ML20035C319

Engineering Evaluation Rept AEOD/E93-02 Evaluation of Loss- of-Offsite-Power Due to Plant-Centered Events

ML20035C319
Person / Time
Issue date:	03/31/1993
From:	Mazumdar S NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
Shared Package
ML20035C303	List: ML20035C302 ML20035C319
References
TASK-AE, TASK-E93-02, TASK-E93-2 AEOD-E93-02, AEOD-E93-2, NUDOCS 9304070049
Download: ML20035C319 (45)

Text

'

t-.; ;

, - !c.

. AEODIE93-02.

L ENGINEERING EVALUATION REPORT EVALUATION OF LOSS-OF-OFFSITE POWER DUE TO PLANT-CENTERED EVENTS MARCH 1993 Prepared by: Subinoy Mazumdar, Ph.D.

Office for Analysis and Evaluation of Operational Data U.S. Nuclear Regulatory. Commission-9304070049 930330 PDR NUREG 1032 C-PDR

Q.

CONTENTS t

ABBREVIATIONS v

ABBREVIATIONS USED IN TABLES vi 1.

SUMA1ARY,

I 2.

LNTRODUCTION....

'l 3.

DISCUSSION

............ 2 3.l~ Identification of Events...

2 3.2 Event Trends....

....... 3 3.3 Event Duration.......

3 3.4 Total LOOP Event

............... 5 3.5 Events Under Power Operation 5-3.6 Events Under Shutdown Condition.......

7 3.7 Event Causes 8

3.7.1 Events Caused by Personnel Errors................

8 3.7.2 Events Caused by Equipment Malfunction or Failure 10-3.7.3 Events Caused by Design Deficiencies....

10 3.7.4 Events Caused by Inadequate Maintenance Practices...........

10 -

3.8 Failures of Multiple Safety-Related Equipment During LOOP Events I1 3.9 LOOP Event Risk Significance....

11 4.

FINDINGS..

12L 5.

CONCLUSIONS........

13 6.

REFERENCES........................

13

o.

c..

TABLES.

Table L Total Loss-of-Offsite Power Caused by Plant-Centered Events-Under Power Operation

=15 Table 2. Partial Loss-of-Offsite Power Caused by Plant-Centered Events Under Power Operation

'O

/,

Table 3. Total Loss-of-Offsite Power Caused by Plant-Centered fx[nts

./.

28

~ Under Plant Shutdown' Operation

/

Table 4. Partial Loss-of-Offsite Power Caused by Plant-C' entered Events Under Plant Shutdown Operation 31 Table 5. Duration of Loss-of-Offsite Power..,'......

39

.i Table 6. Analysis of LER Event Causes.'.

40 r

Table 7. Plant Centered LOOP Eveat Significance

.40 e

iV

ABBREVIATIONS ac alternating current ASP Accident Sequence Precursor CCDP conditional core. damage probability de direct current EDG emergency diesel generator HPCI high-pressure coolant injection llT Incident Investigation Team -

LOOP loss-of-offsite power NSST normal station service transformer RCP reactor coolant pump RFP reactor feed pump RSST reserve station service transformer SAT startup auxiliary transformer SCSS Sequence Coding and Search System SST station startup transformer SUT startup transformer v

ABBREVIATIONS USED IN TABLES AFW-auxiliary feedwater.

3 ASW auxiliary salt water 1

BFM breaker failure module

[

f CAC containment atmosphere control CREFS control room essential filtration system CREV control room essential ventilation CT current transformer DD design deficiency ECCS emergency core cooling system EF equipment failure EFP emergency feedwater pump ESF engineered safety feature FBEVS fuel building essential ventilation system h.

hour HPCS high-pressure core spray I

inadvertent LPCI low-pressure coolant injection m.

minute MFRV main feedwater regulating valve MG motor generator MOV motor-operated valve i

MSIV main steam isolation valve MSSV main steam safety valve MT maintenance NSSSS nuclear steam supply shutoff system P

procedure PE personnel error PORV power-operated relief valve PT potential transformer vi

.x, ;

l 1

ABBREVIATIONS USED IN. TABLES (cont )-.

~~

RAT reserve auxiliary transformer RCIC reactor core isolation cooling ~

g.

RHR residual heat removal RPS reactor protection system s.

seconds SBGT' standby gas treatment SI safety injection SP set point SRV safety relief valve ST standby transformer.

SWP service. water pump TBV turbine bypass valve UAT unit auxiliary transformer USST unit station service transformer k

s vii

n I

1.

SUMMARY

This report documents AEOD's investigation of loss-of-offsite power (LOOP) events at L United States nuclear plants. The study addresses LOOP events at medium' voltage (between 2 kV and 15 kV) Class IE buses caused by malfunction or failure of equipment or systems inside the plant, henceforward called plant-centered LOOP events.

A data search identified 86 plant-centered total'or partial LOOP events between 1985 and 1989. Many of these events involved multiple equipment-malfunctions or failures,.especially during power operation. Analysis of these 86 LOOP events indicates the events co' ld be' u

grouped in four cause categories with 48 percent of these events related to personnel errors, 28 percent related'to equipment malfunctions or failures,14 percent related to design deficiencies, and the remaining 10 percent related to inadequate maintenance practices.

Analysis of the events caused by personnel errors indicates that most of these events could have been avoided by better personnel awareness. This study indicates that between 1985_-

and 1989, there were 26 plant-centered' total LOOP events with a median LOOP duration-time of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 8 minutes (Tables 1 and 3) as compared to previously reported 18 minute median restoration times. The duration of the LOOP could have been reduced by preplanning for' quick restoration of offsite power especially during shutdown operations.

Several plant-centered LOOP events identified in the study had been evaluated in~'the Accident Sequence Precursor (ASP) program. The conditional core' damage probabilities (CCDPs) were in the E-4 range indicating the plant-centered LOOP events are considered risk significant and precursors to accidents.

2.

INTRODUCTION The importance of reliable offsite power supplies for safe operation'of nuclear plarts is well -

known to the industry. The minimum requirements for offsite power are specified in 10 CFR 50, Appendix A-(Reference 1) while plant technical specification _s (TS) cover permissible plant operating conditions. The guidance for staff review of,offsite power is contained in Section 8.2 of the standard review plan (Reference 2).- Tables 1 through 4 contain information about the 86 specific plant-centered LOOP events. Table I lists 15 events where a total LOOP occurred with the nuclear plant at power. The 26 events listed in Table 2 were partial LOOPS that occurred when the plants were at power. _ Table 3 presents 11 events of total LOOPS that occurred during plant shutdown, and Table 4 lists 34 events where a partial LOOP occurred during plant shutdown. Each table lists in Column 2 the plant name, docket number /LER number, and the event duration. The remaining columns provide a description of the event, the cause, failed equipment, corrective actions and the event significance.

i i

Several reports have been published on LOOP events at nuclear plants. Many of these l

reports are identified in References 3 through 8. Reference 3 documents total and partial' LOOP events that occurred through the end of 1983 categorizing the LOOP events a's plant-centered or grid-centered. Grid-centered events are the events caused by malfunctions or j

failures of equipment or systems outside the plant. Reference 3 also indicates that about 70

]

., =

d 1

. percent of all LOOP events were caused by plant-centered events. Based on causes of the LOOP events, Reference 3 further categorizes the causes of the LOOP events into_ weather.

related, human error, design error, and hardware failure. However, Reference 3 did not'

)

analyze the LOOP events from the point of view of event duration, event cause, failed l

equipment, corrective action, and safety significance.

Reference 4 reports on the risk of core damage from external events such as nearby industrial or military facility accidents, onsite hazardous material storage accidents, severe-temperature transients, severe weather storms, lightning strikes, external fires, extraterrestrial activity, volcanic activity, earth movement, and abrasive windstorms.. Reference 5 tabulates recovery time of offsite power from LOOP events into plant-centered, grid-centered, and weather-related categories. Reference 6 tabulates the LOOP events between.1975 and 1989.

classifying them into five categories based upon duration and availability of power sources.

Reference 7 provides an assessment of the major contributor to the frequency of station blackout and the probability of subsequent core damage. Reference 7 reported that between -

1968 and 1985 there were 46 plant-centered total LOOP events with a median restoration time of 18 minutes. These studies focused on estimating the frequency of events and l

associated risk.. However, these studies did not analyze the LOOP events from the point of-view of event duration, event cause, failed equipment, corrective action, and safety -

significance which have been included in this report.

An NRC Incident Investigation Team (IIT) report (Reference 8) on failure of all ac power to safety-related loads at Vogtle Unit 1 on March 20, 1990, and the finding in Reference 3 that about 70 percent of all LOOP events are caused by plant-centered events provided the

{

impetus for this engineering study on LOOP events caused by plant-centered problems.

This study covers only plant-centered LOOP events involving total or partial loss of power at medium-voltage (between 2 kV and 15 kV) Class IE buses; it does not cover grid-centered events that involve LOOPS caused by loss of transmission lines and equipment in the high-voltage switchyard. However, the study includes LOOP events caused by malfunctions or failures of the main transformer, station auxiliary transformers (SATs), and startup i

transformers (SUTs), including associated protective relays, bus ducts, current transformers, potential transformers, and lightning arresters. At most plants, such equipment is located inside the plant boundary and not in the switchyard. This study analyzes plant-centered LOOP events from the point of view of total and partial LOOP events, LOOP duration under power and shutdown operation, root cause analysis, and corrective measures to reduce the plant-centered LOOP events.

3.

DISCUSSION i

3.1 Identification of Events l

The Sequence Coding and Search System (SCSS) was used to conduct multiple searches of the operating experience database to identify the plant-centered LOOP events which occurred:

from 1985 through 1989. The staff also screened all LERs and daily event reports in 1989 l_

t'o identify LOOP events caused by plant-centered failures.

Review 0f the above data identified 86 LERs related to plant-centered LOOP events. A listing of these LERs with the plant name and a brief description of the event, event causesc failed equipment, corrective actions, and safety significance is given in Tables 1 through 4 Table 1 lists the total LOOP events that occurred while the plant was at power, Table'2 lists the partial LOOP events while the plant was at power, Table 3 lists the total LOOP events

- during shutdown operation, and Table 4 lists the partia1' LOOP events during shutdown operation. Because of the limitations of the LER search process, the listed LERs are.

representative events of interest, but the lists can not be considered all inclusive.

3.2 Event Trends Grouping the LOOP events by the year of occurrence indicated that 31 percent of these events occurred in 1989, 20 percent in 1988, 20 percent in 1987, 17 percent in 1986, and 12 percent in 1985. The number of LOOP events per year from 1985 through 1988 changed very little except for events attributed to new plants commissioned during this period '

However, the increase in LOOP events during 1989 can be attributed to the manual screening of all LERs reported in 1989 as opposed to the SCSS screening for previous years. Another reason for the increase in LOOP events in 1989 is that the newer units experienced higher failure rates, For example, out of 27 events occurring in 1989, four events occurred at-South Texas Unit 2 which began commercial power operation in June 1988, and 4 events occurred at Palo Verde Units 1,2, and 3, which began commercial power operation between January 1986 and January 1988. River Bend began commercial power operation in June 1986 and four events occurred at River Bend in 1988 and 1989.

3.3 Event Duration The salient features of LOOP durations recorded in Tables'1 through 4 are reproduced in Table 5. Most of the LOOP durations were extracted from the LERs. When the duration.

was not stated in the LERs, it was obtained from the licensee. The licensees were also contacted for all LOOP events that lasted more than 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to fmd out why it took that long to restore offsite power.

Out of the 86 events, on 29 occasions (34 percent of the 86 events) the LOOP duration was less than 30 seconds. The average duration for all events was 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and.42 seconds. On nine occasions, the LOOP durations were more than 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. When these nine events are excluded, the average LOOP duration comes to I hour and 20 minutes. When the 29 momentary losses are excluded, the average LOOP duration was 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> and 10 minutes.

