ML18087A821
| ML18087A821 | |
| Person / Time | |
|---|---|
| Site: | Salem  |
| Issue date: | 03/29/1983 |
| From: | NRC |
| To: | |
| Shared Package | |
| ML18087A820 | List: |
| References | |
| NUDOCS 8304110837 | |
| Download: ML18087A821 (40) | |
Text
~
Ma~ch 29, 1983 SALEM RESTART STATUS REPORT BY THE U.S. NUCLEAR REGULATORY COMMISSION PUBLIC SERVICE ELECTRIC AND GAS COMPANY SALEM NUCLEAR GENERATING STATION UNIT NOS. 1 and 2 DOCKET NOS. 50-272 ANO 50-311
SALEM *RESTART STATUS REPORT L
Summary II. Background III. Issues A.
Equipment Issues Contents
- 1.
Safety Classification of Breakers Z.
Identification of Cause of Failure
- 3.
Verification Testing
- 4.
Maintenance and Surveillance Procedures B.
Operator Procedures. Training, and Response Issues March 29, 1983
- 1.
Operating Procedure for Reactor Trips and Anticipated Transients Without Scram (ATWS)
- 2.
Op~rator Training
- 3.
Operator Response
- c.
Management Issues
- 1.
Overa 11 Management Capability and Performa*nce
- 2.
Master Equipment List
- 3.
Procurement Procedures
- 4.
Work Order Procedures
- 5.
Post-Trip Review
- 6.
Timeliness of Event Notification
- 7.
Updating Vendor-Supplied Information
- 8.
Involvement of QA Personnel with Other Station Departments
- 9.
Post Maintenance Operability Testing 2
~.
~.
~March 29, 1983 Sa 1 em Restart Status Repor_t I. Summary Thi~ report briefly describes the NRC and. licensee actions to address and resolve equipment, operator procedures, training and response, and management issues identified by the NRC evaluation of the two events at Unit 1 of the
- Salem Nuclear Generating Station that resulted in failure of the reactor to trip automatically upon a valid signal.
The second event occurred on Febru-ary 25, 1983 and led to the realization that a sfmilar event had occurred on February 22, 1983.
An NRC tas~ force has been established to conduct a separate longer range study of the broader implications of the Salem events.
Long-term actions identified herein are applicable to Salem but may have generic implications.
The NRC task force. will determine generic actions needed for other facilities.
For the Salem facility, longer term actions developed by the task force may comple-*
ment the long-term actions identified here-in.
Short-term actions identified in this report must be satisfactorily resolved before plant startup.
II. Background On February 25, 1983 an event occurred at Unit 1 of the Salem N.uclear Generat-ing Station when the reactor-trip circuit breakers failed to automatically open following receipt of a valid trip signal from the Reactor Protection System (RPS).
The manual trip system* was used to shut down the reactor.
Subsequent-ly, it was concluded by the licensee that the failure to trip was caused by a malfunction of the undervoltage (UV) trip attachments in both reactor-trip circuit.breakers.
These UV tri~ attachments translate the electrical signal from the RPS to a mechanical action that opens the circuit breaker.
On February 26, 1983, an NRC team was onsite to conduct initial followup and to collect preliminary information.
As a result of NRC inquiries, the licensee determined that both reactor-trip circuit breakers had similarly failed to open upon receipt of a valid trip signal on February 22, 1983.
The failure to auto-matically trip on February 22 was not recognized by the licensee until the com-puter printout of the ~equence of events was reexamined in more detail on February 26.
Furth'er eva 1 uation of these events and the circumstances 1 eadi ng
- up to them revealed a number of issues that require resolution by the licensee and/or the NRC.
This report identifies those issues and the short-term actions proposed to resolve them prior to resumption of operation at Salem Unit l* and the long-term actions that are needed following restart.
The short-term actions required for Unit 1 will also be implemented on Unit 2 prior to restart of Unit 2.
- Salem Unit 2 is presently shut down for refueling and is not presently scheduled to resume operation before Unit l~
3
March 29, 1983 The licensee met with NRC staff on February 28, March 5, March 10 and March 14, 1983 to present the results.of initial evaluations related to the events.
Based on licensee submittals of March 1 and March 8, 1983 and on the findings of *the NRC evaluation of the Salem events, issues were identified and categorized as equipment issues, operator procedure, training and response issues, and manage-ment issues.
They are discussed in detail in Section III of this report.
III.
Issues A.
Equipment Issues Three of the issues relate to the affected equipment, that is, the reactor-trip circuit breakers (Westinghouse 08-50 circuit breakers).
These issues are 1) safety classification of the circuit breakers, 2) identification of the cause of the failure, and 3) verification testing of the circuit breakers.
- 1.
Safety Classification of Breakers
- a.
Issue During the initial NRC evaluation of the February 25 event, it was determined that maintenance was conducted on the Salem Unit 1 reactor-trip circuit breakers in January 1983, following a failure of one reactor-trip circuit breaker to trip upon receipt of an RPS signal at Salem Unit 2 on January 6,*
1983.
The work. orders authorizing. the January 1983 maintenance identified the maintenance as not safety related and not requiring quality assurance review.
As a result, it was not clear on February 26, 1983 what portion, if any, of the reactor-trip circuit breakers was considered safety related by the licensee.
The reactor-trip circuit breakers contain both a UV trip attachment and a shunt trip attachment, but only the UV trip* attachment is operated by an automatic RPS trip signal.
- b.
Action/Evalu~tion This issue has been resolved.
Section 7.2.1.1 of the Salem Updated Final Safety Analysis Report (UFSAR), Revision 0, indicates that the Reactor Trip System includes the reactor-trip ci~cuit breakers and the UV trip attachment.
The Westinghouse Solid State Logic Protection System Description (WCAP-7488L) also defines the scope of the system as including the reactor~trip circuit breakers and the UV trip attachments.
The UV trip attachment and the reactor-trip circuit breaker are safety-related equipment in that they are essential features of the Reactor Trip System, which is necessary to prevent or mitigate the consequences of a design-basis event that could result in exceeding the offsite exposure guidelines set forth in 10 CFR Part 100.
The shunt trip attachment of the reactor-trip circuit breakers in the Westinghouse design is not required by present NRC regulations to be safety grade and, although it is provided to perform the manual trip function, no credit is taken for this design feature in the safety analysis(~ manu~l reactor.trip also actuates the UV trip attachment).
The licensee in a March 1, 1983 letter to
. 4
e.
~ March 29, 1983
.NRC concurred in this understanding.
Hance, the specific issue with regard to the safety classification of the reactor-trip circuit breakers is considered resolved.
Other issues concerning the.manner in which the reactor~trip circuit breakers were treated from a procurement and maintenance standpoint at Salem are addressed under Management issues (Section III C).
The licensee has made a commitment to install new UV trip attachments on all four Unit 1 circuit breakers prior to restart and to verify that the new circuit breakers have been properly serviced and tested.
- 2.
Identification of Cause of Failure
- a.
Issue The licensee's initial determination of the cause of the failure of the reactor-trip circuit breakers (as documented in a March l, 1983 letter) was
.that there was binding and excessive friction of the vertical latch lever of the UV trip attachment due to a l.ack of proper lubrication. This conclusion was concurred in by Westinghouse representatives and was based on visual inspection of the UV trip attachment, in-place testing performed after the.
failures, and previous Westinghouse experience.
I i
The NRC has conducted an initial determination of the cause of the failure based on inspection of the failed UV trip attachments and interviews with cognizant maintenance personnel on how the devices were maintained.
The inspection indicates that there were possibly multiple contributing causes of failure.
Possible contributors are (1) dust and dirt; (2) lack of lubrication; (3) wear; (4) more frequent operation than intended by design; (5) corrosion from improper lubrication in January 1983; and (6) nicking of latch surfaces caused by vibration from repeated operation of the breaker.
The contributors appear to be cumulative, with no one main cause.
The initial investigation
~lso indicates that all of the potential contributors to the failure of the UV trip attachments*are age related and that a new device would. likely perform properly.
Many surfaces of the latch mechanism are worn and the additional friction tended to prevent prope~ operation.
Proper lubrication throughout the life of the device might have prevented the wear that can be seen on the sample.
These initial findings indicate that the UV trip attachment f~iled from binding and excessive friction.
However, in addition to the potential contributors cited above,. there remains the possibility that other UV trip attachment or breaker problems may have caused the Salem failures.
Because of the importance to safety of the reactor-trip circuit breakers and UV trip attachments, the NRC staff has prepared a more structured approach to resolving this issue.
There-fore, a laboratory testing and examination program funded by NRC wil 1 attempt to determine the precise cause of failure.
The NRC has concluded its initial investigation of the cause of failure.
Only one other possible contributor has been identified that has not been previously reported, which is the 08-50 breaker trip bar mechanism.
This can contribute to higher trip forces being required if the trip bar mechanism is not properly maintained and lubricated.
To date, this has not been found to be a major cause of concern.
However, a longer term program to resolve this *issue will consider this aspect.
5
- -,..*-*~-:--:--::.~--:.*-..*-**** --_*~:-**-*- -*--*--
- -}_~"".-:'-:'""'-*. --::-"':"':----:---:--;-:--.*-.*::*.***
.e March 29, 1983
- b..
Short Term Actions
- c1)
Licensee Action Westinghouse has advised the staff that modifications to the UV trip attachment were made i~ 1971 and 1973.
As a result, the* licensee shall confirm, in writing to the NRC, that the new UV trip attachments now installed in the Salem Units 1 and 2 have incorporated all design changes made to these devices.
The licensee has committed to mea$ure and confirm the farce required to trip the breake~.
(2)
NRC Action NRC conducted an initial evaluation of the cause of the UV trip attachment.
failures which included visual examination of the devices by qualified perso.nnel and determining how the devices were maintained.
Based on this, we conclude that operation with new devices, in conjunction with preoperational testing and periodic surveillance, is acceptable.
- c.
Long Term Actions (1)
Licensee Action The NRC will require the licensee to determine the allowable number of opera-tions of the circuit breakers and establish a replacement interval for the entire unit or components of the unit.
This action should be complet*ed within six months of plant startup.
In addition, the Licensee shall establish a procedure far me~suring the force required to trip the breaker using the b.reaker trip bar and the force output from the UV trip 1 ever.
-(2)
NRC Action NRC has completed the laboratory test being conducted by its consultant Franklin Research Center (FRC).
These tests included examination of the failed attach-ments and disassembly to determine the precise cause of failure.
A 11 work. was controlled by procedure and the results documented including photographs when applicable.
In addition, the staff will review and approve the licensee's commitments resulting from his long term program.
- d.
Evaluation.
Investigation of the failure of the Salem Unit 1 reactor trip circuit breakers ta open when the undervoltage trip attachments (UVT) were de-energized by the solid state protection system on February 22 and 25, 1983 included review of the operating, maintenance, and surveillance testing history far the 08-50 circuit breakers used at the Salem plant.
