ML20133M393

Power Reactor EVENTS.March-April 1985

ML20133M393
Person / Time
Issue date:	10/31/1985
From:	Massaro S NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
References
NUREG-BR-0051, NUREG-BR-0051-V07-N2, NUREG-BR-51, NUREG-BR-51-V7-N2, NUDOCS 8510250583
Download: ML20133M393 (61)

Text

__

NUREGlBR-0051 Vol. 7. No. 2 r

/,Q, POWER REACTOR EVE NTS W M.. jI United States Nuclear Regulatory Commission Date Published: October 1985 Power Reactor Esents is a bi-menthly newsletter that compiles operating experience information about commercial nuclear power plants This includes summaries of noteworthy events and hstings and/or at,stracts of USNRC and other documents that discuss safety-related or possible generic issues it is mtended to feed back some of the lessons learned from operational experience to the various plant personnel, i e , managers, hcensed reactor operaton, training coor-dinators, and support personnel Referenced documents are available f rom the USNRC Pubhc Document Room at 1717 H Street. Washington. DC 20555 for a copying fee Subscriptions and additional or back issues of Power Reactor Events may be requested from the Superintendent of Documents. U.S. Government Printing Of fice. (202) 257-2060 or -2171, or at P.O. Box 37082. Washmgton D C. 20013-7982.

Table of Contents Page 1.0 SUMMARIES OF EVENTS 7

1 1.1 Erosion and Rupture of Heater Drain Piping, Partly Due to Misuse of Pump Discharge Pipe at Trojan.. .. 1 1.2 Feedwater Line Rupture Due to Erosion in Area Not Regularly inspected at Haddam Neck._ ..

. . . . . . . 2 1.3 Waterhammer in Residual Heat Removal System Piping Following Performance of Revised Procedure at Susquehanna.. . . .. .. 4 1.4 Partial Loss of Power Due to Actuation of Transformer Single Differential .

Trip Relay at North Anna.. ..

. . . . .. 5 1.5 Opening of Only One Reactor Trip Breaker on Trip Signal One to Separate Vacuum Pressure Switches for Each Trip Train at Ginna... 8 1.6 Diesel Generator inoperabihty Due to Loss of DC Control P6wer and Operator Unfamiliarity with Equipment at Catawba.. .. 10 1.7 Inoperability of One Loop of Emergency Service Water System Due to Sliding Links Left Open DuringPlant Modifications at Susquehanna.. - 14 1.8 Mispositioned Boric Acid Tank Selector Switch Due to 1%rsonnel Error During Surveillance Test at Kewaunee... 16 2.0 EXCERPTS OF SELECTED LICENSEE EVENT REPOR TS... 23 3.0 ABSTRACTS / LISTINGS OF OTHER NRC OPERA TING EXPERIENCE DOCUMENTS.. 45 3.1 Abnormal Occurrence Reports (NUREG-0090).. 45 3.2 Bulletins and Information Notices... 47 3.3 Case Studies and Engineering Evaluations... 50 3.4 Generic Letters... SS 3.S Operating Reactor Ewnt Memorand.. . 56 3.6 NRC Document Compilations... 57 Editor: Sheryl A. Massaro Office for Analysis and Evaluation of Operational Data U.S. Nuclear Regulatory Commission Period Covered: March-April 1985 Washington, D.C. 20555 8510250583 851031 PDR NUREG BR-OO51 R PDR

1.0 SUMMARIES OF EVENTS 1.1 Erosion and Rupture of Heater Drain Piping, Partly Due to Misuse of Pump Discharge Pioe at Trojan At Trojan

• on March 9,1985, the reactor tripped from full power following a turbine trip due to spurious high vibration signals on a main turbine bearing.

The resulting main feedwater isolation produced, as expected, a pressure pulse in the heater drain and feedwater systems, which caused a rupture at an eroded location in the heater drain pump discharge piping on the 45-foot elevation of the turbine building. As a result of the piping rupture, a steam-water mixture of approximately 350 degrees F escaped into the turbine building, which actuated fire suppression (deluge) systems, damaged secondary plant equipment in the vicinity, and injured one member of the plant operating staff. The reactor was safely cooled down using steam line power operated atmospheric relief valves (PORVs) and the residual heat removal system. The event is detailed below.

On the evening of March 9, i985, the plant was cperating at 100% power. Average coolant temperature was 585 degrees F and reactor coolant system (RCS) pressure was 2235 psig. At about 9:50 p.m., a reactor trip occurred from automatic actuation of the reactor protection system, due to a main turbine trip. The turbine trip was caused by a spurious main turbine bearing high vibration signal.

The reactor protection system and plant safety systems functioned as designed during the transient. Following the turbine trip, the resulting automatic main feedwater isolation produced a pressure pulse to approximately 875 psig in the heater drain and feedwater systems, as expected. However, the pressure surge caused an eroded section of the 14-inch diameter heater drain pump discharge piping to rupture, resulting in the release of a steam-water mixture of approximately 350 degrees F into the 45-foot (ground-level) elevation of the turbine building. In addition to the fire suppression (deluge) system actuation by heat sensors in the turbine building and damaged secondary plant equipment, one member of the plant operating staff received first and second degree burns on 50% of his body from the high temperature fluid. He was treated at a local hospital for three weeks before being released.

Because of the ruptured piping ar.d steam and water buildup in the turbine building, condenser vacuum was lost approximately 4 minutes after the reactor trip. Loss of vacuum rendered the steam dump system inoperable, so the steam line PORVs were used to control steam pressure and plant temperature. Makeup water for the steam generators was supplied from the condensate storage tank using the auxil-iary feedwater system. The plant was maintained in hot standby until 3:50 a.m.

on March 10, 1985, when a forced cooldown, using PORVs and auxiliary feedwater, was initiated. The plant entered hot shutdown at 10:20 a.m. and the residual heat removal system was placed in service one hour later.

• Trojan is a 1080 MWe (net) Westinghouse PWR located 32 miles north of Portland, Oregon, and is operated by Portland General Electric.

I

2 The ruptured section of A106B carben steel beater drain system piping had experienced severe erosion / corrosion of the pipe wall. Because the feedwater flow out of a normally open 14-inch manual globe valve was directed against the pipe wall, the pipe wall at the rupture location had eroded from a nominal thickness of 0.375 inch to a thickness of approximately 0.098 inch. The systen flow rate at this location was 20 to 24 feet per second at normal operating conditions of approximately 450 psig and 350 degrees F. Apparently, the pipe had been installed as a modification in about 1977 to aid in maintaining heater drain tank levels during plant startup, but was not intended to carry full flow during normal full power operation. Due to operational problems, however, the pipe did become the normal flow path. Based on subsequent inspections, the only other section of piping where significant erosion / corrosion had occurred was at a 10-inch to 14-inch expander section downstream of a 10-inch control valve.

Minimum wall thickness was still met at that location, however, and repairs were made during the 1985 outage.

The damaged section of pipe was replaced, and power operation resumed on March 15, 1985. Testing per'ormed during the initial turbine roll on March 16, was inconclusive with respect to the cause of the spurious turbine bearing vibration signal.

An extensive program has been in place to inspect high pressure extraction steam and heater drain piping, assuming that erosion / corrosion will only occur in piping subjected to two-phase flow and/or flashing. Because the March 9, 1985 rupture occurred in piping downstream of the heater drain pumps where normal operating conditions are 450 psig and 350 degrees F (sub-cooled water), the ruptured lire was not included in the inspection program. As a result of this piping failure all secondary system piping runs subjected to temperatures in the range of 300 to 480 degrees F (150 to 250 dearees Cl with flow rates greater than 15 feet per second will be evaluated to identify flow perturbation areas where erosion / corrosion may be occurring. A sampling of suspect areas identified will be ultrasonically tested to verify adequate wall thickness, then repaired or replaced as reouired. (Refs. 1-3.)

1.2 Feedwater Line Rupture Due to Erosion in Area Not Regularly Inspected at Haddam Neck On March 16, 1985, a steam leak was discovered at Haddam Neck

• while the plant was operating at 100% power. The reactor and turbine were manually tripped due to the possibility of grounding the steam generator feed pump motor (s) and/or heater drair pump motor (s). After tripping the plant, one steam gener-ator feed pump was shut down and the auxiliary steam generator feed pumps were started to ensure their availability. Condenser vacuum was lost due to air leaking through the turbine seals. The atmospheric steam dump valve was then used to control primary side pressure and temperature. Automatic initiation of auxiliary feedwater flow occurred due to low level in two steam generators. The cause of this event was a pipe rupture immediately downstream of the 1B feed-water heater normal level control valve. The eroded section of pipe was re-placed. Sections cf pipe similar to the pipe that ruptured will be included in the plant program for monitoring pipe elbows for erosion in the main steam and feedwater systems. The event is detailed below.

• Haddam Neck is a 569 MWe (net) Westinghouse PWR located 13 miles east of Meriden, Connecticut, and is operated by Connecticut Yankee Atomic Power.

3 On March 16, 1985, with the plant operating at 100% power, the operators in the control room heard a " pop" from the turbine building at 8:05 p.m. Security and Health Physics personnel notified the cuntrol room of a steam leak in the north-east, lower level area of the turbine building. The Control Operator notified Shift Supervisor, who was making a tour for plant status. The main control board indications appeared normal.

The Shift Supervisor and secondary side Auxiliary Operator investigated the steam leak. Steam and water appeared to be coming from the area of the IB feed-water heater normal level control valve. Steam was blowing towarc the stean generator feed pumps. The Shift Supervisor ordered a manual trip of the reactor and turbine due to the possibility of grounding the steam generator feed pump motor (s) and/or heater drain pump motor (s). In addition, the exact location of the pipe. rupture had not been determined.

The reactor and turbine were manually tripped. Steam generators 1 and 3 were noted as having lower secondary side levels than steam generators 2 and 4.

The steam generator low levels were attributeri to the tripping of reactor coolant pumps 1 and 3 during the event, which caused shrinkage following idling of the loop. These pumps are required to trip by design during four-loop operation following a reactor scram. These pumps were restarted by 8:30 p.m.

After manually tripping the plant, the A steam generator feed puitp was shut down. The A and B auxiliary steam generator feed pumps were started to ensure availability in the event that both feed trains required isolation.

Condenser vacuum was lost due to air leaking through the turbine seals. The gland steam supply had previously been isolated for reasons unrelated to this event. The high pressure steam dump was lost when the condenser vacuum reached 20 inches mercury. This was recognized after the primary side Control Operator noted an increase in Tave. In response to the increase in primary temperature the secondary side Control Operator manually opened the atmospheric steam dump at about 8:15 p.m. Primary side temperature and pressure were controlled by the atmospheric steam dump until restart.

Automatic initiation of auxiliary feedwater flow occurred at 8:13 p.m., due to low level in steam generators 2 and 4, 44% and 45% wide range level, respec-tively. The levels of steam generators 2 and 4 remained below 45% for 20 sec-onds. The levels were low because of increased boil-off, which was caused by loops 1 and 3 being idled when their reactor coolant pumps were tripped.

After the reactor was tripped, the pipe rupture was located. The pipe had ruptured downstream of the IB feedwater heater normal level control valve, which is a Masoneilan Camflex valve. The actual rupture was approximately 1/2 inch by 2-1/4 inches.

The pipe rupture occurred because the flow exiting the 18 feedwater heater normal level control valve impinged directly on the pipe surface and severely eroded the pipe in that area. The eroded section of pipe was replaced. In addition, the corresponding pipe on the A feedwater train was checked for erosion. The plant already has a program for monitoring pipe elbows for erosion in the main steam, feedwater, and condensate systems. Sections of pipe adjacent to flow control valve configurations similar to the pipe that ruptured will be included in the plant's reliability engineering program for monitoring erosion of secondary system pipe elbows. (Refs. 4 and 5.)

4 1.3 Waterhamer in Pesidual Heat Removal System Piping Following Ferformancelf Revised Procedure at Susquehanna On April 27, 1985, while preparing to place the B loop of the Susouehanna Unit 2*

residual heat removal (RHR) system in service, e waterhammer occurred causing a reactor water level transient. Tha reactor water level dropped approximately 35 inches, causing a reactor protectien system (RPS) actuation. No control rod motion occurred since all rods were fully inserted at the time of the event, and no emergency core cooling systems initiated. The waterhammer and leval transient were caused by rapidly filling partially drained RHR piping from the reactor vessel. The piping was partially drained while warning the injection line in accordance with operating procedures. Af ter restoring the reactor vessel level and resetting the RPS signal, the D RHP pump was started in the shutdown cooling mode. A second waterhammer occurred, and the shutdown cooling suction valves closed due to high flew (an engineered safety feature). The second water hanmer resulted from rapidly collapsing steam pockets in the RHR piping when the pump was started. A walkdown of the system outside of the containment was performed and no damage was found. The operating procedure for RHP is being revised to delete the section for injection line warm up to prevent future waterhammers. The event is detailed below.

At 8:37 a.m., on April 27, 1985, a waterhammer occurred while attempts were being made to place the B loop of RHR in service for shutdown cooling. The operators were warming the RHP system in accordance with OP-249-002 Revision 3, "RHR Operation ir Shutdown Cooling Mode." Revision 3, issued February 8, 1985, had not previously been performed at Susquehanna. The revised procedure specifies warming both the suction line and the injection line separately by establishing flow from the reactor vessel through the RHR piping to the main condenser, radwaste or suppression pool. The licensee was following the procedure section which established a flow path to the main condenser via a 4-inch line which taps off the RHR crosstie piping between RHR loops A and B.

The procedure specifies maintaining warmup flow until the PHR crosstie temperature reaches 205 F and RHR conductivity is within specification. The operators completed the procedure steps which warm the suction piping without problems, and aligned system valves to warm the low pressure coolant injection (LPCI)/RHP piping. The flow path S r this portion of the procedure involves establishing flow from the recircu mtion system discharge piping back through the LPCI/RHR testable check valve (this valve is opened by continuously supplying air to it) and the equalizing line, and the LPCI injection and throttling valves to the crosstie piping to the main condenser. The heat exchanger outlet and bypass valves are shut during this warmup. A waterhammer occurred while securing from this lineup when heat exchanger bypass valve F048B was opened valves are shut during this warnup. A waterhammer occurred while securing from this lineup when heat exchanger bypass valve F048B was opened.

When valve F048B was opened, reactor vessel level dropped from about 48 inches to 13 inches, causing a reactor scram (all rods were already inserted). This corresponds to several thousand gallons of water. The RHR injection piping had apparently voided, and the water flashed to steam. During the warming process, testable check valve F050B showed dual indication. It is unknown how the voiding

• Susquehanna Unit 2 is a 1065 MWe (net) General Electric BWR located 7 miles northeast of Berwick, Pennsylvania, and is operated by Pennsylvania Power and Light.

5 actually occurred. It is possible that the testable check valve, in a partially closed condition, was not passing sufficient flow to keep the system full as water was draining to the condenser, which was under vacuum.

After the first waterhammer, Operations personnel inspected the RHR piping for damage. None was found. They checked that the RHR piping was filled and vented from_a high point vent and, at 9:45 a.m., started the D RHR pump.

Another waterhammer occurred and shutdown cooling isolation valves F008 and F009 isolated (apparently on high flow), causing the RHR pump to trip. This waterhammer occurred because the system piping was still voided. Tne operators checked the high point vent on the injection line (previously they had checked a vent at a higher elevation in the containment spray line), and steam issued from the vent. Subsequently, the operators cooled down the RHR piping to about 160 F using " keep fill" and other system vents. Nuclear Plant Engineering (NPE) performed a walkdown of the suction and injection piping. No evidence of piping or hanger damage was found. A temporary change to OP-149-002 was written to modify the procedure steps that warm the injection line. The procedure was changed to discharge RHR water to radwaste via the 1-inch heat exchanger vent line. This flow path should restrict flow during the warmup process sufficiently to prevent voiding. Sub3equently, the RHR system was placed in shutdown cooling at 7:45 p.m., April 27, 1985.

Revision 3 to OP-149-002 had modified the procedure to include steps to enable warming the LPCI line by backflow frca the recirculation system. It was included to prevent a thermal transient at the RHR recirculation pipe tee. General Electric Service Information Letter No. 175, dated June 15, 1976, indicates that under some conditions a fatigue analysis has shown that this tee can be overstressed after repeated thermal cycles. As a result of the waterhammer concern, the licensee is modifying the procedure to delete that portion addressing injection line warmup.

An engineering work request was prepared to request NPE to address the thermal cycle concern with the RHR/ recirculation pipe tee.

The licensee checked the calibration of several instruments which might have been affected by the waterhammer. Instruments checked included suction and discharge pressure instruments, a flow transmitter, and two pressure switches used to sense an RHR pump running for automatic depressurization. No evidence of these instruments being affected by the waterhammer was found.

