ML20071A637
| ML20071A637 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 01/31/1991 |
| From: | Meyer O EG&G IDAHO, INC., IDAHO NATIONAL ENGINEERING & ENVIRONMENTAL LABORATORY |
| To: | NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| Shared Package | |
| ML20071A636 | List: |
| References | |
| EGG-HFRU-9476, NUDOCS 9104160408 | |
| Download: ML20071A637 (19) | |
Text
_
.. ~ _. _ _ _ _ _... _ _ _
_,,..._.m__.
4 b
i EGG.HFRU 9476 i
TRIP REPORT:
ON SITE ANAL.YSIS 0F i
THE HUMAN FACTORS OF AN EVENT AT HILLSTONE 3 i
ON DECEMBER 31, 3090 (TURBINE BUILDING P192 BREAK)
Orville Meyer.
Investigative Team:
- James Trapp, NRC/ Region 1 David Jaffee, NRC/NRR-Herbert Kaplan, HRC/ Region I Stephen Koscielny, NRC/NRR Tom Shediosky, NRC/ SRI Haddam fleck Eugene Trager, NRC/AE00 Jimi Yerokum, NRC/ Region (
I.
Orville Meyer, INEL l
- Team-Leader l
~
l Put11shed January 1991-s Idaho National-Engineering Laboratory l
EG&G Idaho,-Inc.
P. O. Box 1625 L
Idaho Falls, ID 83415' t
Prepared for the-Office for Analysis and Evaluation of Operational Data U.S. Nuclear-Regulatory Commission Washington, D.C.
20555 under DOE Contract No. DE AC07-761001570 9104160400 910404 PDR ADOCK 05000423 S
. ~
. ~ -
EXECUTIVE
SUMMARY
l i
At 4:33 p.m., December 31, 1990, a pipe break occurred in the turbine l
building at M111 stone'3.
The operators responded promptly with a manually f
initiated turbine trip and a manually-initiated main steam line isolation f
trip.
NRC Region I formed an Augmented Inspection Team-(AIT) to investigate l
the event.
The Ali leader was James Trapp, NRC Region I.
Other NRC staff f
members of the AIT were David Jaffe, NRR; Herbert Kaplan, Region I; Stephen l
l Koscielny, NRR: Tom Shedlasky, Region'It Eugene Trager, AE00; and Jimi t
l Yerokun, Region I.
Orville Meyer, Idaho National Engineering Laboratory (INEL) provided assistance as part of an AE00 program to study the human factors of operating events.
The AIT conducted an on site investigation from l
l 1
January 3 to January 7, 1991.
This trip report provides a review of the operational details of the event and an analysis of'the human factors that f
were part of the event.
On December 31, Millstone 3 was at about 86% power on the last few weeks of a power coastdown cycle before refueling. At approximately 1:30 p.m..
December 31, a pencil sir.ed leak was identified in the discharge piping of the moisture separator drain (DSM) pump A.
This-piping is 6 inch carbon steel and-carries 380"F water at a nominal pressure of 600 psig and velocity of.17 ft/see to the condensate header. The leak was a through wall leak immediately downstream of a flow control valve.
The area of the leak was examined visually by maintenance engineering, a Unit 3 plant engineer,' and operations-management.
It was decided to isolate the leak by using manual valves upstream and downstream of the'1eak, allow the pipe to cool,-and inspect and repair the pipe.
The evening shift (3:30 11:30 p.m.) proceedad to carry out the isolation of the pipe.
The shift control operator (SCO) elected to personally:
close the two manual valves. He closed the' valve on the pump side of the leak and then moved to a phone box about 20 ft distant where he contacted the balance of plant control operator in the control room and directed him to turn off OSM pump A.
The leaking pipe ruptured immediately after DSM pump A was turned off.
In addition, the discharge pipe for OSM pump 8 ruptured at i ll r
y
+m
.ie-y s
r-M-
/
appars.stly the same time.
