ML20134D376

Requests Review & Concurrence on Encl Final Power Reactor Events, Vol 7,Number 1 (NUREG/BR-0051) for Jan-Feb 1985. Comments on Draft Issue Coordinated by D Crutchfield Incorporated.Concurrence Requested by 850802

ML20134D376
Person / Time
Issue date:	08/01/1985
From:	Heltemes C NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:	Harold Denton Office of Nuclear Reactor Regulation
Shared Package
ML20134D356	List: ML20134D354 ML20134D376
References
RTR-NUREG-BR-0051, RTR-NUREG-BR-51 NUDOCS 8508190197
Download: ML20134D376 (51)

Text

- _ _ -

, f Uco

+  % UNITED STATES E i NUCLEAR REGULATORY COMMISSION j WASHINGTON D C. 20555

%, /

AbG 011985 MEMORANDUM FOR: Harold R. Denton, Director Office of Nuclear Reactor Regulation FROM: C. J. Heltemes, Jr., Director Office for Analysis and Evaluation of Operational Data

SUBJECT:

POWER REACTOR EVENTS, Vol. 7, No. 1 Enclosed for your review and concurrence is a copy of the final Power Reactor Events, Vol. 7, No.1, for the January-February 1985 period.

We have incorporated the comments on the draft issue as coordinated under Dennis M. Crutchfield, and have provided an advance copy to

' Gary Holahan's staff. We request your concurrence by August 2,1985, and would appreciate response by telecon to Sheryl Massaro on x24499

, or to John L. Crooks on x24425.

] obit .1 C TelfemeVr., Director 0 e for Anarysis and Evaluation Operational Data

Enclosure:

As stated cc w/ enclosure D. Eisenhut, NRR 8500190197 050009 PDR NUREQ DR-OO51 R PDR J

l

, NUR EC/BR-0051 Vol. 7, No.1 i

/ ...A POWER REACTOR EVENTS

\ s,, m ,/

United States Nuclear Regulatory Commission Date Published: July 1985 Power Reactor Events is a be-monthly newsletter that compiles operatmg experience mformation about commercial nuclear power plants This includes summaries of noteworthy events and hstings and/or abstracts of USNRC and other documents that discuss safety related or possible generic issues it is intended to feed back some of the lessons learned from operational experience to the various plant personnel, i e , managers, hcensed reactor operators, trainmg coor-dmators, and support personnel Referenced documents are available from the USNRC Pubhc Document Room at 1717 H Street, Washmgton, DC 20555 for a copymg fee Subscriptions and additional or back issues of Power Reactor hents may be requested from the Supenntendent of Documents. U.S Government Prmtmg Office. (202) 257 20th or 2171. or at P.O. Box 37082, Washmgton. D C. 20013 7982 Table of Contents Page.

1.0 SUMMA RIES OF EVENTS... . . . .

. I 1.1 1.2 Main Steam isolation Valve Problems at Hatch. Grand Gulf, and Oyster Creek.. .~ .. I 1.3 Safety injection Tank Inteakage Due to Degraded 0 Rings on Check Valves at Calvert Chits.. . 4 1.4 Reactor Trip on Main Feedwater Pump Trip Due to Component Failure at McGuire.. . . . . . . . . . . . S 1.5 Failure of Containment Tendon Field Anchor Heads Due to Hydrogen Stress Cracking at Farley.. 8 Inoperable HPCI and RCIC Following L ow Vessel Water LevelCondition at Hatch..

1.6 . 10 ProceduralInadequacy Results in Low Voltage Condition on DieselGenerators at Washingtan Nuclear..........

1.7 .~......-.................. . . . . . . . .. 12 1.8 Ice Condenser Lower inlet Doors Blocked Closed Due to Personnel Error at Catawba . 14 ..

Reactor Scram on Loss of Condenser Vacuum Due to failed E>rpansion Joint, and Subsequent High Containment Pressure at QuadCities.. . ....

1.9 . . . . . . . . . . . . 15 Inadvertent Recirculation System Actuation SignalDuring Plant Protection System Testing at Arkansss........ .. . . . . . . . . .

1.10 Reactor Trip In'volving Failure of Reactor Trip Breaker at Sequoyah...

. ... . . . I6

1. !! References.. . . . .

,, . . 18

. . . . .. .. . . . . . . . 20 2.0 EXCERPTS OF SEL ECTED LICENSEE EVENT REPOR TS.. . .. . 23 3.0 ABSTRACTS / LISTINGS OF O THER NRC OPERA TING EXPERIENCE DOCUMENTS.. . 41 3.1 Abnormal Occurrenw Reports (NUREGD090)..