Voiding in the RHR system during warmup operations appears to be a generic problem. Similar problems at other plants"were addressed in NRC's IE Information Notice 84-81, " Inadvertent Reduction in Primary Coolant Inventory in Boiling Water Reactors During Shutdown and Startup," issued November 2, 1984. (Refs. 6 and 7.)

1.4 Partial loss of Power Due to Actuation of Transformer Single Differential Trip Relay at North Anna On March 23, 1985 at 11:08 p.m., North Anna Unit 2* was manually tripped from 100% power. The Unit 2 Control Room Operator (CRO) observed individual rod position indicatcrs (IRPIs) indicating that the shutdown and control banks were dropping into the core concurrent with a partial loss of control room

• North Anna Unit 2 is an 893 MWe (net) Westinghouse PWR located 40 miles northwest of Richnond, Virginia, and is operated by Virginia Power.

6 l lighting and a loss of several nonsafety-related parameter irdications. Based I

I on these indications, the CR0 believed a reactor trip was occurring, and that the plant had lost a significant part of its power supply. Therefore, the CP0 manually tripped the reactor and turbint in accordance with the immediate action requirements of the reactor trip or safety injection procedure.

The loss of power occurred when the No. 5 switchyard transformer generated a fault signal which initiated a No. 2, 500 kV bus isolation signal (see Figure 1). The isolation of the No. 2, 500 kV bus resulted in loss of power to the No. 4, 34.5 kV bus. This deenergized A and B reserve station service trans-formers (RSSTs), causing a less of power to the IJ and 2H 4160 V emergency busses. The IRPIs are powered from the 2H 480 V emergency motor control cen-ter (powered by the 2H 4160 V bus) through a 480 V/120 V transformer.

The 2H and 1J energency diesel generators automatically started on the loss of power signal, and reenercized their respective emergency busses approximately 10 seconds into the event. Substantial auxiliary steam loads, a' ng with the initiation of auxiliary feedvater, caused a cooldown of the primary system.

The main steam line isolation valves were closed and auxiliary steam loads shifted to Unit 1 to terminate the cooldown. Primary system temperature stabilized at approximately 530 decrees F about 15 minutes into the event. Primary system pressure reached 1820 psig before stabilizing. Stea.n generator blowdown trip valve TV-BD-200D indicated mid-position after blowdown automatically isolated as a result of low steam generator level. Operations personnel verified that blowdewn flow was isolated in that loop. Subsecuently a work request was sub-mitted to correct the faulty valve position indication problem.

Since the A and B RSSTs lost power when the event began, the A and B station service busses also lost power when they transferred to reserve station service after the reactor trip / turbine trip. Undervoltage signals caused the A and B reactor coolant pumps, the A and P main feedwater pumps, and the A and B condensate pumps to trip. In response, the C main feedwater pump and C condensate pump automatically started; the C reactor coolant pump remained in service through-out the event.

Once the No. 5 switchyard transformer was isolated, power was automatically restored to the No. 2 500 kV bus. The A and B RSSTs were subsequently reen-ergized. The IH 4160V emergency bus was not affected, and therefore Unit 1 IRPI indication was not lost. Accordirgly, the Unit 1 CP0 did not see a trip condition, and maintained the unit at 100% power throughout the event.

The lic nsee inspected the No. 5 transformer and found that it had not been faulted. However, they did find that one of three single differential trip (SDT) relays actuated to initiate the event. All three of the SDT relays were replaced. (A similar problem with this type of relay at a fossil power station operated by the licensee occurred earlier in 1985.) The relays that were removed are to undergo licensee testing to determine the cause of the spurious actuation.

An engineering evaluation has been requested to determine the feasibility of design modifications to the North Anna switchyard that would keep the 500 kV bus No. 2 energized in the case of a No. 5 switchyard transformer fault. The feasibility of alternate power supplies for the IRPIs is also being investigated.

(Refs. 8 and 9.)

230 kV 230 kV 500 kV

" Note: ODenotes Circuit Breaker y

Une #255 #5 Transformer

/ m _,

a_

500 kV Line #575 w

,, I_

u -

500 kV Line #573 : F Cross-tie to 500 kV Bus #1 u '

500 kV Line #576 w

- I__.

u "

500 kV Bus #2 500 kV 34.5 kV 34.5 kV Bus #4 34.5 kV 34.5 kV Vu.AAr Reserve Station uAAA/

A Service Transformers B m

4.16 kV 4.16 kV To 1J 4160 V r To 2H 4160 V Emergency Bus Emergency Bus Figure 1. Simplified One-Line Diagram of 500 kV Bus #2 Feeder to 34.5 kV Bus No. 4

8 1.5 Opening of Only One Reactor Trip Breaker on Trip Signal Due to Separate Vacuum pressure Switches for Each Trip Train at Ginna On April 11, 1985, an investigation was being conducted at Ginna* to determine the source of a circulating water leak in the main turbine condenser. With condenser vacuum decreasing, a manual turbine trip was attempted. The first of two actuations of the manual turbine trip pushbutton failed to result in a turbine trip. This was attributed to the adjustment of a mechanical stop on the autostop tripper bar. The turbine was tripped successfully on the second attempt. During the subsequent power reduction, a reactor trip occurred as the result of the combination of the turbine being tripped, low condenser vacuum, and reactor power being above the P-7 permissive. Only the B reactor trip breaker opened on the reactcr trip signal, due to separate vacuum pressure switches for each reactor trip train. The event is detailed below.

At 11:30 a.m. on April 11, 1985, while the reactor was at approximately 25%

power, an investigation was being conducted to determine the source of a circulating water leak in the mair turbine condenser. While isolating and venting the condenser 1A1 water box, the condenser vacuum began to decrease and the condenser hotwell levels began to fluctuate. With consideration of loss of condensate suction and high condenser backpressure, the decision was made to manually trip the turbine. The act" ; ion of the main control board manual turbine trip pushbutton did not produce a turbine trip, although the turbine bearing oil lockout relay did trip. As personnel were being dispatched to the local turbine trip station, a stcond attempt was made to actuate the turbine trip from the main control room. This attempt resulted in a turbine trip after approximately a 5 to 10 secona delay. The reactor was stabilized at approxinately 15% power, with condenser vacuum at approximately 23 inches mercury and condenser steam dump available.

The decision was made to reduce reactor poser to approximately 3% to permit stopping of the running nain feedwater pump, and to maintain vacuum for the condenser waterbox inspection. At 12:20 p.m., at approximately 7% reactor power, a reactor trip occurred as the result of the combination of the turbine being in a tripped condition, low condenser vacuum, and reactor power being above the P-7 permissive. The indicated vacuum in the control room at the time of the reactor trip was approximately 23 inches mercury. Only the B reactor trip breaker opened automatically on the reactor trip signal, and the Operations personnel opened the A reactor trip breaker by actuating the main control board manual reactor trip pushbutton. Following the reactor trip the main steam isolation valves (MSIVs) were manually closed from the control room to limit the reactor cooldown. The reactor was stabilized at hot shutdown conditions.

The loss of condenser vacuum was determined to be caused by the isolation and venting of a section of the condenser. This section had been damaged by the failure of a steam impingement baffle plate for drain lines from the secondary steam traps and the moisture separator reheaters. Following the

• Ginna is a 470 MWe (net) Westinghouse PWR located 15 miles northeast of Rochester, New York, and is operated by Rochester Gas and Electric.

9 baffle plate failure, approximately 40 conJenser tubes were damaged. The failure of the baffle plate has been attributed to fatigue caused by increased steam loading from uporading of the secnndary system. A new stainless steel baffle plate has now been installed, which incorporates a much stronger design, and the damaged condenser tubes have been plugged.

The failure of the turbine to trip initially from actuation of the main control board manual turbine trip pushbutton was due to the adjustment of a mechanical stop for the autostop tripper bar. This mechanical stnp intermitterfly would not allow the tripper bar to release the autostop oil fluid. An adjustment was made to the mechanical stop, and the trip mechanism was successfully tested.

The reactor trip resulted from a decrease in condenser vacuum due to the ruptured condenser tubes. A two-out-of-three low turbine autostop oil pressure or a two-out-of-two turbine stop valves closed signal will trip the reactor when permissives P-7 and P-9 are present. Permissive P-7 is present when two-aut-of-four power range instruments are greater than 8%, or two-out-of-two turbine first stage pressure channels indicate creater than 8% power. Permissive P-9 is present when steam dump to the condenser is blocked by low vacuum (less than 20 inches mercury) or loss of both circulating water pumps. The automatic opening of only the B reactor trip breaker was determined to be the result of separate vacuum pressure switches for each reactor trip train (one-out-of-one logic.)

Pressure switch PS-48dA is used in the A train and pressure switch PS 4848 is used in the B train. The pressure switches sense condenser vacuum from a coninon {

manifold, also shared by the two pressure switches used for the condenser steam dump logic.

Testing following the event verified that the B train pressure switch would actuate at 21.7 inches mercury, and the A train pressure condenser vacuum allowed the B train to trip prior to the A train. The control room indication at the time of the trip was approximately 23 inches mercury due tn the sensing line for its transmitter being located at a different point in the condenser.

Although the system responded per design, the licensee is investigating a logic change to have each pressure switch trip each reactor protection train.

The actuation setting of the B train pressure switch has been lowered to coincide with the A train switch.

The licensee determined that condenser vacuum switches had not been calibrated since 1979, since they were categorized with a large portion of the secondary plant gauges and sensors that are not considered to be safety-related or have a technical specification designation. This category of gauges and sensors is calibrated as manpower availability dictates. The vacuum switches will be incorporated into the procedure for " Calibration and/or Test Surveillance Program for Instrumentation / Equipment of Safety-Pelated Components." In addition, a comprehensive review will be conducted to determine if other sensors or gauges warrant incorporation into this program. (Refs. 10 and 11.)

10 1.6 Diesel Generator Incperability Due to Loss of DC Control Power and Operator Unfamiliarity with Equipment at Catawba At Catawba Unit 1,* from March 7 to 14,1985, diesel generator (DG) IB was inoperable due to a loss of dc control power. The unit was operating at 30%

power during this period. The problem was discovered on March 14, when an attempt to start DG 1B resulted in the diesel not obtaining rated speed within the required time limit. Af ter subsequent investigation, two circuit breakers for DG 1B controls were found open. The circuit breakers were closed, and the diesel passed its operability test. This incident was classified by the licensee as a Component malfunction. When an operator previously attempted to replace a burned out indicating light on the DG 1B panel, a short circuit occurred and tripped the two circuit breakers feeding the DG '.B controls. However, the length of time taken to discover the inoperability of DG 1B, even though several indications existed, suggests operator unfamiliarity with equipment at this relatively new plant, and inadequate procedures. The event is detailed below.

The DGs and associated controls at Catawba are manufactured by Transamerica Delaval, Inc. DG control power is provided by the DG batteries, or by the DG battery chargers, which convert ac power to dc power. Several breakers are pro-vided with this circuitry to serve as equipment protection from various system faults that could occur. An indicating light nounted on the diesel engine panel provides the status of dc power to the control circuitry. An annunciator system installed on each diesel engine panel monitors the operation of the DGs and alerts personnel of any malfunction by appropriate lights and audible alarms. I When any annunciator on the panel alarms, a "DG Parel Trouble" annunciator is actuated in the control room. The Control Room Operator would then dispatch a Nuclear Equipment Operator (NEO) to the panel. T1 rough the use of annunciator response procedures, necessary corrective action can be taken. Another monitoring device for the DGs is the 1.47 Bypass Panel. This system, which is designed in accordance with Regulatory Guide 1.47, alerts the Control Room Operator of a bypass (inoperable) status of a nuclear safety related system train. The light (s) that monitor the status of the DGs are the "DG A(B) Bypass" irdication.

On March 7,1985, at 7:00 p.m. , DG 1A was discovered inoperable due to its control power batteries being placed on equalize charge. The DG 1A batteries were subsequently returned to service 45 minutes later. Since DG 1A had been inoperable, a periodic test (available power source check) was required to be perforred on DG 1B to comply with technical spe:ifications. Prior to performing the test, NE0 A noticed that the "DC Control Power On" and the

" Shutdown System Active" indicating lights on the diesel engine panel were not lit. He believed that the problem was caused by a burned out light bulb, and did not take action at that time to replace the bulb. From 7:59 p.m. until 8:05 p.m., NEO A ran DG 1B, which met the acceptance criteria specified in the test. The same orocedure was then performed on DG 1A, and it also met the acceptance criteria specified.

• Catawba Unit 1 is a 1145 MWe (net) Westinghouse PWR located 6 miles northwest of Rock Hill, South Carolina, and is operated by Duke Power.

1

11 Upon corrpletion of the procedures, the DGs are required to be placed in alignment for emergency start (ES) actuation. Prior to placing DG 1B in ES alignment, NE0 A obtained two light bulbs to replace the two lights that were burned out. A short circuit occurred when NE0 A attenpted to place the new bulb in the "DC Control Power On" socket, at about 10:00 p.m. NEO A was unaware that breakers CBS and CB6 (feeder breakers to diesel engine controls) located in the rear of diesel engine panel IB had tripped. NE0 A then proceeded to replace the burned out light bulb in the " Shutdown System Active" socket.

However, the bulb would not light.

Per the ES checklist, the following step must be sigred off: "17. DC Control Power On (as indicated on Diesel Engine Control Panel 1B)." Since this light had caused a short circuit and was not functional at the time, NE0 A contacted two Unit Supervisors to obtain guidance as to the subsequent course of action.

The Unit Supervisors instructed NE0 A to use alternate means to verify that dc control power was available; i.e., to check for acceptable DG battery voltage, and verify that DG bettery charger breakers were closed. They felt this was adequate, because they were under the belief that the "DC Control Power On" light was monitoring the status of the output voltage of the battery chargers.

The Unit Supervisors were unaware that the breakers were connected downstream of the battery charger. After NE0 A verified that the DG battery had proper voltage and that the charger circuit breakers were closed, he signed off Step 17 of the ES checklist. NE0 B independently verified the step. Upon completion of the ES checklist for both DGs, NE0 A originated a work request at 11:35 p.m.

to investigate and repair the light sockets for "DC Control Power On" and

" Shutdown System Active."

On March 12, 1985, a Shift Technical Advisor (STA) noticed that the "D/G 1B Bypass" light on the 1.47 Bypass Panel was lit. The STA proceeded to research the applicable logic diagram to find the cause of the light being lit. After checking all the inputs to the light, he could not determine the problem. Another work request was generated on March 13 to investigate and repair all the 1.47 Bypass Panel lights that control room personnel believed were incorrectly lit for present plant conditions.

On March 14, 1985, at 12:50 p.m., DG 1A was started by NE0s C and D, per the 1A operability test, to meet technical specifications surveillance require-ments. Af ter about 40 minutes of operation, an annunciator for " Fuel Pump /

Overspeed Drive Failure" was received. Fuel oil pressure began to decrease and the DG began to vibrate excessively. As a result, DG 1A was shut down and declared inoperable. A work request was initiated to investigate and repair the cause of the problem.

Since DG 1A was inoperable, DG 1B was required to be started to comply with technical specifications. At 2:10 p.m., NE0 C attempted to place DG 18 in Maintenance Mode. (This allows the DG to be manually rolled on starting air prior to starting.) However, the Maintenance Mode relay would not latch in. Because technical specifications require that DG 1B be operable when DG 1A is inoperable, the Shift Supervisor instructed NE0 C to run DG IB without manually rolling it on starting air. By procedure, the start attempt was made from the control room. D/G 1B began to roll, but it would not start due to run relays apparently not energizing. When NE0 C saw that the start timer was at 44 seconds, he phoned the control room and requested that DG 1B be shut down.

However, when the NE0 attempted to shut down DG 1B, it continued to roll on

12 starting air. (Starting air vill stay engaged until the DG starts.) Control of DG 1B was then transferred to the diesel room so that a local attempt could be made to defeat the DG start. This attempt failed. Af ter approximately 100 seconds of rolling en starting air, DG IB started. However, the generator field did not flash (i.e., the generatcr did not produce voltace). NE0 C again tried unsuccessfully to stop the DG with the stop pushbutton. Sin

CG 1B would not shut down by normal means, NE0 C depressed the run/stop knob located on the diesel governor, successfully shuttino down the DG.

Since DGs lA and 18 were both inoperable, and the nain generator was off line, an unusual event was declared. The cause of the DG 1A fuel oil system problem was investigated, and it was fcund that its filters ard strainers were both clogged. Since NEOs C and D recalled not having a high differential pressure (DP) indication across the filters when running DG 1A, the DP gauge on the diesel engine panel was investigated for a possible malfunction. It was fcund that the equalize valve on the gauge was open, causina the gauge to give no indication of fuel oil filter DD. The local strainer DP gauge had not been checked prior to start. Af ter the gauge was valved in properly and the fuel oil filters and strainers were replaced DG 1A was tested again.