The longest LOOP event (Table 2, No.13) was a partial LOOP at LaSalle Unit 1, LER 50-373/89-009, for 52 hours6.018519e-4 days <br />0.0144 hours <br />8.597884e-5 weeks <br />1.9786e-5 months <br /> and 28 minutes. It occurred at 4.16 kV Class 1E bus'243 which is normally fed from offsite power through startup auxiliary transformer (SAT) ~2. On failure of the power supply from SAT 2, bus 243 is powered by emergency diesel generator (EDG) 2B, There is no provision to energize this bus from any other source. On March 2,.

1989, there was a snow storm around the plant area. A lightning arrester on the primary side of SAT 2 failed resulting in opening of the breaker feeding power to SAT 2. The EDG l

r j

3 2B' started and powered bus 243.: The licensee explain' d that a combination of factors e

~

contributed to the long restoration time. This included the inclement weather, the time required to check' SAT.2 including high potential test and oil sample tests, the time required -

to get the replacement lightning arrester from storage about 70 miles away, the time required to mount the new arrester, and allow enough time for the oil inside the arrester to stabilize.

before the arrester could be energized.

The second longest LOOP event (Table 2, No.14) was also a partial LOOP at 4.16 kV bus 243 at LaSalle Unit 2, LER 50-373/89-007. The duration was 51 hours5.902778e-4 days <br />0.0142 hours <br />8.43254e-5 weeks <br />1.94055e-5 months <br /> and 5 minutes'.

~

In this event, the SAT 2 was lost because of an inadvertent actuation of the SAT 2 deluge system. Similar to the LaSalle Unit i event, the licensee took time to check the associated equipment prior to energizing bus 243 from the offsite power.

The licensee was questioned about the duration of these two events at LaSalle. The licensee expla:ned that during these two events there was little they could do to significantly reduce the LOOP duration. However, the LOOP durations of these two events were significantly -

more than the LOOP duration of any other event.

~ The third longest LOOP event (Table 1, No.11) was a total LOOP for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and 51 minutes at Palo Vnde Una 2. I ER 50-529/89-01, on January 3,1989 Each Palo Verdei Unit has two Class IE buses which are noanally fed from the 13.8 kV buses through two 13.8 kV to'4.16 kV transformers. However, because of rain and pollution, two bushings of each transformer flashed over simultaneously resulting in a total LOOP. The licensee attributed the LOOP duration to weather, shift turnover, and the time required to replace the' bushings in sequence.

The next longest LOOP event (Table 3, No. 6) was a total LOOP at Pilgrim on February 21, 1989, LER 50-293/89-010. At this plant the Class IE buses can be fed from the 345 kV -

offsite power through the SUT or from the 23 kV offsite power through the shutdown transformer or from the 345 kV offsite power through the main transformer and the SAT.

At the time of the event, the plant was under shutdo_wn operation,' the shutdown transformer was undergoing maintenance, and the auxiliary loads were fed through the SUT. - A cable fault occurred on the secondary side of the SUT which tripped the SUT resulting in a LOOP.

It took the licensee 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> and 20 minutes to restore the offsite power through the main transformer and SAT. The licensee mentioned that the main cause for the delay was the time taken to prepare for equipment tagging, tag inspection, removal of tags, and for shift turnover.

Another event of interest was a total LOOP event (Table 1, No.10) at Palisades on July 14, 1987, LER 50-255/87-024. On this occasion, with the reactor operating at 91 percent power, maintenance work was in progress on the transformer deluge system. A sudden actuation of the deluge system' occurred which created a fault on a startup transformer resulting in a LOOP. The licensee took 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> and 26 minutes to tag an'd inspect the.

equipment before restoring the offsite power. Subsequently, the licensee added another offsite power feed through an underground cable with automatic bus transfer provision and replaced the generator disconnect link with a motor operated disconnect. With these

_4_

k

y modifications the licensee now has three redundant offsite sources with provision for automatic fast and slow bus transfers.

1 3.4 Total LOOP Events-The staff review of the 86 LERs indicated that 26 events (30 percent of all plant-centered events) resulted in total LOOP (Tables ~ l and 3). Fifteen events occurred with the plant under power operation and 11 events occurred while the plant was under shutdown operation.

The longest total LOOP occurred at Palo Verde Unit 2,~ LER 50-529/89-001 (Table 1, No.11). This LOOP was for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and 51 minutes. The'second longest' total LOOP occurred at Pilgrim, LER 50-293/89-010 (Table 3, No. 6), LOOP duration 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> and 20-minutes. These two events have been described in section 3.3.

A review of the average LOOP duration recorded in Table 5 indicates that under power j

operation the average total LOOP duration was about twice the average total LOOP duration under plant shutdown conditions. This can be justified by the fact that under plant shutdown-conditions the plant loads are much less and the plants operate on a simpler power supply configuration.

The total LOOP duration acquired for this study,'which covered 1985 to 1989, was compared with the station blackout study report, NUREG-1032 (Reference 7), data which covered 1968 to.1985. There were 26 total LOOP events during the recent 5 year span and 46 total LOOP events during the prior 18 year span. The_ event median duration from 1985 to 1989 was 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 8 minutes (time from start of the LOOP to power restoration) while the station blackout study indicated a median' duration of 18 rninutes. We' understand the station blackout study included an evaluation to estimate when power could have been restored and that was the event duration reported.' Many conclusions of NUREG-1109,

" Regulatory /Backfit Analysis for the Resolution of Unresolved Safety Issue A-44, Station -

Blackout" are based on NUREG-1032. The recent median LOOP duration data of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 8 minutes could mean the LOOP events are actually longer duration events than previously thought or that the prudent course of action involves more effort to assure -

restoration attempts will succeed. Since operating experience shows that actual licensee restoration time is much longer than the estimated restoration time, a review of this effect'on the resolution to unresolved safety issue A-44, Station Blackout, may be warranted.'

Fifty-two percent of the total LOOP events were caused by personnel errors, 25 percent by equipment malfunctions or failures,18 percent by design deficiencies, and'the remaining 5 percent by inadequate maintenance practices.

3.5 Events Under Power Operation Forty-one LOOP events (48 percent of the 86 LOOP events) occurred with the plant under power operation (Tables 1 and 2). Almost all the events in Tables 1 and 2 involved multiple equipment or system malfunctions or failures including bus transfer failures and severe perturbations in the electrical system.

-s-

One example of multiple equipment failure is the event (Table 1, No. 5) at Diablo Canyon Unit 2, LER 50-323/88-008, on July 17,1988. ' During this event, with the plant operating at full power, ground alarms were received from one reactor coolant pump (RCP) and two circulating water pumps fed from two 12 kV buses D and E. Soon ground alarms were received from the secondary side of the 25 kV to 12 kV auxiliary transformer feeding these two buses from the main generator. The operators transferred the 12 kV buses from the auxiliary transformer to the startup transformer. Then a phase unbalance alarm was received from the RCP. The operators reduced the reactor power to 50 percent and tripped one circulating water pump motor. Soon after that a fire was reported from the startup transformer grounding resistor. The operators tripped the reactor and the RCP motor. Soon after that the 230 kV breaker feeding the startup transformer tripped causing a total LOOP.

The fire in the vicinity of the grounding resistor was caused by the burning of insulation of a cable that connected the grounding transformer to the grounding resistor. A sheet of micarta type material had been inadvertently left on the resistor banks directing heat from the resistor banks to the cable which had been routed over the resistor banks. The fire created a ground fault on the secondary side of the grounding transformer which blew two fuses on the primary side of the grounding transformer. The blown fuses left the 12 kV system ungrounded and created a voltage transient that resulted in a phase to phase fault and tripped the 230 kV breaker feeding the startup transformer. The RCP 2-3 was the last RCP to be tripped and at that stage its associated steam generator SG 2-3 was the main heat sink. This resulted in SG 2-3 being cooled off more than the other steam generators which ultimately depressurized it to the differential pressure set point which initiated safety injection. In addition, a secondary system transient produced water hammer in the condensate and the feedwater systems, flashing in the feedwater heater inlet and outlet piping, and depressurization in lines connected to the condenser hotwell. Also, the compressed air system pressure temporarily fell below normal pressure. The first ground fault alarm was caused by a deteriorating RCP motor terminal connectors with galled aluminum threads.

This event was quantified in the ASP program to have a CCDP of 4.lE-5 (See Section 3.9).

Another example of a LOOP under power condition with multiple complications is the event (Table 2, No. 8) at Dresden Unit 3, LER 50-249/89-001, on March 25, 1989. On this occasion, a capacitor inside a 345 kV switchyard circuit breaker failed. The breaker received a trip signal but did not trip. The breaker backup logic tripped additional breakers that isolated the 345 kV power feed to the reserve' auxiliary transformer, TR 32. The fast bus transfer was inhibited because of dirty breaker contacts. A slow bus transfer took about 3

14 seconds which tripped a reactor feed pump (RFP) motor and a reactor recirculation pump motor. The reactor water level rose to the main turbine and the RFP trip set points. The reactor scrammed on turbine stop valve closure. The operators manually closed the main steam isolation valves and tised mildly contaminated condensate water because the clean demineralized water shell side supply valve was deenergized. This resulted in low level contamination around the isolation condenser. Furthermore, the power supply to an annunciator panel tripped due to a fuse failure requiring declaration of a generating station emergency alert. Also the two feeder breakers to the low pressure coolant injection swing bus tripped spuriously and the reserve feed breaker for the swing bus failed to close. In addition, the high-pressure coolant injection (HPCI) pump experienced HPCI high pressure bearing oil drain high temperature because a HPCI lube oil cooling water normal return valve opened. The HPCI turning gear was unavailable following the trip of the HPCI,

,.~

r

. turbine because of turning gear mot'or failure. The security multiplexer was unavailable for.

~

about I hour because of an open power supply fuse. The security computer was without-power for about.17 minutes because the security system uninterruptible power supply failed.

The primary containment oxygen analyzer was unavailable for a short period.. Also, the t

main turbine turning gear was inoperable because of the loss of the instrument air. system.

This event was quantified in the ASP program to have a CCDP of 1.3E-5 (See Section 3.9).-

Similar multiple equipment or system malfunctions or failures occurred during most of the '

1 LOOP events listed in Tables l'and 2. A review of these events indicates that most ' f the o

secondary failures during these events were caused by unrecognized' design deficiencies,.

sudden equipment failure on demand, and previously failed components that remained.-

undetected. The secondary failures were at times associated with personnel errors.

i Forty percent of the LOOP events under power operation were caused by personnel errors, 30 percent by equipment malfunctions or failures,20 percent by design deficiencies, and the 1

remaining 10 percent by inadequate maintenance practices.

3.6 Events Under Shutdown Condition Fifty-two percent of the LOOP events (Tables 3 and 4) occurred while the units were shutdown. In'the shutdown condition, the unit auxiliary loads were often fed from one offsite source only. The standard TS permit nuclear unit operation in shutdown modes (modes 5 and 6) with power supplied from only one offsite source and one onsite source.

(usually an EDG).

During the shutdown operations or refueling operations the licensees usually did not make

~

contingency plans for quick restoration of alternate offsite power source (s) if the first offsite power source was lost. Because of this lack of preplanning for. quick restoration of offsite power, in a number of cases under shutdown conditions when the first offsite source was lost, the Class 1E loads were p. sered by the diesel generator (s) for hours and the licensees were slow in restoring the available offsite power. With this approach, the plants were without redundant power supply for hours. From a plant safety point of view, it is desirable to switch over to an alternate offsite power source (s) at the earliest opportunity to minimize relying only on the EDGs.

