ML18100B168
| ML18100B168 | |
| Person / Time | |
|---|---|
| Site: | Salem  |
| Issue date: | 06/23/1994 |
| From: | Roxanne Summers, Wiggins J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML18100B167 | List: |
| References | |
| 50-272-94-80, 50-311-94-80, NUDOCS 9407010055 | |
| Download: ML18100B168 (80) | |
See also: IR 05000272/1994080
Text
U. S. NUCLEAR REGULATORY COMMISSION
REGION I
REPORT/DOCKET NOS.
50-272/94-80
50-311/94-80
LICENSE NOS.
LICENSEE:
- Public Service Electric and Gas Company
P.O. Box 236
FACILITY:
INSPECTION DATES:
INSPECTORS:
STATE OBSERVER:
TEAM LEADER:
APPROVED BY:
i;;v.-
9407010055 940624
- -
ADOCK 05000272
G
- ~
Hancocks Bridge, New Jersey 08038
Salem Nuclear Generating Station
April 8-26, 1994
Stephen Barr, Resident Inspector, Salem, DRP (Asst. Team
Leader)
J. Scott Stewart, Examiner, DRS
Iqbal Ahmed, Senior Electrical Engineer, NRR
Warren Lyon, Senior Reactor Systems Engineer, NRR
John Kauffman, Senior Reactor Systems Engineer, AEOD
Larry Scholl, Reactor Engineer, DRP
Richard Skokowski, Reactor Engineer, DRS
Howard Rathbun, NRR Intern
Richard Pinney, New Jersey Department of Environmental*
Protection and Energy
g~ui~
Engineer
(,,lfa;}o/t
ProJects Branch 2, DRP
es T. Wiggins, Ac *
Division of Reactor Safety
EXECUTIVE SUMMARY
Areas Inspected: An Augmented Inspection Team (AIT), consisting of personnel from Region I
AEOD and NRR, inspected those areas necessary to ascertain the facts and determine probable
causes of the automatic reactor shutdown and multiple automatic initiations of the safety injection
system that occurred on April 7, 1994. The team assessed the safety significance of the event,
including the resultant plant operation with a water (liquid) filled pressurizer and its challenge
to the primary coolant boundary integrity and the potential vulnerability of the ultimate heat sink
to the same marsh grass intrusions that challenged the plant normal heat sink, which was the
initiating event for the sequence of events on April 7. The adequacy of the licensee's design,
maintenance and troubleshooting practices relative to the safety injection system was reviewed.
The possibility for any potential generic implications posed by the Salem event was assessed.
Results: The Augmented Inspection Team (AIT) developed a sequence of events detailing the
circumstances surrounding a Salem Unit 1 plant trip and a series of safety injection system
actuations. It was found that the events led to the loss of the pressurizer steam bubble and the
normal reactor coolant system pressure control system, and an Alert declaration. The AIT noted
through an event sequence and causal factor analysis that the root causes of key events generally
included a combination of component failure and human error. Additional procedural guidance
for, and prioritization of work activities of control room operators would have resulted in a
better response to the event. The AIT found in general that the licensee response to the almost
daily _event of grass clogging of the circulating water screens was very well planned and
coordinated for the additional workload at the circulating water structure. However, as indicated
by the performance of personnel and equipment in response to the April 7 event, the licensee
did not adequately plan for, and coordinate, the activities corresponding to the additional
workload in the control room resulting from the same event.
Finally, even though some equipment and licensed operators performed poorly during the
ensuing transient on April 7, the core and its primary protective barriers were maintained
throughout the event.
In addition, the following conclusions were developed as a result of the AIT review and
discussed at a public exit meeting held on April 26, 1994:
Summary of Conclusions:
1.
No abnormal releases of radiation to the environment occurred during the event (Section
3.4).
2.
The April 7, 1994 event challenged the RCS pressure boundary resulting in multiple,
successful operations of the pressurizer power operated relief valves and no operations
of the pressurizer safety valves (Section 3.2).
3.
Operator errors occurred which complicated the event (Section 4).
ii
EXECUTIVE SUMMARY (CONT'D)
4.
Management allowed equipment problems to exist that made operations difficult for plant
operators (Section 7.2).
5.
Some equipment was degraded by the event, but overall, the plant performed as designed
(Section 3).
6.
Operator use of emergency procedures was good. However, procedural inadequacies
were noted with other operating procedures (Section 4).
7.
Licensee's investigations and troubleshooting efforts were good (Section 5).
iii
TABLE OF CONTENTS
EXECUTIVE SUMMARY ...................................... ii
EXECUTIVE SUMMARY (CONT'D) ............................... iii
TABLE OF CONTENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv
1.0
INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.1
Event Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2
Augmented Inspection Team Activities . . . . . . . . . . . . . . . . . . . . . .
1
2.0
GENERAL SEQUENCE OF EVENTS
. . . . . . . . . . . . . . . . . . . . . . . . . . 2
3.0
PLANT RESPONSE TO EVENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
3 .1
Solid State Protection System (SSPS) Response . . . . . . . . . . . . . . . . . 4
3.2
Pressurizer PORVs, Safety Valves & Associated Pipe . . . . . . . . . . . . .
7
3.3
Circulating and Service Water Systems . . . . . . . . . . . . . . . . . . . . .
13
3 .4
Reactor Systems Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
16
3.5
Atmospheric Steam Dump Valves and Steam Generator Safety Valves . .
21
4.0
PLANT OPERATOR PERFORMANCE & PROCEDURE ISSUES . . . . . . . .
21
4.1
Operator Response Prior to the Plant Trip . . . . . . . . . . . . . . . . . . .
22
4.2
Operator Response Following the Plant Trip and Safety Injections . . . .
25
4.3
Procedure Adequacy and Use . . . . . . . . . . . . . . . . . . . . . . . . . . .
28
4.4
Event Classification & Notifications . . . . . . . . . . . . . . . . . . . . . . .
30
4.5
Simulator Demonstration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
30
4.6
Reactor Vessel Level Indication System (RVLIS) Monitoring . . . . . . . .
30
4. 7
Operations Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
32
5.0
EVALUATION OF TROUBLESHOOTING ACTIVITIES
. . . . . . . . . . . . .
34
6.0
OTHER FINDINGS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
40
7.0
SAFETY SIGNIFICANCE AND AIT CONCLUSIONS . . . . . . . . . . . . . . .
42
7 .1
Safety Significance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
42
7.2
AIT Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
43
8.0
EXIT MEETING . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
49
ATTACHMENT 1 - AIT Charter
ATTACHMENT 2 - Safety Injection System Logic Diagram
ATTACHMENT 3 - Confirmatory Action Letter
ATTACHMENT 4 - Sequence of Events
ATTACHMENT 5 - Acronyms
ATTACHMENT 6 - Exit Meeting Attendees
ATTACHMENT 7 - Figures
iv
J
DETAII.S
1.0
INTRODUCTION
1.1
Event Overview
On April 7, 1994, operators at Salem Unit 1 were operating that unit at 73% power. The plant
was at a reduced power level due to the reductions of condenser cooling efficiency resulting
from the problems river grass had been causing at the unit's condenser circulating water (CW)
intake structure. Shortly after 10:00 a.m. that morning, a severe grass intrusion occurred at the
intake structure, and many of the Unit 1 CW pumps began to trip. Operators consequently
began to reduce plant power in order to take the unit turbine off line. As a result of operator
error and equipment complications, a Unit 1 reactor trip and automatic safety injection occurred
at 10:47 a.m., and a subsequent second automatic safety injection occurred at 11:26 a.m. The
subsequent sequence of events resulted in the Unit 1 primary coolant system filling, resulting
in a loss of normal pressurizer pressure control at normal operating temperature and pressure.
The licensee declared an Unusual Event and subsequently an Alert condition at the unit.
The events of April 7, from the initiating downpower transient to the ensuing reactor trip and
safety injections, were complex and involved a combination of personnel errors and equipment
failures.
1.2
Augmented Inspection Team Activities
On April 7, 1994, senior NRC managers determined that an AIT was warranted to gather
information on the plant trip and subsequent safety injection system actuations at Salem Unit 1.
The AIT was initiated because of the complexity of the events, the uncertainty of the root causes
of some of the conditions and equipment problems that had been encountered during the events,
and possible generic implications. A charter was formulated for the AIT and transmitted to the
team on April 8, 1994 (Attachment 1). The NRC Region I Regional Administrator dispatched
the AIT early on April 8, 1994. The AIT met with PSE&G management and staff regarding
the facts known at that time for the April 7 event.
On April 8, 1994, NRC Region I issued a confirmatory action letter (CAL) that documented the
verbal commitments made by the licensee to the NRC regarding the control of activities
for equipment that failed to operate properly during the event, PSE&G support of the team
inspection activities and the subsequent restart of the unit. The CAL is enclosed as Attachment
3.
The team completed initial inspection activities on Apri.115, 1994. Additional onsite inspection
was conducted on April 17, 20 and 21, 1994, to perform additional operator interviews and to
review the results of ongoing troubleshooting and testing activities. The work directed by the
AIT charter was completed and a public inspection exit meeting was held on April 26, 1994.
The AIT participated in two congressional staff briefings, a public NRC and PSE&G
2
management meeting on May 6, 1994 and an NRC Commissioners' briefing on May 11, 1994.
The AIT provided information/findings to NRC Region I for use in developing the issues
warranting corrective action or further analysis prior to restart of Unit 1.
2.0
GENERAL SEQUENCE OF EVENTS
On April 7, 1994, prior to the reactor trip and safety injection events, Salem Unit 1 was
operating at approximately 73 % power. Operators were operating the plant at less than full
power due to the effect marsh grass in the Delaware River was having on the Salem units'
circulating water (CW) systems.
Over the course of late winter and early spring, heavy
accumulations of the river grass at the CW structure were clogging the CW system travelling
screens which protect the CW pumps from river debris.
By approximately 10:30 a.m. on April 7, the power level at Unit 1 had been decreased to about
60 % power as a result of an increase in condenser back pressure due to river grass interfering
with the travelling screens at the CW structure. In response to the approaching loss of CW,
Unit 1 operators began a unit load reduction at 1 % power per minute. From 10: 15 a.m to 10:40
a.m., several of the Unit 1 CW travelling screens clogged with grass and caused the
corresponding CW pump to trip off line. Operators attempted to restore the pumps as they
tripped, but by 10:39 a.m. only one CW pump was available.* As the CW pumps were lost from
service, operators increased the rate of the downpower maneuver from 1 % to 3 % to 5 % to
eventually 8 % per minute. As the operator responsible for controlling turbine power reduced
the unit load, the operator responsible for reactor power correspondingly reduced reactor power
by inserting the reactor control rods and by boration.
Initially, during the downpower maneuver, operators reduced turbine power ahead of reactor
power, and the resulting power mismatch caused slightly higher than normal temperature for the
primary coolant system. At about 10:43 a.m., the Nuclear Shift Supervisor (NSS) directed the
operator controlling reactor power to go to the electrical distribution control panel to begin
shifting plant electrical loads to offsite power sources. At that time the control room crew
members believed the plant was stable; however, they failed to recognize that reactor power was
still decreasing due to the delayed effect of a boron addition that had been made. This led to
reversal of the power mismatch and a decreasing T...,. At 10:45 a.m., the NSS identified the
resultant over-cooling condition, went to the reactor control panel and began withdrawing control
rods to raise coolant temperature, and then turned over control once again to the original
operator. This operator continued to withdraw the control rods, and reactor power increased
from approximately 7% to 25% of full reactor power. Since power dropped below 10% power,
the power range "high neutron flux-low setpoint" trip had automatically reinstated, establishing
25 % reactor power as the automatic reactor trip setpoint. When reactor power reached the 25 %
setpoint, at approximately 10:47 a.m., the reactor automatically tripped.
Almost immediately following the reactor trip, an automatic safety injection (SI) actuated. The
SI was initiated only on Train A of the SI logic on high steam flow coincident with low primary
coolant T_.
Although the operators did not recognize it at the time, the licensee later
3
determined that the high steam flow signal was a result of a pressure wave created in the main
steam lines by the closing of the turbine stop valves when the turbine automatically tripped. In
response to the reactor trip and SI, the operators entered Emergency Operating Procedure (BOP)
BOP-Trip 1 at 10:49 a.m. Due to the nature of the initiating signal, the SI actuation did not
successfully position all necessary components to the expected, post-actuation position, and the
operators, as part of BOP performance, manually repositioned affected components. At 11:00
a.m., the licensee declared an Unusual Event based on a "manual or automatic emergency core
cooling system actuation with a discharge to the vessel." During further performance of the
BOP, operators had to reset the SI logic, and it was at this point that they reafued that Train B
of the SI logic had not actuated and that there was thus an apparent logic disagreement.
As the operators were performing the required BOP steps, the primary coolant system continued
to heat up due to decay heat and running the reactor coolant pumps. As the primary heated up,
steam generator pressure consequently increased, and because of pre-existing problems with the
steam generator atmospheric relief valve (MS 10) automatic control, steam generator pressure
was not properly controlled by these valves. Concurrently, due to primary heatup and the
volume of water added by the SI, the pressurizer filled to solid or near-solid conditions, and the
pressurizer power operated relief valves (PORVs) periodically automatically opened to control
primary pressure. Shortly before 11:26 a.m., steam generator pressure increased to the ASME
code safety valve lift setpoint in the Number 11 and/or 13 steam generator(s). The opening of
the safety valve caused a rapid cooldown of the primary coolant system, and due to the solid
water state of that system, a coincident rapid decrease in primary system pressure. At 11 :26
a.m., primary pressure reached the automatic SI setpoint of 1755 psig, and since Train B of the
SI logic remained armed, a second automatic SI was actuated by that train of logic. Operators
had also identified the decreasing primary pressure and manually initiated SI moments after the
automatic initiation.
Following the second SI, operators remained in the BOP network and pursued stabilizing plant
conditions. At 11 :49 a. m., the pressurizer relief tank (PRT) rupture disk ruptured to relieve the
increasing tank pressure which resulted from the volume of primary inventory relieved to the
PRT. At this point, the operators were faced with cooling down the plant from normal operating
temperature and pressure without having a steam bubble in the pressurizer to control primary
pressure during the transient. Once the ECCS injection was terminated, operators controlled
plant pressure through a combination of charging and letdown using the chemical and volume
control system. At 1:16 p.m., licensee management declared an Alert under Section 17.B,
"Precautionary Standby," of the Salem Event Classification Guide. The licensee decision to
voluntarily enter this Emergency Activation Level was made in order to assure the activation of
the Salem Technical Support Center (TSC) to provide the Salem operators with any technical
assistance that would be required as they cooled down the plant. By 2: 10 p.m., the TSC had
been fully staffed, and at 3: 11 p.m., the operators restored a bubble in the pressurizer.
4
At 4:30 p.m., operators restored pressurizer level to the normal band and returned level control
to automatic.
The operators subsequently exited the EOPs and used integrated operating
procedures to cool the plant down to Mode 4 (Hot Shutdown), which was achieved at 1:06 a.m.
on April 8, and then to Mode 5 (Cold Shutdown), which was achieved at 11:24 a.m. on the
same day.
A detailed sequence of events is provided in Attachment 4.
3.0
PLANT RESPONSE TO EVENT
3.1
Solid State Protection System (SSPS) Response
3.1.1 SSPS Description
The function of the reactor protection system is to sense an approach to unsafe conditions within
the reactor plant and then initiate automatic actions to protect the reactor fuel, the reactor coolant
system and the primary containment from damage. A block diagram of the system logic is given
in Attachment 2. Process sensors monitor various plant conditions and provide an output to the
system bistables. When a trip setpoint is exceeded the bistable deenergizes its associated input
relays which then provide an input to the solid state logic circuitry. The solid state logic
processes the various inputs, determines if an unsafe condition is being approached and, when
appropriate, actuates the output relays to cause a protective action. The protective action may
be a reactor trip or the actuation of the safeguards equipment. As shown in the block diagram,
each channel bistable controls a relay in both Protection System Trains A and B. The two
protection trains have identical functions to ensure that in the event of a failure of one train the
automatic protection actions will be ensured. Another design feature of the system is that, once
initiated, a protective action shall go to completion. This feature is achieved by various means
for the different safeguards equipment. In some cases relays within the solid state protection
system electrically seal in and thereby ensure the protective action continues to completion
regardless of the duration of the signal. For some components this feature is accomplished by
components and circuitry downstream of the solid state protection system circuitry. For example
the main steam isolation valve closure (MSIV) action is "sealed-in" when a mechanically latching
relay, within the MSIV control circuitry, is released by the action of a solid state protection
system buffer relay. For these components, the duration of the input signal must last long
enough for the latching relays to actuate.
System Actuation Logic
The protection system is designed such that the failure of a single component cannot prevent a
desired automatic protective action from occurring. Likewise, the design ensures that a single
component failure cannot cause an unnecessary system actuation. These design objectives are
accomplished by having multiple instrumentation channels and redundant protection trains. A
vital component of the protection trains is the solid state logic. This logic ensures that more
than one instrumentation channel is sensing an unsafe condition; however, it does not require
5
all channels to initiate a protective action. For example, to protect the plant from the effects of
a main steam line break accident, the protective system monitors differential pressures from
which main steam line flow rates may be inferred, main steam line pressures and the average
reactor coolant temperature {T...,). One of the conditions required to cause a protective action
is the coincident existence of both:
1.
High ste.am flow in two of the four main steam lines. (Each steam line has two flow
instruments with an associated bistable. The logic considers steam flow in a particular
steam line to be high if one of the two bistables are tripped.)
2.
Low T""" condition on two of four reactor coolant system loop temperature instrument
channels; or low steam line pressure on two of the four main steam line pressure
channels.
When this logic is satisfied the protective actions that are initiated are the isolation of the main
steam lines and a safety injection. The safety injection logic then results in closure of the
feedwater control and bypass valves, main feedwater isolation, trip of the feedwater pump
turbines, realignment of various system valves and dampers and actuation of the safeguards
equipment control systems (e.g. safety injection pump and emergency diesel generator starting).
The solid state logic processes the various system inputs in a similar manner as necessary to
generate the appropriate protective action based on the particular accident analysis.
Some of the safeguards equipment receives actuation signals from both protection trains (e.g.
emergency core cooling pumps, emergency diesel generators). Other equipment (consisting
mostly of train specific safety injection system valves) receive actuation signals from only one
of the protection trains. The system design is such that the components that are actuated from
a single train alone, result in completing the safety function. Therefore, a single logic system
failure will not result in a total loss of safety function.
When the solid state logic generates a protective action signal one of two actions occur. For a
reactor trip the undervoltage coils of the reactor trip circuit breakers are deenergized directly
by the solid state logic circuits. For all of the other protective actions, the solid state logic
circuits control the operation of a master relay in the Safeguards Equipment Cabinet. Depending
on the number of relay contacts that are needed to accomplish a protective function, additional
slave and buffer relays are utilized. The slave relays are controlled by a master relay and buffer
relays by a slave relay.
Some of the control circuits use additional control relays in the
operation of the safeguards equipment, as discussed previously. For the MSIV system, each
latching relay, once actuated, operates solenoid valves that cause individual MSIV s to close.
The resultant effect is that for the MSNs the series operation of a master, slave, buffer and
latching relay is required before the protective action, generated by the SSPS logic, is assured
of going to completion.
