ML19275A955
| ML19275A955 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 10/31/1979 |
| From: | Bland W PRESIDENT'S COMMISSION ON THE ACCIDENT AT THREE MILE |
| To: | |
| Shared Package | |
| ML19254E707 | List:
|
| References | |
| NUDOCS 7910300404 | |
| Download: ML19275A955 (22) | |
Text
.
TECHNICAL STAFF AN ALYSIS REPORT ON CLOSED EMERGENCY FEEDWATER VALVES TO PRESIDENT'S COMMISSION ON THE ACCIDENT AT THREE MILE ISLAND
@VANCE COPY NOT FOR PUBLIC RELEASE BEFORE AMs, 'n~EDNESDAY, CCTOBER 31, 1979 79 /0 3o0%d y.
1182 126
CLOSED EMERGENCY FEEDWATER VALVES BY WILLI AM M. BLAND TECHNICAL ASSESSMENT TASK FORCE OCTOBER 1979 WASHINGTON, D.C.
1182 127
This document is solely the work of the Cowaission staff and does not necessarily represent the views of the President's Commission or any member of the Commission.
This pre-publication copy is a final document and will be subject only to minor editorial changes in its published form.
09 1}g U c.
i
SUMMARY
On March 28, 1979, the Three Mile Island, Unit 2, nu: lear power plant experienced the most severe accident in the U.S. com:narcial nuclear power plant operating history.
The accident, which occurred at about 4:00 in the morning, was started by a loss of normal feedwater supply to the steam generators, which led rapidly through a no mal sequence of cvents for reactor shutdown.
During this normal sequence of events, the pilot-operated relief valve (PORV) opened and stuck (failed) in the open position in which it remained for a considerable length of time before being isolated by action of the operators.
Thic failure, followed by early operator action that throttled the flow from the HPI (high pressure injection) pumps, initiated an abnormal sequence of events that led to this most severe accident.
A number of analyses, involving studies, inspections, and tests, have been conducted to understand what caused this accident and why it happened.
One of these analyses was to investigate the reason for the emergency feedwater valves being in the closed position instead of the open position as required, as described in this report.
The findings and conclusions from this analysis are as follows.
FINDINGS 1.
There has been no positive identification of a reason for the valves being in the c!csed position.
2.
Of all the explanations analyzed, the most likely explanations, each with comments to the contrary, are:
a.
the valves were not reopened at the conclusion of the most recent surveillance procedure, requiring them to be closed, conducted prior to the accident; b.
the valves may have been mistakenly clcsec by control room operators during tne /ery first part of the accident; i182 129
c.
the valves may have been mistakenly closed from other control points within the plant; and d.
while considered a remote possibility, there is a chance that these valves were closed by an overt act.
3.
A number of deficiencies have been identifiec during this analysis to determine why the emergency feedwater valves were in the closed position.
These deficiencies are highlighted by tne following findings:
a.
Nuclear safety-related procedure change requests to close these valves during surveillance testing did not receive proper technical evaluation.
NRC failed to detect this violation of technical spe fications during inspections August 1978 through March 26, 1979.
b.
The as-run check-list of surveillance procedure involving emergency feedwater valves was not reviewed nor retained.
Verification of important procedural steps, as by c.
inspection, was not accomplished and recorded, nor was it required.
d.
There was no periodic systematic review of control room status.
Too many respondees were used during check list call-out, e.
f.
Too many people had access to potentially sensitive plant locations.
g.
Switches and valves do get mispositioned, possibly more frequently than formal records indicate.
h.
The TMi-2 emergency feedwater valves had a history of only a few problems.
i.
Two conditions that were not to drawings and specifi-cations were found in the emergency feedwater circuitry despite being under Quality Assurance Program control, as required by safety related classification of these valves; these conditions did not affect operation of the valves.
4.
There is physical evidence that at an unknown time an unexpected event or transient caused overheating in the emergency feedwater system.
It is likely that the cause of the observed condition occurred after the emergency feedwater valves were ocened by operator action and played no part in the reason why the valves were in the closed position.
5.
Tests and inspections, in place of a scphisticated Sneak Circuit Analysis, did not find a sneak circuit path that would operate the emergency feedwater valve::,.
1182 130
6.
Emergency feedwater valve position indicator circuitry has been confirmed to be in working order.
CONCLUSIONS 1.
The utility failed to apply appropriate centrol over safety-related procedure and its implementation and changes to it; NRC failed to detect lack of control.
2.
The utility does not apply appropriate discipline to access to in-plant areas, accomplishment of procedures, and equipment config u ration.
NRC did not recognize tF 3 lack of discipline.
