review'f applicable Technical Specification Surveillance Requirements was less-than-adequate.

C.2 (MatrixError 09) The. Primary Operator did not log Au~liary Spray usage as required:

Required procedures were not used by the Operators. this is less-than-adequate.

~These Human Performance errors would have been prevented ifthe appropriate procedures were used and correctly adhered to.

CORRECTIVE ACTION C.l I)

Management shall reemphasize to Plant personnel the C.2 importance of procedure use and strict adherence.

2)

Management shall provide an evaluation of the procedure preparation methodology (i.e., the Procedure Writers Guide) and determine ifadditional changes are required to improve procedure format and content.

C.2.1 Evaluate using PMS points to automatically log AuxiliarySpray temperature and Pressurizer temperature when AuxiliarySpray is used..

C.2.2 Evaluate modifying the EP and/or applicable RO procedures to include steps which require the logging of all required Au~liary Spray information.

RESPONSIBLE ORGANIZATION C. I I)

Plant Director, W. C. Marsh 2)

Plant Director, 4V. C. Marsh C.2.1 EED-Electrical. G. W. Sowers/L..L. Benson C.2.2 PS&C Operations, R. E. Younger/R. E. Buzard

PAGE 98 IIR 2-3-89-001 EVENT DATE: MARCH3, 1989 UNIT3 REACTOR TRIP FOLLOWINGLARGE LOAD REJECTION ISSUE ¹11 HKB~PERFORMIANCE EVALUATIONSYSTEM C. Work ractices (continued)

MODE RESTIUIZNT/DUEDATE C.1 1)

Mode 2 entry restraint 2)

NONE/120 days followingreport approval C.2.1 NONE/60 days followingreport approval C.2.2 NONE/60 days followingreport. approval D. Su erviso methods RESOLUTION/ANALYSIS (MatrixError ¹7) Problems were encountered during reclosure of generator output breakers:

The Control Room supervision performed inappropriately, because they reset the relay assuming that the relay "lock-out" would actuate with the Generex trips. They should have used drawings or other

- appropriate documentation which identifies the causes for the 186G-9 "lockout" actuations.

This research would have identified that the Generex trips are the only cause for this particular relay actuation. This would have eliminated the troubleshooting test which was performed and would have eliminated any assumptions made prior to the resetting of the relay.

CORRECTIVE ACTIONS Operations shall review the modifications to the Degraded Electrical Power Procedure (4XAO-XZZ12), as identified in the Written Communication's section. The Operations crew shall then adhere to the procedure and not allow or perform unnecessary troubleshooting.

RESPONSIBLE ORGANIZATION Operations, J. J. Scott, F. C. Buckingham, R. E. Gouge MODE RESTREQNT/DUE DATE Mode 2 - U-l, U-2, U-3

PAGE 99 IIR 2-3-89-001 EVENT DATE: MARCH 3, 1989 UNIT3 REACTOR TRIP FOLLO%INGLARGE LOADRE~CTION ISSUE 011 EGJ1KAI'l PERFORMANCE EVALUATIONSYSTEM (continued)

E. ~lnin ualiQcation content and methods RESOLUTION/ANALYSIS (MatrixError l7) Problems were encountered during reclosure of generator output breakers:

Training for resetting "86 lock-outs" is less-than-adequate.

Training on identifying potential consequences of inappropriate actions is less-than-adequate.

CORRECTIVE ACTION Provide training to Operations and PR&C personnel on resetting lockouts (including the consequences of resetting "86" lockouts without proper troubleshooting) per 4XAO-XZZ12, following completion of Corrective Action 11.B.l.

RESPONSIBLE ORGANIZATION Training, W. F. Fernow MODE RESTRAINT/DUE DATE

~.

Mode 2-U-l, U-2, U-3

SUMMARY

The most notable deficiencies in human performance were attributed to Work Practices.

This Causal Category accounted'for'7 of the 9 errors noted. This causal factor has been identified on previous HPES

~

evaluations.

As a corrective'action Training Development is in the process of developing a course on Work Practices for Maintenance and, Operations personnel.

This training is scheduled for an upcoming requalification cycle.

II

PAGE 100 IIR 2-3-89-001 EVENT DATE: MARCH'3, 1989 UNIT3 REACTOR TRIP FOLLOWINGLARGE LOAD Rt~SECTXON LIST OF FIGURES FIG. 1)

FIG. 2)

FIG. 3)

~

FIG. 4)

FIG. 5)

FIG. 6)

FIG. 7)

FIG. 8)

-FIG. 9)

FIG. 10)

FIG. 11)

FIG. 12)

Primary Event and Causal Factors Chart (E&CF Chart)

SSO Relay E&CF Chart Steam Bypass Control Erratic Operations E&CF Chart Fast Bus Transfer E&CF Chart ADVOperation from the Control Room and Remote Shutdown Panel E&CF Chart AD% Local Manual Operation E&CF.Chart MSSS Building LIghting E&CF Chart Instrument AirE&CF Chart RCS Leakage from RCP 1B E&CF Chart RCS Leakage from CHV-435 E&CF Chart Off-Site Dose Calculation Errors E&CF Chart Energy-Barrier-Target Charts (for Issues

Ã1 - ~10)

FIG

SUMMARY

EVENT AND CAUSAL FACTORS CHART l.I.R.