-- ---------------
6
3.1.2 SSPS Response During the Event
During the plant transient that occurred on Salem Unit 1 on April 7, 1994, the solid state
protection system responded to a sustained low T ,_ condition and coincident short duration high
steam flow indications.
The low T ,_ condition was a result of actual plant conditions
experienced during the rapid plant power reduction. The short duration high steam flow signals
occurred following the main turbine trip. These high steam flow signals were not the result of
an actual high steam flow condition resulting from a postulated steam line break; but rather,
were caused by a pressure wave in the main steam lines that occurs when the turbine stop valves
rapidly close during a turbine trip.
High Steam Flow Signal Analysis
The team reviewed PSE&G's analysis of the high steam flow signal associated with the initial
safety injection on April 7, 1994. At Salem Generating Station the steam flow in each main
steam line is determined by measuring the pressure difference across the steam line flow
restrictor. The flow restrictor is a venturi type flow meter. However, the pressure taps are on
each side of the flow restrictor and there is no pressure tap at the throat.
Following a reactor trip the P-4 permissive selects a new setpoint for the high steam flow safety
injection and steam line isolation. This new setpoint is equal to a 40% power steam flow
equivalent. Additionally, P-4 also initiates a turbine trip .. According to PSE&G analysis, the
quick closing of the turbine stop valve associated with a turbine trip generates compressive
pressure waves in the main steam line. These pressure waves travel upstream toward the steam
generator and are reflected back and forth from the two ends of the pipe. These waves are also
reflected such that they enter the pressure sensing lines for the pressure transmitters, where a
pressure difference is then indicated, and intermittent, short duration, high steam flow signals
are generated.
The team questioned whether either Salem unit had experienced similar intermittent high steam
flow signals following previous reactor/turbine trips. PSE&G reviewed past reactor/turbine trips
and identified at least three occasions where short duration high steam flow signals were
generated following reactor/turbine trips. Although PSE&G had identified short duration high
steam flow signals following previous reactor/turbine trips, as a result of the analysis during
those prior events they determined that the condition resulted from the P-4 high steam flow
setpoint change and the time actual steam flow decreases below 40%. PSE&G considered this
to be an expected response of the instrumentation and that no modification was necessary. The
spurious high steam flow signals caused by the pressure waves following a reactor/turbine trip
were not identified; and therefore, not evaluated until the April 7, 1994 event.
Also, following the April 7, 1994, event PSE&G found that safety injections due to the spurious
high steam flow signals had occurred at another Westinghouse plant and that time delay circuits
were installed to address this problem.
7
Plant Res.ponse
A review of the sequence of events generated by the plant computer following the reactor trip
and turbine trip indicated that protective action signals were generated in response to the high
steam flow/low T..., signals two times. The sequence of events program divides each one second
time interval into 60 cycles and identifies events that occur and/or clear within each one cycle
time interval. AIT review of the sequence of events computer printout determined that the
coincident high steam flow and low T..., conditions were logically satisfied twice just after the
reactor trip on April 7. The first occurrence occurred and cleared within one electrical cycle
(0.0167 second). The second occurrence occurred during one cycle and cleared in the next
cycle. Since it is not possible to determine when, within the first cycle, that the initiation
occurred, or when, within the second cycle, the trip condition cleared, the actual duration that
the trip signal was present cannot be determined other than it was present for a maximum of two
cycles (0.033 second).
The first occurrence was of such short duration that neither the A nor B protection system trains
was able to actuate any safeguards equipment prior to clearance of the input signal.
The second occurrence was sufficient for protection train A to respond and resulted in a partial
actuation of the safeguards equipment. The difference in the response times of the A and B
logic trains resulted in the single train actuation. The reason for the partial actuation of the
equipment associated with the A protection train is that the short duration signal did not allow
sufficient time for all of the seal-in and/or latching relays to respond.
The safeguards
components that are actuated as a result of operation of a solid state* protection system slave
relay (with a seal-in design) all performed as expected for the A protection system train. Other
components, that have seal-in or latching relays within their specific control circuits, did not all
operate. The later set of components included two of the four MSIVs that failed to close, the
main feedwater pump turbines that failed to trip and the main feedwater isolation valves that
failed to close. PSE&G tested the system response to varying duration input signals to validate
these conclusions. This testing is discussed in Section 5 of this report.
3.2
Pressurizer PORVs, Safety Valves & Associated Pipe
The pressurizer for each Salem reactor coolant system (RCS) is equipped with two power
operated relief valves (PRl and PR2) that can be isolated from the pressurizer by block valves.
The PORVs are set to open at 2335 psig. They actuated over 300 times during the event to
relieve water and successfully prevented an RCS overpressure condition that could have
challenged the pressurizer safety valves. Also, they successfully opened and closed several times
after the event.
Post-event examination showed that both PORVs incurred wear of the valve internals; however,
the valves still worked after the event. Prediction of future valve operation, particularly due to
the galling observed in PR2's valve stem, is judged impractical by the AIT. The galling could
- ------------ -----------~
8
lead to failure at any time, or the valve may operate numerous additional times before failure.
Damage to PRl was found to be generally less severe than to PR2. The licensee subsequently
replaced the worn internals, which the AIT considered an appropriate action.
PORV Design
Figure 1 in Attachment 7 shows the Salem PORV design. The valve is air actuated with the
actuation diaphragm moving a stem (9) that passes through packing located in the valve bonnet.
The stem is threaded into a plug (20) and an anti-rotation pin (8) is driven through the threaded
junction to prevent rotation. The bonnet is bolted in place, and holds the cage (19) against a
gasket (18) in the bottom of the valve body via the cage spacer (21). The valve seat surfaces
are on the bottom of the plug and along the inside of the cage toward the bottom. Lifting the
plug moves the plug seat away from the cage seat, allowing flow. At the time of the event for
Salem Unit 1, the stem was 316 stainless steel with a chrome plating, the anti-rotation pin was
300 series stainless steel, and the plug and cage were 420 stainless steel. The valves are
manufactured by Copes-Vulcan.
This valve model was tested in the 1981 EPRI test program except that a combination of two
different valve internals types were tested (a Stellite plug in a 17-4 PH cage, and a 17-4 PH plug
in a 17-4 PH cage). Some delayed closures were identified in the EPRI tests due to scoring and
galling of some surfaces for the valve with the 17-4 PH plug. Originally, Salem Unit 1 used
the 17-4.PHplug and cage internals. Subsequently, the licensee changed to a 316 stainless steel,
Stellite plug.
The change to the 420 stainless steel valve internals was completed in 1993. These new
internals had no service life other than testing prior to the April 7, 1994 event.
Subsequent to the event, the licensee replaced the valve internals using the 316 stainless steel
stellite plug in a 17-4 PH cage.
PORV Performance During Event
The PORVs actuated over 300 times during the event to relieve water and successfully prevented
an RCS overpressure condition. Figure 2 in Attachment 7 depicts the RCS pressure during the
transient after the second SI actuation. It was during the period from about 11:30 a.m. to 12:00
noon that the PORVs experienced the greatest amount of operation.
Each PORV is equipped with a "valve not fully closed" position indication activated from the
valve stem. This provides a positive indication if the valve is more than - 5 % open and is a
recorded indication. The licensee reconstructed the number of valve cycles from this indication
by counting a cycle as a combination of passing 5 % on an opening motion followed by passing
5% on closing. On this basis, PRl cycled 109 times and PR2 cycled 202 times. Cycle times
varied from 0.3 sec to 2 sec.
9
Post-Event Examination and Evaluation
The licensee obtained the following information for temperature downstream of the PORVs from
the Technical Support Center logs:
Approximate time,
Tail pipe
Pressurizer
Pressurizer
April 7
temperature, °F
temperature, °F
pressure, psi
3:30 p.m
215
650
2250
4:16 p.m
212
2260
6:53 p.m.
211
7:00 p.m.
605
1800
8:00 p.m.
205
595
- 1500
Roughly 212 °F or greater is expected under these conditions if the valve is open or leaking
significantly. The observed behavior from 6:53 p.m. to 8:00 p.m. indicated that the PORVs
were closed and not leaking significantly. The earlier values could be due to tailpipe cooldown
following the event. For comparison, the Unit 2 thermocouples indicated 135 - 150 °F at about
5:00 p.m. on April 23, 1994, while that unit was operating at power.
Following the event, licensee personnel observed that the leak rate into the pressuriz.er relief tank
(PRT) was similar to that existing before the event (0.66 gpm prior to the event; about 0.64 gpm
at 5:00 p.m. following the event). The source of the leak appeared to be from a pressurizer
safety valve, as is discussed later in this section.
The AIT noted that the licensee initially intended to accept the PORVs as operable following the
event without a visual inspection of the valve components. However, as a result of an AIT
request for the engineering evaluation of the PORVs upon which that operability determination
was based, the licensee then elected to open the valves for inspection.
The licensee post-event, preliminary examination of PORV PR2 showed galling of the stem
where it passed through the bonnet and severe wear/scrapes, but little or no galling, along part
of the plug and cage. The damage was concentrated on the side toward the outlet, which the
licensee indicated was consistent with past experience. The licensee also indicated the cage
appeared softer than the plug. The seat did not exhibit obvious cutting. The plug was reported
as freely movable in the cage by hand. Valve PRl did not exhibit stem wear, although there
was some wear to the plug and cage and there was a possible cut in the valve seat. Both valves
had an axial crack on both sides of the anti-rotation pin.
This crack passed through the
10
The licensee planned to reassemble the internal parts and the bonnet from PR2 in a different
valve body and test to destruction with water at - 2300 psi if a test facility can be found that
will use the radioactive components. The internal parts from PRl will be carefully examined.
The licensee will examine new internal parts for the PORVs to see if there are cracks in the
vicinity of the anti-rotation pins.
Primary Code Safety Valves
The pressurizer for each Salem reactor coolant system (RCS) is equipped with three safety
valves (PR3, PR4, and PR5) that are set to open at 2485 psig ( + 1 % ). Pressure never reached
the safety valve setting during the event, although the PR4 tailpipe temperature indicated high.
Post-event testing showed that PR4 was weeping; a condition the AIT judges to have existed
before the event. The licensee plans to replace PR4 and will also remove and test PR3 and PR5.
Valve tailpipe temperature for PR4 was observed to be - 216 °F at - 12:00 noon on April 7
(220 °P via post trip review report), while PR3 and PR5 indicated a more normal 130 - 135 °F
range. (Roughly 212 °F or higher is expected under these conditions if the valve is open or
leaking significantly, depending upon both the pressurizer and pressurizer relief tank conditions.
Note that the Unit 2 thermocouples indicated 135 - 150 °P on about 5:00 p.m. on April 23 while
the unit was in mode 1.
Also note that these temperatures are not recorded.
The only
information was from logs and personnel recollections.) This elevated tailpipe temperature
raised the question of whether PR4 lifted during the event.
Attempts to evaluate the tailpipe temperature indication operability following cooldown failed;
apparently mistakes were made by the licensee in selecting sensors to test and the
instrumentation was damaged during PORV disassembly and during instrumentation evaluation.
Review of RCS pressure data and PORV open/close behavior shows that the pressure never
significantly exceeded the PORV lift pressure of 2335 psig. Thus, PR4 should not have lifted
unless its setpoint was significantly low. Each pressurizer safety valve has a 0.15 to 0.3 inch
limit switch, which corresponds to -
1A to 1h open. There is no record of a limit switch
indicating open during the event.
The leak rate into the pressurizer relief tank (PRT) was 0.66 gpm before the event and was
estimated as - 0.64 gpm at 5:00 p.m. following the event. This is consistent with a leak that
was unaffected by the event.
Post-event testing of PR4 at Wylie Laboratories showed valve lift at 2515, 2516, and 2524 psig,
with seat leakage at 90% of the setpoint value. (The valves are supposed to open at 2485 psig
with a+/- 1 % tolerance, which gives a maximum allowable of 2510 psig.) Wylie indicated to
the licensee that 25% to 35% of the safety valves they test will exhibit such leakage.
The combination of event pressure, leak behavior, and post-event valve testing support a
conclusion that PR4 was leaking prior to, during, and following the event and did not lift during
the event. The AIT did not assess the slightly out-of-tolerance lift setpoint for PR4 since it had
no effect on the event.
11
PORV /Code Safety Valve Piping
The licensee performed a visual inspection of the piping and supports downstream of the PORV
and safety valves immediately after the event and stated there was no evidence of damage.
Later, after examining piping upstream of the valves, the licensee reported two support rods
were bent; but that these were not believed to have been damaged during the event. The
licensee found no other pipe or support related damage. After the AIT effort, the licensee
completed their evaluation of the associated piping and determined that no flaws occurred as a
result of this event. This evaluation was reviewed by Region I as part of the effort supporting
restart assessment and will be documented in a future report.
The licensee discussed pressurizer nozzles and its piping system with Westinghouse regarding
pressure transients upstream of the PORVs and reported an expectation that there was little
effect. The pressurizer volume would be expected to dampen such transients and no safety valve
operation would be expected. The licensee reported that an analysis assuming 2350 psig and 680
°F resulted in a usage factor of 0.01 for 350 full-open/full-close cycles.
The licensee's analysis was based upon PORV opening times of 0.5 sec and 2 sec for closure.
The licensee did not address shorter times, the influence of a lower temperature (pressurizer
temperature during the event was probably as low as - 550 °F), the effect of both valves being
in operation rather than one, or the influence of the valve not going fully open before receiving
a close signal. The AIT believed additional analysis was necessary to establish the lack of
impact upstream of the PORVs. This concern was discussed with the licensee. Subsequent to
the AIT completing its inspection activities, the licensee provided additional evaluations of the
associated piping to the NRC for review prior to restart. The AIT did not assess this additional
information.
AIT Evaluation of PORVs. Safety Valves and Associated Pipe
The galling (or deep gouging) observed on the stem of PR-2 is of concern. The valve is
designed with a clearance around the stem such that it should not touch the bonnet. With this
clearance closed and with the stem dragging against the inside of the bonnet, the ability of the
plug to open or close could be severely affected. Of interest, the stem damage and plug damage
were both on the downstream side of the internal assembly which leads to the hypothesis that
the damage could have been at least partly flow-induced.
As previously mentioned, this valve model was tested in the 1981 EPRI test program, except
that different valve internals were tested. The 420 stainless steel plug and cage in the PORVs
at the time of the event, is a martensitic stainless whose hardness is dependent on the heat
treatment. This is a much-used alloy where wear and corrosion resistance are both important.
PSE&G and Copes Vulcan indicated the valve with the 420 stainless steel internals performed
well in the field in similar applications.
12
The AIT found the PORVs' operability to be indeterminant after the event because of the
observed damage, although noting that the valves opened and closed upon command shortly
before disassembly. The AIT also notes the PORVs were relied upon for low temperature
overpressure protection (LTOP) following the event, but prior to disassembly, and were also
relied upon as a vent. The AIT concluded that the licensee met the legal requirements for
demonstrating the PORVs operable prior to reliance for LTOP purposes. However, the AIT
believed that since the PORVs were operated in a condition beyond that envisioned in the FSAR
(i.e. multiple actuations involving steam and water), additional evaluation was appropriate.
Salem's FSAR analyses include an allowance of 20 minutes to reset safety injection for
inadvertent actuations. Westinghouse recently provided information on this topic to the licensee
as required by 10 CFR 21.2l(b) (Gasperini, J. R., "Inadvertent ECCS Actuation at Power,"
Letter to Dave Perkins, Public Service Electric and Gas Company from Westinghouse Electric
Corporation, PSE-93-212, June 30, 1993.). This stated that:
"Westinghouse has discovered that potentially non-conservative assumptions were used
in the licensing analysis of the Inadvertent Operation of the ECCS at Power accident.
Based on preliminary sensitivity analyses, use of revised assumptions could cause a water
solid condition in less than the 10 minutes assumed for operator action time. If the
~RVs were blocked, the PSRVs (safety valves) would relieve water and potentially
cause the accident to degrade from a Condition II incident to Condition ID incident
without other incidents occurring independently.
Per ANS-051.1/N 18.2-1973, a
Condition II event cannot generate a more serious event of the Condition m or IV type
Without other incidents occurring independently. n
The letter further stated that Westinghouse adopted the following criterion:
"The pressurizer shall not become water solid as a result of this Condition II transient
within the minimum time required for the operator to identify the event and terminate the
source of fluid increasing the RCS inventory. Typically, a 10 minute operator action
time has been assumed. n
(NOTE: Chapter 15 of the Salem FSAR defines Condition II events as faults of moderate
frequency including "spurious operation of the safety injection system at power;" and, Condition
ID events as infrequent faults including small break LOCAs.)
The AIT concluded that the Westinghouse recommended actions may need to be re-examined
in light of the Salem experience. The Salem operators took about 17 minutes to terminate safety
injection during the first SI and 12 minutes to terminate the injection on the second SI. The
pressurizer did in fact become water solid and yet, plant operators responded appropriately to
the inadvertent EECS actuations per approved EOPs.
13
Solid plant operation as encountered during the event is not specifically addressed in Salem's
licensing basis as addressed in Chapter 15 of the Final Safety Analysis Report (FSAR).
Licensing basis analyses generally do not reach solid plant conditions.
For example, the
applicable LOCA analyses involve two phase conditions rather than the single phase resulting
from a solid RCS, and a licensing basis inadvertent safety injection does not lead to a solid RCS.
Regardless, the pressure and temperature challenge to the RCS pressure boundary is generally
enveloped by the composite of analyses addressed in Chapter 15 of the FSAR.
Consequently, the AIT evaluated the event with respect to challenge to the RCS pressure
boundary and addressed whether the event could have logically progressed to a more serious
condition. The AIT found that no RCS pressure boundary design parameters were exceeded
during the event. The operators restored a pressuriz.er steam bubble before conducting a planned
plant cooldown, thus eliminating the potential problems that may have occurred if a solid
cooldown were attempted. The AIT judges that not being strictly within the licensing basis
envelope is not a significant safety concern for this event.
The AIT addressed the possibility of progression to a more serious accident due to PORV or
safety valve problems and concluded that multiple additional failures would have been necessary.
Further, the AIT judges the most likely such accident sequence would have been a loss of
coolant accident (LOCA), which is within the design basis for the plant.
3.3
Circulating and Service Water Systems
Overview
As discussed previously, the event of April 7, 1994 evolved from an initial problem of plugging
of the Salem circulating water (CW) intake screens followed by CW pump automatic trips as
water level difference across the intake screens reached the 10 foot trip value. Although CW
is necessary for plant operation at power, it is not essential to the plant's safety. However, the
vulnerability of the CW system to grass intrusions challenge continued power operation of the
plant as well as challenge the plant operators and safety systems in response to the resultant
transient conditions, as occurred during this event. Consequently, the AIT assessed aspects of
CW operation.
In contrast to CW, service water (SW) is vital to safety - it provides the safety related ultimate
heat sink. Salem CW, Salem SW, and Hope Creek SW are located in three similar intake
structures along the Delaware River.
This observation immediately raises the question of
whether the problems that occurred with CW could also occur with SW. Consequently, the AIT
assessed the potential for a loss of Salem SW in light of the problems with the Salem CW.