INTRODUCTION On March 28,1979, Unit 2 of the nuclear power plant at Three Mile Island (TMI) near Middletown, Pa., experienced the most severe accident in the history of commerical nuclear power plant operations in the United States.
This accident has been and ccatinues t.o be the subject of much investigation in order to determine the primary cause behind the initiation and furtherance of tne accident.
A number of analyses, involving studies, inspections, and tests have been conducted to understand what caused this accident and why it happened.
One of these analyses, which investigates the reason for the emergency feedwater valves being in the closeri position instead of in the ocen position as required, is presented in Inis report.
The importance of these valves is indicated by their classifi-cation as safety-related and the fact that it is noted by procedure and in the technical specifications that they are to be in the ooen position during plant operation.
Being in the closed position at the beginning of the accident prevented the emergency feedwater from reaching the steam generators in the first minute after loss of the normal feedwater.
At a little over one minute (Ref.1), into the accident, the operators noted that the steam generators had "gone dry" which resulted in loss of the capability of heat transfer from the reactor coolant system to the secondary system (Ref. 8).
At about 8 minutes into the accident (Ref.1), the operators " positioned" these valves to the ooen position and quickly reestablished feedwater flow to the steam generators.
It is unlikely tnat the delay in establishing emergency feedwater flow directly affected the course of the accident; however, it dic have an intangible effect in that it did provice a significant cistraction to the control room operators who were already busy with emergency conditions.
ANALYSIS PLANS This report, which is really more in the nature of an investi-gative than an analysis recort, has been prepared to present the information that has been learned about why the emergency feeCwater valves were in the closed position at the time that the TMI-2 accicent began and not in the coen position as recuired by specification anc
^
o 1182 131
procedure.
The intent is to document the results of this investi-gation and related findings which will be useful in preventing a recurrence.
Much work in the area of the closed emergency feedwater valves, sometimes identified as EF-V-12A and EF-V-125, has already been accomplished and reported by others, notably References I and 2.
It is the intent not to redo this earlier work, but to make maximum use of it where it is in agreement with this analysis.
Detail's in this report will discuss where differences occur or where additional investi-gations were or are being conducted as part of this present analysis.
GENERAL DESCRIPTION OF FEEDWATER SYSTEM Details of the feedwater system, including the emergency feedwater system can be cbtained from the text and schematic in reference 3.
Some general information about this system from reference 3 is containec in the following paragraphs.
The Condensate and Feedwater System is designed to supply feedwater to the steam generators from the condensate proauced in the condenser during normal power operation.
System design is based on calculated heat balance and two parallel condensate and feedwater trains are provided.
The system is also designed to supply feedwater to the steam generators and to maintain an emergency high water level in the steam generators in the event of loss of both main feedwater supply trains.
There are also available two motor driven emergency steam generator feedpumps and one turbine driven emergency steam generator feedoump.
These pumps are fed from any of the following sources:
the condensate pump discharge, the condensate storage tanks, and either redundant branch of Nuclear Services River Water System.
The emergency feedwater valves, EF-V-12A and EF-V-12B, which are the subject of this analysis, are identified on the sketch of a part of the TMi-2 emergency feedwater system, shown in figure 1.
Other valves discussed in the analysis portion of this are identified on tnis sketch as appropr, ate.
AN A LYSIS Much work in the area of the closed emergency feedwater valves, identifiec as EF-V-12A and EFV-V-12B, has been accompiisned and recorted in referenced documents.
To make best use of this earlier work, material from Reference I will be quoted ir this reocrt and it will be noted where analyses are in agreement.
Where the present analyses nave differences and where different or accitional investi-gations were (or are being) conducted, the differences will be discussed.
In this way, the present state of knowledge can be gathered in one place and assessed more readily.
b 1182 132
A.
MATERI AL FROM REFERENCE I The following possible reasons for the emergency feedwater valves having been in the closed position at the time the TM.-2 accident began are noted below in small type as transferred from Reference 1.
1.
The valves were left closed after the last surveillance test of the emergency feedwater system.
2.
The valves were closed by the overt act of an individual.
3.
The valves were left closed after maintenance work on the system.
4 The valves malfunctioned as a result of an improper design change or plant modification.
5.
The valves malfunctioned because they were exposed to elevated temperatures prior to or during the accident.
6.
The valves were closed as an operator action prior to or during the transient.
Review of all these possible causes revealed no reason to believe that any of them was the specific cause of the closed valves.
The findings are summarized below.
1.
The operators and supervisors responsible for conducting the surveillance test on March 26, 1979, were interviewed.