2-3-88-001 SSORRAY OPERATES

~

SBCS OPERATION ERRATIC FAST BUS TRANSFER DID NOTOCCUR ADV'S FAILED ADVS LOCAL TOOPERATE OPERATION REhIOTELY DIFFICULT

~

LARGE LOAD REJECT 0102:19 REACTOR TRIP IESFAS ACTUATION 0103:48 LOSS OF NON~CLASS POVIER 0106:01 DEGRADED CONTROL OF IIEAT REhIOVAL HEAT REhIOVAL BY SBCS 0230 NON CLASS POWER RESTORED 0243 SEAS ANOMALIES MSSS LIGHTING INADEQUATE

~

INSTRUMENT AIR SYSTEM DEGRADED

~

DOTTED LINES INDICATE FACTORS WHICH HAVE NOT BEEN VERIFIED u///tu//u/uu/uuuu///utu RCS LEAKAGE INCREASED

~

INDICATES DETAILED EVENTS AND CAUSAL 'CHART FOR THAT TOPIC (ATTACHED)

EFFLUENT DOSE CALCULATION EIAXS

II 0

FlGURE 2 SSO RELAY EVENTS AND CAUSAL FACTORS CHART f.l.R.

2-3-89-001 SSO REIFY OPERATED DEVERS LINE C PHASE FAULT AT PVNGS, DEVERS BREAKERS PL 992 PL 995 OPEN UNIT 3 GENERATOR BREAKERS PL 985 PL 988 OPEN LARGE LOAD REJECT

FIGURE 3 STEAM BYPASS CONTROL ERRATIC OPERATION:

EVENTS AND CAUSAL FACTORS CHART I.I.R.

2-3-89-001 PREVIOUSLY IDENTIFIEDBY SPEER 7/31/88 NO REPAIRS INITIATED AUTO PERM.

TIMER CARD FAILURE NO PM TASK FOR TIMER CARD LARGE LOAD REJECT 0102:19 SBCS VALVES 1001-1008 CYCLE 0102:30

. SECONDARY PRESSURE DECREASES REACTOR TRIP/MS IS ON LOW S/G

.PRESS 0103:48 ALL SBCS VALVES CLOSE ON Q.O. BLOCK 0103:51

0 0

!I

FIGURE 4 FAST BUS TRANSFER EVENTS.AND CAUSAL FACTORS CHART I.I.R.

2-3-89-001 SBCS ERRATIC OPERA'IION GENERATOR COASTS DOAN GENERATOR ANDGRID OUT OF SYNCH GENERATOR SEPERATED FROID GRID Ht VOLTS/HERTZ SYNCHCHECK WORKS AS DESIGNED LARGE LOAD REJECT 0102:19 REACTOR TRIP/

TURBINE TRIP 0103:48 GENERATOR TfllP 0106 FAST BUS TRANSFER DID NOT OCCUR 0106 IIAtt.SOI, ttAtl-S02 DE EIIERGIZE 0106:01 GENERATOR SUPPLYING HOUSE LOADS FAST BUS fRANSFER ENABLED

\\

FIGURE 5 ADV OPERATION FROM THE CONTROL ROOM AND REMOTE SHUTDOWN PANEL EVENT AND CAUSAL FACTORS CHART I.I.R.

2-3-89-001 tAAINSTEAtA ISOLATION SIGNAL POTENTIAL DESGN DEFICIENQES g SiMULATOR DOES NOT hIODEL ACTUALAOVs

RESPONSE

IDENTIFIED PAEVIOUS ERRATIC OPEAATIOtl AOs NOT TAAltIED IN REtJlOTE SHUTDOWN PANEL OPERATIOtl STEAhllHG PATH TO COtlDEtISER ISOLATED 0103 t48 OPERATORS

~

UtlABLE TO OPEtl ALL ADvs FROM CONTROL ROOtA 0106:30 CONTROL OF ADVs

- VERIFIED -TO BE IH TIIE COHTAOL ROOI4 ADV CONTROL SHIFTED TO REMOTE SHUTDOWN PAtl EL 0111 DIFFICULTY Itl AEhIOTE SHIITDOVIN PANEL OPEBATIOtl OPERATOA INSERTS 15 20% DEMAND SIGNAL ONI.YADVtvu ATTEtIPTED FAOt.

Af.tIOTE SIIUTDOVFHPhtli I ADV COtlTAOL TO MANUAL LOCAL 0137 ADV(s)

UNABLE TO BE OPERATED FROM COtlTAOL ROOM 0126 ADV CONTROL SHIFTED BACK TO COtlTROL ROOM 0126 ADV 178 UNABLE TO BE OPENED FROM REt.'IOTE PANEL PANEL 0120 A.O. INSERTS 30%

DEMANDSIGNAL

FIGURE 6 ADV LOCAL MANUALOPERATION EVENTS AND CAUSAL FACTORS CHART I.I.R.