The initial investigation centered upon the UVT attachment, however, subsequent.
efforts included the interaction of the UVT attachment with the circuit breaker.
The trip lever of the UVT attachment must lift the circuit breaker trip bar f~r opening of the circuit breaker ta occur.
To date, two possible failure modes have been determined for the Salem Unit 1 UVT attachments.
The first was observed by the Licensee and by NRC personnel 6
March 29, 1983
. the day of and the day after the February 25, 1983 event.
This failure mode apparently occurs when latch-to-latch pin binding prev*ents unlatching of the UVT attachment, thereby preventing the trip lever from moving when the device is de-energized.
Shortly after the February 25 event, all but one of the failed devices were lubricated and no further failures to operate could be repeated.
The remaining failed UVT attachment was subsequently damaged and was not available for inspection.
The second possible failure mode was recognized from inspection of the UVT attachment provided to Franklin Research Center (FRC) by the Licensee.
The latch spring on this device exerts enough force on the latch to reduce the output force from the trip lever as the friction increases between the latch spring and latch resulted from age related wear and lack of lubrication. This reduced force could be significant if the force required to lift the circuit breaker trip bar is higher than normally expected.
On March 18, 1983, Westing-house Switchgear Di~ision representatiie~ stated that the expected force required to lift the circuit breaker trip bar at time of manufacture would have been a maximum of 31 ounces and a normal range of 20 to 28 ounces.
On March 17, 1983, FRC personnel measured 28-to 30-ounce lift force requirements on five of six Salem reactor trip circuit.breakers made available for inspection by the Licensee.
These were the four Unit 2 circuit breakers, and the Unit 1 118 11 bypass circuit breaker.
The sixth circuit breaker, the present Unit 1 "A" trip, required 38 ounces of lifting force for operation, indicati~g that reduced output force, from a UVT attachment coupled with a high trip bar lift requirement is a pos-sible condition.
The licensee has committed to measure the force required to trip the breaker using the breaker trip bar and confirm that the breakers trip with a force of 31 ounces or less. This will be done prior to start-up.
During the investigation, variations in construction were noted among the original UVT attachments supplied to the Salem plant.
The device given to FRC had a tight latch spring.
The remaining device that was made available to FRC for inspection had a much looser latch spring that exerted no force on the latch except during actual latching operations.
No reset lever spring.~djust ment lock washer was found on the device provided to FRC, whereas the remaining Salem device had the lock washer.
Discussions with NRC and Licensee personnel indicated that similar variations were noted in the other UVT attachments that were no longer available for inspection by FRC.
The latch surfaces of the original UVT attachments were found to be in the as-stamped state.
Roughness was noted on the latch-to-latch pin face and on the latch-to-latch spring face.
On the device provided to FRC, this roughness on the latch spring side of the latch had caused a groove to be worn into the spring.
Irregularities an the latch-ta-latch pin surface of the latch were noted on the FRC device* and the device tested by the Licensee.
During testing of the FRC device, hesitation during unlatching was observed when voltage.was gradually reduced ta the coil of the device, further indicating friction in the latch-to-latch pin surface.
Photographs of the latch, latch pin, and latch spring surfaces taken on March 18, 1983 show the irregular nature of the mating surface.
Subsequent to the manufacture of the Salem UVT attachments, Westinghouse changed the manufacturing p*rocedure for the latch to include hand honing of the latch surfaces that mate with other components.
7
March 29, 1983
- On March 17, 1983, FRC person~el examined the new UVT attachments supplied for Salem Unit l~ -These devices were found to have the latch-to-latch spring sur-face honed.
Other surfaces could not be examined because the devices were mounted on the circuit breakers.
Variations in latch spring force were noted, and one UVT attachment had spring forces similar to the original device sup-plied to FRC for evaluation.
On March 18, 1983, Westinghouse Switchgear Division personnel indicated that quantitative acceptance criteria have not been set for the UVT attachments.
No output force requirement has been set and no quantitative requi~ement for
. mechanical unlatching capability exists.
In addition, no such requirements
- have been set for field testing UVT attachment operation and circuit breaker trip bar lifting force.
The staff concurs thai properly maintaine~ breakers a~d UV trip attachment will perform their intended function for a sufficient. period of time until the long term actions are completed and eval!Jated.
While we still believe all of the possible contributors identified are cumula-tive, wear caused by frequent use of the UV trip attachment would be the most probable cause.
Proper maintenance and lubrication would have minimized the UV trip attachment problem.
However, since this was not done, lack of maintenance and lubrication would definitely accelerate the failure potential.
- 3.
Verification Testing
- a.
Issue On August 20, 1982, one reactor-trip circuit breaker on Unit 2 failed to operate during survei11ance testing. A UV trip attachment was*rein~talled on this cir-cuit breaker after replacing ~he coil, the circuit breaker was reinstalled, and subsequent post maintenance testing was performed to establish operability.
Similarly, on January 6, 1983, a reactor trip occurred at Salem Unit 2 due to a low-low steam generator level, but one reactor-trip circuit breaker failed to open..
The licensee concluded that the circuit breaker failure was due to bind-ing from dirt and corrosion in the UV trip attachment.
The*UV trip attachment an the Unit 2 circuit breaker, as well ~s the-UV trip attachment an all Unit 1 reactor-trip circuit breakers, was c 1 eaned, 1 ubri cated and readjusted under
- supervision of a Westinghouse representative.
On February 20, both breakers performed satisfactorily during reactor trip events.
Since the circuit breakers again failed an February 22 and 25, adequacy of the testing to ensure circuit breaker operability is an issue.
Testing following reactor-trip circuit breaker maintenance or initial installation should be sufficiently comprehensive to provide reasonable assurance that the circuit break*r will function as needed.
- b.
Short Term Actions (1). Licensee Action The 1 i censee has conducted a program to verify proper operat i o*n of the reactor-tri p circuit breakers prior to returning them to service.
The program involved preinstallation testing of UV trip attachments 25 times by the vendor.
After installation on the trip breakers, the UV trip attachment and trip breaker were 8
March 29, 1983
- tested ten more times.
Following this testing, a time.*response test of the
- breaker actuated through the RPS was performed.
("2)
NRC Action By letter dated March 14, 1983, the licensee stated that he had sucessfully completed his short-term testing program.
The staff considers this action complete.
- c.
Long Term Actions
.(1)
Licensee Action The licensee has committed, to perform a 2000 cycle bench test of a DB-50 reactor trip circuit breaker.
The test will consist of 1000 cycle trips utilizing the shunt coil and 1000 cycle trips utilizjng the UVT.
The licensee will develop and provide the NRC with a detailed test procedure and a~ceptance criteria by May 1983.
The intent of the testing is to verify the adequacy of the licen~ee's maintenance and surveillance program.
(2)
NRC Action Review the adequacy of end results from the licensee's program.
- d.
Evaluation The licensee has performed his short-term testing program and committed to sub-mit a* long-term operational verification program for the reactor trip breakers for NRC review by May~*1983. Based on the successful results, of the testing performed thus far and the above commitment from the licensee, the staff con-cludes that this issue has been satisfactorily resolved to permit restart of the plant.
Further action required of the licensee will be determined sub-
- iequent ta the staff's review of the licensee's long-term verification testing program.
- 4. *Maintenance and Surveillance Procedures
- a.
Issue (1)
Maintanence Procedures During the review, it was ~etermined that no specific maintenance procedure existed at the Salem facility to conduct preventive or corrective mainten-ance on the reactor-trip circuit breakers.
The maintenance conducted in January 1983 was not performed in accordance with the latest Westinghouse recommendations, which were contained in Westinghouse Technical Bulletin NS0-74-1, as amended by technical data letter NS0-74-2.
Additionally, no program of preventive maintenance had been conducted on these circuit br~akers since original installatfon; The* licensee has now developed a maintenance procedure and preoperational verification program for use on the reactor-trip circuit breakers (includ-ing the UV trip a.ttachment), which is based on all applicable vendor 9
==
2-.-~---**-* 1 March 29, 1983 maintenance recommendati ans, appropriate qua*1 i ty assurance (QA) require-ments, and post maintenance testing.
The NRC staff initial review of the procedures and program identified certain defici.encies.
By letter dated March 14, 1983, the licensee submitted Revision 2 to Salem Generating Station Maintenance Department Manual Maintenance Procedure M3Q-2 to address these deficiencies.
The staff evaluation of this information is discussed below, and includes input from the staff's technical consultants.
(2) Surveillance Testtng and Procedures With respect to surveillance testing, the licensee conducted a functional test of one of the two reactor-trip circuit breakers every month, so each*
ci rcu.it breaker was tested once every two months.
The survei 11 ance test involved tripping a circuit breaker by use of the UV trip attachment.
The licensee also operated the circuit breakers weekly by exercising the shunt trip attachment.
In view of the number of reactor-trip circuit breaker failures at Salem, it appears that the periodic surveillance testing was ineffective in detect-ing reactor-trip circuit breaker failures of the type experienced on Feb-
. ruary 22 and 25, 1983.
The licensee had proposed monthly testing of the main reactor-trip circuit breakers by use of the UV trip attachment and weekly testing of the reactor*
trip circuit breakers by use of the shunt trip attachment.
We did not agree with the weekly testing interval of the shunt trip attachment, and also required that the associated bypass breakers be tested at each refueling outage.
By letter dated March 14, 1983, the licensee described routine testing of breakers which specifies that the shunt trip attachment of each reactor-trip breaker be tested each month.. This is in accordance with the NRC staff's previous recommendation, and is acceptable.
In his March 14, 1983 letter, the licensee also states that the UV trip attachments on all breakers,.including the bypass breakers, have now been successfully tested.
Regarding the NRC recommendation that testing of the UV trip attachment of the bypass breakers be performed every refueling out-age the licensee has modified Maintenance Procedure M3Q-2 such that all reactor trip and bypass breakers have their UV trip attachments tested every six months.
Based on the above, the licensee has complied with the staff's recommenda-tion concerning testing of the UV trip attachment of the bypass breakers.
- b.
Short Term Action
{l) Licensee Action
- i.
The maintenance procedure now specifies cleaning and vacuuming the equipment.
This does not completely resolve the previous deficienc~
since it is not clear whether the entire circuit breakers room and cabinets are to be cleaned.
The staff requires that this deficiency 10
It March 29, 1983 be completely resolved and the circuit breaker room and cabinets be cleaned prior to plant startup.
ii. The maintenance procedure still does not require replacement UV attach-ments to ~ave successfully completed 25 consecutive cycles of testing to be performed by Westinghouse.
The maintenance procedure or other appropriate documents, e.g., purchase order, should be revised to require all replacement UV attachments to have successfully been so tested.
For startup the license~ has stated that the new UV attach-ments (currently installed) have completed this testing.
