ML18087A772
| ML18087A772 | |
| Person / Time | |
|---|---|
| Site: | Salem  |
| Issue date: | 03/14/1983 |
| From: | Dircks W NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO) |
| To: | |
| References | |
| TASK-PII, TASK-SE SECY-83-098A, SECY-83-98A, NUDOCS 8303230332 | |
| Download: ML18087A772 (37) | |
Text
,_i I
. A'l"rACHMEN'l' s
'l_.
(,
- , I f/
March 14, 1983 POLICY ISSUE (Information)
For:
The Commissi.oners From:
William J. Dtrcks Executive Dtrector for Operations
Subject:
SALEM RESTART SECY-83-98A
Purpose:
To provide the Commissioners with a report on the current status of the staff evaluation of tpe failure to automatically scram events of February 22 and 25, 1983 at* the Salem Nuclear Generating Station and the staff action p1an for authorizing restart of Units l and 2.
Discussion:
During a briefing on March 2, 1983 concerning the Salem rea-ctor trip system failure events, the Commissioners requested that the staff provide its plan of action to resolve the issues identified from the NRC evaluation of the Sa 1 em events.
Enclosed is the Salem Restart status report which identifies the tssues related to the recent Salem events and the short-and 1 ong-tenn actfons *needed to resolve those issues.
For the short-term actions, the staff has or intends to obtain specific commitments from the licensee to complete those actions and the staff will assure their satisfactory completion prior to permitting restart of either Salem unit.
For satis_factory resolution of the long-term actions, the staff intends to develop with the licensee an acceptable_
schedule for completion of those actions, obtain necessary written commitmen.ts, and follow up their completion on the agreed upon schedule.
Contact:
Gus Latnas X-27817 R. Sta rostecki FTS-488-1230 c:
- .:~~.
- ~
- ~**
.'*'/I I*-
- e.
The Commissioners.
I I
Enclosures:
In addi*tton to the short-and long-term actions identified in the report, the staff has also concluded that a show cause order should be issued to the licensee (see enclosure 2).
- The staff believes that the particular circumstances at this facility, as further detailed in the start~up report, justify requiring that these three separate but interrelated sets of actions be implemented by the licensee in a* t.imel y fashion.
Subj~ct to satisfactory implementafion of these actions, the st~ff has concluded that the Salem facilities can be restarted and operated without undue risk to the health and safety of the public~ Enforcement actions are under active constderati'on by the staff and will be discussed separately with the Commission at a later date.
- l. Salem Restart Status Report 2.. Dft Show Cause Order DISTRIBUTION:
Commissioners OGC OPE OIA SECY
(.
-................ ~-=-:.... :~.._
ENCLOSURE 1
. f
f:... *.:
'. ;* 11
- e.
SALEM RESTART STATUS REPORT, I.
Summary II. Background III. Issues
. A.
Equipment Issues
- 1. -
Safety Classification of.Breakers
- z.
Identification of Cause of Failure
- 3.
Ver.ifi ca ti on Testing
- 4.
Maintenance and Surveillance Procedures B.
Operator Procedures, Training, and Response Issues
- 1.
Operating Procedure for Reactor Trips and An~icipated Tran-sients Without Scram (ATWS)
- 2.
- 3.
Operator Training Operator Response C.
Ma~agement Issues*
- 1.
. Overa 11 Management Capability and Performance
- 2.
Master Equipment List
- 3.
Procurement Procedures
- 4.
Work-Order Procedures
- 5.
Post-Trip _Review.
- 6.
Timeliness of Event Notification
- 7.
Updating Vendor-Supplied Information
- 8.
Involvement of QA Personnel with Other Station Departments
- 9.
Post Maintenance Operability Testing IV.
Conclusions Appendix A Appendix B I
Results of NRC Staff Evaluation of Events at Salem Nuclear Generating Station Initial NRC Staff Review of Licensee's Maintenance Procedure and Preoperational Verification Program
,1":*,. *.lit'
- ..... ~
- ~ ~-.. ~.~;~*,.:
,~~srm~..
I
- -**~
.e
(.
Salem Restart Status Report I. Summary This report briefly describes the NRC and lic~~see actions to address and resolve equipment, operator procedures, training and response, and management issues identified by the NRC evaluation of the two events at Unit l of the Salem Nuclear Generating Station that resulted in failure of the reactor to trip automatically upon a*valid signal.
The second event occurred on Febru-ary 25, 1983 and led to the realization that_ a similar event had occurred on February 22, 1983.
Based on NRC evaluation~ a number of potential contribu-tors to failure have been identified.
However, our initial evaluation indi-cates that all of the potential contributors to the failure are age-related and that a new device should perform properly..
An NRC task force h~s been established to conduct a separate longer range
- study of the broader implications of the events.
NRC long-term actions identified herein are applicable to Salem but may have generic implications.
The NRC task force will determine generic actions needed for other facilities.
For the Salem facility, longer term actio~.. -developed by this task force may complement the long-term actions identified nerein:
NRC short-term* action~
identified in this report must be satisfactorily completed before plant startup.
II. Background On February 25, 1983 an event *occurred at Unit 1 of the Salem Nuclear Generat-ing Station when the reactor-trip circuit breakers failed to automatically open following receipt of a valid trip signal from the Reactor Protection System (RPS).
The manual trip system was used tD shut down the reactor.
Subsequently, it was concluded by the licensee that the failure to trip was caused by a malfunction of the undervoltage (UV) trip attachments in both reactor-trip circuit breakers.
These UV trip attachments translate the electrical signal from the RPS to a mechanical action thet opens the circuit breaker.
On February 26, 1983, an NRC team was onsite to conduct initial followup and to collect preliminary information.
As a result of NRC inquiries, the* licensee determined that both reactor-trip circuit breakers had.similarly failed to open upon receipt of a valid trip signal on February 22, 1983.
The failure to auto-matically trip on February 22 was not recognized by the licensee until the com-puter printout of the sequence of events was reexamined in more detail on February 26."
Further evaluation of these events and the' circumstances leading up to them revealed a number of issues that require resolution by the licensee and/or the NRC.
This report identifies those issues and the short-term actions proposed to resolve them prior to resumption of operation at Salem Unit i* and
- Salem Unit 2 is presently shut down for refueling and is not presently scheduled to resume operation before Unit L
- e.
~.
~.*.......
__ *:*... '.t. *' *. ~: *'--.=-*
- . :.~ ~ *.* : l ~. ~
the long-term actJons that are needed following restart.
The short-term actions.
- required for Unit 1 will also be implemented on Unit:2 prior t~ restart of Unit 2~. -.
The licens*ee met with NRC staff on February 28, 'March 5, and-*"l';farch io, 1983 to present the results of initial evaluati~ns related to the evehts.
Based on licensee submittals of March 1 and March 8, 1983 a.nd on the findings of the NRC evaluation of the Salem events, issues were identified arid. categorized as equipment issues, operator procedur¢, trainihg.. and r~s~onse iis~es, and.
management *issues~ They are discussed *in detail.in Section 111 of:. this report.
III.
Issues**
- A.
Equipment. Issues Thr.ee of the issues* re 1 ate to the affected equipment, that i's, the reactor-
.trip circuit breakers (Westinghouse DB-50 circuit breakers).* :Thes.e issues are
- 1) safety classification of the cir*cuit breakers, 2) identification of the
- cause of the fa~l~~e, and 3) verification testing of the cirtGit breakers.
- 1.
Safet,y Classificati,on of Breakers During the initial NRC evaluation of the February 25 event, **;t was determined
- that maintenance was conducted on the Sa l.eni.._Uni t 1 reactor-trip circuit breakers in January 1983, *following a failure* of.one rea~tor,.;;trip c.ircuit breaker to trip upon receipt of an RPS signal at Salem Unft -z on January 6,"
19S3.
The work. orders authorizing the January 1983 mai ntena*nce identified the maintenance as n"ot safety related and not requiring quality *assurance review.
. As a result,'. i*t was not cl ear on February 26,.1983 what porUon, if any, of the reactor.. trip circuit breakers was consiqered safety related by the licen-see.
The reactor-trip circuit break!=rs contain both a UV trfp. attachment and*
a sh1:.1nt trip attachment, but only the UV trip attachment is :operated by an automatic RPS trip signal.
Action/Ev al uat ion
- This issue *has been resolved.
Section 7.2~1.l of the Salem Updat~d.F{nal Safety Analysis Report (UFSAR), Revision 0,.indicates that the Reactor Trip System includes the reactor-trip circuit breakers and th~ UV *trip attachment..
