ML19256A908

Comments on Task Action Plan A-17 Presented at 781025 Meeting of Plant Arrangements Subcommittee & Forwards Essays on Fail Safe & the Single Error

ML19256A908
Person / Time
Issue date:	11/07/1978
From:	Adler E Advisory Committee on Reactor Safeguards
To:	Bender M AFFILIATION NOT ASSIGNED
References
ACRS-CT-1069, NUDOCS 7901170029
Download: ML19256A908 (16)

Text

.

712 FLORtDA AVENUE hM /

k y

i<

CAM R10C,E,1ENNE55EE 37830 483-0994 jyov. 71978 THIS DOCUMENT CONTAINS POOR QUAUTY PAGES

'y, fl. Bendel, Chat /n7an Plan / nrrai,Ejei,,E>nis Jul>< orriinidee.

c.7.,g y G /25 rncela el /he Pion-l D/rangernen/s Al /hc y

3vhec..montlee, lhe rad nelian Plan. n-n wa.> cne cl the ilems eeviewed. Die ccmenenla ic fc //cw u.'ll he c /

ihlere>l oho le lhe flrws and we>/injha3e > ubc<2i:1ai;Hees The Tnsi Ac8vn Plan,17cui>icn 6, con /nihs lhe Lilcri.iiric,-

g",'*lt?:E's v's"ac Die p<ohicin /c beresoIved by /h)3 /o 3l<

liOV 131978 is /c e.S/oh//3h a 3E slemofi process /c 7

"*"'" P ""I l'*I"'ns Ic de}ennine lhei/

gppyps1n2s3s1s5$

I

_T.

i;njsocl cn various o]herplonl sys/ ems.

Revinen I cllhe Task ncfen Plan s eslales lhejxchlein:

Tlie probleni Ic he sesolved is lo iden/il9 wisere lhe presci,1 clesihii, onol >is as nl reviee:

y pecc ed,wes may acl on epln bh on con / lb/

polen/iallq adverse se,slem inferoclisn3 and le recornmend lhe regula-l cry ac/d n Ihal shet Id be laken lo rec lif deliciencies an /he precedures "

y l Big lhe Inn 7vage ol Rev. o,lhe TasI would be expec led le develcp procedures wherp h a large guonlil9 y

of interacidas woulol be oxposed by /he review prc cess.

7 9 01 17 0 02c)

• m/houqh -lhis is a. com,nendo/>!c o bjec/,vc. ;4 i> even mne importanl -lhol et bosis he e.slabli>hed Ic d;, pose oJ inderoclibns, holh real niid (wleirlidl, wh,ch o ve already known lo esirl. 77>c revised Inn 9 uoq e s eems de sa q lhol }he Insk wi/I deal oko u:,lh design jroclices rImh hore produced Jhese venI ond pudenlioI n 1evoclibnr, i

// is lherebe evavla wh;le la idenbl seine ev i >.lia, g 3

problein arens and lo innvive wholho. Jhe ln>L wi't ind er /

ollempi le e>/nid,Ah a basis fo<

ie.scle.dicn al ensling pic hlemL Som e deepee 01 sysicin i,derocliun i> u,,ovoielo ble, swsve<er

./ne impocl on sn fel will depend bc/I, en p,0 bob:l;/ el y

9 occuironte and Jhe resullincj de9 ree c l deepr adolion of

,,, ole </ibi1. 77h;s wns retogn:2ed eci !

/he ienc h/

m developrnenl proyinm and,volher 4han shug7 e w;//,

l proho b;l;lNr and conseyaences, desig,, p,oclic es were ndcy}rd Jo o void o de r o c -l ions. Tirese ton be sloled in 7e.>e<a is n

4/lcw3 :

a. Ptolceiicn ons ice rc / m..sl vel be pe,natied l

lo foiI l-ci lhe.same rens on.or a s l!> e res ull

. sing e t%f) failu, e, /nsl> umenh el a l

Jhe<eh<e mv>J nuJ be.shn<ed.

bi /n ej en eral, lh e evenl who e k disa hle s o r degrades predeclun mus) >,ol also ro us e prodecid>n k he needed,