- However, this deficiency in the maintenance and other documentation must be resolved prior to plant startup.
The ma i ntena*nce procedure now specifies a 30-mi nute i nterva 1 between each of the ten cycles of testing r~quired. This test interval is in accordance with the previous staff recommendation.
However, the main-tenance procedure has not been revised to specify an acceptance cri-teria should any failure occur during this testing.
Previously sub-mitted acceptance criteria were acceptable to the staff, but have not been incorporated into the maintenance procedure.
However, the staff 1 s consultant has reviewed the previous acceptance criteria and has the following comment:
Item 2 (of the document previously reviewed by the staff, "Salem Nuclear Generating Station, Reactor Switchgear, Operational Verification Program11 ) states that M3Q-2 requires 10, 40, then 50 trips of the circuit breaker depending upon the number of failures of the undervoltage trip attachment.
M3Q-2 does not contain such a require-ment.* Allowing any failures during testing is wholly inappropriate for the undervoltage trip unit and Main-tenance Procedure M3Q-2 should not be modified to allow the undervoltage trip attachment to fail, no m~tter how
- many successful operations follow.
Failure to operate once during a sequence of trippings of the attachment indicates severe problems in the mechanism and places the reliability of its function in doubt.
The NRC staff concurs with the above comment.
Therefore, Enclosure ~
of the maintenance procedures should be revised to require that no failure of the UV attachment be allowed.
If a failure occ~rs, the UV attachment being tested should not be installed.
The licensee has stated that the new UV attachments have been successfully tested ten times, utilizing a 30-minute time interval.
However, this deficiency must be resolved prior to plant startup; It should be noted, that following completion of the testing discussed above, after installation into the appropriate breaker compartment, a response time test of the breaker, actuated through the Solid State Protection System (SSPS), was performed in accordance with Technical Department test procedure lPD-18.4.002 or lPD-18.4.005.
NRC review of these test procedures will be performed prior to plant startup.
11
March 29, 1983 The referenced Technical Department Procedures, lIC-18.011 and lIC-18.1.010, are still being revie.wed by the NRc* staff. This review will be performed prior to plant startup.
iii. Section 9.8 discusses timing of the circuit breaker when tripped by the undervoltage trip attachment.
FRC suggests that three timing tests be performed and the average time to be compared to previous tests as successive tests are performed.
This would allow degradation in per-formance to be determined.
A timing test has been performed on the new circuit ~reakers to establish a base lin~ for future comparisons.
The NRC staff concurs with the above FRC suggestion.
The m~intenance procedure and Enclosure 7 to it should be modified ~ccordingly. This
- deficiency in the maintenance procedure must be resolved prior to pl ant startup.
iv. of M3Q-2 was taken from the Westinghouse Low Voltage Metal Enclosed Switchgear Manual.
This diagram incorrectly shows attachments such as the overcurrent trip device that are not used in the reactor trip circuit breakers and does not show the shunt trip or undervoltage trip attachments.
FRC suggests that an applicable diagram be included in the procedure.
The NRC staff concurs with the above comment.
The maintenance procedure should be modified accordingly.
This deficiency must be resolved prior to plant startup.
- v.
Section 9.7 contains a caution concerning the self-locking screw in the moving core of the UV attachment.
The maintenance procedure, and other appropriate procedures, should be revised to require that a sealant be applied to the head of.the screw such that field adjustments are not
. possible without breaking this seal.
This deficiency must be resolved
- prior to plant startup. Additionally, the licensee is required to notify the NRC in writing, prior to plant startup, that these seals are in place.
vi. of the maintenance procedure should be revised to specify the acceptance to 1 erance* on the UV trip attachment coil dropout v-o 1 tage (referencg Seeton 9~7 of Maintenance Procedure M3Q-2).
The maintenance procedure shall also address the action to take if the coil dropout voltage falls below the specified limits.
This deficiency must be resolved prior to plant startup.
vii. Enclosure 7 should be revised to require notification to the NRC and take no corrective action if any data is found to be out of specifica-tion.
The licensee is required to submit to NRC, prior to plant startup, propo~ed Technical Specification changes that require such notification to be made prior to any corrective actions being taken.
viii. The staff recommends Section 9.7.4 of the maintenance procedure be revised to require that a static trip measurement be made on the.trip bar of each of the four reactor trip breakers and the output force of all four UV trip attachments be measured each time.maintenance is per-formed and following installation of a new UV trip attachment.
If the 12
March 29, 1983 It measured trip force.an any trip bar exceeds the manufacturer recommended
- upper limit of 31 ounces, or th~ output force of any* UV trip attach-ment is less than twice the measured trip force, NRC should be immediately notified prior to any corrective action.
(The upper limit of 31 ounces is based on information received from Westinghous~~
According to Westinghouse, any breaker exceeding 31 ounces trip* force*
is rejected and not sent to its client.) These measurements are required to be performed prior ~o plant startup.
The maintenance pro-cedure, and Enclosure 7 to it,.should be revised accordingly, and Technical Specification changes made to require NRC notification prior to any corrective actions.
(2)
NRC Action The NRC will verify the successful completion of the licensee's she.rt term action.
As noted above in the licensee's short term actions, the NRC will perform a review of the licensee's test procedures identified in item ii.
- c.
Long Term Actions (1)
Licensee Action The NRC required that the licensee incorporate results of a long-term verifica-tion testing of the reactor-trip circuit breaker into maintenance and surveil-lance programs.
The licensee, in his March 14, 1983 letter, has committed to perform this long term verification testing and to review all recommendations made. by his staff at the comp 1 et.ion of this.program.
The 1 ong-term opera ti ona 1 verification program for the reactor trip breakers will be submitted for NRC review by May 1983.
The accepted recommendations will then be incorporated as changes to either Main-tenance Procedure M3Q-2 or the interval of surveillance testing of the breakers, whichever is applicable.
This action should be completed within two months. of completion of long-term testing.
The maintenance pr6cedure is still not explictt relative to the frequency of UV attachment lubrication. It 5hould be modified to require lubrication each time maintenance is performed.
The NRC staff and its contractors have nd concerns relative ta the adequacy of the lubricant, but are continuing ta review this subject.
The NRC staff's consultants made the following comment concerning the points of lubricant application:
The second paragraph of Item 9.7.2.Z indicates the portions of the undervoltage trip attachm~nt to be l~bricated; however, no mention is made of the latch to latch sprin.g (the copper alloy flat spring) surface, the bearing points of the latch spring pin, and the bearing points of the reset lever arm.
All of these, especially the latch to latch spring surface, are fric-tion sources that could prevent operation and should be con-sidered for lubricition.
13
.... ~,~~----*----~~.~~~~~=--= ~-'---
-~
March 29, 1983 The NRC staff concurs with the above comment.
Therefore, the maintenance procedure should be revised. accordingly.
In a March 22, 1983 letter to the NRC, Westinghouse states that a new
- Technical Bulletin clarifying the circuit breaker and UV trip attachment lub-ricants and lubrication points will be issued to the licensee by March 24, 1983.
the licensee is required to verify in writing to the NRC, prior to plant startup, that the circuit breakers and UV trip attachments have been lubricated in accordance with this Technical Bulletin, and that the latch spring surface, the bearing points of the latch spring pin, and the bearing points of the reset lever arm have been lubricated.
If these are not specified as lubrication points in the Westinghouse Technical Bulletin, then Maintenance Procedure M3Q-2 should be revised to indicate so.
With regard to surveillance testing in addition to the monthly testing of the shunt trip attachment and UV trip attachment of the main breakers, the staff will require that circuit breaker timing also be performed once*each month, instead of the current schedule which requires thi *s test to be performed every six months, in accordance with Maintenance Procedure M3Q-2.
The staff also recommends a permanent test panel be used when these tests are performed.
The staff will also require that the licensee revise his surveillance testing pro-cedures to include a test of the UV trip attachment prior to any startup, if such testing has not been performed within s_even days of startup.
The licensee should submit proposed Technical Specification changes that comply with the above and that require that the results of these tests be reported to the NRC prior to any corrective action, if any deficiencies are identified.
These pro-posed Technical Specification changes are required to be submitted prior to exceeding 30 days of operation following plant startup.
(2)
NRC Action NRC is evaluating the licensee's proposed lubrication requirements for the UV trip attachments (i.e., type of lubricant, frequency of lubrication, points of application, etc.).
NRC will also assure that results of long-term verifica-tion testing of the reactor-trip circuit breakers are adequately incorporated into maintenance and surveillance programs to determine testing frequency, inspection requirements, and life.times.
In his letter of March 14, 1983, the licensee has committed to submit for NRC review, by May i983, a proposed long-term verification testing program.
The staff will review that proposed testing program and, following its completion, verify that the results are adequately i nc.orporated into maintenance and sur-vei 11 ance programs.
The maintenance procedure stil_l specifies cleaning the UV attachment with stoddard solvent.
The NRC staff and its consultants will complete their review to determine the adequacy of this solvent and any potential adverse effects from its use.
d
- Ev a 1 ua ti on
- Based on the staff's review and evaluation of the licensee's actions that have been completed, together with those actions to be completed in the short term, 14
It March 29, 1983
- we conclude that the identified dificiencies in the maintenance and surveillance procedures should all be resolved prior to restart.
The maintenance procedure has been improved to_ include 1) maintenance on both the main and bypass breakers, 2) specific action to be taken if acceptable test tolerances a-re not met, and 3) a s19ecific maintenance and testing frequency.
The surveillance testing and procedures have been improved to include 1) monthly testing of the shunt trip attachment of each reactor-trip breaker,.and 2) testing of the UV trip attach~ents of the bypass breakers every six months.
These changes made in the surv~illance testing and maintenance procedures signi-
-ficantly improve the capability to detect and* correct RPS breakers problems that have occurred at Salem however additional improvements are necessary.
- 8.
Operating Procedures, Operator Training, and Operator Response !~sues Examination of the circumstances associated with the events involving reactor-trip circuit breakers, tdentified certain issues relative to procedures, training, and operator response.
These issues are discussed in the sections that follow.
It should be noted that the operators' role in respondin[ to an ATWS event is to compensate for multiple failures in the reactor protection system.
The adequacy of the design of this system is discussed in other sec-tions of this report and is subject to Commission rulemaking.
The purpose of procedures for ATWS is to increase the likelihood of prompt and proper operator actions.
- 1.
Emergency Operating Procedure for Reactor Trip and Anticipated Transients Without Scram (ATWS)
- a.
Issue
. The NRC staff conducted interviews with control room operators and reviewed the reactor trip and ATWS procedure (EI-I-4.3, Revision 7) which was used by control room personne 1 during the February 22, 1983 and February 25, 1983 events.
These efforts revealed the follo~ing:
The operators do not, as a general practice, take immediate action to initiate a manual trip based on reactor trip "first out" annunciators, nor are they directed to do so by the procedure.