The operator who actually manipulated the valves involved, stated that he specifically recalled opening that valve.
The investigation found no basis for rejecting his assertion.
If his assertion was incorrect and the valves were left closed after the test, the investigation found no information to explain how the closed valves would have gone unnoticed during the 42 hours4.861111e-4 days <br />0.0117 hours <br />6.944444e-5 weeks <br />1.5981e-5 months <br /> between the test and the accident.
- However, routine panel inspections are not required to the staff by this licensee.
2.
No information was developed during this investigation indicating that sabotage was a contributing factor to the initiation of the accident or to the subsequent response of plant personnel or equipment to the accident.
3.
The possibility of maintenance work being done an the valves was addressed.
No evidence was found of such maintenance after both record reviews and intersiews.
4.
The possibility that the valves were closed as the result of an improper response of the valve control circuits to the turbine trip was addressed.
A change was made in the logic circuitry related to the operation of the emergency feedwater valves.
The enange included defeating the automatic closure of the emergency valves EF-V-12A/3 with a low OSTG pressure signal.
This feature had been part of the protective circuitr>
7 1182 133
involved with the plant response to a steam break accident.
If the modification required by 9.1 had not been properly performed there would be a possibility of the valves closing.
Since the accident, the licensee has written and performed a test to determine if the closure demand feature had been removed from the EP-12VA/B valves.
The results indicate that the valves did not close when the feedwater iatching logic was introduced, indicating that the changes affect'
- EF-V12 A/B appear to be correct. SIo reove r, the pressure in the GTSGs during the first 8 minutes did not reach the initiation point for this control system, even if the change had not been properly completed.
5.
The possibility that the valves were e'
-ed, as a result of temperature problems as might occur from system backflow, was addressed.
Information was obtained that suggests at least one of the valves might have undergone a thermal transient.
This was based on observed ciscoloration of the valve piping.
The visual inspection by an investigator confirmed that a
plastic instruction tag on valve EF-VllB, the EFW control valve, was " melted." The investigation included a review of possible reverse flow paths to the B OTSG, a check of maintenance requests, and interviews with mechanical and electrical maintenance personnel and operations personnel.
Burns and Roe Drawing No. 2005, Flow Diagram Feedwater and Condensate, shows the possible flow paths frou B OTSG.
A backflow from inside containment would have to travel through reactor building penetration R-616B, check valve.
An alternative path could involve the same penetration, EF-V13B, EF-V12B, EF-V32B, and end at the backside of Er-V11B on to EF-V12B.
A third path could include the penetration R-616B, EF-V13B, EF-V32B, and back up to EF-VllB and/or througu EF-V32B.
The discoloration of the pipe appears to indicate hea*.ing along the pipe from penetration R-616B to the check valve EF-V13B through EF-V12B to EF-VllB, the raost direct route.
The possibility that oil staining might indicate an overheating of these valves was addressed.
The EF-V123 valve appears to have oil leakage from the limitorque operator motor which stained the valve body and piping.
No evidence of a Work Request for the EF-V12 valve just prior to. March 28, 1979, was found. Operations auxiliary operators who performed the IFW surveillance test that required them to be in the vicinity of the EF-V12B valve were interviewed regarding the valve oil leak.
Five stated they did not recall seeing an oil stain, while the sixth did not recall looking at that valve.
They did perform tha surveillance over a period from January 3, 1979, to. March 3, 1979.
Additional information presented to the investigator indicated that the valve EF-V123 did not have oil stain on ?! arch 26, 1979.
The investigator did note that the instruction tag on EF-VilB was deformed and showed signs of being burnt (brown) on the rear side where it is in contact with the valve housing.
The condition of the EF-V12A valve and piping was inspected and found sound with no similar condition. On ?! arch 28, 1979, both EF-V12A and EF-V12B were in a closed status.
1182 134
There was no evidence to cause the investigator to conclude that either 12-valve would be closed because of the condition of EF-V12B or the condition of the B emergency feedwater piping.
All information indicates that both valves opened, when actuated by the control room operator, on March 28, 1979, at about 0408 hrs.
This review did not conclude how the emergency feedwater pipe became discolored, how the oil leaked, nor how the tag deformed.
The purpose of this study was to determine if the condition could have been a reason for the EF-V12B valve to be in a closed position at 0400 hrs on March 28, 1979.
The findings do not indicate a relationship.
The possibility of a correlation to the status of the B OSTG emergency feedwater piping after its isolation during the accident was not pursued.
6.
The possibility that the valves were closed as an operator action during the transient was addressed.