3.2 Bulletins and Information Notices.. .

. .. . 41 3.3 Case Studies and Engineering Evaluations . .

.. . . .. .. 42 3.4 Generic Letters. ..... . . . . . . .

.. . . . . 44 3.S Operating Reactor Event Memoranda..

. . .. 47 36 NRC Document Compilations.. . . . . . .

. .. . . . . . . 48

. . . . . 49 Editor: Sheryl A. Massaro Office for Analysis and Evaluaticn of Operational Da'a Period Covered: U.S. Nuclear Regulatory Commission January-February 1985 Washington, D C. 20555

l 1.0 SUMMARIES OF EVENTS 1.1 Main Steam Isolation Valve Problems at Hatch, Grand Gulf, and Oyster Creek

, Events involving main steam isolation valves (MSIVs) are discussed below. The

event at Hatch occurred in January 1985, and involved failure of an inboard MSIV to operate within specified time limits. During repeated cycling of this valve, .

the inboard MSIVs drifted to less than 90% open, resulting in an unplanned reac- '

tor scram. At Grand Gulf in February 1985, it was noted that three MSIVs failed to close normally while being shut to limit the cooldown rate after a reactor scram. Although the Oyster Creek event occurred about a year ago, the sumary is based on a revised licensee event report submitted in late 1984 The event involved the inadvertent repositioning of MSIVs during a modification of plant computer system tie-ins.

I Reactor Scram Due to Inboard MSIVs Drifting Closed at Hatch i On January 19, 1985, performance of the " Main Steam Line Isolation i during(HNP-2-3111) at Hatch Unit 2,* the A inboard MSIV Valve Trip Test" procedure (2B21-F022A) failed to operate within the time limits of technical specifications, i Plant personnel then cycled the A MSIV repeatedly to see if its time would change to meet the technical specification requirement. During this cycling,

the inboard MSIVs drifted to less than 90% open, resulting in an unplanned j reactor scram.

l Plant personnel performed an investigation, and determined that the continuous cycling of the A inboard MSIV resulted in a high rate of charging flow (i.e.,

greater than or equal to 30 SCFM) to the MSIV's accumulator. This caused isola-tion of the drywell pneumatic system supply valves (2P70-F004 and -F005), when the supply flow rate became greater than or equal to 30 SCFM for 2 minutes.

When the drywell pneumatic system supply valves isolated, the MSIVs started drifting closed, due to the system being isolated from its supply.

, Plant personnel reviewed procedure HNP-2-3111, and determined that it could be used to cycle all'of the inboard MSIVs in sequential order or to cycle an inboard MSIV more than once. Thus, by using the procedure, plant personnel could place a greater than or equal to 30 SCFM drain on the drywell pneumatic system supply 4 for 2 minutes. (This does not affect the outboard MISVs because they are not fed by the drywell pneumatic system.) Because of this inadequacy, procedure HNP-2-3111 is being revised to add a note to allow a 2-minute wait between oper-ating MSIVs sequentially or for cycling MSIVs, to prevent a high flow isolation of the drywell pneumatic system. (Ref. 1.) '

i ,

• Hatch Unit 2 is a 748 MWe (net) General Electric BWR located 11 miles north of Baxley, Georgia, and is operated by Georgia Power.

l i

1

- - - - ._. . . - - _ . -- - - - - -. _ - - - . _ _ . _ ~ ._.

4 Reactor Scram on Low Condenser Vacuum with Subsequent MSIV Failures 4

at Grand Gulf i  :

i On February 10,1985, at 6:50 a.m., the operators at Grand Gulf Unit 1* were 1

in the process of swapping the steam jet air ejectors (SJAEs) when the reactor scrammed due to a turbine trip on loss of condenser vacuum. The plant was 1 operating at approximately 49% reactor power.

i The A SJAE was being placed in service due to apparent intercondenser fouling i t

of SJAE B, which was unable to maintain condenser vacuum. The breaker for suc-tion valve F0038 on the B train was tagged open for maintenance work. However, with the A train supply valve (F505A) fully open, the steam supply pressure to i l SJAE A was only about 60 psig. In order to increase the steam supply pressure,  !

l the B SJAE supply valve (F5058) was throttled closed. The steam supply pressure 1 increased to 115 psig. At this time, the operators noticed that condenser

) vacuum was decreasing. The A train suction valve (F003A), which needed to be

open to increase the vacuum, was found to have dual indication. The valve was

given an open signal both locally and remotely, but did not respond. An opera-tar was sent to open valve F003A while another was sent to clear the tag and e

,! close SJAE B suction valve F0038. During this time, condenser vacuum decreased [

t to the turbine trip setpoint and a turbine trip occurred followed by a reactor

, scram.