The Westinghouse Solid State Logic Protection System Description (WCA*P-7488L)
- also defines the scope of the system as including the reactdr-trip circuit breakers and.the UV trip attachments.
The UV trip attachment ~nd the r~actor-
. -trip circuit bre*aker are safety-related equipment in that they are essentia*1 features *of the Reactor Trip System, which is necessary to prevent or mitigate the consequences of a design-basis event that could result irt exceed1ng the offsite exposure guidelines set forth in 10 CFR Part 100.
The shunt trip attachment of the reactor-trip circuit breakers in the Westinghouse design is not required by present NRC regulations to be safety grade and, although it is provided to perform the manual trip function, no credit. is taken for this design feature in the safety analysis (a manual reactor trip*also actuates the UV trip attachment).
The licensee in a March 1, 1983. letter to NRC concurred 5
-.. *. ~
in this understanding.
Hence, the specific issue.with regard to the safety classification of the reactor-trip circuit breakers is considered resolved.
Other issues concerning the manner in which the reactor-trip-circui~ breakers were treated from a procurement and maintenance standpoint at Salem are addressad under Management issues (Section III C).
The licensee has made a.
commitment to install new UV trip attachments on all four Unit 1 circuit.
breakers prior to restart and to verify that the new circuit breakers have been pr.operly serviced and tested.
- 2.
Identification of Cause of Failure the licensee's initial determination of the cause of the failure of the reactor-trip circuit breakers (as documented in a March 1, 1983 letter) was that there was binding.and excessive friction of the vertical latch lever of the UV trip attachment due to a lack of proper lubrication. This conclusion was concurred in by Westinghouse representatives. and was bas*ed on visual i~spection of the UV trip attachment, in-place testing p~rformed after the
'.ailures, and previous W~stinghouse experience.
The NRC has conducted an*initial-determination of the cause of the failure based on inspection of the failed UV trip attachments and interviews with cognizant maintenance personnel on how the devices were maintained.
The
- inspection indicates that there were possibly multiple contributing causes of failure.
Possible contributors are (1) dust and _dirt; (2) lack of lubrica-tion; (3) wear; (4) more frequent operation-than~intended by design; (5) *cor-rosion from improper lubrication in January 1983; and (6) nicking of latch surfaces caused by vibration from repeated operation of the breaker.
The contributors appear to be cumulative, with no one main cause.
The initia1 investigation also indicates that all of the potential contributors to the
. fa i 1 ure of the UV trip attachments ar.e age related and that a new devi.ce would likely perform properly.
Many -surfaces of the latch mechanism are worn and.
the additional friction tended to prevent proper operation.
Proper lubrica-tion throughout the life of the device might have prevented the wear that can be seen ~n the sample.
These initial findings indicate that the UV trip attachment failed from binding and excessive*friction.
However, in addition to the potential contri-
_butors cited above, there rem~ins the possibility that other UV trip attachment or breaker problems may have caused the Salem failures.
Because of the importance to safety of the reactor-trip circuit breakers and UV trip attachments, the NRC staff has-prepared a more structured approach to resolv-ing this issue.
Therefore, a laboratory testing and examination program.
funded by NRC will attempt to determine the precise cause of failur~.
Appendix A describes the initial NRC inspection effort and extent of additional examination and te*sti ng to be done by NRC.
NRC Acfion - Short Term NRC ~onducted an initial evaluation of the cause of the UV trip attachment fail-ures which included visual examination of the devices by qualified personnel and determining how the devices were maintained (See Appendix A for details).
Based on this, we conclude that operation with new devices, in conjunction with preoperational testing and periodic surveillance, is acceptable.
c
~* *--
~-
NRC Action*~ Long Term
- NRC will conduct laboratory testing and examination of the failed attachments to determine the precis~ cause of failure, if p6~sibl~.
We anticipate that this war~ will be complete within one mont~ and the re~ult~ will be avai*l.able for consideration by the generic task force.
- 3.
Verificati-0n Testi~g On August 20, 1982,.one reactor-trip circuit breaker on Unit 2 failed to*
operate during surveillance testing.* A UV trip attachment*was reinsta~led*on this circuit breaker after replacing th~ coil, the circuit breaker was rein-s*tal 1 ed, and.subsequent post maintenance testing was performed to establish.
pperapility.. Similarly, on January 6, 1983, a reactor tr"ip cc.curred.at :Salem Unit.2 due to a low7low steam generator level, but one reactor-trip circuit breaker fai 1 ed to.. open.
The 1 i censee concl ud.ed that the Ci r"C:uit breaker fai 1-
- Ure was due to binding from dirt and corrosion fo the UV *trip attachment.
The UV*trip attachment on the Unit 2 circuit breaker, as well as the UV trip attachment on an *unit 1 rea:cto~tr.ip circuit breakers, was cleaned, lub*ricated and readjust~d under iupe~vision of a Westinghouse representative.
On.Feb~u-
- ary 20, both breakers performed satisfactorily during reactor trip ev~nts.
Since the circuit breakers again failed on February 22 and 25, adequacy of the t~sting to ensure circuit breaker operability is an issue.
Testing following reactor-trip circuit breaker ma*intenance QI'_ initial installation should be sufficiently comprehensive to provide reasonable a_?SUrance that the cfrcui~
breaker will function as needed~
~.
licensee.Action - Short Term.
I The licensee.has proposed a program to verify proper operation of the reactor-trip circuit breakers prior to returning them to service.
The program will involve preinstallati6n testing of UV trip attachments 25 iimes by the vendor; After instal.lation on the trip briakers, the UV trip attachment and trip breaker will be tested t~n more times.
Once initial adjustm~nts have been per-formed, any failure in the 25 cycle or 10 cycle tests '.¥ill constitute a failure of the.trip assembly and investigation of the cause of failure and NRC notifi-cation will be required.
Following this testing, a time response test of the breaker actuated through the RPS will be performed.
The NRC staff considers
- this issue to be sufficiently resolved to permit restart of the plant pending a commit~ent by the. licensee to develop and implement a program. comparable* to
- that de.scribed below under Long Term.
- *License~ Action. - Long Term
- Although the licensee has not yet proposed a :long-term program, the NRC staff has concluded that an extensive bench test of the rel i abil itY of a reactor-trip circuit breaker and UV and shunt trip attachments as an integrated unit
.is indicated.
The test.would involve cycling (a total.of 2000 cycles: 1000 trips by UV trip attachment and 1000 trips by shunt trip attachment) under simulated ~nvironmental service conditions to determine. if a properly main-tained circuit breaker and its attachments can operate for an extended number of cycles.
The purpose of this test will be to deter~ine if there are accu-mulated effects which will affect proper breaker operation.
If these tests 7
.point to specific deficiencies in components or in the integral assembly,
- further testing or design modifications may be indicated.
The testing would be* performed by the licensee or appropriate industry owners group or vendor.
We anticipate that this. program could be. completed within six months.
NRC Action - Short Term NRC will verify satisfactory completion of the. licensee's short-term preopera-t i ona 1 testing program.
NRC Action -* Long Term NRC will require the licensee to establish a long-term reliability test program for *the reactor-trip. circuit breakers and will assure that the follow-ing points are included:
- 1.
a sufficient number of cycles is included to provide statistically meaningful results.
- 2.
as wel.l as the circuit break~rs.
- 3.
- 4.
the-test is conducted under environmental ~onditions similar to those seen by the*circuit breakers.
sufficient delay time is included between cycles to'allow return to steady-state conditions.
- 5.
test procedures and acceptance criteria which wi.11 give reasonable assur-ance.of uncovering possible deficiencies in the integral breaker assembly and individual components.
- 4.
Maintenance and Surveillance Procedures During the review, it was determined that no specific maintenance procedure e?<isted at the Salem facility to conduct preventive or corr:-ective maintenance on the reactor-trip circuit breakers.
The maintenance conducted in January 1983 was not pe~formed in accordance with the latest Westinghouse recommenda-tions, which were contained in *west inghouse Techni ca 1 Bulletin NSD-7_4-1, as amended by technical data letter NSD-74-2.
Additionally, no program of preventive maintenance had been conducted on these circuit breakers since original installation.
With respect to surveillance testing, the licensee conducted a functional test of one of the two reactor-trip circuit breakers every month, so each circuit breaker was tested once every two months.
The surveillance tests involved tripping a circuit breaker by use of the UV trip attachment.