2-3-89-001 MANUALHANDWHEEL CALlEOFF ANDWAS RE ATTACHED CLEVIS PIN DSBIGAGED CAIISItIG VALVECLOSURE ADV 185 OPENED WITH DIFFICULTIES 0224 DISPATCHED TO LOCALLY OPERATE ADVs 0125 BARRIERS TO SUCCESSFUL TASK COMPLETION ADV 184 NOT OPERATED ADV 178 OPENED SUCCESSFULLY 0137 HEAT RELIOVAL VIA ADVs ACHIEVED 01 3'7 EXTREME ENVIRONMENTAL CONDITIONS AOs NOT TRAINEDON LOCALADV OPERATION ADV179 BROKEN DURINGMANUAL OPERATION 0140 DEGRADED LIGHRNG SAFElY VALVE UFTING LOCAL INSTRUCTIONS LESS THAN ADEQUATE OPERATES OPPOSITE OF ADV 185 CHEATER BAR USED VALVE LOCATIONSNOT IDENTIFIED EQUALIZING LVENOT ELED INSTRUCTIONS SPECIFIC TO ADV 179 NOT UTIUZED

FIGURE 7 MSSS BUILDING LIGHTING EVENT AND CAUSAL FACTORS CHART 2-3-89-001

'. SIAS LOAD SHEDS POWER SUPPLY LOSS OF NON CLASS K)/VER 1, P.C.R CAIICELLED D.90/D 91 RESTCRED AS BUILT NOT PER DEiWN ONLY I LAMP IN EACH 140'.lSSS RCO!.I ESSENTIAL LIGHTS DE.ENERGIZED 0103:54 EIIERGENCY LIGHTS ENERGIZE 0103:54 LOSS OF tIORMAL LIGHTING 0106:01 LIGIITItIG LESS THAN ADEOUATE FOR hlAtlUAL ADV OPERATIONS

-0125 EMERGENCY LIGHTS DE.EtIERGIZE/

ESSEIITIAL LIGHTS EIIERGIZE NO ESS.

LIGHTS IN 140'OUTH hl55 5 BUILDING SEVERAL P.hl.s i

WAIVED DESIGNED FOR EGRESS SHORT LIFE BULB INSTALLED LAhIPBURNED

'UT MSSS AND CONTAINMENTLIGHTS PM TASK

Ib 0

FIGURE 8 INSTRUMENT AIR EVENTS AND CAUSAL FACTORS CHART I.I.R.

2-3-89-001 RX TAIP TURBINETRIP LOSS OF NON CLASS POD MANYPLANT VALVES OPERATING IAPRESS OBSERVEDAT 64 PSIG INSTRUMENT AIA PAESS NORMAL INSTRUMENT AIR COMPAESLOAS DEENERGIZED 0106:01 NITROGEN BACK.UP VALVE OPENS II108:42 NON CLASS POWER RESTORED 0243 AIR COtolPAESSOAS BE.EIIERGIZED 0401 INSTRUMENT, AIRLOW

'AESSUAE ALAAM INSTRUMENT NR PRESS DECfIEASES

FIGURE 9 RCS LEAKAGE FROM RCP 18 EVENTS AND CAUSAL FACTORS CHART I.I.R.

2-.3-89-001 RX TRIP S IAS/C IAS 0103:48 LETOOVN ISOUGED OPERATGflS CYCLE CHARGING PUMPS LOSS OF NAN S01 AND NAN S02 0106:41 NUCLEAR COOLING WATER UNAVAILABLE CH UV-507 '

LEAKSBYOA FAILSTO AEMAIN CLOSED RCP SEAL INJECTION STOPPED K

ALL 4 RCPs DE.ENERGIZED 0106:01 ACP SEAL COOLING LOST 0106:41 SEAL BLEED OFF VALVES CLOSED BY OPERATORS 0 1,14 OLEEO OFF FLOW RE.ESTABLISHED RCP SEALS EXPOSED TO ELEVATED TE MP EAATUfiES 0135-LOCAL INSPECTION OBSEAVES APPROX.

1.25 Gpt'1 LEAK FROII RCP 1B SEAL 1900 RCP 1B SEAL STAGING PAESSUAES OBSERVED ABNOAI.IAL 0250

II IP

FlGURE 19 RCS LEAKAGE FROM CHV 435 EVENTS AND CAUSAL FACTORS CHART I.LR.