Hope Creek experienced a loss of one SW pump while the team was on site, and the AIT briefly
assessed this event for applicability to general SW reliability, and concluded that the failure was
unrelated to the events causing CW difficulties at Salem.
14
Findini:s
The AIT found that the continuing problems experienced with Salem CW present an important
challenge to plant operation. This could become a safety concern because of continuing plant
perturbations that cause unnecessary plant transients, distracts the operators, and potentially leads
to unnecessary challenges to the operators and plant safety systems. While noting that the
licensee had previously approved a long term fix by modifying the CW design, the AIT believed
a short term fix was warranted, such as improving the operating procedures to respond to the
resultant transients.
SW operability was found to not be a short term issue, requiring corrective actions. The
licensee indicated that they have never had a SW failure due to debris and the AIT found no
other evidence to the contrary, indicating that SW was not wlnerable the same initiator. The
AIT suspected that the design of the circulating water structure lends itself to such vulnerability
and that the service water structure design is potentially unaffected by debris. The AIT further
concluded that additional NRC review of service water system wlnerability was warranted but
was not within the scope of the AIT inspection.
Description of Salem and Hope Creek Water Intake Structures and Related Machinery
Salem and Hope Creek have three water intake structures positioned as shown in Fig. 3 in
Attachment 7.
Salem's SW intake is about 100 yds upstream (north) of the CW intake and Hope Creek's SW
intake is about 3/8 mile upstream of the Salem SW intake. Water entering each intake structure
passes through a trash rack, a moving screen, a pump, and, for SW, a filter. These are shown
in Figs. 4 - 6 in Attachment 7. The bottom of both SW intakes is at about the river bottom,
about 30 feet below surface grade. The CW intake bottom is 50 ft. below grade and the river
bottom is dredged to that depth for the width of the intake structure and for a distance of 100
ft. from shore.
CW Performance During the Event
In anticipation of additional grass intrusion events, the licensee had removed the front covers of
the traveling CW screens and laid fire hoses that were used to wash accumulated grass and
debris from the screens before the built-in screen washes were reached. Quick-disconnects had
been provided on covers in the screen drives so that shear pins could be replaced quickly (3 to
7 minutes).
Despite the fire hoses and running the screens as fast as possible, the screen loads became so
heavy during the event that shear pins were failing and screen dogging was causing .a significant
water level drop across the screens. One licensee representative estimated that the water level
drop across the trash racks was about 1 - l 1h ft. CW pumps tripped when level reached a 10
foot differential across the screens.
15
There is no easily obtainable record of CW screen operation. However, CW pump operation
was obtained and is summarized as follows:
Five CW pumps were in operation during the initial part of the grass intrusion. Various
pumps tripped and were restored to operation by the efforts of the personnel staged at
the CW structure. Just before the reactor trip, only one pump remained, and at the time
of reactor trip, two were in service.
An AIT member observed one grass intrusion during the onsite inspection. Fire hoses were
being operated to clean an estimated 1 - l 1h inch thickness of debris off of the screens.
Immediately after the attack, debris around the screen machines was ankle to knee deep.
Licensee personnel said the debris was waist deep following the April 7 event.
SW Reliability
Licensee representatives informed the AIT that they had never seen a correlation between Salem
CW debris problems and problems with SW at the Salem or Hope Creek sites. They further
indicated no historical problems with loss of SW due to debris. The AIT found no instances that
contradict those descriptions.
The licensee provided excerpts from its evaluation of a June 1993 turbine trip/reactor trip due
to loss of CW (SERT Report 93-07). (That loss of CW event was attributed to actions of a
diver cleaning a circulator trash rack.) This stated that:
" *.. service water rake and screens are not challenged by debris as are the circulating
water systems. As a result, service water screens operates (sic) periodically as compared
with constantly for circulating water. The service water trash rake is used infrequently
while the circulating water trash rack must be cleaned at least daily during heavy
grassing periods....
The Service Water intake has not been subject to the same
accumulation of trash and silt as the circulating water intake. For example, while the
Corps of Engineers was dredging upriver in 1983, silting caused the shutdown of all
circulating water pumps, but the service water intake was not affected. This difference
in susceptibility to trash and silting is attributed to the location of the service water intake
directly on the river front. The circulating water intake is in a diverging section of the
river and the resulting drop in velocity and eddy formation is more conducive to trash
and silt accumulation."
Licensee personnel also often cited the high velocity at the CW intake as a major contributor.
In addition to such factors, the AIT judges that the CW high flow rate is a major factor in that
it affects a much larger section of river bottom than affected by the SW systems and a 20 foot
deep "pit" is dredged in front of the CW structure. Material falling into this pit is likely to be
sucked into the CW intakes.
16
Based on this information, the AIT concluded that there was no immediate concern regarding
the reliability of the service water system; however, as previously stated, this issue warrants
further review by NRC as part of the planned reviews of service water systems and individual
plant evaluations.
Additional Information Regarding Hope Creek SW
The Hope Creek licensee stated that no recent SW traveling screen failures have occurred due
to shear pin failure. Several years ago, the screens were not routinely in operation unless there
was a pressure differential across the screen. Then the screen would start at normal speed and
immediately shift to high speed. Shear pin failure would often follow.
Each screen at Hope Creek is now operated whenever the respective SW pump is operating, and
a shift to high speed does not cause shear pin failure. An unacceptable increase in pressure
differential when the screen is operating at high speed is addressed by starting another SW pump
and stopping the first pump to allow the screen to clear via normal wash while it continues to
operate. According to the licensee, switching between pumps in this manner has always been
sufficient to prevent a problem. The potential is still recognized in procedure HC.OP-AB.ZZ-
0122 (Q), "Service Water System Malfunction," 7/9/93, which states:
"Loss of service water can occur due to reed intrusion. The event typically occurs
following marsh bums followed by heavy rains and the next high tide.... This heavy
intrusion overloads the screen wash system with subsequent intrusion of the reeds into
the suction of operating service water pumps. The resulting heavier than normal fiber
intrusion clogs the service water pump strainers."
The inspector was told that there are relatively heavy debris "hits" roughly 3 times in the fall
and 3 or 4 times in the spring in which high differential pressure alarms across the traveling
screens are received in the Hope Creek control room. The response is to start a different SW
pump and shut down the operating pump while the screen continues to operate. The built-in
screen spray system has always been adequate to clean the screen once the flow was removed,
and the problem has been handled without further complication by swapping back and forth, a
capability made possible by the two trains of three pumps each.
3.4
Reactor Systems Response
The Salem Unit 1 event included aspects of potential concern with respect to the reactor fuel and
the reactor coolant system (RCS). These are as follows:
1.
Power and criticality control
2.
Adequate margin to the departure from nucleate boiling ratio (DNBR)
3.
Adequate subcooling margin (SCM)
4.
Rate of change of temperature
5.
Rate of change of pressure
17
6.
Challenge to fuel cladding
7.
Low temperature overpressure
8.
Pre-Cooldown and Cooldown Operations
9.
Post-Event Usage of the PORVs (power-operated relief valves)
10.
Piping Considerations
Each is addressed as follows:
Power and criticality control
Control of power and avoidance of conditions that could lead to rapid power excursions are
important to protection of the fuel cladding and the RCS pressure boundary. Although power
was rapidly reduced during the April 7, 1994 event, no unusual configurations resulted and the
reduction rate was small when compared to a typical transient associated with a reactor trip from
full power. This aspect of the event was not a challenge to the fuel or the RCS.
The power increase rate just before the reactor trip was about normal, and actual power was
small in comparison to full power. Heatup aspects of the transient were probably of little
consequence since there was not a large local transient effect. For this reason, the AIT did not
investigate such areas as transient temperature distribution within the fuel.
Reaching a lower temperature than permitted by Technical Specifications raises questions such
as: adequate rod control to attain shutdown; and, could a positive moderator temperature
coefficient have been encountered. The licensee investigated these questions and reported that
shutdown margin was always significantly greater than required. The moderator temperature
coefficient always remained significantly negative.
These conclusions were independently
verified by the AIT.
Examination of intermediate and power range nuclear instrumentation indications was performed
by the licensee and no significant deviations were found between the indications and actual plant
power during the power ascension transient.
The AlT concludes that no local or overall power conditions were reached that are of concern.
Adequate de,Parture from nucleate boiling ratio IDNBRl
An adequate DNBR is necessary to assure that the fuel cladding does not become blanketed with
steam, a condition that would cause a rapid cladding temperature excursion. The licensee
investigated core thermal limits and the axial power distribution during the event and concluded
that DNBR limits were not approached. The AIT concurs with this assessment.
18
Adequate subcooling margin (SCM)
Maintenance of an adequate SCM with an adequate DNBR assure that the fuel cladding remains
cooled.
The reactor coolant pumps (RCPs) remained running throughout the event and
consequently large temperature variations did not result and the reactor vessel upper head
remained cooled. The pressure/temperature behavior during the event was evaluated and the
minimum SCM was determined to be 39 °P. This occurred during the pressure transient at the
time of the steam generator safety relief valve(s) lift. Much of the time the SCM was > 80 °P.
Although all temperature and pressure indications substantiated that adequate SCM was always
maintained, annunciator data indicated loss of SCM at approximately 12:20 p.m. during the
event. The licensee investigated these alarms and reported that overhead windows D-40 and D-
48, SCM low, are set to actuate at s 10 °P SCM, and that post event evaluation of annunciator
historical data showed the following alarms:
I Item
II
Date I
Time
I Train I
1
417/94
12:20:02 - 12:20:05
A
2
4/7/94
12:22:57 - 12:23:00
B
3
417/94
21:21:38 - 21:29:01
B
4
4/7/94
21:48:03 - 21:56:58
A
5
4/8/94
03:30:42 - 03:46:36
B
6
4/8/94
04:00:55 - 04:10:31
A
The licensee attributed these apparent losses of SCM to the core exit thermocouple processing
system (CETPS) indication that results from pushing a train A or train B CETPS reset button
or when a train of the CETPS is tested.
Each of the two CETPS trains is provided with the following inputs:
1.
29 incore thermocouple temperatures
2.
RCS pressure
3.
Containment radiation
4.
Containment pressure
The licensee stated that the apparent losses of SCM indicated in items 1 and 2 were due to the
nuclear control operator pressing the CEf PS reset button. The rational is as follows. The
bottom of the containment radiation scale is 1 R/hr whereas actual containment radiation is close
to uro. A uro will cause an alarm. The operator will respond by acknowledging it on CETPS
followed by pushing the system reset button to re-arm the containment radiation input alarm.
19
Depressing the reset button causes indicated SCM to go to zero, a result noted in the operator's
procedure. The specification for CETPS data transmittal time provides a maximum of 4 sec,
consistent with the 3 sec time observed in table items 1 and 2.
Table items 3 - 6 were attributed to performance of RCS hot leg pressure channel functional
testing. Placing the channel switch in the test position causes the RCS pressure input to CEfPS
to be zero. The licensee stated it verified this testing as the cause by reviewing the control room
narrative logs and the overhead annunciator historical data.
The AIT concurs with this explanation of the loss of SCM indications and concurs that adequate
SCM was maintained throughout the event.
Rate of change of temperature
The temperature change prior to initiating the controlled cooldown was less than 100 °F and the
cooldown was conducted slowly and deliberately without approaching cooldown rate limits. Rate
of change of temperature was not a problem.
Rate of change of pressure
No large pressure excursions occurred that would represent a direct challenge to the RCS
pressure boundary (except as noted below) or the fuel cladding.
Challenge to fuel cladding
The licensee reported that there was evidence of one or two fuel cladding defects before the
event and observed an iodine spike consistent with that number of defects after the reactor trip.
As discussed above, no conditions were found that could represent a challenge to the cladding
during this event.
The licensee obtained a gas sample from the reactor vessel head on April 13 that consisted of
about 96% nitrogen, 3% hydrogen, and minor amounts of other gases.
No significant
radioactive components were found. This is consistent with a conclusion of no fuel damage
since no significant quantities of fission product gases were found.
The AIT concludes that there was no fuel cladding damage and no conditions existed that
represented a challenge to the fuel cladding.
Low temperature ovemressure
Temperature during the event never reached a value where low temperature overpressure would
be a concern.
20
Pre-Cooldown and Cooldown Operations
The operators elected to restore the vapor space in the pressurizer after the initial solid operation
in which pressure was controlled by the PORVs rather than initiating an immediate cooldown.
They additionally elected to not trip the RCPs. The AIT concurs with these decisions. A choice
to trip the RCPs or to attempt a solid plant cooldown could have significantly complicated the
event.
The question of tripping RCPs was raised during the event. The AIT considers such questions
to be part of a reasonable examination of alternative actions. In discussion with key personnel
who were in the control room area during the event, it became clear that this alternative was
never seriously considered for implementation.
Maintaining RCP operation during solid operation assured uniform RCS temperature, provided
better temperature control, and allowed eventual entry into cooldown with a normal plant
configuration. Tripping RCPs would have introduced a significant temperature variation into
the RCS and would have caused average RCS temperature to increase, a particularly difficult
situation since a variation of only 1 °F would change RCS pressure by about 100 psi.
Reactor coolant system pressure for several hours following the second safety injection is
summarized in Fig. 2 in Attachment 7. The part of the event during which the PORVs were
controlling pressure occurred from about 11:30 a.m. to 12:00 noon. Following that, the PORVs
were not challenged again. The operators essentially set the letdown rate and RCS temperature,
and controlled pressure by varying the charging rate with the objective of maintaining 2150 +/-
50 psig. A pressurizer bubble was restored and pressurizer level reached 50% at 4:30 p.m. A
normal cooldown from hot standby was initiated at 5:15 p.m. and was conducted without
difficulty.
Post-Event Usage of the PORVs
The pressurizer .PORVs were relied upon for low temperature overpressure protection and for
venting following the event. There was no evidence of a malfunction during this usage although,
as discussed in Section 3.2, significant damage was found when the PORVs were disassembled.
Piping Considerations
As discussed in Section 3.2, the AIT has little concern with piping downstream of the PORVs
and safety valves. Previous analyses, tests, and the post-event examination of the piping by the
licensee have shown this piping was not challenged during the event. The AIT questioned the
licensee regarding the potential for damage upstream of the PORVs. The principal concern was
the possibility of damage that could lead to a LOCA. This question had *not been closed at the
time of the AIT's exit from the facility, but was addressed by the licensee prior to requesting
21
restart agreement from NRC Region I. This additional information was reviewed by NRC
Region I in order to lift the provisions of the CAL that was in place. Results of that review will
be documented in a resident inspection report.
Pressurizer Relief Tank (PRT) Rupture Disk
During the safety injection actuations, the PRT rupture disk ruptured to relieve the increasing
tank pressure, which resulted from the volume of primary coolant inventory relieved to the PRT.
As a result, approximately one gallon of primary coolant was spilled onto the containment floor.
Subsequent to the event, the rupture disk was replaced and the PRT inspected. The rupture disk
operated as designed and no damage occurred to the PRT.
Based on the AIT assessment of the reactor systems response during the event, no protective
barriers failed and no abnormal releases of radiation to the environment occurred.
3.5
Atmospheric Steam Dump Valves and Steam Generator Safety Valves
Following the plant trip and initial safety injection, the reactor coolant system temperature
increased as a result of core decay heat and reactor coolant pump heat. This RCS heatup, and
the corresponding increase in steam generator pressures were not recognized by the plant
operators. Steam generator pressures increased above the setpoint of the steam generator safety
valves because of the failure of the atmospheric steam dump valve (MS 10) controllers to
promptly respond. Consequently a steam generator safety valve lifted and the steam release
through the valve caused a cooldown that initiated the second automatic safety injection due to
an actual low pressurirer pressure condition.
The reason for the slow response of the atmospheric steam dump valve was investigated by
PSE&G and reviewed by the team. The results of this review is described in Section 5 of this
report. The steam generator safety valves and low pressurizer pressure safety injection initiation
circuitry operated as designed.
4.0
PLANT OPERA TOR PERFORMANCE & PROCEDURE ISSUES
Grass intrusions at the circulating water intake structure at Salem are a seasonal phenomenon,
with more severe attacks in spring and autumn. Losses of circulating water pumps or screens
affect condenser vacuum. Degradation of condenser vacuum can necessitate reducing reactor
power or removing the turbine from service. The operator actions to cope with a grass intrusion
are governed by procedures. In general, however, the actions taken by operators are a function
of the extent and rapidity of the grass intrusion (and resultant loss of circulators and condenser
vacuum), and prospects for recovery of any lost circulators.
22
4.1
Operator Response Prior to the Plant Trip
Prq>arations and Response At The Circulating Water Intake Structure
PSE&G management had undertaken extensive efforts at the intake structure to combat the
circulating water grass intrusion and minimize the resultant, at least twice daily, transient.
Management had assigned a shift supervisor, a maintenance supervisor, and an approximate 12
person crew at the circulating water intake structure for expected grass intrusions following
diurnal tide changes. Fire hoses and shovels were pre-positioned and used to remove grass from
the screens during grass intrusions. However, during heavy grass intrusions, as occurred on
April 7, a high screen differential pressure rapidly develops and disables the travelling screens
by sacrificial failure of the shear pins that connect the screen motor to the screen gear.
The extensive PSE&G efforts at the intake structure had generally positive results in dealing with
prior grass intrusions. Management established special work control procedures to facilitate
quick restoration of failed circulating water screen shear pins.
The special work control
procedures allowed the local shift supervisor to approve work and blocking tags during screen
repair, thus bypassing normal work control oversight. Records were procedurally required to
be maintained by the local shift supervisor for all work performed however, the tagouts and
work control history used during the April 7 event were lost and no permanent record was made.
The local shift supervisor provided direct continuous communication with both Salem control
rooms.
Preparations and Response at the Turbine Hall
Two off-duty shift supervisory personnel were stationed at the water box area during grass
intrusion to assist in restoration of circulators to service should trips occur. These individuals
were available to assist in pump priming operations.
The inspectors learned that shift
supervisory personnel would, at times in the past, override the water box priming protective
interlock for the circulators by manually lifting contacts. This was found to be the case during
the April 7 transient when an attempt to restore the 12A circulator to service was unsuccessful.
The on-duty Senior Nuclear Shift Supervisor (SNSS) manually lifted contacts, an action which
is not directed in approved operating procedures.
This action by an SNSS sets a poor
supervisory example for other crew members. As will be described and developed below, the
SNSS's presence would have likely been more beneficial in the control room. His absence from
the control room was an example of inappropriate prioritization of activities by shift crew
management.
In spite of the efforts in planning and guidance outside the control room to effectively respond
to grass intrusions, personnel response actions at the circulating water intake structure did not
fully meet plant management expectations, and an action in the turbine hall (jumpering a
protective interlock) was not procedurally directed and was taken by the senior crew manager.
23
Preparations and Operator Res.ponse In The Control Room <Pre-trip)
Plant and crew management had made no special preparation for control room operator response
to routine, expected grass intrusion into circulating water, even though the plant was operating
with an important automatic control system in manual. The event revealed weaknesses in the
existing procedures and training for control room response that might be required for a
significant grass intrusion.
Despite twice daily *grass intrusions which caused power reductions and restorations, no
compensatory actions had been taken by management to ensure adequate reactor and plant
control during the power swings. Automatic rod control was out of service on April 7 due to
corrective maintenance. Operators had suspected that the T.,.., - T .m comparator did not work
properly and rods were being manually controlled.