Since no further problems were encountered, DG 1A was declared operable, and the unusual event was ended. An unsuccessful attenpt was made to determine why the eaualize valve on the filter DP gauge was left open.

The cause of the DG 1B failure also was being investigated March 14, 1985. It was found that breakers CBS and CBS in the rear of the IB control panel were open. These breakers feed the DG run relays, the stop solenoid, and the maintenance mode lockout soleroid. Since the breakers were open, DG IB could not be placed in the mainterance mode, nor could it be stopped by normal means. Even though the run rolays did not energize, DG 18 started after ICO seconds because the DG exhausted most of its starting air pressure in an attempt to start. This caused the diesel shutdown solenoid to disarm, which resulted in the subsecuent oponing of the fuel racks and the start of the DG. However, as a resul+ of the run relays not energizing, the generator field did not flash, and therefore prevented the generator from producing voltage. After the breakers were closed, DG 18 was started to prove its operability. It ran satisfactorily for about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, and was shut down and declared operable.

On March 15, 1985, the investigation was continued te determine hcw the breakers were opened. On this day, a Staff Engineer discovered that a work request had been initiated on March 7, which was the previous tire that DG IB was proven operable. Af ter researching the electrical schematics, it was found that the "DC Control Power On" light was electrically protected by circuit breakers CBS and CB6. The "DC Control Power On" socket was then removed. Inside the socket there was a dirt buildup. It is possible that during the construction phase of the unit, the light lens cover was not present, thus allowing dirt to accumulate.

Af ter cleanirg the socket, it was reinstalled and a new light bulb was inserted.

The light bulb then lit. The dirt buildup in the socket and the burned out bulb had apparently existed since construction, and an electrical arc was initiated when NE0 A tried to replace the bulb. The arc was believed to have caused the breaker to trip.

l l

i

13 A significant aspect of the incident was the length of time taken to discover it. When breakers CBS and CB6 opened, a "D/G 1B Bypass" light actuated on the 1.47 Bypass Panel. However, no one noticed this light because an audible alarm did not sound. The panel had several alarms, that control room personnel believed were incorrect for plant conditions. For this reason, control room personnel did not utilize the 1.47 Bypass Panel. When the actuated light was noticed by the STA 5 days after it had been lit, the cause of the light actuation could not be determined. This was due to the fact that there are no procedures for use of the 1.47 Bypass Panel; therefore, control room personnel were unaware of the response required for a light actuation.

There are twelve inputs to the "D/G 1B Bypass" light. Five of the inputs are enabled by actuation of an annunciator on the diesel engine IB panel.

Six of the inputs are enabled by breaker and valve positions which also can be determined very easily from other control room indications. The remaining input to the light is 125 V dc essential auxiliary trouble, which signifies that de power to the DG control circuitry is lost. For this input, there is no annunciator with this same nomenclature, but it does not monitor the position of the breakers in the rear of the diesel engine IB panel, and it is not an input to the 1.47 Bypass Panel. Therefore, when breakers CBS and CB6 tripped, it.was not readily apparent that a problem existed. An annunciator for the breaker positions should have been installed on all diesel engine panels. Also, if the Unit Supervisors and NE0s had known about the breakers and their func-tional use, they would have likely met the intent of step 17 in the ES checklist differently.

Corrective actions include the following:

(1) A Station Problem Report will be initiated to install an annunciator to warn of loss of de control power to the diesel engine panel, and a Nuclear Station Modification will be initiated to install an annunciator to warn of loss of de control power to the panel.

(2) Personnel will investigate and repair the 1,47 Bypass Panel invalid indica-tions; a response manual will be developed that will provide the action to take in the event a 1.47 Bypass light actuates. Also, an Operation Manage-ment Procedure will be developed to provide guidance in the use of this manual.

(3) A statement will be added to the Diesel Generator lesson Plan to ensure that personnel are aware that breakers exist in the rear of the diesel engine control panel and that their functional use is understood. (Ref. 12.)

1

14 1.7 Inoperability of One Loop of Emergency Service Water System Due to Sliding Links Lef t Open During Plant Modifications at Susquehanna At Susquehanna Unit 2 on April 21, 1985, two sliding link (or states link) terminal blocks were found open in the auxiliary control circuit for the spray pond bypass valve in the A loop of emergency service water (ESW). This circuit provides for the automatic functioning of the spray pond bypass valve on ESW pump starts and shutdowns. Investigation determined that the A loop of ESW had been inoperable from at least April 4,1985 until April 21, 1985, which exceeds the limiting condition for operation allowed by technical specifi-cations. During this period, Unit 2 was in power operation, and Unit I was in refueling. The concern is that anomalies observed by Control Room Operators between April 4 and 21 were not aggressively pursued, and that additional states links were found open in various plant systems. This event shows a need for increased sensitivity to the broader consequences of individual equipment ancmalies, particularly to operability of systems and components common to both units, and for the strengthening of administrative controls. The event is detailed below.

On April 21, 1985 the ESW pump at Susquehanna Unit 2 (ESW pumps are common to both units) was started, and the spray pond bypass valve (HV-01222A) did not automatically open as required by design. The pump was tripped and the circuit breaker and motor overloads for HV-01222A were verified to be closed. The A ESW pump was restarted 5 minutes later, and again the spray pond bypass valve did not automatically open. The pump was tripped and a limiting condition for operation (LCO) was declared for the A loop of ESW being inoperable. Investigation by licensee electrical maintenance personnel determined that HV-01222A did not operate automatically due to two open states link terminal blocks in a relay panel. The open states links deenergized the auxiliary control circuit which provides the automatic opening of HV-01222A on a start of the A or C ESW pump.

The states links were closed, the bypass valve operated satisfactorily per design, and the LC0 was cleared.

Licensee investigation of the event revealed that the states links had been opened by a contract electrician on March 27, 1985 during modification work to add a transfer switch and a new cable to the relay panel. Opening the states links was not included in the work instructions which the electrician was using, and the fact that the electrician opened the states links was not recorded in the work document. On March 28, a schematic check of the cable and transfer switch was performed which included an energized test of the circuit, but only up to the open states links. The licensee electrician who performed the schematic checks saw the states links open, but did not question or document their status. During this time, the A ESW pump was running and HV-01222A was open providing a flow path back to the spray pond. On April 4, the A ESW pump was shut down but HV-01222A did not automatically close. The operator depressed the "close" pushbutton for HV-01222A, and the valve closed electrically. A work authorization (WA) was submitted, stating that the valve failed to automatically

• Susquehanna Unit 1 is a 1032 MWe (net) General Electric BWR, and Unit 2 is 1065 MWe (net). They are operated by Pennsylvania Power and Light, and are located 7 miles northeast of Berwick, Pennsylvania.

15 close on shutdown of the A ESW pump. Since there was no LC0 associated with the WA, it was assigned a low priority by Maintenance, and was not immediately worked on. On April 11, the C ESW pump was started. When HV-01222A did not open automatically within the A ESW pump. Since there was no LC0 associated with the WA, it was assigned a low priority by Maintenance, and was not immediately worked on. On April 11, the C ESW pump was started. When HV-01222A did not open aJtomatically within a reasonable length of time, the operator depressed the "open" pushbutton for HV-01222A, and the valve opened electrically. Due to the cpen states links, the A loop of ESW was thus inoperable from at least April 4 until April 21, 1985, but was not recognized.

Ir. addition to interrupting power to the auxiliary control circuit for the automatic function of HV-01222A, the open states links deenergized the ESW A loop bypass indication system (BIS) alarms and a portion of the Division 1 auxilfary load shed circuits for Unit 1. The loss of BIS alarms would have prevented any indication in the event of a control power loss on motor overloao for the ESW Loop A diesel generator cooler valves. The Unit 1 Division 1 auxiliary load shed circuit is designed on the basis of a loss of coolant accident (LOCA) signal, with one of two startup transformers and two of four ESS transformers supplied by offsite power. It affects Non-Class IE 13.8 kV and 480 V loads, tap setting changers to the startup transformers, degraded grid voltage protection for Division 1 engineered safeguards system (ESS) busses, and load shed of miscellaneous ESW pumphouse panels. The turbine generator lockout relays were reset during the incident. Per design, the load shed logic for the Non-Class 1E 13.8 kV and 480 V loads does not function with these relays reset, therefore, there was no consequence due to the open states links. The Unit 1 Division 1 auxiliary load shed circuit sends a signal to boost the tap changer setting en the startup transformers during accident conditions. No credit is taken in the voltage study for this boost; therefore, there is no consequence of losing this capability. Since Unit I was defueled during the time the states links were open, the Unit 1 LOCA signal into the degraded grid voltage protection circuit was not required since the emergency core cooling system (ECCS) loads were not required by technical specifications. The ESW pumphouse loads are common to both units, and either a Unit 1 or Unit 2 LOCA signal is required for lord shedding. The Unit 2 LOCA load shed was disabled; however, since both startup transformers and all four ESS transformers were in service there was no consequence of the loss of the load shed circuitry.

During the licensee investigation it also was discovered that the auxiliary load shed circuitry was not identified on the electrical drawings for breaker loads. This load was inadvertently omitted from the circuit breaker interruption impact diagrams which were developed in the second half of 1983.

A comprehensive walkdown was conducted of safety-related panels to identify and correct open states links. Any states link which was found open was documented and evaluated for operational impact by the plant Engineering staff. Any open states link which was determined to have operational impact on Unit 2 or fuel load impact on Unit 1, was closed by a WA. Open states links without operational or fuel load impact were closed on a continuing basis as manpower became available. The Unit 2 walkdown was completed prior to starting up the Unit on May 3,1985 after a one-week outage for turbine generator maintenance.

16 The walkdown of the panels identified open links in the circuitry for the C diesel generator cooler inlet and return valves frem the A loop of the ESW.

The links connect the motor overload bypass switch to the circuitry for the valves. With the links open, the valves' motor overloads were not continuously bypassed, as required by technical specifications. The links apparently were opened during the performance of modification work in the panel where the by-pass switched is located. When the motor overload bypass switch for these and other balance of plant system valves is taken to " bypass," there is no indication of this in the control room. The Nuclear Plant Engineering group has reviewed the design and no further changes are planned. The panel walkdown also identified an open link in the standby gas treatment system (SGTS) control logic from the Unit 2 reactor building Zone II. The open link prevented the Zone 11 differential pressure instrument from providing a signal to the differential pressure indicating controller which maintains the lowest differential pressure of Zones I, II, and III at greater than or equal to 0.25 inches. Without this input, if Zone II had more inleakage than the other two zones, the A SGTS train would not have maintained Zone II at the required differential pressure. No dif ferential pressure anomalies were noted during regularly scheduled surveillance testing of the A SGTS train.

The B SGTS train was not affected.

A station policy is being implemented to better control the status of states link position. Each contract electrician presently on site working on modifications and all future contract electricians working on modifications will be required to sign a statement that they understand station work practices, and that they are required to log the opening and closing of any states link in their work document. Additionally, an administrative procedure is being developed which will define the method of control and/or tagging of open states links by work groups. Nuclear Plant Engineering is performing an update of the circuit breaker interruption diagrams. This update will incorporate all outstanding modification related information to provide an accurate as-built representation of each 120 V ac and 125 V dc distribution circuit in Units 1, 2, and their common area. It also will incorporate all necessary drawing reference information in order to ensure that any drawing has bi-directional reference. In the interim, work planners are being instructed to thoroughly investigate all 120 V ac and 125 V dc distribution circuits, ccnsidering the possible limitations in the drawing representation.

(Refs.13 and 14.)

1.8 Mispositioned Boric Acid Tank Selector Switch Due to Personnel Error During Surveillance Test at Kewaunee On December 18, 1984 at Kewaunee,* with the plant operating at full power and a shif t turnover in progress, operators in the control room noticed that the status light for the boric acid tank / safety injcction suction selector switch was brightly lit. This indicated that the switch position was inconsistent with the actual lineup of the safety injection (SI) pumps to the boric acid tanks (BArs ); i.e., the selector switch indicated that the B BAT was aligned

• Kewdunee is a 503 MWe (net) Westinghouse PWR located 27 miles east of Green Bay, Wisconsin, and is operated by Wisconsin Public Service.

17 when in fact the A tank was aligned. The mispositioning of the BAT selector switch was the result of an operator not returning the switch to its proper position following completion of a monthly surveillance test of the SI suction source switchover logic.

Operation of the SI system is such that on an SI actuation, the SI pumps initially draw highly concentrated boric acid from one of the two BATS and then have their suction source switched to the refueling water storage tank (RWST) upon an indicated low level condition in the tank identified by the position of the selector switch. In the degraded mode present during this event, the SI system would not have automatically switched pump suction from the A BAT to the RWST should the system have been called upon to function during an accident.

The capability for manual switchover of the suction source from the control room remained available to the operator.

At 10:30 p.m. on December 18, 1984, with the plant at full power operation, the Control Room Supervisor was performing a review of the control room panels. He thought that there was something abnormal on the ready status panel, ard upon closer examination determined that the " Boric Acid Tank Out of Service" monitor light appeared to be " bright." Investigating, he found that the control room BAT selector switch was in the "Tk A" position, but the IB BAT was physically aligned to provide suction to the SI pumps. He immediately notified the Shift Supervisor and Control Room Operators and placed the selector switch in the "Tk B" position. This resulted in the monitor light going to " dim," which is its normal indication.

Normal' plant practice is to have either manually-operated valve SI-1A or 1B open to provide concentrated boric acid flow from the selected BAT to the SI pump suction. Upon receipt of an SI signal, valves SI-2A, SI-28, and

• normally open SI-3 receive an open signal. As the aligned BAT empties and indicated level reaches 10%: (1) valves SI-4A and SI-4B open to provide suction from the RWST, and (2) valves SI-2A and SI-2B close to prevent backflow to the BAT due to the head of the RWST. With the tank selector switch on the "Tk A" position and SI-1B open, the logic natrix to open SI-4A and SI-48, and close SI-2A and SI-28, could not have been completed if called upon. Opening valves SI-4A and SI-4B required the level indication to be consistent with the tank selected. If this condition does not exist, the " Boric Acid Tank Out of Service" monitor light on the SI ready status panel will become " bright."

(See Figure 2.)

The switch misalignment occurred earlier the same day during the performance of surveillance procedure SP 35-14'/, " Boric Acid Tank Level Instrument Test."

This surveillance is performed monthly by the Instrument and Control Group (I&C) as required by plant technical specifications. The purpose of the procedure is to check the setpoints of the level instruments on each BAT.

During the procedure, the tank selector switch is positioned to the tank not under test.

The Shift Supervisor approved the start of the surveillance procedure at 12:40 p.m., and the Control Room Operators logged the test started 15 minutes later.

The I&C Technician began with the 1A BAT and therefore the selector switch remained in the "Tk B" position. Upon completing the test on the 1A BAT, the operator repositioned the switch to "Tk A," and the I&C Technician performed the check of the IB BAT level instruments, m

l A N Cn N 'O @ N ,_ O N CD r4 (D (D N r=

44 N Co O C) O Cn N Ch N 00 O c) O Cn N 7- i- T T 7- T-T- 57- 7 T 7- 7- T-I- o Ho Ho FoFo I.- o Ho He He a>  !

.a >cFe J>cJ FoHo p cJ po 1- e i- o

.a > J> _J > a> _a > _a > J> _J > .J > > J> .J > J> l c c c c c c '

4 _c 4 .c.J J c3 J C3 J 4cJ4 _c .i CO J C3 J 4 _cJ J 4 _cJ c3 3 c0 _J 4 .CJ J < .CJ3 CO J CO J l "o "o "

O

.a F .a o

"FJora" .o o "H_o "F _o a F" .o "o"o "t o.a "t .o .:

"o

'a "t- .o:

Ia Fa t F _J J .J I- J H .a

< 46 46 4646 4 4646 4646 4646 co a cc .a 46 to J c<3 .a.6 c3_6 c3..a a 46 .

c3 J c3 a co c3 J c3_6 co.

a 4 6; to a co s c3 _J co a Boric Acid Tank l Selector Switch o o o u o o u ,, ,, o e ,, , , ,r , , ,,

Tk A Tk B l

,r ,, ,, , , ,, ,, <r ,, ,, ,, ,r ,, i r 'r ,r r r , , r r i r a r , r r r 1 L 2 L J L 2 L J L J k J L J L J cn C C o o

c. c.

o ,, , , , 4,__0 m,_, O .r o u ,,

.O 4o mz ._

m2 To o ,, y ,,

SI-4A , , , , _ To SI-4B Opening _:  :

Opening Circuitry L J L Circuitry v ,, u o r i F L J L a i o , I Close Close SI-2A SI-28

" Boric Acid Tank Out of Service" Monitor Light " Bright" Figure 2. Simplifiad Logic Diagram 1

i 4 4 l

19 The last step of the procedure states " Place the boric acid tank selector switch to the desired position." No direction is given in the procedure to determine the " desired position," or who is to initial the step on the test data sheet. Since the procedure is under the responsibility of the I&C group, the I&C Technician initialed the step on the procedure data sheet. He then informed the Control Room Operators that he had completed the test; the Control Room Operators do not remember being told the test was completed. No operator log entry of test completion was made on the day shift. At 1:55 p.m., the I&C Technician brought the procedure data sheet to the Shift Supervisor, who signed off its completion in his log. The Shift Supervisor assumed that the Control Room Operators had been following the test performance and were aware of its completion; therefore, he did not inform them that it was signed off.