The operating staff on duty during the period when the valves were found closed were interviewed to determine whether these valves could have been closed as an oparator action to prevent an excessive cooldown rate of the RCS and an attendant pressurizer level drop. The investigators pursued the possibility that the action was initially taken and then forgotten by the operator for 8 minutes.
No information was cP_ained during this interview that would indicate that this operator action took place during the accident.
B.
ANALYSES IN CONJUNCTION WITH THOSE OF REFERENCE I The results of the investigation conducted by the technical staff agrees to a large degree with the foregoing results of Reference i in the area of investigation to determine why the emergency feedwater valves were in the closed position when they were required to be in the ooen position.
A point-by-point comparison follows.
1.
The valves were left closed after the last surveillance test of the emergency feedwater system.
This analysis agrees with the analysis of Reference i, but adds that failure of the operators to retain the check-sheet used to mark their progress tnrough the accomplishment of Surveillance Precedure 2303-M27A/B on March 26, 1979, as noted in Reference
.1, and the description where two control room operators were resconding to the surveillance team in reportedly positioning the emergency feecwater valves by actuation of valve controls on ne Danel in the control room to the open position at the ccmpletion of the survesiance procedure on March 26, noted in Appendix B, leave doubt that the valves were opened as reported.
A qtcote Pom reference 5 reinforces the doubt relatec to this point.
The CRC assigned in Relief snift during surveillance testing 3/25/79 on EFW system stated that he remembers Auxiliary 9
1182 135
Operator reading off valves to be realigned at the ccmoletion of the test, but he does not remember whether he performed the operation to attain the EF-V-12 valves or whether the CRO on shift performs the coeration.
He stated tney were both standing at the board and botn responding alternately,
apparently, altnough he was not positive in the point. This confirms the report given by the Auxiiiary Operator.
During this review it was noted that the accomplishment of Surveillance Procedure 2303-M27A/B, revision 4 on March 26, 1979, was the last time the emergency feedwater valves had been operated before the March 28, 1979, accident.
If the feedwater valves had been left in the clrsed position then indicator lights on the panel would have so indicated that position.
This implies several shift changes occurred without notice of wrong position of valves.
Such an error would normally be picked up, at least, during a well disciplined shift change.
It was noted in Reference 6 that no inspector witnessed the accomplishment of this surveillance procedure, as is done for important procedure accomplishment in other high-risk activities, even though this system is classified as safety grade.
The responsibilities for such inspection coverage are left up to the Quality Assurance Cepartment by Procedure 1001, Three Mila Island Nuclear Station, Station Aaministration Procedure 1001, Document Control, Appendix M, as quoted from paragraph 2.4 as follows:
The Quality Assurance Department has the option to survey any and all procedures.
Tnose procedures chosen for QA surveillance will be indicated with the words, "QC Hold Points Indicated" or " Performance to be observed by Quality Control.
Notify QC at least four hours prior to starting task," on the cover sheet.
From interviews with the QC manager for TMI, it was learned that his staff is able only to survey (or inspect) an average of about one application of each surveillance procedure every 2 years (Appendix N).
Thus there is no real requirement to accomplish inspection of important procedures on a regular basis, i here is no NRC requirement for the inspection to be cerformed.
It also was noted that a Procedure Change Recuest, No. 2-78-707
( Appendix A), applicable to this procedure, had been initiatec on August 1,1979, had been approved on August 15, 1978, and had resultec in the issuance of the crocedure on August 30, 1978, as Revision 4.
The reason for the change request was given as:
New Pump reference valves established because valve line up is changec.
EF-V-12A/B are now closed because EF-Vil A/E was (sic) leaking by.
With EF-V12A/B closec, old flow rate cannot be duolicatec.
Thus the change in Inis surveillance procedure results in clanned closure of both emergency feedwater valves at the same time each time the precedure was aopiied (a similar cnange was made to a relatec procedure, but it is not considerec necessary to evaluate both in this analysis).
10 1, 1 0 9
- 1. T h
The Change Request ( Appendix A), classified as a nuclear safety-related change, was processed by procedure, but as noted in Reference 1, the safety evaluation failed to address the aspect of the change which called for simultaneous closing of both the emergency feedwater valves at the same time anc thus isolating the emergency feedwater pumps from the steam generators.
The closure of these valves appears to imoact the TMI-2 Technical Specification.
For this kind of impact, Met Ed should have processed the change through NRC before making the change to the procedure, thus Change Request Procedure AP 1001 was not followed.
This finding is noted in Reference I and in Reference 6, the post-accident review conducted by Met Ed/GPUS.