No compensatory actions had been
established to ensure manual rod control would not adversely hinder rapid power changes,
apparently because management did not foresee the potential difficulties that could arise. Crew
management expected the two reactor operators to coordinate the reactor transient during the
grass intrusion. In particular, crew management foresaw no difficulties with one operator on
control rods and boration, controlling reactor power and temperature, while monitoring
pressurizer level; and the other operator performing turbine load reduction while monitoring
steam generator levels, and controlling balance of plant equipment such as heater drain pumps,
feedwater pumps, and circulating pumps and screens.
Review of control room logs revealed some differences between those logs and the final
sequence of events which suggested some minor confusion among the crew members. The
operator assigned to control the reactor was also assigned to maintain a control room log of
activities. Review of the log revealed that all circulator pumps were removed from service or
tripped during the event. At the time of the reactor trip, control room logs showed all pumps
out of service and none returned. However, subsequent PSE&G review of circulator pump
amperage, taken from computer data obtained during the event, reveal that two pumps were
running at the time of the reactor trip.
The inspectors considered the alarm response procedures for low vacuum conditions to be weak
because no specific turbine trip criteria were provided. Main condenser vacuum is monitored
by the operators as turbine last stage back pressure. The operator's attempt to maintain back
pressure as low as possible, with annunciator alarms at 25 inches of vacuum (Low alarm) and
23 inches of vacuum (Low-Low Alarm). The abnormal procedure for high backpressure (low
vacuum) conditions contained no reactor trip criteria. The setpoint for the low vacuum turbine
trip was not specified by the procedure and the procedure stated that the operator should restore
vacuum unless a turbine trip occurred between 18 and 22 inches Hg vacuum.
At 10:34 a.m. on April 7, the 12A, and 13A and 13B circulators were out of service. The
abnormal procedure for circulating water requires that loss of both 13 pumps in combination
with any 12 pump out of service, requires the turbine be taken off line within one hour. It was
clear to control room personnel that action was progressing to perform a normal, but rapid,
24
turbine shutdown until and unless the minimum number of circulators could be returned to
service. The rate of turbine load reduction was an attempt by the turbine operator to maintain
a minimum back:pressure in the main condenser. The operators started the transient with the
normal l percent per minute load reduction rate. Within a few minutes, an 8 percent per minute
rate was used to unload the turbine. The reactor control operator was required to control reactor
temperature and power while simultaneously adding boron and inserting control rods while the
turbine was being unloaded.
Expectations that circulating water could be returned to service in a short period of time and
prior experience in maintaining turbine operations through grass intrusions were contributing
factors in the operators continued attempts to maintain turbine operations while progressing to
a normal turbine shutdown. The SNSS left the control room during the transient to over-ride
a circulator pump permissive interlock and restart the 12A circulator pump in an attempt to
maintain condenser vacuum and prevent a turbine trip. The SNSS would normally provide
direction to the NSS on when a reactor or turbine trip should be initiated. The actions of the
SNSS in combination with the extensive effort undertaken by station personnel to maintain
turbine operation at both the circulating water intake and in the turbine hall reflected perceived
management expectations that extraordinary effort would be used to overcome grass intrusions;
and when viewed in conjunction with the below-described lapses in control of reactor power and
coolant temperature, indicate that attention was inappropriately diverted from the primary
systems to the balance of plant.
Numerous distractions were present in the control room during the load reduction. Continuing
communications with circulating water operators required numerous assessments of plant
conditions and restarts or trips of circulators. In the ten minutes prior to the reactor trip, during
the cooldown of the reactor; seven circulator pump trips and three restarts occurred on Unit 1.
Additionally, the communications included Unit 2 activities as well as repeated circulator screen
trips and restarts. During this period, the rod control operator made at least one boron addition
and moved control rods nearly 150 steps into the core. At low power, a feedwater pump
oscillation occurred and the BOP operator requested and received authorization to idle a
feedwater pump. The rod control operator was directed to leave the rod control panel and shift
normal plant electrical loads from the main generator to an offsite power source. This evolution
required three to five minutes to complete.
The reactor cooled to below the minimum temperature for critical operation.
The shift
supervisor noted the cooldown and made a reactivity change by personally withdrawing control
rods while the rod control operator was shifting normal plant electrical loads. The result of this
change could not be determined by the inspectors. The rod control operator returned to the
control panel. He was given a direction to raise power to restore plant temperature and began
a steady control rod pull. The shift supervisor did not discuss the fact that he had manipulated
the control rods with the rod control operator when he returned and his direction to raise power
lacked specificity, i.e., how far or how fast to raise power. The reactor trip occurred when
power reached the 25 percent power high flux trip. At the time of the reactor trip, the only
licensed personnel in the control room were the shift supervisor and the two assigned control
operators. Other shift supervisory personnel including an SRO, an SRO-licensed shift technical
25
advisor, and the SNSS were in the turbine hall attending to water box priming. The AIT
concluded that these resources could have been more effectively used for ensuring reactor
control and coordination of primary and secondary plant operations.
Summary
PSE&G management's preparation for control room operator response to routine, expected grass
intrusion into circulating water was weak. Automatic rod control, an important system for
automatic reactivity control during rapid downpower maneuvers, was considered non-functional.
This posed an additional burden to the operators. Operator guidance and procedures for rapid
downpower maneuvers, loss of circulators, and restoration of T_ below the Technical
Specifications minimum were weak or did not exist. This necessitated on-the-spot, subjective
decision-making and operator response; rather than a pre-planned, thought out, operator
response. The above weaknesses were manifested in poor command and control of control room
activities (confusion and lack of supervision of a relatively inexperienced reactor operator) prior
to the reactor trip and safety injection. When the operators' efforts were unsuccessful, the
resultant plant conditions (Lo-Lo T *** ) combined with a long-standing equipment problem (main
steam line pressure spiking on turbine trip) to cause the first safety injection. The event
suggested training weaknesses associated with the above topics, as well as performance
weaknesses (multiple, simultaneous reactivity changes arid monitoring of reactor response) and
control room supervisory weaknesses associated with supervision of operator activities and
resource allocation, e.g., extra licensed operator personnel were used outside the control room
for balance of plant equipment, rather than inside the control room to assist with control room
activities associated with reactor control.
4.2
Operator Response Following the Plant Trip and Safety htjections
Reactor trip and first safety injection
At 10:47 a.m. on April 7, the reactor tripped on low power high flux (25%) while temperature
was below P-12 (543 degrees F). The reactor trip response was as expected. However,
momentary main steam flow instrument spikes while in the Low-T *-.c condition allowed partial
actuation of Safety Injection logic. While operators recognized the SI actuation occurrence, no
"First Out" alarm indicated the cause.
Injection equipment actuated as expected.
Other
equipment failed to respond as the operators expected when solid state protection system (SSPS)
train B did not actuate as described in Section 3 of this report. Emergency Operating Procedures
(EOPs) account for SI actuation failures by directing operators to align individual components
to the SI position. Ten valves required manual repositioning during sheet 1 of EOP-TRIP-1, the
applicable EOP. Operators made one minor error in that they missed one letdown isolation
valve during the initial valve alignments. During this time high head safety injection was filling
the pressurizer. Prior to reset of safety injection and realignment of charging and letdown, more
than thirty minutes had passed, the pressurizer filled solid, and the power operated relief valves
had actuated repeatedly.
..
26
Operators took approximately 5 minutes to realign valves. Four more minutes were required
to complete BOP steps that included control of auxiliary feedwater and isolation of main steam
isolation valves (MSNs). The operators took about seventeen minutes (reset at 11:05 a.m.) to
reset from the initial safety injection. In addition, operators needed seventeen more minutes to
establish pressure control with letdown and charging.
PSE&G had recognU.ed that safety injection train disagreements were possible occurrences and
operator training included diagnosis of train disagreement conditions. However, no procedural
actions were specified when train disagreement occurred. During the transient, the operators
considered that train B of SSPS did not automatically actuate and took action to manually align
the components as specified in the EOPs. Some discussion took place that train B should be
declared inoperable due to the failure to actuate. At 11:26 a.m., train B manual actuation was
used to insert a safety injection actuation signal during the solid plant cooldown, although
automatic actuation occurred prior to the manual actuation. Because train A safety injection had
actuated without any apparent coincident logic (as would have been indicated by the "First Out"
alarm) in the control room, the operators could not be assured that either train was fully
Solid Pressure Control
-
The condition of the solid pressurizer should have been anticipated by the operators. The pre-
trip cooldown below the minimum temperature had caused a shrink of pressurizer level due to
contraction of coolant. The pressurizer level control system attempted to maintain level by
limiting letdown and increasing charging into the reactor. The pressurizer level had contracted
to less than 17 percent and the pressurizer heaters had cutout as expected on low pressurizer
level. The subsequent safety injection added inventory to the reactor coolant system.
In
addition, the rapid reactor heatup after the first safety injection caused a swelling of reactor
coolant making the pressurizer solid. Apparently, none of the operators had predicted the result
of the operating sequence although all were trained to do so.
Following the initial safety injection, as they had been trained, the reactor control operator
assumed the responsibility for stating the required initial actions of the EOPs. The BOP operator
conducted the initial actions as read by the reactor operator. The initial actions were completed
in approximately five minutes.
Because he was involved in the numerous manual valve
alignments needed in this event, the secondary plant operator did not adequately monitor and
maintain a stable steam generator pressure, and the automatic feature (steam generator
atmospheric steam dumps or MSlO's) used to control RCS temperature did not function because
of the characteristics of the controller. Section 5 of this report describes this characteristic.
Also, the operators not recovering the use of that feature led to the lifting of the steam
generator code safety valve.
The operators did not anticipate the effect of the lifted steam generator code safety valve on the
solid plant pressure and no attempt was made to control pressure prior to the rapid pressure
decrease that led to automatic and manual actuations of the safety injection system.
27
Although the command and control function during EOP-TRIP-1 was as practiced, the operators
neither diagnosed that the post-SI sequence would result in a solid pressurizer nor developed an
adequate plan of action for control of solid plant pressure when realized. The secondary plant
operator did not establish adequate heat removal using the atmospheric steam dumps.
Second Safety Injection and Continued Solid Plant Pressure Control
After a steam generator code safety lifted, cooldown of the solid plant caused a second,
automatic safety injection on low pressure. The operators initiated a manual safety injection
about the time when RCS pressure reached the SI setpoint. The second safety injection caused
numerous PORV actuations. The PRT rupture disc failed as would be expected during this time.
The rapid pressure reduction was not anticipated by the operators. The operators did not have
clear guidance on solid plant pressure control. They did not consider that establishing a bubble
in the pressurizer was within the scope of the EOPs. The yellow path for high pressurizer level
was not recognized nor used as guidance in drawing a bubble. Although in the Westinghouse
system of EOPs, a yellow path represents and optional approach to the event, the licensee did
not provide for procedurally-controlled alternatives to it. Thus, the AIT's view is that the
- correct path would have been identification of coolant inventory yellow path, then use procedure,
Functional Recovery Coolant Inventory (FRCI-1) to establish a bubble.
Restoration of Normal Plant Pressure Control
Stable plant conditions were established prior to starting the pressurizer heatup. BOP guidance
was adequate in maintaining plant control and although there were numerous technical
discussions and distractions in the control room during and subsequent to the safety injections,
the operators controlled the plant to a safe endpoint. Event declarations were in accordance* with
station procedures.
The operators reset the second SI at 11:41 a.m. Operators were controlling RGS temperature
by manual control of the MS 10s. Earlier, during the response to the opening of the steam
generator code safety valve(s), the operators experienced difficulty with the controls for 1lMS10
and, as a result, maintained this valve in a manual and closed condition. About an hour after
reset, at 12:54 p.m., the llMSlO opened to about 50% open position, but was immediately
closed with no noticeable cooldown. The plant pressure and temperature were then maintained
using the other three MSlOs with no further difficulties.
Following reset of the second safety injection and establishment of solid plant pressure control
using charging and letdown, the operators determined that the action statement of Technical
Specification 3.5.2, which required two operable ECCS injection systems (or cooldown to below
350°F within six hours) could not be met. By design, the automatic ECCS actuation capability
was not available following the safety injection actuation and would not be re-instated unless
reactor trip breakers were cycled after the safety injection was reset. Salem procedures did not
include a provision of*restoring the automatic functions of the safety injection system from these
28
conditions. In addition, the operators were not sure if either protection trains were operable
based on performance during the preceding events. Since Salem operators had no procedural
guidance for re-establishing automatic safety injection capability, and since it was not clear that
the automatic logic was operable, and due to the estimated six hours required to re-establish a
pressurizer steam bubble, the operators could not complete a reactor cooldown in the time
required by the Technical Specification. PSE&G management considered the use of 10 CFR
50.54(x) while the EOPs were in effect. However, later, after restoring normal pressure control
and completing the EOPs, PSE&G requested and was granted enforcement discretion by the
NRC for the additional time necessary to allow a reactor cooldown in a controlled manner, in
accordance with normal cooldown procedures without automatic safety injection capability.
Event Declarations
Declaration of the Notification of the Unusual Event was timely and in accordance with Salem
Emergency Action Levels. The decision of the emergency coordinator to declare an Alert to
obtain technical assistance when EOPs did not provide clear guidance was prudent.
Summary
Operator response to the reactor trip and safety injection was per the emergency operating
procedures. Operators maintained adequate sub-cooling margin throughout the event. Operator
control of engineered safeguards equipment was appropriate throughout the event. The post-trip
phase of the event revealed weaknesses in operator knowledge, performance, and procedural
guidance for: solid plant pressure control; use of functional recovery procedure "yellow paths;"
handling of SI train disagreements; and, control of MSlO controllers.
4.3
Procedure Adequacy and Use
Prior to the Reactor Trip
Prior to the reactor trip, direction to the operators for clogging and loss of the circulating water
system was provided by procedure, Sl-OP-AB.CW-OOOl(Q), Circulating Water System
Malfunction. This procedure directed reduction of load and removal of the turbine from service
when a minimum combination of three circulators was not met. The power reduction was
conducted using the direction provided by procedure, Sl.OP-IO.ZZ-0004(Q), Power Operation.
Neither procedure provided management expectations as to when operators should cease the
effort to maintain plant operations and instead, stabilize plant conditions by either turbine or
reactor trip. As a result of the lack of guidance, operators went to an atypical rate of power
reduction (8 percent per minute) in an attempt to maintain main condenser and turbine operation.
The inspectors did not identify procedural expectations for operator action if the plant
temperature is not controlled above the minimum temperature for critical operations, except that
Technical Specifications require recovery within 15 minutes.
29
The team identified that the Senior Nuclear Shift Supervisor, instead of directing control room
activities during the transient, ignored operations directives for equipment control and manually
defeated a circulator start interlock located in the turbine building while attempting to ensure
continued plant operation.
Following Reactor Trip
At the time of reactor trip, operators correctly implemented procedure, l-EOP-TRIP-1, Reactor
Trip or Safety Injection. The BOP directs that components not aligned by the automatic
actuation be individually aligned to the safety injection position. Manual actuation of safety
injection is directed if safety injection is required but not indicated on the control panel
indication. In this case, actuation was indicated, but not required, hence no manual actuation
was inserted. It was not clear to the AIT, that the operators could specifically associate the
failure of the large number of components to respond to the safety injection actuation with a
failure of SSPS train B logic. The team noted that no guidance had been provided to the
operators on proper response to ECCS train disagreement, which was identified to the operators
during the transient by flashing lights on status panel RP-4, on the main control board.
The operators correctly transitioned to procedure, l-EOP-TRIP-3, Safety Injection Termination,
when appropriate plant conditions were established.
Following the initial trip and safety
injection, operators attempted to establish stable plant conditions but were unable due to the
steam generator safety valve actuation and cooldown that resulted in a second safety injection.
Quasi-stable conditions were established upon recovery and re-entry into procedure, l-EOP-
TRIP-3, following the second safety injection. At this time, the plant was in solid plant pressure
control. Specific control guidance for solid plant control is not provided by the SI termination
procedure.
Guidance for re-establishing pressure control with a steam space in the pressuri7.er was available
to the operators by Critical Safety Function; Coolant Inventory Status Tree, yellow path
directive, l-EOP-FRCI-1, Response to High Pressurizer Level. However, this option was not
used. Instead, the operators continued through l-EOP-TRIP-3, and with technical support from
the Salem Technical Support Center, re-established the steam space in the pressurizer outside
of direct BOP guidance.
As mentioned previously, given the resultant conditions of the transient, and absent procedural _
guidance to restore the automatic safety injection capability from those conditions, operators
could not achieve the shutdown requirements of the plant technical specifications within the time
allowed. A Notice of Enforcement Discretion was issued by the NRC to allow the operators to
proceed with a normal cooldown.
30
4.4
Event Classification & Notifications
Event Classifications and Notifications were per procedure.
The Alert declaration was
particularly prudent, given that the operators felt they wanted or needed additional resources.
During the initial notification of the Unusual Event, NRC expectations were not met regarding
the level of detail of the telephone reports to the NRC and the ability to discuss the event and
answer questions that would enable the NRC to quickly assess the event to determine the
appropriate NRC response posture. The initial notification to the NRC did not convey to the
NRC information that complications were associated with the event. It was determined that the
licensee's Emergency Plan and Event Classification Guide required the licensee's communicator
to fill in a data sheet (NRC Data Sheet - Attachment 8 of the ECG) that, if properly completed,
would have given the NRC sufficient detail within the required notification time.
These
problems with level of detail and knowledge of the event were due to the physical location and
the pre-event activities of the communicator, combined with the limited background and
experience level, in general, of communicators at Salem; and, an apparent lack of oversight by
the senior nuclear shift supervisor in approving the information developed for transmission to
the NRC.
4.5
Simulator Demonstration
On April 12, 1994, the Salem training department provided a demonstration of the event of
April 7, 1994 to AIT team members. The demonstration included an explanation of plant
response, indications available to the operators, associated emergency operator procedures, and
a walkthrough of the BOP actions. The demonstration provided the inspectors with a good
understanding of the event dynamics, man-machine interface, and relevant procedures. The
demonstration was valuable in fostering the team's understanding of the event and expected
operator response. The team acknowledges the cooperation of site management and the Salem
training department in facilitating the simulator demonstration.
4.6
Reactor Vessel Level Indication System (RVLIS) Monitoring
On April 12, 1994, the NRC Senior Resident Inspector noted that the RVLIS indications in the
control room were at 93% (indicating that the reactor vessel was not completely full of water)
and questioned the operators about the indications. The SRI was told that operators at Salem
are not required to monitor RVLIS indications while in cold shutdown. The team reviewed
training material associated with RVLIS. This training material indicates that RVLIS provides
accurate indication while in cold shutdown.
Assessment of the Gas Bubble in the Reactor Vessel Upper Head
The Salem RVLIS indications are readily visible on a back panel from the normal operator
station at the control board. Further, the indication can be displayed on a control board monitor,
although, this was not in use when discovered by the SRI. The Senior Resident Inspector
31
discovered that each of the two RVLIS readings were showing - 93 % on April 12, 1994. When
this was identified to the operators, they were not aware of the indication and initially judged
the instrumentation to be incorrect.
As a result, the AIT was concerned with the effectiveness of operator training on this system.