The procedure in use required a manual trip if an automatic reactor trip did not occur as indicated by reactor power level remaining high or control rods failing to insert~
At least one operator questioned the appropriateness of the ATWS procedure's step to trip the turbine without first verifying that the reactor had tripped, because tripping the turbine results in a loss of heat sink.
15 l
-==~==~---~~-------------------
March 29, 1983
- b.
Short-Term Actions (1) licensee Action (a) The licensee is required to identify the indications in the control room that provide positive indication.; without operator analysis or verification, that an automatic reactor trip demand is present.
(b)
The l*icensee is required to revise procedures to direct the operators to *insert a manual trip whenever positive indication of an automatic trip demand is present without delaying to evaluate the overall plant status.
(c) The licensee is required to review the basis for the ATWS procedure steps and order of priority in light of the operator's concern, revise the procedure as necessary, and train the operators on the basis for the procedural steps and importance of procedural compliance.
(d)
The licensee is required to train operators in the revised procedures.
prior to restart. of Unit. 1.
(2)
NRC Action (a) The NRC will review the adequacy of the licensee's revised procedures and basis for the procedural steps and order of priority.
(b)
The NRC will review the adequacy of the Westinghouse Owners Group Emergency Operating Procedure Guidelines.
- d.
Evaluation This evaluation is divided into two sections.
The first section deals with positive indication of a reactor trip demand.
The second section addresses the revised procedures and includes an evaluation of the licensee's revised pro-cedures relative to the requirement to manually trip the reactor upon receipt of positive indications of a reactor trip demand.
The licensee's revised pro-cedures relative to the Westinghouse Owners Group guidelines is also evaluated.
(1)
Positive Indication of Reactor Trip Demand The staff's position is based on the following definitions of 11 reactor trip demand" and 11posi.tive indication 11 of that demand.
A reactor trip demand is the condition of the final output of the logic protion of the reactor protection system calling for an automatic reactor trip.
(This does not necessarily mean that the inputs to the* reactor protection system logic requires a trip, but only that the output of the logic portion requires a trip.) Confidence in the validity of this trip demand is based on the redundancy and reliability of the reactor protection system logic.
A reactor trip demand will effect automatic reactor trip if either reactor protection circuit breaker opens.
Positive indication of a reactor trip demand is defined as the information from control room indicators that informs the operator of the present existence of a reactor trip demand.
Information from the first out annunciator panel alone 16*
l
March 29, 1983
.Provides a more conservative indication beGause it indicates either that a trip demand currently exists or that such*a demand existed in the past.
Although this conservative indication may result in the operator tripping the reactor when the plant 1 s condition no longer requires a trip, the staff judges the frequency of these unnecessary manual trips to be on the order of the number of trips caused by a failure of the reactor trip system, and is therefore acceptable.
The licensee's proposed positive indications of a reactor trip are:
(1) presence of an alarm on the reactor trip portion of the first out annunciator panel and (2) concurrent sensor bistable trip indications (sufficient to r~quire a reactor trip) on the solitj state protection system (SSPS) reactor trip status panel.
Each first out annunicator means that the reactor trip system detected a condi-tion requiring a trip for a plant parameter, e.g., a low-low water level in a specific steam generator.
D~e ta the demonstrated time response of the system, it is possible that a trip conditi~n is not present long enough to cause a reactor trip breaker to open.
Because the annunciator panel has a lock-in feature independent of the reactor trip system, the trip condition could clear before the reactor protection system, as designed, effects the trip and locks in.
Because the bistables i.n the reactor trip system automatically reset when their sensor input no longer exceeds the trip setpoint, illuminated bistable indicators on the SSPS status panel provide the information that the plant conditions still requires a trip. Therefore, although the first out panel alone provides the conservative positive indication of a ~eactar trip demand, the first out annunciator concurrent with the bistables on the SSPS status panel is required far positive indication that the need for a reactor trip presently exists.
(2)
Revised Procedures The staff review of the revised procedures addressed several areas.
The oper-ators must be able ta carry out the instructions quickly enough ta successfully respond ta a plant transient*.
The indicators upon which the operator acts must be sufficiently reliable ta invoke proper action when necessary and not ta cause improper operator action which affects safe operation of the plant.
The instructions must h~ve an adequate technical basis to provide confidence in their appropriateness.
Finally, the procedures must be written clearly so that the operator can understand and implemen~ them in a high stress environment.
This includes immediate actions that must be committed to memory and performed before time is available to obtain the procedure.
Timeliness of Response To address the is~ue of how much time is avail~ble for operator actions, tha staff reviewed the analysis of the limiting ATWS event, i.e., ATWS involving total loss of feedwater.
The limiting concern for this event is reactor coolant
~ystem pressure.. Results of the analysis show that if the turbi~e is tripped within about one and a half minutes, after the loss of feedwater even if the reactor is not tripped, the pressure transient does not exceed design limits, and is therefore acceptable.
The analysis is discussed in Section VI of this report.
The staff reviewed the reactor trip procedure (EI-I-4.3, Revision 9, dated March 10, 1983) and visited the Salem Unit 1 control room on March 18, 17 l
--~~~~~=""'~*;:;::=:::=:=!:=.::::.::=:.::=~=-.;:__~~-~---~-~r---~---;._;.:_;"~*~*--~,~-*-~--~--------~*-~
-.~-. -=--:**..--:..::::~"'!:-.:":'**.:'.<.'"{""'; <<:-:~-.-~.....~?C:.:o:~--*,r::*:---**,-:;- -~?~'...:__~,** ;-:-2.~~-,..'.~~~"71'"':-"'~*:'.:Ci:'*..,~~*.-;:.:7r*-=-...,;:*-~...-...,.,~~~":~""'*.... ~.
- _,..,,_....~~--:--~,......
i March 29, 1983 1983*to look at the indications and controls used in the procedure and to walk through the initial steps of the procedure.
When a reactor trip is demanded, as indicated by the first out annunciator and the SSPS status panel bistable indicators, the procedure instru~ts the operator to manually initiate a re~ctor trip using either of the two protection system J~handle trip switches.
If a reactor trip does not occur, the procedure instructs the operator* to then per-form the following actions until the reactor trips:
- a.
manually initiate a reactor trip using the other protection system J-handle switchi b.. open the reactor trip breakers using the individual-bre*ker control-circuit pushbutton switches,
- c.
manually trip the*turbine,
- d.
open the breakers supplying power to the rod drive MG sets, and
- e.
manually initiate safety injection.
All these actions ar~ performed in the control room on the main control board.
If these actions do not result in a reactor trip, instructions are provided to trip the reactor and turbine from locations outside the control.room.
Staff review indicated that the SSPS status panel is located and arranged in a*
manner that should require only a few seconds to recognize a reactor trip demand.
The staff walk through of the Unit 1 control room demonstrated that the operator could perform all the necessary control room actions in less than half a minute.
Therefore, we conclude that the instructions provided for manually tripping the reactor and turbine can be followed well within the time available for the limiting analyzed ATWS event.
The small size of the Salem control rooms (Units 1 and Z) and the relationship of the main control board and SSPS status panel permit rapid ope.rater scanning of displays necessary for this event and rapid operation of all controls required.
No generalizations should be made from these findings to other control rooms or the use of other procedures in these control rooms.
Detection and Identification of the First Out Annunciator Review of the first out annunciator panel operating sequence showed that a first out signal provides two unique coding methods to direct the operator 1 s attention to a specific annunciator tile.
The first is the auditory signal with a specific pulse rate and frequency variation unique to the first out panel.
The sound draws the operator's attention to the fact that an annunciator is active while the specific pulse rate and frequency is meant to identify the first out panel.
Identification by auditory coding is useful only if a limited number of
-different signals must be learned by the operator.
The recommended limit is nine for all auditory signals located in the control room, including plant evacuation, fire, security, computer alarms. annunicators, etc.
Since there are more than twelve distinct auditory alarms in the Salem control room, the significance of the first out panel auditory alarm is diminished and should not 18
It March 29, 1983
. be credited as an aid to panel identification.
The first out panel *demarcation in the control room provides adequate reference such that a flashing tile within its bounds should ensure identific*tion as a first out annunicator.
The second method of coding is intended to identify the specific first out. t i1 e within the first out panel.
This ls accomplished by-illuminating two red bulbs along with the two while bulbs illuminated on all activated tiles.
The net result is a first out indication that appears to be pink when viewed under normal ambient control room illumination.
This color is not easily discrimi-nated from that of illuminated white tiles on the same panel.
In addition, the NRC color vision testing requirements for operators may not be sufficiently discriminating or uniformly applied to. detect a color vision deficiency, thus exacerbating the potential problem of quick first out tile identification.
The licensee's procedure involving positive indications of a reactor trip demand does not depend on identification of a specific annunciator tile on the first out panel, only on detection of any reactor trip annunciator on the panel.
Because of the number of different audio signals used in the control room, the operator may not be immediately aware that a first out annunciator has acti-vated, but the audio signal is adequate to alert the operator to scan the annunciator panels.
Thus, the deficiencies in auditory and visual coding for identification should not significantly affect operator performance of the emergency procedure.
These deficiencies may affect ~est-event operator actions and are expected to be addressed within the context of the detailed control room design review.
Reliability of SSPS Status Panel Indications Based on discussions with Salem personnel, and observations made during the control room walk through, several issues about status indicator lights were identified.. Although the first out panel is powered from an uninterruptible power supply, the SSPS status panel is powered from a miscellaneous AC (MAC) b~s.
Each status panel indicator consists of a light fi~ture which can contain up to four miniature bulbs.
Each indicator appeared tb be vertically parti-tioned so that two bulbs may be placed on each side of the partition. It was not clear from our discussions with plant personnel whether all light fixtures were vertically partitioned. According to operations personnel, only two bulbs are used in each indicator.
This is necessary to reduce the heat generated within each indicator fixture and to reduce the load on the associat~d power supply.
However, control room observation from a human factors standpoint did indicate that on~ bulb was sufficient to provide a visible indication of annunciator status.
The bulbs in the indicators are tested once each shift, and both trains of the status panel are funi:tionall.Y tested each month when pe.rforming surveillance tests on the reactor protection system.
A burned out bulb is detected by observing a dark side on the indicator surface.
Concern about reliance on SSPS status panel indication orig1nated in the Unit 1 control room with the observation that a number (at least 10) of the status panel indicators appeared to have a burned out bulb (one side of each indicator was dark), although this was not confirmed by exami~ing each indicator.
An additional issue was the placement of bulbs in the indicators.
With one bulb 19
March 29, 1983 an each side of the light fixture, it was very clear when a bulb was burned out.
However, with two bulbs an one side of the partition, it may be difficult to determine that a bulb was not working.
At the time of the c_antrol room walk through, no determination was made as to the placement of bulbs in the light fixtures.