2-3-89-001 LETDOWN ISOLATEDDUE TO SIAS NO LETDOWN FLOWTHROUGH AEGEN. HEAT EXCHANGER CHARGING TEMPERATURE REDUCED LOCAL hlEASUREMENT RXLOWTIG TRANSIENT CH V435 FUAMANITED TO REDUCE LEAKAGE PAIOA

.TO EVENT CHV 435 EXPERIENCES THEAhlAL TRANSIENT 0103;54 FUAhlANITE h'I ATE RIAL SHAINKS rrrrrrrrrrrrrrrrrrrA LEAKAGE INCREASES LEAKAGE VERIFIED 3.3 GPhl 1900 CHV 435 LEAKAGE.5GPM

0

I FIGURE 11 OFF-SITE DOSE CALCULATIONERRORS EVENT AND CAUSAL FACTORS CHART I.I.R.

2-3-89-001

~~

LOSS OF NON CLASS POWER 0106:41 ACTUAL AELEASE CALCULATED BELOW TECH SPEC LIIIITS NOTIFICATION OF UNUSUAL EVENT DECLARED 0139 AMSiMESOAEM CCI IPUTERS NOT AVAILABLE REVIEW OF E PIP.14 DISCOVERS MATH EAAORS RP TECH BEGINS OFFSITE DOSE CALO PEA EP IP-14 0139 MANUAL CALCULATION NECESSARY 0139 CALCULATION COhIPLETED ERRONEOUSLY 0150 RP RECOI1MENDS TO EC THAT NO PROTECTIVE ACTIONS NECESSARY 0150 NUE TEA MIN AT ED 0252 DOSE RATE FOR ALLAELEASE POINTS NOT CALCULATED MATH EAAOASINCOAAECT CONVEASIQN FACTORS CONSERVATIVE DEFAULTVALUES USED IN CALCULATION ESFAS ACTUATIONS RESET NON CLASS KSYER RESTCAED AU-139 AND AU 140 READINGS NOT OBTAINED

41

ENEIeGY Ilhlelel E Ie Nl tthteteit e

¹2 lih eleth,le N3 ih eleiLle N4 lihie Iei L le

¹5 ihletelL' N(1 ihlei e II Ie

¹7 Thleo I;"I NOTE: TI IIS Glehl'I IICAI,let'-I'IeESENTATION OF TlIE ENEleGY-llhHfeIER-ThleGLI'Nhi.YSiS IS ONt.Y IN'I'ENI)VD I O INI)ICATEWlIICII Ch I'EGOtet I;S e)F tthtetetEtes wEtet; vt FEcnvE voH Tiits Issut;"ANI)wtitcit wvteE No t. wt iti i; ITis tet coGNtzt'o 'nihT nli ieE hteE MANYi osst tt I I," I htehu i i, AND SElelES COMIIINATIONSOF 'n IESE CATEGOIeIES OF Ilhtetett,"tes, IT IS NOT I IIE IN'I'ENTol"I'IIIS IIEI'IILSENI'h'I'ION OF I I IE E-li.'I'NAI.YSIS To Sl tow tllOSE COMIIINA'noNS.

ENERGY-BARRIER-TARGETANALYSISFOR IIR 2-3-89-001

'ENEIeGY gf4ERGT SSO REIFY spUIetoUs ACfVATION UAHIeIEIe Nl FAII.ED IIAlelelEIe N5 Uqt)I'.Ie

EVAI, rhieGLI ThHGET I'Ieo I'I;CI';@IIII'MENT WITIIIN Sl'ECII'IChl ION IIF n

SC I hte IF.

F.S

l. EQUIPMENT PERFOleMANCE ADEQUATE LESS 'n IAN UNt)EH ADEQUATE EVAI.UA'noN USED NOT USED NOT APPLICADII'SO HEI'CI'l1ATION

2. PERSONNEL PERFORMANCE

3. PROCEDURES

4. TRAINING S. DESIGN DFle INSI'ht.IA'tloN

6. MANAGEMENT

7. OTIIER

ENEItGY 13hl t1 tl E It Nl N5 TARGn NOTE: TIIIS Glthl'IIICAI.ItEI'ltESENTATION OF TIIE ENEI(GY-13hltltIElt-ThltGL"I'NAI.YSISIS ONI.Y IN'IENDEI)TO INDICAI'E iVIIICII Ch'I'EGOI(IES OF 13AI(ltIEIISiVEItE El:FECllVE FOR TIIIS ISSUE AND iVIIICII iVEItl;N() I'. iVIIII.LI'I'S I(ECOGNI/kD 11!AT'I'IIEltE AI(E hlhNY I'OSSIIII.E I'hl(AI.I.EI.

AND SLI(IES COh113INATIONS OF TlIESE CATEGOltlES OF IIAItltlEltS,I'I'S NOT TIIE INTL'N'I'FllIIS IIEI'ltESENTA'I'IONOl'lIE E.II.T ANALYSISTO Sl IOiVTlIOSE COMIIINATIONS.