In this case, RVLIS was specifically installed to provide an independent indication of water level
for events initiating from power operation. A full understanding of shutdown operation would
instill the insight that RVLIS is important to shutdown operation as well. Apparently, the
licensee did not expect that a gas bubble would form during its shutdown operating conditions.
Ultimately, after much discussion with the NRC, the licensee took the following actions:
a.
A sample of the gas bubble was drawn in a careful, well planned manner.
b.
Operating plans were changed to avoid plant perturbations until the gas bubble and its
implications were understood. For example, the licensee typically switches residual heat
removal (RHR) pumps from time to time to equafue use.
A planned switch was
postponed because the licensee had not yet investigated whether gas bubbles existed at
other locations that could impact RHR system operation if the switch were made.
c.
An investigation was initiated to identify the source of the bubble. The investigation
showed that the reactor coolant system (RCS) letdown, volume control tank (VCT)
conditions, and charging were consistent with generating a bubble in the reactor vessel
by introducing nitrogen from the VCT via the charging system.
(NOTE: During
shutdown operations a nitrogen "blanket" is maintained in the VCT to ensure proper
pressure for the charging system and minimize the amount of oxygen in the system.)
The AIT judged that the gas bubble was too small to be of immediate safety concern although
it would have been a concern if significantly larger. Importantly though, the AIT concluded that
the bubble was slowly increasing when discovered. For the bubble to potentially perturb RCS
cooling during normal RHR operation, it would have to expand into the hot leg. The most likely
expansion process would result in draining all steam generator (SG) tubes, perhaps followed by
lowering the pressuriz.er level, before a loss of RHR would. occur due to vortexing at the RHR
inlet. Loss of RHR due to the bubble was judged very unlikely based upon the bubble volume
and pressure at the time it was discovered.
In addition to being concerned about the apparent lack of operator awareness about the formation
of the gas bubble, the AIT was also concerned, however unlikely based on other indicators,
whether the gas bubble could have been an indication of fuel damage. The licensee reported an
iodine spike following the reactor trip that was expected from its knowledge that one or two fuel
pins were leaking. No indications of fuel damage due to the event were evident at the time of
discovery of the bubble, nor were any found at any time by the AIT. The licensee obtained a
gas sample at approximately 5:30 p.m. on April 13. Analysis showed it to consist of about 96%
nitrogen, 3 % hydrogen, and minor amounts of other gases.
No significant radioactive
32
components were found. The analysis was as expected for a gas bubble at that location due to
nitrogen being introduced from the VCT. The sample was consistent with a conclusion of no
fuel damage since no significant quantities of fission product gases were found.
Based on the system operations since the plant shutdown and the evidence gathered through the
licensee's sample analysis, the AIT determined that the most likely cause of the bubble is gas
transport from the VCT. The composition of the gas sample is consistent with an origin in the
VCT. Shortly after discovery of the bubble, the VCT pressure was 38 psig at a temperature of
64 °P, in contrast to essentially atmospheric pressure in the pressurizer gas space (and a higher
pressure in the hot leg due to the head of water in the pressurizer) and an RCS temperature of
170 °P. Conditions existed for absorbing nitrogen in the VCT and releasing it in the RCS.
Licensee calculations confirmed the plausibility of this behavior. The licensee reduced VCT
pressure to 15 psig during the evening of April 12 to reduce gas transport into the RCS.
4. 7
Operations Conclusions
The event revealed a number of weaknesses in plant systems, procedures, operator actions and
management controls that are normally maintained to assure plant safety:
Extensive response efforts had been established by plant and crew management for rapid
response to grass intrusions, including placing maintenance and operations supervisors
in the circulating water structure during periods when grass intrusions occurred,
streamlining of work controls including use of on-the-spot tagouts and elimination of
individual component work orders, and the use of direct, continual communications
between an SRO at the circulating water structure and the control room. However, even
the streamlined work controls were not fully adhered to during the April 7 event. Also,
CW equipment control was still maintained by the control room operators without
assistance, even though the resultant transient conditions were expected.
The control room operators had not been provided adequate guidance on management
expectations for control room activities during grass intrusions. During the rapid power
reductions that had become almost routine, circulating water screens, circulating water
pumps, main turbine load, steam plant equipment controls, and reactor controls required
quick, on-the-spot manipulations to meet all of the guidelines for power reduction. The
lack of management guidance was aggravated when rod control was placed in manual
instead of the normal automatic condition, requiring direct reactor control and oversight
as power was reduced. In spite of the daily power reductions and escalations, and the
inoperable automatic feature of rod control, management had not provided additional
measures to ensure that the control room operators could successfully respond to a rapid
transient condition.
Pre-trip command and control of operator activities were weak as evidenced by: a poorly
controlled rapid downpower with multiple reactivity changes; vague directions from the
NSS to the reactor controls operator to "pull rods" to restore T..., above minimum
temperature for criticality; an excessive rod pull; an operator being directed to leave the
reactor controls console to transfer electrical loads while reactivity was not stable; and,
the fact that supervisors did not obtain additional operator(s) in anticipation of the
33
transient to compensate for having rod control in manual. Additionally, the on-duty
Senior Nuclear Shift Supervisor (SNSS) was outside the control room, manually defeating
a circulating water protective permissive interlock, when his presence in the control room
would have better served nuclear safety.
The operators had not been provided direction on actions required for operation with
reactor temperature below the minimum temperature for critical operations.
Although the number of CW pumps and screens was below the minimum required for
turbine operations, operations efforts were directed toward plant recovery without a trip.
This unsuccessful effort resulted in the conditions leading to the safety injections and
subsequent loss of the pressurizer steam space.
Post-trip operator performance and command and control were generally good, and in
accordance with applicable procedures, although some weaknesses were noted.
Operators implemented and appropriately followed BOP TRIP-1 and EOP-TRIP-3; with
one minor exception, i.e., one letdown isolation valve was missed during the initial valve
alignments.
The MSlO controller characteristics inhibited the control of atmospheric steam dumps.
Ineffective direction had been provided to the operators to ensure adequate control of
plant temperature following reactor trips without condenser bypass capability. While
training included discussion and simulator modeling of the MSlO control problems, the
condition remained uncorrected for years. The inability to control the atmospheric dump
valves contributed to a steam generator safety valve lifting and the second safety injection
during solid plant pressure control.
The operators had not anticipated that the cooldown and subsequent heatup would fill the
pressurizer. No diagnosis of the effect of the open safety valve on the solid plant had
been made by the operators until pressure rapidly fell.
Use and knowledge of functional recovery procedure "yellow paths" was weak. In
particular, the availability and applicability of a yellow path to establish a pressurizer
bubble was not known by to the operators.
The operators had not been provided sufficient direction regarding safety injection train
logic disagreement, to minimize the recovery actions and possible avoidance of loss of
the pressurizer steam space.
Event Classifications and Notifications were per procedure. The Alert declaration was
particularly prudent, given that the operators felt they needed additional resources. NRC
34
expectations were not met regarding the description of the event with the complications
that occurred. Emergency Plan procedures for developing necessary information to be
transmitted to the NRC were not fully implemented.
Operators knowledge and use of RVLIS during cold shutdown conditions was weak. *
5.0
EVALUATION OF TROUBLF.SHOOTING ACTIVITIFS
The AIT reviewed the licensee's troubleshooting plans to ensure that the causes of the
unexpected plant equipment response would be determined. Also, the review ensured that the
cause of any identified malfunction would be corrected. The AIT observed portions of the
troubleshooting activities to verify that the activities were appropriately accomplished.
Solid State Protection System
Following the safety injection on April 7, 1994, PSE&G personnel performed extensive testing
of the SSPS to determine the root cause of the event and to determine if the system performed
as designed. These efforts included visual inspections, performance of established surveillance
tests and event specific tests and troubleshooting. These activities included the following:
A visual inspection of the SSPS components, including the high steam line flow input
relays was performed. Discoloration of the relay cases was noted and some relays had
a powdery residue on the bottom of the case.
The response times of the high steam line flow input relays were tested to determine the
time from actuating the bistable to input relay contact closure. All relays operated and
the drop out times varied from 4.2 to 14.8 milliseconds.
Surveillance tests Sl.IC-ST.SSP-0008(Q)(0009Q), "Solid State Protection System Train
A(B) Functional Test," were performed.
The test results for both trains were
satisfactory.
Portions of surveillance test Sl.OP-ST.SSP-0009(Q), "Engineered Safety Features SSPS
Slave Relay Test Train 'A'," were performed to test the operation of slave relays K616
and K621. These relays control the closing of the MSNs, the feedwater isolation valves
and the tripping of the steam generator feed pump turbines and the main turbine. All
relay tests were satisfactory.
Continuity checks of the release coils for the MSN
control auxiliary relays were also found to be satisfactory.
Surveillance test Sl.IC-TR.SSP-0004(Q), ".Response Time of SSPS Logic - Safety
Injection Train B," was performed with satisfactory results.
35
"Mini SI Test" was developed and performed on each of the SSPS trains to determine
how long a safety injection signal must be present to cause the MSN close circuit
latching relays to energize. For this test, one main steam line high flow instrument was
placed in a trip condition and a pulse generator was connected to the input of a second.
The plant was in a cold shutdown condition resulting in all of the low T..., instruments
being in the tripped condition. With these conditions, a pulse signal input to the second
high steam line flow instrument completed the trip logic necessary to generate a MSN
isolation and SI protective signal.
The results of these tests determined that all of the latching relays operated as designed.
However, this testing demonstrated that consistent, predictable behavior could not be
achieved unless the input signal lasted longer than about 50 milliseconds. Furthermore,
the as found condition of the relays associated with Train A actuated faster than those
associated with Train B; and therefore, a shorter input pulse duration on Train A would
effect valve closure.
A similar time response test to that for the MSNs was performed to determine if the
feedwater isolation signal would close the four feedwater isolation valves and trip the
main feedwater pump turbines. This testing also showed that the equipment actuation
was dependent on the duration of the input signal. All components operated as designed.
PSE&G decided to replace the high steam flow input relays based on the results of their visual
inspection. A difference in response times of the two trains could also have been caused by
differences in the input relay performance. Following the relay replacements, the "Mini SI
Test" was reperformed for Train B. The results of this testing determined that the response time
for the MSN closing relays had decreased and the overall response times more closely
approximated those for Train A.
Atmomheric Steam Dump Valve Controls
The design function of the air-operated atmospheric dump valves (ADV) is to remove heat from
the reactor plant when the main condenser is not available, and to prevent operation of the main
steam safety valves (MSSVs) during operating transients. The main steam system pressure is
normally approximately 1005 psig at zero power and decreases to approximately 850 psig at full
power. The ADV controllers are set to open the valves at 1035 psig (whereas the MSSVs open
at 1060 psig). This setting results in a demand signal (actual steam pressure vs. "open" setpoint)
that maintains the ADVs closed and charges capacitors in the ADV controllers. When steam
pressure rises above the controller setpoint, the capacitors must discharge before the controller
can begin providing signals to open the ADV. However, due to the actual pressure being below
the controller setpoint for an extended period of time (850 psig vs 1035 psig), the controller
output saturates low (a phenomenon called reset wind up) and causes a delay in opening the
ADV. Switching the ADV controller to manual will bring it out of saturation in a few seconds.
36
However, the specific time period required for the controller to be in the manual mode to
discharge the internal capacitor, removing the reset wind up, is not known.
The team noted that the operators were trained to use the manual operating mode, however, the
emergency operating procedures did not address the use of the manual mode.
The response of the controllers during the testing with a simulated ramp input pressure showed
that the ADVs may begin to open before the pressure reaches the MSSV setpoints, but they may
not limit the pressure increase to prevent opening the MSSVs.
To mi.nimi7.e the delay in the ADV controller response, PSE&G has installed a clamping circuit
to decrease the full power setpoint from 1035 psi to 1015 psi and decreased the controller gain
from 12 to 3 and tl:ie reset time from 180 seconds to 2 seconds. These changes should improve
the response time of the ADV controllers to prevent a rapidly increasing steam pressure from
unnecessarily opening the MSSVs.
The reset windup problem associated with atmospheric steam dumps was the result of a plant
controls modification implemented in the late 1970's to prevent an inadvertent opening of the
valves. The AIT found that PSE&G had recognized this problem for many years, and had
intended to address it during a planned design change to the feedwater control system.
Licensee troubleshooting efforts also determined that the problem that occurred with l lMS 10
on April 7, was due to a bad servo in the controls, which was then replaced.
Rod Control System
The team reviewed the following two issues related to the rod control system operation: first,
why the rod control system was being operated in the manual mode prior to the event; and
second, whether the rod control system responded appropriately when it was momentarily
switched to automatic control during the event. To address these questions, the team reviewed
the following:
maintenance history of the rod control system prior to the event;
operation of the rod control system during the event; and
troubleshooting and testing of the rod control system after the event.
The team reviewed the recent maintenance history of the rod control system to determine why
it was in manual control at the time of the event. This review indicated that troubleshooting of
the rod control system had begun on February 25, 1994, to investigate three separate instances
of unexpected control rod insertion while the system was in automatic control. The results of
initial troubleshooting identified multiple grounds within the T fl
err recorder, which were
corrected. However, on March 14, 1994, the rods again experienced unexpected control rod
insertion. . Troubleshooting the same day identified noise at the T ,.., input from isolator
37
1TM505A. Noise was also identified on the T .... input from isolator 1TM412N. Subsequently,
both isolators were replaced and the noise was eliminated.
After isolator 1TM412N was
replaced, it was found to be drifting. The isolator was recalibrated and PSE&G continued to
monitor it to determine if the drift was a problem.
At the onset of the April 7, 1994 event, the rod control system was being operated in the manual
mode. During the rapid load reduction the operator switched rod control to automatic with the
NSS' approval.
The rod speed indicated seven steps per minute and the rods stepped in
approximately two steps then stopped. The operator observed the T .. recorder and noticed a five
degree temperature error between T..., and T rer, and detennined that rod speed should be 72 steps
per minute. Therefore, the operator thought that automatic rod control had not responded
appropriately and switched back to manual control.
PSE&G performed the troubleshooting to determine whether the rod control system responded
appropriately in automatic during the event. This troubleshooting included the satisfactory
performance of procedure, SI.IC-CC.RCS-OCH (Q), "Rod Control System Automatic Speed
Verification," that verified proper rod control system operation at 6 and 72 steps per minute.
The rod speed and direction demand are based on a compensated temperature error signal.
Temperature error is defined as the difference between Tier and Terr and is compensated by a
power mismatch signal. The magnitude of the compensation signal is dependent on the power
mismatch between main turbine power and reactor power. Additional troubleshooting was
performed to verify the proper operation of the rod control system by varying one input
parameter while maintaining the other input parameters constant. The results of these tests
indicated proper operation of rod control in the automatic mode.
PSE&G also performed a dynamic test to verify proper operation of automatic rod control. This
test established initial conditions where nuclear power, turbine power and Trcr were set at 10%,
while T..., was set at negative five degree error. Nuclear power was then ramped from 10% to
25 % over a one-minute time interval. This test also indicated proper operation of automatic rod
control.
PSE&G performed other troubleshooting to confirm that the problems identified prior to the
event were adequately resolved. These tests included a verification that the system grounds were
removed and that the isolator drift was within specification. Additionally, PSE&G concluded
that the T_ recorder should not be used as an indicator of required rod speed during power
changes and intended to communicate this to the licensed operators and reinforce it in operator
training.
Intermediate Range CIR) Nuclear Instrumentation System <NIS>
In addition to other functions, the IR instrumentation channels provide reactor trip capability and
block both automatic and manual withdrawal of control rods (rod block) at 25 % reactor thermal
power (RTP) and 20% RTP, respectively.
38
This trip, which provides protection during reactor startup, can be manually bypassed if
two-out-of-four power range channels are above approximately 10% of full power. During the
event, the reactor tripped at 25 % RTP by the power range (PR) NIS low setpoint when the
reactor power increased from 7% RTP to 25% RTP under manual control of the control rods.
During this power escalation, the IR instrumentation channels 1-out-of-2 logic did not provide
either the rod block or the reactor trip functions. It was determined that the IR instruments were
indicating a lower power than the PR instruments and never exceeded the IR rod block or
reactor trip setpoints.
The licensee stated that the IR rod block and trip function are for startup protection; but, the PR
startup trip is used in the safety analysis (and the IR functions are not credited). The licensee's
investigation found that the difference between the PR and IR instrument's indicated power was
due to the different locations of these two detectors around the core. The IR detectors are in
the middle-upper region of the core and thus experience more neutron shielding from the control
rods in the core (rod shadowing) than* the PR detectors. The PR detectors are located at the
upper and lower regions of the core and are, therefore, less affected by the rod positions. For
a given reactor power and control rod position, this phenomenon may result in a higher power
indication on PR instrumentation channels than on the IR instrumentation channels, as was
observed during this event. PSE&G determined that rod shadowing due to the control bank "D"
rod position (operator pulled 35 steps, from step 55 to step 90 on control bank D) was
responsible for the failure of the IR NIS to provide rod blocks at 20% RTP and reactor trip at
25 % RTP. Westinghouse study of this phenomena found that detector IN35 would not initiate
signals for rod block and reactor trip until the RTP was 28.1 % and 35 .1 % respectively, while
its redundant detector IN36 would not initiate those signals until 25.3% RTP and 31.6% RTP
respectively. This translates into a maximum error of 10.1% RTP on IN35 and 6.6% ofRTP
on IN36.
The existing setpoints of the IR instrumentation channels are based on WCAP-12103,
"Westinghouse Setpoint Methodology for Protection Systems, Salem Units 1 & 2." In this
analysis the assumed "setpoint uncertainties" used percent span accuracies for various Rack
Parameters (RP) and Process Measurement (PM) that were consistent with the standard
Westinghouse methodology.
This analysis used a combined uncertainty value in terms of
percentage RTP for all PM components which contained allowances for power calorimetric,
down-comer temperature, radial power redistribution and rod shadowing.
A subsequent
Westinghouse analysis WCAP-13549 "Setpoint Uncertainties for IR NIS of Salem Units 1&2"
separated the rod shadowing from the rest of the PM components and performed calculations to
determine the maximum value for rod shadowing that would preserve the total allowance. Total
allowance is the difference between the Safety Analysis Limit and the nominal trip setpoint
assuming all uncertainties at their maximum values. The new calculation used an uncertainty
of 1.8% RTP for rack drift which resulted in an increment of rod shadowing effect from 6.25%
RTP to 11.87% RTP. This value is found to encompass the observed error in the setpoint of
the IR NIS channels due to the rod shadowing phenomenon (10.1 % RTP on IN35 and 6.6%
39
RTP on IN36) as long as the actual as-found IR NIS Rack Drift is less than 1.8% RTP. The
post-incident as-found setpoints of both IN35 and IN36 instrument channels were found to be
within this assumed Rack Drift value.
The team observed that the rod shadowing effect was used in the standard Westinghouse
instrument setpoint methodology and may have been reevaluated in the plant specific analyses
(e.g WCAP-13549) for other Westinghouse Nuclear Power Plants.
High Steam Flow Setpoint Change Circuitry
PSE&G performed testing to determine if the automatic change in the high steam flow setpoint
following a reactor trip (P-4) was inducing electrical noise that may have caused momentary high
steam low signals.