The licensee also operated the circuit breakers weekly by exercising the shunt trip attach-ment. In view of the number of reactor-trip circuit breaker failures-at Salem, it appears that the periodic surveillance testing was ineffective in detecting 8
- e.
reactor-trip circuit breaker failures of the type ex~erienced on February 22
- and 25, 1983.
The licensee has now developed a maintenance procedure and preoperational verification program.
The NRC staff initial review of the procedures and pro-g*ram identified certain deficiencies (see Appendix B).
Licensee Action - Short Term The licen~e~ has now.~eve~~ped a specific preventive rnaintenanc~ ptoced~re for*
use on the reactor-trip zircuit breakers (including the UV-trip attachment),
which is ba~ed On all applicable vendor*maintenarice recommendations, appropri-ate qua~ i \\:y -as ~.i:rance (QA) requirements, and post maintenance testing.
The licensee has proposed monthly testing of the main reactor-trip circuit breakers by use tif the.UV trip attachment and weekly*testing of the reactor-trip *circuit breakers *by use of the shunt trip.. attachment.
We do not agree with the weekly testing interval of the shunt trip attachment, as further.
discussed in _Appendix B, and will al~o require that the ~ssociated bypass breake~s be tested pri~r ta plant.restart and at e~ch refueling ?utage.
Licensee.Action -
Lon~ Term*
The NRC wi 1.1 re qui re that.the 1 i censee i n~rForate results of a 1 ong-term verification testing of the reactor-trip circuit bi'eaker into maintenance. and surveillance programs.
This action should be completed within two months of completion of long-term testing.
NRC Action -!*Short Term The NRC staff has completed an initial review of the surveillance and mainte-nanc~ program ~nd its procedures.
Certain defici~ncies have been identified (see Appendix*B).
The licensee will be required to complete action necessary
- to resol~e the identified deficiencies prior to restart and to reduce the frequency of testing the shunt trip attachment unless compelling reasons to the contrary are developed.
NRC A~tion ~ Long Term
. NRC *w; 11
~valuate the 1icensee 1 s proposed lubrication requirements for the UV tri'p attachments (i.e., type of lubricant, frequency of *lubrication, points of*
.application, etc.).
NRC will also* assure that results of long-term verifica Q
tion testing of the reactor-trip circuit breakers are aqequately incorporated
.*into maintenance and surveillance programs to determine testing frequency, inspection requirements, and lifetimes.
The evaluations will be conducted with the assistance of the Franklin Research Center (FRC) and the Brookhaven National Laboratory (BNL).
I
-~
10
I
- e.
"I
- 8.
.Ope.rating Proce.dutes ;*: Operato.r* Training,. and Operator Response Issues
- Based on examination of t:he circumstances associ*ated with the events.involving rea*ctor-trip circuit breakers, certai*n issues have been identified relative to procedures, training, and operator response. They are
- 1.
Operating procedures for reactor tri.p and* ATWS
- 2.
Operator training *effectiveness* relative tc:i the RPS and associ ate*d
- i ndi ca tors
- 3.
Operator response These issues are discus.sed in the sections below.
- 1.
- and Antici ated Transients Without Interviews with control room operato~s were conducted by NRC staff, and a review of the operating procedure.for ATWS and reactortrip (EI-4:.3) have revealed'that a) the operators do nc:it take immediate action to initiate a manual trip based on reactor-trip 11first-out 11 annunciators, b) they were not directed to do so by the procedure; however,. the pr.ocedure did require a manual trip if an automatic reactor trip di¢ not occur.
The procedure required only evaluation of reactor power le-vel rem-aining high and/or multiple control rods failing to insert, and c) at least one operator questioned the appropriateness of the ATWS,procedure's step to trip the turbine, without
- first verifying that the reactor had tripped, since that results in a loss of*
heat sink.
Based on these discussions with op~rators,. the staff believes that the revised procedure dated March 2, 1983, would not have substantially changed the operators' response due to q perceived need to evaluate plant stat~s from control room indications.
Litensee Actiori - Short Term
- 1.
The NRC will requi're the licensee to identify the indications in the con-trol room that provide positive indication, without operator analysis or verification, that an automatic reactor t~ip demand is present.
- .2.
The NRC will r~quire the licensee to.revise procedures to direct the operators to insert*a manual trip whenever positive indication of an automatic trip demand is present*without delaying to evaluate the overall plant status.
3~
The NRC wi 11. requi*re the licensee to review the basis for the ATWS proce-dure steps and.order of p~i ori ty in light of the operators 1 concern, revise the procedure as necessary, and train the operators on the bas1s for the procedural steps and importance of procedural compliance.
- 4.
The NRC ~ill require that all operators be trained.on the revised proce-dures prior to restart of Unit 1.
- Licensee Action - Long Term The NRC will require the licensee to incorporate any procedural changes for Unit 1 into Unit 2 procedures and retrain Unit 2 operators on revised proce-dures prior to Unit 2 restart.
NRC Action - Short Term NRC will review the adequacy of licensee's revised procedures and basis *for the procedural steps and order of priority.
NRC will also review.the adequacy of the Westinghouse Owners Group, Emergency.
Operating Procedure Guidelines.
- 2.
Operator Training Interviews conducted by NRC with the licensed operators who were onshift during the two* events indicate a lack of familiarity with the functions of the annunciators and indicators associated with RPS.
The interviews also revealed that* the operators who were onshift during the February 25 event did not recognize that a failure of the RPS had occurretj until-approximately 30 minutes.after the event.
Specifically, the operators interviewed were not able to describe whether the reactor-trip-indicator light (red) on the RPS mimic status 'panel indicated a demand for* or confirmation of a breaker *trip.
Interviews also indicated that at least sOnie*oper-ators questioned the validity of annunciators until they could be confirmed by* independent indication.
This need to verify caused the operators not to take immediate action to trip the reactor based on annunciator indication and verification of reactor power level remaining high and/or multiple control rods failing to insert on February.25, 1983 as discussed in op~rator response issue 8.3.
In any event, it is apparent that training in the areas of the RPS and associ-ated indications and alarms is warranted.
Licensee Action - Short Term The NRC will require the licensee to conduct the additional training r~quired in issue B.l and additional training on the RPS and associated indications and alarms (specifically whether these are demand or confirmatory and the use of this information), and to review the February 22 and 25 events with all operators.
Licensee Action - Long Term The NRC will requ~re the license~ to assure that RPS training and associated subjects in the operator qualification and requalification program address the areas of (1) logic function of the RPS and (2) operation of the RPS and asso-ciated indications.
This training shall be incorporated in the ongoing regular training programs.
- e.
NRC Action - Short Term
/
- NRC will evaluate the adequacy and completion of remedial training prior to Unit 1 and Unit 2 restart.:*
NRC Action-Long Term NRC staff will audit the li~ens~e 1.s.requalifitation ~r6gram.
- 3.
Operator Response Interviews with operators on shift for the February 22 and 25; 1983 events and.
with I&C and mainten~nce personnel disclosed the following:
- a.
In both events, the operators took 20 to 30 seconds to determine the overall plant""st~tus and initiate a manual re'actor trip*.
For the.first event, this evaluation began-with the -electrical *bus transfer failure.
This eva 1 uation was heces*sary beta use of the resulting 1 arge number of a 1 arms and lost equipmerit* *contra 1 s and. status i-ndi ca tors. : This eval-:-.
uation time was nearly identic~l to the ti~e it took for the* plant conditions to degrade causing ttie RPS to provide.an automatic reactor trip ~ignal. For the second ev~ht, the evaluation of ~he plant status began when* the rea.ctor trip annunciator actuated and the *evaluation determined that a reactor trip was in-fact nef:essary"based on plant parameters and control 'room indicators.
This time could have been.
shortened had the operators recognized that an earlier valid trip was called for by the RPS.* :
- b.
During ~he first event, after an operate~ was directed to manually trip (scram) ~he reactor, the switch handle was not operated *correctly.
When the SRO c~lled for a ma~ual trip, the control handle was inadv~rtently
- pulled off the board an*d *had to be reinserted to perform the manua 1 trip.
- c.
Becaus~ of the near coincident automatic trip signal, this may have con-tributed to the operator's failure to recognize that the automatic trip*
system had called for a trip and had fai~ed to trip the reactor prior to the manual trip.
In spite of the positive indication df the reactor protection system failure during the second event, the operator~ neither understood nor trusted the indications.
Because of this the operators unnec~ssarily reevaluated plant status.
The operators m~nually tripped the reactQr in response to their eval~atinn of the plant status and control room indi-cators.and not due to recognition of the failure of the reactor protec-tion system.
- d.