• 4

} The F003A valve would not respond because it had tripped on thermal overload i (possibly due to valve cycling), if this had not occurred, the turbine may l not have tripped on low vacuum. It appears that the thermal overload trip was l caused by excessive automatic cycling of the valve on low steam flow due to j undersized piping to the SJAEs. j i

At about 8:04 a.m., an attempt was made to manually close the MSIVs to limit ,

il: the cooldown rate. For manual closure, a test circuit is used to slowly close 1 the valves. After they are closed, the automatic actuation circuit is placed  !

! in the "close" position to hold the valves closed. Upon taking the associated i

handswitches to close following the slow closure of the MSIVs, three MSIVs reopened. Several attempts were made to close the valves before they were successfully held' closed.

The failure of the MSIVs to stay closed after being shut with the test circuit, j i and their inability to be closed normally, indicated a failure of the dual .

solenoid valve in the automatic actuation circuit. The vendor, Automatic Switch  !

! Company (ASCO), and General Electric are conducting an investigation to deter-mine the root cause. t Corrective actions included (1) a design change to increase the size of the SJAE steam supply piping and to complete other SJAE enhancements, (2) cleaning the B intercondenser, (3) implementing an NRC-approved action schedule for increased

, exercising of the MSIVs prior to startup, and (4) replacing the MSIV dual solenoids.

root cause isOthernecessary(correctiveactionswillbecompletedafterthe

determined. Refs 2 and 3.) t i

!

• Grand Gulf Unit 1 is 1250 MWe (net) General Electric BWR located 25 miles south

of Vicksburg, Mississippi, and is operated by Mississippi Power and Light.

I i

! 2

Inadvertent Repositioning of Primary Containment Isolation Valves at Oyster Creek At Oyster Creek

• on June 27, 1984, during an extended outage since February 1983, a procedure was being performed for a plant modification involving a new plant computer system. A step of this procedure required that a neutral electrical lead connecting a panel 11F neutral to a panel 10F neutral be lifted in panel 11F in the control room. This allowed a computer tie-in to the neu-tral point. Fuse 6F8 in panel 11F was removed in an attempt to deenergize the computer tie-in points. (This also resulted in loss of valve position indica-tion for 13 containment isolation valves.) When the lead was lifted, the Con-trol Room Operator observed that the MSIV shut alarms cleared, and noted that all four MSIVs indicated open on panel 11F. The plant also experienced a half-scram at approximately the same time. The A MSIVs (NS03A and NS04A) were then observed to shut by control room indications. The Control Room Operator ordered reinstallation of the removed fuse and the previously lifted neutral electrical lead. By reinstalling the fuse, valve position indication for the 13 contain-ment isolation valves was restored, and the operators noted that several valves had repositioned.

In addition to the MSIVs, these repositioned valves included recirculation loop sample valves, a drywell sump valve, a drywell equipment drain tank valve, torus vent valves, drywell purge valves, and reactor building to torus vacuum breakers.

Many of these valves are redundant components for isolation of various penetra-tions into the drywell. The valves were restored to their normal positions by operator action (except the reactor building to torus vacuum breakers, which reopened automatically when the lead was reinstalled).

It was believed that the half-scram was caused by a spiking intermediate range monitor (IRM), and the IRM was then ranged upscale. The Control Room Operators were uncertain as to the cause of valve repositioning and, since primary con-tainment integrity was not required, it was decided to lift the neutral elec-trical lead again to verify its affect on the containment 1;olation valves.

Fuse 6F8 was left-installed so that valve position indication remained available.

The results were the same as the first time the lead was lifted except that no half-scram occurred, and uncertainties exist as to whether the A MSIVs (NS03A, NSO4A) opened. The neutral lead was reinstalled, the computer termination com-pleted, and the repositioned valves w.re restored to their normal positions by operation action (again, except for the reactor building to torus vacuum breakers, which reopened automatically.)

The apparent cause of the occurrence is attributed to the following:

-- The neutral side of the seal-in relays for the affected solenoid operated valves are connected together in a neutral string with a single wire sup-plying this string (in panel 10F) from panel 11F. Interruption of this neutral cross-tie causes the neutral string in panel 10F to develop a po-tential with respect to the 11F neutral.

• 0yster Creek is a 620 MWe (net) General Electric BWR located 9 miles south of Toms River, New Jersey, and is operated by GPU Nuclear.

3

. I

, -- Improper deenergization of the electrical circuit of concern. The

! procedure used for the computer termination should have required either:

1 (1) the use of a temporary jumper to maintain the neutral in panel 10F; or  ;

! (2) deenergization of all power sources connected to the neutral involved  !