Subsequent investigation found that the inner wall of both pipes had been thinned by an erosion / corrosion mechanism.
The SRO was sprayed with moisture and rust but was not injured. He made his way through the turbine building, which was rapidly filling with steam, and to the control room where he ordered a manual reactor trip.
The reactor trip and manual steam line isolation trip were executed by the control room-operators within two and-a half minutes of the pipe rupture.
The most pressing problem was the loss of instrument air to air operated valves within the containment.
The moisture in the turbine building had caused a loss of electrical power tc an ele.trical to pneunsMc (1/P) converter which in turn closed an isolation value in the instrument air line.
The loss of instrument air closed the letdown vt.lves and the pressurizer spray valves.
The immediate response of the operators waJ to reduce charging to the minimum required by the reactor coolant pump seals and to assure that pressurizer pressure control by the PORVs occurred.
Teamwork by the operators and instrument an( control technicians then successfully diagnosed the problem and devised an expedient method of resolving it.
This provides an example of successful, knowledge based, problem solving.
The plant operators responded well to usher prv,tm caused by the pipe ruptures, principally, the rising water level in 500 turbine building from the ruptured condensate system and froiw melted fire sprinkler heads and the failures and grounds in non class 1E electrical load centers.
The response to these problems appeared to have been well prioritized and coordinated.
l The root cause of the event was human error in applying a computer program to identify piping in the secondary systems that might be suNect to ero* ion corrosion.
Evidently, the results of the computer program had not received final engineering validnion, nor had there been a follow up review of progress of the program.
The risk to personnel that was evidenced by the through wall pipe leak was not recognized nor controlled.
The SCO and several other plant staff iv
n personnel were near the leaking pipe and exposed to risk in the approximately I
3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> between disenvery of the leak and the pipe rupture.
In addition, command and control was diminished when the SCO elected to manually isolate the leaking pipe by himself.
In doing so he was out of direct communication with the control room and out of contact with any other operator.
His escape from the turbine building and resumption of control room command facilitated the prompt response of the operators.
i 0
l l
l l
-V_
u
c 4
4 ACKNOWLEDGEMENTS We express appreciation to the Millstone 3 staff for their cooperation in providing the type of information necessary to analyze the human factors of the operating event 4 We particularly thank the operators who were on duty during the evening shift for their cooperation during-the interviews.
l I
i
.. i,
-v i.
t CONTENTS EXECUTIVE
SUMMARY
111 ACKNOWLEDCMENTS.....>.................................................
vi i
ACRONYMS.............................................................. viii i
1.
INTR 00VCil0N.....................................................
1 l.1 Purpose.....................................................
I 1.2 Scope.......................................................
I 1.3 On. site Analysis Team.......................................
I 2.
DESCRIPTION OF THE EVENT ANALYSIS...............................
2 2.1 Background..................................................
2 2.2 Time line of the Event......................................
4 2.3 Analysis....................................................
9 2.3.1 Operator Response...................................
9 2.3.2 Diagnostics and Decision making.....................
9 2.3.3 Control of Risk to Personnel........................-
10 2.3.4 Command and Control...........-......................-
11-2.3.5 Human Error.........................................
11 3.
SUMMARY
OF FINDINGS..............................................
12 i.
l vil
1 ACRONYMS ADV atmospheric dump valve AEOD Analysis and Evaluation of Operational Data
~
Ali augmented inspection team BOP Balance of Plant Control Operator BWR boiling water reactor OSM moisture separator drain EPRI Electric Power Research Institute 1/P electrical to pneumatic ILC instrumentation and control INEL idaho National Engineering Laboratory M$ly main steam isolation valves MSLI main steam line isolation NRC Nuclear Regulatory Commission NRR Nuclear Reactor Regulation PE0 plant equipment operator PORV power operating relief valve PWR pressurized water reactor RCP reactor coolant pumps R0 Reactor Operatcr SCO Shift Coi. trol Operator SS Shift Supervisor SSSA Shift Supervisor's Staff Assistant l
vill
~
1.