A review of the single line diagrams of all operating nuclear plants indicates that about 60 percent of the plants have more than one offsite power source available under shutdown conditions. With adequate preplanning, most plant licensees would be able to quickly switch to an alternate offsite power source. On October 28,1991,.the NRC issued an Information Notice (Reference 10) on this subject.

Furthermore, because the licensees tried to minimize the outage duration and conduct as much maintenance, inspection,' testing, and replacement as possible during the shutdown periods, many activities were performed without adequate planning and supervision. At times, people were not adequately qualified for the job and, on occasions, vehicle and personnel movement was not adequately controlled. The Vogtle event of March 20, 1990,-

f (Reference 8) demonstrates this point. In this event, with the plant in mid-loop operation, all ac power to safety related loads and the residual heat removal system were lost when a truck in the low voltage switchyard backed into the support column for the offsite power feed to the reserve transformer. The event at Diablo Canyon Unit 1 on March 7,1991, (Reference 11), when a mobile crane caused flash-over of a 500 kV line inside the power plant is another example of poor job execution during plant refueling. Another example (Table 3.

No. 2) is the event at Crystal River Unit 3 on October 16,1987, LER 50-302/87-025, when a worker inside the plant touched a 230 kV feeder with a metal pole. On February 18, 1992, the NRC issued an Information Notice, IN 92-13, (Reference 14) on this subject.

During these events, the licensees had no provision for quick restoration of alternate offsite power in the event the available offsite power source was lost due to a mishap.

Fifty-seven percent of the LOOP events under shutdown condition were caused by personnel errors, 23 percent by equipment malfunctions or failures,10 percent by design deficiencies, and the remaining 10 percent by inadequate maintenance practices.

Thus, adequate preplanning for quick restoration of offsite power and improvement in personnel awareness are likely to significantly reduce LOOP occurrences and their duration during plant shutdown operation.

3,7 Event Causes Staff analysis of the 86 total and partial LOOP event causes are summarized in Table 6. The event causes reported in the LERs have been categorized into four broad classes, namely (1) personnel errors, (2) equipment malfunction or failures, (3) design deficiencies, and (4) inadequate maintenance practices. Personnel errors have been further subdivided into inadvertent action, procedure inadequacies, and set point errors. Many of the LERs reported multiple causes for each event. Addition of these multiple causes for the 86 LERs resulted in 111 event causes. Multiple event cause basis has been used for all event cause analysis discussed in this report. Thus, for the 86 events included in this study,53 event causes relate to personnel errors (48 percent of 111 total event causes), 31 event causes to equipment malfunctions or failures (28 percent),16 event causes to design deficiencies (14 percent), and 11 event causes to inadequate maintenance practices (10 percent).

3.7.1 Events Caused by Personnel Errors Table 6 indicates that persbnnel error was the prime cause of all LOOP events (48 percent of all LOOP event causes). A review of the events caused by personnel error (Tables 1 through 4) indicates that about 9 out of 10 times these personnel errors involved bumping panels, slamming panel doors, producing vibration while working on an adjoining panel, operating a wrong switch, pulling the wrong fuse, failing to remove temporary jumpers, making wrong connections, and using wrong devices. Another six percent of the personnel errors were caused by procedure deficiency, failure to follow procedure or by poor communication. The remaining three percent of the personnel errors were caused by device set point error.

_g_

i l

~

.j pm q

Staffinvestigation of the LOOP events caused by personnel errors indicates that many of

.these events could have_been avoided by adequate personnel and &cedure controls. For-example, the event (Table 1, No. 3) at Brunswick Unit '2 (LER P M9-009) could have -

been avoided if the technician doing the trouble shooting had unde -

ne basic features'of -

the electrical distribution syste71 and if his work had been properly supervised by a qualified

. person. In this event the technician shorted a neutral grounding transformer because he.

thought a grounding transformer was the same as a CT. At Brunswick Unit 2, the neutral of the station startup transformer.(SST) is grounded through a grounding transformer with 'a resistor on the secondary side of the transformer. The technician was trouble shooting an SST ground fault alarm. In an effort to clear the alarm, the technician decided to put a 5

jumper around the grounding transformer primary which created a low resistance ground path for an existing ground causing severe damage to the 4160 V bus duct. This resultedLin -

reactor scram, turbine trip, and total LOOP for the unit.

1 A second example of a LOOP event (Table 2, No.1) due to personnel error is discussed in LER 50-313/87-005 for Arkansas Nuclear Unit 1. This event involved testing a generator high voltage breaker. Prior to the test, the relay test personnel discussed the need to take out the breaker' failure module. However, during the test, the relay test personnel failed to pull out the breaker failure module. This resulted in opening four 500 kV switchyard breakers, generator trip, and drop out cf loads due to slow bus transfers.

A third example (Table 3, No.7) of LOOP due to personnel error is the Shoreham event on t

March 18,1987, LER 50-322/87-003. In this event, a condensate pump start first tripped the normal station service transformer (NSST) which was followed by tripping of the resen'e station service transformer (RSST) resulting in a total LOOP. On loss of the offsite power, the reactor tripped along with isolation of various safety systems. This event was caused by adding jumpers a;.ross the NSST and RSST CT secondaries during modification work for testing an EDG without studying the consequences of adding these jumpers.

Another similar LOOP event (Table 1, No. 9) occurred at Millstone Unit 2 on October 25, 1988, LER 50-336/88-011, because maintenance personne! grounded a 4160 V safety related bus by inserting a wrong " ground and test device."

LER 50-255/87-024, submitted by the licensee for the Palisades Nuclear Plant (Table 1, No.10), discusses an LOOP event caused by a transformer fault when maintenance personnel inadvertently actuated the deluge system during planned maintenance.

i A fatal accident (Table 3, No.11) occurred at Wolf Creek Unit 1, LER 50-482/87-048, because the individuals involved failed to follow the procedure to check the power supply before working on a 4.10 kV switchgear.

The Vogtle event of March 20,1990, (Reference 8), and the Diablo Canyon event of March 7,1991, (Reference 11), clearly demonstrate the results of lack of control over vehicle movement inside nuclear plants.

On 16 occasions the relays and other devices malfunctioned from vibrations caused by panel tapping, slamming of panel doors, working on adjoining panels, and accidental bumping. _On

-9..

14 occasions personnel opened the wrong device (e.g., the fuse or switch) or made incorrect connections or failed to remove jumpers installed during testing.

3.7.2 Events Caused by Equipment Malfunction or Failure As indicated in Table 6,31 of the events were caused by equipment malfunctions or failures.

A review of these events indicated that 12 of these events (36 percent) involved transformers, 6 events (18 percent) involved relays, 4 events (12 percent) involved switchgear, 3 events (9 percent) involved generators, and 2 events (6 percent) involved fuses. In the majority of these events, the licensee could not established the exact cause of the equipment failures.

3.7.3 Events Caused by Desiga Deficiencies LOOP events caused by design deficiencies were often related to inadequate bus transfers.

About 90 percent of the LOOP events under power operation (Tables 1 and 2) were accompanied by bus transfer failures. The different aspects of bus transfer improvements were reported in Reference 9. S 1991 the NRC issued an Information Notice (Reference

12) on this subject.

One example of LOOP caused by design deficiency (DD) is the event (Table 4, No. 23) reported in LER 50-499/89-001 for South Texas Unit 2. In this event a LOOP occurred due to an inadvertent actuation of the staidby transformer deluge system. Corrective action included repositioning the deluge system nozzles to lessen the deluge water impingement on the transformer bushings.

A second example of LOOP caused by deluge actuation is the event (Table 1, No.10) reported in LER 50-255/87-024 at Palisades. During this event the LOOP lasted for 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> and 26 minutes. Other examples of LOOP caused by deluge actuation are the events reported in LER 50-301/89-002 at Point Peach Unit 2 (Table 1, No.12), LER 50-483/

85-011 at Callaway Unit 1 (Table 2, No. 4), and LER 50-456/87-048 at Braidwood Unit 1 (Table 3, No.1).

Another common DD is the degraded voltage or inadequate relay setting as reported in LER 50-311/86-007 at Salem Unit 2 (Table 1, No.14), LER 50-395/89-008 at Summer (Table 1, No.15), LER 50-369/86-011 at McGuire (Table 4, No. I1), LER 50-313/87-005

{

at Arkansas Unit 1 (Table 2, No.1), and LER 50-249/89-001 at Dresden Unit 3 (Table 2, No. 8).

3.7.4 Events Caused by Inadequate Maintenance Practices Ten percent of all event causes relate to inadequate maintenance practices. The most common cause is the accumulation of dust and water inside bus ducts as reported in LERs 50-324/89-009 at Brunswick Unit 2 (Table 1, No. 3), LER 50-268/89-008 at Browns Ferry Unit 2 (Table 4, No. 3), LER 50-528/88-003 at Palo Verde Unit 1 (Table 4, No.16), !

and LER 50-328/88-034 at Sequoyah Unit 2 (Table 4. No. 21). The LER 50-255/87-024 reported on contamination of transformer deluge system at Palisades (Table 1, No.10) and the LER 50-280/89-005 on breaker failure due to accumulation of dust and dirt at Surry Unit 1 (Table 4, No. 27).

B 3.8 Failures of Multiple Safety-Related Equipment During LOOP Events A review of the LERs on LOOP events indicated that often multiple equipment failed or malfunctioned during the LOOP events, at times causing concern for plant safety. Such multiple equipment failures were more prevalent under po.wer operation (Tables 1 and 2). In many cases such LOOP events involved voltage transients in the plant medium voltage system which prevented bus transfers and caused load shedding. In a number of cases one or more Class lE equipment failed to start on demand. In a few cases, the failed equipment had become inoperable earlier but remained unidentified until the LOOP event occuned.

o The LOOP events at Diablo Canyon and Dresden described in Section 3.5 clearly indicate how involved multiple equipment failures can be under power operation. Another similar event is the recent failure of uninterruptible power supplies following a catastrophic failure of the main transformer at Nine Mile Point Unit 2, on August 13,1991, (Reference 13).

One example of such an event under plant shutdown operation was the Vogtle event'of J

March 20,1990,-(Reference 8) in which both of the EDGs failed to start on a LOOP resulting in a station blackout. Another example is the LOOP event subsequent to the main transformer failure at Diablo Canyon on March 7,1991, (Reference 11). During this LOOP event multiple equipment failed including emergency lighting and the plant communication systems.

Our review of the 86 LERs indicated that about 29 of these events (34 percent) involved LOOP events associated with malfunction of multiple equipthent or systerri.

3.9 LOOP Event Risk Significance The events identified in this study were compared with previous LOOF events evaluated in the ASP program as a means to establish a measure of risk significance associated with plant-centerea LOOP events. The ASP prcgram evaluated 25 LOOP evento of all kinds from 1985 through 1989. Twelve of those events were identified in this study as plant-centered LOOP events. Table 7 identifies the distribution of plant-centered events that received an ASP -

evaluation, ti.e plant condition (power or shutdown) when the event occurred, and the maximum ASP conditional core damage probability (CCDP) that was calculated.

Three of the eight ASP evaluations involving plant-centered total LOOP events resulted in -

CCDP around E-4 with a maximum predicted value of 4.3E-4. Under shutdown conditions, three plant-centered total LOOP event CCDP were around E-5 with a maximum of 7E-5.

The maximum CCDP for any of the 25 ASP LOOP event evaluations was approximately E-3 i..- -

followed by 9 events with a CCDP in the E-4 range. Thus, plant-centered LOOP events are considered risk significant, and as precursors to accidents.

4.

FLNDINGS The important 6ndings from evaluation of the 86 total or partial plant-centered LOOP events between 1985 and 1989 are as follows:

A.