! in this event, rather than just the one from fuse 6F8.

t l The immediate corrective action was to reinstall the lifted neutral lead. A i functional test was performed on July 13, 1984 to demonstrate that insertion 4

of a primary containment isolation signal while the 10F/11F neutral tie is

! interrupted will cause all containment isolation valves to shut, and that interrupting the neutral tie while a primary containment isolation signal is present will not result in valve repositioning (assuming only one valve is in 1 j the" bypass" mode).

i Further testing was performed on September 7,1984, to analyze the transient

~

.; phenomenon occurring in the containment isolation valve control circuitry, and demonstrated that the five solenoid operated valves with the " bypass" feature

~

will not override a containment isolation signal if these valves are bypassed  ;

j open.  ;

J J Other corrective action included modifying the containment isolation valve con-trol circuit neutral bus in panels 10F/11F to convert the existing neutral bus configuration into a ring bus arrangement. This change eliminates the possi- .

, bility of inadvertent opening of the containment isolation valves due to a broken l l or lif ted wire in the neutral bus. The modification was successfully tested on l

October 4,1984 (Ref.4.) ,

i i

1.2 Safety injection Tank Inleakage Due to Degraded 0-Rings on Check Valves '

! at Calvert Cliffs t l On January 16, 1985, a safety injection tank (SIT) check valve inleakage test '

at Calvert Cliffs Units 1 and 2* indicated excessive leakage into two $1Ts. t The outlet check valves for these SITS were overhauled, and it was found that ,

the seating surface for each valve's ethylene propylene 0-ring was degraded.

Both 0-rings were replaced with more heat resistant 0-rings made of Dupont i Kalrez compound. .The event is detailed below.

i On the afternoon of January 15, 1985, a leak test was performed on the Calvert l Cliffs Unit 1 and 2 SIT outlet check valves. This test was performed to obtain l l background data necessary for a revision to Surveillance Test Procedure 0 65, i " Quarterly Valve Operability Verification." The test consisted of pressurizing  ;

!' the high pressure safety injection (HPSI) header for 10 minutes, while simul- l taneously monitoring S!T inleakage via two possible leakage paths. The first l

! path is through two 1-inch isolation valves (the SIT check valve leakage drain i

valve and the fill valve). The second path is reverse flow through the SIT i outlet check valve. The Unit 2 test results indicated negligible inleakage; i however, the Unit 1 test results needed further investigation to more accurately verify and quantify SIT check valve inleakage.

l i

i

• Calvert Cliffs Units 1 and 2 are 852 MWe (net) Combustion Engineering PWRs located 40 miles south of Annapolis, Maryland, and are operated by Baltimore j Gas and Electric.

l l 4 l

1 1

4 On January 16, 1985, with Unit 1 in power operation, the No.13 HPSI pump was i started, beginning a second inleakage test. This test was patterned after the

Calvert Cliffs' Operating Instruction for leak testing SIT fill, drain, and 3

tank outlet check valves. Prior to starting the HPSI pump, one potential leak-

! age path was isolated by closing the manual isolation valves for the SIT fill i header to permit independent monitoring of the SIT outlet check valve. A marked j rise was noted in the No. 11A SIT during the 10-minute pump run; this tank also had the highest indicated inleakage on the previous day's test.

1

The licensee's conservative evaluation concluded that the two overriding con-  !

cerns were (1) the HPSI flow rate specified in the technical specifications j could not be assured, thereby potentially worsening the consequences of the o limiting small break loss of coolant accident (LOCA); and (2) during prolonged 1 operation of HPSI, the SIT inleakage could cause the tank's relief valve to lift '

! (250 t 8 psig setpoint), reducing the nitrogen inventory and thereby rendering I the tanks inoper ble. Based on this information, the licensee felt that both [

j Unit 1 HPSI headers should be declared inoperable, and the unit was shut down.

l On January 17, 1985, Unit 1 entered hot shutdown, and preparations were made .

) for draining and venting the 11A and 11B SITS. Work packages were prepared for i overhauling both of the tanks' outlet check valves. These valves are 12-inch, i 1500 psi, swing disc check valves with an inclined, " soft" seat. They provide i pressure isolation for the tanks from both primary coolant pressure and HPSI j pump discharge pressure. An ethylene propylene 0-ring (Type E-832-9) is utilized l at the seating surface. This material has been found to deteriorate at a rate

greater than that specified by the manufacturer. Three different types of ethylene propylene have been used since initial operation. Although successive i 0-ring materials have had better temperature and radiation resistant qualities.

l each type has experienced degradation. A facility modification had been ap-1 proved in December 1983 to allow for the use of Dupont Kalrez 4079 as replace-i ment 0-ring material. Kalrez, a perfluoroelastomer, will better withstand the

} temperature environment in which these valves operate. This modification had i been scheduled for completion during 1985 on both units.

i Repairs began concurrently on both SIT outlet check valves on January 17, 1985. .