In view of the reliance on status lights for positive indication of a trip demand at Salem, and issues for reliable status indication based an staff
- observations, the licensee will be required, prior.ta restart, ta provide the staff with a detailed description of the procedures which will be.used to ensure the operability of SSPS status panel indicators.
Tec.hnical Basis of ATWS Procedure The technical basis of *the ATWS procedure is provided by the Westinghouse Owners. Group procedure guideline ECA-1, "Anticipated Transient Without Scram, 11 dated September 1, 1981.
The licensee's procedure EI-I-4.3, "Reactor Trip, 11 Revision 9, dated March 10, 1983, was reviewed using the Westinghouse Owners Group guideline ECA-1 as a basis.
Although there are plant-specific differences, no technical deficiencies were noted.
The licensee's procedure contains plant-specific, detailed steps to provide operators with more methods of tripping the reactor and turbine than are identified in the generic guidelines.
Human Factors Review of Procedure A human factors and technical review was conducted of the ATWS portion of the licensee's "Reactor Trip" procedure (EI-I-4.3, Unit 1, Revision 9, March 10, 1983).
In addition, the entire procedure was reviewed from a human factors standpoint.
A number of human factors discrepancies were identified, including lack of internal consistency, logical ordering of steps, and convention used for emphasis.
None of the discrepancies.identified warranted revision of the procedure prior to restart; These discrepancies were discussed with the licensee on March 23, 1983, and the licensee agreed ta consider them as a part of his program for upgrading emergency operating procedures (EOPs).
This upgrade program will revise existing EOPs, using the Westinghouse Owners Group Guidelines, as part of the ongoing Three Mile Island Action Plan to upgrade all plants' EOPs.
All plants' schedules for the EOP upgrade are due to the NRC by April 15, 1983, in accordance with Generic Letter 82-33.
The Owners Group is currently revising the emergency procedure guidelines based on NRC staff comments, internal review, and results of the verification/
validation program.
The staff expects to complete its review of the guidelines in April 1983.
It is anticipated that the revision to the guidelines will be completed in June 1983.
When completed, implementation of the revised guide-lines will be audited by the staff.
In conclusion, our review included the tfmeliness of operator response, reli-ability of the indications, technical basis of the. procedure, and the human factors of the procedure.
Based on this review, the staff cannot conclude that the revised procedure is acceptable unless the reliability of the indications relied upon for manual trip can be established.
The staff's concerns on reli-abilty of the SSPS status panel indicators include the power supply for the lights, source of the signal far the lights, and the methods which will be used 20
~... *.
March 29, 1983 e
. to ensure the operability df the lights.
The staff will* complete its review and describe its evaluation of this concern in a subsequent report.
2.*
Operator Trainihg
- a.
Issue Interviews conducted by the NRC with the licensed operators who were onshift during the two events indicate a lack of familiarity with the functions of the annunciators and indicators associated with the Reactor* Protection System (RPS).
The interviews also revealed that the operators who were onshift during the February 25 event did*not recognize that a failure of the RPS had occurred until app~oximately 30.minutes after the event.
Specifically, the operators interviewed were not able to state.whether* the* reactor-trip-indicator light (red) on the RPS mimic status p*anel indicated a demand for or confirmation of a breaker trip action.
Interviews also indicated that at least some operators questioned the validity of annunicators until they could be confirmed by inde-
. pendent indication.
This perceived need to verify caused the operators not to take immediate act1on to *manually trip the reactor based on annunciator indica-tion and verification of reactor power level remaining high and/or multiple control rods failing to insert on February 25, 1983.
Based on staff review, it is apparent that training in the areas of the RPS and its associated indications and alarms is necessary.
A revised operating procedure for reactor trip, EI-I-4.3, which includes Anticipated Transients Without Scram (ATWS) has been implemented.
The revised procedure directs the operators to initiate manual trip when a reactor trip is demanded as indicated by annunciations on the first out annunciator panel and
'the SSPS status panel.
b*;
Short-Term Actions (1)
Licensee Actions (a)
The licensee shall conduct training on the revised procedures prior to restart of Unit 1.
(b)
The licensee shall conduct additional training on the Reactor Protection System (RPS) and its associated indications and alarms (specifically whether these are 11demand 11 or "confirmatory 11 ).
(c)
The licensee shall review the February 22 and 25 events with all operators.
(2)
NRC Action NRC will evaluate the adequacy and completion of remedial training prior to Unit 1 and Unit 2 restart.
- c.
Long-Term Action (1)
NRC Action 21
NRC staff will audit the licensee's requalificatian program~
determined by Region I.)
Evaluation
- -*-***~-
,__......o.~*-***1
. "* ~
March 29, 1983 (Date ta be This evaluation is the NRC short-term action item and it addresses the licensee's shbrt-term actions.
The licensee's short-term action items are discussed in three sections:
(1) training on the revised procedure, (2) training on the RPS, and (3) review of the February 22 and 25 events.
In addition, comments are provided on the testing procedures for evaluating effectiveness of the*
training and on the completeness of the licensee's training program.
- Finally, the licensee actions to be completed prior to Unit 1 and 2 restart are identified.
The Salem Nuclear Training Center Staff developed an ATWS Training Program which was conducted for 56 licensed personnel.
Six training sessio~s~ of approximately-3 hours in length, were conducted on March 10, 11, and 15, 1983.
At the conclusion of each session, trainees were evaluated by a written examination. A grade of 80% was required for passing.
In addition, 12 operators undergoing their normal requalificatian training were required to take an 11 upgrade 11 exam to address NRC concerns.
As part of this program, the trainees were "talked through 11 the rev:ised steps of Emergency Instruction EI-I-4.3 (Revisions 8 and 9).
The trainees were also given a refresher on the RPS and associated indications and alarms.
Definitions of "demand" and "confirmatory" signals were introduced and discussed.
The anatomy of an ATWS was discussed as well as a thorough review of the February 22 and 25 events.
This training program covered the required subject matter, however; same concerns still exist.
Revised EI-I-4.3 The trainees were asked to list the 7 steps that an operator is required to perform if an automatic reactor trip has not occurred, to manually trip the reactor.
While this is a valid question (operators are required to have these steps memorized), a random sampling of 5 test results showed that only 1 trainee listed these steps without error.
For the remaining 4 trainees, as well as other trainees, no retesting of this test item was required, and no remedial assistance was provided.
The trainees, while they may be able to 1ist the 7 steps of this revised procedure, were not given any opportunity for practice or required to undergo performance testing.
RPS and Associated Indications and Alarms While the trainees were g.i ven refresher training on the RPS and 11demand 11 and "confirmatory" trip signals, the trainees were not tested on the location of these signals, nor on the listing of the 5 11confirmatory 11 signals (as stated in the training objectives).
Only orie of the tests, the 11 upgrade 11 test for only 12 trainees, required the trainee to explain the difference between these two signals.
To measure the accomplishment of this subject matter, all trainees should have been required to identify the location of these annunciators, 22
~March 29, 1983 explain the difference between the types o-f sig'nals and list the 5 "confirma-tion" signals.
Review of February 22 and 25 Events It appears that.the training.provided for reviewing the February 22 and 25 events was very thorough.
Various reports, computer printouts and recorder*
charts were utilized.
There were test items covering these events.
Testing Procedures For the final evaluation, one of two versions of the final examination was given to each trainee.
These two versions were distributed in an alternate fashion.
Upon review, it is apparent that these two versions do not t*est the same subject matter.
While some questions are the same, certain areas, e.g.,
alarms, are tested on one version but not on the other.
Basic educational principles require that if separate tests are to be given, they must be equivalent. All students should be tested on the same subject matter.
As previously stated, the 12 trainees undergoing requalification training wete given an additional 11 upgrade" exam.
The scores received on these two different tests were then averaged for a final score (a score of 80% was the criteria for passJng).
However, in one case, a trainee received a 93% on the first test and a 73% on the 11 upgrade 11 test for an 83~~ fi na 1 score.
Thus, the student passed.
Two different tests should not be averaged to make one final score.
Averaging in this manner does not ensure understanding of all the subject matter.
There were 18 learning objectives given to the trainee at the beginning of the training program; however, the trainees were not evaluated on all of these objectives.
To ensure successful achievement of the subject matter, the trainee's performance should be evaluated against all established objectives.
Completeness of the Training Program Our review of operating practices at the Salem station indicate that auxiliary operators will perform trip functions, contained in the last two steps of the ATWS sequence, on direction from the control room.
The steps include manual trip of the reactor t~ip breakers and manual trip of the rod drive M.G. sets.
Training of the auxiliary operators for these tasks is not evident.
Our review of the traing material and objectives indicated the instructor lesson plan and student handout materials were not referenced or indexed.
In addition, all training material does not include titles and revision dates.
Actions Reguired Prior to Restart Based upon -review of the ATWS Training Program, the following are required:
(1)
Examinations should be returned to trainees for them to assess their strengths and weaknesses.
Remedial assistance can then be provided, by the licensing training staff, on an individual basis.
23
.*1
(2)
(4)
(5)
.. -- -- *-- -___,_ *=--------.. ----- --~------~~--'---~- *-
_,*=-***----~----'---'-'=-"'r.'==-=-""---=---"-'""-=---~:::.* -.:..:.: --,_, __.:....:.__*
-~:....:....:: :.:- -- ---
_,fi ~.;;::__:_--
- ._ 1 e
e Mar-ch 29, 1983 Lack of operational pr~ct~ce on the revised procedures is a concern.
Trainees should be* given the opportunity to walk through these procedures in the control room until successful performance is e_xhibited.
This.may be done on an individual or a team basis.
Lack of adequate evaluation of trainee on the RPS and associated indications and alarms is another concern.
Trainees should be evaluated on the location of annunciators, alarms, etc., and the types of signals exhibited.
Individual or team walk-throughs in the control room would be an excellent vehicle for such evaluation.
PSE&G should review auxiliary operator training programs and assure that a 11 designated operators know the location and know how to operate trip mechanisms for the ATWS procedure.
PSE&G should review-the source of material contained in the ATWS training and lesson plans to ensure that it is current and properly referenced.
The objectives for this ATWS training should also be referenced in the student handouts and instructor lesson plans.
Upon satisfactory completion of the above required actions, the licensee's ATWS Training Program will be acceptable for restart of Units 1 and 2.
- 3.
Operator Response
- a.
Issue Iriterviews conducted at the Salem Nuclear Generating Station disclosed the fo 11 owing:
In both events, the operators took 20 to 30 seconds to evaluate the overall plant status and initiate a manual reactor trip.
For the first event, this evaluation began with the electrical bus transfer failure.
This evaluation.was necessary because the loss of the electrical bus resulted in a large number of alarms, and loss of equipment and indicators.
By coincidence, the time taken for this evaluation was nearly identical to the time it took for the plant conditions to degrade to the point of causing the reactor trip system to provide an automatic reactor trip signal.