NRC was initially informed by licensee I&C and maintenance person~el th~t the first out pane.l and RPS logic systems*.are highly reliable.
Based on this information and the NRC's general understanding of the logic of these systems, the NRC concluded that the informa~ion provided in the Salem control room (i.e.,.first out panel alarms, illuminated RPS dis-plays, and safety grade instruments) was adequate to enable operators to immediately identify an ATWS event.
Subsequent to this initial 13 c.
conclusion and based on NRC questioning of the licensee on March 3 and 4, the licensee conducted tests which indicated that short-duration signals (less than 10 milliseconds) could produce a reactor trip annunciation on the first out panel and a computer printout indicating a reactor trip without initiating the reactor protection system.
However, after review-ing test results, the.licensee concluded that the testing indicated the system was functioni'ng as designed and that it required trip signals of more than 10 ta 12 milliseconds duration.to actuate*the reactor-trip circuit breakers and seal in the reactor protection system.
Accordingly, the current design of the first out panel can result in operators ques-tioning_ the reliability of the information provided on this panel.
Based on the above, the NRC concluded that for the event on February 22, the operators' response was prompt and fully satisfactory.
For the event on February 25, taldng into account the deficiency in-the reactor trip procedure and deficiencies in training that resulted in (1) operators ~ailing to recog-nize an RPS reactor trip demand and (2) the operators failing to understand the control roo.m indications, the operators* response time.was reasonable.
licensee Action ~ Short Tenn
- 1.
The NRC will require that in addition to the training required in issue 2, operators must be cautioned on.the use of the manual trip 11J 11 handle control.
licensee Action - Long Term
- l.
The NRC will require the licensee to evaluate alternative means to
- permanently secure the 11J 11 handle as part of the Detailed Cantrel Room Design Review.
- z.. The NRC will require the licensee to reevaluate the design of the first out panel system with regard to the reliability of information presented to operators, as a part of its detailed control room design review.
NRC Action - Long Term
- l.
The NRC staff will evaluate the licensee's findings and corrective actions related to these long-term actions as part of the NRC review of the licensee 1s*detailed control room design review.
The licensee 1s schedule for completion of the detailed control room review will be sub-mitted for staff review on April 15, 1983.
14
- e.
C.
Management Capability and Performarice The deficiencies identified durin~ th~ review o~circumstances surr6unding these events raises the question of the responsiveness, practices, and capabi-lity *of licensee management at the corporate and station level.. Additionally, a* number of specific m~nagement -issGes directly related to the failure of the reactor trip breaker events were also identified. The isiues discussed in this section are:
- 1.
Overall Management Capability and Performance
- 2.
Master Equipment List
- 3.
Procurement Procedures
- 4.
Work Order Procedures
- 5.
Post Trip Review
- 6.
Timeliness of Event Notification
- 7.
Updating Vendor Supplied Information
- 8.
Involvement of QA Personnel :with oth~-~tation Departments
- 9.
Post Maintenance Operability Testing
- 1.
Overall Management Capability and-Performance.
\\.
Historically", PSE&G mahagemeri.t-has not displayed the expected aggressive effort to self evaluate. and redirect efforts to correct internally identified probiems.
However, the licensee has re~ponsed the* specific evaluations con-ducted by external organizatiohs such as INPO, NRC and consultants.
E~ch of these are discussed below.
The 1981 INPO evaluation identified opportunities for improvement in numerous areas including-=
staffing, personnel safety practices, adh.erence to procedures J control of documents and design changes, availability of technical support, operating practices with respect to inoperable alarms and tagouts, shift turnover procedures; and goals and objectives.
Based on cintinuing observation, the licensee responded positively to
~elected findings by various actions although the effectiveness of these actions ha~ been less* than expected.
The area of preve~tive maintenance, beyond that required by technical speci-fications, was also raised as an issue by INPO in 1981.
The licensee instituted a program to be responsive to this INPO concern, but the recent 1982 INPO report still contains Findings and Recommendations and identifies a target date for completion of this effort in February 1983.
It should be noted that the reactor trip breakers were identified by the licensee for inclusion in this program.
15
.Based on the 1982 INPO report additional findings were identified in the areas
-of industrial safety, use of the computer tagging system, backlog-of work orders, drawing revisions and plant modifications, adherence-ta established radiation protection procedures and policies, and material and housekeeping conditions in the axuiliary building and intake structures.
Four SALP assessment were conducted by the NRC during the period October 1980 -
October 1982.
The earlier assessments identified weaknesses in the areas of:
design c.hange documentation, engineering support responsiveness, health physics, physical s_ecurity and.. overall management followup to numerous areas.
The later SALP assessments ac:k.nowl edge licensee management attention, to, -and improvements in the areas of, design change tracking and documentation and health physics.
Physical security, despite several initiatives on the part of the licensee to improve the area, continued to be weak.
Very recently, the licensee has dedicated considerable resources ta physical security wh"ich, if properly implemented, should facilitate a number *of hardw~re improvements and add several managers to the organization to more effectively monitor security activities on a day~to-day basis *
. The most visible committment made by-the li.censee are organizational.
During
.the licensing process for Salem Unit 2 in 1981, the licensee made a decision to place all activities, including engineering under a single vice president.
Commit~ments were made to recall these activities from the corporate offices in Newark, New Je-rsey to the site located in *Southern New Jersey.
While the licensee was hopeful that such re 1 ocation-of *the engineering staff, incl udi.ng QA personnel, to the site would prove more effective, thi process has moved much more slowly than hoped and has even resulted in the loss of certain personnel.
As late as January 1983, the QA department.was, placed in the
- Nuclear Department, and began moving to the site.
The organizational and loc~tion ~hanges have now been in transition for almost 18 months.
Station organizational changes were also made to focus effort approiately and a number of new data management systems were installed to track issues for management followup.
With respect to safety review *committees, NRC inspection experience has shown that the onsite and offsite review committees are properly constituted, meet frequently, and ask cogent questions.
Since licensing of Unit 2, the licensee has maintained a separate independent Safety Review Group (SRG) with a general charter to *identify and evaluate safety issues.
In response to an NRC request, the licensee has agreed to evaluate the effectiveness of the SRG in terms of types of issues addressed and more importantly, the approach to and timeliness of the licensee 1s response to such recommendations.
PSE&G management is generally capable and has been willing to make changes to improve safety. While the licensee has demonstrated his ability to react to external direction, and strong self-assessment program has not been effectively carried out that would identify the specific deficiencies identi-
. fied* by the several external review efforts discussed previously, or of equal importance, to identify and rectify their root causes.
r Li ceris ee Act i on-Shor.t Term.
NRC will require the licensee to determine whether t~e currently identified problems with the ~eactor trip breaker~ are indicative of broader based pro-blems '.With the administrative and man~gerial control system.
Licensee has committed to evaluate the effectiveness of the independent SRG in terms of issues addressed and resolutions.
ln.partituTar, the evaluation should address the role of SRG with respect to the August 1982 and January 1983 reactor trip b!eake~ problems.
NRC*Action -- Short Term
- NRC will review the licens~e 1 s evaluations a~d will require the licensee to address* any broader *based. pro bl ems identified as a result of_. that eva 1 uati on.
. Li cens~~ Action _-'.:"Lons Term Contiriue management initiatives aimetj at imp~oving organizational.respon-siveness ta identifying and resolving problems, particu*larly in the area*s of proc~dure adequacy and adherence.
NRC Action - Lonq Term Continue to review the. *adequacy ~f managemen_t_ control and ti me ly re solution of problems through an aug~ented inspection program.
~
~
Master Equ,ip~nt Li.st 1
- 2.
Th~ licensee'.maintains a Q. list that identifies activities, structures, and sy.stems to which the Operational Quality Assurance (QA).Program applies.
A Master Equipment List (MEL) is used by i;.he licensee as the reference document for deterrnining the safety classification of individual equipment.
The MEL is intended to be a comprehensive list of all station equipment and identifies each item as nonsafety related or safety related. When preparing maintenance work orders, the MEL is consulted to determine if QA coverage of the work is necessary.
Licensee and NRC review identified three problems associated_ with the MEL.
These proble~s are, 1) the accuracy and completeness of the docu-ment, 2) issuance as a noncohtrolled document, and 3) lack of uriderstanding-by plant personnel of ~ts proper use.
The MEL was derived from engineering source documents and a construction program document called Project Oirec~ive 7 (PD-7) and was provided to station personnel by the Engineering Department as a reference document in Ju1y 1981.