Prior to shif t-change, a " Control Room Shif t Turnover Checklist" is completed by the Control Room Operators. ~he off-going day shift, when completing the

" BAT Selected" entry on the checklist looked at the BAT level indication in the control room, which is marked with a grease pencil to indicate the manually aligned tank for SI. He verified that greater than 66% level was available as required by technical specifications, and circled BAT 1B on the checklist.

The " Boric Acid Tank Out of Service" monitor light on the SI ready status panel is the only positive indication of proper valve and tank alignment in the control room. The Control Operator did not notice the abnormal light status.

Even though the monitor light was in the " bright" condition, it is difficult to distinguish " dim" and " bright" on the ready status panel. The difficulties arise from bulb age, aging of the status windows, circuit resistor age, batch or lot of bulbs in use, and the Control Room Operator perspective of the panel.

At 10:00 p.m., in preparation for the next turnover, the evening shif t Control Room Operators also used the BAT grease marking on the tank level indicators, and circled BAT 1B on the turnover checklist. When the Control Room Supervisor discovered the misaligned switch, he changed the checklist to reflect the "as found" position of the selector switch and added a note to indicate the correct switch and tank lineup.

In sumary, the performance of the " Boric Acid Tank Level Instrument Test" placed the plant in a condition that is a violation of a technical specification. By not properly completing the final step of this surveillance procedure, the plant remained in violation of technical specifications for an additional 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. There are several contributing factors for not properly realigning the system at the end of the +-et:

(1) The surveillance procedure did not have provisions for Control Operator signoffs of completed steps or complete independent verification of safety-related manipulations.

(2) There was a lack of communication between the I&C Operator, the Control Room Operators and the Shift Supervisor in ensuring that everyone knew when the test was completed.

(3) The " Shift Turnover Checklist" did not explicitly require checking that the BAT selector switch was in the proper position, or that the monitor light was " DIM."

20 (4) As previously identified in the control roen design review, the contrast of the monitor lights on the SI ready status panel makes it difficult to distinguish the normal condition (" dim") and the abnormal condition

(" bright").

Immediate corrective actions were taken to return the switch to the proper position, investigate the cause of the misalignment, review the safety impli-cations of the event, and issue a plant Incident Report. On December 19, 1984, the Plant Manager conducted a meeting with tbc department heads on the '

significance of the event, and directed each of then to speak to their employees about the importance of iob attentiveness. He also spoke to the personnel q involved on the significance of the event and what could have been done to prevent the incident. 1 In additici. the licensee has completed the following corrective actions:

-- Surveillante procedure SP 35-147, " Boric Acid Tank Level Instrument Test,"

was revised to ensure that test performance compiies with plant technical h specifications. This revision also provides Control Operator sign-offs for operator nanipulations, and ensures adequate independent verification.

-- A review and evaluation of the current SI system hardware and technical specifications was performed. No need for modifying the hardware or technical specifications was identified, since the revision of SP 35-147 has minimized the difficulty in testing the BAT level transmitters with k the other tank still operable, and therefore has minimized the chances for error.

The architect / engineer for Kewaunee, along with licensee nuclear personnel, performed an evaluation of the existing SI ready status panel. In addition, field modifications were attempted on the panel itself. The results indicated that interim changes would not be able to provide an appreciable improvement in the contrast between the " dim" and " bright" states of the windows, and that the only effective solution is redesign of the panel.

The licensee has contracted a consultant to perform an evaluation of the SI ready status panel, and the control room annunciator and panel system as a whole. In the interim, normal maintenance will continue to be performed on this panel, as is done on all panels in the attempt to keep them as effective as possible.

A review of all plant surveillance procedures is being performed by a licensee review comittee made up of personnel from the ISC operations, maintenance, plant technical support, nuclear services, and nuclear licensing and systems groups. The review addresses: (1) compliance with plant technical specifications during test performance, (l') ensuring that adequate provisions for independent verification of safety-related manipulations are included, and (3) ensuring provisions for operator signoffs if operator manipulations of equipment are required.

Reportability requirenients were reinforced with Shift Supervisors, Control Room Supervisors, and Shift Technical Advisors, by further discussions stressing conservatism in the reporting requirements.

t

21

-- An independent review by the corporate technical review group has been initiated to assess plant incidents that are related to personnel errors, experience level of the personnel involved, root causes of the errors, and corrective actions taken. Data has been collected from 173 incident reports related to personnel error at Kewaunee since 1973. A computer data base has been established to facilitate data sorting and trending. The results and recommendations of the technical review will be incorporated into a final report.

-- On January 7, 1985, an enforcement conference was held between the licensee and the hRC. The licensee provided an in depth description of the event and planned corrective actions. In recognition of good licensee performance, the NRC subsequently provided full mitigation of a civil penalty. In addition, the NPC Region III Administrator provided copies of the licensee's detailed report to each licensee in Region I!! as an example of a high quality, in depth analysis with a clear description of corrective actions. (Refs. 15-18).

22 l

1.9 References l

(1.1) 1. NRC, Preliminary Notification PNO-V-85-14, March 11,1985.

2. Portland General Electric, Docket 50-344, Licensee Event Report 85-02, April 8, 1985.

3. NRC, Region V Inspection Report 50-344/85-10, April 18, 1985. <

(1.2) 4 Connecticut Yankee Atomic Power, Docket 50-213, Licensea Event  : I Report 85-06, April 12, 1985. '

5. NRC, Region 1 Inspection Report 50-213/85-07, May 29, 1985.

(1.3) 6. Pennsylvania Power and Light, Docket 50-388, Licensee Event ,

Report 85-16, May 28, 1985. 1

7. NRC, Region I Inspection Report 50-387/85-12; 50-388/85-12, May 30, 1985.

(1.4) 8. Virginia Power, Docket 50-339, Licensee Event Report 85-05-01, April 23, 1985.

9. NRC, Region II Inspection Report 50-339/85-05, May 1, 1985.

(1.5) 10. Rochester Gas and Electric, Docket 50-244, Licensee Event Report 85-11, May 10, 1985.

11. NRC, Region I Inspection Report 50-244/85-06, May 28, 1985.

(1.6) 12. Duke Power, Docket 50-413, Licensee Event Report 85-22, April 12, 1985.

11.7) 13. NRC, Region I Inspection Report 50-387/85-16; 50-388/85-15, May 16, 1985.

14 Pernsylvania Power and Light, Dockets 50-388 and 50-387, Licensee Event Report 85-15, May 30, 1985.

(1.8) 15. NRC Note to R. Wessman/G. Holahan, NRR, from M. Caruso, NRR, re:

"12/18/84 Event at Kewaunee: ECCS Degradation," December 31, 1984

16. Wisconsin Public Service, Docket 50-305, Licensee Event Report 84-21, January 17, 1985.

17. NRC, Region III Inspection Report 50-305/84-23 (DPRP),

January 30, 1985.

18. Letter to J. Keppler, NRC/ Region III, from D. Hintz, Wisconsin Public Service, re: " Status of Corrective Actions (Boric Acid Tank Misalignment Event)," March 13, 1985.

23 2.0 EXCERPTS OF SELECTED LICENSEE EVENT REPORTS On January 1, 1984, 10 CFR 50.73, " Licensee Event Report System" became effective. This new rule, which made significant changes to the requirements for licensee event reports (LERs), requires more detailed narrative descrip-tions of the reportable events. Many of these descriptions are well written, frank, and informative, and should be of interest to others involved with the feedback of operational experience.

This section of Power Reactor Events includes direct excerpts from LERs. In general, the information describes conditions or events that are somewhat unusual or complex, or that demonstrate a problem or condition that may not be obvious. The plant name and docket number, the LER number, type of reactor, and nuclear steam supply system vendor are provided for each event. Further infor-mation may be obtained by contacting the Editor at 301-492-4499, or at U.S.

Nuclear Regulatory Comission, EWS-263A, Washington, DC 20555.

Excerpt P_a age 2.1 Installation Deficiency Results in Unqualified Diesel Generators and Shutdown Boa rd Battery Racks at Browns Ferry. . . . . . . . . . . . . . . . 24 2.2 Conduit Firestop Seals Not Installed Due to Procedural Deficiency and Personnel Error a t Catawba . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

, 2.3 Snubber Deficiencies Due to Improper Installation and Other Causes at San 0nofre............................................ 26 2.4 Leaking Velve Bonnets Result from Improper Identification of Valves to be Tested at Browns Ferry............................. 27 2.5 Degraded Ventilation System Serving Engineered Safety Features Equipment at Kewaunee.......................................... 28 2.6 Motor-operated Valve Torque Switch Setting Not Within Specified Limits Due to Failure to Completely Incorporate Revisions into Setpoint Documents at North Anna........................... 29 2.7 Flow Induced Vibration on Feedwater Regulating Valves Caused by Faulty Valve Design at Robinson................................. 30 2.8 Chlorine Detection System Problems at Brunswick................... 31 2.9 Inadvertent Dilution of Reactor Cavity During ECCS Testing Due to Incomplete Closure of Primary Water System Valves at Zion....... 32 2.10 Technical Specifications Shutdown Due to Inoperable Subcooling Ma rg i n Moni to rs a t Tu rkey Poin t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 2.11 Standby Gas Treatment System Design Deficiencies at Cooper........ 34

24 2.12 Weld Area Degradation of Component Cooling Heat Exchanger Service Water Piping Due to Low Velocity Brackish Water at Salem. . . . . . . . 35 2.13 Auxiliary Feed Pump Turbine Response Time Problems at Davis-Besse. 35 2.14 High Pressure Coolant Injection Turbine Reversing Chamber Problems at Duane Arnold........................................ 37 2.15 Liquid Waste Discharge Without Demineralizer Treatment Due to A dm i n i s t ra t i v e E r ro r . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 2.16 Failure of Automatic Initiation of Auxiliary Feedwater Due to Stuck Solenoid on Bypass Valves at Haddam Neck.................. 38 2.17 Low Steam Line Pressure Safety Injection Actuation During P l a n ned S hu t down a t Ca l l a way . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 2.18 Scaffolding Installation Error Due to Personnel Error at Summer... 40 2.19 Potential Loss of Component Cooling Due to Misadjustment of Relief Valves at Zion........................................... 41 2.20 Inoperable Containment Isolation Valve Due to Mechanical Connector Problem at St. Lucie.................................. 42 2.1 Installation Deficiency Results in Unqualified Diesel Generators and Shutdown Board Battery Racks Browns Ferry Units 1, 2, 3; Dockets 50-259, -260, -296; LER 85-14; General Electric BWRs Units 1 and 2 were in refueling / maintenance outages at the time of this event; Unit 3 was in cold shutdown.

On April 5,1985, the Nos.1, 2, and 3 250 V main battery racks, the 48 V A and B annunciator battery racks, the 48 V telephone battery rack, the 24 V neutron monitoring battery rack, the Unit I and 2 diesel generator (DG) battery A, B, C, and D racks, and the Unit 3 DG battery A, B, C, and D racks were found installed out of drawing specifications. On April 19, preliminary results of an engineering evaluation indicated that the 250 V battery racks, the 48 V battery racks, and the 24 V battery racks were qualified in the present con-figuration. The DG battery racks could not meet seismic qualification require-ments. On April 22,1985, a 3-inch to 4-inch gap between a battery and the end of the 3EB shutdown board battery rack was identified. An evaluation completed on May 1,1985, showed the battery rack could not meet seismic qualification requirements.

The DG battery racks were in an unqualified configuration because modification engineers had not taken appropriate steps to ensure all design requirements were met. A lack of detailed mounting instructions was found to be the primary cause of the 3EB shutdown board battery rack not being properly installed.

A safety evaluation showed there was the potential to damage the 3EB shutdown board battery and the DB batteries during a design basis earthquake. The 3EB shutdown board battery provides control power to the 3ER 4160 V shutdown board.

i i 25 s i

l The loss of one 4160 V shutdown board is acceptable per the Final Safety Analysis

! Report, and would not jeopardize plant safety. Damage to the DG batteries would prevent startup of the corresponding DG, The loss of the DG would accordingly ,

jeopardize the ability to maintain the plant in a safe shutdown condition in the  !

i Qvent of concurrent loss of offsite power.  ;

i i On April 20 cnd 21, the DG battery racks had shims installed to correct the i installation deficiency. On April 22, the 3-inch to 4-inch gap on the 3EB

{ shutdown board battery rack was eliminated by adjusting the end of the battery rack. The design drawings for the 250 V, 48 V, and 24 V battery racks are being

revised to reflect the ir. stalled configuration. The probability of similar

installation errors occurring has been minimized by the present modification i j procedures, which are more comprehensive than the procedures used to install i the battery racks in 1979 and 1980.

J 2.2 Conduit Firestop Seals Not Installed Due to Procedural Deficiency

] <

and Personnel Error Catawba Unit 1; Docket 50-413; LER 85-13-01; Westinghouse PWR 1 q

On February 20, 1985, during a random inspection of firestops, several conduits i

that penetrate fire barriers with their ends unsealed for fire protection were i discovered. Craft personnel indicated that they did not trace down and seal l conduits unless they terminated immediately beyond the penetration. A non- i i conforming item report (NCI) was initiated and it was determined that this may l l be a generic problem. On February 28, 1985, the remaining fire barriers were

determined to be inoperable because they did not meet specifications. Since i this was potentially a generic problem, all fire barriers in the plant were

! declared inoperable until conduits could be traced down and sealed.

J l As soon as the inoperability determination was made, support for fire watches and firestop material installation in conduits was arranged. On February 28, 1985, work was started to trace down all conduits and install firestop seals in the ends. By March 1,1985, all conduits which penetrate fire walls were in-spected and sealed as necessary. A total of 45 conduit ends were sealed.

Cable penetration and firestop work activities at Catawba are conducted under Construction Procedure 469 (CP469), " Installing and Reentering Penetration Firestops, Pressure Seals and Flood Seals." CP469 incorporates the require-

ments of the " Specification for Installation and Repairing of Cable Penetration

Firestops" (CNS-1390.01-0098) into procedural format to be used by craft person-

nel. Also, a Construction 0A Procedure, " Mechanical and Cable Penetration Firestops" (M-53A), is used to inspect all firestop work against applicable

! specifications.

l During original procedure preparation and subsequent revisions, personnel

! failed to properly incorporate into CP469 the requirement to seal conduit ends,

. although CNS-1390.01-0098 requires this. Consequently, when the builder craft

! repaired firestops, they did not trace out conduit to seal the ends, but only sealed sleeves and conduits that terminated immediately et the fire barrier.

l Also, QA Inspectors failed to inspect the ends of conduits for seals. QA l Procedure M-53A requires QA to " perform necessary inspection to verify compli-1 l ance with applicable specifications." This intent was not met for three reasons:

i

,_-s _..---,---,w -n..,-n- - . - - - , + . , , , - -.,-. ----.- ,-- n.~.v-n. -.--n.- - en. -

26 (1) QA Personnel had an inadequate knowledge of applicable specifications, (2) QA assumed that CP469 had been written adequately and actually reviewed crafts work against CP469 rather than against CNS-1393.01-0098, and (3) QA assumed that elec-trical craft would seal the ends of conduits under specification CNS-1390.01-0121.

This specification requires that electrical craft seal the ends of conduits for moisture pre.tection purposes rat <er than fire protection purposes. However, under this specification, certain conduits are exempted from being sealed.

Although some conduits were sealed by electrical craft, the sealing reouire-ments per CNS-1390.01-0121 did not meet the fire protection sealing require-ments of CNS-1390.01-0098 until changes were made to the specification during .

tne incident. Therefore, before the incident, credit should not have been \

taken for sealing conduits under CNS-1390.01-0121. To make the two specifi-cations agree, Variation Notice 48411 was initiated. This allows credit to be taken for sealing performed under either specification.