INTRODUCTION 1.1 Puroote Nuclear Regulatory Commission (NRC) Region I formed an augmented inspection team (AIT) to investigate the turbine building pipe break and subsequent manual reactor trip, which occurred at Hillstone 3 on December 31, 1990.
During that event two 6 inch moisture separator drain (DSM) pump discharge lines failed catastrophically while the plant was operating at 86%
power, releasing 380'F water from the condensate system.
This report describes the results of on site analysis of the human factors involved in that event.
1.2 Lt9pk The human factors study focused primarily on the actions of control room operators during the December 31, 1990, pipe rupture event at Millstone 3 based on data from discussions, plant logs, and interviews with control room operators and other station staff.
Idaho National Engineering Laboratory (INEL) provided assistance to the AIT as part of the Analysis and Evaluation of Operational Data (AE00) program to study the human factors of operating
- events, i
1.3 On site Analysis f
The on site Ali consisted of:
l JamesTrapp,NRC/ Region 1(TeamLeader)
David Jaffe, NRC/ Nuclear Reactor Regulation (NRR)
Herbert Kaplan, NRC/ Region i Stephen Koscielny, NRC/NRR Eugene Trager, NRC/AE00 l
Tom Shedlosky, NRC Haddam Neck Jimi Yerokun, NRC/ Region i Orville Meyer, INEL.-
The team was at the Millstone 3 site from January 3 to January 7, 1991.
~l
2.
DESCRIPTION OF THE EVENT ANALYSIS i
2.1 Backaround The Millstone Nuclear Station is located on Long Island Sound near the town of Niantic, Ccnnecticut.
There are three units, essentially independent, with a separate,ontrol room for each.
Unit 1 is a 660 MWe BWR that began commercial operation in 1971. Unit 2 is a 8/0 HWe combustion engineering PWR that began commercial operation in 1975.
Unit 3 is a 1154 MWe, 4 loop, Westinghouse PWR that began commercial operation on 4/23/86.
Unit 3 was in an end of cycle, power coastdown operation with a refueling shutdown planned for February 1991.
The pomir level at the time of the event was approximately 86%.
The pipe break occurred in the OSM system, which returns water collected by the turbine generator moisture separators to the condensate header, which also serves as the suction header for the main feedwater pumps.
There are two DSM pumps, 30SM PIA and 30SM PIB, which discharge through individual flow control values and 6 inch, 600 psig, carbon steel pipes into the condensate header.
The flow in the 6 inch discharge pipes consists of 380'F liquid at a nominal velocity of 17 fi/sec.
The Ali found that the;e flow conditions made these 6 inch pipes susceptible to thinning of the pipe wall by erosion / corrosion. Millstone 3 had reviewed piping in the secondary systems for susceptibility to erosion / corrosion using guidelines provided by EPRl; however, these two 6 inch pipes were not identified as susceptible due to human error in the application of a computer program for use of the Electric PowerResearchInstitute(EPRI) guidelines.
Both 6 inch discharge pipes failed essentially simultaneously.
The 3DSM-PlA discharge pipe failure opened about half of the pipe circumference, while j
the PIB discharge pipe suffered a complete break.
'he pipe breaks permitted 4
the condensate system to blow down through the condensate header and back I
through the failed 6 inch pipos. The pipe breaks were preceded by a pencil-size leak that existed for at least three hours.
2 I
-=c.= - "
The Millstone 3 staff had previous experiences with relatively minor steam leaks in the secondary system.
At least one of these had been a leak 9
through the wall of a pipe rather than through a mechanical seal.
The leak had been caused by jet impingement from a smaller pipe, which was fed into the larger pipe.
The consequent thinning of the pipe wall was localized and did not cause significant weakening of the strength of the piping section.
The pipe breaks on December 31, 1991, occurred about an hour after the evening shift (3:30 to 11:30 p.m.) had assumed control.