During the first event, after an operator was directed to manually trip the reactor, the J-Handle switch was not operated properly.
When the shift suprevisor ordered a manual trip, the operator inadvertently pulled off the J-handle, which then had to be reinserted to perform the manual trip.
This erroneous action was due to the operator 1 s lack of familiarity with this switch.
The nearly coincident automatic trip signal may have contributed to the operator 1 s failure to recognize that the automatic trip system had called for a trip and had failed to trip the reactor prior to the manual trip.
For the second event, the evaluation of the plant status began when the reactor trip annunciator actuated.
This evaluation determined that a reactor trip was necessary based on plant parameters and control room 24
~ March 29, 1983 indicators.
This time could have been reduced had the operators recognized sooner that a positive trip demand existed.*
There was* positive indication of the reactor protection system failure during the second event, including f1rst out annunciators and SSPS status panel indications.
However, the operators neither understood nor trusted the indications.
Because of this, the operators unnecessarily reevaluated plant status.
The operators manually tripped the reactor in response to their evaluation of the plant status. and control room indications and not due to recognition of the failure of the reactor protection system to*
provide the requ.ired trip.
The NRC was initially informed by licensee instrumentation and control persdnnel and maintenance personnel that the first out panel and SSPS logic systems are highly reliable..
Based on this information and the NRC's understanding of these systems, the NRC concluded that the informa-tion provided in the Salem control room (i.e., first out panel alarms, illuminated RPS status displays, and safety grade instruments) was adequate to enable operators to immediately.identify an ATWS event.
Subsequent to this initial conclusion and based on NRC questioning of the licensee on March 3 and 4, the licensee conducted tests which indicated that short duration signals (less than lG milliseconds) could procduce a reactor trip annunciation on the first out panel and a computer printout indication of a reactor trip, without fully initiating the* reactor protection system.
However, after reviewing the test results, the licensee concluded that the system was functioning as designed and required trip signals of longer duration to actuate the reactor-trip circuit breakers and lock in the reactor protection system.
Accordingly, the current design of the first out panel can res~lt in operators questioning the r~liability of the information provided on this panel.
Based on the above, the NRC concluded that for the February 22 event, the operators 1 response was prompt and fully satisfactory.
For *the event on
- February 25, taking into account the deficiency in the reactor trip procedure and deficiencies in training that resulted in (1) operators failing to recognize a reactor trip demand and (2) the operators failing to understand the control room indications, the operator 1 s response time was reasonable.
- b.
Short-Term Actions (1)
Licensee Actions The licensee was requi*red in addition to the training required in B.2, to caution operators on the use of the manual trip 11J 11 handle control.
(2). NRC Action None.
- c.
Long-Term Actions-( 1)
Licensee Action 25
L! :==...
~-.......... -.. **-***--
... -~-~.... 1 March 29, 1983 (a) The licensee is required to evaluate alternative means to permanently secure the 11J 11
- handle to the switch as part of the Detailed Control Room Design. Review.
(b) The licensee ii req~ired to reevaluate the d~sign of the first out panel*
system with regard to the reliability of information presented to operators, as part of the Detailed Control Room Design Review.
(2)
NRC Action The NRC will evaluate the licensee's findings and corrective actions related to the long-term licensee actions as part of the NRC review of the licensee's Detailed Control Room Design Review.
This review will be completed within two months following receipt of the licensee's submittal~ _
- d.
Evaluation To fulfill the licensee's short-term action requirement, the licensee issued to each licensed operator a directive describing the problem and proper operation of the J-handle switch.
The staff considers this action acceptable for restart.
The licensee's long-term action will be parts of the Detailed Control Room Design Review.
The schedule for this review will be provided to the NRC by the licensee on or before April 15, 1983 in accordance with Generic Letter 82-33.
C.
Management Capability and Performance The deficiencies identified during the review of circumstances surrounding these events raises the question of the responsiveness, practices, and capabi-lity of licensee. management at the corporate and station level. Additionally, a number of specific management issues directly related to tha failure of.the reactor trip breaker events were also identified.
The issues discussed in this section are:
- 1.
Overall Management Capability and Performance
- 2.
Master Equipment List
- 3.
Procurement Procedures
- 4.
Work Order Procedures
- 5.
Post Trip Review
- 6.
Timeliness of Event Notification
- 7.
Updating Vendor Supplied Information
- 8.
Involvement of QA Personnel with other Station Departments
- 9.
Post Maintenance Operability Testing 26
~*
tit March 29, 1983
- Based on-NRC review of information provided by the licensee in letters dated March 14 and March 15, 1983 and insp~ctions and meetings at the Salem site, the following issues are considered resolved for restar~:
- 5.
Post Trip Review
- 6.
Timeliness of Event Notification
- 7.
Involvement of QA Personnel with other Station Departments Evaluations addressing each resolved issue are included with the issue in this report.
For the remaining management issues which are not yet resolved, no evaluation is included nor are the required actions updated to reflect licensee commi*tments.
The remaining evaluations.will be provided in a final report before restart of either Salem unit..
- 1.
Overall Management Capability and Performance.
- a.
Issue Historically, PSE&G management has not displayed the expected aggressive effort to self evaluate and redirect efforts to correct internally identified problems.
However, the licensee has responded to the specific evalµations
. conducted by external organizations such as INPO, NRC and consultants.
Each of these are discussed below.
The 1981 INPO evaluation identified opportunities for improvement in numerous areas including:
staffing, personnel safety practices, adherence to procedures, control of documents a~d design changes, availability of technical support, o'perating practices with respect to inoperable alarms and tagouts, shift turnover procedures, and goal$ and objectives.
Based on continuing observation, the licensee responded positively to selected findings by various actions although the effectiveness of these actions has been less than expected.
The area of preventive maintenance, beyond that required by technical speci-ficatidns, was also raised as an issue by JNPO in 1981.
The licensee instituted a program to be responsive to this INPO concern, but the recent 1982 INPO report still contains Findings and Recommendations and identifies a target date for completion of this effort in February 1983.
It should be noted that the reactor trip breakers were identified by the licensee for inclusion in this program.
Based on the 1982 INPQ report additional findings were identified in the areas of industrial safety, use of the computer tagging system, backloi of work orders, drawing revisions and plant modifications, adherence to established radiation protection procedures and policies,.and material and housekeeping conditions in the auxiliary building and intake structures.
Four SALP assessment were conducted by the NRC during the period October 1980
-Octobe~ 1982.
The earlier assessments identified weaknesses in the areas of:
design change documentation, engineering support responsiveness, health physics, 27
March 29, 1983 physical security and overall management followup to numerous areas.
The later SALP assessments acknowledge licensee management attention to, and improvements in the areas of, design change tracking and documentation and health physics. Physical security, despite several initiatives on the part of the licensee to improve the area, continued to be weak.
Very recently, the
- licensee has dedicated considerable resources to physical security which, if properly implemented, should facilitate a number of hardware.improvements and add several managers to the organization to more effectively monitor security activities on.a day-to-day basis.
The most visible initiatives made by the licensee are organizational.
During the licensing process for Salem Unit 2 in 1981, the licensee made a.decision to place all activities, including engineering under a single vice president.
Commitments were made to relocate these activities from the corporate offices in Newark, New Jersey to the site located in Southern New Jersey.
While the licensee was. hopeful that such relo.cation of the engineering staff, including*
QA personnel, to the site would prove more effective, the process has moved much more slowly than hoped and has even resulted in the loss of certain personnel.
As late as January 1983, the QA department was placed in the Nuclear Department, and began moving to the site.
The organizational and location changes have now been in transition for almost 18 months.
Station or~anizational changes were also made to focus effort appropriately and a number of new data management systems were installed to track issues for management followup.
With respect to safety review committees, NRC inspection experience has shown that the onsite and offsite review committees are properly constituted, meet frequently, and ask cogent questions.
Since licensing of*Unit 2, the licensee has maintained a separa*te independent Safety Review Group (SRG) with a general charter to* identify and eva 1 uate safety issues.
In response to an NRC request, the licensee has agreed to evaluate the effectiveness of the SRG in terms of types of issues addressed and more importantly, the approach to and timeliness of the licensee's response to such recommendations.
PSE&G management is generally cap ab 1 e and has been wi 11 i ng to make changes to improv~ safety. While the licensee has demonstrated his ability to react to external direction, a strong self-assessment program has not been effectively carried out that would identify.the specific deficiencies identified by the several external review efforts discussed previously, or of equal importance, to identify and rectify their root causes.
- b.
Short Term Actions (1)
Licensee Action NRC will require the licensee to determine whether the currently identified problems with the reactor trip breakers are indicative of broader based pro-blems with the administrative and managerial control system.
Licensee has committed to evaluate the effectiveness of the independent SRG in terms of issues addressed and resolutions.
In particular, the evaluation
- should address the role of SRG with respect to. the August 1982 and January 1983 reactor trip breaker problems.
28
.. 1
tit March 29, 1983
'(2)
NRC Action NRC will review the licensee's evaluations and will require the licensee to addres~ any broader based problems identified as a result of that evaluation.
- c.
Long Term Actions (1)
Licensee Action Continue management initiati~es aimed at improving organizational respon-siveness to identifying and resolving problems, particularly in the areas of procedure adequacy and adherence.
(2)
NRC Action Continue to review the adequacy of management control and timely resolution of problems through an augmented inspection program.
- d.
Evaluation Some short term actions are incomplete, hence, this issue is not yet resolved.
- 2.
Master Equipment List
- a.
Issue The licensee maintains a Q list that identifies activities, structures, and systems to which the Operational Quality Assurance (QA) Program applies.
A Master Equipment List (MEL) is used by the licensee as the reference document for determining the safety classification of individual equipment.
The MEL is intended to be a comprehensive list of all station equipment and identifies
~~ch item as nonsafety related or safety related. When preparing maintenance work. orders, the MEL is consulted to determine if QA coverage of the work. is necessary.
Licensee and NRC review identified three problems associated with the MEL.
These prob fems are, 1) the accuracy _and comp 1 eteness of the docu-ment, 2) iss~ance as a ndncontrolled document, and 3) lack of understanding by plant personnel of its proper use.
The MEL was deri~ed from engineering source documents and a construction program document called Project Directive 7 (PD-7) and was provided to station personnel by the Engineering Department as a reference document in July 1981.
Prior to issuance of the MEL. the PD-7 was used as the reference document. The MEL, however, was not issued as a controlled document, therefore verif~cation of its accuracy and completeness on issuance was not assured, and it was not updated in the plant as necessary.
The reactor-trip circuit breakers were not included in the MEL.
In addition, some personnel were not familiar with how to use the MEL for determining the classification of a particular piece of equipment.
Maintehance personnel acknowledged that reference was made to PD-7 on occasion during the January - February 1983 period.