-y

c. The nelibn o/ one proled Ve halu,e,audi,w real or spu,1cus, should d nroidable, no) en use analher proleclive <>clabn k he needed, These princQ)les were nol unNer.snll ndopled b y Jhe developmenJal rencfor programs, howe /e/ Jhe.se envl3 reo cIc<s included con-Inis nmen) {ealu<es which pi~ided ar)<hlibnn) dep}h od elefense. 3hould hc)h corrircl and proleelibn in1l,Jhe re.s ull woul,} be con lohterl, flo we<e/'

ns reocle,' ccre.s increased in aize, if becnnie ren lhed Jho) n. mollen cor e eauId nol be ceniained nnd Jhe delense dependeJ enJ&eI on Jhe prodecfisn sy.sJen,. D> a re.sv//

ol ATwS concerns, iniligndihg oolvres l

hn-e been propos e,I ~ h,2 h uiovl,1, on En1 lure k seroni, >rsJo<e Jhe l

unmyle Jhe wes/ing ous e defense in dep h,10s d

on h

sy enis walk n<lec,unJe y<ess vie reI,'e J ni,d he n>surome o ) frompt avn. feedunler' inilinl ion, wovid be a ble k klernde jse inosI sereve deansiend I. c., /os.s eJ Leedwnder, Jasi ns Jhis p,0blem seemed k be n) Jnc poin/

ol resolu-lion, luedinghouse proposed Jh e RESAfL 4/4 In-/cqinJed Prodeclion Syslein wherein Jhe inslvumen/s a nil loeg h Jo s conJrol, projeclibn. nnd ESF have been tiucwporaled inlc rn sing e St l f4 ore specd'c n ll Jhe l

ESF leolu<e, js enhFeedwole/ ).soJolibn

/ P,5 inclades /he Reaclo/ SI,v/down, and Avy FeedlunleV in*rlinl ion, 'T7)lS

inv?les on oderorl Ion which is polenlia/L mo<e sences ihar, lhe siinullaneous lallus e oI conIv,cI ani:/,><cleclici,.

T/1e concern wov/d be lhe spvnous in]lia/ ion of Feedwo/c, holalion,(an Anlicipaded 7~ ainici>l} Icqelhey i. Ih -lhe 3

o inllin le.Sc rorr> and Rex Feedwce/ef, /or lhir ina bil1I t

onannei - /he Ihvee levels a / deSense in deflh, icn/rc /,

reo c Ic v i h u-/rfc n i t, a nd A Tw s nii li} alib n w c, v i,] h e de(co led in a singIe even/,

t.I is,nle<eslinc de ccnsidov lhe si nilisanie cI 7

g ihis. Il had been prefcsed Iho) Independon), doers e 51,vidcwa syrien>s he applibd as defense ogaina}

-loilv> e le se rcnn, he wove / lhe req v;/cd i;idependom e ei divers e sy sdenn u.culd be di ((ic cll k c /> lain and k donicns/< ale. ns on ollerno/Ge ne A Tws milq alic n syrienn w c<c p<cpcsed u hiih, cansislin9 essenlinll5 o f added <cli e l < apor i /, wov/d be in heren IL\\

due<se and Jh e<c lsve in dependenl. Ne u, b 9 ne incyc<olibn al ecnl<cl, reo c for s ho ldc wn and ini li} a-ltc r, tirlc a 3n s 9 e s2,5 lein, to e o re A7w5

/

ba c k o l se, v n <e c n e,

-- m m

Aill:ove,h /here con be ne.' clo uhl a s Ic lhe

.30f OllSnc'55 o $

he conb erf dent e5 O f lht In i s)<e Of

}his syslern, we are enliVeltj Mlhool gvl dance as lo lhe ovohobilil alils c<c arrance. rhe sy.slem y

ine ludes niicre p,c <essovs and di}ilai sc/Jwa> c Ici u horh we lins e no experienc e reinpos a ble l< lhe one lho,d teirlu> q of expenem e with convenlanal liardwa te and lechni ues. We con, hcwevenfcsivlalc q

a mechonis n> k/ /ailvre suy,esled by exirlih y evj)erlent e, e~ herein 0,id 2 p, cc, o o m s wo uld, in errc f, he m>erled, hic the un d I in /eg <aled p, cle< /a n Syslein T/us reptesenis tx tutrenl prol>lem in nhiih