ENERGY-BARRIER-TARGET ANALYSIS FOR.IIR 2-3-89-001 ENERGY g~F.R~G S13CS EltRATIC ItESPONSE 13AHItlElt Nl FAII.ED 13hltl(IElt

.N2 FAII.ED 13AltltlLlt N3 I'All.ED llhl1 I(I EI(

N5 UNDER EVAI

'I'Alt(hLT

~hlt~GE

'(ESI'ONI) TO MITIGh A'I'E DI;SIGN TltANSII N'I S BARRIER IIER AND DESCRIPTIO ARRIFR EFFECTIVENESS IBBUB~NUhIBBR 2

1. EgUIPMENT PEIIFOItMANCE 2.

PERSONNEL PERFORMANCE

3. PROCEDURES 4.

TRAINING

5. DESIGN 6.

MANAGEMENT ADEgUATE I.ESS TIIAN UNDElt ADEQUATE EVAI.UA'I'ION USED NOT USED NOT APPI.ICAI3I.E

-Itl;IAY'I'Ihll It Chl(D h1 AI.FIINCl'I()N

- OVL'ItSIGIIr Glt()1)IIS

- Sl'h ('t()()l' Sl'I I It I'lt()(:I;S.'h

- I'I'hl I'lt()(:I;l)llltl

-I(OO'I'hilSI'F FAII.UI(L()F TIMEItChltD

7. OTIIER

ENEItGY 13hltttlElt Nl 1'hltG If1' NOTE: TIIIS Glthl'IIIChl. ItEI'IeESENTATION OF TIIE ENEItGY-llhltftlElt-ThltGEThNAI.YSIS IS ONI.Y INIENDED TO INDICATE LVIIICII Ch'I'I GOltll'.S OF IIAItRIEltSIVEItE EFFEC11VE FOlt TIIIS ISSUE AND IVIIICIIIVEItE NO'I'. IVIIII.EI'f IS Iel:.COGNIKED 111AT'fllEIeE hi(I'1ANYI'OSE'IIII.E I'Althl.l.l'.I.

AND SLItlFN COMIIINATIONSOF TlIESE CATEGOltlES OF I)hltltll'.IeS, fl'S NO'I'llIE INTEN'f OF 11IIS ltEI'ltLSEN'I'h'I'IONOF 'I Ill'. I'. ll T ANALYSISTO Sl IOLVTlIOSE COMIIINATIONS, ENERGY-BARRIER-TARGET ANALYSIS FiOR IIR 2-3-89-001 ENEltGY g~PR~G IMPROPER SESS ALARMS 13hltltII It Nl 13hltltlElt N3 FAII.ED llhltleIErt N5 UNDElt EVAI I'h It(lE'I

~Alt(3R'f INDICA I'E ACIUhl.

CONI)I'I'IONS FOlt Ol'El eh I'Olt DIAGiNOSIS IIIE I)ER AND DESCItl ION I)hltltlRRRPPRCT

.NESS

~SEVE ~UhlBER SS

l. EQUIPMENT PERFOItMANCE 2,

PERSONNEL PERFORMANCE

3. PROCEDURES ADEQUATE LESS TlIAN UNDElt ADEQUATE, EVAI.UAnON USED NOT USED NOT APPI.ICAIILE DUAI. INI)ICA'I'IONS olt NUN-AIAI(M Iii%1S TEST I'ltO(hlthM 4.

TIMNFNG

5. DESIGN 6.

MANAGEMENT

~

I.IMI'I'ivl'I'CII/

VAI.VE DESIGN

7. OTIIER

ENEltGY llhltluEIt UAIel<<EIe l3hleleIE t IIhlelelEle IIAI<<uEle IIAIel<<EIe Ih elelvle ThltGLI'I

¹2

¹3

<<n

=

¹5

¹6

¹7 NOTE: IlIIS Glehl'I IICAI.IIEI'IeESEN'I'A1ION OF TlIE ENEIeGY llhltltIERThltGI I'NAIYSIS IS ONI Y INI'ENI)LI)TO INI)ICA'I'EiVIIICII Ch'I'I'GOlell(S I

>I'IAltluEltS iVEIKEl'FECTIVE FOltTlIIS ISSUE AND iVIIICII XVEItl'OI; eVI IIIL I'I'S Itl'(O(iNI/I'.I)llIATTlII;leE ARE MANY I'OSSII II I I'hlth) I I I.

ANI) SEIeIES COW IIINA'I'IONSOF 'l1 IESE Ch'I'EGOleIES OF Ilhlutll IIS, I'I'S NOl'Till'.IN'I'ENTOl'lIIS ItLI'IeL'SENl'A'I'IONOF 'I'III' II:I'NALYSIS TO Sl IOiV11 lOSE COMIIINATIONS.

ENERGY-BARRIER-TARGETANALYSISFOR IIR 2-3-89-001

'ENERGY

~ENERG FIIT DESIGN Ilhl el I IEIt

¹5 UNI)L'R I'.Vhl I'Alt GL"I ThltGET h1AIN'I'AINI'OIVI;ItTO NAN.SO I/S02 KVI'I'll A GENEIIA'I'OleIIIeLAI(l'It ONI.Y lltll'OI.I.O'eVEI)

IIYA IIEACI'Olt

'l1tll'DEQUATE I.ESS11IAN UNI)Elt USEI)

NO'I'SEI)

NOTAI'PLICAIII.E AI)EQUATE EVAI.UA'I'ION

1. EQUIPMENT PERFOItMANCE

2. PERSONNEL PERFOItMANCE

S. PROCEDURE

S

4. TRAINING S. DESIGN 6.MANAGEMENl'Vhl.lhYI'E CUItltENT l)IÃIGN

7. 011IER.