Prior to iss~ance of t~e MEL, the P0-7 was used as the reference document.
The MEL, howev-er,. was not issued as a controlled document, therefore verifica-tion of its accuracy and completeness on issuance was not assured, and it was not updated in the plant as necessary.
The reactor-trip circuit breakers were not included in the MEL.
In addition, some personnel were not familiar with how to use th~ MEL for determining the classificat~on of a particular piece of equipment.
M~intenance personnel acknowledged that reference was made to PD-7 on occasion during the January - February 1983 period*.
17
~*.-
-'-'---~._
I Licensee Action - Short Term The NRC will require that the licensee:
- l.
Verify the MEL is complete and accurate with respect to emergency core cooling (ECCS) including actuation systems, RPS, auxiliary feedwater, and containment isolation systems.*
- 2.
Instruct appropriate personnel in the pur)3*ase and use of the MEL.
Licensee Action - Long Term NRC will" require that the licensee verify the completeness and accu~acy of the MEL and reissue it as a controlled document.
NRC Action - Short Term NRC wi 11 perform samp 1 i ng* review of the MEL on the above systems.
NRC Action - Long Term NRC wil 1. confirm comp 1 eti on of the 1 i censee' s long-term acti,on.
- 3.
Procurement -Procedures A review of safety and quality classifications for the reactor trip breakers indicates that the licensee's established management and administrative controls allowed the procurement of replacement components for a safety system*
with a quality less than that of the original design.
This is evidenced by procurement activities concerning the purchase of reactor trip breakers and replacement components conducted during the period from June 1, 1981 to March 1, 1983.
One example involved the issuance of a purchase order for a spare reactor trip breaker on June 1, 1981.
Contrary to the established administra-tive controls; the breaker was classified incorrectly; the proper review and -
approval was not conducted; and no QA requirements were imposed as required for the original equipment.
Subsequently, on September 15, 1982, the classi-fication for the same order was changed to an even ~ore inappropriate classi-fication without the required review and ~pproval process.
As a result of*
these activities, the purchased-breaker was received and placed into storage, without further use, without appropriate documentation that would demonstrate suitability for its use had it been required.
All subsequent purchases for reactor trip breaker components consistently
- utilized the initial incorrect classification.
A spare coil for a UV trip attachment purchased in this manner may have been utilized on August 20, 1982.
Though the procurement review focused on the reactor trip breaker, the licensee's activities in the area for other safety related components could have resulted
- in s-imilar circumstances existing for plant safety systems.
Licensee Action - Short Term NRC will require and the license~ has made a commitment to have the procure-ment procedures evaluated and modified as_ required to ensure that the appro-18
J I
priate classification is b~ing applied to items and/or services important to safety.
Pending satisfactory resolution of this item and a commitment by the licensee to develop and implement a program comparable to that described under Long Term, the staff. consi~ers this issue sufficiently resolved to permit restart.
Licensee Action
.. Lona Term
- The licensee.. wi 11 re.view the organi za:ti on re l'ati onshi ps i nvo 1 ved in the procurement.process.~nd assess the cu~rent management controls to provide and
.ensure that* departure from expected performance of personnel involved in the procurement *process will be appropriately flagged for management at~ention~
Additionally, the licensee will formulate a plan to revie~ a~d assess on a s~mpling basis the procurement ~roce~s as it relates to all ~rior procufe~~rit activity on systems important to safety.
The *plan will address the sche.dule,
- and criteria to be applied for an ~ccelerate.d samplihg based upon initial finding.
- 4.
Work Order.Procedures *
- ~.
The review identified that the personnel preparing maintenance work orders were not complying with instructions contained in the station administrative procedure.
Specifically, for the work pert~rmed on the reactor:--trip circuit breaker in January 1983, the engineering department was not consulted to * :
verify safety classification, and an erroneous nonsafety'determination* was made.
Such tonsultation is. required* if equipment:is not listed in the MEL.
There was,.therefore, no independent review within the maintenance organiza-tion, and the Quality Assurance Department was not involved in the work.
Historically~ there was no requirement for QA personnel* to be involved in the review of work* orders. as they were processed to assure that appropriate steps*
were: taken to assign tlassification. It should be noted, howeveri that all other work orders* for maintenance or services on the reactor trip breakers were found tci be properly designated safety-related.
Lice~iee Acti6~*~ Short Ter~
- The licensee has made a *commitment to have the QA Depart"ment review all non-safety related work orders prior to starting work, and to implement *a program and training to ensure that work orders are properly classified.
NRC will require the licensee to review work orders written since issuan~e.of
- the MEL for proper classification and will *evaluate safety consequences.of these found improperly classified.
NRC Action - Short Term NRC will review licensee's work order classification progra_m.
- 5.
Post-Trip Review The licensee did not determine that there had been a failure to trip on February 22 unt i1 the compute.r pri nto*ut of the sequence of events *was re-19
r l
- evaluated on February 26, as a result of NRC inquiries.
Although the licensee conducted a review of each trip, there was no formal procedure for -conducting
_a systematic review.
By letter dated March 1, 1983, the licansee made a commitment to develop-a post-trip and post-safety injection review procedure.
The procedure will specify the review and documentation necessary to determine the cause of the event and whether equipment functioned as designed.
Other.
key elements of a post-trip review procedure are 1) necessary management authorization for restart, 2) debriefing of affected*aperators, 3) verifica-tion that reporting requirements '#ere completed~** and 4) followup review by safety committees.
F~rthermore, the affected individuals who will be required by procedure to review the sequence of events computer p~intout and other event records will need to receive necessary training in the proper interpretation, understanding and evaluation of these records.
Licensee Action - Short Term NRC will require and the licensee has committed to develop and issue.a post-trip and post-safety-injection review procedure and train appropriate Opera-tions Department personnel on the. requirements prior to Untt 1 restart.
NRC Action - Short Term NRC will review the licensee's post-trip and post-safety injection review pr-ocedure*to ensure ~he key elements*noted above are adequately addressed.
- 6.
Timeliness.of Event Notification On three occasions between January 30 and February.25, 1983, the licensee notified NRC of significant events belatedly.
In each case, the notification was approximately 30 minutes late.
Two of these reports ~re for the February 22 and 25 *events.
Furthermore, in the February 22 event, the first notifica-tion did not contain known significant information regarding actuation of engineered safety features and opening of the power operated relief valves.
This additional information was provided approximately 40 minutes later.
The notification procedures used by the licensee warrants further evaluation as to the priority assigned for NRC notification.
Licensee Action - Short Term NRC will require the licensee to reemphasize reporting requirements with all shift and on-call management personnel and will reevaluate notification
. priori ti es.
NRC Action HRC will confirm that licensee's short term action is completed.
- 7.
Updating Vendor Supplied Information As a result of the February 25," 1983 event and NRC IE Bulletin 83-01, the licensee indicated not being aware of the existence of two Westinghouse technical service bulletins that provided preventive maintenance recommenda-tions for the reactor-trip circuit breakers.
The two documents in question 20
- e.
. *--* - - --* ***---.,..~*--
- were published by Westinghouse in 1974.
The license~ has requested documenta-tion for all Westinghouse equipment and will incorporate this information into station documents.
While we are not aware of any problems with other vendor documentation, an NRC staff concern is whether a similar situation exists with respect to documentation for other vendor-supplied information; Licensee Action - Short Term The licensee has mad~ a commitment to a program to update existing documenta-tion on safety equipment and to ensure that vendor documentation is under a controll~d system.
Licensee Action - Long Term The licensee will-complete the above program in a timely manner.
NRC actio~.- Long Term NRC wil 1 perform inspections to v~rify the._impl ementat ion of licensee Is program.
- 8.
Involvement of QA Personnel with Other Station Deoart~ents The Quality Assurance Department did not review maintenance work orders associated with repair of the reactor-trip circuit breakers in January 1983 because the work was not designated safety related.
Further examination d~termined*that the QA Department does not ~eview for proper determination of classifitation the work orders designated nonsafety rel.ated by other depart~
.ments.
Discussions with the licensee indicate that the QA Department has been some.what isolated from the activities of other departm.ents.
As a result *of prior deci s i ans, the licensee had initiated steps in January 1983 to relocate ~he QA Department from the corporate offices in Newark, N.J.
to the site and is taking steps to increase QA Department involvement in other station ~ctivities. Completion of this program of increased QA involvement with oth~r station activities need not be completed prior to restart, because completion of short-term actions in management issues 5 and 6 is sufficient to correct QA deficiencies in the short term~
License~ Action - Short Term
, The licensee has made a commitment to institute a program to more fully integrat~ QA' activities into the overall actiyities.