LOOP Duration The average duration of the 86 LOOP events included in this study was 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and 42 seconds. Out of the 86 events, on 29 occasions (34 percent of the 86 events) the' LOOP duration was less than 30 seconds. When the 29 momentary losses are excluded the average duration was 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> and 10 minutes..On nine occasions the LOOP duration was more than 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The longest duration was 52 hours6.018519e-4 days <br />0.0144 hours <br />8.597884e-5 weeks <br />1.9786e-5 months <br /> and 28 minutes.

B.

Total LOOP Events The staff review of the 86 events indicated that 26 events (30 percent of the 86 events) resulted in total LOOP. Under power operation the average total LOOP duration was about twice the average total LOOP duration under plant shutdown condition. The median LOOP duration was 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 8 minutes.

Fifty-two percent of the total LOOP events were caused by personnel errors, 25 percent by equipment malfusions or failures,18 percent by design deficiencies, and the remaining 5 percent by inadequate maintenance practices.

C.

Events Under Power Operation Forty-one LOOP events (48 percent of the 86 events) occurred with the plant under power operation. Most LOOP events under power operation (about one-third of the 86 events) involved multiple equipment or system malfunctions or failures including' bus transfer failures and severe perturbations in the electrical system.

Forty percent of the LOOP events under power operation were caused by personnel errors, 30 percent by equipment malfunctions or failures, 20 percent by design denciencies, and the remaining 10 percent by inadequate maintenance practices.

D.

Events Under Shutdown Condition During the shutdown periods, most licensees did little or no preplanning for quick restoration-of offsite power on loss of the first offsite power source. Also, during the shutdown periods, many activities were performed without adequate planning and supervision. At times, people were not adequately qualified for the job and, on occasions, vehicle and personnel movement was not adequately controlled.,

l 1

i

Fifty-seven percent of the LOOP events under shutdown condition were caused by personnel.-

errors, 23 percent by equipment malfunctions or failures,10 percent by design denciencies, and the remaining 10 percent by inadequate maintenance practices.

E.

Event Causes The study identified that 48 percent of the 86 events were caused by personnel errors, 28 percent by equipment malfunctions or failures,14 percent by design deficiencies, and the remaining 10 percent by inadequate maintenance practices.

A review-of the events caused by personnel errors indicates that about 9 out of 10 times these personnel errors involved bumping panels,' slamming panel doors, producing vibration while working on an adjoining panel, operating a wrong switch, pulling the wrong fuse, failure to remove temporary jumpers, making wrong connections, and using wrong devices.

Under power operation the average total LOOP duration was about twice the average total LOOP duration under plant shutdown condition.

5.

CONCLUSIONS The current rate of LOOP caused by plant-centered events can be reduced by:

A.

Improvement in administrative controls to ensure that persons conducting modifications, maintenance, and testing are knowledgeable and careful about their work and that these activities are properly scheduled, controlled, and supervised.

B, Improvement in the alertness of people carrying out maintenance and testing of plant equipment.

C.

Improvement in control of personnel and vehicle movement'inside the plant area.-

D.

Preplanning for quick restoration of offsite power in the event the available power source is lost due to a mishap.

E.

Improvement of the plant auxiliary power distribution and bus transfer schemes.

6.

REFERENCES 1.

Office of the Federal Register, National Archives and Records Administration, Title 10 of the Code of Federal Regulations, " Energy," revised annually.

2.

U. S. Nuclear Regulatory Commission (U.S. NRC), NUREG-0800, July 1981,

" Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR Edition."

-n-

. G 3.

R. E. Battle, NUREG/CR-3992, February 1985, " Collection and Evaluation of Complete and Partial Losses of Offsite Power at Nuclear Power Plants."

4.

C. Y. Yimura and P. G. Prassienos, NUREG/CR-5042, February _1989, " Evaluation of External Hazards to Nuclear Power Plants in the United States."

5.

R. L. Iman and S. C. Hora, NUREG/CR-5032, January 1988, "Modeling Time to Recovery and Initiating Event Frequency for Loss of Offsite Power Incidents at-Nuclear Power /lants."

r 6.

H. Wyckoff, F.uclear Safety Analysis Center, NSAC/147, March-.1990, " Losses of Off-Site Power at U. S. Nuclear Power Plants through '1989."

7.

P. W. Baranowsky, U. S. Nuclear Regulatory Commission,-NUREG-1032,' June 1988, " Evaluation of Station Blackout Accidents'at Nuclear Power Plants."

8.

NUREG-1410, June 1990, " Loss of Vital AC Power and the Residual Heat Removal System During Mid Loop Operations at Vogtle Unit 1 on March 20,.1990."

9.

Engineering Report AEOD/E90-05, " Operational IIxperience on Bus Transfers."-

10.

Information Notice, IN 91-68, " Careful Planning Significantly Reduces the Potential-Adverse Impacts of Loss of Offsite Power Events During-Shutdown".

I 1.

Pacific Gas and Electric Company, Licensee Event Report 50-275/91-004, Diablo e

Canyon Unit 1, March 7,1991.

12.

Information Notice, IN 91-57, " Operational Experience on Bus Transfers."

13.

Niagara Mohawk Power Corp., License Event Report, 50 410/91-017, Nine Mile Point Unit 2, August 13, 1991,

^

14.

Information Notice, IN 92-13, " Inadequate Control Over Vehicular Traffic at Nuclear.

Power Plant Sites."

b,

=

v s-~

)

ey e

. dE

Table 1. Total loss-of-Offsite Power Caused by Plant-Centered Esents t!nder Power Operation Failed i

No.

Plant Data Event Description Cause Equipment Correctise Actions Esent Significance 1.

Beaver Valley 2 A technician bumped a PE-1: Technician None Several self-reset relays EDGs started and 412/87-036 power switch resulting bumped a turbine replaced by lockout powered the Class IE 7

7h. 46m.

in a turbine trip. Bus instrument switch. DD.

relays. Power supply to buses.

transfer occurred but the hiultiple relays did not turbine instrument outgoing breaker have seat in feature.

disabled and time delay reclosed causing a total 13reaker reclosure relay will be installed.

LOOP.

blocking was not used.

2.

Big Rock i During main generatt PE-1: Plant operator None A training memo EDG started but did 155/88-002 synchronization, a higi.

closed the main describing the event, not load as a second 3s.

voltage tie breaker generator breaker out system operation, and offsite source powered tripped. Recirculation of phase with the grid.

proper synchronization the buses in 3s.

pumps and the reactor issued.

tripped.

3.

Brunswick 2 During trouble shooting PE-1: The technician Bus duct and Damages repaired. New EDGs started and 324/89-009 a ground on SUT, a did not know the effect CAC & LPCI procedure issued. CAC powered Class IE 1

4h. 43m.

technician created a of shorting the valves valve sent to the buses. Reactor U,

solid ground fault by grounding resister PE-vendor for analysis.

scrammed.

I installing a jumper P: inadequate Containment isolation across the grounding communication groups, I, 2, 3, and 6 resistor.

between personnel and-energized. Reactor inadequate procedures pressure and on power supply and temperature was valve maintenance. h1T:

controlled by SRVs, Water accumulated in llPCI, and RCIC.

bus duct.

4.

Crystal River 3 The Unit 3 SUT was PE-1: Technician None Failed equipment EDGs started and 302/89-023 supplying all 4160V and inadvertently bumped a replaced.

powered the Class 1E 4

lh.

6900V buses. Relay pushbutton that tripped buses.

technicians were testing a 230 kV line. EF: A the 230 kV system. A -

breaker fault detector technician bumped a relay failed and tripped pushbutton tripping the,

a!! offsite power. Two SUT. The reactor and components failed in the turbine tripped. One the EFP start circuit.

EFP failed to start automatically.

4 m

m e

.,-.4 w -

o y

e ~

x Table 1. (cont.)

Failed j No.

Plant Data -

Event Description Cause Equipment Correctise Actions E$ent Significance 5.

Diablo Canyon 2 Galled aluminum threads EF: the cause of the Cable and Neotral cable for SUT The eleventh ECCS 323/88-008 caused a ground fault at galled threads could not

~ conn ?ctor rerouted. Surge actuation resulted in a 2h. 22m.

RCP 2-2. The operator be established. PE-1:

suppressors on 12 kV discharge of water into

~

transferred 12 kV bus D the fire was caused by vacuum breakers the reactor. The EDGs to the SUT. A fire leftover mica sheet on replaced. The security started and powered developed at SUT grounding resistor.

alarm system will be the Class IE buses.

grounding resistor evaluated.

Some condenser tube causing a ground fault plugs were blown out which resulted in a total by the secondary LOOP. Sl occurred. The transients.

secondary. system transients produced water hammers in the condensate and I

feedwater systems. The compressed air system i

pressure fell below e

normal level.

t 6.

Dresden 2 -

A fault on RAT TRl2, EF: A fault on the Transformer TR21 repaired. Bus EDGs started and 237/85-034 tripped R AT TR22. Bus secondary side of TRl2 TR21 and tra.isfer circuit powered the Class IE 4h. 36m.

transfer to TR21 failed.

initiated this LOOP coil of an modified. New :

buses.

Half scram occurred.

event. DD: Bus transfer MOV in computers installed.

RFP 2B tripped and 2C lailed because of isolation New replacement failed to start. Reactor-defective control condenser radios ordered.

scrammed on low water circuit. Process system.

Emergency power level. Process computer -

computer had ' poor '

supply added to alarm printer stopped.

communication with telephones.

Lost audio contact all-the printer. The radio over the plant and lost -

and telephone several telephones.

communication failed Operator could not because the repeater control transfer of '

transmitters did not condensate water to the have alternate power isolation condenser shell.'

supply y

,m

-w r -

a

Table I. (cont.) -

Failed No.

Plant Data Event Description Cause Equipment Correctise Actions Event Significance 7.

Ilope Creek An investigation of a PE-1: A relay None Updated test manual and -

EDGs started and 354/86-011 damaged 13 kV~

technician disconnected training programs.

powered the Class IE' 30m.

disconnect switch was wrong relays which buses.

undertaken with only resulted in tripping of one offsite power source the only offsite source available for Class IE to Class I E buses, buses. This offsite source was lost during a relay test.

8.

Maine Yankee A fault in one of the two EF: A fault in the main Main Investigation did not

-The EDGs started and 309/88-006 main transformers transformer initiated.

transformer identify the cause of the powered the Class IE 10m.

tripped the reactor. Low this LOOP event. The and 480V transformer failure.

buses.

system voltage inhibited SWP tripped because of circuit '

Initiated review of bus bus transfers to reserve defective circuit breaker transfer circuit, transformers. A SWP breaker.

1 tripped.

[

9.

Millstone 2 While performing PE-1: The individual 4160V Failed components The EDGs started and.

336/88-01I preventive maintenance who issued the GTD switchgear repaired. Grounding powered the Class !E 3 h.

on SWP motor, a wrong selected the wrong procedure rewritten.-

buses.

GTD was inserted into a GTD and the 4160V bus resulting in.

electrician who loss of power to both installed the GTD Class IE buses.

failed to recognize the mistake.

10.

Palisades During maintenance to PE-SP: The main None Initiated a review of the The EDGs started and 255/87-024 correct an alarm transformer deluge dehige system design to powered the Class IE '

7h. 26m.

problem for the main system pressure was set minimize the inadvertent -

. buses.

transformer, the deluge too. high. MT: The actuation of the deluge system was activated water in the system. Quarterly resulting in loss of the -

transformer deluge inspection of the deluge SUT.

' system was system initiated.

contaminated. PE-P:

Operating procedure

'did not include resetting of two auxiliary relays;

Table I. (cont.) -

Failed No.

Plant Data Event Description Cause Equipmen t Corrective Actions Esent Significance 11.

Palo Verde 2 Two' transformers, MT: The transformer Transformen Failed bushings The EDGs started and 529/89-001 feeding power from a failed because of bushings replaced. Bushing powered the Class 1E 24h.51m.