It also is noted that NRC did not detect this violation of the Technical Specification despite frequent inspection (l&E) visits to TMI-2, as evidenced by a summary of inspection reports ( Appendix C),
which indicates 15 inspection periods with indication of few noncom-pliances found between August 1978 and March 1979.
In aadition, it is noted in the report (Appendix D), that an I&E inspection was made at TMI-I and TMI-2 March 19-23 and Marcn 26, 1979.
Surveillance Procedure 2303-M27A/B was last accomplished before the accident on March 26, 1979.
Findings from this analysis are:
a.
A nuclear safety-related procedure Change Request did not receive proper technical evaluation.
b.
NRC failed to detect this violation of Test Specification during inspections August 1978 through March 26, 1979.
c.
As-run check list of important procedure are not reviewed and signed by appropriate levels of supervision and are not retained to support what was accomplished, d.
Verification of actual accomplishment of significant steps in important procedures was not accomplished and recorded by unbiased party (as by inspector), nor was it required.
e.
There was no periodic systematic review of control room equipment status to assure that it meets operational requirements.
f.
Too many operators were responding to check list call-out in final positioning of the emergency feecwater valves at the comoletion of Surveillance Procecure 2303-M27A/S on Maren 26, 1979.
2.
The valves were closed by the overt act of an individual.
This analysis closely agrees with the finding cf Reference I, particularly since it seems unlikely that a knowledgeable indivicual intending to cause camage would select tne relative insignificance of these valves as their target.
However, a person not very kncwiecgeacie may have mace a mistake.
Also, from information contained in tne analysis in Reference 1, nundreds of ceople nad access to these positicos from which the valves could have been centrolled.
Information supplied 1182 137
by Met Ed during this investigation ( Appendix H), indicates that as many as 728 people on March 26, 758 on March 27, and 81 during the first 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of March 28, had access to locations in the plant from which they could have controlled the position of these valves.
The fact that so many people had access to the three control points for tnese valves has made it necessary for a request to tne FBI to consider performing an investigation ( Appendix E) just to confirm that this is not a reason for the valves being in the closed position.
The FBI response ( Appendix E-1) was that they did not consider information and concerns expressed in Appendix E sufficient cause to initiate an investigation.
In addition to the analysis reported in Reference I and to the request of Appendix E, this tee.hnical effort also analyzed personnel records selected by Met Ed through the screening process noted in Appendix F.
Of the five records produced by Met Ed, one was related to a person verified by Met Ed as being absent from the TMi-2 site prior to and up to the time of the accident and another was related to a person identified by Met Ed as requiring an escort in that part of TMI-2 where the valve controls are located ( Appendix F-1).
No other investigation has been conducted nor is any planned of the remaining three records ( Appendix F-1).
While the results on hand are not conclusive, it appears that' there is only a remote possibility that the reason for the valves being in the closed position is because of an overt act.
Findings from this analysis are:
The policy and implementing procedures for controlling a.
access to various parts of the nuclear power generation plant permitted access of too many people to many poten-tially sensitive locations; b.
While considered a remote possibility, there is a chance tnat these valv,es were closed by an overt act.
3.
The valves were left closed after maintenance work on the system.
This analysis has no information contrary to that of Reference 1.
This is supported by a review of work requests; none was found related to the valves in the period March 25, 1979 thru Maren 28, 1979.
Only two work requests related to inese valves were found in the period November 1978 to August 1979.
One was completed July 10,1979 and ne other is still open.
It is concluded that no work was cone on these valves after the March 26, 1979, surveillance Procedure had oeen accomolisned.
From the results on nand it aopears unlikely that this is the reason for the valves being in the closed position.
4.
The valves malfunctioned as a result of an improper design, change or plant modification.
This analysis has no information contrary to tnat of Reference I at this time.
Sneak circuit inspection and tests concuctec on the 12 1182 138
circuits related to these valves (see Sn > a C.2) by request of this analysis team did not provide additional ormation.
From the results on hand it appears unlikely that this is tne reason for the valves being in the closec posit. ion.
5.
The valves malfunctioned because they were exposed to elevated temperatures prior to or during the accident.
This analysis has no information contrary to that of Reference I at this time.
An engineering evaluation of the reported visual evidence that an unexpected event or transient occurred in the emergency feedwater
- ystem related to EF-Vl2B is being accomplished.
The time of tne event or transient is unknown.
Evaluation results so far merely confirm that an overheating condition did occur, and speculate that the overheating may have come from backflow, after the EF-V-12A/S valves were opened.by operator action and at a time when there was a pressure difference between Steam Generator A and S ( Appendix K).
Investigation into possible paths of this flow is noted in Appendix L.