2.3 Snubber Deficiencies Due to Improper Installation and Other Causes San Onofre Unit 2: Docket 50-361; LER 84-79; Combustion Engineering PWR On November 20, 1984, with Uni! 2 defueled, the routine 18-month surveillance of Pacific Scientific Mechanical Snubbers was initiated. By December 26, 1984, eight snubbers were determined to have been damaged during installation and were rendered inoperable contrary to Technical Specification Section 3.7.6. As a result of continued surveillance testing, a total of 88 snubbers were identi-fied as deficient. These deficiencies were categorized as being caused by improper installation (13 snubbers), environmental degradation (3 snubbers),

vibration (20 snubbers), hydraulic transients (26 snubbers), wear related de-gradation (25 snubbers), or mmfacturing defect (1 snrober).

As the functional surveillance testing program uncovered the failures, the size of the test sample of the affected type of snubber was increased per Technical Specification Section 4.7.6.e. The failure rate of the small size snubbers (PSA 1/4, 1/2) was about 18%, which required the inspection sample to be ex-panded to 100% for this size. For both the medium (PSA 1, 3, 6, 10) and the large (PSA 35,100) snubbers, no failures occurred in the sample population.

Where potentially damaging transients were suspected, snubbers within the transient boundary were visually inspected and freedom of motion was verified in accordance with Technical Specification Section 4.7.6.c. As part of this expanded inspection, three medium size snubber failures were identified. In addition to the technical specification inspection, physical walkdowns of these postulated transient pathways were performed to visually inspect for damage to other' pipe supports or the piping itself. Selected snubbers, which were found damaged due to these hydraulic transients, were destructively tested to deter-mine ultimate failure loads for transient analysis purposes.

All snubbers that failed to meet the functional testing acceptance criteria were removed for further testing and/or physical examination and were replaced with operable snubbers. Ultimately, all the inoperable snubbers (with the exception of three) were disassembled and inspected to determine the failure mode. Upon completion of this examination, thermal stress analysis will be or has beer, performed for all lines associated with the inoperable snubbers.

Fatigue analysis will be or has been performed for all Class I lines involved.

In addition, transient stress analysis has been performed on all lines having

\

27 undergone a potentially damaging transient by postulating a transient path and using loading values based on physical evidence and operational data.

Although corrective action will not be finalized until the engineering analysis is completed, several preliminary corrective actions are being taken as follows:

(1) where transients have been identified, operational procedures are being reviewed, and equipment redesign is being pursued to minimize or accommodate future transients; (2) to minimize environmental degradation, the addition of protective coverings for snubbers which are susceptible to this phenomenon is being evaluated; (3) to minimize vibration failures, measurement of the opera-tional system vibration frequencies will be made where possible and compared to vendor supplied data to more accurately determine approximate life span of snubbers operating in these conditions and, where appropriate, supports less susceptible to vibration damage will be evaluated; (4) to preclude installation i

errors, mainte' nance procedures for installation and repair of snubbers are being revised to ensure proper installation; and, (5) the one identified manu-facturing defect is not considered generic in nature, as it is one failure found in over 500 small snubbers tested and is being considered an isolated incident with no further action planned.

2.4 Leaking Valve Bonnets Result from Improper Identification of Valves to be Tested Browns Ferry Units 1, 2, 3; Dockets 50-259, -260, -296; LER 85-C8; General Electric BWRs At the time of this event, Unit I was at 90% power, Unit 2 was in a refueling outage, and Unit 3 was in cold shutdown.

On March 15, 1985, while performing maintenance work on the Unit 2 high pres-sure coolant injection (HPCI) turbine exhaust valve (HCV-73-23), it was dis-covered that the valve bonnet was not being leak checked in accordance with 10 CFR 50, Appendix J requirements. A review of engineering drawings and appli-cable procedures revealed that the reactor core isolation cooling (RCIC) turbine exhaust valve (HCV-71-14), the HPCI turbine exhaust drain valve (HCV-73-24),

and the RCIC turbine condenser vacuum pump discharge valve (FCV-71-32) had flanged bonnets that were not being local leak rate tested. All four valves are stop lift check valves. On March 15, surveillance Instruction 4.7.A.2.g.2 was revised to include bonnet leak tests for HCV-73-23 and HCV-71-14 The other valves, HCV-71-32 and HCV-73-24, were not added at this time since a modi-fication was required to make the valve bonnets testable.

Unit I was manually scrammed on March 19,1985, at 0127 in order to comply with Technical Specification 4.7.A.2.h requirements after HCV-73-23 and HCV-71-14 both failed the bonnet leak test. Valves HCV-71-14 and HCV-73-23 both passed the local leak test on Unit 2, while HCV-71-14 on Unit 3 failed the test.

The root cause of this condition was the failure to properly identify all the 10 CFR 60, Appendix J valves. Valves HCV-1-71-14 and HCV-3-71-14 were disas-semhied and inspected. Both valves had an extra outer bonnet gasket which made the inner gasket ineffective. The valve bonnet integrity was not breached on either valve, based on no external leakage being detected during the bonnet leak test and the valve bonnet seeing pressure during the last integrated leak rate test (ILRT). Disassembly of HCV-1-73-23 revealed deteriorated gaskets.

During the local leak rate test, considerable leakage was seen through the

23 outer gasket. Since this valve bonnet had seen pressure during the last ILRT and had been visually inspected with no leakage indications, it appears the bonnet integrity was maintained by the inner gasket.

Valves HCV-71-32 and HCV-73-24 had a single gasketed bonnet design; therefore, they were not testable. Both of these valves, on all three units, are being modified so they will have a testable bonnet. These valves will be tested prior to their respective unit's startup.

When HCV-3-71-32, HCV-3-73-24, and HCV-2-71-32 were disassembled for modifica-tion, a spring was found missing. This spring constantly exerts a small clos-ing force on the valves' discs. An engineering evaluation was performed on the valves and determined that the missing springs did not adversely affect any safety-related functions.

In order to prevent recurrence of this problen., an engineering evaluation of the Browns Ferry Appendix J testing requirements is being performed on all valves that could possibly have test requirements imposed on them. Surve11-lance Instruction 4.7.A.2.g.2 was revised to include bonnet leak tests on the four valves. Valves HCV-73-24 and HCV-71-32 will be modified to a testable bonnet design and successfully pass the bonnet leak test prior to their respec-tive unit's startup. The valves which failed the bonnet leak test will success-fully pass the bonnet leak test prior to their unit's startup. The valves with the missing springs will have springs installed prior to startup of their units.

2.5 Degraded Ventilation Systems Serving Engineered Safety Features Equipment Kewaunee; Docket 50-305; LER 84-18-01; Westinghousa PWR During the 1984 refueling outage, several of the fan coil units (FCUs) serving engineered safety features (ESF) equipment were found to have air flows less than nominal design. The air sides of the units were cleaned and, althcugh design air flows were not achieved, some improvements in air flow were obtained.

It is suspected that the reduced air flow is caused by ir. creased fin fouling which results in an excessive differential pressure across the cooling coils (CCLs).

Evaluations were then performed to determine if the fan coils had sufficient cooling capability to ensure proper post-accident operation of ESF equiocrent.

During the course of these evaluations, it was discovered that additional area cooling would be required to maintain acceptable post-accident temocratures under worst case conditions. These evaluations concluded that, under current conditions, post-accident area temperatures would be limited to a value which would not be expected to cause short-term failure of ESF equipment.

Finally, on September 28, 1984, continuing investigations discovered that the service water side of several fan coil units had become partially blocked with silt, further degrading their cooling capability. The fan coil units were immediately cleaned, and enhanced tubeside operation was verified by tempera-ture measurements on the air inlet and discharge sides of the coils.

A thorough review of the safety-related equipment in the affected areas was conducted and reasonable assurance of equipment operability under current 1

1

29 conditions was confirmed. An evaluation to increase the cooling capability of the existing FCUs, or to provide additional cooling to a level sufficient to maintain acceptable temperatures under postulated post-accident conditions, also was performed. The following corrective actions were or will be implemented as a result of these evaluations: (1) FCUs serving equipment important-to-safety will be included in the plant preventive maintenance program to ensure peri-odic cleaning; (2) replacement cooling coils for the turbine building basement and auxiliary building basement and mezzanine FCUs will be purchased and in-stalled; (3) two additional FCUs have been purchased and will be installed in the auxiliary building basement, and two in the auxiliary building fan floors; (4) the airflow through the auxiliary building mezzanine FCus will be increased by adjusting the fan speed; (5) the turbine building basement safeguards cor-ridor will be split into separate Train A and B areas, each serviced by its own i dedicated FCU (and qualification of the existing auxiliary feedwater pump 1A area FCU will be upgraded from nonsafety-related to nuclear safety-related);

and (6) the necessary duct work modifications and flow balancing associated with the above actions will elso be completed.

! 2.6 Motor-0)erated Valve Torque Switch Setting Not Within Specified Limits )ue to Failure to Completely Incorporate Revisions into Setpoint Document North Anna Units 1, 2; Dockets 50-338, -339; LER 84-10-01; Westinghouse PWRs Based on a concern raised with torque switch settings at Surry Power station and a request from the North Anna resident NRC inspector, an inspection of the torque switch settings of five Unit 1 motcr-operated valves was conducted with i Unit 1 in a refueling outage and Unit 2 at 75% power. The inspection revealed three of these valves had torque switch settings which differed from those specified by the North Anna Setpoint Document. Based on the results of this initial inspection it was decided to check the torque switch settings on the i Unit I safety-related motor-operated valves during the Unit 11984 refueling outage, and check the torque switch settings of the Unit 2 safety-related motor-operated valves during the Unit 2 1984 refueling outage. (These are Limitorque SMB-000 and SMB-00 motor-operated valves.)

Tnese inspections revealed 67 of the 134 valves inspected on Unit 1 and 62 of the 138 valves inspected on Unit 2 had torque switch settings that were not within the limits specified by the North Anna Setpoint Document. This resulted from using superseded torque switch settings, in some cases, when developing the North Anna Setpoint Document, and confusion when adjusting torque switch i

settings because of torque switch design. The North Anna Setpoint Document (approved in July 1982) contained torque switch settings that were based on anticipated plant conditions. Pre-operational tests were conducted to verify acceptable torque switch settings under actual dynamic flow conditions. Torque switch settings were changed based on the results of these tests. It has been necessary to change torque switch settings since the pre-operational tests were conducted to ensure acceptable valve operation. These revised torque switch settings were not completely incorporated in the North Anna Setpoint Document.

The Setpoint Document has now been revised based on an engineering review of setpoints. Torque switches have either been adjusted or left as is, based on an engineering evaluation of each setpoint. In several cases, the engineering evaluation indicated that for conservatism the valves' torque switch settings

30 should be lef t as is to ensure they would perform their safety function even though a setting disagreed with available documentation. These setpoints are still under review and appropriate setpoint document changes and/or valve torque switch setting changes will be made when this review is ccmplete.

Confusion when adjusting torque switch settings for the actuators en these Limitorque motor-operated valves was caused by the design of the torque switch.

The open and close torque switch settings are adjusted by moving screws located on a plate which is attached to the torque switch. Confusion in adjusting torque switch settings is caused by the fact the "open" electrical contacts are located near the screw used to adjust the close setting of the torque switch l and the "close" electrical contacts are located near the screw used to adjust the open setting of the torque switch.

New maintenance procedures approved on July 26 and August 31, 1984 contained misleading torque switch diagrams which also :ontributed to this event. An electrician using these procedures would transpose the desired open and close torque switch settings. These procedures have been revised to include a clearly labeled diagram of a torque switch. The procedure used to adjust torque switch settings prior to July 26, 1984 contained a clearly labeled correct torque switch diagram. The North Anna Nuclear Training Department has instructed elec-tricians of the potential for confusion when adjusting torque switch settings, and has informed electricians that applicable procedures have been revised to include a clearly labeled diagram of a torque switch.

The misleading torque switch diagrams were based on a diagram contained in INP0 report 83-037, assessment of " Motor-Operated Valve Failure." This problem has been brought to the attention of INP0. INP0 has drafted an Operations and Maintenance Reminder to inform its members of this problem. -

2.7 Flow Induced Vibration on Feedwater Regulating Valves Caused by Faulty Valve Design Robinson; Docket 50-261; LER 85-10; Westinghouse PWR On March 1, 1985, while operating at 50% power, the plant experienced high feedwater line vibrations resulting in feedwater regulating valve (FWRV) oscil-lations. On a previous load increase, these high vibrations were experienced between 40% and 60% power. In an effort to reduce the vibration, the load was increased; at 52% power, high vibrations at the FWRVs caused the instrument air line to the B FWRV to separate from the valve operator, closing the B FWRV.

With feedflow slot to B steam generator (SG), the reactor tripped en a " low SG 1evel coincident with a steam flow greater than feedflow" reactor trip signal.

The flow induced vibration at the FWRVs was caused by incorrect data used to design the valve internals. The actual differential pressure (DP) across the  ;

FWRVs, which increased due to numerous secondary system improvements, was ap- I proximately 100 psi greater than anticipated. l Interim corrective action has been taken to reduce the flow induced vibrations until the valve internals can be replaced. The 6A and 6B feedwater heater outlet gate valves have been throttled to decrease the operating DP across the FWRVs by decreasing the pressure at the FWRV inlet. A special procedure was implemented, including these interim actions, allowing plant operation with the existing FWRV internals. The FWRV internals are planned to be replaced by the

31 end of the next refueling outage. Further vibration reduction was also accom-plished by increasing the air pressure required to operate the FPWVs from 12 to 18 psi by FWRV spring ad,iustment.

2.8 Chlorine Detection System Problems 2.8.1 Failure of Units' Common Chlorine Detection System to Meet FSAR/ Technical Specification Design Criteria Brunswick Units 1, 2; Dockets 50-325, -324; LER 84-33-01; General Electric BWRs While performing a design review of the control building emergency ventilation system (CB HVAC) following discussions with the Resident NRC Inspector, it was determined that the chlorine isolation portion of the system did not satisfy I the design criteria established in the FSAR or the basis to technical specifi-cations. The basis to Technical Specifications 3/4 3.5.5 (chlorine detection system) states that the chlorine detection system is consistent with Regulatory Guide 1.95. Regulatory Guide 1.95 and the FSAR (Section 6.4.2.2) both indicate that the CB HVAC will be isolated by either a high chlorine signal at the Con-trol Building air intake plenum or by a high chlorine signal at the chlorine storage location. Contrary to these requirements, the CB HVAC will only isolate on a high chlorine signal in the control building air intake plenum.

A detailed review into the history of the chlorine isolation system was con-ducted. During the course of this investigation, it could not be determined if the isolation logic from the detectors in the chlorine storage location had ever been installed; althcugh, as noted, the logic does appear on some plant drawings.

The architect / engineer for Brunswick, United Engir.eers & Constructors (UE&C),

is being requested to investigate their in-house documentation in an attempt to determine the cause for the isolation design omission.

Corrective actions include the following:

(1) A plant mcdification will be written and implemented to bring the chlorine detection system into compliance with design commitments. This modifica-tion will assure that the isolation time from detection of chlorine to damper isolation is less than the air transport time from the chlorine detector to the damper in accordance with the criteria of Regulatory Guide 1.95.

(2) A thorough desig1 review of the chlorine detection system and its asso-ciated isolat!or logic was performed. During this review, it was determined that the suctica line was located such that it was susceptible to partial clogging by saad, small gravel, etc. In addition, the vendor recommended that the suction line piping material be changed from copper to PCV or stainless stael. A plant modification has been completed which changed the piping to stainless steel, relocated the suction point to make it less susceptible to clogging, and relocated the air inlet plenum detectors closer to the suction point to provide a auicker isolation response time.

(3) Until the chlorine detection system can be restored to the design comit-ments by plant modification (s), the following actions have been or will be implemented to assure adequate chlorine protection for Operations personnel in the control room:

32 (a) Surveillance on ,the control building air intake plenum detectors' drip rate will be performed weekly to assure detector operability.

(b) Standing instructions have been established to require the isolation of the CB HVAC upon the receipt of a high chlorine annuciation from the c'etectors that are located in an area adjacent to the chlorine storage location detectors, and that have an alarm function only.

This isolation will be maintained until the alarm clears and the integrity of the chlorine system is verified.

2.8.2 Manually Initiated Isolations of Units' Common Control Buildirg Heating Ventilating Air Conditionino System Due to Chlorination System High  !

Chlorine Alarms I

Brunswick Units 1, 2; Dockets 50-325, -324; LER 85-13; General Electric BWRs l

On March 7 and 22, 1985, the Units 1 and 2 common control building heating ven-tilating air conditioning (CB HVAC) system was manually isolated due to the receipt of high chlorine alarms at the chlorination system storage location.

These isolatior.s were carried out in accordance with plant standing instruc-i

'tions, which were implemented due to a discovered design deficiency involving the chlorine isolation function of the CB HVAC system (identified above). On .