13.8 kV bus to two 4.16 particle and moisture -

creepage distance buses.

kV Crass IE buses, accumulation on the increased. Implemented failed causing a LOOP bushings. DD:

bushing washing inadequate creepage program.

distance of the bushings.

' 12.

Point Beach'2 Du' ring trouble shooting PE-1: The deluge Transformer Failed bushings The generator stuck -

301/89-002 the main transformer.

system had wiring bushings replaced.

breaker relay acted 3h. 22m.

deluge system, the error. The cause for prematurely and '

deluge system actuated.

transformer trip could caused the grid The transformer tripped

.not be established.

degradation. The resulting in a reactor EDGs started and.

trip. Bus transfer took powered the Class IE-

~ t place but the grid buses.

E voltage degraded. Bus i

undervoltage relay operated and EDGs energized the Class IE loads.

13.

Robinson 2 While EDG B was out of EF: Investigation could None Installed larger size-Control room 261/88 005 service, Class IE bus E-not establish the cause fuse on the PT primary ventilation failed to '

'4h. 44m?

2 was lost because of a of the fuse failure. DD-.

and copper inserts on align to emergency blown fuse in the SUT tripped because of the secondary side.

recirculation mode.

undervoltage relay de saturation of. cts.

Fire water supply to circuit. The reactor.

containment vessel was tripped and the auxiliary isolated. The plant was loads were transferred to cooled by natural SUTc A 115 kV breaker' circulation and tripped and de-POR Vs.

energized SUT. EDG A -

started and powered Class IE bus E-1. SI and.

MSIV closure signals.

were initiated, j

6 m

c-e 12a

-e m

m a

m.

.r.

3 s

v w-

-e'-

b r.-

7

+

y Table 1. (cont.)

Failed No.

Plant Data Event' Description Cause Equipment Corrective Actions Esent Significance -

10 Salem 2 -

While trouble shooting PE-I: During None A number of short-term EDG 211 was out of ~

311/86-007 steam generator leveli troubleshooting steam and long-term service resulting in loss 3h. 47m.

the reactor tripped and generator water level, a investigations and design of all ac to vital bus Si occurred. Multiple technician shorted an modifications initiated.

211. Number of MOVs bus transfers occurred instrument bus. DD:

and saRguard due to degraded bus Degraded bus voltage equipmer.t were lost.

voltage. Component was caused by cooling water pump and unplanned load growth.

RCPs were secured.

Additional findings t

Reactor coolant pressure under investigation.

increased requiring.

cycling of PORV 2PRI.

+

15.

Summer.

Technicians shorted two PE-1: Technicians.

None Multiple modifications lloth EDGs started and.

395/89-00S power leads inside a inadvertently shorted in relay settings powered Class IE 2h.10m.

generator cabinet two power leads inside initiated.

buses.

causing a turbine trip the generator stator g

and a reactor trip. Three cooling water cabinet.

I other offsite generating.

EF Turbine runback units tripped causing a relay failed. DD: Relay degraded grid, settings in other plants were inadequate -

i l

l l

l l'

i.-

-w.

w

+

u-,

.w.-

n -

Table 2. Partial I.ms-of-Offsite Power Caused by Plant-Centered 1: vents IJuder Power Operation-l:

Failed l

No.

Plant Data Esent Description '

Cause Equipment Correctise Actions Eient Significance Is Arkansas i During maintenance PE-I: HFM not pulled None Switchyard maintenance EDGs started but did

~

313/87-005 tests, generator output out. DD: Syncheck practice and HFM not tie to Class IE 20 cycles breaker failed to trip relay set too low. BFM circuitry under review.

buses. Lost main resulting in a turbine not set to trip the feedwater pumps. The trip. One bus fast generator lockout relay.

piant was stabilized in transferred, other buses hot shutdown.

slow transferred.

2.

Ileaver Valley 2 During 100 percent load EF: Turbine overspeed None None. The load rejection No. I EDG autostarted 412/87-032 rejection test, bus protection control test was a one-time test and energized class IE 40m.

transfers were inhibited malfunctioned.

and will not be repeated.

bus.

because of phase Elevated pressure difference between experienced in high onsite and offsite power pressure turbine. Steam sources.

dump did not operate.

3.

Brunswick i During manual control EF: Oxide buildup on Generator Defective parts were Group 2,3,6, and 8 y

325/86-024 of main generator manual potentiometer voltage replaced.

containment isolation-3hr. 3 t m.

voltage regulator, the contact wiper regulator occurred. SRVs reactor tripped. Two prevented control of opened.Two EDGs Class IE buses tripped ~

generator voltsge.

powered two Class IE because of ' degraded bus buses.

voltage.

4 4.

Callaway I During a ' reactor startup, EF: Water accumulated -

None Pull station plug Reactor manually 483/85-011' the station SUT was lost inside a deluge pullbox.

rescaled. The deluge tripped and one EDG 2h. 26m..

because of deluge

.MT: A pipe. plug on control circuit modified automatically started actuation.

pullbox was loose and to inhibit deluge and powered Class llE not properly caulked.

operation until the bus.

DD: Inadequate deluge.

transformer trips. -

control circuit.

5.

Callaway l The main generator PE-1: The operator None

. Additional operator -

One EDG and AFW 483/88-015 breaker tripped when an unknowingly vibrated training on racking and

' pump actuated.

36m.

operator racked in an.

the generator breaker.

relay sensitivity adjoining breaker.

cubicle. MT: Relay initiated; Relay contact P

contact set too.

gap readjusted.

sensitive.

~

.a m

N n.,-

an, w,.

,at w

e ~

~

r

w x

i o 'r E

t o

d d

I wta' n

e le lorG a ss c

iaf pD da a

n F

eE eC l

a ms t

c r

i

d. a e

a e e

f ee n

t h '

r st in pt uO s

Gd' g

p t

i es.

e iS ir Dz r

t aoe d Ei t omtae g.

l t

s n

Ps et e

r r

e s e

Cieh a n nu o n et s

Oeb E

Rt or s e

r d.

u y

e

.d lr s

gcd g d et e na en ec nt n

is pi n o

v o

vi v o e r

l r

a it im er s e ei r p u

e c

r ca pe q

A tns la e

mc h a s

t t

r e

d int i

ano n gn

.d a

s n e r er t

n ed wa d ot o i t c

ai '

lens ei e

n e

r le pr i biii m t

r med a vv i

p C

FcOa

n. M r o

a o d

eee 1

r s e

t r eg r

ena n

e e

't t Ol t

tor n m

a imVv eoh.

. d p w

ki s

t c

e ilei d wnSh ait n

u e

S gesi o

a q eoa l

nw N

FE Ff rMirhb t

s

)

tn F:

o l

s doe d

d e

c er h a

ef n E u.

r.

(

r w

l o a pt t d

.d ge ee n

e iagm p odk d

r e

n uk n rV f

t i s a u t

2 ir c ea c

n t s a

e r

r aoS s nu pe l

loSiVia a n t

le f

ei s e gc ef t

r pr f ah oer q cfMdBn oiB sf t

si b

o rB e~

r r e t

r a aid : aTa e eh a

n cp : d pt t

t t

T:

r T

a n

vt o n aDa r u weFy:E b D r-h rf n

n io d f u

pr icMt ost eo f dDi et a odl s

Dvi.

n i a o

O gh n

g enu

.d s e I

t uid e r

n m ah. n gd s ojr e. o og

iWaai r

gwod e

i eaiapk l

ycl mpa n

t 1

s 1

t a

s c l

cl e

t k

l l

u

- od aics s ipol oe n EuS oewb a

E r oea eoi r l or hi C

P wr rfb pmt b cf t l

=

r sl P pat a

e y

p lt t t i

h p

r s n

iut u t

r u

a e

s c r

e ut eo bA t

r nt k

r ur o a o

.d Od n

e r n a

ebi t

t e n v cd s e

o c nea e

i h

adVgk e

s. l r

a it e of b

h ea ak n c ip sP

,n is r

,n t if x

Ve o

lpp r

a aW c i4 d

k nl d urSe c

nn e es npm s

gl t

f l

ni t

e n

oai 4 a ah s i

au h

s u D

ih t

a c

wg

,f geidgeTl p

a r n

loidV int r t

meWt lea leSV nt e

l h

e w

ri cl lt r

s r iS B uae uouooS a

s on E

FoIaMT Dmlepvf npAt s

~

2 n

i o-e y

a s

n7 1

s1 a0 t

0 a

e0 C-D B -

- 7 o8 8

t s8 -

l v6 b/m.

i n

/

a3 a

a 24 l

4 h.

i P

D32 D31 o

N 6

7.

~

I;d i i

4

~

4 Table 2. (cont.)

Failed No.

Plant Data.

Eient Description Cause Equipment Correctise Actions Esent Significance 8.

Dresden' 3 -

A fault occurred inside a EF: A failed capacitor None Defective components Low level -

249/89-001 345 kV breaker. A 4 kV inside a 345 kV replaced. Design and contamination in the 7h. 22m.

bus did not fast transfer.

breaker. Pitted relay procedures modified.

isolation condenser RFPs' dropped out. The contacts in bus transfer Contaminated areas vent area.

reactor scrammed.

circuits. Fuse failure.

decontaminated.

Several components -

DD: Inadequate time Maintenance practices malfunctioned. Low delay in bus transfer.

reviewed.

contamination in area Feedwater control around the isolation unable to control rapid condenser vent.

water level increase.

The clean water supply to the isolation condenser too low. UPS failed due to inappropriate switching sequence. PE-P-Main i

turbine turning gear

.y did not engage because of procedure-deficiency. Operator failed to control IIPCI lube oil cooling because of, lack of procedures.

MT: Improper installation of IIPCI turbine gear motor brush and pitting of relay contacts.

9.

Duane Arnold During a power / load EF: Reactor scrammed -

Breaker trip -

Defective components One EDG started and 331/89-011 unbalance test, the-because.of a failure of.

. coil and repl: iced.' Power / load powered the Class IE 40m.

reactor scrammed. The H generator cts. Bus cts -

unbalance circuit bus.

Class IE buses did not s transfer blocked operating procedures

transfer, because the breaker revised.

trip coil was burnt out.

-.~

r.

r y

lj dE E

y'.

eI I

dsau E' '

tr s d

s as ns e

eb t

a aa c

r dI sl l

n e

ns oC dC l

a ah as t

e ic s t a

ud t

e a

dl i

wt eC ae r n f

o z

a t

s o

i t

n r e s

d Gg d

ig Ge ah r

De B e t

t S

Dt s

z c

2 i Ee sd.

En.

Gg t

es Ges o

e r

n n

d e e

e n s

s h

Da wds Des o

u nu nu E

Tc Eo b Tab Eeb l

f la d g e5 h o u

ni cT i o n

t r

nS a -,

w d

a n i

d ia n2 d n n

g v

e d

o s

i o

l t

s e r eTi ei n

d vd t

t o

l e

nnUa iue l

l d.

n i

r i

i.

c s r noi a r e o

tc d

h t

d e u a nmod vbl t

A el a

ol fi n

e t

s e

s i

e v es p

cu e

n c

lon n

oiei u c nb o m mv en lei u n

s r

r o

i v u t

t t

s v o

r c nd n

c no o

a o ee o

k r

u e

ic n

r c

r r

e t

r es c

eep vc s

o h a a

pv eod eo r

r mr r n eh i

C Tw R

O gI ppu P

w t

tn gn e

inoni r g m

d p t

t lei e

e e

iu n

n n

h she a q o

o o

gr s u

i r

FE N

N N

b

)

t.