0 Cl 0

ENERGY Dhl(I(tE)t Nl DA(l I

N2 hlt (S I

N4 1)AR)e)E)(

lsht(st)E)t

)A (t(IE t Th)tct;-r N5 NG N7 NOTE: Tl<<S G)(AP) <<CA). I(EPI(ESENrAIION OF TIIEENEI(GY 13hltltlER Thl(GET ANAIYSIS IS ONI Y IN'I'ENI)EI)TO INI)ICAll'VI<<CIICA'I'EGO)(<<S Ov l)blest tE)ts ivEI(LE)FECIIVE vo)t TlIts ISSUE AND iv)I)CI I wvle)'. No r. ivtt<< t. )r IS t(tx()(N)zE))TtIhr I)tEI(E AleE MANY)oss))

3))'.)A)(AL)I'.

ANI)sEI(IL's coh) IIINAI'loNs oF Il)EsE chlEGo)(IEs ov Ishs()e)L')(s. i) Is No'I")i<<; )N1')N'I'v )') )ss )es) >s(L'st'N)'AI')QN ov'I'Ill' 11:I'NA).YS)s

'ro slloiV )IsosE COMDINAT)oNS.

ENERGY-BARRIER-TARGETANALYSISFOR IIR 2-3-89-001

. ENERGY

~EEOC lh)PROPER ADV OPERATION DAI(te)ER Nl FA)).ED DA)elt)Elt N2 FAILED Dhtt)e) Elt N3 FAILED 13hltl(IEI(

N4 FAILEI) lshl(I(IE)t N5 FAII.LI)

DA)tl(IER NG UN))Elt EVAI I'ht(GL) rhncET FUNC)')ON hS I)I')GN)'.I)

Fltoh1 'll)E CON)')(OI. 1(OOM Olt MANUAI.I.Y S

I SS SSU

l. EQUIPMENT PERFORMANCE

2. PERSONNEL PERFOI(MANCE

3. PROCEDURES

4. Ileh)NING

5. DESIGN

6. MANAGEMENT

7. Oll)ER ADEQUATE 'I.ESS IlIAN UNDE)t Al)EQUAIY EVAI.UATION USEI)

Nol'SED NOTAPPLICABLE

- I)<<) No'I'e)'.ss'oN))

v)ec)hs c.le cire les)

- l)AN))KVSILI'.I.(:I.LVIS

- ('lt 'il'AVE

- AO I.OCAI.OI6

~ 0)'S IbYI'ING, hlhlN'I'.

&'ll'.S)'

Clt. I(SI' I.OCA).

Ol'S

- A)lt, N2 SU))SYSTEM

- CONI'IGUI(h')lON CONl'I(OI I'i~)

I'I(()G)(AM. )NI'0

'sl(ANSFE)t

ENEleGY 1 th I e I et E le Nl NS

'I'hleG I."I'OTE:

TIIIS GtehPI IICAI.IeEI'leESENTATION OF TlIE ENEIeGY-Dhletetzte-ThteGEI'NAI.YSIS IS ONI.Y INI ENDI'.D TO INI)ICAI'E WIIICII Ch'I'E('Olell'.6 OF DhlelelzleS iVEteE EFI'EC11VE FOIe TIIIS ISSUE AND iVIIICII 1VEIeE NOl'. iVIIIIE IT IS IIECOGNIZEDllIATTill'.IIEhleE h1ANY I'OSSllll.lhlehI.I.L'I.

AND SEIeIES COMIIINATIONSOF TlIESE CATEGOleIES OF lthtetetzteS

. IT IS NOTllIE IN'I'EN'I'FTlIIS Iezl IeESEN'I'A'I'ION OF 'I'IIE E.lt ~

'I'NAt.YSIS TO Sl IOW TI,IOSE COMIltNATIONS.

ENERGY-BARRIER-TARGET ANALYSIS FOR IIR 2-3-89-001 ENERGY Q~F.RG INADEQUATE MSSS LIGIITING tlhletelFle Nl FAII.ED

'Dhtetetzte N2 FAII.I;D tthteteIEte N3 FAILED tthtetett:te NS Fhll.l'D

'I'hteG L"I'h~teG F.

ADEQUA'I'E I,I0l I'I'IN Gi Te) I'EleFOIeM TASKS RIZR ttZR AND DZSCRIPFtO ahnntzn EFFECTrvzNzss

l. EQUIPMENT PEIeFOleMANCE 2.