The valves were disassembled and valve internals were cleaned and inspected.  !

j Approximately one-third of the 0-ring seats were found degraded. Both 0-rings j were replaced with Kalrez Compound 4079 0-rings. Valve repairs took approximate-1 ly 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />. Both SITS were filled on January 18, and both check valves were j subsequently satisfactorily tested for zero leakage.

As a result of this event, all SIT outlet check valves will be leak tested quar-terly. The remaining six SIT outlet check valves will be overhauled during their respective 1985 refueling outage, and the ethylene propylene 0 rings will be replaced by the higher temperature resistant Kalrez compound 0-rings. A change to the technical specifications justifying a more flexible minimum com-bined flow rate for the lowest three HPSI leg flows will continue to be pursued. ,

(Ref.5.)  !

i i 1.3 Reactor Trip on Main Feedwater Pump Trip Due to Component Failure I at McGuire ,

! On January 28, 1985, McGuire Unit 1* tripped from 100% power on 10-10 steam

}

i ,

i *McGuireUnit1isa1180MWe(net)WestinghousePWRlocated17milesnorthof i l Charlotte, North Carolina, and is operated by Duke P6wer.  ;

5

4 l generator (SG) level when a main feedwater pump tripped on low suction pressure. l j The cause of the pump trip was the failure of a pneumatic pressure transmitter, j which provided a false low pressure signal. Following the pump trip, a turbine l i runback did not occur due to the failure of a component in the turbine control system. The failure of the turbine to run back caused the 10-10 level trip.

Two other post-trip abnormalities occurred during this event. An SG power- ,

operated relief valve (PORV) remained open for about four minutes, causing excessive cooldown and loss of SG inventory. Also, a discharge check valve on  :

1 the turbine-driven auxiliary feedwater pump (AFWPT) failed to close after the

pump was secured, causing backflow of hot SG water to the pump and upper surge  :

tank. The major cause of the event is component failure of the pressure trans-4 mitter, which initiated the pump trip, and of the turbine control system to cause j turbine runback. Corrective actions will consist of repairing or replacing

failed components, as well as determining ways to preclude or minimize future j failures. The event is detailed below.

l On January 28, 1985 McGuire Unit I tripped from 100% power on SG B lo-lo l level. The low SG level condition was caused by the tripping of main feedwater i 9

< pump turbine (FWPT) 18. The cause of this pump trip was the failure of a pneu-j matic pressure transmitter, which provided a false low pressure signal. A turbine <

runback signal following the loss of FWPT 1B was not initiated due to an electronic component failure in the digital electrohydraulic (DEH) turbine control system. I Without the turbine run back to 56%, all four SG levels dropped to the 10-10 level 3

reactor trip setpoint in approximately 1 minute. A manual runback was attempted, i

but was unsuccessful.

The cause of this event was component failure of (1) the FWPT 1B suction pres-  :

! sure transmitter, and (2) the DEH input circuit, which prevented turbine runback.

1 The pneumatic transmitter is an Ashcroft series 4000 unit. The tubing failed l l on what is identified as the " thin walled" side of the tubing, and appeared as  ;

a split.

l The main turbine runback signal generated in this event originated from the FWPT IB control oil pressure switch. This oil pressure switch actuated imme-  !

diately after the FWPT suction pressure transmitter failed low to begin the  !

j main turbine runbeck. After being processed by electrical relay logic, the runback signal is fed to a 408 V de signal conditioning circuit cord and pro-cessed for input to the DEH automatic runback circuits. The automatic turbine [

runback did not occur because the diode on this circuit card had failed and was electrically shorted. This short circuit prevented the applicatie relay from  ;

energizing, which prevented the runback signal from reaching the DEH circuitry.  ;

4 The purpose of this diode in the circuit is to limit the inductive voltage surge  !

following deenergizing of the de relay coil. Nine similar diode failures have i been found since the Unit 1 and 2 DEH systems were placed in service. These i li failures were reported to Westinghouse on June 28, 1984 Westinghouse responded i to this report with a letter giving recomendations to check the circuit card j jumper configuration, determine if induced noise is present on the input lines, and ensure that all the input cables are shielded. The licensee has verified that all the input circuit card jumpers are installed correctly and that shielded cable is used on most of the input cables.

A permanent resolution to the diode failure problem is being pursued. Plans include: (1) determining if the diode is necessary for circuit operation, ,

(2) determining if a diode of high rating is necessary for proper circuit l operation, and (3) reviewing the possibility of providing redundant input cir-cuits or a manual input circuit.

i 6 i

A design deficiency contributing to this event existed on the FWPT suction pres-sure instrumentation, in that one pneumatic pressure transriitter supplied the signal to three pressure switches for a two-out-of-three logic trip signal.