,l n

o d

e6 le n

c e

hT 5

l g eg

(

d.

b e

S T

h n t

r g - esS c

ni r pr m

t i 2

opk i

togn3 h a a

d n

e e

wl nt w2f h i

t ni t

l ort aUs nTot louoh e

a i a c r a

e r

b b g

l r

t e

r b

e n e r

di e

e uoUen a

pyb om pwl r

s eel si ai ut T

ot or o

ct t

l ni r c i T: au is e t

i ni co e

u r

t es el cf eh n o b b pMc e

om.

o n

igb e

e r h

as h t pr t

Ar ek eh g nh.

Du eoor r n Tdetad

.b g r

Tr s e u a

t di df e

t s

1:

s p aGpcn es t c

1 b

t mf s s I

u

- d t

ne pi ol peDiwri isiw Eoo a r a

E a e Fe Ei r

r or r wfams' Pf r t a '

nh h

r r

C Pi Et P

bet s t

t t

s lt r

. ye e

I od p

u e

G lt n

t a

uf rh c l t

s m.

a r r cm i

V aoat nivp s

a D

f n

o e n

a -

l u

r f

i dUrd'.

k gl arCei pd a

em E o r, t k o o

el l

6 noi i

r cat e

e d

dd x n

f o d oe e

a t

oae 9.T r i r t

ni up s nr nr p de er n at t il s

r t

e ec er d 6 Su ns e u

apot ae o

o ahisciep sih c a r c rb e oi i

s r t

i ab e

r ar u vTs g

t l

r - docpf oy r

h ea i

r u

t t

g t

mt ao op r

y n peeVie3 r r p

ipdTe uwt a

n a

r e

.l iorh fhTnfh ga rLs ir oe

.h d r c

rl er e s m k

e e

mt t

t s

r t

t ea e e

,toUp ock o

en c

e s

t t r e o n

a h g 9. 5 n o gi a.

t r o symedgepc t

i s

eecl doe mmu eh t

r e

t h e

l. eff c o

n t

n t

i6T nwe n eps r gt s z a

oer a lc D

Ardisb i ae2 f e

o o1 mms n

r

,dwa S s

t o i s ne c

s t

n, n r

cys m le t

sf eh moe e

k iGcobugpe upo

,2 e pcmhi hh it s t t

n t

s pt nia cc mve a s ns i o l

pF s epta r

r r

pl o

e uDsEn urh n aa h gi oi o

i aoio n

e n a nr r i

r v

E DEdI epdT

'Aot w Wt rFtrUlcbt mo wp AoUtrUsci r

i r

a r

t r

ap 2

9 t

0 9

n4 0

a t

1 1

i0 0.

o0.

1 m

0 ' m.

a 0

P 9

m i -

2 D

8 4 le8 8 8

7 7

8 4 n

y

/2 i

t 8'.

m/1 i/

a3.

l a

le/m 1

n a45 e4h.

d7.

S7h r8 r1 a

n4h a32 l

~

I 2l L35 P

F31 F33 o

0 N

1 2

3' 1

1 I

1

[3i i

li!ll

(!Illi Llp

e Table 2. (cont.)l Failed No.-

Plant Data Esent Description Cause Equipment Correctise Actions Esent Significance.

14 LaSalle 2 The SAT tripped EF: Inadvertent trip of SAT Cause of the deluge The B and C drywell 374/89-007 following sudden -

SAT from actuation of bushing actuation could not be chillers, the 2B 5 t h. 5m.

actuation of the deluge the deluge system.

established.

circulating water '.

system. On loss of SAT pump, reactor building bus 243 is normally fed ventilation, reactor :

from EDG-28. The water cleanup. system, EDG 2B was undergoing and the IC feedwater -

maintenance. Unit 2 heater string tripped.

remained on line and the EDG 2B was started Ih.

6m. after the SAT tripped.

15.

North Anna I A failure of the RSST EF: Mechanical failure MFRV and Defective parts of the The source range 338/88-20 caused degraded voltage of the MFRV.

RSST MFRV and RSST nuclear 8s.

at Class IE bus IJ. The tapchanger tapchanger replaced.

instrumentation was 1

MFRV. closed causing a Initiated evaluation of manually energized.

operator performance.

One main feedwater

-; M reactor trip.

1 1-cause of RSST isolation valve did not tapchanger failure, fully close. One EDG manual supervision of started and energized tapchanger operation,.

bus.. l j.

4 and replaced MFRV trim during next refueling outage.

16.

Palo Verde i An electrical fault EF: Faulty CT. MT:

CT Defective CT replaced.

EDGs started and

$28'86-003 occurred on the high _

Water leak, aside the A 10 percent sample of ~

energized the Class IE 20m.

voltage side 'of a 13.8V -

load center.

similar cts tested.

buses.

480V load center.

transformer, Due to a faulty CT, the SUT tripped resulting in scram of reactors-I and 2.

4, mJ r

f l

l l

e nf E

E E

s i

d dI r

u o

dI I

cg n

Ge n

s s o8 ai Di s

sf cn n n z

a a s e

s dla a

e ot io c

i a

g C

dl t

t dl n

E s

s b rl t

r e

a e u eC nCs lo tcs r uaI eC t

t ic d nb r

a d

r t h dheGs eeeeC a e a e e eE f

pR as nl r t h t

i e

a st et Mweif r o s o st n

idl t

r d

ig cn Gd d

oee n Gd r

s t

t e

a e eSt c n i a Dt oa s v

e Dz S

s a

zhP i nk e s Ei t

sdl i

si m

aeC Eg G gT.R sf a eC ucpsS g

tn t

r r

r e

er e es Des e nl l mcP e es e

h nu nun aa s

h a h nu axI mfod eI Teb h

E Tt Teb Eeb ot r

s t

d h

er d

g e

e e

t t

n a

~

i a

w nd.

g gme' v'

a l

i i

mp c

d e

.lt it c

s i e.

t s

d ed n

a t

e n

e e

a o

e r

f sh o

v ul r v vhluul d~

i t

op e

e l

v t

r nr mi it eh o r e e

a i

i e

c t

v gr c

e t

r aff xd8,

A in s w ot h

r wi d

e e n r

r d

t e

e lek.

m d

nt i

r e nr lte u

e e n dd f s e d

s

,at t

ur e s

,i oun e

c os no a o c e mt ao c.

s e

k uow f f lps ah s s

ys ccp as y o

os r e h a e

lane d m lpa r

r c s en r

u f

a el Wieh r

e rf no r

eac Re C

d pt Tt Rb r

r t

r ge tn nm e

i r

d r s m

o d p nf e e s

h y

lei e

us it u

n on c u la s

i q o

r a x r e

a FE N

Gt Eb R

r

)

tno e.

c r

d d

e r

e e

d ot e

f e es u

h

(

a p

ol h u e

d rl t

r sTa e

r o

ne c

rf eiay 2

e u leg s

q c

o ok f l u a

le le e v n ioh. e o

t ipb n a

t s

r a e eAeb b

nd ei a ur p

r s i

r r

d a

dd y

e ub e"

r r t

a n

. eh e

ue iob rl c e na y gt n

n T

oir.

t r

r oin c e caa s

luom ee af e ge f lel d a

r r ye t

a n

t i a b

eb d a r P

r f gr ei s cn e

or ot r.

t t

r e

P ek Aef Dxn ef e h d ce i

e

do o

ee v ne er r r ef Tpuu t

h e n su r

id s ee e v s

s s

n T:

gudi F:ipl l d e n u

e a

a E

o Fs a a

nr r aa nr a ii C

P cw Eit Mh orfom Et ff upt r

t t b r

r d

.d e e e.

e.i e

8 n

T k

r o i

.d n

3 fshd a

npr nToi Vt e C

e' l

r r 1

dg m

i e t

o r

e a

.ca f

a b nni ht ia a r us a e

s iord r n

k a s n

f.

e udt nt eeb r n t

t cr o

i od go nr 0 e y

s a

t r u 3 nr a guo mi o ul e

r s

t of y cc mb pet 2 et e, g p ip t

inp lt t

r gs c e x a e e

h e e ue a

a oar r t

r ir' v n gef eet k pp e ul c

ts t

sh nhb p s

et r

yt amc ot r

e h oama f

t t

i t

D T

g r s oas ol e

g d n o n ot s

d ak et cu lu ef a t

nU h eif o s ad o go i

t a

s r et a nt n

iS pt s n oes et n

ap r

t epul n r

nu ul da d f pe e

ue l

t hi aV r ar ea oil y ih o t

E Dh Tt f t k AgcDvd ph AtrTn t

I' 1

I 3

a e4 d5 d8 d 2 0

n0 n1 n4 d

D e -.

e0m.

e0 e0 t

0 a

r m

B 0

B -

B.

V 8 8

8 9

t 8 2 r8 2 r8.

e/.

r8 n

o/4.

i e/.

e/m 0

v8h v8 v8 a

la3h 54 54 5 m P

P5I R41 iR41 R46 i

l o

8' 9

0 7

N 2

1 1

1 ll

[ gi

,t j;

s' N

Table 2.J(cont.)

Failed No.-

Plant Data-Esent Description Cause Equipment Correctise Actions Esent Significance 21; Surry I.

Material blown from the PE-l: The material on Relay.

Replaced the defectise The EDG started and '

280/89-044 turbine roof caused a the roof was not relay.

energized the Class lE 16mc fault on the RSST. The -

secured properly. EF:

bus.

operator manually A relay failure -

tripped the reactor and prevented the tripping the turbine. The.

of the main generator generator was manually breaker.

tripped after 200 sec.onds.

22.

Vogtle -

While tramferring power DD: A CT was None Corrected the improper The EDG started and 425/89-023=

supply to a non-lE busi improperly terminated.

CT termination and energized the Class IE 4h.' 17m.

the incoming breaker.

reviewed other CT loads.-

tripped resulting in -

terminations.

power loss to one Class IE and various non-lE

.'t buses.

sg 23.

Waterford 3 '

While transferring power -

DD: The feedwater None The cup valve seat -

The EDG started and-

-t

-382/85-040 supply from startup to pump governor cup -

replaced. The breaker energized the Class IE' 2m.

auxiliary transformer, -

valve seat was -

control circuit under loads.

jT the incoming breaker -

undersized.'

review.

first closed and then opened.'The main-feedwater pump tripped from overspeed.

8 y

-w-.-

v

..-' '-m r

u.

,,v

',,1

2:

Table 2. (cont.)

?

Failed No.

Plant Data.

Esent Description Cause Equipment Correctise Actinns Esent Significance 24.

Wolf Creek.

Duri'ng maintenance PE-1: The technician None None The EDG started and 482/86-011 tests in the station performing the test energized the Class IE 40m.

switchyard, power to a failed to isolate the bus. Power was lost to-Class IE bus was lost breaker trip circuit.

several radiation L

which initiated a start of monitors which a turbine driven AFW initiated a containment pump, steam generator purge, control room blowdown and sample ventilation, and fuel line isolations and building isolation.

actuation of the A signals.-

shutdown sequencer which started the motor driven AFW pump A and the essential SWP A.

25.

_ Wolf Creek Dur'ng switchyard PE-1: Nonlicensed None None The EDG started and t

4982/86-44 maintenance tests, power utility personnel jarred energized the Class IE 0

3h. 43m..

was lost to a Class IE' a relay panel result ng bus. Power was lost to i

i bus which initiated a in opening of the Class several radiation start of a turbine driven

.lE bus supply breaker, monitors which feedwater pump, a steam.

initiated a containment-generator blowdown and purge, control room sample line isolations, ventilation, and fuel and actuation of the A building isolation shutdown sequencer signals.

which started the motor driven AFW pump A _

{

and the essential SWP A.

26..

Zion 2 During periodic testing PE-P. Subsequent tests -

None Test procedure revised.