The results of this test indicated that summator 1PM505B dropped its setpoint slightly below the
expected setpoint for a period of time following the reactor trip, while summator 1PM506B
responded as expected by going directly to the new setpoint. PSE&G ruled this out as a possible
cause of the event since high steam flows were received on both channels and this would require
that both summators exhibit the same setpoint drop.
PSE&G continued troubleshooting the high steam flow setpoint circuit to identify the cause of
the summator 1PM505B setpoint dropping below the expected setpoint.
Initially, PSE&G
thought that the summator had failed, however, a replacement module yielded the same test
results. Further investigation by PSE&G revealed that both the replacement module and the
module that was installed at the time of the event were not the proper module. This module and
the one used to replace it during the current troubleshooting were of the proper part number, but
did not contain the "special" designation specified by the vendor. This "special" designation was
used to identify the incorporation of a capacitor in the summator circuit. Upon determining that
the wrong module was installed, the licensee installed the proper module.
The test was
performed again, and the same results occurred. At the conclusion of this inspection, PSE&G
was continuing to investigate the reason for the high steam flow setpoint dropping below the
expected setpoint following a reactor trip and how the incorrect module was installed in 1989.
The AIT concluded that neither of these two concerns contributed directly to the April 7, 1994
event; but, that the second issue was a potential loss of configuration control.
Conclusion
The AIT closely monitored the licensee's troubleshooting and testing activities. The team found
that the planning, control and performance of troubleshooting activities were very good and
resulted in the thorough validation of the root causes for the unexpected equipment responses.
The results indicated that the plant responded as designed for the conditions present on
April 7, 1994.
Also, some equipment performed poorly, as a result of pre-existing
vulnerabilities or deficiencies such as the CW screen wash system, the high steam flow relays
and the MSlO controllers. As described in Section 3.2, the licensee was initially prepared to
40
accept the pressurizer PORVs without a visual examination of the valve internals. While this
activity was noted as weak by the AIT, this was not indicative of the licensee's generally very
good troubleshooting efforts.
6.0
OTHER FINDINGS
Condenser Vacuum Alarms and Associated Procedures
The team reviewed the alarm printouts and the SPDS printout of the condenser vacuum values
for the April 7, 1994 event. This review revealed the following:
The vacuum sensed on the west side of the condenser was consistently 2" - 3" Hg lower
than that of the east side as recorded by the SPDS;
The vacuum sensed on the west side of the condenser dropped below 23" Hg at 10:40
a.m. and remained below 23" Hg for approximately three minutes, with the lowest value
being 21.67" Hg for over one minute during that time; and
The condenser vacuum low-low alarm came in at 11:23 a.m., while the condenser
vacuum low alarm did not come in during the event.
The condenser vacuum sensed on both the east and west sides of the condenser are used to
provide indication. Additionally, the condenser vacuum sensed on the east side is used to
provide alarm functions. These alarm functions are a condenser vacuum low alarm with a
setpoint of 25" Hg, and a condenser vacuum low-low alarm with a setpoint of 23" Hg.
Discussions with PSE&G staff revealed that the condenser is a single-pass condenser, with the
circulating water entering on the east side. This design explains the variations between the
sensed vacuum for the east and west side.
The team reviewed the alarm response procedure for the condenser vacuum low-low alarm.
This procedure described the alarm setpoint, the cause, automatic actions associated with the
alarm and operator actions required in response to the alarm. The automatic actions described
in the procedure were a turbine trip and reactor trip if power is greater than 49 % , and just a
turbine trip if power is less than 49 % * The team determined this statement is incorrect since
the device that trips the turbine is a mechanical device not related to the device actuating the
alarm. Additionally, review of the last calibration of the turbine trip device indicated that it was
set within its specified range of 18" - 22" Hg, at 18.4" Hg, and would not have actuated at the
same time as the alarm. To address this issue PSE&G developed a procedure revision request
to revise the alarm response procedure so that it properly reflects that the turbine trip is not an
automatic function associated with the condenser vacuum low-low alarm.
41
SSPS Conformance with IEEE-279
Code of Federal Regulations in 10 CFR 50.55a(h) requires the nuclear power plant protection
system to meet the requirements of IEEE Standard 279, "Criteria for Protection Systems for
Nuclear Power Generating Stations." As a result of the equipment responses experienced during
this event the team reviewed the SSPS design relative to two sections of IEEE-279.
Section 4.16 of IEEE-279, "Completion of Protective Action Once it is Initiated," states that the
protection system shall be so designed that, once initiated, a protective action at the system level
shall go to completion and return to operation shall require subsequent deliberate operator action.
Section 4.12, "Operating Bypass," which states that where operating requirements necessitate
automatic or manual bypass of a protective function, the design shall be such that the bypass will
be removed automatically whenever permissive conditions are not met.
The team found that there were latching relays or seal-in features in all of the component control
circuitry such that if there were actual conditions requiring an MSIV isolation and safety
injection, all actions are designed to go to completion. Also, the team determined that the
manual bypass of SI (Auto SI block following reset) in response to an BOP step is not an
operating bypass. The blocking of automatic SI following a system reset, permits the operators
to take manual control of equipment as necessary to recover from a plant transient or accident.
The period of time that the auto SI may be blocked is controlled by plant Technical
Specifications.
The team concluded that the SSPS at Salem was in compliance with IEEE-279.
SSPS Modification History
The team reviewed the modification history associated with the SSPS, including changes to the
steam flow transmitters. It was determined that the changes made to the system did not have
any effect on the April 7, 1994, event.
Additionally, the team also reviewed the design
specification for the SSPS, and found no specification related to the minimum pulse length
required for actuation of the SSPS/ESF systems.
Input Relay Chatter
The team found that the main steam line flow indications have experienced drifting during the
operating cycle. The drifting resulted in the instrumentation output reaching the high steam line
flow trip setpoint and caused momentary drop out and pick up ("chattering") of the associated
input ~elays.
To eliminate the relay chatter the flow instrumentation was periodically
recalibrated. As discussed in Section 5 of this report, a visual inspection of the relays indicated
some discoloration of the relay cases and the evidence of a powdery residue in the cases. The
input relays were subsequently replaced.
The response time of the Train B of the SSPS
appeared to improve following the installation of new relays, however the team could not
42
determine if the relays had been degraded by the chattering. The cause of the instrumentation
drift had not been identified prior to completing the AIT inspection. The AIT judged that the
relay chattering did not play a key role in this event and should be reviewed by NRC as part of
routine inspection. NRC inspection in this area was continuing after the AIT effort, as part of
the NRC Region I effort to review and assess licensee actions prior to restart. This effort will
be documented in a future inspection report.
7.0
SAFETY SIGNIFICANCE AND AIT CONCLUSIONS
7.1
Safety Significance
The AIT found that the event was not a significant threat to the reactor fuel, the fuel cladding
or the containment. The RCS pressure boundary was maintained within its design throughout
the event; however, the pressurizer PORVs and piping upstream of the PORVs were challenged
by frequent cycling of the valves to maintain RCS pressure.
The PORVs functioned as designed to prevent an RCS overpressure although they were damaged
in the process. This damage did not appear to affect PORV functionality during or following
the event. The licensee did not complete evaluation of piping upstream of the PORVs prior to
the AIT exiting the site, and consequently the AIT was unable to complete its assessment of that
piping.
The PRT rupture disk relieved to containment as designed during the event. The amount of
coolant released to containment was minimal and readily cleaned up following the event. The
containment pressure boundary was not challenged.
The most likely complication with significant consequences if further failures had occurred
during the event is a small break LOCA.
Multiple equipment failures would have been
necessary for this to occur, such as: coincident failures to close both a pressurizer PORV and
its block valve; or, C9incident failures to open both PORVs and a resultant opening of the
pressurizer safety valve(s) and a subsequent failure of one or more valves to close. However,
initiation of the LOCA would be within the design basis for the plant, and equipment necessary
to mitigate such conditions responded as designed to the inadvertent safety injection actuation
and hence, would have been available to respond to any further degradation had it occurred.
The Salem April 7 event resulted in no protective barrier failures. However, the event led to
a loss of the pressurizer steam space and significantly challenged RCS pressure boundary
components.
While, as described above, the safety consequences of the event were minimal, the AIT
considered the equipment, personnel performance and procedural problems to be noteworthy and
to warrant addressal by the licensee.
43
7 .2
AIT Conclusions
No abnormal releases of radiation to the environment occurred during the event.
The AIT developed an independent sequence of events and performed an assessment of key
operating parameters that would indicate a failure to a primary barrier such as fuel cladding,
reactor coolant pressure boundary or containment. The AIT determined that the primary
boundaries remained intact throughout the event.
The pressurizer PORVs functioned properly on numerous occasions to maintain the RCS
pressure boundary within the previously analy:zed envelope. As a result of these operations, the
pressurizer relief tank (PRT) rupture disk ruptured, as would be expected, to prevent destruction
of the tank. As a result, a few gallons of reactor coolant from the PRT were released to the
containment floor. The AIT reviewed the radiological surveys of the area near the PRT and
concluded that the level of contamination was minor and consistent with the normal activity
contained in the PRT.
Event challenged RCS p~re boundary resulting in multiple, succesmul operations
of pressurizer PORVS and no operations of the p~rizer safety valves.
As stated earlier, the AIT findings disclosed that the event sequence provided a challenge to the
RCS pressure boundary. As a result of the initial safety injection, the RCS filled with water.
Without the normal pressurizer steam space to dampen pressure excursions, the continued
injection, both from the initial and second automatic safety injection actuations, resulted in
repeated, successful actuations of the pressurizer PORVs to limit the RCS pressure within the
analy:zed envelope.
The AIT concluded that the event did in fact pose a significant challenge to the pressure
boundary by challenging the PORVs; that the pressure boundary protective devices (PORVs and
safety valves) functioned properly throughout the event; that no limits were exceeded during the
event; and that some equipment degradation resulted.
Operator errors occurred which complicated the event.
The AIT reviewed plant event data and interviewed the operators involved in the event. It was
concluded that operator errors occurred throughout the event sequence. However, it was noted
that operator performance was better after the reactor trip than prior to the trip.
The operators responded appropriately to the potential loss of condenser circulating water by
decreasing reactor and turbine power, ultimately with the intent to remove the turbine-generator
unit from service. Power was reduced, using a combination of control rods and boration, to a
point that the operators began to switch onsite electrical loads to offsite power supplies in
anticipation of removing the turbine from service. The shift supervisor directed the operator on
the reactor controls to perform the electrical load swaps.
At that time, neither the shift
44
supervisor nor the reactor operator recognized that the reactivity change, due to borations, was
incomplete. In fact, when this was complete, the reactor power was less than the turbine power
so that T .... began to decrease. This decreasing T_ was not immediately identified; however,
upon discovery the shift supervisor responded to this condition by pulling rods in manual. Thus,
the shift supervisor was no longer in a position to properly direct the activities of the reactor
operators. The RO completed the electrical load swap, returned to the reactor controls without
adequate communications from the shift supervisor regarding the shift supervisor's actions and
commenced to raise reactor power. The RO noted that T..., had gone below the Technical
Specification minimum temperature for criticality, but failed to effectively communicate such
to the senior reactor operator. Also, the shift supervisor directed the RO to raise power, but,
was not explicit regarding how far or fast to raise power. Absent such direction, the RO
continued to raise reactor power while monitoring T.... for an indication that temperature was
recovering and failed to identify that a reactor trip on low power.;.high flux condition would
occur. As a result of the above operator errors, a reactor trip occurred on high flux (25 % ) and
the low T..., condition was still present. The low T * .c condition in coincidence with an indicated
high steam flow signal initiated the first automatic safety injection.
After the reactor trip and safety injection, the operators appropriately entered the EOPs and
successfully completed the required actions. As a result of the unusual equipment response to
the initial safety injection system actuation, described previously; numerous valves were not in
the expected or required position per the EOPs. The operator responded to these conditions per
the EOPs. One letdown isolation valve that was mispositioned was not initially identified and
corrected by the operator. This was subsequently discovered by the operators during the
termination/recovery actions after identifying that the safety injection was not needed. It is
noted by the AIT that a redundant valve for this same isolation line did close.
At about this time in the event sequence at least one steam generator code safety valve lifted
causing a rapid secondary and primary cooldown.
This cooldown, from the solid RCS
condition, induced a very rapid depressurization of the RCS, and ultimately the second safety
injection. The AIT concluded that the operators were not properly monitoring the RCS heatup
resulting from decay heat and the running Reactor Coolant Pumps, after the initial safety
injection. The AIT noted that the automatic steam generator atmospheric relief valves should
have lifted before the steam generator code safety valve set point was reached, but due to a
characteristic of the controller for the relief valves (reset windup), which the operators were
trained to handle, the valves did not open sufficiently to limit the main steam pressure rise.
Following the code safety lift, operators proper! y responded by taking manual control of the
steam generator atmospheric relief valves in order to lower pressure to re-seat the safety(s). The
resulting rapid RCS depressurization was observed by the operators and they decided to
manually re-initiate safety injection. A second automatic SI occurred prior to the manual
operation; however, the operators continued with the manual actuation. The operators then
appropriately re-entered their EOPs at this time without further error.
----- ----
45
In addition to the above, the AIT also identified the following two concerns regarding operator
actions:
During the down power transient, the senior shift supervisor, also SRO-qualified and the senior
management representative in the control room, left the control room area to bypass a condenser
vacuum permissive switch in an attempt to restart one of the inoperable circulating water pumps,
hoping to restore adequate condenser cooling. The AIT concluded that this was an inappropriate
work activity and also, poor judgement on the senior shift supervisor's part to leave the control
room during the transient.
After the initial safety injection, the senior shift supervisor left the control room proper in order
to classify the event and initiate notifications per the emergency plan implementing procedures.
While this activity was timely, the initial notification message developed for a communicator
provided minimal information to the NRC in that it failed to describe the complications that had
occurred.
Management allowed equipment problems to exist that made operations difficult for
plant operators.
1.
The AIT found that during this event and for about a month prior to the event, that the
automatic rod control system was not in service. This led to the operators having to
manually control reactor power to maintain RCS T .... within program.
During the event of April 7, 1994, the operators initially decreased turbine power at
1 %/minute, but quickly increased that rate change to a maximum of 8%/minute. At this
rate of change, even the automatic rod control system would not have been able to
maintain T ... in program without operator action to assist by boration. With the rods in
manual, as was the case, operator action in response to the 8%/minute rate of change
was very difficult.
The AIT noted that PSE&G management was addressing the automatic rod control
system problem and that, in fact, the control system was available at the time of the
event. However, operations management had not yet restored the system to service since
a final surveillance test had not been completed. That test had been scheduled for the
day of the event
2.
The AIT found that the short duration, high steam flow signal, resulting from the turbine
trip, had been previously identified by the licensee following prior post-trip reviews
conducted after similar turbine trips in the past. Information provided the AIT indicated
this condition had been recognlled as early as 1989. The high steam flow signal was of
very short duration, on the order of 20 to 30 milliseconds, and appeared about 1 second
after the turbine trip. While this condition had been recognlled previously, the licensee
attributed the cause to be a combination of the logic (the reactor trip automatically
reduces the high steam flow setpoint from about 110% to about 40% of rated steam flow)
46
and the actual decay in steam flow following a reactor trip-turbine trip. Upon closer
analysis following this event, the licensee identified that the actual cause of the indicated
high steam flow signal following a turbine trip corresponds to a pressure wave initiated
by the turbine stop valve closure.
The AIT concluded that this pressure wave did cause the indicated high steam flow, and,
coincident with the low T..., condition induced by operator error, resulted in the initial
automatic safety injection actuation. The AIT further concluded that earlier licensee
assessment of indicated high steam flow after turbine trips was inadequate in that it failed
to identify this mechanism and therefore the problem remained uncorrected.
3.
The AIT found that the automatic controls for steam generator atmosphere relief valves
were not maintained. This, coincident with the operators failure to recogniz.e that RCS
and steam generator temperatUre and pressures were increasing after the initial safety
injection, led to the steam generator code safety(s) actuation and resultant second safety
injection actuation. The atmospheric relief valves (MS 10s) control system had been
modified in the late 1970's, which resulted in the controls not responding properly in
automatic without operator action. Plant operators had been trained to make up for this
deficiency by placing the system in manual for a few seconds and then restoring the
system to automatic. This would result in the control system then working properly.
During the events of April 7, 1994, the operators failed to take adequate manual control
of this system prior to pressure increasing to the lift setpoint of the steam generator code
safety(s).
The AIT determined that the control system for the MSlOs was known to be deficient.
Modifications had been planned, but never implemented to correct these conditions and
operators had been expected, through training, to make up for the control deficiencies
by manual actions.
4.
The AIT found that the circulating water system was vulnerable to periodic grass
intrusions. This had been documented by the licensee for a number of years. Records
indicating that this condition was especially aggravated in the spring of 1994 were
provided the to AIT. However, the vulnerability had been previously recognized by the
licensee and modifications had been planned to make the system less susceptible to grass
intrusions. These modifications had not been implemented prior to the event. During
the spring of 1994, as the river grass conditions worsened, the licensee began to initiate
special work teams and work controls at the circulating water structure in response to the
predictable grass intrusions that occurred coincident with daily tide changes. These
special practices were quite effective at responding to the degrading circulating water
conditions and usually resulted in restoring inoperable traveling screens and circulating
water pumps without the need for control room operators tripping the turbine or reactor.
The AIT noted that on one occasion prior to the April 7 event, operators had been forced
to remove the turbine from service as a result of a grass intrusion; but, the reactor was
maintained in low power operation. No further complications had occurred on that
47
event. It was also noted by the AIT that the event of April 7 was apparently more severe
than earlier events, resulting in operators decreasing power at a maximum of 8 %/minute.
This was done to reduce turbine power fast enough to minimize the increasing back
pressure in the condenser. The prior grass intrusion events did result in operators
frequently reducing power to maintain condenser vacuum, while the special work
activities at the circulating water structure restored inoperable circulators. However, no
prior event required such a high rate of change in power to compensate for the loss of
circulating water.
The AIT determined that the grass intrusion event of April 7 was very severe; however,
the vulnerability of the design was previously recognized and modifications to improve
the system had not yet been implemented.
Some equipment was degraded by the event, but overall, the plant performed as
designed.
The AIT observed the licensee's troubleshooting efforts. It was noted by the team that certain
valves for the safety injection systems, containment isolation systems, feedwater isolation
system, and steam line isolation system did not respond in the usual manner to the initial
automatic safety injection actuation. This was a- result of the short duration of the initiating
signal, which was only of sufficient duration for parts of the protection logic to respond,
resulting in the unexpected behavior. However, functional testing of the protection logic clearly
indicated that it would have performed properly in response to real accident conditions had they
been present.
The AIT further concluded that licensee troubleshooting methods clearly
demonstrated the logic responded as would be expected to the short duration signals. The AIT
determined that the plant response to the event was as expected for the conditions that occurred.
The troubleshooting efforts clearly demonstrated that the protection logic response, as well as
the response of the main steam and feedwater isolation systems, were a direct result of
instrument sensitivity and response behavior to short duration signals. Testing demonstrated that
consistent, predictable behavior could not be achieved unless the input signal lasted longer than
about 50 milliseconds. The wlnerability of the protection system to short duration signals had
not been previously identified or evaluated by the licensee prior to the April 7 event.