The control room crew consisted of:
Shift Supervisor (SS), Senior Reactor Operator (SRO) licensed Shift Control Operator (SCO), SRO licensed Reactor Control Operator (RO), R0 licensed Balance of Plant Control Operator (BOP), R0 licensed Shift Supervisor's Staff Assistant (SSSA)
These operators had worked together on this crew for approximately two years.
The B0P had been a licensed operator since 1987, while the SS, SCO, and R0 had been licensed operators at Millstone 3 since the first nuclear operation in 1985.
The SCO had 10 years experience on nuclear submarines prior to joining the Millstone 3 staff.
TheSCOwasintheturbinebuildingincloseproximity(approximately 20 ft) to the two 6 inch pipe sections when they ruptured. He was on a phone l
communicating with the BOP, who had just turned off pump 3DSM PIA, when the pipes ruptured.
This helped define the time of the pipe break.
The SCO exited from the turbine building with some difficulty but without harm and entered the control room in about 2 minutes.
He reported a steam leak in the turbine building, and a manual reactor trip and main steam line isolation were promptly initiated.
3
I 2.2 Time line of the Event The following event time line sequence was developed from interviews with the control room operators and the duty officer, copies of control room logs, and data derived from the plant computer by the Millstone 3 staff.
2.2.1 12/31/90 1:00 p.m.
The management duty officer began a tour of the turbine building and did a complete walk.through of the concrete floor (elev 14 ft 6 in).
Upon his return to an area where mechanics were at work he noticed a growing puddle of hot water.
The mechanics confirmed that the leak was growing rapidly.
The duty officer obtained the help of the turbine bJilding plant equipment opentor (PEO) and found the leak was coming from under the thermal insulation package around flow control valve 30SM LCV.
20Al, which is located above the turbine building mid level (elev. 38 ft 6 in) and below the concrete operating floor (elev.
64 ft 6 in) and is accessible by ladders and catwalks.
2:30 -
Ouring this period the control room was notified of the leak.
l 3:30 p.m.
Maintenance workers removed the insulation package from valve j
30SM LCV 20A1, and a visible, pencil sized jet of steam and liquid was seen shooting upward from the pipe wall about four inches from the outlet port of the flow control valve.
The area of the leak was inspected by the duty officer, the maintenance supervisor for the turbine building, a maintenance engineer, and an engineering supervisor.
The leak was discussed with the Hillstone 3 Superintendent.
The decision reached was to (a) isolate the leak early on t % tvening shift by shutting manual valves 3DSM V4 and V7 and (b) allow the pipe to cool down for-inspection and repair.
(This action would permit the repairs to be made while continuing power generation since the flow from moisture separator drain tank 30SM TKlA could be diverted directly to the 4
~
.. ~
I condenser through valve 30SM V17.
Evidently there was no remark or discussion of the possible haanrd posed for personnel by the leak or of the possibility that the leak could be an indicator of an impending f ailure of the pipe.
The manual valves that were to be closed for isolation of the leak were in the immediate area of the leak. Use of remotely operable valves for isolation of the leak would have required a shutdown from poweroperationtohotstandby.)
i 3:30 p.m.
The evening shift assumed control room duty responsibilities.
4: 15 p.m.
The SCO elected to isolate the leaking OSM pipe section and went (approx) to the locatice of the 30SH V4 valve between the 30$M PIA pump and the flow control valve. He was unaccompanied and the turbine building PE0 was unaware of his presence.
After closing 30$M V4 the SCO went to a ' Hear Here" phone box located on a grating duck above the DSM piping, approximately 20 feet distant from the leaking pipe.
He contacted the 80P in the control room and directed him to-turn off pump 30SM PIA.
4: 33:49.66 The BOP tripped the breaker for 30SM PIA.
The S0P was still on p.m.
the phone witt *he SCO and heard a loud exclamation from the SCO, and then 6he phone went silent.
4:33:52 p.m.