March 7, the units were operating at power levels of 60% (Unit 1) and 100% '

(Unit 2). On March 22, the units were operating at 60% (Unit 1) and 65%

(Unit 2).

The event on March 7 occurred shortly after the isolation valve to the chlorina-l tion system chlorine tank car was opened while cancelling an equipment clearance.

! The cause of the event on March 22 could not be determined. In each case, an l Auxiliary Operator dispatched to the area found no evidence of a chlorine leak.

i Within approximately 40 minutes of the first event and 23 minutes of the second

event, the CB HVAC system was returned to normal service.

Isolation of the CB HVAC system, whether automatically or manually inigiated, s <

places the system into its most conservative condition.

• I 2.9 Inadvertent Dilution of Reactor Cavity During ECCS Testing Due to Incomplete Closure of Primary Water System Valves 4

J Zion Unit 1; Docket 50-295, LER 85-13; Westinghouse PWR l On April 2,1985, the unit's reactor cavity was inadvertently diluted during the emergency core cooling system (ECCS) full flow test. The unit was in cold shutdown condition at 2766 ppm boron, and the reactor vessel head was removed.

ECCS finw characteristics by The pumping purpose of the from the full flow refueling teststorage water is to verify tank (RWST) into the vessel and l

measuring flow rates. The boron concentration of the RWST was at approximately l 1478 ppm; therefore, dilution of the reactor vessel occurred during the test.

About 12 days prior to the above test, apparently two primary water system valves (1VC8455 and IVC 0015) had not been fully closed after a hydro was per-  !

formed on the volume control system suction line. (These valves are controlled '

by reach rods and are also diaphram valves; therefore, it is difficult to deter- I mine when they are fully closed.) During this period prior to the test, the 1

s, g

w

33 RWST was being diluted through the above valves but was not detected since there were no refueling mode RWST surveillance requirements.

Section 3.9.5.D of the Zion Technical Specifications state that " Positive reac-tivity changes shall not be made by boron dilution when the containment integ-rity is not intact unless the reactor is maintained subcritical by at least 10%

delta K/K." Two separate calculations were performed to determine the shutdown margin after the dilution event. Using actual source range counts, the shutdown margin remained greater than 10% (14.2% as calculated) after the event. A least

squares fit method was utilized to plot the counts versus time. Calculations using this plot resulted in a 95% confidence level of a 13.1% shutdown margin.

l The second method used was to attempt to actually determine the boron concentra-tion in the vessel after the dilution event. Since no model is available to take into account the mixing between the reactor cavity and vessel, an extremely conservative calculation was made. The result of this indicated shutdown margin was reduced to 6.8% during the event. If this had occurred, the count rate would have more than doubled. The actual increase was 26%, supporting the con-clusion that the shutdown margin of 10% was not exceeded.

Several long and short term corrective actions have been developed to prevent recurrence. Short tern corrective actions include recording RWST level every shift when shut down. A sample will be run if a rise of 0.5 ft occurs in RWST level. The PWST will be sampled weekly, as well as before the ECCS full flow test. Long term corrective actinns include modification to cut and blind flange the primary water line that resulted in the dilution. A study will be initiated regarding the use and mainter m e of reach rod valves.

2.10 Technical Specificaticrs Shutdown Due to Inoperable Subcooling Margin Monitors Turkey Point Units 3, 4; Dockets 50-250, -251; LER 85-10; Westinghouse PWRs At 7:35 p.m., on March 30, 1985, a plant shutdown of Unit 3 was initiated for both a scheduled refueling outage and in accordance with the requirements of Techt.ical Specification 3.5, Table 3.5-5, which resulted from six reactor cool-ant system temperature elements being declared inoperable. The six temperature elements were declared inoperable due to the potential that they could fail if subjected to the elevated moisture and pressure levels during design basis events. These temperature elements provide the input signals to two independent channels of reactor subcooling margin monitors. This subcooling margin instrumen-tation is used to monitor the subcooled conditions in the primary system during both normal and off-normal operating evolutions. Because the reactor shutdown was initiated coincident with a scheduled refueling outage, the reactnr was cooled down and placed in a refueling shutdown condition.

The reason for both independent subcooling margin monitoring channels being considered inoperable and for the subsequent plant shutdown was due to the failure of the six wide-range temperature elements to meet environmental quali-fication acceptance criteria. Pursuant to the requirements of 10 CFR 50.49, the licensee and their contractor have established a program for the environmental qualification of electrical equipment. Under this program, the environmental qualifications of the subject temperature elements were reviewed in January 1985.

i

34 1

During tSe review, it was found that inadeouate documentation to conclusively demonstrate the qualifications of the temperature elements had been submitted and a further investigation was required. At the conclusion of this investi-gation on March 29, 1985, the licensee determined that the environmental quali-fication of the temperature elements was not adequate, and the plant manage-ment staff was immediately advised of this conclusion.

Corrective actions which have been taken or are planned to ensure that the sub-1 ject temperature elements have acceptable environmental qualifications include the following:

t l (1) The Unit 4 reactor system temperature elements for the subcooling margin l

) monitors were hermetically sealed with epoxy on February 3, 1985, which t was the first convenient Unit 4 outage. This action was taken as a precautionary measure until the environmental qualification of the temperature elements could be verified through a subsequent investigation which was complemented on March 29, 1985. 4 i

t (2) The Unit 3 subcooling margin monitor temperature elements were hermeti- I cally sealed with epoxy during the refueling outage which began in March

1985.

(3) To enhance plant maintenance, the existing temperature elements will be re-placed by environmentally pre-qualified temperature elements of a different manufacturer. This replacement will be completed for Units 3 and 4 during g future refueling outages.

2.11 Standby Gas Treatment System Design Deficiencies Cooper; Docket 50-298; LER 85-02; General Electric EWR s On March 5, 1985, during plant shutdown conditions, the licensee retained an independent engineering firm to perform a review of the standy gas treatment system (SGTS) design, operating procedures, and surveillance procedures. The purpose of the review was to determire if there were any recommended modifica-tions which would ensure compliance with the applicable requirements of Regula-tory Guide 1.52 and ANSI N509.

During the review of the system, it was determined that there are three defi-ciencies which could possibly prevent the system from performing its intended  ;

function. These deficiencies, due to inadequacies in the design of the original  !

system, are as follows: {

(1) Expansion sleeves at the SGTS fan discharges and in the crossover line i between the two SGTS trains do not have sufficient slack in the sleeves  !

and potentially would not provide for sufficient movement capability in a seismic event. This could result in a failure of the subject sleeves.  ;

t l (2) The crossover duct between the two SGTS trains is unrestrained in one  !

direction. Unrestricted movement during a seismic event could potentially  !

result in a failure of the crossover duct work. j i

l l (3) The SGTS housing drains are tied into a common drain header and there are

no valves or loop seals in the housing drain lines. This piping arrange-

, ment could permit a small amount of process flow to bypass the filter and adsorber banks.

35 The licensee will perform the following corrective actions prior to performing any operations which require availability of the SGTS in accordance with Tech-nical Specification 3.7.B.1:

l (1) The aforenentioned expansion sleeves will be replaced with sleeves which have sufficient expansion capability to prevent failure of the sleeve during the design basis seismic event.

(2) Additional bracing will be added to the supports for the crossover duct to provide the necessary restraint to prevent failure of the crossover duct during the design basis seismic event. The seismic adequacy of other supports in the SGTS will also be verified and any necessary modifications will be performed.

l (3) An isolation valve will be installed in each SGTS housing drain line to preclude a portion of the air flow from bypassing the filters. In the event that valve procurement time is excessive, the housing drains will be individually capped until the valves are available.

< 2.12 Weld Area Degradation of Component Cooling Heat Exchanger Service Water Piping Due to Low Velocity Brackish Water i

Salem Unit 1; Docket 50-272; LER 84-08-01; Westinghouse PWR 4

On March 9, 1984, during a refueling outage, radiography of 16 welds in the service water piping associated with the No. 12 component cooling heat exchanger revealed possible indications in the vicinity of nine of the welds. This radio-graphy was performed as the result of weld repairs which were effected during i the previous refueling outage. Further analysis revealed that pitting corrosion

was occurring in the heat affected zone of the welds, although the welds them-selves were in excellent condition. A complete mapping of the stainless steel piping was performed and indicated that the pitting damage was not confined to the weld areas alone, but was rather extensive throughout the piping.

l i Because of the degraded condition of this safety-related system, the event was originally reported in accordance with 10 CFR 50.73(a)(2)(v). This supple-mental LER identifies the root cause and corrective action taken as a result of that occurrence. The pitting corrosion was determined to have been caused by the low velocity brackish water in contact with the stainless steel piping. A

design change was implemented which replaced the stainless steel pipe associ-ated with the No.12 component heat exchanger with carbon steel pipe coated with a polyethylene copolymer coating. (It should be noted that the service water piping for the No.11 component cooling heat exchanger on Unit 1, and

, the Nos. 21 and 22 heat exchangers on Unit 2 are constructed with concrete coated carbon steel piping, and therefore is not susceptible to the corrosion i problem experienced by heat exchanger No. 12).

2.13 Auxiliary Feed Pump Turbine Pesponse Time Problems l

! Davis-Besse; Docket 50-346; LER 85-07; Babcock and Wilcox PWR On March 23, 1985, during cold shutdown, the post trip review of a steam and I feedwater rupture control system (SFRCS) trip from 26% rated thermal power showed that auxiliary feedwater pump (AFP) 1-2 had not met its 40-second re-

\

{

1 l

-. ~. . .- . . . - _- _ . - . _ , . . . . . - -

j.

l 36 l sponse time required by Technical Specificaf kns 3.3.2.2. The SFRCS trip oc-l curred on March 21, 1985, during a controlled shutdown for a maintenance out-l age. AFP 1-2 was declared inoperable. In addition, AFP 1-1 had been declared i

inoperable on March 16, 1985, due to a hanger failure. At that time, the hanger I

problem was thought to be from waterhammer forces that resulted from the SFRCS logic change implemented during the 1984 refueling outage. The hanger had been

repaired the same day.

The SFRCS logic change, which opens the cross-connect main steam supply valves MS106A and MS107A in addition to the main steam supply valves MS106 and MS107 on a full SFRCS trip, has been determined to be a primary cause of the water-hammer. Waterhammer caused some hangers to looser in both trains; however, an engineering evaluaticn determined that only one support on AFW Train I was  :

damaged to the extent that it affected the operability of that train. That i support was repaired the same day, and the train declared operable. '

(

The SFRCS logic change was also thought to be the cause of the slow response time on AFP 1-2. Even though both trains would be affected, the differences in the piping configuration was thought to explain why AFP 1-2 was affected

, more than AFP 1-1, causing it to hesitate and not meet its response time.

l However, even after the SFRCS logic was changed so that MSIC6A and MS107A do

, not open except on low main steam line pressure, AFP 1-2 response was not

! acceptable. i I

t Further investigation determined that the biggest contributor to the response  ;

i time problem was the sizing of the internal speed setting bushing in the new t  !

Woodward PGG governor that was installed on only AFP 1-2 during the 1984 re-fueling outage. The installed 30-second speed bushing was hindering AFP 1-2 l

from meeting its response time.

In addition, during the 1984 refueling outage the discharge of AFP 1-2 (AF3872) was changed to a normally opened valve. With the discharge valve open, the I.

level control circuit is enabled and, during normal operation, the governor would control on the low speed stop until a low steam generator level is sensed.

If a once-through steam generator low level trip of SFRCS occurred with the governor on its low speed stop, the response time would be delayed. It takes

=

approximately 60 seconds for the new governor to oo from the low speed stnp to l the high speed stop, instead of the 15 seconds of the original governor. Addi-l tional testina and evaluations are expected to help determine the cause of these problems.

l The corrective actions were:

l (1) The internal speed setting bushing of the new PGG governnr was replaced

with a 15-second ramp bushing, i

4 (2) The position of the pump discharge valve (AF3872) was changed from normally J cpen to normally ::losed.

(3) The logic of the steam supply valves (MS106A and MS107A) was changed so l that they will no longer open simultaneously with valve MS106 and MS107.

d a

4 w= gm w-.r--o gpg e.we g---emp-e.

37 2.14 High Pressure Coolant Injection Turbine Reversing Chamber Problems Duane Arnold; Docket 50-331; LER 85-07; General Electric BWR l During disassembly of the high pressure coolant injection (HPCI) turbine for overhaul and inspection on February 21, 1985, while in a refuel outage, damage and missing parts were noted in several of the ten steam reversing chambers which serve to redirect steam back into the turbine blades followina its ini-tial injection. The turbine is a Terry Corporation (T147) Type CS.' Three of ,

the chambers (#4, 5, and 9) had cracks, with one of these (#5) having a piece '

of approximately 1.5 square inches missing out of its vane. A fourth chanber i (#7) had a linear indication. Two reversing chamber mounting bolts were miss-ing on chamber #4, and three were missing on chamber #5. On six of the ten reversing chambers (#3, 4, 5, 6, 7, and 8), locking tabs for one or more of the mounting bolts were missing or found cracked and/or eroded. Cracking of the

~

reversing chambers has been discovered in the HPCI turbine during previous re-fueling outages. During the last outage (1983) all ten reversing chambers were

! replaced with new chambers which had passed a radiographic examination.

The reversing chambers which were found with cracks or indications are four of five which receive inlet steam at turbine full load. Historically, these five i reversing chamber locations have experienced cracking problems. The cause of

this cracking is believed to be pressure pulsing fatigue and thermal fatigue from the cyclic duty experienced by the HPCI turbine. Metallurgical properties of the reversing chambers are also a factor.

i Between each outage, the HPCI system has performed satisfactorily, with no system operability degradation noted as a result of cracked chambers or bolt and locking tab problems. As indicated by operating experience at the plant, and in the opinion of the manufacturer, cracks in reversing chambers or small pieces breaking out of the chambers will not affect the ability of the HPCI system to perform its design .~ unction. As a corrective measure, inservice and warehouse stock reversing chambers will continue to be liquid-penetrant and I radiograph-tested prior to installation in the turbine. The location and

. history of each reversing chamber within the turbine will be noted, and the turbines will be internally inspected at the next refuel outage to determine their status. Engineering review of reversing chamber problems is continuing.

l The missing reversing chamber mounting bolts and the missing, cracked and eroded bolt locking tabs discovered during the turbine inspection are not believed to be a cause of, or a direct result of, the cracked reversing chambers. Each locking tab secures three bolts. The cause of the locking tab failure appears to be steam flow across an unsupported span between the bolts. Failure of a locking tab allows bolts to loosen and work their way out. Broken bolts have been found during past inspections. As indicated by plant operating experi-j ence. these problems do not affect the ability of the HPCI system to perform

'j its design function. Previous analysis by General Electric has indicated loose parts from the HPCI turbine will not enter the reactor vessel. A design modi-fication consisting of individual locking tabs for each bolt, with no unsup-

. ported span, will be used when the reversing chambers are reinstalled. These

! also will be checked during the internal turbine inspection planned for the i

next refuel outage.

1

l 38 l l

1 2.15 Liquid Waste Discharge Without Demineralizer Treatrrent Due to Administrative Error

! North Anna Units 1, 2; Docket 50-338, -339; LER 84-13-01; I Westinghouse PWRs

. On September 25, 1984, with Unit 1 in startup following a refueling outage and

} Unit 2 in refueling, the B liquid waste mixed bed clarifier demineralizer which l had been in service since September 10, 1984, was found to contain no resin required for ion exchange. The B clarifier demineralizer was initially placed i in service on September 10 because projected doses to unrestricted areas due to clarifier effluent were determined to be in excess of the limits specified in l Technical Specification (TS) 3.11.1.3. Consequently, between September 10 and September 25, 1984, clarifier effluent was discharged without treatment, with projected doses due to liquid effluent in excess of the specified limits. The discharge path of the clarifier effluent is into the circulating water dis-charge canal and subsequently into the North Anna Reservoir.

i The unloaded clarifier demineralizer was placed in service because inadequate controls existed for checking the operable status of the demineralizers prior to placing them in service. When the error was discovered on September 25, j 1984, the redundant loaded A liquid waste mixed bed clarifier demineralizer was placed in service.  !