PERSONNEL PERFOteMANCE

3. PROCEDURES ADEQUATE I.ESS TlIAN UNDER ADEQUATE EVAI.UA'I'ION USEI)

NOT USED NOT API'I.ICAIII.E

~ ESSENTIAL I.IGilI'I'ING

~ Eht I IIGI NCY I.l(ilI'I'INGi MSSS I'ibt WAIVEte I'Shle Iel VII 1V 4,

TRAINING S. DESIGN 6.

MANAGEMENT

7. OTIIER

~ ~

~ 'IUIelIINEIll.l)G uGI I'r.

~

MSSS I.IGII'I'ING

il

Uhl(l El ENERGY I

llhltlVEI(

h eIVE AICICIEIC IIA C CII'I(

lh (l(ILlt lhl(l(I I'hl(GI;"I'l N2 NS N4 N5 NG N7 NOTE: TlIIS GI(AI'IIICAI,I(EI'RESENThllON OF TlIE ENEICGY-l3hl(ICIEICTAICGEI'NAIYSIS IS ONI Y IN'I'ENI)LD'I'0 INDICATEIVIIICII Ch'I EGOI(IIXOF l3hl(ICIEI(SIVEI(kEl'FECTIVE FOI(TlIIS ISSUE AND IVIIICII IVEICE NO'I'. %VIIII.Lfl'S ICI C( GNI/I I) 'I IIh'I"I'III ICE hltE MANYI'OSSIIII.I I'hl(AI.I.II.

ANI)SE IVES COMIIINATIONSOF llIESE CATEGOIVES OF llhl(ICIEltS,I'I IS NO'I"I'IIEIN'I)EN'I'Ol'TIIISI(EI'I(LSkNThl'IONOF I'IIE E II T ANAI.YSISTO Sl IOiVlllOSE COMIIINATIONS.

ENERGY-BARRIER-TARGETANALYSISFOR IIR 2-3-89-001

'NERGY ENERGY INSTRUMENT AIR DEFICIENCIES IIAIVVER Nl UNDEI(

UAI(l(IL'I(

N5 UNDEI(

EVAI..

Threel

~ABORT PEICFOIV1 AS I)ESIGNEI) TO MI'I'IGiYIE TICANSIEN'IS SC 0

lh R E F.

NF.S I. EgUIPMENT PERFOI(MANGE

2. PERSONNEL PERFOI(MANGE

3. PROCEDURES

4. mAINING

5. DESIGN

6. MANAGEMENT ADEgUATE I ESS'lllhN UNI)EI(

ADEQUATE EVAI.UATION USEI)

NO1 USED NOT AI'I'I.ICAI31.'E

- AS I)LII I(MINED IIYL'NGINl:.El(ING ACI'ION I'IAN

- EVALUATEI'El(

Nlec GENEIvc Lt",ITEI(88. I4

7. OTIIER

0

ENEItGY IlhltltlEIt NI JJ5 Th1to L"I'OTE:

TIIIS GltAPIIICAI.IIEI'ltl'.SENTATIONOF TIIE ENEltGY-13ARRIER-ThltGET ANAI.YSIS IS ONI.Y INTENI)EDTo INDIChlE iVIIICII Ch'I'I'.Goltll 6 OF I3hltltlllts ivEItE EFFI Cllvl;FOR TIIIS ISSUE ANI) ivlIICIIWEItl; NOT. WIIIIt: I'r Is IIECOGNI/LD'Illh'I'IIEIIEAltE h5ANY I ossllll F. I'hlthl I El.

ANI) SEltILS COMIIINA'floNSOl'lIESE CATEGOIIIINOF 13hltltlEItS, IT IS NOTllIE IN'I'EN'I'l'lIIS ltEI'ltESENTA'fION OlIIE L 13-T ANALYslsTo sl lowTllosE COMI3INA'rIONS.

ENERGY-BARRIER-TARGET ANAI.YSIS FOR IIR 2-3-89-001 ENERGY P~F.R~G RCS LEAKAGE AND.

DETECTION 13hltltlER JJ I FAII.ED 13hltltlEIt N2 FAII.ED IlhltltlElt NG EAILLD

'I'h1 AGE'I'~i',GI+

ltCP SEAID /

Tl Cll Sl'L'C &

HECOVLRY OI'E1th'I'IONS RIE IIER AND DESCRIPTIO 33ARltIFR EFFFCTIVENRSS ISSUE NUh5HER S

1.

EQUIPMENT PERFOIIMANCE 2.

PERSONNEL PERFORMANCE 3, PROCEDURES 4.

TRAINING ADEQUATE I.ESS TlIAN UNDElt USI'.I)

NOT USEI)

NOT Al'I'I.ICAIII.E hl)EQUA'I'E EVAI.UATION

- SLAI.III.I EI)OI'I'I I I;.'jl'AIJI.ISI IL'I)

- SEAI. I'hll.tJ 1tl' I'

Itl'il'O'VSL (4Ft'IJltl'll I'I'l)ol'I'5V/:il;hl.