Status reports, Appendix P, further postulate that hot water from steam generator A backed into the B system lines, when steam generator A pressure was more than 50 psi higher than the pressure in steam generator B (after about l-hours into the event) and assuming a failed check valve in "B" line.
Tests correlate damage to paint with water temperature available.
From the results on hand and because the time span from accident initiation to the time these valves were discovered to be in the closed position, only 5 minutes (Reference I), is so short it is doubtful that a thermal transient from inside the steam circuitry could have had an adverse effect anc forced the valves to the closed position and because the valves ooened wnen commanded to do so indicates no significant damage of a thermal transient had occurred then.
It appears unlikely that the observd conditions of discoloration of pipe, stains on valve, and deformation of plastic tag attached to t; a valve will provide a reason for concluding the valves were in the closed position.
The findings from this analysis are:
a.
An unexpected event or occurrence or flow path caused the observed conditions of discoloration and stains on the pipe and valve in the emergency feedwater system and deformation of an attached plastic tag.
b.
It is likely that the cause of the observec concition occurred after the emergency feecwater valves were opened by the operators.
6.
The valves were closed as a result cf an operator action prior to or during the transient.
This analysis h ; no information contrary to tnat of Reference I at this time.
However, it does seem possible that sucn an ocerator action coulc have ta<en place in the excitment of tne very early stage of the accicent at one of the valve control points.
1182 139 u
From the results on hand, it appears that it is possible, though remotely so, that an operator action at one of the valve control points in the plant could have been the reason for the valves being in the closed position.
C.
ADDITION AL AN ALYSES 1.
Analysis of the documentatiJn formed during the inquiry accomplished at the request of GPUSC by John Miller, GPUSC executive consultant, into why the emergency feeowater valves were found in the closed position instead of in tne required ooen position.
2.
Analysis to determine if a sneak circuit had closed the emergency feedwater valves.
3.
Analysis of records search to determine how prevaient the problem is of having valves and switches found in wrong position.
4.
Analysis of results of tr inspection of position indicator switches and circuitry on the emergency feedwater valves.
The results of investigation and analysis of these areas follows:
1.
The documentation ( Appendix B) of tne inquiry into why the emergency feedwater valves were in the closed position was made by John Miller, GPUSC executive consultant, and E. O'Connor of Jersey Central Power & Light Company.
The inquiry was conducted in considerable detail with almost all logical questions asked.
The inquiry confirmed th&t the existing documentation indicates to a limited degree that the valves were thought to have been coened by t'.e operators at the completion of the surveillance test conducted on March 26, that no other tests invciving these valves were scheduled before the March 28 accicent and that it was unlikely that valves were commandec to the closed position from any of the three control positions in the plant.
Individual deoositions were taken from C'Connor and Miller.
O'Connor concluded he did not know how the valves reacned the closed position (Reference 5).
Miller stated during his deposition that he Deiieved the best possibility of an explanation is that the va!ves were not recoened following the surveillance test on March 26 anc believes that is the best that will ever be known on this subject (Reference 6).
Miller appeared vague during the deposition regarding toward whom he accressed cuestions during his incuiry; that is, he tended not to recall tne names of indivicuals he interviewed, as ne conducted his inquiry This, to scme extent, tencs tc raise a cuestion as to the vigor aoolied curing his search for tne reason :ne valves were in tne closed position.
11 1182 140
The investig&tJon conducted by Miller and O' Conn'or appears to have been fairly complete.
Only one person appears to have been missed by their interviews of the persons closest to these valves during the surveillance test--Cooper.
Cooper was reported to have been away from tne TMl site during the period of Miller's inquiry because of illness, However, Cooper later appeared before the Commission on May 20, 1979, with other persons who conducted these tests and testified that he did ocen these valves (at the conclusion of the surveillance test).
An analysis of this inquiry brought forth no new explanation, over part A.I of this analysis, and reinforces doubt that the valves were ooened as reported at the conclusion of the Surveillance Procedure involving the emergency feedwater valves completed on Maren 26, 1979.
The finding from this analysis is that there is a possibility that the emergency feedwater valves were not reopened following the March 26, 1979, surveillance test.
2.
Another investigative step has been initiated.
Th'at is, to search by inspection and test means (wherever possible) for a " sneak circuit" that could have electrically commanded these valves to the closed position by some unique combination of conditions, switch positions, equipment failure, or equipment operation that occurred in the early phase of the March 28 accident.
Results of a sophisticated sneak circuit analysis performed on a reactor that had been in service a number of years (Reference 7), has been forwardeo to GPUS Systems Engineering Organization.
This organization has initiated a more simple search for sneak circuit associated with these valves.