Additional investigation of the liquid radwaste treatment system disclosed that the liquid waste mixed bed clarifier demineralizers were not in service from l July 11, 1985 to September 10, 1984 During this time period, projected doses to unrestricted areas due to liquid waste effluent were above the limits speci-i fied in TS 3.11.1.3. The liquid waste demineralizers were not in service, as a j

result of administrative error.

l The high level liquid radwaste treatment system was fully cperational through-out these times and high level liquid radwaste was properly demineralized prior to discharge to the clarifier. The dose to the maximum exposed men.ber of the '

public from radioactive materials in released clarifier effluents did not ex-

, ceed the limits specified in TS 3.11.1.2 for that.

i In order to prevent recurrence of similar events, Operations personnel were instructed on the importance of verifying clarifier demineralizer status when required to place them in service. Operating Procedures for the liquid waste system will be reviewed for adequacy. Proper controls will be included to  :

ensure that the status of the clarifier demineralizers are verified when they are required for service. Health physics procedures concerning liquid effluent dose projections will be reviewed and revised as necessary so that appropriate administrative controls exist for ensuring that the liquid waste mixed bed clarifier demineralizers are placed in service when required by TS 3.11.1.3.

2.16 Failure of Automatic Initiation of Auxiliary Feedwater Due to Stuck Solenoid on Bypass Valves Haddam Neck; Docket 50-213; LER 85-05; Westinghouse PWR

! A test of the automatic initiation of the auxiliary feedwater system was per-formed on November 2, 1984 while in hot standby. The plant was completing i ,

-_,~-m,-- -- - -

39 refueling and had not yet achieved criticality. During the test, it was dis-covered that the steam generator feedwater bypass valves in loops 1 and 4 did not open automatically. As a result, au,.iliary feedwater would not have been able to flow to seam generators in loops 1 and 4 without operator action.

These air-operated bypass valves did not open because the solenoids were stuck and did not aytomatically vent the control air on receipt of the auto-initia-tion signal. Both auxiliary feed pumps were operational at the time of the test.

The solenoids are Asco Model No. NP 8320A-185E. Since both solenoids operated

! properly in all subsequent tests, the licensee has not yet determined the exact l reason for their malfunction. The solenoids and system were retested, per-formed acceptably, and declared operational for continued use. Further action planned includes additional testing of the solenoids.

2.17 Low Steam Line Pressure Safety Injection Actuation During Planned Shutdown Callaway; Docket 50-483; LER 85-1s; Westinghouse PWR i On March 30, 1985, at approximately 0613 CST, an inadvertent safety injection actuation was initiated from a low steamline pressure signal. The event oc-3 curred during a planned shutdown for steam strainer modifications, other mis-1 cellaneous maintenance, and surveillance testing. The unit had been removed 4

from service at 2301 on March 29, and the reactor had been shutdown at 0230 on March 30.

I The atmospheric steam dump valves were being controlled in automatic with manual adjustments to the steam pressure setpoints in order to sustain the desired '

j steam flow rate through the steam generators (SGs) to cool down the primary sys-i tem. As the steam dumps are opened, the steam pressure will decrease with a cor-responding decrease in primary system temperature. A new equilibrium condition will then be established at a lower steam pressure and lower primary system

temperature than prior to the steam dump adjustment.

As the primary system continues to cool down, the stean pressure will decrease such that the steam dumps will require adjustment in order to continue the desired cooldown rate. At the time of the event, the primary system had been

, cooled from the no-load temperature of 557 F to approximately 525 F. The steam

pressure had decreased from 1110 psig to approximately 740 psig.

When the Peactor Operator adjusted the steam pressure setpoint for the SG Loop j 4 atmospheric steam dump valves, the steam pressure decreased on the oroer of '

10 to 15 psig. However, the steam pressure signal fed into the engineered safety feature logic is rate sensitive and amplified by a factor of 10. Thus, the 10 to 15 psi decrease in steam pressure appeared to be a 100 to 150 psi decrease.

The setpoint of the low steamline pressure safety injection signal is 615 psig.

Therefore, the 10 to 15 psi decrease, as amplified by the rate compensation,

was sufficient to cause a safety injection actuation.

The safety injection resulted in automatically starting the centrifugal charging i

pumps, safety injection pumps, residual heat removal pumps, auxiliary feedwater

pumps, emergency diesel generators, and in automatically injecting emergency core cooling system water into the reactor coolant system. Following the safety

injection, operators performed emergency operating procedures and restored plant

systems for continuing plant cooldown.

_ _ . _ ,.- - _ _ ._ __, ~ ,_

40 l

l To prevent recurrence, a statement has been added to general operating pro-cedures for plant cooldown from hot standby to cold shutdown, cautioning opera-tors about the possibility of initiating a safety injection due to the rated compensation effects at reduced pressure combined with pressure transients when cycling the atmospheric steam dump valves.

2.18 Scaffolding Installation Error Due to Persornel Error Summer; Docket 50-395; LER 85-07; Westinghouse PWR On March 21, 1985, the NRC Resident Inspector notified the licensee of a plant condition which potentially could have degraded the functional capability, as required by Technical Specification 3.8.1.1, of diesel generators A and B.

Specifically, the inspector had observed scaffolding installed over both of the generator units for preventive maintenance (PM) on the overhead chain hoists.

The scaffolding had been installed over diesel generator A on March 20, and over diesel generator B on March 21. The scaffolding could have had an adverse impact on the operability of both onsite ac power sources for a period of ap-proximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> and 25 minutes during a seismic event.

Maintenance engineering personnel inspected the area immediately after being notified of the situation. The initial analysis of the scaffold installation assumed that the scaffold would fall and degrade the functional capability of the diesel generators, since there is insufficient technical information to allow an objective evaluation of the scaffold's ability to withstand a seismic event. All scaffold material was subsequently removed from the area on March 21.

The cause of the event is attributed to personnel error. Factors contributing to the scaffold installation error were:

(1) There was an inadequate description of the proposed scaffolding on the General Maintenance Procedure (GMP) 101.008, " Seismic and Vital Equipment Area Scaffolding / Shielding Evaluation and Utilization," evaluatier. 'orm initiated by the planner on March 8,1985. Therefore, the proposed m tal-lation reviewed by maintenance engineering on March 13 was not considereo adverse to the operability of the diesel generators. An additional error occurred when the engineer was not informed of later changes to the scope of the scaffolding.

(2) The engineer did not personally go to the site of the scaffold erection to ensure work was within the scope of his initial evaluation.

(3) Construction personnel erected a scaffold that clearly exceeded the description on the request form.

The licensee has initiated the following corrective actions to prevent a recurrence:

(1) All personnel involved in erecting or evaluating scaffolding have been directed to visit the site prior to installation to ensure that an adequate preliminary evaluation of the scaffolding required has been conducted and its potential impact on equipment in the area has been evaluated. Scaffolds which could adversely impact equipment operability will be coordinated with activities that require the equipment to be removed from service.

41 (2) The details and consequences of this event were reviewed with maintenance personnel.

(3) GMP-101.008 was reviewed and revised as necessary to clarify and re-enforce the requirements for scaffolding erection.

2.19 Potential loss of Component Cooling Due to Misadjustment of Relief Valves Zion Units 1, 2; Dockets 50-295, -304, LER 85-08; Westinghouse PWRs Unit 2 was operating at 99% power and Unit 1 was in cold shutdown. On Febru-ary 16,1985, IMOV-CC9414 on the component cooling return line from the reactor cooling pump (RCP) bearing oil coolers was closed and taken out of service for routine maintenance. Almost immediately afterwards it otas noticed that the CC surge tank level was decreasing. Only the Unit 2 tank was valved in. An opera-tor was sent to valve in make up water to the surge tank, during which the cause of the leak was investigated. The containment (Unit 1) sump pumps were reported to be running continuously, indicating high sump level. It was believed that the relief valve (ICC 9427) for component cooling from the RCP bearing oil coolers had lifted and was stuck open. Component cooling to the RCP bearing oil coolers was isolated, stopping all leakage. Sump accumulation was approxi-mately 1710 gallons during this event. It is believed that the relief valve lifted due to a pressure transient induced by the closing of 1MOV-CC9414. Com-ponent cooling to the RCP bearing oil coolers was subsequently unisolated and the leak did not return.

An event very similar to this occurred on February 3,1984, during which a pres-sure transient also caused a relief valve (ICC 9428) in the component cooling system to lift and it also failed to reseat until the line was isolated. The fact that both events involved similar valves initiated an additional in depth investigation into the cause of the events. In the interim, appropriate proce-dures were changed to ensure that the operators could identify and respond to this specific loss of component cooling situation, and valve and pump manipula-tions were kept to a minimum in the system.

The findings of the investigation showed that both valves had been previously removed, inspected, and tested for the 5-year valve program. The work packages also showed that the nozzle ring setting had been changed on both valves per station procedure. These valves, however, were set as if they were standard relief valves, when in reality they were special valves requiring a different zero starting point for the nozzle ring. The station procedure made no reference to the correct manufacturer information on these special valves. This condition -

prohibited the valves from properly reseating after lifting, ar.d was later found to also reduce the relief capacity of the valves and lower the lift pressure setting.

Upon realizing this problem, immediate attention was given to Urit 2 which has identical valves and was at power operation. Since 2CC 9428 is normally iso-lated, attention was focused on evaluating the condition of 2CC 9427. It was found that the valve 2CC 9427 had also been worked on previously and was impro-perly set. It was decided to reset the nozzle ring while at power operation, since the valve did not have to be removed or isolated to implement the repair.

Tha valve was reset on February 22, 1985.

l 42 l A list of all other relief valves which could have been improperly set was com-piled and they were evaluated as to their significance. The only relief valve determined to affect the safety of the reactor was CC9427, and that valve was reset that day. The other valves will be reset at the earliest opportunity.

2.20 Inoperable Containment Isolation Valve Due to Mechanical Connector Problem St. Lucie; Docket 50-335; LER 85-02; Combustion Engineering PWR On December 31, 1984 during normal full power operation, Operations personnel were attempting to locate and isolate a ground fault indicated on the IB dc bus.

The ground isolation procedure requires that a component coolina water to reac-tor coolant pump supply header instrument air-operated containment isolation valve (HCV 14-7) be blocked open by temporary connection to a nitrogen supply system while the valve's breaker is momentarily deenergized for a ground check.

The valve's mechanical jumper was installed by the Nuclear Operator (NO) and the breaker deenergized by the Nuclear Watch Engineer (NWE). The NWE observed that the ground fault indication failed to clear and immediately reenergized the breaker, reset the valve's solenoid, and instructed the N0 to remove the mechanical jumper from the valve.

The N0 found that he cculd not disengage the quick disconnect coupling from the valve. He then contacted his NWE and notified him of the problem. The NWE promptly contacted the Shift Meintenance Supervisor for immediate assistance in decoupling the jumper. Concurrently the NWE had the N0 prepare and route a PWO to document the maintenance assistance required.

The Maintenance Supervisor dispatched a mechanic who paged the N0 and inquired as to the valve's location. The N0 and NWE then assumed that the jumper would be removed by the mechanic. The dc ground was finally located and isolated in an unrelated part of the plant and the dc ground isolation procedure was termi-nated without the jumper in question ever being removed.

The PWO written by the N0 for documentation was forwarded to Mechanical Main-tenance where it was processed on a routine basis. Eventually the PWO was determined to involve I&C department equipment and was forwarded to that group.

On February 28, 1985, I&C personnel presented the PWO to the Assistant Nuclear Plant Supervisor (ANPS) for the necestary review and approvals prior to the commencement of any safety-related job. The ANPS immediately recognized the containment isolation function of the valve and declared the 4-hour action statement required by the technical specifications. I&C personnel immediately commenced work on the valve. Less than one hour after decieration of the action statement the temporary jumper was removed and the valve was returned to service.

Determination of the series of events leading to this incident was hampered due to the fact that the NWE involved had terminated his employment with the company before this problem was identified. The root cause of the problem seems to be that both the NWE and N0 assumet that because this was a seemingly ninor mechanical problem (decoupling a quick disconnect fitting) the arrival of a mechanic on the scene assured that the job would be accomplished. This error of assumption was compounded by no entries being made in the appropriate problem tracking systems (Watchstander Logs, Equipment Out Of Service Log, etc.)

43 As a corrective action, the dc ground isolation procedure has been changed to require the temporary nitrogen jumper to be continuously hand held or entered into the Jumper Log. In addition, ANPS review and sign off is now required when the ground isolation procedure is completed or terminated for any reasoit.

Also specifics of this particular event will. be emphasized to all Operators during requalification training.

s

45 3.0 ABSTRACTS / LISTINGS OF OTHER NRC OPERATING EXPERIENCE DOCUMENTS 3.1 Abnormal Occurrence Reports (NUREG-0090) Issued in March-April 1985 An abnormal occurrence is defined in Section 208 of the Energy Reorganization Act of 1974 as an unscheduled incident or event which the NRC determines is significant from the standpoint of public health or safety. Under the provi-sions of Section 208, the Office for Analysis and Evaluation of Operational Data reports abnormal occurrences to the public by publishing notices in the _ Federal Register, and issues quarterly reports of these occurrences to Congress in the NUREG-0900 series of documents. Also included in the quarterly reports are updates of some previously reported abnormal occurrences, and summaries of cer-tain events that may be perceived by the public as significant but do not meet the Section 208 abnormal occurrence criteria.

Date Issued Report 4/85 REPORT TO CONGRESS ON ABNORMAL OCCURRENCES, JULY-SEPTEMBER 1984, VOL. 7, N0. 3 There were ten abnormal occurrences during the report period.

Four occurred at licensed nuclear power plants, four occurred at other licensees (industrial radiographers, medical institu-tions, industrial users, etc.), one occurred at a licensed fuel manufacturer, and one at an Agreement States licensed hospital.

The occurrences at the plants involved: (1) degraded isola-tion valves in the emergency core cooling systems at Vermont Yankee, LaSalle, Cooper, Pilgrim, Hatch, and Browns Ferry; (2) degraded shutdown systems at Fort St. Vrain; (3) loss of offsite and onsite ac electric power at Susquehanna; and (4) refueling cavity water seal failure at Connecticut Yankee.

The occurrences at other licensees involved: (1) contaminated radiopharmaceuticals used in diagnostic administrations at two nuclear pharmacies (Nuclear Pharmacy, Inc. in Chicago, Illinois, and Syncor International, Inc., in Blue Ash, Ohio) that received faulty devices from Medi-Physics, Inc., in Tux-edo, New York, used to prepare radiopharmaceutical doses; (2) therapeutic medical misadministration at Washin ver.;ity Medical Center in St. Louis, Missouri; (3) gton Uni-significant internal exposure to iodine-125 at the Veteran's Administra-tion Medical Center in Bronx, New York; and (4) therapeutic

..edical misadministration at the U.S. Air Force Medical Center, Keesler Air Force Base near Gulf Port, Mississippi.

46 Date Issued Report The other occurrences involved: (1) degraded material access area barriers at !;uclear Fuel Services, Envin, Tennessee; and (2) contaminated radiopharmaceuticals used in diagnostic administrations at Rhode Island Hospital, Providence, Rhode Island.

Also, the report provided update information on: (1) steam generator problems (76-11), first reported in NUREG-0900-5, July-September 1976; (2) the nuclear accident at Three Mile Island (79-3), first reported in Vol. 2, No.1, January-March 1979; (3) seismic design errors at Diablo Canyon Nuclear Power Plant (81-8), first reported in Vol. 4, No. 4, October-December 1981; (4) emergency diesel generator problems (83-25),

first reported in Vol. 6, No. 4, October-December 1983; and (5) exposures to americium-241 (AS83-9), first reported in Vol. 6, No. 2, April-June 1983.

In addition, items of interest that did not meet abnormal occurrence criteria included: (1) seal table leaks at the Zion, Sequoyah, and Trojan plants; and (2) reactor vessel flaw at Indian Point Unit 2.

i

47 3.2 Bulletins and Information Notices Issued in March-April 1985 The Office of Inspection and Enforcement periodically issues bulletins and information notices to licensees and holders of construction permits. During the period,19 information notices and one information notice supplement were issued.

Bulletins are used primarily to communicate with industry on matters of generic importance or serious safety significance (i.e., if an event at one reactor raises the possibility of a serious generic problem, an NRC bulletin may be is-sued requesting licensees to take specific actions, and requiring them to submit

, a written report describing actions taken and other information NRC should have l to assess the need for farther actions). A prompt response by affected licensees is required and failure to respond appropriately may result in an enforcement action. When appropriate, prior to issuing a bulletin, the NRC may seek com- '

ments on the matter from the industry (Atomic Industrial Forum, Institute of Nuclear Power Operations, nuclear steam suppliers, vendors, etc.), a technique l which has proved effective in bringing faster and better responses from licensees.

Bulletins generally require one-time action and reporting. They are not in-tended as substitutes for revised license conditions or new requirements.

Information Notices are rapid transmittals of infonnation which may not have been completely analyzed by NRC, but which licensees should know. They require

no acknowledgement or response, but recipients are advised to consider thc appli-cability of the information to their facility.