Licensee Action - Long Term The licensee will complete the cbove QA integration program.
NRC Action - Long Term Monitor li*censee's implementation of the above QA integration program.
- 9.
Post-Maintenance Ooerability Testing
Past practice at Salem for post maintenance operability testing has varied *
. Such testing may be specified by the preparer of the maintenance work order or
. left to the discretion of maintenance personnel.
For safety-related equip-ment, post-maintenance surveillance testing is done before returning the equipment to service.
Additional functional post-maintenance and repair testing of equipment, such as surveillance testing, may need to be performed to demonstrate operability as an integral part of the larger component or system in.which it must function.
Licensee Action - Long Term The licensee will review and revise procedures and practices as necessary to ensure that functional testing of the overall components or system is per-formed to demonstrate operability prior to returning the equipment to service following maintenance and repair.
Procedures will be revised, as necessary, to assu.re that operations department personnel rev*i*ew the testing prior to returning such equipment to service.
NRC Action - Long Term
. NRC will review licensee 1s revised procedures and their implementation to
... assure that appropriate post maintenance operability testing is being accom-plished before equipment is returned to ser.vice.
22
Appendix A RESULTS OF NRC STAFF EVALUATION OF EVENTS AT SALEM NUCLEAR GENERATING-~TATION I.
IDENTIFICATION OF CAUSE Of FAILURE Summary. and. *rnitial Findings Initial inspection of the UV trip attachment indicates a* possibility of multiple con-tributing causes of failure..
Possible contributors are (1) dust and dirt; (2) lack ~f lubrication; (3) wear; (4) more frequent oper~tion than intended by design; (5) corrosion from improper lubrication in January 1983; and (6) nicking of Jatch surfaces caused by vibration* from r.epe.ated operatia*n.
of the breaker.
The contributors appear to be cumulative, with no one main
- Ca.use. The.initial*investigation indicates that the failure was age related and that a n*ew device would perfo*rm properly.
Many surfaces of the 1 atch mechanism.are worn and the additional friction tended to p*revent proper operatiori.
Proper lubrication throu~hout the life of the devit~ might have
- prevented-the wear that can be seen on the ~ample.
lhe tests and examinattons proposed by the staff and its contractor will attempt to determine the cau~e of failure._aT}d if *possible reproduce it.
following summarizes the initial findings and lists the er.oposed* tests.
The Discussion and Circumstances i
A site visit.was conducted on March 3, 1983 by NRC and Franklin Research Center. personne 1 to inspect the type DB-50 circuit. breaker undervo 1 tage trip attachment in an effort to d~termine the most*probable cause of failure.
The reactor.tri~ circuit breaker rooms for Units 1.and.2, each of which contain four DB-*50 circuit breakers, were vi sua 11 y inspected and the.fo 11 owing obser-
- vati ons w~re made:
- 1.
All" four 08-50 Unit 1 *circuit breakers and UV *trip attachme9ts were removed from the circuit breaker cabinets.. The enclosures were generally clean-and free of dust.
- The ambient temperature was between 85 and 95°F, with warm exhaust air from inverter cabi~ets bein~ directed at the DB-50
- circuit breaker cabinet~. The ~pacing bet~een cabinets is approximately
. *2.
3 feet.
All four DB-50 Unit 2 circuit breakers were also inspected.* The UV tiip attachments were* removed, however.
The circuit breaker cabinets con-tained a layer of loose dust approximate.. ly*l/16 inch thick.
The ambient temperature was in the 70°F range.
UV trip attachments are mo~nted on the top of the circuit-breaker platform, to the right of the shunt trip attach~ent, which is several inches from the bottom 9f the circuit breaker cabinet.
Interviews were conducted with an electrical maintenance supervisor who discussed the circumstances of the removal of the circuit breakers that were involved with the incident on Unit 1, and an electrical supervisor who had*
23
--~---------
a*lso worked on the circuit breakers in question in August 1982.
The informa-
- tion received was that the circuit breakers and their UV trip attachments had been operated frequently and had operated during surveillance testi~g within a few days prior to the incident.
' A request was made to Salem management to provide one of the UV trip attach-ments and a shunt trip attachment for testing at Franklin Research Center (FRC).
This request was complied with, and an.... investigation of these devices is now under way at FRC.
Results of Initial Examination Initial evaluations indicated roughness in the operation of the trip latch.
There is some dragging of the mechanism, and portions of the latch mechanism have obvious signs of wear.
Possible contributing factors to the failure to operate are a lack of lubrication, wear, jarring'of the UV ~ttachment as a result of circuit breaker operation and more frequent operation of the UV trip attachment than was intended during design.
It is postulated that under most industrial applications, the UV attachment would be used.very infrequently and probably would be operated only during test sequences at perhaps yearly or longer intervals. Therefore, in industrial applications, it would operate
- only a few times, perhaps 20 or* 30 cycles during its life~ime, and would not be a normal tripping mechanism for the br~aker. However, in its use at Salem and other nuclea~ power plants, it is.the_prime tripping device for the.
circuit breaker, and is therefore called upon to.qperate on the order of 50 times per year.
This.would mean that at its current age:* in 1983, there* would have been possibly 400 to.500 trip opera~ons of this device.
During the initial* evaluation it was noted that the shunt trip attachment has been operated once every seven days since August 1982, rather than at longer intervals. This means that the circuit breaker is tripped and closed every seven days.
This causes jarring of the entire mechanism of the circuit breaker and its attached relays and coils due to the normal operation of the breaker.
This may or may not be significant, but it should be noted that the UV attachment stayed energized during these trips, and its latch mechanism was jarred somewhat by operation of the circuit breaker.
This possibly added to the friction built up in the latch mechanism from normal operation by causing the latch mechanism to just slightly nick the surface that it rides on and thereby tend to prevent opera ti.on.
Further investigation wi 11 try to deter-mine whether this is indeed a problem.
It appears from initial inspection of.
the device that wear and roughness of mating surfaces in the trip latch are present.
Proper lubrication might have prevented the current situation or could have reduced the roughness to the point where proper operation could occur.
Further investigation will attempt to determine whether the CRC-2-26 lubricat-ing and cleaning spray added to the operating problem by either causing cor~osion or removing all residual lubrication from initial construction and possible caking of dust and dirt. It appears that from the time of initial constr~ction of the UV trip attachments up until January of 1983, no *lubrica-tion procedures had been performed, and then, in January of 1983, lubrication
- procedures were undertaken by the maintenance personnel and a Westinghouse 24
- technician.
At this time, *the CRC-2-26 lubricant cleaner *was sprayed on all four-UV trip attachments associated with the Unit 1 tircuii breaker.
This 1ubricant is being procured by *FRC_for ~esting pu~pcises.
Li.st.of...Irive$ti gati ons To Be. ~erformed by *NRC Cqntractor. (FRC)
~
- 1.
- 2.
- 3.
The first test will be to perform* various deenergizations and energiza-ti o'ns of the UV trip. attachment and moni toi:- the* device under various conditions.
The second test wi 11 be to di sasse.mbl e the 1 atch. niechani sm to observe the*
surfaces o{ the' various parts of the latch and to photograph these sur-faces through a microscope to determi'ne the vari.ous 1 eve ls of wear on th-ese surfaces.*
The third. te'st is. to deter~i ne the effects. of CRC-2-26 **spray on the various types of metals used-:in this devices.
An attempt-will b~* made to.
use ~etals other*t~an tho~e in the actual attachment..
If possible, t~e chemical consist ency. of this spray wi 11 be determined from the manu-facturer.
-. **~* -
To prove that the sample* uy**trip attachment 1s identical to all such Salem devices,.a visual *;nspe~tion of all existing Salem Unit 1 and 2 UV trip att;.a~hm*ents will be performed.
This can..talse place at Salem, with no disas;..
semb ly needed. *The inspection can be made wi"th th:e de vi ~es mounted on the*.
-circuit breakers or loose.
These inspections should be done as soon as
~
possible, and Tuesday, March 8, 1983 is recommended.
If further t~sts are required they will be based on the results of these initial tests.
All tests will be nondestructive such that the device-can be used for further testing and returned to the utility.
Additi_onal Test. To B7 Conducted_**by.th~. Licensee, as* Revise_d..by NRC Staff This test will *re~uire thg ~se of a spare.circuit bte~ker.**~rhe UV trip and shunt trip attachments will be mounte*d on the breaker, and the breaker wi 11 be operated repeatedly to.determine the ef f~ct on the s*hunt and UV trip attach-ments.