]h e lh vec In, ors a l r}e l ens e in dep /h ha ve been Intcepcroled lnle Ihe lirleyaled Ptclecltcn S,sdenJ. IAthen lhe defense in depth, which cusicino y;/

vesides 4, lndependen) di?evs e sy.slems,is tornhined inlo a sinyle sys)em,ii becomes diIlicvll Ic dernonsluale JhoI lhe cley]h c/ defense is mominined. Innsmuch as a hasr3 lc/ resolvlicn aJ Jhis problerr> is urc;enll3 needed,lhe queslibn could serve as a lesl prchlern k ornIvole Ine ellecliveness al Jhe p<cposed sp ern inlevoelik l

medhodolop,.

A//hou9h lhe enechannm for foiIva o/ Jhe iPS is uncertain, Jhere can be no dovhb ns la Jhe sererd of

-lhe consec,vences. Al lhe olher end ed Jhc.speclean, is a curren) problem cuhere'n Jhe probab;hl ond mechaniass Jos inlevoelion a re cueil es-loblished b Jhe conse7uomes rengnin u nc e flc>in. 7771 s he illus)yoled />

Jhc c>ven]5 ca r, et-l H B Rchin s on n ivl n l 2 s'on where$he is ofolion of loss oJ one d.c. hvs cau5 ed Sc.bsl0 nlio l equipnuwl don?oye a nd oi Jhe so,n e li;n e ca a > e d ce s e <a,n a nd cie<f ros;,izc,

oJ residvaI heoI removaI copa bihl y

• In boJh evends sys-lerns weic beinq -Ic., led a/

serviced. In one inslance lhe opvolor (nited 4

-lenninnle lhe Jes) and as et resoil Jhe ha Herez charge tuas exhausded; in Jhe olhes, Jhc oyevok/

4envir,a ded Jhe oferodion bv] opened Jhe wrong ci< cud breaker, lhevch, isoledig lhe d c bus,

/n bcdh even}s Jhe operolc/s we<e unoble Je o

errer) domacye. In onc case lhe ho llery was become coinplelel dischovged because o) allowed lo y

ina hilll9o >>deepie J wovoin9 sywplo,ns.

Ihe operolov's t

In lhe olher, Jhe annunckolo/ wh,th wov/d idenhly ine 1,ov6te, dcpended on d.c. fo/ 14s aperoJd>n,

/n Lo}h case.s./he reoclo/ scremined a//hcocjh a

nol F.y esicgn in-lem. In one inse rl was lhe d

I fail-safe chavoc-levis!!c of lhe scrom beer >kers; in lhe olhe>, lhe underfre7venc rela cj s, u.hich

&< pend on d.c., caused Jhe main ci<culofhg pumf5 lc lr p-The loss o/ d.c. on wnieh many 05 lhe plan l$

sejs} ems depend, h3 ca usme;.scrom, in loin ca.us ed }hese.sys}en1s lo be needed for rcsidual hcol remoml-

/n holh even}s cohen Jhe reoc!c/ scromened, a

one o((silc n.c. sc>oyce evo.s losl, a nd because el Jhc ina b;hl) lo operade esaud breakers wi4hovl d.c., one diesel c7enera ld in ea ch cas e become voava's la ble.

s Becau.se of kobr/il Jo opevole ciavil breakers, y

equ:pmenl doma7 e resulled. In one cose -lhe )vibine bearings were losi beca use al ina b>I;I lo disconneci II,c inoperable d.c. driven o,I pump, and resJove Jhe o.c. pump. In lhe 0-lher case Jhe d;eseI enero 4/

y c n.s unde / les) and in operalion o f Jhe J,hu, Because u

of inabilil lo dOconnec) Jhe generab>g if y

a tiemp-led k drive lhe main 9enevolv os

~

j maley and was des /vce,ed in Jhe enIlemp/,

=

e h1 bo-lh ca3e5 coYfecitve n)eusures have been opphhi le prevend repel >%n of clomage lo e9uymca!. In ho/h eo.ses Jhe feaIvres which caused lhe uninlended and uneipec/ed scrom remain uncorrecled. /1ddi/ibnal equiprnend laf re,sidual head removal vernained operable }hus 1.,eelinij Jhe. single failure requiremen), so lhol no basis exisls /cv reyvivinej remedial measurrs lnlhese evends lhe consequences of a sinyle human error have been magn >/ihl bc, lhe mierachins. N is I;kel lhad if all of /he pcs.sible mieraclicn.s were Anown, suth en when c-lher syslems are vnde/ /esi adJhe.same