The steam flow greater than feedflow mismatch alarm sounded for all four steam generatnrs.-(feed pumps had lost suction pressure.)
4:33:52.84 The bus 32A ground alarm sounded.
p.m.
4:35:14.968 Main feedwater pump A tripped on low suction pressure.
I p.m.
4:35:15.96 The feeder breaker for bus 32A tripped open.
p.m.
5 l
~.
m.,
n_
4:35 p.m.
The SCO had been near enough to the ruptured pipes to have his shirt thoroughly wetted and covered with rust from the internal wall of he pipe.
However, he was not burned. He was concerned about a safe route for exit fros: 'he turbine building, which was filling with condensed steam. He exited using the concrete main operating deck, which provided some protection from the steam.
The SCO re entered the control room, reported a major steam leak in the turbine building, and ordered a reactor trip.
4: 35:45.72
he RO manually tripp*
.. or, The RO recommended initiation of a mati, s. 4m line isolation trip.
p.m.
4:35:45.id4 The turbine was tripped automatically by the reactor trip. This greatly reduced condensate flow to the hot well and out the o. n.
break.
4:35:46.26 The motor driven auxiliary feedwater pui.ips A and B started p.m.
automatically and provided feedwater flow to the steam generators from the domineraliztd water storege tank.
4: 36:03 p.m.
The main steam isolation valves (MS!Vs) were closed by the manual main stream line isolation (MSL1) trip. Closing the MSIVs prevented any steam from the steam generators from feeding the break flow through any secondary system path.
1 4:38:13.548 inverter 6 was lost, resulting in loss of the plant computer p.m.
logging of plant parameters.
(This meant a loss of computer data for this event after this time, but the operators also reported that this inconvenienced their plant recovery efforts.
Times are approximate after loss of the plant computer.)
The loss of inverter 6 had resulted in loss of instrument air to air operated valves in the containment.
The operators observed that air operated valves in the containr.wnt had failed closed, but had no direct indication that the cause was the loss of invertor 6.
The normal pressurizer spray valve had failed 6
_ _ _ _ _ _,.~ _
closed as had valves for auxiitary spray from the charging system. This left the pressurizer power operated relief valves (PORVs)asthemeansofpressurecontrol,andtheoperators allowed PORV 455A to cycle on automatic pressure control.
Pressurizer level continued to increase.
Air operated letdown valves in containment failed closed, and the operators reduced charging flow to the minimum flow required by the reactor coolant pump seals.
This still caused a slow increase in pressurizer level, which was not stopped until-instrument air was restored to the containment.
Reactor temperature was increasing and use of the turbine bypass valves was not possible because of the pipe break in the condensate system.
Steam generator secondary pressure was increasing correspondingly but the steam generator atmospheric dump valves (ADVs) did not lift.
(InitiationoftheMSLItrip had also blocked the automatic opening of the ADVs on increasing steamgeneratorpressure.)
5:00 p.m.
Re entry into the turbine building was now possible. Condensate system wat'er at 70'F flowed from the failed pipes. Various fire deluge yitten sprinkler heads had melted from the heat and the flow was adding to the water from the condensate system.
Water level was increasing to underneath the condensate pumps.
Oil was present in the water, which meant that an oil water separator had to be rigged before the water could be pumpad into Long Island $0und.
Fire deluge main valves were shut to stop the flow from the sprinkler heads. Work.to remove water and dry out electrical load centers continued through the remainder of this shift and beyond but was not directly related to the efforts in the control room to recover normal control of reactor plant parameters.
5:13 p.m.
Control room operators reset the MSLI trip, thereby unblocking automatic operation of the ADVs.
An ADV began cycling to limit 1
steam generator pressure to 1065 psi, which corresponds to 555'r reactor coolant temperature.
The pressure had not reached the setpoint for the ASME code safety valves.
Steam flow through the ADVsL with feedwater supplied by the motor driven auxiliary feedwater pumps was removing decay heat.