The pressure transmitter failure caused all the output pressure switches and the indicator to decrease, causing the feedwater pump trip on three-out-of-three logic. This situation of a single component failure initiating a multiple logic trip had been identified in February 1983 in a Nuclear Station Modifica-tion request. This request identified deficiencies on both the suction and dis-charge instrumentation of all four McGuire FWPTs. This modification has sub-sequently been implemented on the Unit 1 and 2 FWPTs during their current 1985 refueling outages. The Unit 1 modification is scheduled for completion during the 1985 refueling outage for that unit. The modifications for each unit removed i two of the pressure switches from the transmitter output and placed them on the actual process line.

Two significant post trip sbnormalities occurred during this event. The SG B PORV opened cooldown andofremained and loss openAlso, SG inventory. for approximately 4 minutes, a discharge check causing (excessive valve ICA-49)on l the AFWPT failed to close as the pump was secured following the reactor trip. '

This failure caused much of the water flow to SG C to backflow into the upper surge tank and AFWPT, and not into the SG, until the check valve was isolated. >

The main steam PORV actuation was caused by calibration drif t of the main steam pressure transmitter. This instrument is similar to the pneumatic transmitter Ashcroft series 4000 that is used on FWPT suction pressure. The pressure trans-mitter senses main steam pressure and converts it to a proportional instrument -

air signal. This output air signal operates the pressure switches which open I and close the PORV. The deadband for the opening and closing duration of the '

PORV is controlled by the difference in setpoints between the two pressure switches.  ;

The calibration drift of this pressure transmitter is attributed to a lack of preventive maintenance. Maintenance records show that this instrument has ex-perienced calibration drift in the past. The scheduling priority for the pre- f ventive maintenance on this instrument was low en3 ugh that it did not get placed i on the maintenance schedule to be completed. The instrument has been repaired /

calibrated only when a failure or drift was noticed. The drif t on this type of '

instrument is normally due either to clogged or dirty instrument air orifices l or mechanical wear. According to calibration data, the pressure transmitter (

had drifted high by approximately 8%. This would have caused the PORV to close at approximately 8% below the normal setpoint. Corrective action included plac- '

ing these main steam pressure transmitters on an active preventive maintenance  !

schedule to avoid excessive calibration drift. f The failure of auxiliary feedwater check valve ICA 49 was due to the failure of the valve clapper to close as the AFWPT was stopped. The failed open check ,

valve allowed some of the discharge flow from the motor driven AFWP to flow back toward the AFWPT, and through the minimum flow recirculation valve to the upper surge tank. The stop check valve on the discharge of the AFWPT alsn did not close, and allowed some of this backflow to enter the pump casing and suc- ,

tion piping. The suction relief valve opened, providing a flow path through j the pump. This flow was stopped when the isolation valve between the AfWPt and i SG C was closed. The suction pressure instruments were over ranged and declared '

inoperable per technical specifications.  ;

i 7 l l

l . .

l On January 29, 1985, maintenance personnel disassembled ICA-49 (Borg-Warner swing check valve with bonnet mounted clapper) and checked for internal damage l

and improper operation. No major damage was found. The seating surfaces were l lapped and the valve reassembled. The check valves was tested for backleakage

and forward flow. During this forward flow operational test, the check valve stuck open again. ,

l Maintenance personnel began disassembling the check valve again to check for l damage. As the bonnet bolts were loosened, the check valve clapper was heard dropping back into position. At this point, the valve bonnet bolts were retor-qued and the valve was checked for backleakage. No leakage was detected. Nor-mal valve alignment was achieved without problem and the Unit I reactor startup resumed.

Borg-Warner has been contacted for recommendations for repair of the ICA-49 check valve. The most desirable solution currently available is to place a mechanical stop on the clapper to prevent overtravel. Nuclear Station Modifi-cations have been written to replace both Unit 1 and Unit 2 Borg-Warner check valves on the auxiliary feedwater systems, and to replace the pump discharge stop check valves. The pump discharge stop check valves for Unit I were replaced during the recent 1985 refueling outage. The valves for Unit 2 will be replaced during the 1986 refueling outage. (Ref. 6.)