The EDG started and 304-86_-0!!-

of the reactor protection.

indicated that during Additional investigation energized the Class IE -

'13h.33m; logic, the reactor tripped.

testing to existing on noise source b us.-

from high' power range procedure, the system continuing.

flux rate; The fast bus was subjected to noise.

transfer did not take' place.-

1

=

x m

v i

e-

~

v e

i Table 3. Total I.oss-of-Of fsite Power Caused by Plant-Centered Esents Under Plant Shutdown Operation Failed No.

Plant Data Esent Description Cause Equipment Correctise Actions Esent Significance 1.

Braidwood I During testing of the PE-l'. Misposition of a None SAT trip from deluge EDGs started and 456/87-048 deluge system, the SAT deluge system valve.

discontinued.

powered the Class IE

.5 3 m.

feeder breakers tripped.

DD: See corrective Mechanical guards buses.

action.

added to the deluge system. The procedure for surveillance test modified.

2.

Crystal River 3 Personnel touched a 230 PE-1: Grounding 230 None None EDGs started and 302/87-025 kV' feeder with a metal kV line with metal pole powered the Class IE 59m.

pole causing a loss of the.

buses.

unit SUT.

3.

Crystal River 3' Unit 3 SUT was under DD: SUT was None Control room EDGs started and 302/89-013 maintenance. Unit 1,2, overloaded.

annunciator added to powered the Class 1E 18s.

and 3 loads were fed notify operator if Units buses.

from Unit I and 2 SUT.

I and 2 SUT is loaded.

g Starting of a Unit I i

boiler feed pump caused a system undervoltage and actuation of ESF.

4 Indian Point 2 During a plant recovery PE-1: Relay personnel A bistable Failed devices replaced.

EDGs started and 247/85-016 following a reactor trip, tapped a relay box. EF:

and a relay powered the Class IE 20m.

all 6.9 kV buses were AFW pump trip was

buses, lost. Caused by tapping caused by a failed of a relay panel. One.

relay.

AFW pump tripped several times.

~

5.

Oconee 3.

During a refueling EF: The transformer None.

CT-3 oil cleaned. Three Keowee hydro units 287/85-002 outage, all auxiliary _

sudden pressure relay insulators on 4 kV bus started and energized 4 t h. 25m.

loads were being tripped CT-3.

and one neutral bushing kV buses.

supplied by SUT CT-3.

of CT-3 replaced. The -

A relay actuation sudden pressure relay tripped CT-3.

replaced.

x

+

.a

,i e

7 r

dE dE' E

Eo I

I t

r m

nI nI c

o p

g a

a s

s s

ot,n e

s a

t s

s s

s c

d a da da da e m

c oi i t r y a

rl l dli n

el el nl nl a

C rC aC aCd b i e' o

pl p er t

t d si ts a r t

r us c

a a

ed

,pce rb r y

e e

d e d et n mgu as e e

i t

t f

sh sh eh eh i t

n o rl a oa s

a a eot i

g Gd Gd ad adi o o inn r

t t

t t

t t t n

s s

r r

t s

a c wt w n e t

e t

e n gi r

z s z s zI n iol ng c

i De e

S Dz.

Ei si si

.i la lot it idi ri t

conga e i

r n e E gs gs gs r id eal lod c

tn r e r e Gr e Grgsdi el t

t e

e e

v esi nnnt e s es Des Dnuueoo aou on e l i i

h nu h nu r

nu E

Teb Teb E eb E ebb vccwib cas s

m t

d.

s n ee o d.

r gsf e

e y

ne ll s

c a

a r n e

n a

h po s

l io lp c ot lb o n

e i

e r

u e

e nt a w

tc r

r A

le i

igd e ic v

s e p e.

ns t

s t

e b

c e n os oa l

it c

f d.

d es io pu s

a e

c ee l

mu n sd d

d c a

o e i e

r eio v

r r

le a

r el r i ei el

~p u d d

o ia h p s

e empa h

n C

F Tr Si s r Ti w

tne m

d p lei le e

e e

u b

n n

n i q a

o o

o a

FE C

N N

N

)

tn r

o s s e

c e

f

(

le y

ol r

e o

a u

a i

n b

d n da ig e.

a le a g s

e gT n t

3 C

r ri t

c c n oe h m s

e t

v.

d oiCe nf e

le

. g t

s rl n

le u pl e

f nt b

lui id T

f u.

c e h io as ed e sh

o. sy t

a r

t oTt id e a

t h

en r

s s s s d

o u

en r

h e d n t

e o

oi n

t i c. get ge p

al r

v s

di r

t a

lb e pc Ad n

r ni s

e Cal Au

d

er ai u t

l e at agl n

l a

enrd dh c b

r e

Pi pi aei c e s

1 a

f s

u mpcs mt F: l Ea Eqm t

u s

a u

eon eo a

a Fa r

n eue r r oh r C

Edi Em Pc P rjt ppct p 6

t r

t e

r 1

a sh n

Te 4

t f

a s at o

Um F

o s

p d

dt i

r r

r n S o n e -

erh n a 4

dei n

l

~

n ff o

no d

emg uTpot aoy t

a e

s i

pt n

rr r n pS c wnie' s t it i

oea eoi S r a m

o f

p eNt e gi d i

lt id r ff lt a

t r r nt n s t

es u r

us r n sP a ee eol a a

c e

u.

paeO nhfsh a s s

ayh e

s s

o l

• . r sd r r t

nu.

f e

r t

rt O

e nT ioos D

lea ee r t d d ges z u

d dd

.d a

iim n eL ne rTeSt b

e nv ui o

r t

g np rb f opl opt pS a a e n

a i

r i

pa cpsS psi vt e

c op r e e

l t

t ci usVn uSiSinf y s

er l

ai t ir i

E As Derk e At r o At bRtrNios t

st t c

1 n

d 0

n6 d2 3

u a

a0 n0 0

a 1

t s0 e0 m0 e

l a

0 m D

m90 m.

B m.

a -.

m I

e5 6

h7 m t

i8 2 i81 r8 9 e8 4

n

/

/2 e/4 r / 6

+

r r

l lg3h.

ia2 iv8 h2h.

u a

o2 95 r8h 5h P

iP21 P22 R4t S32

-e o

N 6

7 8

9.

J v

$,y w

w i

m Table 3 (cont.)

Failed No.

Plant Data Event Description Cause Equipmen t Correctise Actions Eient Significance 10.

Shoreham.

The NSST tripped PE-1: The technician None The event report was EDGs started but did 322/87-026 during a relay.

failed to pull out a read by I&C not load as slow bus 20 cycles calibration. The fast bus relay prior to the test.

management and relay transfer was -

transfer was inhibited.

supervisors and -

successful.

l-The slow transfer took technicians.

place. Numerous ESFs initiated. The reactor building standby ventilation and the control room air conditioning system chillers became inoperable.

11.

Wolf Creek 1 During execution of PE-l> The individuals Switchgear Strong recommendations-EDG started but the -

482/87.-048

' maintenance work, a involved failed to '

XNIl02 for prejob briefing EDG breaker did not

1 15m.

technician was follow procedure to issued.

close.

LM electrocuted resulting in check the power supply l1 a fire in Class IE bus -

before working on Nil 02. In trying to clear:

4160V switchgear.

the fault, the operator-;

tripped the remainiag'.

Class 1E bus.

k 4

.m

s..m um' m

.m' 2

.c

-u-

+,

w m

c Table 4. Partial 1.oss-of-Offsite Power Caused by Plant-Centered Esents linder Plant Shutdown Operation Failed No.

Plant Data Esent Description Cause Equipment Correctise Actions Event Significance 1.

Arkansas 1 LOOP occurred twice PE-1: Exact cause could None Senior management and Reactor coolant system 1 313/89-043 during manual bus not be established.

supervisory personnel temperature increased 15m.

transfers. During the Likely cause operator addressed operating from 103 'F to 120 *F.

second event, the decay error.

crews on i

heat removal pump was professionalism, 4

lost for 9 minutes.

formality, attention to details, and safety.

2.

Browns Ferry I While inspecting floor PE-1: Unauthorized None Responsible personnel Initiated half scram 259/86-029 penetrations, personnel opening of the PT received disciplinary signal on RPS, 27m.

erroneously opened PT cabinet door.

action.

containment isolation cabinet which tripped groups 2, 3,6, and 8.

the normal feeder Unit 1,2, and 3 refuel breaker to the bus.

zone isolation, control room emergency ventilation and SBGT.

t-EDG started and Y

powered Class 1E bus.

3.

Browns Ferry 2 An electrical fault on a DD Inadequate 4160V bus, Preventive maintenance Lost three RPS MGs 260/89-008 unit USST led to the loss insulation above the bus duct, practice reviewed, and RPS buses IB,2A, 16m.

of a shutdown bus. The bus duct. The design of and.

design changes initiated, and 2B. Unit I half.

alternate feed to this bus the bus duct allowed transformer and corrective action scrammed and Unit 2

~

was tagged out for collection of water bushing plans initiated for this full scrammed.

maintenance.

from condensation.

connections.

transformer and other Containment isolation t

M T: Vendor transformers.

groups 2, 3,6, and 8.

recommended SBGT trains A, B, and preventive maintenance C, CREV trains A and was not performed.

B, and Units I,2, and PE-I: Multiple 3 refuel zone isolation abnormal electrical actuated.

system alignments and inadequate.

communications led to inappropriate actions.

1 E

m

-- -.c

-v*

--'m---

w

+

-,w.r-

.g.

q.,.

s

Table 4. (cont.)

Failed No.

Plant Data -

Esent Description Ca use Equipment Correctise Actions Esent Significance' 4.

Brunswick i During maintenance PE-1: An electrician None The electrician EDG 2 started and 325/87-027 work on SUT breaker actuated a breaker received appropriate powered bus E-2.

17m.

compartment, Class 1E linkage resulting in

training, bus E-2 tripped.

power loss to bus E-2.

5.

Callaway 1 During a manual bus PE-1: Wrong breaker None Procedure to be Control room 483/86-005 transfer, a Class IE bus was energized.

revised ventilation, fuel Im.

was transferred to a building ventilation, dead power source.

and containment purge isolation occurred.-

6.

Catawba 1 During a bus transfer EF: The differential None None EDG started and -

413/86-055 test, a 6.9 kV--1.16 kV protective relay of the powered the Class iE 37m.

transformer tripped transformer operated.

bus, resulting in loss of The cause of the relay power to a Class I E bus.

operation could not be established.

E 7.

Catawba 1 On start of a RCP, PE-1: A ground None Relays swapped and 1.oss of all ac at a Class -

3 413/89-001 power was lost to a Class overcurrent relay was recalibrated.

I E bus.

28m.

.lE bus. The associated swapped with a time

'f EDG was out of service delay overcurrent relay.

resulting in a loss of all ac to that bus.

8.

Diablo Canyon 2 During a' functional test PE-P-Because of lack None Electrical craftsmen EDG started and 323/88-012.

of UAT relay, the UAT of procedures, trained and powered the Class IE 46m.

tripped.

technicians improperly memorandum issued.

bus.

tapped test power from UAT differential relay-circuit causing the-l relay to trip.

9.

Fermi 2 A ground fault tripped eft A transformer Transformer Failed bushing '

powered the Class.lE EDGs started and 341/89-003 the system service bushing failed?

bushing replaced.

l' 20m.

transformer.

buses.

--n-,

v

,v

~,,

--e

.s Table 4. (cont.)

Failed No.

Plant Data Esent Description Cause Equipment Correctise Actions Esent Significance 10.

liarris I While one of the two EF: Protective relay None None EDG started and 400/87-059 incoming power lines to tripped from vibration powered the Class IE t h. 5m.

I A SUT was out of of the adjoining panel bus.

service for undergoing modifications, the modifications.

remaining line tripped.

11.