IN.J.I

5. DESlGN 6.

MANAGEMENT CoiV'I'AINMEN'I'UMI I.I:.VEI.& ItlIS INI)ICATION 7.

OT1IER

ENERGY 13hltltlER Nl N5 Thl(Oil;"I NOTE: TIIIS GRAI'IIICALREI'RESENTATION OF TIIE ENERGY-BARRIER-TARGET ANAI.YSIS IS ONI.Y INTENDED TO INDICATEIVIIICIICh'I'I GOIIIES OF BARRIERS IVERE EFFECIIVE FOR TIIIS ISSUE AND WIIICII IVERE NOT. iVIIII.E 17 IS RECOGNIZED llIATTlIERE ARE MANYI'OSSIIII.E I'AIIAI.I.EI.

AND SERIES COMBINATIONSOl'IIESE CATEGORIES OF I3ARRIERS. IT IS NOT TIIE INTh&fOF TlIIS REPRESENTATION OF TIIE E.II-T ANALYSISH) Sl IOIVTllOSE COMIIINATIONS.

ENERGY-BARRIER-TARGET ANALYSIS FOR IIR 2-3-89-001 ENERGY OFFSITE DOSE CALCULATION ERRORS BARRIER N2 FAII.ED BARRIER

¹3

.UNDER EVhl IIARRIER N4 Fhll.ED I3AMIIER N5 FAII.ED Th RGL"I

~AII~C

~

I'l(OI'Elf I'I)O'I'I O'I'IVE AC'I'ION RL'COA151 L'Nl)A'I'ION BARRIER BER AND DESCRI ION BARRIER EFFECTIVFNESS ADEQUATE I.ESS TllhN UNDEI<

ADEQUATE EVAI.UATION USED NOT USED NOT Al'PLICA13LE I. EQUIPMENT PERFORMANCE 2.

PERSONNEI PERFORMANCE

3. PROCEDURES 4.

TRAINING

- CAI.CUI YI'ION ERI(OILI I'1<0%'IIIL'NAIINCE-Ml O'IS 'I'0

~

I'ROCI I)UIO:

5. DESIGN 6.

MANAGEMENT MESOI(I;M/RihIS I'OIVEIISUI'I'I.Y T. OTIIER

0 0

'I

ENERGY BhltltIEIt Nl N5 ThltGI;"I NOTE: TIIIS Glthl'IIICALI\\El'ltESENTATION OF TlIE ENEltGY-13hltltlEft-ThltGI;"I'Nhl.YSISIS ONI.Y INI'LNI)I'.I)TO INI)ICATEiVIIICIICA'I'L'GOltlES OF 13AltltIEftS iVEItE El:I:ECllVEFOR TIIIS ISSUE hNI) iVIIECIIiVEItE N()T. iVIIII.E IT IS ItEC()CNI/EI)'llIATTIIL'ItEAltl'1ANYI'OSSIIII.I'. I'hlthl.l.L'I.

AND SEltIES COMIIINATIONSOF TIIESE CATEGOItIES OF IIAltltlh;ItS. Il'S'NOT llll IN'I'I'N'I'FTIIIS ItEI'ItESENI'ATIONOF TIIE k:.13.T

'NALYSISTO Sl IOiVTlIOSE COMBINATIONS.

ENERGY-BARRIER-TARGET ANALYSIS FOR IIR 2-3-89-001 ENERGY g~EILGG EQUIPMENT PEItl ORMANCE ANOMALIES 13hlt ItlElt Nl FAII.ED 13AItRIER N2 FAII.ED BhltltlElt N3 FAR.LI)

I)hit ltIL'lt N5 UNI)Elt EVAI I'hltGI."I

~hgCCFI to l'Elt Eg UIBMEN'I Ol'E1th'I'ION E

HERAND DESCRI ION BhRRIFR EFFECTIVENESS ISSI IF. ~Bh'lllF.R I10 1.

EQUIPMENT PERFOItMANCE 2.

PERSONNEL PERFOltMANCE

3. PROCEDURES ADEQUA'I'E LESS TlIAN UNI)Elt ADEQUATE EVAI.UATION USEI)

NO'I'SEI)

NOT AI'PI.IChlII.E 10.1. 10.2. IO:1. 10.5 IO,I1~ IO.H. 10. IO

- 10.3

- 105 4.

TRAINING

5. DESIGN 6.

MANAGEMENT

%RA' IO.I I. 10.12

7. OTllER

i 0

v t e Letter Sequence Other
TAC:73246, (Open)
Initiation Acceptance... Administration Questions Answers Results Approval... Other: ML17304B203, ML17304B205, ML17304B206, ML17304B212, ML17304B214, ML17304B215, ML17304B230, ML17304B232, ML20247L666, ML20247L685, ML20247L692, ML20247L727
MONTHYEAR1989-05-25 [Table View]

ML17304B215

Text

SUMMARY

Response

Background

SUMMARY

SUMMARY

RESPONSE

S. PROCEDURE

Navigation menu

Search