29
~.*
Marc:h 29, 1983
- b.
Short Term Actions (1)
Licensee Action The NRC will require that the licensee:
- 1.
Verify the MEL is complete and acc:urate with respect to emergency core cooling (ECCS) including actuation systems, RPS, auxiliary feedwater, and containment isolation systems.
- 2.
Instruct appropriate personnel in the purpose and use of the MEL.
(2)
NRC Action NRC will perform sampling review of the MEL on the above systems.
- c.
Long Term Actions (1)
Licensee Action NRC will require that the licensee verify the completeness and accuracy of the MEL and reissue it as a controlled document.*
(2)
NRC Action NRC will confirm completion of the licensee's long-term action.
- d.
Ev a 1 ua ti on Some short term actions are incomplete, hence, this issue is not yet resolved.
3.*
Procurement Procedures
- a.
Issues A review of safety and quality classifications for the reactor trip breakers indicates that the licensee's established management and administrative controls allowed the procurement* of replacement components for a safety system with a quality less than that of the original design.
This is evidenced by procurement activities concerning the purc:hase of reactor trip breakers and replacement components conducted during the period from June 1, 1981 to March l, 1983.
One example involved the issuance of a purchase order for a spare reactor trip breaker on June 1, 1981.
Contrary to the established administrative controls;*
the breaker was classified incorrectly; the proper review and approval was not conducted; and no QA requirements were imposed as required for the original equipment.
Subsequently, on September 15, 1982, the classification for the same order was changed to an even more inappropriate classification without the required review and approval process.
As a result of these activities,*
the purc:hased breaker was received and placed into storage, ~ithout further use, without appropriate documentation that would demonstrate suitability for its use had it been required.
30
tit March 29, 1983
- All subsequent purchases for reactor trip breaker components consistently utilized the initial incorrect classification. A spare coil for a UV trip attachment purchased in this manner may have been utilized on August 20, 1982.
Though the procurement review focused on the reactor trip breaker, the licensee's activities in the area for other safety related components could have resulted in similar circumstances existing for plant safety systems.
- b.
Short Term Actions (1)
- Lic~nsee Action NRC will require and the licensee has made a commitment to have the procure-ment prqcedures evaluated and modified as required to ensure that the appro priate classification is being applied to items and/or services important to*
safety.
(2)
NRC Action NRC will verify that the licensee has evaluated and modified procurement procedures as necessary.
- c.
Long Term Actions (1)
Licensee Action The licensee will review the organization relationships involved fn the procure-ment process and assess the current management controls to provide and ensure that departure from expected performance of personnel involved in the procure-ment process w-ill *be appropriately flagged for management attention. Addition-ally, the licensee will formulate a plan to review and assess on a sampling basis the procurement process as it relates to all. prior procurement activity on systems important to safety.
The plan will address the schedule, and
- criteria to be applied for an accelerated sampling based upon initial find.ing.
- d.
Evaluation Some short term actions are incomplete, hence, this issue is not yet resolved.
- 4.
Work Order Procedures
- a.
Issue The review identified that the personnel preparing maintenance work orders were not complying with instructions contained in the station admintstrative procedure.
Specifically, for the work performed on the reactor-trip circuit breaker in January 1983, the engineering department was not consulted to verify safety classification, and an erroneous nonsafety determination was made.
Such consultation is required if equipment is not listed in the MEL.
There was, therefore, no independent review within the maintenance organiza-tion, and the Quality Assurance Department was not involved in the work.
31
Marc:h 29, 1983 Historic:ally, there was no r.eq-uirement for QA personnel to be involved in the review.of work orders as they were proc:essed to assure that appropriate steps were taken to assign c:lassific:ation. It should be noted, however, that all.
other work orders for maintenance or services on the reactor trip breakers were found to be properly designated safety-related.
- b.
Short Term Actions (1)
License~ Action The licensee has made a commitment to have the QA Department*review all non-safety related work orders prior to starting work, and to implement a program and training to ensure that work orders are properly classified.
NRC will require the licensee to review work orders written since issuance of the MEL for proper classification and will evaluate safety consequences of those found improperly classified.
(2)
NRC Action NRC will review licensee 1 s work order classification program.
- c.
Long Term Actions All required actions were short term.
- d.
Evaluation Some short term acti-0ns are incomplete, hence, this issue ts not yet re~olved.
- 5.
Post-Trip Review
- a.
Issue.
The li.censee did not determine that there had been a failure to trip automa-tically on February 22 until the comp_uter printout of the sequence of events was reevaluated on February 26, as a result of NRC inqu1r1es.
Although the licensee conducted a review of each trip, there was no formal procedure for conducting a systematic review.
By letter dated March l, 1983, the licensee made a commitment to develop a post-trip and post-safety injection review procedure. The procedure will specify the review and documentation necessary to determine the cause of the event and whether equipment functioned as designed.
Other key elements of a post-trip review procedure are 1) necessary management authorization for restart, 2) debriefing of affected operators, 3) verification that reporting requirements were completed, and 4) followup review by safety committees.
Furthermore, the affected individuals who will be required by procedure to review the sequence of events computer printout and other event records wi 11 need to receive necessary training in the proper interpretation, understanding and evaluation of these records.
32
e March 29, 1983
- b*.
Short Term Acti ans (1). Licensee Action NRC will require and the licensee has committed to develop and issue a post-trip and post-safety-injection review procedure and train appropriate Operations Department personnel on the re4uirements prior to Unit 1. restart.
(2)
NRC Action NRC will review the licensee's post-trip and post-safety injection review procedure to ensure the key elements noted above are adequately addressed.
- c.
Long Term Actions.
All required actions were short term.
- d.
Evaluation In response to this issue, the licensee in his March 14, 1983 letter submitted Administrative Directive (AD) - 16, Revision 1 dated March 13, 1983 entitled "Post Reactor Trip/Safety Injection Review and Startup Approval Requirements 11
- A0-16 provides for a formal post trip and/or post safety injection review to be performed by the Senior.Shift Supervisor and the STA qualified shift super-visor.
Specific. areas to be reviewed and documented include:
- 1) condition of the unit prior to the event~ 2) personnel assignments, 3) evolutions in progress which could have contributed to the event, 4) major equipment, protection and control systems out of service or inoperable at the time of the event 5) mode of event initiation (i.e manual or automatic), 6) sequence of events (SOE) computer printout and other alarm printouts, 7) control room recorder charts, 8) alarms received which were unusual for the event or other expected alarms which were not received, and 9) requir~d corrective ~ctions to be completed prior to startup.
The above information, as well
~s a narrative of the event, will be documented on Form A0-16-A, and the SOE printout, recorder charts and other event records will be incl.uded with the report.
The staff has reviewed the licensee's post trip and post safety injection review procedure to determine that the key elements noted in S.a. above have been adequately addressed.
These key elements are:
- 1) that sufficient event review wi 11 be conducted to determine. the cause of the event and whether equipment functioned as designed; Z) that necessary management authorization for restart is specified;
- 3) that debriefing of appropriate personnel is required to be conducted;
- 4) that reporting requirements are required to be completed;
- 5) that a followup review by safety committees is required to be conducted; 33
..:1 I
March 29, 1983.
- 6) that personnel conducting the review understand information provided by the event records.
Based on the. information required to be provided on Form AD-16-A, the fact that two SRO licensed operations personnel (i.e. the senior shift supervisor and the STA qualified shift supervisor) are involved with the review, and the requirement for specific review and attachment of applicable event records (i.e. the SOE printout), control room recorder printouts, and the auxiliary alarm printout, the staff is satisified that AD-16 specifies. a sufficently deta i 1 ed review of a*n event to determine i.ts cause and whether equipment functioned as designed.
With re~pect to management authorization for restart, the procedure specifies that the Operations Manager (OM) may authorize restart following a reactor trip or safety injection provided that 1) the post trip review has been com-pleted, evaluated and reviewed with the OM and 2) the evaluation clearly indicates the cause of the event and that all equipment and systems functioned as designed.
If the cause of the event has not been clearly determined or there is a question concerning the proper performance of equipment or systems, the procedure specifies that an investigation be conducted and reviewed by the Station Operations Review Committee (SORC) prior to startup.
Restart following these more complex events will be authorized by the General Manager - Salem Operations after receipt of SORC recommendations and.a determination that the unit can be restarted safely.
The staff questioned why restart is not always authorized by the General Manager - Salem Operations since he is the individual who is re.sponsible per Technical Specification 6.1.1 for overall facility operation.
The staff was informed that in all cases, the General Manager or Assistant General Manager will be kept informed of the circumstances of an event and would be able to redirect the Operations Manage~*s actions, if necessary.
Hence, although specific. restart authority is granted to the OM for clearly understood e*vents, upper level management oversight will exist f_or all reactor trip and safety injection events.
The staff also noted that the procedure specifies that individuals authorized to assume the OM's responsibiltties may authorize startup if the OM is not available.
The staff was informed that the Operations Engineer (OE) period-ically assumes the OM's duties when the OM is in training.
The staff has verified that the qualification requirements for the OE are the same as for the OM per Administrative Procedure -2. which references ANSI-18.l, 1971.
Based on the above. the staff is satisified that the procedure specifies the appropriate management authorization for restart following a reactor trip or safety injection.
With respect to debriefing of appropriate personnel, the procedure specifies that fact finding sessions are conducted with *ppropriate personnel to determine the cause of the event, actions taken and observed sequence of ~vents. The fact finding sessi ans wi 11 be conducted as part of the review, prior to restart.
The staff is satisffed that this element is adequat~ly addressed.
With respect to reporting requirements, the procedure specifies that a deter-mination be made that the event was properly classified and that with respect 34
L tit March 29, 1983
'to follow-up review by safety commi.ttees, provision is addressed in the *procedure to have the onsite safety committee (SORC) review all reactor trips and safety.
injections.
As noted above, for.those events where the cause is not clearly indicated or there is any question of the proper functioning of equipment, the SORC
- wi 11 review the ~vent prior to restart.* For other events, the SORC wi 11 review the event but not necessarily before restart. Additionally, the Nuclear Support Department will also perform an independent review of each reactor trip/safety injection event for the purpose of determining corrective actions to prevent the type of event from ~eoccurring. Also, the procedure specifies _
that the original event review report will be maintained on file for fature reference.
Based on the above, the staff is satisifed that sufficient followup review of these events will be conducted.
With respect to the review* personnel understandi_ng the information provided by the event records, the staff notes that the reviews are conducted by SRO licensed personnel who _are familiar with the various co~trol room recorders and alarm printouts.
However, as evidenced by the recent ATWS ev.ents, these personnel were not as familiar with the information provided on the SOE printout (such as interpretation of the timing of the line entries).
The licensee has conducted training for Operations personnel on the SOE printouts for the February 22 and 25 events.