Due to the repeated operation of the pressurizer PORVs, the AIT requested, and the licensee
completed an assessment of the PORVs, pressurizer code safety valves and attendant piping and
supports. The licensee and NRC inspected the PORV internals, which exhibited wear requiring
further evaluation and corrective action prior to restart.
As a result of the troubleshooting activities, other equipment conditions requiring repairs were
also identified, including the PRT rupture disk, main steam high steam flow input relays, and
various MSlO control components.
48
Operator use of emergency procedures was good.
The AIT determined that the operators' use of the EOPs in response to the multiple automatic
safety injection actuations was good; however, some errors happened after entry into the EOPs.
The AIT found that operators were not specifically knowledgeable in the use of EOP "Yellow*
Path" procedures for solid plant recovery. "Yellow Path" system function restoration procedures
are optional in the Salem EOP scheme; but, for this event and the solid plant condition, no
alternative procedures had been provided. Knowledge, training and practice in the use of
"Yellow Path" procedures could have aided the operators earlier in the recovery of the
pressuriz.er steam space following the multiple SI actuations.
Operator actions to manually initiate SI on rapidly decreasing RCS pressure and in declaring the
Alert to ensure appropriate engineering support for plant recovery from the solid RCS condition
were considered appropriate by the AIT.
Prior to entry into the EOPs, the operators committed a number of errors dealing with command
control and coordination of the downpower transient. Most of these errors could have been
avoided if appropriate guidance had been developed and implemented in the normal integrated
operating procedures and in the abnormal or alarm response procedures.
Licensee investigations and troubleshooting efforts were good
The AIT closely monitored the licensee's troubleshooting activities and, to a lesser extent, the
licensee's independent investigation. Based on the direct observation of the logic testing and
other troubleshooting activities, the AIT determined that the licensee approach was clearly to
ascertain the root causes of the events of April 7, identify necessary corrective actions and then
implement such measures. However, it was noted by the AIT that the licensee was prepared to
accept the operability of the pressuriz.er PORVs without a visual inspection of the components.
The AIT asked for the necessary engineering evaluation of the PORVs upon which the licensee
was to base their operability assessment. Prior to developing this evaluation, the licensee then
elected to open the components for a visual inspection. This led to the findings of the degraded
PORV internals resulting from the event. While this specific activity was not pursued rigorously
by the licensee without NRC prompting, this was not indicative of the other troubleshooting
activities observed by the AIT.
The AIT met with members of the licensee's investigation team to discuss preliminary findings;
and, reviewed the operations post trip report and the investigation report. Information gathered
from these reports was useful to the AIT assessment. Further, the licensee's sequence of events
and facts supporting the event sequence were found to be consistent with the AIT's. The AIT
concluded that there was evidence of noteworthy management oversight and control weaknesses
due to the coincidence of equipment issues, both recent and historical, operator errors and
procedural guidance deficiencies that all contributed significantly to the April 7 event. In
contrast, the licensee's investigations placed a greater emphasis on the operator errors in
contributing to the event. The AIT noted that the licensee's investigation did not attempt to
49
ascertain why the operator errors occurred, but identified the errors as root cause. However,
it was also noted by the AIT that licensee's recommended corrective actions clearly addressed
the equipment and procedural deficiencies that contributed to the event.
8.0
EXIT l\\.1EETING
On April 26, 1994, the AIT conducted a public exit meeting at the site discussing the inspection
scope and preliminary findings. The exit meeting slides were provided to the public and made
an official record under separate correspondence to the licensee, dated April 26, 1994. The
attendees at the exit meeting are listed in Attachment 6. Following the public meeting, the AIT
met with and responded to questions from the publ~c and media representatives in attendance.
April 8, 1994
ATTACHMENT 1
AIT CHARTER
MEMORANDUM FOR:
Marvin W. Hodges, Director, Division of Reactor Safety
FROM:
Thomas T. Martin, Regional Administrator
SUBJECT:
AUGMENTED TEAM INSPECTION CHARTER FOR THE
REVIEW OF THE SALEM UNIT N0.1 REACTOR SCRAM
AND LOSS OF PRESSURIZER STEAM BUBBLE
On April 7, 1994, Salem Unit No. 1 reactor scrammed from 25% power during maneuvers to
shut the plant down. Subsequent to the reactor scram, the plant experienced a series of safety
injections which resulted in loss of the pressurizer steam bubble and normal pressure control.
In addition to the reactor trip and safety injection, certain valves that are required to operate,
failed to close. Because of multiple failures in safety related systems during the event and
possible operator errors, per M.C. 325, Paragraph 05.02, Item a, I have determined that an
Augmented Inspection Team (AIT) should be initiated to review the causes and safety
implications associated with these malfunctions.
The Division of Reactor Safety (DRS) is assigned the responsibility for the overall conduct of
this augmented inspection.
Robert Summers is appointed as the AIT leader.
Other AIT
members are identified in Enclosure 2. The Division of Reactor Projects is assigned the
responsibility for resident and clerical support as necessary; and the coordination with other
NRC offices, as appropriate. Further, the Division of Reactor Safety, in coordination with DRP
is responsible for the timely issuance of the inspection report, the identification and processing
of potentially generic issues, and the identification and completion of any enforcement action
warranted as a result of the team's review.
Enclosure 1 represents the charter for the AIT and details the scope of the inspection. The
inspection shall be conducted in accordance with NRC Management Directive 8.3, NRC
inspection Manual 0325, inspection Procedure 93800, Regional Office Instruction 1010.1 and
this memorandum.
Enclosures:
1. Augmented Inspection Team Charter
2. Team Composition
Al-1
ORIGINAL SIGNED BY:
William F. Kane for
Thomas T. Martin
Regional Administrator
ENCLOSURE 1
AUGMENTED INSPECTION TEAM CHARTER
The general objectives of this AIT are to:
ATTACHMENT 1
AIT CHARTER
1.
Conduct a thorough and systematic review of the circumstances surrounding the reactor
scram at Salem Unit No. 1 on April 7, 1994 and the resulting loss of the pressurizer
steam bubble.
2.
Assess the operators' actions preceding and subsequent to the reactor scram. Develop
a sequence of events and events causal factor analysis for the plant and operators'
responses and human factors associated with the event. Compare the expected plant
response to the actual plant responses.
3.
Review the licensees event classification and notifications for appropriate responses.
4.
Assess the safety significance of the event and communicate to the regional and
headquarters management the facts and safety concerns related to problem identified.
5.
Examine the equipment failures and identify associated root causes.
6.
Determine if any design vulnerabilities or deficiencies exist that warrant prompt action.
7.
Prepare a report documenting the results of this review for the Regional Administrator
within thirty days of the completion of the inspection.
Schedule:
The AIT shall be dispatched to Salem so as to arrive and commence the inspection on April 8,
1994. During the site portion of the inspection resident and clerical support is available.
Al-2
ENCLOSURE2
TEAM COMPOSIDON
The assigned team members are as follows:
Team Manager:
Onsite Team Leader:
Onsite Team Members:
New Jersey State Observer
- added later
Wayne Hodges, DRS
Robert Summers, DRP
Steve Barr, DRP
Scott Stewart, DRS
Larry Scholl, DRS
Warren Lyon, NRR
Iqbal Ahmed, NRR
John Kauffman, AEOD
Howard Rathbun, NRR
Richard Pinney
Al-3
ATTACHMENT 1
AIT CHARTER
CONTROL
BOARD'
SWITCHES
TRAIN B
PROTECTION
SYSTEM
ANALOG
TR~N B
PROTECTION SYSTEM
NUCLEAR INSTRUMENTATION
SYSTEM OR rlELD CONTACTS
p:::::==::::::A:::::==::::::,
PROCESS
SENSORS
BISTABLES
CONTROL
BOARD
SWITCHES
TRAIN A
PROTECTION
SYSTEM
TRAIN A
LOGIC
MASTER
AND
SLAVE
RELAYS
MASTER
AND
SLAVE
RELAYS
INPUT
RELAYS
SOLID STATE LOGIC
ATTACHMENT 2
SAFETY INJECTION SYSTEM LOGIC DIAGRAM
ACTUATE
TRAIN B
SArEGUARDS
COMPUTER
DEMUX
COMPUTER
MONITORING
"OR" CABLE
CONTROL
BOARD
MONITORING
CONTROL
BOARD
DEMUX
CABINET
ACTUATE
TRAIN A
SArEGUARDS
TO ROD
DRIVE
MECHANISMS
ROD
CONTROL
SYSTEM
(
ROD
CONTROL
M-G
SETS
BYPASS
BRK 8
BYPASS
BRK A
ATTACHMENT 3
CONFIRMATORY ACTION LETTER
April 8, 1994
Docket No. 50-272
License No. DPR-70
CAL No. 1-94-005
Mr. Steven E. Miltenberger
Vice President and Chief Nuclear Officer
Public Service Electric and Gas Company
P.O. Box 236
Hancock's Bridge, New Jersey 08038
Dear Mr. Miltenberger:
SUBJECT:
CONFIRMATORY ACTION LETTER 1-94-005
On _April 7 and 8, 1994, in telephone discussions, William Kane, Deputy Regional
Administrator, informed Mr. Joseph Hagan, Acting General Manager, Salem Nuclear Generating
Station, of our decision to dispatch an Augmented Inspection Team (AIT) to review and evaluate
the circumstances and safety significance of the Unit 1 reactor trip and safety injection that
occurred on April 7, 1994. The event was complex and may have involved personnel error,
equipment failure, or a combination of both. The AIT was initiated because of the complexity
of the event, the uncertainty of the root causes of some of the conditions and equipment
problems encountered during the event, concerns relative to the proper functioning of engineered
safety features, and possible generic implications. The AIT, led by Mr. Robert Summers of our
office, is expected to commence their activities at the Salem Nuclear Generating Station on April
8, 1994.
In response to our request, Mr. Hagan agreed to place Salem Unit 1 in a cold shutdown
condition and maintain that condition until the AIT acquired all the information needed for their
assessment and was ~~ti.stied that any necessary corrective measures have or would be taken; and
that your staff would take actions to:
1.
Assure that the AIT Leader is cogniz.ant of, and agrees to, any resumption of activities
that involve the operation, testing, maintenance, repair, and surveillance of any
equipment, including protection logic or associated components, which failed to properly
actuate in response to the reactor trip and safety injection(s) of April 7, ~994.
2.
Assemble or otherwise make available for review by the AIT, all documentation
A3-1
ATTACHMENT 3
CONFIRMATORY ACTION LETTER
(including analyses, assessments, reports, procedures, drawings, personnel training and
qualification records, and correspondence) that have pertinence to the equipment
problems leading up to the reactor trip and safety injection(s), and subsequent operator
response and recovery actions.
3.
Assemble or otherwise make available for review by the AIT, all equipment, assemblies,
and components that were associated with the problems encountered during the events
leading up to, and subsequent to the reactor trip and safety injection(s).
4.
Make available for interview by the AIT, all personnel that were associated with, or have
information or knowledge that pertains to the problems encountered during the events
leading up to, and subsequent to the reactor trip and safety injection(s).
5.
Gain my agreement prior to commencing any plant startup.
Pursuant to Section 182 of the Atomic Energy Act, 42 U.S.C. 2232, and 10 CPR 2.204, you
are hereby required to:
1.
Notify me immediately if your understanding differs from that set forth above.
2.
Notify me, if for any reason, you require modification of any of these agreements.
Issuance of this Confirmatory Action Letter does not preclude issuance of an Order formalizing
the above commitments or requiring other actions on the part of the licensee, nor does it
preclude the NRC from taking enforcement action if violations of NRC regulatory requirements
are identified through the actions of the AIT. In addition, failure to take the actions addressed
in the Confirmatory Action Letter may result in enforcement action.
The responses directed by this letter are not subject to the clearance procedures of the Office of
Management and Budget as required by the Paperwork Reduction Act of 1980, Pub. L.96-511.
In accordance with 10 CPR 2. 790 of the NRC's "Rules of Practice," a copy of this letter will
be placed in the NRC Public Document Room. We appreciate your cooperation in this matter.
Sincerely,
ORIGINAL SIGNED BY:
William P. Kane for:
Thomas T. Martin
Regional Administrator
A3-2
3
ATTACHMENT 3
CONFIRMATORY ACTION LETTER
cc:
J .J .Hagan, Acting General Manager - Salem Operations
C. Schaefer, External Operations - Nuclear, Delmarva Power & Light Co.
S. La.Bruna, Vice President - Engineering
R. Hovey, General Manager - Hope Creek Operations
F. Thomson, Manager, Licensing and Regulation
R. Swanson, General Manager - QA and Nuclear Safety Review
J. Robb, Director, Joint Owner Affairs
A. Tapert, Program Administrator
R. Fryling, Jr., Esquire
M. Wetterhahn, Esquire
P. J. Curham, Manager, Joint Generation Department,
Atlantic Electric Company
Consumer Advocate, Office of Consumer Advocate
William Conklin, Public Safety Consultant, Lower Alloways Creek Township
K. Abraham, PAO (2)
Public Document Room (PDR)
Local Public Document Room (LPDR)
Nuclear Safety Information Center (NSIC)
NRC Resident Inspector
State of New Jersey
A3-3
ATTACHMENT 4
SEQUENCE OF EVENTS
DETAILED SEQUENCE OF EVENTS
April 7. 1994
Pre-transient initial conditions: Unit 1 power at 73%, rod control in manual.
0730
12A circulator out of service for waterbox cleaning.
1016
13B circulating water pump emergency trip on travelling screen differential pressure;
13A, 13B and 12B travelling screens all clog and eventually go out of service.
1027
13A circulating water pump trips on high screen differential pressure.
1032 Unit 1 operating crew initiated a plant power reduction from approximately 650 MWe
at 1 % power per minute initially (up to this point, plant power had decreased from 800
MWe due to an increase in condenser back pressure). Subsequently, operators increased
the reduction rate to as high as 8 % per minute.
1034 - Operators attempt to restart 12A circulating water pump; pump immediately trips due to
pump circuit breaker not being fully racked in.
1039 P-8 permissive (reactor trip on low coolant flow in a single loop) reset (blocked) at 36%
reactor power.
By this time, all circulating water pumps except 12B have tripped; 13A and 13B are
restarted, but by 10:46 they have tripped again, leaving 12B as the only circulator in
service.
1043 P-10 permissive (power range low setpoint reactor trip and intermediate range reactor
trip and rod stop) reset (reinstalled) at 10% reactor power.
At about this time, the Nuclear Shift Supervisor (NSS) directs the Reactor Operator (RO)
at the rod control panel to go to the electrical distribution panel to perform group bus
transfers.
1044 Turbine load at 80 MWe, RCS temperature at 531 degrees F. Low-low T .... bistable
setpoint Tech Spec allowable value L. 541 degrees F, therefore low-low T .... bistables
trip.
A4-1
ATTACHMENT 4
SEQUENCE OF EVENTS
1045 The NSS begins to withdraw rods, and then the RO is directed by the NSS to return to
the rod control panel and withdraws rods to restore RCS temperature - rods pulled 35
steps, from step 55 to step 90 on control rod bank D.
1047 Reactor power increases from 7% to 25 % due to the outward rod motion - reactor trips
at 25% power range low setpoint. This is a "reactor startup" nuclear instrument (NI)
trip. The NI "intermediate range" 20% power rod stop and 25% power reactor trip did
not actuate.
1047 Automatic safety injection (SI) on high steam flow coincident with low-low T_. All
ECCS pumps start, ECCS flow paths functional, main feedwater regulating valves close.
No "first-out" alarm was received for the SI. SI signal received on SSPS logic channel
"A" only.
1049 Operators enter BOP-Trip 1 procedure.
1053
Operators manually initiate main feedwater isolation.
1058 Operators manually initiate main steam isolation (only 2 of 4 main steam isolation valves
closed at the time of the auto-initiation of SI).
Operators manually trip main feed pumps.
1100 Licensee declared an Unusual Event, based on: "Manual or Auto ECCS actuation with
discharge to vessel"
1105 BOP exit-step 36 directs operators to reset SI; operator notices SI logic channel "B" was
already reset (indicated that "B" channel had not auto-initiated) and a flashing light on
the RP4 panel (indicated SI logic channel disagreement).
1118 Pressurizer PORVs (PR-1 and PR-2) subsequently periodically auto open on high
pressurizer pressure (indicated pressurizer was filling to solid condition).
A4-2
ATIACHMENT 4
SEQUENCE OF EVENTS
During recovery, steam generator atmospheric relief valves open several times to control
secondary temperature and pressure.
Number 11 and/or Number 13 steam generator safety valves open, causing RCS
cooldown (by this time T .... had increased to about 552 degrees F). This indicated that
the steam generator atmospheric relief valves were not properly controlling pressure.
1126 Second actual automatic safety injection - initiated by low pressurizer pressure (low
pressurizer pressure trip setpoint= > 1765 psig, allowable> =1755 psig).
Low
pressurizer pressure due to RCS cooldown (due to steam generator code safety valve
going open).
Second auto SI received on SSPS logic channel "B" only. Operators initiate a manual SI
just after auto SI, in response to the rapidly decreasing RCS pressure.
1141
While resetting the second SI, operator notices that RP4 panel lights indicate SI logic
channels in agreement (i.e., light no longer flashing).
Technical Specification Action Statement (TSAS) 3.0.3 entered due to two blocked auto
SI trains.
1149 Pressurizer relief tank (PRT) rupture disk ruptures (pressurizer was either solid or nearly
solid after the first auto-initiated SI at 1047, and the second auto-initiated SI resulted in
sufficient relief of RCS to the PRT to raise level and pressure until rupture disk blew).
1316 Alert declared. This was done to ensure proper technical staff was available. Licensee
staff recognized that TSAS 3.0.3 could not be met for inoperable SI logic channels. The
operators were also concerned about how to properly restore the pressurizer to normal
pressure and level control from solid RCS conditions and wanted sufficient engineering
support.
1336 The NRC entered the monitoring phase of the Normal Response Mode of the NRC
Incident Response Plan. NRC Region I activated and staffed their Incident Response
Center, with support provided by NRC headquarters personnel.
1410 The Technical Support Center was staffed to assist control room operators with recovery
of normal RCS pressure and level control.
1511
Operators restore pressurizer bubble.
1630 Pressurizer level restored to 50%, level control returned to auto. EOPs exited, IOP-6
A4-3
(Hot Standby to Cold Shutdown) procedure entered
1715 Plant cooldown initiated.
2020 Alert terminated.
April 8. 1994
0106 Mode 4 (Hot shutdown) entered.
1124 Mode 5 (Cold shutdown) entered.
A4-4
ATTACHMENT 4
SEQUENCE OF EVENTS
CETPS
cw
GL
NRC
PR ...