}uhe,of when add.;lional operndoy erra/s are tammiflec],

il mighl become apparen) lhn-l applicadicn a / /he single laiIvre crilericn ivov/d he inode9e a/e and,walhcul fol<mg nic occccel lhese inferncliens, prebob;lis/d.

i as.ses.smen}s would be in<ohi).

// eve again il would be v.seful Jo le.s/Jhe performonie ellhe inferoclkn melhedcloy yattempha b

lo idenlil allponih;Illies ahe<e / css 0-1 a.d.c. bus y

tuov/d ca use c2 scrom, and also lo idenlif allpossibil. lies y

wh ere lo ss 0-f d. c. wo uId deg m de reside a I h en d remoraI capo hili lq. Inn.smuch a 5 man polenlioI inderacl ions nre well hidden, Jhis could to the proposed melhadolo79

one example of a ha dden mechani sm /c/

inferocli n is Jhe inlerlock., discovered a l C sle/

y C<eek n fler.severnI tjenvs of operadion, whnh had ils condocls on Ihe marable forlibn aJ n. cirevil b <en li er/ and which p<etp:vled ope.roJIon of /hc redundo n l Iroin rhen lhe circv,l breake/ was ra cL eJ c J cf as'<l> bn. The inle</cc h wa s inJended f

y o preven) operolibn of bodh J<ains a J Jhe. rome l

onl Ja;ne, b s J w,J h Jhe h <e n k et roched cul, bcJk Irnius becarne in oporc> hie-Si}n;In ti Jhe Brcwns Fe<<

pcial lig hd circuils, cn loilu<e, ca used Jh e c&cv;l hveahors 10 he mainlained in -lhe irqyed tendilibn.

The cinu;I arrongemen/ wa3 'in/ ended only ks a a s we

}he abiliI h J <r,, o n demand. /i, bell, sinlantes

-lhe inferoclidn> resulled l<om well hidden and unwspec-led measures in/ ended k peclecl e<juijunend, and were discovered only when porkemonce wo 5 d emo nd er) u n d e t un vs v o l c irc urru /o n c es,

In summary. ll is proposed ihn ihe idenhficalibn of oddilibnol inderoclions wovid be uselvl, Jhn) Jhe idendifnoli6n of Judden and vns v. spec-ler/ mech anisms,incIvdiiny in f erocli6ns w)lh lhe operado/, wov/d be even n>cre vJe/vl.

flowere/,111 consIderali6n 0l Jhe inlerocli6ns

alread kno un lo extil, of Jhe sladed objeclubes c5 Jhis Task Acli :n Plon, lhe morl impor/and wculd "lo recournend -lhe recjuinlory ac-lidn lhal should be be da ken 40 recbl deliciencies in }he procedures'l Atloclied ave essays on Fai/ Sn [e a nd Jhe Sin cj /e Ewc/'. whic h ma y h e el scow v.s e in w,4h J h e Inde,ro chbn Prog rn en.

cenn e e le bn b h.hft

Much aHen-licn ha.s been given k lhe single failure. On}kallq lhe single failure represen/ed no more ihan a recjuivenvend kr rech ndona of compo n e n Is, n c / o c riler/cri, a nd app In a l> le p; lo ecli<e cornponen/s and Jheir in/erccnnechins.