1.4 Failure of Containment Tendon Field Anchor Heads Due to Hydrogen Stress Cracking at Farley On January 25, 1985, while conducting a pre-integrated leak rate test walkdown of the exterior of the containment structure at Farley Unit 2,* an alert utility worker noted grease leakage and a deformed vertical tendon anchor grease can (cap) on the top of the containment ring beam. When the lower grease can on the same tendon was inspected in the tendon access gallery, it also was found to be deformed. Removal of the lower grease cap showed that the field anchor head had broken into seven pieces. The post-tensioning force (approximately 1.5 x 10 pounds) also had been released, and numerous broken wires from the 170-wire tendon were found. The unit was in cold shutdown for a refueling outage at the time of thC discovery.

A program was initiated to visually inspect all remaining caps. Although no deformed caps were found, the architect / engineer then recommended a random sample, visual inspection program for field anchor heads to establish a 95%

probability with a 95% con'idence level that no other field anchors were failed. The fifth field anchor inspected during this program was found to have a large crack, but appearel to be carrying full tendon load. Since this (de-graded) field anchor was of the same material heat as the first, the program ,

was modified to replace al' field anchors of that heat (49 total) and to perform a 95% probability with a 95% confidence level visual inspection prngram for cracked anchors of different material heats. ,

The two degraded anchors and the first four non-degraded anchors of the same heat number were removed for laboratory testing. This testing included i analyzing chemical and physical properties as well as scanning electron micro-l

• FarleyUnit2isan809PWe(net)WestinghousePWRlocated28milessouthwest of Dothan, Alabama, and is operated by Alabama Power.

8 l

i .

• l .

I scopy. These four non-degraded anchors were also magnetic particle and load tested. These four were successfully tested to 140% guaranteed ultimate tensile strength. Grease and wire samples were analyzed. Additionally, a non-degraded field anchor of the same heat number was sent to an NRC laboratory for confirm-l atory tests.

By late February 1985, all field anchors of the affected heat had been visually inspected, as had the random sample of non-affected heats. No additional failed field anchors had been found at this time. Approximately half of the affected anchors had been replaced while the visual inspections were being conducteu.

Preliminary laboratory results concluded that the problem was not related to a specific material heat, and that temper embrittlement was not the primary cause.

l Since discussions with laboratory personnel indicated that the presence of mois-ture may be a contributing factor, a decision was made to inspect visually all j l

vertical and all below-ground horizontal tendon field heads for anchor cracks -

and evidence of moisture. Additionally, based on the magnetic particle labora-tory testing, a decision was made to magnetic particle test the field anchor heads, which were removed during the replacement process. As of February 28, 1985, 24 field anchors had been magnetic particle tested and eight were found to have cracks in the ligaments between the tendon holes in the anchor.

During this expanded visual inspection program, a third field anchor was found in the failed condition. This anchor also was on a vertical tendon, but was of a i different material heat than the first two degraded field anchors. All vertical tendon field anchors on Farley Unit 2 have been inspected visually, with no other visual cracks found. However, moisture was found in approximately half of the ver-tical tendon field anchor enclosures. Detectable moisture was found in approx-imately 8% of the horizontal and 4% of the dome tendon field anchor enclosures.

Water was found in the grease cap or on the anchor head in each case of the three l failed vertical tendon field anchor heads. The quantity of water found associated t with these varied from a few ounces to 1/2 pint. The maximum amount of water reported, to date, by the licensee was 1-1/2 gallons, which was found in one grease cap when it was removed from a vertical tendon field anchor head.

Results from two laboratory analyses (Inland and Battelle) of failed anchor head material indicate the failures have been caused by hydrogen stress cracking (HSC). .

The NRC laboratory results also confirm that HSC is the causal factor of the  !

failures. The conditions necessary for HSC to occur include a high-strength ,

steel subjected to sustained tensile stresses and a source of atomic hydrogen. l Testing, to date, reveals evidence that a corrosion cell was established between ,

steel and zinc in the presence of the available water. The zine source may have  ;

been particles from the inside of the galvanized tendon sheaths that were abraded during tendon installation and tensioning or from the inside of the galvinized grease caps, some of which showed evidence of surface etching which points to an active corrosion cell. The corrosion cell produced the atonic hydrogen that was then apparently absorbed by the steel, resulting in cracks and their growth by HSC.

The crackef $9rfaces exhibited intergranular separation. it is certain that the magnitud# of the cracking could continue to grow as the corrosion cell continued to produce hydrogen until a critical crack size was reached. Rapid section failure then would occur as a result of increased stresses (same load but on a reduced area). .

9 ,

i . .

\ ..

Load tests were conducted on four removed field anchor heads. One anchor head  !

tested had three ligament cracks before load testing began. Two of the four anchors had water found in them. Each anchor head withstood minimum load of 140% of the guaranteed ultimate tensile strength of the tendon without failure.  !

Three of the field anchor heads exhibited additional cracks after the load tests. The anchor head with the three original ligament cracks was examined and found to have definite intergranular separation.