Information Date Notice Issued Title 85-17 3/1/85 POSSIBLE STICKING 0F ASCO SOLEN 0ID VALVES (Issued to all nuclear power reactor facilities holding an operating license or construction permit) 85-18 3/7/85 FAILURES OF UNDERV0LTAGE OUTPUT CIRCUIT BOARDS IN THE WESTINGHOUSE-DESIGNED SOLID STATE PROTECTION SYSTEM (Is-sued to all Westinghouse-designed PWR facilities holding an operating license or construction permit) 85-19 3/11/85 ALLEGED FALSIFICATION OF CERTIFICATIONS AND ALTERATION 0F MARKINGS ON PIPING, VALVES, AND FITTINGS (Issued to all nuclear power facilities holding an operating license or a construction permit) 85-20 3/12/85 MOTOR-0PERATED VALVE FAILURES DUE TO HAMMERING EFFECT (Issued to all nuclear power reactor facilities holding an operating license or construction permit) 4 85-20 3/14/85 MOTOR-0PERATED VALVE FAILURES DUE TO HAMMERING EFFECT Suppl. 1 (Issued to all nuclear power reactor facilities holding an operating license or construction permit)

48 Information Date Notice Issued Title 85-21 3/18/85 MAIN STEAM ISOLATION VALVE CLOSURE LOGIC (Issued to all nuclear PWP facilities holding an operating license or construction permit) 85-22 3/21/85 FAILURE OF LIMIT 02QUE MOTOR-0PERATED VALVES RESULTING FROM INCORRECT INSTALLATION OF PINION GEAR (Issued to all nuclear power reactor facilities holding an operating license or construction permit) 85-23 3/22/85 INADEQUATE SURVEILLANCE AND POSTMAINTENANCE AND POSTMODI-FICATION SYSTEM TESTING (Issued to all nuclear powbr reactor facilities hniding an operating license or con-struction permit) 85-24 3/26/85 FAILURES OF PROTECTIVE C0ATINGS IN PIPES AND HEAT EX-CHANGERS (Issued to all nuclear power reactor facilities holding an operating license or construction permit) 85-25 4/2/85 CONSIDERATION OF THERMAL CONDITIONS IN THE DESIGN AND INSTALLATION OF SUPPORTS FOR DIESEL GENERATOR EXHAUST SILENCERS (Issued to all power reactor facilities holding an operating license or construction ptmit) 85-26 4/2/85 VACUUM RELIEF SYSTEM FOR BOILING WATER REACTOR MARK I AND MARK II CONTAINMENTS (Issued to all BWR facilities having a Mark I cr Mark II containment and holding either an operating license or construction pennit) 85-27 4/3/85 NOTIFICATIONS TO THE NRC OPERATIONS CENTER AND REPORTING EVENTS IN LICENSEE EVENT REPORTS (Issued to all nuclear power reactor fa'cilities holding an operating license or a construction permit) 85-28 4/9/85 PARTIAL LOSS OF AC POWER AND DIESEL GENERATOR DEGRADATION (Issued to all nuclear power reactor facilities holding an operating license or construction permit) 85-29 4/12/85 USE OF UNQUALIFIED SOURCES IN WELL LOGGING APPLICATIONS (Issued to all well logging source licensees authorized to do well logging, using sealed sources) 85-30 4/19/85 MICR0 BIOLOGICALLY INDUCED CORROSION OF CONTAIhMENT SERVICE WATER SYSTEM (Issued to all holders of a nuclear power reactor operating license or construction permit) 85-31 4/19/85 BUILDUP 0F ENRICHED URANIUM 13 VENTILATION DUCTS AND ASSOCIATED EFFLUENT TREATMENT SYSTEMS (Issued to all uranium fuel fabrication licensees)

49 Information Date Notice Issued Ti tle 85-32 4/22/85 RECENT ENGINE FAILURES OF EMERGENCY DIESEL GENERATORS (Issued to all nuclear power reactor facilities holding an operating license or construction permit) 85-33 4/22/85 UNDERSIZED N0ZZLE-T0-SHELL WELDED JOINTS IN TANKS AND HEAT EXCHANGERS CONSTPUCTED UNDER THE RULES OF THE ASME BOILER AND PRESSURE VESSEL CODE (Issued to all nuclear power reactor facilities holding an operating license j or construction permit) 85-34 4/30/85 HEAT TRACING CONTRIBUTES TO CORROSION FAILURE OF STAIN-LESS STEEL PIPING (Issued to all nuclear power reactor facilities holding an operating license or construction permit) 85-35 4/30/85 FAILURE OF AIR CHECK VALVES TO SEAT (Issued to all nuclear power reactor facilities holding on cperating license or construction permit)

50 3.3 Case Studies and Engineering Evaluations Issued in March-April 1985 The Office for Analysis and Evaluation of Operational Data (AE0D) has as a pri-mary responsibility the task of reviewing the operational experience reported by NRC nuclear power plant licensees. As part of fulfilling this task, it se-lects events of apparent interest to safety for further review as either an engineering evaluation or a case study. An engineering evaluation is usually an immediate, general consideration to assess whether or not a more detailed protracted case study is needed. The results are generally short reports, and the effort involved usually is a few staffweeks of investigative time.

Case studies are in-depth investigations of apparently significant events or situations. They involve several staffmonths of engineering effort, and result in a formal report identifying the specific safety problems (actual or potential) illustrated by the event and recommending actions to improve safety and prevent recurrence of the event. Before issuance, this report is sent for peer review and ccmment to at least the applicable utility and appropriate NRC offices.

These AEOD reports are made available for information purposes and do not impose any reouirements on licensees. The findings and recommendations contained in these reports are provided in support of other ongoing NRC activities concerning the operational events (s) discussed, and do not represent the position or require-ments of the responsible NRC program office.

Special Date Study Issued Subject S501 3/15/85 REVIEW 0F OPERATIONAL EXPERIENCE FROM NON-POWER REACTORS AE0D performed an evaluation of the operational experience submitted from non-power reactor licensees to determine if the information was adequate and if the operating experi-ences of non-power reactors should be included in AE0D's program for the evaluation and feedback of operational data.

The study found that: (1) the reporting requirements for non-power reactors were adequate to ensure that significant events are reported to the NRC for evaluation; and (2) the evaluation of operating experience performed by the NRC Regional Offices and the Office of Nuclear Reactor Regula-tion (NRR) for non-power reactors licensed for power levels less than or equal to 2 MWt was acceptable based on the limited safety significance of postulated events at these reactors.

For non-power reactors licensed for more than 2 MWt, there are postulated events with a potential for offsite releases that could reduce the margin for public health and safety.

Presently, no single NRC organization reviews all the oper-ating data for these reactors to obtain an overview of the operating experience. Thus, a suggestion of this evalua-tion was that NRR evaluate all the operating experience for non-power reactors licensed for more than 2 MWt as

1 51 Special Date Study Issued Subject part of its ongoing licensing activities to identify the lessons learned and ensure reactor safety.

S502 4/85 AE00 SEMIANNUAL REPORT (JULY-DECEMBER 1984)

This issue of the AE0D semiannual report covered AE0D activ-ities for July through December 1984 The report included selected comments and observations resulting from the review of operational data and AE00 trend and pattern program studies.

A brief summary of the activities and accomplishments dur-ing this period also was included. The technical evalua-tion program results were highlighted and a number of the program activities were discussed. Also included were a status and summary of the AE00 reconmendations that were new or that remained outstanding from the last report. In 4 addition, some background information was provided on the AE0D organizational structure, ongoing studies, and avail-able reports.

Engineering Date Evaluation Issued Subject E503 3/11/85 PARTIAL FAILURES OF CONTROL ROD SYSTEMS TO SCPAM I During the semiannual briefing to the Commissioners on November 20, 1984, AE00 had been reauested to provide i a listing and analysis of events that have occurred l since the Salem 1 anticipated transient without scram (ATWS) events in February 1983 involving failures of

control rods to perform their scram function properly.

This AE0D engineering evaluation was performed in re-i sponse to that request.

i During the approximately two-year period covered in j this evaluation, a total of 13 events were found where i there was a failure of from one to six control rods to properly perform their reactor scram function. The 13 events are listed in Appendix A of the report. In six of these events, the failures occurred during an actual

! scram demand, and in the remaining seven events the

failures were discovered during surveillance testing activities. In all' cases, the plant was safely shut down by the proper functioning of the remaining oper-able control rods.

There are two real concerns associated with such fail-ures. One is the potential for connon-cause failure such as an inability to insert sufficient control rods i to assure reactor shutdown due to a single type or i

- 52 Engineering Date Evaluation Issued Subject E503 cause of failure. The second is generic implications, (cont'd) since other reactors may be susceptible to the same type of failures. Even though the design and manufac-ture of control rod systems are certainly mature, it is of concern and significance that these 13 events over a two-year period involved four potential common-cause failure mechanisms, three of which have generic irrplications for similar reactors.

The potential common-cause events are:

(1) The November 1983 event at Peach Bottom Unit 3 where two control rods had excessive scram tims ,

because of foreign material (Loctite) in the scram solenoid valves.

(2) The October 1984 event at Susquehanna Unit 1 where four control rods failed to scram due to sticking of the disc holder subassembly in the j scram pilot solenoid valves.

1 (3) The event at Ko-Ri Unit 5 in Korea, where a rod i assembly guide screw had fallen out and prevented rod movement. U.S. reactors having the same type of mechanism include Catawba Units 1 and 2, 1 McGuire Unit 2, Watts Bar Units 1 and 2, and Seabrook Units I and 2.

(4) The June 1984 event at Fort St. Vrain where six out of 37 rod pairs failed to scran during a reactor-trip.

The first three potential common-cause events noted above also have potential generic concerns for other facilities. Only the last event is censidered to be unique and therefore applicable only to Fort St. Vrain.

For the three events that involved potential comon-cause failure mechanisms which had generic implications, adequate corrective actions end actions to alert other utilities have been taken. In the case of Fort St.

Vrain, the unit has remained s5ut down since the event and will be started up only after all corrective actions have been completed and approved by the NRC.

The remaining nine events were caused by apparently random failures which do not appear to have common-cause failure or generic implications.

Concerns regarding inadequacies in post-trip review, post-maintenance testing and identification of root

53 Engineering Date Evaluation Issued Subject E503 cause of failure were evident in some of the 13 events.

(cont'd) Lessons learned from past experience have still not resulted in complete correction of the problems identi-fied. However, these concerns should be alleviated when the actions discussed in the NRC's Generic Let-ter 83-28, " Required Actions Based on Generic Implica-tions of Salem ATWS Events," are established and fully implemented.

E504 3/29/85 LOSS OR ACTUATION OF VARIOUS SAFETY-RELATED EQUIPMENT l DUE TO REMOVAL OF FUSES OR OPENING 0F CIRCUIT BREAKERS 1

This engineering evaluation report provides information concerning operational events which involved the prac-tice of removing fuses for personnel protection during maintenance and/or plant modification activities. The safety concern is that this practice has resulted in unknowingly disabling safety systems, and has caused inadvertent actuation of these systems with attendant plant transients.

The report concludes that the practice of removing fuses or opening circuit breakers during maintenance and/or plant modification activities should be elimi-nated where practical, even if the frequency of such activity is low. Where this practice is unavoidable in order to provide plant personnel with the necessary protection during these activities, the report suggests that: (1) adequate review and analysis of the circuits involved should be performed; (2) independent verifica-tion of such review and analysis should be conducted to ensure that all effects on plant equipment are known; and (3) training of involved plant personnel should be conducted to alert them to the possible undesirable results of fuse removal or breaker operation. These actions are suggested to be performed prior to removing fuses or opening circuit breakers.

, E505 3/29/85 SERVICE WATER SYSTEM AIR RELEASE VALVE FAILURES As a result of several residual heat removal service water (RHRSW) air release valve failures at the Browns Ferry and Hatch plants, and an emergency service water air release valve failure at the Duane Arnold plant (all boiling water < reactors--BWRs), a generic study of these failures was perforned. The purpose of this study was to review the causes for these failures, the actual plant safety problems which have been experi-enced, the safety significance of these failures, and the need for corrective actions.

54 Engineering Date Evaluation Issued Subject E505 Three potential safety problems were found to result (Cont'd) from SW air release valve failures. These were:

(1) reduced service water flow to the RHR heat ex-changers, (2) flooding of the SW pump room, and (3) in-creased system unavailability due to the frequent need for maintenance.

At the present time, TVA (Tennessee Valley Authority) has installed an orifice plate in the flow path of the Browns Ferry RHRSW air release valve. The purpose of this orifice plate is to reduce the discharge rate into the pump room in the event of an air release valve failure. In the long term, TVA is planning to install RHRSW air release valves with an increased dynamic loading capability.

In pressurized water reactors (PWRs) the equivalent l systems (the main service water cooling system and the component cooling water system) are closed loop systems which do not require the use of air release valves. As a result, no PWR air release valve failures were found by the data search. Therefore, SW air release valve failures would appear to apply to only BWRs.

55 ', <

1 3.4 Generic Letters Issued in March-April 1985 '

Generic letters are issued' by the Office of Nuclear Reactor Regulation, Division of Licensing. They are similar to IE Bulletins (see Section 3.2) in that they transmit information to, and obtain information from, reactor licensees, appli-cants, and/or equipment suppliers regarding matters of safety, safeguards, or environmental significance. During March and April 1985, two letters were issued.

Generic letters usually either (3) provide information thought to be important in assuring continued safe operation of facilities, or (2) request information on a specific schedule that would enable regulatory decisions to be made regard-ing the continued safe operation of fccilities. They have been a significant means of communicating with licensees on a number of important issues, the reso-lutions of which have contributed to improved quality of design and operation.

Generic Date Letter Issued Title

~'

85-06 4/17/85 -QUALITY ASSURANCE GUIDANCE FOR ATWS E0VIPMENT THAT IS

. NOT SAFETY-RELATED (Issued to all-power reactor licensees and all applicants for power reactor licenses) 85-02 4/17/85 STAFF RECOMMENDED ACTIONS STEMMINGtFP0M NRC INTEGRATED PROGRAM FOR THE RESOLUTION OF UNRESOLVED SAFETY ISSUES REGARDING STEAM GENERATOR TUBE INTEGRITY (Issued to all PWR licensees of operating reactors, applicants for oper-ating--licenses, and holders of construction permits, and Ft. St. Vrain) 9 i

r

,V i 4 e

SS l

3.5 Operating Reactor Event Memoranda' Issued in March-April 1985 The Director, Divisinn of Licensing, Office of Nuclear Reactor Regulation (NRR),

disseminates information to the directors of the other divisions and program offices within NRR via the operating reactor event memorandun (0 REM) system.

The OREM documents a statement of the problem, background'information, the safety significance, and short and long term actions (taken and planned). Copies of OREMs are also sent to the Office for Analysis and Evaluation of Operational Data, and of Inspection and Enforcement for their information.

2 No OREMs were issued during March-April 1985.

l I

4

/

k

(

J

, ,a , -. .,, ~... . -. -

57 4

3.6 NRC Document Compilations The Office of Administration issues two publications that list documents made publicly available.

. The quarterly Regulatory and Technical Reports (NUREG-0304) compiles biblio-graphic data and abstracts for the formal regulatory and technical reports issued by the NRC Staff and its contractors.

. The monthly Title List of Documents Made Publicly Available (NUREG-0540) contains descriptions of information received and generate 3 by the NRC.

This information includes (1) docketed material associated with civilian nuclear power plants and other uses of radioactive materials, and (2) non-docketed material received and generated by NRC pertinent to its role as a regulatory agency. This series of documents is indexed by Personal Author, Corporate Source, and Report Number.

The monthly Licensee Event Report (LER) Compilation (NUREG/CR-2000) might also be useful for those interested in operational experience. This document contains Licensee Event Report (LER) operational information that was processed into the LER data file of the Nuclear Safety Information Center at Oak Ridge during the monthly period identified on the cover of the document. The LER summaries in this report are arranged alphabetically by facility name and then chronologically by event date for each facility. Component, system, keyword, and component vendor indexes follow the summaries.

Copies and st hscriptions of these three documents are available from the Super-intendent of Documents, U.S. Government Printing Office, P.O. Box 37082, Washing-ton, DC 20013-7982.

1 1

. = _ - - - - _ -_ . - .__ - .-

UNITED STATES ,ou n ,.et. um NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20666

• • • ,'g'

wase. o c ceamit oer OFFICIAL SUSINESS PENALTY Fort PRfVATE USE. 6300 120555078877 3 US NRC IANIN411g3333 ADM-DIV 0F TIDC

' POLICY W-5 01 & PUB MG y BR-PDR Auggg WASHINGTON DC 20555 j

i a

k l

i f

1 1

l l

l

_ . . _ _ - . _ . _ _ _ _ _ - _ _ _ - . _ . . - . . , _ . _ -- - _ _ - . - - - - _ - . . _ . . _ . . . ,_