The search is to involve hands-on inspec+. ion of the involved circuitry coupled with simple elect-ical measurements in an effort to identify unexpected electrical paths.
Tests and inspections of the electrical circuitry relatea to the emergency feedwater valves in an effort to identify a sneak circuit condition that would cause these valves to be commanded to the closed position has been completed by GPUSC engineers.
They report, as documented in Appendix ! and Appendix 0,"there were no unexpectec circuits found, nothing fcund to indicate a sneak circuit condition that would explain why the EF-Vl2A/B valves were found in tne closed position.... "
It is emphasized that the test and inspection carried out is a physical check and, because of configuration and geometry limitations, may not provice the assurance that a sneak circuit did not exist as a scphisticated sneak circuit analysis (Reference 7) would do.
These tests anc inspections did uncover two Conditions in these circuits which were not done accorcing to crawings anc specifications cespite these circuits being under Q A Program control ( Appendix I); neither condition is suspectec cf causing the valves to be in the closed position.
1182 141"
3.
A search of available records has been made to determine the frequency with which valves and switches are found in other than exoected positions at TMI, and the history of problems with the emergency feedwater valves.
The TMI-2 nonconformance records, including the LERs, were searched and there was no record of either switch or valve being reported in the wrong position ( Appendix J).
The TMI-1 records were similarly searched, extending back to January 25, 1973.
The records showed seven instances ( Appendix J) where switch (es) and or valve (s) had been found in the wrong position.
This was about one reported instance per year.
In each case the report was based upon some incorrect function or a failure to function, it is therefore assumed that the failure was the reason for the report and not the wrong position.
Early informal interviews with TMI-2 personnel resulted in the explanation that occurrences of switches and valves found in the wrong position would be worked,out and fixed with the shift supervisor at once without a formal report unless a failure to function had been the reason for the detection.
All available nonconformance and deficiency records at TMl and the LER system were searched for reports of problems with emergency feedwater valves at TMI-2 ( Appendix G).
Only two reports, in the maintenance historical records, were written on these valves; neither can be related to these valves t;eing found in the closed position on March 28, 1979.
No reports were found in the LER system on emergency feedwater valves in B&W plants.
From this analysis the findings are:
a.
Switches and valves do get mispositioned; possibly more often than formal documents indicate.
b.
Emergency feedwater valves EF-V-12 have little history of problems.
4.
Sometimes switches can malfunction or get out of adjustment to provide misleading position indication, as noted in Reference 1, for the EF-Vil A/B valve switen and indicator-During the tests and inspections conducted for possible sneak circuit electrical paths, the valve position indicator switch and circuitry for each emergency feedwater valve, EF-Vl2A/S, were checked and confirmed to be in proper work;ng order, Appencix I and Appendix C.
The finding from this analysis is that emergency feedwater valve position indicator circuitry was confirmed to ' e in o
working orcer after the accident.
16 82 142
FINDINGS AND CONCLUSIONS Analyses conducted into determining the reason the emergency feedwater valves were in the closed posit on when needed early in the TMI-2 accident on March 28, 1979, instead of the ocen position, have resulted in these findings and conclusions.
FINDINGS 1.
There has been no positive identification of a reason for these valves to have been in the closed position.
2.
Of all the explanations analyzed, the most likely expla-nations, each with comments to the contrary, are:
a.
the valves were not reopened at the conclusion of the most recent surveillance procedure, requiring them to be closed, conducted prior to the accident; b.
the valves may have been mistakenly closed by control room operators during the very first part of the accident; c.
the valves may have been mistakenly closed from other control points within the plant; and d.
while it is considered a remote possibility, there is a chance l' at these valves were closed by an overt act.
3.
A number of deficiencies have been identified during this analysis to determine why the emergency feedwater valves were in the closed position.
These deficiencies are highlighted by the following findings:
A nuclear safety-related Procedure Change Request to a.
closc these valves during surveillance testing did not receive proper technical evaluation.
NRC failed to detect this violation of Technical Specification during inspections August 1978 through March 26, 1979.
b.
The as-run check list of surveillance procedure involving amergency feedwater valves was neither reviewed nor retained.
Verification of important procedural steos. as by c.
inspection, was not accomplished and reccroed; nor was it required.
d.
There was no periodic systematic review of control room status.
1182 143 17
e.
Too many respondees were used during cneck list call-out.
f.
Too r,any oeople had access to potentially sensitive plant locations.
g.
Switches and valves do get mispositioned, possibly more frequently than formal records indicate.
h.
The TMI-2 emergency feedwater valves had a history of only a fe.w problems.
i.