McGuire 1 While one UAT was DD: Relay setting too None Undervoltage relays EDG started and 369/86-011 under maintenance, the high.

replaced by lower powered the Class IE 2h. 42m.

second UAT tripped on pickup relays.

bus.

undervoltage signal.

12 McGuire 2 With the plant in mode EF: The overcurrent None Relay malfunction was The Class I E bus 370/85-007 6, the breaker feeding relay for bus IETA investigated but the 2 ETA lost all ac.

12m.

offsite power to Class IE tripped for unknown cause could not be bus 2 ETA tripped. At reason.

established.

i that time, the associated O

EDG 2A was under maintenance.

l 't Millstone i Prior to switching out PE-1: Design error None Interim design modified.

EDG started and 245/89-012 the RSST, all auxiliary caused during interim powered the Class IE 30m.

loads were fed through modification for bus 14E.

the NSST and the main maintenance work, transformer. During switching out operation of the RSST, the power source for NSST tripped.

14.

Millstone 3 Class IE bus 34C lost, PE-1: Cleaning activity None Signs and tapes posted EDG started and 423/87-038 offsite power supply due caused relay contact and personnel informed powered the Class IE 40m.

to mechanical shock.

bounce tripping power about sensitive relays.

bus 34C.

supply to bus 34C.

=

Table 4. (cont.)

Failed No.

I'lant Data Event Description Cause Equipment Correctise Actions Esent Significance 15 North Anna I,2 During a switchyard PE-l: An electrician None Procedures modified EDGs started and 338/89-010 modification, offsite inadvertently grounded powered the Class IE 16m.

power to Class I E buses a control wire causing buses ill and 2J.

111 and 2J was lost due the LOOP. PE-P: Lack to a ground fault. RilR of adequate procedure.

pump was lost for about 5 minutes.

16.

Palo Verde 1 SUT tripped due to a MT: Dust accumulated Bus duct Failed components EDGs started and 528/88-003 fault on a 13.8 kV bus inside the failed bus and CT replaced. cts being powered Class IE 2h.41m.

and a CT. ESF actuation duct, and water seeped replaced by cts with buses. Italf leg trips and loss of radiation in. DD: CT insulation better insulation.

received on monitor occurred inadequate.

containment isolation, resulting in actuation of SI, containment spray, control room essential and recirculation filtration, containment actuation signals.

I purge isolation, and fuel U

building essential ventilation signals.

17 Palo Verde I While replacing a relay, PE-I: The electrician None None EIXi started and 528/88-019 power to a Class IE bus caused a ground fault powered the Class IE 37m.

was lost. This actuated while working in a bus.

train B FBEVS and restricted area.

CREFS signals, which tripped trains A and B FBEVS and CREFS.

18.

Peach Bottom 3 During maintenance of PE-l: Probable cause -

None Cause of the event EDGs started and,

3278-88/009 _.

Class IE bus 23, the electrician error.

investigated but could powered the Class IE 30m.

~~

feeder breaker to the bus not be ascertained.

bus, tripped unexpectedly.

Four outboard Group 11 and 111 primary containment isolation system isolation valves closed.

Table.s. (cont.)

Failed No.

Plant Data Event Description Cause Equipment Correctise Actions Event Significance 19.

Quad Cities 2 A fault on the reserve PE-1: The personnel Line Replaced damaged EDG started and 265/85-01I U AT developed as lowering the cord were insulators insulators.

powered the Class IE 43m.

personnel lowered a.

unaware of the danger.

damaged.

bus.

power cord close to the transformer. The fault created a transient on the electrical system resulting in a loss of the RPS bus and a lock-up of a feedwater regulating valve.

20.

River Bend While installing a spare PE-1: Lack of None All relay department EDG started and 458/89-029 transformer, technicians communication personnel retrained, powered the Class IE 24m.

shorted two live leads between the supervisor Panels labeled.

bus.

resulting in loss of a and the technicians.

8 preferred transformer.

O ESF actuated resulting in ~

start of Division I and 11 -

SBGT, annulus mixing.

and fuel building ventilation filters.

Various containment isolation. valves closed.

21.

Sequoyah During a thunderstorm, MT: Mixture of flus duct and -

Repaired damaged Four EDGs started and 328/88-034 the 6.9 kV start bus moisture and duM breaker components.

powered the Class IE 41m.

flashed over resulting in caused short circuit compartment.

buses.

loss of several 6.9 kV inside the 6.9 kV start Class IE buses. Lost bus.

cooling tower lights and pumps, and plant security computers.

Table 4. (cont.)

Failed No.

Plant Data Event Description Cause Equipment Correctise Actions Esent Significance 22.

South Texas i Following a fire, PE-1: Operator slipped.

None None One EDG started and 498/89-006.

operators were bleeding powered Class IE bus.

Ih. 7m.

air from the generator circuit breaker. One operator slipped and tripped the main transformer, Train A Class IE buses, and all non-Class IE buses.

23.

South Texas 2 Following replacement PE-I: An operator None Developed procedure for Two EDGs started and 499/89-001 of a ST heat detectors, restored the deluge fire protection panel powered the Class IE 25m.

the deluge system was system without restoration. Operators buses.

being restored. An resetting ST detector briefed. Deluge nozzles actuation of the deluge alarm. PE-P' Lack of repositioned.

system occurred procedure for resetting 8

resulting in a loss of ST.

alarm. DD: Inadequate setting of deluge e

i nozzles.

24.

South Texas 2 During a thunderstorm, EF: Failure of lightning Lightning All lightning arresters Two EDGs started and 499/89-005 a ST lightning arrester

arrester, arrester for ST replaced.

powered the Class IE lh. 22m.

failed resulting in a loss

buses, of ST and two ESF buses.

25.

South Texas 2 Four seconds after PE-1: Improper wiring None Generator relay wiring EDG 21 started and 499/89-029.

generator of generator relays. EF:

corrected. Broken lug powered Class IE bus 6m.

synchronization to the RCP tripped because of-repaired.

E2A.

grid, the _ reactor tripped -

a broken lug in control causing a LOOP to circuit.

auxiliary buses and Train A. ESF bus. RCP ID tripped after j

energization.

.e

w

.e_

t' Table 4. (cont.)

.c h

Failed No.

Plant Data Esent Description Cause Equipment Correctise Actions Event Si;tnificance 26.

Sout Texas 2 While checking the main EF: A component 01- ? meter The meter was needed EDG 21 started and -

499/89-014 generator protective failure inside generator for testing only. It was powered Class IE bus :

S i m.

circuit with the phase angle meter removed. The EDG fuel E2A.

generator m.,a and field backfed voltage to linkage corrected.

I breaker open, the high generator protective voltage breakers feeding relay. EDG failed due the main transformer to misadjustment of tripped resulting in an fuel rack actuation q

offsite power loss to ESF linkage.

bus E2A. One nonsafety-related EDG failed to start.

27.

Surry l During a manual bus MT-The incoming Gattery Necessary maintenance,

'Two EDGs started and 280/89-005 transfer, the incoming breaker failed to close repair, and adjustments powered the Class It' 31 m.

breaker failed to close because of dust and performed.

buses.

8-resulting in LOOP at two dirt. EF: Backup 1

Class IE and two non-service air compressor Class lE buses.

failed because of low Subsequently, more oil pressure. Loss of buses tripped on memory and SPs to i

undervoltage. The monitors was due to a

~

running RiiR and failure of backup component cooling water battery supply.

pumps tripped. Backup service air compressor failed to start. Memory and SPs for process and ventiiation vent monitors were lost. Sample pumps for containme.it particulate and gas b

radiation monitors tripped.

4 ein -

Table 4. (cont.)

h Failed No.

Plant Data' Esent Description Cause Equipment Correctisc Actions Esent Significance 6

28; TMli During a manual bus EF: The breaker fault 4160V Circuit breaker replaced.

Iffsite power was 289/86-008-transfer, the incoming was due to a circuit quickly restored on all 3hJ25m.

circuit breaker component failure.

breaker.

buses except for the developed a ground fault faulted bus.The EDG resulting in a IGss of the started but did not incoming transformer, load because of the bus RCPs, and secondary fault.

plant components.

29.

TMII During Appendix R PE-P: Inadequate None None The EIX3 started but.

289/87-001 modification work, a instruction to the did not load because of 8 m.

technician opened a CT operator.

the operation of the circuit in IE bus which overcurrent relay.

energized a neutral overcurrent relay and tripped the I E bus.

a 30.

TMt1 During maintenance, an MT: The relay wires None None The EDG started and

-t.

289/87-002 electrician replaced ac were not properly powered the Class I E 13m.

improperly placed relay terminated bus.

cover which tripped the l A auxiliary transformer.

1 31.

Turkey Point T While closing a relay PE-I; Vibration from.

None Technician cautioned.

EDG 3 A started and 250/85-012 panel door, the main -

closing the door tripped powered the Class IE;

$h 35m transformer, tt:e.

a lockout relay.

bus.

auxiliary transformer, and bus 3A tripped.

32.

ay Poim 4 During construction PE-1: Inadvertent None Construction crew EDG'13 started but did.

2r 36-007-activity, the lockout.

jarring of the relay.

cautioned.

not load because of' 59nt relev for 4160 V bus 4B.

operation of the wa' actuated resulting in lockout relay, loss of the transformer

, feeding this bus.

e wm.

-r-i ew-w e-te-- w a

e r-mma

___u__.__-*As__*._,___1 m-a, w

.ns' Table.8. (cont.)

17 ailed No.

Plant Data Esent Description Cause Equipment Correctise Actions Esent Significance 33.

Yankee Rowe While modifying the PE-1: Excessive None None EDG started and 29/87-008 control room main vibration produced powered the Class IE 3h50m.

paael, the SST tripped.

while cutting a hole on bus.

control panel.

34.

Yankee Rowe During testing of the PE-P: Deficient test None This test is a one time EDG started and 29/88-010 generator exciter field, procedure caused this event. Procedure powered the Class IE 2h. 22m.

two Class IE buses were event. EF: The tie checked with the bus.

lost. Subsequently, breaker failed because manufacturer.

during return of power of failure of breaker from normal source, the trip linkage.

bus tie breaker did not close.

I M

i Table S. Duration of 1.oss-of-Offsite Power Plant Power Total or Number of No. of Esents Total I.OOP Aserage LOOP No. of Esents Table Condition Partial LOOP Events ~

< 30 m.

Duration Duration

> 6h.

1.

Power Total 15 2

70h. 36m.

4h. 42m.

3 2.

Power Partial 26 9

164h. 58m.

6h.21m.

5 3.

Shutdown Tctal 1I 4

25h. 28m.

2h.19m.

1 4.

Shutdown Partial 34 14 35h. 49m.

I h. 3 m.

O TOTAL 86 29 296h. Sim.

3h. 27m.-

9

Table 6. Analysis of LElt Event Causes Plant Total or Equipment inadequate Power Partial Atalfunctions er Staintenance Table No.

Condition LOOP Personal Errors Failures Design Deficiencies Practices No Percent No.

Percent No.

Percent.

No.' - Percent 1.

Power Total 13 18 6

22 6

22 2

8 2.

Power Partial 11 33 13 40 5

15 4

12

' 3.

Shutdown Total 7

59 4

33 1

8 0

0 4.

Shutdown Partial 22 57 8

20 4

10 5

13 TOTAL 53 48

-31 28 16 14 Il 100 i

8 I

Table 7. Plant Centered LOOP Event Significance Number of Number of blaximum ASP Table No.

LOOP Type Condition Events ASP Esaluations CCDP 1.

Total LOOP at Power 15 8

4.3 E-4 2.

Partial LOOP at Power 26 1

1.3 E-5 3.

Total LOOP Shutdown 11 3

7E-5 4.

Partial LOOP Shutdown 34 0

,.i..

,