6:35 p.m.
Control room operators had continued to diagnose the loss or instrument air to the containment and had pulled the electrical control logic diagrams.
Two instrumentation and control (l&C) technicians had observed the steam in the turbine building and had gone to the control room to offer assistance.
They decided that the probable cause of the loss of instrument air was that loss of invertor 6 had caused loss n' 'lectrical power to an electrical to pneumatic (1/P) conve,., which had caused a containment air pressure regulating valve 31AS PV 15 to fail closed. Although 31AS PV 15 is classified as a containment isolation valve, the I/P converter could be bypassed since two solenoid valves in series provided a redundant containment isolation means.
(Theneedforautomaticpressureregulating mode of 31AS PV 15 through the 1/P converter had been deleted before this event by a design change. The PV 15 valve was required to operate now only in the open/ closed mode).
The SS and the duty officer cuthorized a " jumper bypass" of the I/P regulator per the station's administrative procedures.
The I&C technicians found that the I/P converter mechanisms could be mechanically wedged open, which would open 31AS PV 15.
This was a more expeditious method than installing tubing to bypass the I/Pconverter.
Instrument air to containment was logged as t
restored at 6:35 p.m.
6:40 p.m.
Normal control of the letdown system was restored and thus
~
normal control of charging and letdown and primary system inventory.
The pressurizer level increase was limited to 83%
and pressure increase had been limited by the PORVs to prevent lifting of the ASME code safety valves.
l
y, l
l 2,3 Analysis 2.3.1 coerator Resoonse Licer.see personnel performed well during this event.
They quickly identified the problem, manually tripped the reactor, isolated the main steam system, and initiated recovery activities.
During recovery the operators kept the plant in a stable condition in spite of problems due to equipment damage resulting from steam and flooding, including a loss of instrument air to the containment and numerous alarms caused by both real equipment problems and false electrical signals.
The constructive teamwork among the station staff is also noteworthy.
The event occurred at 4:30 p.m. New Year's Eve and adequate support personnel were available, many of whom volunteered.
Among those who assisted the control room operators were I&C technicians, four PEOs from Unit 2, and two engineers from Unit 3 engineering.
In addition, local operations were carried on in parallel in the turbine building to de-cil and remove the water and to carry out other recovery efforts.
The emergency operating procedures were entered and properly executed.
However, after the immediate actions were performed, recovery of the plant was based upon the operators' knowledge of plant systems as derived from training and experience and the use of normal operating procedure where applicable.
l 2.3.2 Diaonostics and Decision makino A major problem in maintaining control of reactor pressure and inventory was created by the loss of instrument air to the pneumatic operated control l
valves within containment.
The indications of this problem were the l
increasing pressure and level in the pressurizer because the RCS letdown l
valves and pressurizer spray valve were closed.
The SCO and the RO realized that the pressure increase would be limited by the automatic action of the PORVs and by the ASME Code safety valves.
No automatic means of limiting.the increase in level was present. The SCO took immediate action to limit the-9
y._
(
l rate of increase in level by manually reducing the charging flow to the minimum required flowrate for the reactor coolant pump (RCP) seals.
l The 500 and the R0 deduced that the basic problem was loss of instrument air to the containment and in reviewing panel indications found that the air pressure regulator valve pV 15 was closed.
The control logic diagram for this valve was pulled and confirmed that PV 15 was controlled by an I/P converter.
Since indications of loss of some electrical power load centers were present, it was concluded that PV 15 had failed closed due to a loss of electrical power to its converter. At this point the SCO-and the R0 were joined by an l&C specialist who was not assigned to the shift but who volunteered to help the control room operators.
The SCO and the R0 deduced that the 1/P converter for PV 15 should be 4
bypassed and that this should be permissible, even though PV 15 was a containment isolation valve, because there were two solenoid operated isolation valves in series with the converter.
The 500 obtained the proper authorization for bypassing PV 15 and then directed the !&C specialist to install a bypass around the converter for PV 15.