Han panive ccn,ponends ivere en/vnled /vom Jhe re<juwemen/ Jc/ redundanec; as wcn "Ihe boticm of

} h e plle. (The bot lcm of Jhe j,;/e had Ic he N.,(a/kl>le or, w hen.s c rammed, Jhe rods wo uld o Il fo l) cvI. 7o~ da inis applies k /he iniec,ril aJ Jhe presswe vessel y

whia mus4 nel k,l). 7he sing /e failu<e crifenon ha> been eletaled from a 3 mpic regv;/emeni k/

~

redundant e, Ic bc/h a minsn u en a nd c2 mn vanv<n recjuiremen/ lc( nny sijs-lem Mlhcui regned k p<chn h:lllies c/ freguency of challenge

/l is ivo</hwhile Jhal we

/c ok, fo < a c ha r,.

n) Jhe Single Error, The fot/cwing ing/c EvavN J

ravsed fuel dama9e or mellihe; in earl renc/ovs.

y RECEIVCD ADVISORY COMM17EE ON NITX Fo ull tornmu nic a liin

't =

"s " " * '

x-p:Je Terling NOV 131978 g,ggiugiiici4[_

E SR -/

7es$ncf

@,i l2 WTR Worsened by operakt error N

JL1 Pe<versi15 SJ Lovvonj Pe<versil Operaled w<one; rolee desi}n inadey va c.,

Bonvs

In lodoys planh we have had no co<e mell event buI have seen 4he consegvences of a single human errof rnognified cul of propor/idet b., sys/em respons es and isrlero clibru. Jome exaingles :

H.13. Robins on d u < b h e h e o n r*> g > les Ide. bas-les-l1ri<g, do*e3 e 1 en eta lo/ Jc3 /

el t has - leslul)

Z on i

7 21b a ressvI loveI projecllors y3)em [es dn' dangefovsj j

s y

otvered 6 r oa. au Fe,r 3 Su'y e leadii, c Te.5/id is necessc and a reg ulalcv ve7viveineid q

bul con i).self be hnzordcus, A gren/ money erron have been commilled who'le ronducling esls and Jhe l

possibiltlies are lijn;//es.s. Many are Inken dhe ic/m h

of ope verl ion.s on lhe w<ong componen/ c/ Jrain, or mote recen}/3 on Jhe wroay 9enero/ihg unll, and hn Vc 3c fo (, b een reladiVehy harmless. Don'nq feslinc; hoeverer lhe plan l or indirklual sysdems mo9 he in cz cj e c s s l ty oll-Florrnn / con /tq' u/crlibr1 such }hal a sing /c erro/ rnn Jny7er ex ca3 e ade o/ unaniic q>oled evenis, very I,kely leanin,c Jo oddilibno/ human i

error.s as a resuN of confusion onni confliclih or g

mTsleadin c, sloJus in Covinodion-The Zion Inferoclion Sludy lis'is a surprisihy eleven overpreSSuri2.odion evenis which occurred wilh lhe reacicv

opern-licn3 bei conducled, pr ohn bl5 wilhou) proper coordin alion, or'perhaps wi/hovl undersfondh Jhe possibilil o-lh/erarlibn, The 2icn slud hcwever, failed y

10 cn/l allenlion lo liie significance of man inferoclidns.

Of Ihe etenl3 descvibed in ihe Woy'3 /978 /e//ef Jc m Bencies, 9 lhe Brc.uns Fe<<y iVe a nd Ihe 2ihn die 3<>l en era Iw l

on1 7

five we<e noled, and on/5 lhe laHer }n any delail, The 2 ion dumm9 eod prodecliori syslem Jesling erend wo 5 I

nc/

noled. in ihol even/ lhe cpetalng. slo H wa s una wa <e el i

lhe.sericusr7ess cf /hc Silva licn ollhcoq h /he s,s /ein was {n ayrenJ disorde/ kran ex/ ended perad, This is semeu hoJ s ;mila,' lo lhe Sa n Cnclye p.'le1 Iqh i even], n hie h e> Iso wa s nel recc9niz ed />y lhe 2dn 3/vdq

// would be wo<lkhile,a-l lens) o.s on exercise lo examn1e a few possibililies wherein,w,lh vonbv.s sysienn undergoinc les) of mninlenante, a Jih9 e Error", pcssibI

/

aetcmy anied bs, o n erle/noI eyen], to vfol prodvre uno rc ep In iIt resu)Js (Al@ad nlies Iheplanlvas opernledIor almosk hav..s iv,)h cne ha de/

discha rg ed a Ilowing a mple 1im e L on independon) pren)) This exereise mqhl be tondv<Jeol n.s n. pa r) cl Jh e.5.slem.s indevoelion /hogro en.,

y

//15 9 vile pas.slhle JhoJ human error du/>nq

/esluig is a dominand loilure nicchnnism in need of n flelJion,

Es.sny on Fa)l3afe.