RV
SCM
SSPS
Augmented Inspection Team
core damage frequency
core exit thermocouple processing system
circulating water
departure from nucleate boiling ratio
Electric Power Research Institute
engineered safety features actuation
Final Safety Analysis Report
generic letter
Individual Plant Evaluation
loss of coolant accident
multi-plant action
Nuclear Regulatory Commission
NRC's Office of Nuclear Reactor Regulation
pressurizer relief tank
pressure operated relief valve
ATTACHMENT 5
LIST OF ACRONYMS
PRl, PR2 are pressurizer PORVs; PR3 - PR5 are pressurizer safety valves
reactor coolant pump
Reactor Vessel Level Indication System
reactor vessel
subcooling margin
safety evaluation report
safety injection actuation
safety injection system
solid state protection system
volume control tank
A5-1
NAME
TITLE
ATTACHMENT 6
EXIT :MEETING ATTENDEES
Nuclear Regulatory Commission (NRC)
Iqbal Ahmed
Stephen Barr
M. Wayne Hodges
John Kauffman
Warren Lyon
Larry Scholl
I. Scott Stewart
Robert Summers
Edward Wenzinger
Senior Electrical Engineer, NRR
AIT Assistant Team Leader, Division of Reactor Projects (DRP)
Director, Division of Reactor Safety (DRS)
Senior Reactor Systems Engineer, AEOD
Senior Reactor Systems Engineer, NRR
Reactor Engineer, DRS
Reactor Engineer, DRS
Reactor Engineer - Examiner, DRS
Chief, Projects Branch No. 2, DRP
Public Service Electric and Gas Company <PSE&G)
R. Dougherty
I. Hagan
S. LaBruna
S. Miltenberger
F. Thomas
Senior Vice President - Electrical
Vice President, Nuclear Operations & General Manager, Salem
Operations
Vice President, Nuclear Engineering
Vice President and Chief Nuclear Officer
Manager, Nuclear Licensing
A6-1
FIGURE 1
FIGURE2
FIGURE 3
FIGURE4
FIGURES
FIGURE 6
PORV Design Drawing
RCS Pressure Response
Salem and Hope Creek CW and SW Layout
Salem CW Drawing
Salem SW Drawing
Hope Creek SW Drawing
A7-1
ATTACHMENT 7
FIGURES
ATTACHMENT 7
~lljf,_ -rh
H .5U
H
t
-t-./
a .G2
- ..j
.
-
I 7 * 2~ : * IHi *
Figure 1. Pressure Operated Relief Valve
RCS Pressure (psig)
2,4.---------------------
2.3
2.2
2.1
"C
2
Cl)
~
1.9
.r::.
..!::
1.8
1.7
1.6
1.5 '----'-----'------'----L-------'----___J_-__J
11:30:16
12:20:16
13:10:16
14:00:16
14:50:16
15:40:16
Time
Figure 2. Reactor Coolant System Pressure
- ! -*
u~ i:.
Figure 3. Relative Location of Water Intake Structures
ATTACHMENT 7
HOPE
CREEK
'i *
c. e
§!
ATTACHMENT 7
'.~ g
- ~
- j
i
- .
11111111I1111"1111111111111IH1111111111111
jj
J
2!
.
.=a <
- - -
Figure 4. Salem CW Intake Structure and Equipment
~
~
(II
Cl:l i
Cl:l
~
'""'4
~
(1)
Cl:l I
MARINE DOCl\\-
BUMPERS
~ I ICE BARRIER
- Im
0.
~
1*
- a
- le
t> :
II)
~
STOP LOG 1r1
GUIDE
- 1
I ..
- ' ",
11\\
"
- r':, ..
~,;
~ 1 .. *'
- '
',':'
,*-~ '"
?~-:
FAN
'1'9"
I
\\
"'
"I
..
- ~*:::~1
,1!--E~'!,'-~~;~~~*.:~:!:,),~~:i:~,~:~;t~:::.; ~~~:; ~~b~!~~J:~::~*:-:~*.!~;:.;;::;:~~*.:*~'; .. *::,
j'~ ,,i .. ':,.I,,"' ... "' .. 1': i' ~,,, .. ,,, .. 11",'l\\1";, ... ~ ittt I:,\\* 1,1;,' ~1*~* 1 1\\ l.,'"'1: ,"I 1;,*,, ',' :1-1'.
- -~!','t.~ .. '! l';,~~.~ .. *;:"b;i,!~ ~ ... *.~~,*~ .*<~ 1\\.) t' ~I~ .. ~::: ... .,. ...
~I.:,:~~:* .. *:* *) .. *"S.*,",* I~!;; I I: ,I
,.!,,~ ; .. :; .. ,.~*, t{', ......... ~ ... ,, .. ~,"' .. ~'}!,f t:*~~ ""'~"' *~~*":1,'*"~***!**.: .. *'\\'~1.',' *'"' *'**'*
- ~~;~~~~~~~tY.~i~l~~~~:~*.!.~.*~*~~:,-:{~\\~}~~:;~,:{y),\\~!~;ifo:~~~:.);}
l~~~i~
I,'~,~~ .. ~
':.*i'!,'
~--~:~
- lb~ ... ~~*
- ~~-~ .. ~
(.~~:;
,,,, ..
..........
I
__..-
1"
'!:,!~'
~: ~ I:: .. !:~!\\ 'iJ(t:::' ,'f :1~','l j',~~~~
1
\\
- ~":~~*::~~:-: ;~,,*~*~*z,:~:*.:~~~.;~*,f ~~~~ ::t;t)~ ,~: ",j;~:: ! ; ,;_:;*~: .: ~~!*;"1"
i!:;'!7~.,'~3' ,: .. '1'1i1,~l:!f~~
,:r C
!~ :!: ';~~~~ .. ' !: ft .. 1::; ,'" j~,,~; '!:',::.",'~:1~
1
1; 1 .. :.~~,, :; !~ "!:~~:~~~ *.
~j~*,.~!~!j! ~:~-~:~~:: !':1::*;:,'11'..' :\\t! 1!, '~~ \\ 1
.. )
11~'*
1
- ,~ (!':i::! \\'~ ~: ::
PUMP SUCTION
SUPPORT BROTHERS
~
~
(".)
~
'I
TRASH RAKE _ _, .. 11
OOS-540
DEICING-
LINE
SLUICE GATE
RECIRC CONTROL DAMPER
EXHAUST FAN
, .
. ,, .
- 1
...... ,
~.J*:-...... .,,..,.-...
'.{l~:5l:~;;:~:~i:i[~!::;::;~:
- .:*:
- ~* ...
BIRD AND
INSECT
SCREEN
Robert C. Shinn, Jr.
Commissioner
StAte of New Jersey
Department of Environmental Protection and Energy
Div:ision of Environmantal Safd:y, Healt:h
and Analyt::ical Program$
- Radiation Protec:tion Programs
CN 415
'l'renb:m, N .J.. 08625--0415
Tel (609) 987-6389
Fax (609) 987-6390
May 20, 1994
Mr. James T. Wiggins, Acting Director
Division of Reactor Safety
U.S. Nuclear Regu1atory Commission
475 Allendale Road
Klng of Prussia, PA 19406
Dear Mr. Wiggins:
.. ENCLOSURE 2
Subject:
Salem Unit 1 Augmented Inspection Team
In accordance with the provisions of the July 1987 Memorandum
of Understanding between the Nuclear Regulatory Coznmission (NRC)
and the New Jersey Department of Environmental Protection and
Energy (DEPE), the DEPE is providing feedback regarding the April
7, 1994 Alert at Salem Unit 1 and the subsequent NRC Augmented
Inspection Tea~ (AIT).
As you know, the New Jersey DEPE's Bureau
of Nuclear Engineering (BNE) observed part of the perforntance of
the A.IT.
In keeping with the spirit of the agreement between the
DEPE and the NRC, the DEPE will not disclose its inspection
observations to the public until the NRC releases its final ArT
report.
This participation was especially valuab1e for our nuclear
engineering staff. It allowed us to gain immediate understanding
of the actual events and plant conditions leading to the Alert
declaration on April 7. This information has been shared with DEPE
management.. our representatives were impressed with the diligence
of the ArT *embers and their ability to expeditiously sift through
a complex series of events.
The AIT Team Leader was extremely
cooperative and open to our representatives*
questions and
concerns. All team members had inquisitive attitudes, allowing for
effective information gathering from PSE&G and analysis within the
team.
New jersey Is; An Cqu11I OpportunJry lmploycr
Recyded P~per
Page 2
We
are continuing to review all available information
concerning the Alert.
overall, the in!ormation we have seen is
consistent with our observations of the AIT.
The May 10, 1994
internal memorandum from Mr. Martin, NRC Regional Administrator, to
Mr.
Taylor,
NRC
Executive Director of Operations,
clearly
described the chain of events and the results *of the operator
interviews.
We have two specific . subjects we have not seen
addressed in the information made available to date and we have one
general concern ..
-*
First, the NRC and PSE&G have stated that spurious high steam
flow signals have been experienced before at Salem Units 1 and 2.
We understand that other Westinghouse units have experienced this
problem as well.
We are concerned that these past spurious signals
have not been shared within the industry or if it was shared, there
may be a
weakness in *psE&G's ability to evaluate industry
experience. It the AIT is not*assessing this matter, we recommend
follow-up through the inspection process.
Second, following the first safety injection on April * 7-,
operators.reported.that trouble alarms were received on all three
diesel-generators and an urgent trouble alarm was received on one
of the diesel-generators.
An SRO was dispatched to the .diese1-
qenerators.
He found all diesels operating properly and reset the
alarm which was attributed to low starting air pressura..
We
recognize this is unrelated to th.9 events that led to the
declaration of the Alert. However, it may indicate that a problem
exists with the diesel-generators that operators have learnad to
cope with. -certainly, :responding to an urgent trouble alarm in--an
emergency situation is a distraction that should be avoided ..
Third, our general concern involves an apparent inconsistency
in statements made by NRC senior management and the results of the
previous two SALP periods.
NRC has expressed concern with long-
standing cultural and equipment problems at Salem Units 1 and 2.
The results of the previous SALP reports are not consistent with
these observations. rn fact the latest SALP report indicates some
improvement.
We are concerned over the effectiveness of the SALP
process to reflect the true assessment of this utility's
performance. Perhaps we coUld discuss this issue at an appropriate
time.
If you have any questions, p1ease contact me at
(609) 987-2189.
c: Kent Tosch, Manager, DEPE
Dave Chawaga, SLO, NRC
Attachlnent: DEPE/NRC MOU
Anthon J. McMahon
Acting Assistant Di
Radiation Protection
DEPE
Page 3
,. /14 '87 15:11 NRC KING OF PRUSSI~-2
P02
UN*T*D aTAT~a
NUCLEA~ REQULATO~Y COMMISSION
ftEQION I
&3t f'A"K A\\flHU*
KING 0, .... USllA, 'i~NIYLV&)lfA tt4M
Ric;hard T. O*"-ling, Ph.O .* P.E.
Comm1ssfon*r
O*partaent of Env1ronmental
Protection
401 East State Street
CN 402
Trenton, New J*rsay 08625
Oear Commissioner Oewling:
Th1s letter is to confirm the g@neral agreement reached as the result of our
meetings with Or. Berkowitz and his $taff regardinQ the surveillance of the
nuclear power plants ~parating in New Jers~y. During those meetings we agreed
that there was a need ,to have .a more f<irma l way of coo rd i nat 1 ng NRC and State
ac:t1vities related to plant operations and that the Department of Environmenta*l
Protection's Bureau of Nuclear *Engfnaering (BNE) will be*th* 1nterfect with*-*the
HRC an a day*to*day bas 1.s.
The areas ~ddressed by th1s letter are:
l.
Stat* attendance at NRC m1e~1-ng1 with 11c*n5ees rel*tfve
to licensee perfonaanc*. inc:luding; enforcement conferences,**
plant fnspect1cns and licensing actions.
z.
NRC and BNE exchang*s of fnformat1on regarding plant con*
dit1ons or events that have the potential for or .are of
safety significance.
We agree that New Jersay officials may attend. as observers, NRC 1nforc~m*nt
conferences and NRC me*tfn~5 with 11c~nsees, including Systematic Assessment of
Licensee P*rformance (SALP) review*. with respect to nuclear power plant'
operating 1n New Jersey (PSE&G, GPUN).
We shall give timely notification to
the BNE of auch me1t1ng1, includtng the issues *xpected to be addressed.
Although I do not expect such ea*** to arise frequ*ntly, we m~st reserve the
right to c1ose any enforcement conference that deals with highly sensitiv*
safeguards mat*r1al or information thai 1s the subject of an ongoing ;nvest1-
gation by th* HRC Offfca of Investigation (OI), wher'fl the premature disclosure
of information could jeopardize ~ffect1ve regulat~ry action.
In such cases, we
would brief you or your staff after the enforcement conference and would
expect the State ta maintain the conf1dentia1ity of the briefing.
With regard to NRC inspections at nuclear power plants 1n New Jersey, we ~gree
that the SNE staff may accompany NRC 1nspectors to observ1 inspections.
To the
extent practfcable, HRC will advis* th* .StAte sufficiently in advance of our
inspections $UCh that Stat* 1nsp@ctors can mak* arrangefftilnts to attend.
In
order to assur@ that those ~nsp*ctions are effect1v~ and tneet our mutual need51
I suggest th@ following guidel1ne':
( ,L- 14 '87 15:11 NRC KING OF PRUSSifi-2
P03
.*
2
l.
The State of New Jersey w111 make arrangements with the
licensee to have New J1rs1y participants in NRC inspec-
tions trained and badg1d at each nuclear plant for
unescorted access in accordance with uti1ity reQuirem*nts.
z.
Th* State w111 qive NRC adlquat1 prior notification wnen
planning tc accompany NRC inspectors on inspections.
3.
Prior to the release of NRC inspection report,, the Stat1
w111 exercise discretion in disclosing to the puqlic its
observations during inspections.
When the conclusions or
observat1on5 mad* by the New Jarsay participants ~re sub-
$tant1ally diff*rent from those of th* HRC inspectors,
.New Jersey wil1 make their observations avaihble in
~riting to the NRC and the licensee.
It is understood
that these communications will become publicly avai1ab1e
along with the HRC 1nspect1on reports.
With regard to convnunications, we agree to the following:
l.
The NRC shall transmit technical *information to BNE relative
to plants \\ftithin New Jersey conr,;1rning operations, design,
external events*, etc.; for issues that e1thet" have the potential
for or are of safety significance,
2.
The NRC shall trans~it all Preliminary Notiffcations related
to nuclear plant operations for N*w J1rsey facilities to the
BNE routinely.
3.
The BNE shall co11111unicate to the NRC any concern or ~uest1on
regarding plant conditions or events, and any State information
about nuclear power plants.
Pleaa* let me know 1f ~hese agreements ara sati1factory to you.
Sincerely~
1v./.~
W1111am T. Russell
Regional Administrator
UNITED STATES
NUCLEAR REGULATORY COMMISSION
REGION I
475 ALLENDALE ROAD
KING OF PRUSSIA, PENNSYLVANIA 19406-1415
Docket No. 50-272
Mr. Anthony J. McMahon
Acting Assistant Director
Radiation Protection Element
State of New Jersey Department
JUN 2 4 1994
of Environmental Protection and Energy
CN 415
Trenton, N.J. 08625-0415
Dear Mr. McMahon:
ENCLOSURE 3
SUBJECT:
CORRESPONDENCE DATED MAY 20, 1994 REGARDING SALEM
UNIT 1 AUGMENTED INSPECTION TEAM
The purpose of this letter is to thank you for forwarding the assessment of the AIT activities that
were observed by your representatives and to address the concerns you raise in the subject letter.
We were pleased with the generally favorable remarks you made regarding the conduct of the
AIT.
Your letter provided three issues for our consideration, which you did not believe were being
addressed at the time of the AIT. You are correct in that the AIT did not address these issues.
Our plans are outlined below.
Your first issue addressed past industry experience related to spurious high steam flow signals
and raised a concern about PSE&G's ability to evaluate such industry experience. In reply, the
AIT did not assess this issue directly. Also, while the PSE&G independent investigation did
address operating experience feedback, no assessment of this specific issue was made.
Therefore, NRC will follow up on this issue during a future inspection and will ensure that the
findings are documented in an inspection report. More generally, the AIT finding regarding the
vulnerability of the high steam flow instruments is being reviewed by NRC management for
possible generic communications to the industry.
Your second issue addressed the trouble and urgent trouble alarms received on the emergency
diesel generator (EDG) following the first safety injection actuation on April 7, 1994, and raised
two concerns regarding: operators learning to cope with existing problems; and, distraction of
operators by nuisance alarms during emergency situations. In reply, the AIT did not specifically
review the causes of the EDG alarms. The alarms were investigated by the licensee and the
findings of that investigation were discussed with the NRC. The cause of the urgent trouble
alarm was a defective air receiver outlet low pressure switch, which was replaced. The cause(s)
of the other trouble alarms was not identified; but, additional future monitoring of these alarms
during EDG starts is planned. Future NRC inspections will evaluate the licensee efforts to
identify the specific cause(s) of the trouble alarms. Regarding your concern about operators
JUN 2 4 1994
Mr. Anthony J. McMahon
2
learning to cope with existing problems, the AIT does address this issue for different examples
of pre-existing equipment problems. This matter will be followed up as a result of the AIT
findings.
Regarding your other concern about the potential distraction of operators during
emergency conditions, NRC agrees that this should be avoided, if possible. Our view is that
all indicators, including alarms, should be assumed to be correct and appropriately responded
to. If the alarming condition is subsequently found to be defective, then appropriate corrective
actions should be taken. In this case, corrective actions have been taken for the urgent trouble
- alarm. If future testing identifies the cause(s) of the. other trouble alarms, we will ensure
appropriate corrective actions by the licensee are taken.
Your final issue addressed a perception involving an apparent inconsistency in statements made
by NRC senior management regarding "long-standing cultural and equipment problems at Salem
Units 1 and 2," and the results of the previous two SALPs.
The NRC reviews licensee
performance on a continual basis.
This is accomplished through SALP, through routine
assessments in support of NRC Senior Management Meetings and through inspections. The
SALP, by its nature is a very broad and performance-based assessment, but is focused on
performance observed during the SALP period. The conclusions drawn in the SALPs were
based on information gathered during their respective SALP periods. Recent NRC .findings,
including the AIT findings, and discussions by NRC management are factors.that are considered
in our current assessment. * These findings, as well as other information that NRC management
gathers through inspection and licensing activities and management reviews that occur
periodically, are all appropriately considered in the continual NRC assessment of performance.
We would expect to include the results of our current assessment in the next SALP report. We
understand how your review of the past SALP reports can lead to the perception you developed.
Although infrequent, it is not uncommon that we would also see differences between past SALP
assessments and current performance of licensees. Those differences have typically resulted
either from significant changes in the licensee's processes or organization, or from more defined
insights gained by us through our ongoing programs. In the case of Salem, I suggest both
circumstances were at work. If you would like to discuss this process further, we would be glad
to do so.
Both this letter and your letter, dated May 20, 1994, will be enclosed with the transmittal letter
forwarding the results of the AIT inspection to PSE&G. In accordance with the provision of
the MOU between NRC and the State of New Jersey, both these letters will be placed in the
Public Document Room.
Once again, thank you for your assessment and observations. If you have any questions, please
contact me at (610) 337-5080 or Mr. Edward Wenzinger at (610) 337-5225.
Sincerely,
r-
Mr. Anthony J. McMahon
cc:
Public Document Room (PDR)
Local Public Document Room (LPDR)
Nuclear Safety Information Center (NSIC)
NRC Resident Inspector
State of New Jersey
JUN 2 4 1994
3