However, in the opinion of the staff, this training is not sufficient to ensure that these individuals have a satisfactory *under-standing of other SOE printouts. Additionally, operating personnel may not have a detailed understanding of expected response times of equipment.
The licensee has indicated his intention to reevaluate ~he format and information provided on the SOE printout to make it easier to unde.rstand and evaluate, and as other SOE printouts for reactor trips/ safety injections become available, to provide additional training for Operations personnel.
The staff agrees these additional measures are useful, but until they are implemented, the staff has requested and*the licensee has committed to have an instrument and controls (I&C) supervisor who is knowledgeable on the SOE computer and.under-
~tands expected equipm~nt response times, personally review SOE printouts for for all reactor trips/safety injections prior to restarting the plants. With this commitment, the staff is satisifed that personnel conducting the reviews have a sufficient understanding of the event records.
AD-16 will be revised to reflect this commitment.
Bas*d on the staff's review of the elements of licensee's post trip and post safety injection* review pr.ocedures and for the reasons identified above, the staff concludes that the post trip review issue is resolved.
The staff will verify that the above commitment to have an I&C supervisors review the SOE printout is reflected in the revised AD-16.
- 6.
Timeliness of Event Notification
- a.
Issue On three occasions between January 30 and February 25, 1983, the licensee notified NRC of significant events belatedly.
In each case, the notification was approximately 30 minutes late.
Two of these reports were for the February 22 and 25 events.
Furthermore, in the February 22 event, the first notifica-tion did not contain known significant information regarding actuation of engineered safety features and opening of the power operated relief valves.
35
March 29, 1983 This additibnal information was provided approximately 40 minutes--later.
The notification procedures used by the licensee warrants further evaluation as to the priority assigned for NRC notification.
- b.
Short Term Action (1)
Licensee Action NRC will require the licensee to reemphasize reporting requirements with all shift and on-call* management personnel and will reevaluate notification prior-ities.
(2)
NRC Action NRC will confirm that licensee's short term action is completed.
- c.
Long Term Action A 11 required acti ans were short term.
- d.
Evaluation In response to this issue, the licensee in his March 14, 1983 letter, indicated that the importance of adhering to the reporting requirements of 10 CFR 50.72 has been emphasized to all operating personnel.
Emergency plan procedure EP-I-1 Attachment 4 has been revised to rearrange the priori-ty of notification to the NRC.
Additionally, the emergency plan procedures have been revised to require designated personnel to immediately start making the required notifi-cations and reading the initial contact messages upon classification of the event.
The licensee has also indicated that training on the revisions to the Emergency Plan procedures will be conducted prior to startup for personnel involved in implementation of the Emergency Plan.
The NRC staff considers the licens~e 1 s actions noted above to be sufficient to ensure that the notification requirements of 10 CFR 50.72 will be met in the future.
This issue is considered resolved.
The staff will verify completion of the a~ove noted training prior to restart.
- 7.
Updating Vendor Supplied Information
- a.
Issue As a result of the February 25, 1983 event and NRC IE Bulletin 83-01, the licensee indicated not being aware of the existence of two Westinghouse tech-nical service bulletins that provided preventive maintenan~e recommendations for the reactor-trip circuit breakers.
The two documents in question were published by Westinghouse in 1974.
The licensee has requested documentation for all Westinghouse equipment and will incorporate this information into station documents.
While we are not aware of any problems with other vendor documentation, an NRC staff concern is whether a similar situation exists with respect to documentation for other vendor-supplied information.
36
k.
~March 29, 1983
.ob.
Short Term Actions (1)
Licensee Action The licensee has made a commitment to a program to update existing documenta-tion on safety equipment and to ensure that vendor documentation is under a*
controlled system.
(2)
NRC Action NRC will evaluate licensee's vendor documentation program.
- c.
Long Term Actions (1)
Licensee Action The licensee will complete the above program by December 1983.
(2)
NRC Action NRC will perform inspec.tions to verify the implementation of licensee's program.
- d.
Evaluation Some short term actions are incomplete, hence, this issue is not yet resolved.
- 8.
Involvement of QA Personnel with Other Station Departments
- a.
Issue THe Quality Assurance Department did not review maintenance work orders associated with repair of. the reactor-trip circuit breakers in January 1983 because the work was not -designated safety related.
Further examination*
determined that the QA Department does not review for proper determination of.
classification the work orders designated nonsafety related by other depart-ments.
Discussions with the licensee indicate that the QA Department has been somewhat i~olated f~om*the activities of other departments.
As a result of prior decisions, the licensee had initiated steps in January 1983 to relocate the QA Department from the *corporate offices in Newark, New Jersey to the site and is taking steps to increase QA Department involvement in other station activities.
Completion of this program of increased QA involvement with other station activities need not be completed prior to restart, because completion of short-term actions in management issues 2 and 3 is sufficient to correct QA deficiencies in the short term.
- b.
Short Term Actions (1)
Licensee Action The licensee had a commitment to institute a program to more fully integrate QA activities into the overall activities.
37
--*-*---***-~~-
-~* #
- c.
- Long Term Actions (1)
Licensee Actions March 29, 1983 The licensee will complete the above QA integration program.
The licensee has committed to have a consultant perform an independent assessment of the QA program including the effectiveness of its implementation.
This review and an action plan for improving the Nuclear Operations QA p~r formance is to be prepared by July 1, 1983.
(2)
NRC Action Monitor licensee 1 s implementation of the above QA integration program.
The*
independent consultant 1 s assessment, PSE&G evaluation, and the subsequent action plan will be reviewed by Region I by August l, 1983.
NRC will continue to cover QA involvement in station operations as. a part of the Salem inspection program.
- d.
Evaluation Prior to these events, the PSE&G total corporate nuclear QA effort was re-organized effective January 3, 1983 to place the.Operational Quality Assurance Organization into the Nuclear Diviiion.
Those personnel assigned to this organization who formally worked in the corporate offices in Newark, New Jersey are in the process of being relocated to the site.
Most of the exist-ing personnel in the site QA/QC organization were absorbed into this new or_gani zati on.
The purpose of this change was to provide for increased in-vol vement by QA personnel in the day-to-day *functioning of the Nuclear Depart-ment.
Such integration of a 11 QA fun ct i ans into the Nuclear Department is expected to lead to better interface with other plant personnel for problem discussion and resolution.
It will enable auditors to be more knowle*dgeable about operations as compared to the past when QA auditors were more likely to be 11 generalists 11
- Audit plans are being changed to place more emphasis on system effectiveness (i.e., how it is working?).
In describing the objectives of this reorganization to NRC Region I in a January 4, 1983 meeting, PSE&G indicated that increased daily monitoring and overview were being emphasized for Operations QA personnel as a part of this reorganization.
To better prepare for such increased involvement, it was indicated that in the future, some QA personnel would receive operator type training up to and including simulator training.
Since the February 1983 ATWS events, PSE&G has taken further steps to place greater emphasis on QA program implementation through increased observation and monitoring.
By policy directive dated March 11, 1983, QA personnel have been instructed to place emphasis on adherence to procedures and review of engineering activities such as design changes, procurement control and work orders.
An ongoing comprehensive review of QA Program implementing procedures and any necessary *changes is expected to be completed by August, 1983.'
To emphasize the existing QA program requirements and recent procedural changes as a result of the ATWS events, an indoctrination/training program was conducted by PSE&G for appropriate personnel.
NRC review of the lesson plan for that 38
~March 29, 1983 "training shows that it included discussions of Classification, Work Orders and Procurement.
Specifically included was use of the MEL System, criteria to be used in the determination of safety classificatio*n for proper classification of work orders and procurement documents, and fnterfaces with Nuclear Engineering to resolve any classification questions.
Numerous personnel from all major station departments attended such training sessions as shown i.n attendance records reviewed by NRC.
NRC staff has verified that procedures have been changed to require QA to review and stamp all non-safety related work orders (for concurrence that it was properly classified) prior to implementation.
Administrative Procedure AP-9 (3/10/83) and Quality Assurance Instruction QAI 10-6 (3/11/83) were found to provide for QA review of station work orders and involvement in station maintenanc~ work. *The ltcensee has committed to provide additional detailed training on initiation, processing and closeout of work orders to reemphasize QA and test/retest requirements involving interdepartmental coordination by September l, 1983.
Such training will be monitored by Region I as a part of
~ontinuing on-site inspecti-0n coverage.
The licensee has committed to have an outside consultant organization perform an independent assessment of PSE&G's QA program and new organization as discussed further under management issue number 1.
This assessment is to consist of a review of (1) the QA organizational structure and staffing, (2) the QA program content and procedures, and (3) the effectiveness of implementation of those programs and procedures.
This review will, by its nature, include QA department involvement and integration into other plant activities. After review of findings and recommendat i ans from this assessment, PSE&G is to pre pa.re an action plan for implementing any appropriate changes by July 1, 1983.
Through continuing*inspection coverage, NRC will assure that a meaningful review is accomplished and appropriate recommendations resulting from that review are*
promptly implemented.
In summa.ry, NRC review of this area has verified that the licensee is accel-erating previous plans to more fully involve QA personnel in the day-to-day operation of Salem 1 and 2..
Integration of QA personnel into activities covered by_ work orders such as modifications and. maintenance will be required by recently revised procedures.
Reemphasts and retraining of appropriate personnel on proper use of existing procurement procedtires should assure proper future QA involvement in a.11 procurement act i ans.
NRC has determined that the licensee has recently taken appropriate steps to more fully integrate QA activities into overall Nuclear Department activities.
This issue is considered reso~ved for restart.
The implementation of this QA integration program will continue to be monitored over the long term in the Region I continuing inspection program.
- 9.
Post-Maintenance Operability Testing
- a.
Issue Past practice at Salem for post maintenance operability testing has varied.
Such testing may be specifie9 by the preparer of the maintenance work order or left to the discretion df maintenance personnel.
For safety-related equip-ment, post-maintenance surveillance testing is done before returning the 39
March 29, 1983 '
equipment to service. Additional functional post-maintenance and repair testing of equipment, such as surveillance testing, may need to be performed to demonstrate operability as an integral part of the larger component or system in which it must function.
- b.
Short Term Actions All required actions were long term.
- c.
Long Term Actions Licensee Action The 1 icensee wi 11 review and revise procedures and practices as necessary to ensure that functional testing of the overall components or system is per-formed to demonstrate operability prior to returning the equipment to service following maintenance and repair.
Procedures will be revised, as necessary, to assure that operations department personnel review the testing prior to returning such equipment to service.
NRC Action - Long Term NRC will review licensee's revised procedures and their implementation to assure that appropriate post maintenance operability testing is* being accom-plished before equipment is returned to service.
- d.
Evaluation
..1'-.* -~--
Although no short term actions were required, NRC review of licensee's proposed actions to comply with this issue is not yet complete.
Hence, this issue is not yet resolved.
40