The value of fail. sale desiyn has been much over valed. There ore /dnes tuhen on indrusion caused by a failsole ocluo/kn, vert, ofien spuricus and unwonler), can he unhande. M olher -limes il con he downvs,hl don 9erma, 77he nst?E ecre clum,o is an cyamp/c'. A failJo/c.syvnhv3 dumpincj o[lhe enlWe mollen core In/o lhe dump dank could be unj))lensand and exj)ensive, Under' son 7e main enonce rondilions ll could he danc,ero us I

/elhaI, The 2icn irrleroclicn 3Jud illusdrale.s y

4his verty well. The sludy lisis eleven overpressurnalton even15 which occurred w;Ih the renelc/ ccid and tualer.sclic], // is to}/7er sur,oris&,c;. hvJ ;4 aeems

-lhaI no prodeclkn ogoinsJ -lhi> was provided. Of Jhe eleven cven}s, len occwred on weslinghouse renelots ona) one on cx C E uni l-In add', lion lo lhe lack of prodecl ion, lhe lotlowing also con 4ribuleri-gs[.{?tm",,,

c. The sys4 ems durin9 wader schY operaldn

.seemed Jo in v;le human error, whic h H0V i 31978 env. sed,5efen of Ihe eleven oven).s n.

o p ai v isi e o

.T

b. No lhouc,h/ was yiren lo foiIsole aclvadion,

l. In one event, loss af elecIvic suppIy caused condecI valves lo close.

2. Joss o( ins]<urnenl air covsed vaIves lo elose in Iwo evenis

3. Safel Nijec/ ion was in;lhded, verej I,kek ns a resul} of foi! sale g

ciclu o-lion.

corr /vollers and volves con lail open, closed or in place. A foifure in one aspeci con be advan]ngeous in one mode oJ opero-li6n or harmful in ano/ hen 7~his is egually rue for J

proleclion ssjslems where bodh ins /rurnen/s and aclua-lors ove usuall deshned lo fillsole, 5

retfordless of 4he conseguences oJ. spun'ov.s aclualin, N oppears ihn) Jhese mailers were given no considero-l5n in re7oed Jc woder.so14) ope /olion.

jJ would JhereJere seem tuov/hwhile lo einmine

-lh e ln1po c-l, a n d /h e va lue, o / fo } l a n /c design plan / tvide hash,which could be done n3 o rt ct a poei o/ Jhe Indevoc/fon Progtom.

cvemv vvnne vferatinc in 4h e (oId wale /-soIfol (o nr)Nto n.

Vondo/

AE

/.

%L ue4c Le ldow<t volves </cscd 1.oss a f In>lvumenI oit.

RHR syslem holaled To re,oan'y 2 bl 34L reliel

valve, nHn sysJem ;scloled valve, c v va Ive.y 3 w uE+c inodyevJonll., dex Sole]y njecleon In14 taler)

???

\\

i 4 st S4tu

.5 m oedIc }

Leda,c, clown Jh<v dwo Opera Ic/ lo ded pollus, one pnih closed, is holo nc e cIsa <p and lehdo w n,

Coolan) porny. slo rleol, Opera Ic r error.

6 s1 FPI 1

Cold wn lev' effonnles) in S(r 7 _C_5 Beci,lel it s abo <e

/).s abo <e 6w vE4e As o l>c /e as oho <e 9

kL FPI Leidown unlee clos ed Ins }rv<n en ]

4es lih q.

t 0.w.

GetIdel ConIro } valee clos ed o a areaLey 4,j,peol lo.ss of powev' II y ue4c chave,i;u; ralve opened o~t ios.s eI iniI ori.

Leldown

<a lve closes) e y

....