The !&C specialist examined the instrument air tubing around PV 15 and suggested to the SCO that the 1/P l
converter for PV 15 be wedged open since this would be more expedient than-installing bypass tubing.
The SCO agreed and the wedge was installed.
This opened PV-15, restored instrument air to containment, and restored control of the pressurizer spray valves and letdown systen valves.
?
i The SCO, the R0, and the !&C specialist had thus moved efficiently through problem identification,. diagnostics, action selectt'on,-and action to restore normal control of pressurizer pressure and level._ The pressuriter i
level increase was limited to 83%.
i 2.3.3 Control of Risk to Personnel i
The Unit 3 duty officer, a maintenance engineer, an-engineering--
supervisor, a maintenance supervisor, operators, and.other Unit 3 staff had observed the st n a leak prior to the pipe rupture.
There was apparently;a 1
lack of awareness by these individuals that the through wall pipe leak could 4
. -,.. _,... -, -. ~ -. - -. -,.. - -, 'mu-,%.M...-
..-...-.--w.e.,.
on.-_v,.-.
..-.,%.E
.. m-EM -,_,--wwye.we.
-.w--mn%.-
be a precursor to a catastrophic failure. Other through wall leaks in the secondary systems piping had been experienced during Unit 3 operation.
These leaks had been due to localized flaws, such as those cause by jet impingement, where a small pipe tee'd into a larger diameter pipe.
There appeared to be a low level of awareness among Unit 3 staff that a through wall leak in pressurized piping indicates diminished strength as well as tightness and, in particular, that there are mechanisms such as erosion corrosion that can decrease the piping strength to the p., int of incipient failure.
As a result, between the time that the leak was detected and the time of the pipe rupture, operators and other station staff unnecessari'/ risked serious or lethal injury when they n re in proximity to the pipes that ultimately failed.
2.3.4 Command and Control Although it is beneficial for a control room operator to retain 4
- hands-on" state of knowledge of local operations, command and control was diminished when the SCO elected to manually isolate the leaking pipe section by himself.
This was because the SCO operated in mid levels of the turbine building without direct means of communication with the control room and without contact with a local operator.
(The turbine building PE0 did not know that the SCO was in the building.) The 500_ escaped injury and returned to the control room where he played an important role in recovery of the plant.
2.3.5 Human Error This report is concerned with the human factors that influence the 4
performance of reactor plant operators.
However, the root cause of this event i
that placed out of the ordinary ;ask demands upon the plant operators was the error by non operating personnel who were applying a computer program for determining uhich pipes were subject to erosion / corrosion.
It was obvious after the fact that the DSM pump discharge pipes would have been susceptible To erosion / corrosion. A contributing factor was management's failure to verify that the erosion / corrosion program was adequate.
gg
4 4
3.
SUMKARY OF FINDINGS The plant operttors responded promptly and effectively to the consequences of the pipe ruptures in the turbine building.
The support to the operators provided by other station staff was well coordinated and was volunteered to a significant extent.
Actions seem to have been prioritized well since various measures were taken in their proper time frames, for example reactor trip and main steam isolation in 21/2 minutes followed by restoration of letdown control in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.
Restoration of instrument air to containnent provides an instructive examnle of diagnostic problem solving using knowledge rather than a diagnostic procedure.
The time required was approximately two hours, which is representative of the times required for effective, cognitive problem solving.
The possible risk to personnel _that was created by the through wall leak was unrecognized by station personnel and management.
This situation seems related to the lack of a periodic or final validation of the erosion / corrosion program, which might have provided a defense against the human error that caused the DSM pipes to be overlooked.
Such a validation might have also provided increased awareness among the operating staff of the risk of erosion / corrosion of secondary piping.
Finally, the SCO experienced a close call and escaped serious injury.
This highlighted the somewhat diminished state of control room connand and control that resulted when the SCO chose to isolate the piping by himself.
1 12
.