Two conditions that were not-to-drawings and specifi-cations were found in the emergency feedwater circuitry despite being under QA Program control as required cy safety-related classification of inese valves; these conditions did not affect operation of the valves.
4.
There is physical evidence at an unknown time that an unexpected event or transient caused overheating in the emergency feedwater system; it is likely that the cause of the observed condition occurred after the emergency feedwater valves were opened by operator action and played no part in the reason wny the valves were in the closed positicn.
5.
Tests and inspections, in place of a sophisticated Sneak Circuit Analysis, did not find a sneak circuit path that would operate the emergency feedwater valves.
6.
Emergency feedwater valve position indicator circuitry has been confirmed to be in working order.
CONCLUSIONS 1.
The utility failed to apply appropriate control over a safety-related procecure, its implementation, and changes to it; NRC failed to detect the lack of control.
2.
The utility does not apply appropriate discipline to access to in-plant areas, accomplishment of procedures, and equipment configu ration.
NRC did not recognize this lack of discipline.
1107 144
,3
REFERENCES 1.
NUR EG-0600, investigation into the March 28, 1979, Three Miie Island Accident, Office of inspection and Enforcement, NRC, August 1979 2.
NSAC-l " Analysis of Three Mile Island - Unit 2 Accident," Electric Power Research Institute, July 1979.
3.
Met Ed Final Safety Analysis Report, TMi-2 4.
Transcr ipt of Hearing of Operations (wro performed Surveillance Proc. dure 2303M27A/B on March 26, 1979) 5.
O'Connor deposition 6.
John Miller deposition Boeing Report D2-l18542-1, " Sneak Circuit Analysis, Nuclear s.
Reactor," July 31, 1979 8.
President's Commission on TMI Technical Staff Analysis Report,
" Sequence of Events Summary, Jasper L. Tew, September 1979 O
1182 145
APPENDICES
- A.
Met Ed, Procedure Change Request for Surveillance Drocedure 2303-M27A/B, August 10, 1978 B.
Shaw, Pittman, Pitts, and Trowbridge letter and enclosures containing results of J.C. Miller inquiry into reasons why EF-V-12A/B Valves were closed, June 19, 1979 C.
List of Inspections D.
Haverkemp inspection letter E.
President's Commission on the Accident at Three Mile island, letter to Federal Bureau of Investigation, August 7,1979 E-l Letter from FBI, August,1979 F.
Analysis of Personnel Records, W. M. Blanc and Maura Bluestone, September 10, 1979 F-1 Memorandum for Vincent Johnson "The 12 Valve investigation",
William Bland, October 10, 1979 G.
Memorandum, Discrepant Hardware Investigation, Art Carr, August 10, 1979 H.
Letter from Shaw, Pittman, Potts, and Trowbridge, " Met Ed supplied information on access to control points to cperate the emergency feedwater and valves EF-V-12A/B, June 28, 1979 1.
Memorandum for record, " Status Report on Sneak Circuit Test of EF-V-12A/B Valves, William Bland, August 20, 1979 J.
Memorandum for Record, "Results of Records Searcn for Reports of Valves and Switches Found in Wrong Position," A. Carr, Acgust 14, 1979 K.
Memorandum for record, " Status Repert on investigations on the Emergency Feedwater Valve 12A/12B," William Bland, August 17, 1979.
L.
Memorandum to Bill Bland, "Various Information on Emergency, Feedwater System," Beverly Washburn, August 21, 1979 M.
Station Administri.tive Procedures, Document Control, AP 1001, Rev 18, February 21, 1979 N.
Interview of Supervisor, QC, TMI, dated Juiy 6, 7, 1979 These documents are part of the Commission permanent records that will be available in the National Archives.
20 1182 146
O.
Analysis and Testing of Emergency Feedwater Isolation Valves E F-V-12A ; EF-V-12B, GPU Service Technical Data Report, T R -104, August 24, 1979 P.
Memorandum for record, " Status Report, Pipe Discoloration investigation, Emergency Feedwater System," September it,1979 1182 147
g h/ons : A u S a o.5 ~
- s I S/S *f R - Reo Po-s e gjg g A
G C4s m P.-ea A
E 6 '#O h 5F-v 19 R
R 2 F-V13 A gp_yng
@R 5e A
3 sc.S &
FF = VJ154 5 p. vtL 6 A0 5*
+
+
D
[
D i f = v'SA 2 F = VC S EF-Vff 5g yqg
$ f. jD ; of f f
- t*
- 2 II f e, t* _.,.
R g
k6a JTf l= ~
Em gris evey $icsv4 W2
~
V4 LVIAff 1182 148
.