It is surmised that whi 1 e the attachments are energized and the breaker trips and closes a number of times, additional friction of the trip*
latc*h may occur from the vibration.
This test is described in detail in the
- following section.
.. II.
REVISE;D S.URVEILLANCE. OF REACTOR-TRIP CiRCUIT. BREAKER. OPERATION AND VERIFICATION.. TES1ING:*.
The licensee p~6pbsed th~ following -increased surveillance of r~actor-trip cir~utt breaker operation:
- l.
Main and bypass breakers will be shunt-tripped weekly.
- 2.
Main breakers will be UV-tripped monthly.
25
. -~
- .**\\.*
- ~~
.r*".*
.~.
The acceptability of this revised surveillance of reactor-trip circuit breaker operation has been evaluated by NRC staff.
Based on an analysis conducted by NRC staff, which considered reactor-trip system unavailability, reactor-trip circuit breaker failure rates, and test intervals, the following conclusions were drawn.
First, the proposed test of each reactor-trip circuit breaker UV'=--=.:.=_
trip attachment once every 30 days is acceptable.
Second, the proposed test of the shunt trip attachment once every seven days is considered to be exces-sive and may impac:t on the reliability of the-r~actor trip system by increas-ing the potential for a single failure.
During.testing, a single failure in'
-the logic portion of the reactor trip system could prevent an automaticSCRAM.
Thus, it is recommended that the shunt trip attachment be tested on the same schedule as the UV trip attachment; that is, once every 30 days.
It i.s also recommended that the UV trip of the bypass breakers be tested prior to restart and every refueling thereafter.
Discussion The acceptability of the proposed test intervals for the reactor-trip circuit breakers was based on NRC staff review of reactor-trip circuit breaker failure rate* data obtained ffom Li~ensee Event Reports (LERs).
The generic RPS unavailability of 3x*10- 5 (used in both NUREG-0460, 11Anticipated Transients*
Without Scram for Light Water Reactor~,
11 and by the ATWS Task Force and Steering Group in the development of the proposed ATWS. Rule) was used in evaluating t~e licensee's proposed test in~~rvals. In addition, the following considerations were incorporated into the NRC_staff recommendation:
- 1.
The shunt trip attachment provides a diverse means of tripping the reactor-trip circuit breaker, which is electrically independent of the UV trip attachment.
The UV trip attachment is supplied by a 48-V de source and is deenergized to trip. The shunt trip attachment is supplied by a 125-V de source and is energized to trip.
- 2.
The shunt trip attachment is an energize-to-actuate device and.is not 11 fai1 safe 11 in that a loss of power will not cause a trip.
However, the
__ shunt'trip is powered from a reliable Class lE battery-backed source.
- 3.
Since the shunt trip attachment is an energize-to-actuate device; it is not subject to the constant heating effects that the continuously en-ergized UV trip attacDment experiences.
The heating effects may contrib-ute to the higher failure rate of the UV trip attachment.
- 4.
The mechanical construction of *the shunt trip attachment is less complex than that of the UV trip attachment.
The shunt trip attachment does not rely on the successful operation of the complex latching mechanism that has been determined to be the source of the majority of the failures of the UV trip attachment.
- 5.
The majority of the electrical circuit breakers used in the high-voltage electrical distribution system have de-powered energize-to-actuate shunt trip attachments.
These circuit breakers are used for manual, as well as
- . automatic, trip functions for load shedding and power switching.
Relia-bility of energize-to-actuate shunt trips in similar applications through-26
1:1 J f
- 6.
out the nuclear power industry has been shown to be significantly higher than for devices that are constantly energized.*
Over 70% of the known reactor-trip circuit breaker failures were caused by UV trip attachment failures~
- 7.
Most of the concerns relating to the events at Salem on February. 22 and 257 1983 are related to the operation Of *the uv*t~ip attachment.
Duri*ng the events at Salem, the -~hunt trip attachment functioned properly.
- 8.
Tile bypass breakers are* required to trip in response to a UV trip demand."
signal should this occur when the main breakers are being tested. Sirce the test frequency of the main breakers has been increased, the bypass.
breakers should be tested to verify the capability to perform their backup safety function.
Veri.fi ca ti on_ Testing It is recommended that a bench test be performed on one 0$-50 reactor-trip circuit breaker.
The purpose of the.test ~ill be to cycle the DB-50 with the UV trip and shunt trip attachments in place far a to_tal of 2000 cycles to determine if any adverse. effects can. be i denti fi ed and, if* there are no adverse effects, show that a properly maintained breaker and *its subcomponents can operate for. an extended number of cycles_.
The breaker wi 11 *be tripped, with each cycle being alternated with the UV and stiunt ti::ips.
The ambient*
temperature should be 100°F to simulate the expected service environment, and the circuit breaker should be cycled no more often than once ev:ery 30 minutes to allow for.return to steady-state conditions.
The results of each circuit breaker operation will be documented and a visual check made.
Additional*
.details for this type of test will be provided at a later time.
27
Appendix B INITIAL NRC STAFF REVIEW OF LICENSEE'S MAINTENANCE PROCEDURE AND PREOPERATIONAL VERIFICATION PROGRAM NRC staff reviewed the licensee's maintenance procedure, Salem Generating Station Maintenance Department Manual Maintenance Procedure M3Q-2, Revision 1.
This document includes a procedure for verifying proper operation of the UV trip attachment and testing of the UV trip attachment coil following replace-ment.
NRC staff also reviewed the licensee's proposed reactor-trip circuit-~
breaker oper~tional verification program, which references Procedure M3Q-2.
The following comments and recommendations we~ made concerning these docu-*
ments:
- 1.
The maintenance procedure does not specify wnetber the maintenance and testing described are applicable to both the.main and bypass breakers.*
It should specify that it does.
- 2.
The maintenance procedure should specify required actions to be taken in the event any acceptable tolerances, as identified in Enclosure 7 of
- 3.
M3Q-2, are not met.
The frequency of all maintenance and testing specified in the procedure, with the exception-of the verification testing identified following UV trip attachment replacem~nt, should be specifjed.
- 4.
The procedure should be modified to require cleaning of the entire circuit breaker* room, the removal of all four circuit breakers and cleaning of the cabinets by vacuuming, and cleaning of the breakers during every refueling outage.
- 5.
Section 9.7.2.1 of Proc~dure M3Q-2 specifies that the UV trip attachment is to be cleaned with a standard solvent.
The procedure should specify the exact solvent to be used.
NRC will request FRC and'BNL to determine the adequacy of the proposed solvent and any potential adverse effects from its use.
(Th1s evaluation need not be completed prior to plant startup).
- 6.
Section 9.7.2~2 specifies the composition of the lubricant to be applied to specific points of the UV trip attachment.
This specification should state whether the mechanism is to be lubricated each time maintenance is performed.
NRC will request FRC and BNL to determine the adequacy of the lubricant and the points of application specified, as well as the fre-quency of lubrication.
- 7.
Any UV trip attachment that does not successfully complete the 25 consec-utive cycles of testing to be performed by Westinghouse should not be
. accepted or installed by the licensee.
- 8.
Section 9.7.4.15 specifies the testing to be performed on the UV trip attachment coil following its replacement.
The maintenance procedure should be revised to require that all replacement UV trip attachment successfully complete 25 consecutive cycles of testing prior to inst,1-28
lation in the plant and start of the ten test cycle specified in the maintenance procedure.
The time between each of the ten tests should be specified.
NRC recommends 30 minutes for the reasons *specified in Appendix A.
NRC staff believe the increase in test cycles, and the acceptance criteria specified if any failures occur during this* testing, are reasonable and should be incorp~rated into maintenance procedure M3Q-2.
. 9.
Technical Dep*artment Proce.dure.s Nos. IIC-18.1. 011 and IIC-18..1. 010, referenced by the licens.ee, should be reviewed and their *acceptability determi*ned by NRC staff.
Following rev~sion of the maintenance procedure and the associated proposed
'reacto~trip circuit breaker operational verification program.to incorporate*
the above comments and recommen~ations, the NRC itaff will reevaluate the
- documents and pro vi de anothe'r report that wi 11. include the res u 1 ts of the NRC *
- cantractor 1 s evaluations and will document the ~inal NRC evaluation and conclusions concerning the adequacy qf the maintenance procedure and preopera-tional verification program.
?Q
p1
,l'r ENCLOSURE 2
.~-*
- e.
UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSJON
- In the Matter of PUBLIC SERVICE ELECTRIC AND GAS COMPANY
)
~
Docket Nos. 50-272 and 50-311
)
I.
L
~-
~*.......
(Salem Nuclear Generating Station, Units l & 2)
)
)
)
License Nos. DPR-70 and DPR-75 ORDER TO SHOW CAUSE I.
Public Service Electric and Gas Company (the l~~ensee) holds License Nos.
OPR-70 and DPR-75 which authorize operation of Units 1 and 2 of the Salem
-* Nuclear Generating Station *. The fac"ilities are Westingho~se pressurized_
water reactors (PWRs) located at the licensee's site at Hancock's Bridge, Salem County, New Jersey.
I I.
On February 25, 1983, an event occurred at Unit 1 of the Salem Nuclear Generating Stat i o*n when the control rods fai 1 ed to insert si nee the reactor-trip circuit breakers failed *to automatically open following receipt of a valid trip signal from the Reactor Protectio"n System (RPS).
The manual trip system was used to shut down the reactor.
Subsequently, it was concluded by*the licensee that the failure to trip was caused by a malfunction of the undervoltage (UV) trip attachments in both reactor-trip circuit breakers.
Evaluation of the ev~nt of February 25, 1983 revealed that a similar failure had occurred on February 22, 1983, at Salem l.
There had also been a previous event at Salem 2 in-volving a failure of one reactor trip circuit breaker to trip on January 6, 1983.
-i.-
'\\
ifl"'
- rhe malfunction of the *undervoltage device on February 25 was determined
~
~
by the licensee and the vendor {Westinghouse) to be excessive friction
- on the mechanical latch lever in the UV trip mechanism.
It appears that no preventative maintenance was conducted on the Salem 1 DB-50 circuit breakers until January 1983.
Additionally, the recommendations of a Westinghouse 1974 Technical Bul 1 eti n.and Data Letter ( NSD DATA LETTER 74-2) were not implemented during the January maintenance since the personnel*
who performed the maintenance were not aware of the bulletin recommendations.
The specific details o,f° the event and the licensee's response are contained in the NRC Restart Status Report of March 1983.
The* NRC review-of the event revealed a number of management inadequacies, such
.~s the management su~ervision and control of the procedures governing the cl assi fi ca ti on of -equipment as safety-related equi pnent, management sup'ervi si on of maintenance techniques, and management attention to the safety implications of system malfunctions.
If there were.a potentially severe transient, from a worst case set of initial conditions, and the reactor shutdown system did not function, an extremely severe accident could occur in the absence of timely operator action.
Therefore, the. technical. significance of tne afore-mentioned failures is readily apparent, and when coupled with the cause of t_he challenge to the reactor protection system, i.e., a feedwater
- 1/
system transient, and the frequency of past feedwater sy~tem transients,-
the event raises serious safety questions regarding the safe operation of the Salem facility.
'j_/ Of primary concern to the NRC is the ATWS (anticipated transient without scram) event initiated by a loss of feedwater transient.
In 1981 and 1982, Salem 1 experienced about 11 and 5 feed transients, res~ectively, while Salem 2 experienced about 14 in 1981 and about 11in1982.
This results in a total average of about 10 transi~nts per unit year of
_____.L.!'--
,.r __
---l..
-~"'-
\\'
- II I The analysis of the event, therefore, raised equipment issues, operational issues and management issues which must be addressed to ensure safe future operation.
The licensee has agreed to take certain remedial actions prior to resumption of operation from the current outage,* as well as certain 1 anger-term acti"ons following restart.
These re.me di a 1 acti ans in-volve equipment issues, o~erational.issues, and management i*ssues.
The equipment issues involve (1} safety classifi*cation of breakers, (2) identification of cause of failure, (3) *verification testing and (4) maintenance and surveillance procedures.
The operational issues involve Cl) operating procedure for reactor trips and anticipated transients wi t.hout scram CATWS L (2 J. operator training and (3) operator response.. The. management issues invo 1 ve (1) overa 11 management capabi l tty and performance, (2) master equipment list, (3) procurement procedures,
( 4) work-order procedures, (5). post-trip revi'ew, (6) timeliness of event noti.fi.catton~ en updating vendoro..supplied information, ('8) involvement
- of QA personn~l with other station departments, and (9) post maintenance operab.i.1 i_ty tes.ti'ng.
The NRC staff has reviewed these proposed correcttve acti ans* and determi. ned that, after imp 1 ementati'on, they wi 11 ensure the safe operation of the faci"lity-.
However, to ensure that permanent corrective acti'ons are in place. and to i'ncrease the relial'Sility of the mitigati'on features of this parttcular facility due. to its liistory, certain other long-term actions are requtred in the interest of tlie public health and safety.
'\\
1,;,
- IV.
Accordingly, pursuant to Sections 103, l6l(i), and 182 of the Atomic Energy Act of 1954, as amended, and the Commission 1 s regulations in 10 CFR Parts 2 and SO, IT IS HEREBY ORDERED THAT the licensee should show cause why it should not be required to:
A.
Within 60.days of the effective date of this Order, submit to the Director, Office of Nuclear Reactor Regulation, a detailed schedule for.accomplishing the following actions as soon as possible:
(1)
Implementing at the Salem facili.ty (Units 1 and 2) the following feature of the proposal by the Industry Group.on AlWS submitted on April 23, 1982, ~n Docket PRM-50-29 (page 10 of Appendix C): provision of automatic initiation cir turbine trip and auxiliary feedwater independent of the reactor protection system; (2)
Providing at the Salem facility diversity in activating (tripping) the reactor from breakers, for example, by incorporating the breaker shunt trip function into the automatic trip circuits of the* reactor* protection system; (3)
Developing and implementing procedures consistent with the applicable emergency response guidelines (letters from Jurgensen to Eisen hut dated Nov ember 30, 1981,
from Kingsley to Eisen hut dated July 21, 1982, from Kingsley to Eisenhut dated January 4, 1983) for AT'WS-type transients; and
~
,J
"* I
"."'5-I
~' (4)
Training operators an¢ advisory personnel on the pro-cedures dev~loped under section IV.A(3) prior to implementation.
The schedule shall be subject to approval by the Director and shall be implemented following such approval.
The Director may modify the approved schedule in writing for good cause.
B.
Within 60 _days of the date *of this Order_, submit to the Di rector their plan and schedule to conduct an evaluation into the background, causes, and circumstances. leading up to the events of February 22 and 25, 1983.
The purpose of the evaluation shall be-to develop a p~an to further improve the management's role in identifying and directing resolution of problems associ~ted with safety-related.equipment procurement, maintenance, surveillance and operations.
The scope of the evaluation will cover all safety-related equiµnent.
The evaluation shall include a review of the methods used by managers to.identify inter-departmental problems that may affect safety-related activities.
The evaluation shall also include an analysis of the effectiveness of existing independent safety review groups with specific examination of their roles in the identification of issues and recommendations related to problems associated with the reactor trip breakers.
The plan shall include the method for rep_orting the results *of the evaluation to the Director, and the licensee's method for implementation of any recommendati ans resulting from the eval_uation and/or the NRC review of the evaluation report.
Upon approval by the Director, the plan and schedule shall be implemented.
The Di rector may modify_ the approved pl an and schedule in writing for good cause.
[:(,...
' v.
Within 25 days pf the date of this order, the lic~nsee may show cause why the actions described in Section IV should not be ordered by filing q written answer und~r oath or affinnation that sets forth the matters of fact and law on which the licensee relies.* As provided in 10 CFR 2.202{d),
the licensee may answer by consenting to the order proposed in Section IV of this order to show cause.
Upon the licensee'~ consent, or upon failure
- of the licensee to answer t;his ord~r within_ the allotted time, *the tenns of Section IV of this _order will become effectiye.
Alternatively, the licensee may request a hearing on this order within 25 days after the issuance of.this order.
My request for a hearing or answer to this order shall be submitt.ed to*the Director, Office of Nuclear Reactor Regulation, U.S. Nuclear Regulatory Commission,.Washington, D. C.
20555.
A copy of the request or answer shall also be sent to the Executive Legal Director at the same address.
If a hearing is he1d on this order, the Commission will issue an order designating the time and place of hearing.
If a hearing is held, the issue to be considered at such a hearing shall be whe~her t~e licensee shall perform the actions specificed in Section IV of this order.
FOR THE NUCLEAR REGULATORY COMMISSION Harold R. Denton, Director Office of Nuclear Reactor Regulation Dated at Bethesda, Maryland, this day of March 1983.
..,