At the present time the licensee has removed and inspected by magnetic particle testing,allverticaltendonfieldanchoronUnit2headsflocatedatthebottom ,

to the verticals in the tendon gallery) that had not yet been replaced with new heads. Horizontal and dome tendon anchors found with significant emounts of l water also were detensioned and the heads removed for testing. No visual crack- i ing was found; however, magnetic particle testing revealed cracks in 18 anchors,  !

which were replaced on Unit 2. The licensee has now precoated the anchor heads, l installed buttonheads, and regreased the completed anchor head assembly prior to I retensioning the tendon. The licensee instituted a similar inspection program i on June 10, 1985. No visual cracked tendon anchors were found. However, six l heads were replaced because of cracks found during magnetic particle inspections.

l Current plant technical specifications, where post-tensioned concrete contain- '

ments are used with greased tendons, typically state that during required sur-veillance periods the sheath filler material (grease) is to be checked to verify  ;

that it has not undergone a " change in physical appearance." The intent of .

such a statement is not just to ascertain that the filler material continues to meet the original material specifications, but also that the filler material is  !

performing its original function, which is to preclude moisture from entering t the tendon assembly. Therefore, the presence of moisture or free water during anysurveillanceactivity(shouldbeconsideredevidenceofanabnormalityand require further action. Refs. 7 and 8.)

1.5 Inoserable HPCI and RCIC Following Low Vessel Water Level Condition  !

at iatch On January 16, 1985 at approximately 9:55 a.m. With the reactor at about 61%  !

power. Hatch Unit 1* scramed due to a reactor low water sevel trip signal. [

The signal was the result of a vital ac power supply trip, which caused both A i and B reactor feedpumps to run back. Reactor water level then decreased to i approximately-100 inches (referenceinstrumentzero). Group 2 and Group 5"  ;

isolations and a reactor scram were received due to the low water level signal. i High pressure coolant injection (HPCI) and reactor core isolation cooling (RCIC) l automatically started and injected to recover reactor water level. The A reactor {

feedpump was started manually at the same time. As the feedpump was recovered, j HPCI and RCIC were secured. The high water level turbine trip was then received  ;

• HatchUnit1isa752MWe(not)GeneralElectricBWRlocated11milesnorth  :

of Baxley, Georgia, and is operated by Georgia Power.

l

" Group 2! drywell ventilation, purge and sample lines, reactor building ven- i tilation system transient in core probe withdrawal command, shutdown cooling  !

and head spray modes of residual heat removal. j i

Group 5: reactor water cleanup from recirculation loop.  !

i 10 l

1 l

l l . l for the HPCI, RCIC, and reactor feedpump turbines. Reactor pressure remained I steady at approximately 980 psig, and was controlled with the electrohydraulic control (EHC) system (the main steam isolation valves were not closed, and the turbine had been manually tripped). Standby gas treatment initiated on low water level; no other emergency core cooling systems started or were needed.

After the Group 2 and Group 5 isolations were reset (at approximately 10:05 a.m.,

the reactor water cleanup (RWCU) outboard isolation valve was opened to reestab-lish RWCU system flow in order to accurately determine the bottom head tempera-ture (done to detennine if a reactor recirculation pump could be restarted).

Plant personnel then noted that the water entering the vessel had cooled down I

the bottom head temperature such that the differential temperature between the steam dome and the bottom head was greater than the 145 degree F limit of techni-cal specifications. Thus, the reactor recirculation pumps could not be started.

Plant personnel then decided to depressurize the vessel (by lowering the EHC setpoint) to get the temperature difference within the limit so that a reactor recirculation pump could be started.

At about 11:02 a.m., while plant personnel were lowering reactor pressure, the reactor vessel water level increased to the high level setpoint and the reactor feedpumps tripped. Before plant personnel could reset the feedpumps, with reac-tor power at 0 MWt, the reactor level dropped to the low level setpoint. This caused an actuation of the reactor protection system logic (no actual scram occurred because all of the control rods were still inserted after the 9:55 a.m.

scram), and a Group 2 isolation. Plant personnel restored the reactor level to normal via the A reactor feedpump and the condensate booster pumps as the vessel was allowed to continue to depressurize.

At the time of the initial scram, plant personnel noted that several other loads (i.e., in addition to vital ac) were lost from the 600 V IC bus. These included the 1A reactor building closed cooling water pump, the 1A air compressor, and the main turbine motor suction pump and turning gear oil pump. Also, an elec-tric fire pump lock-out relay on the E 4160 V bus was energized. Investigation by plant personnel determined that undervoltage relay ETRIA would have caused the loss of all those components, had it actuated. It is believed that the actuation of this. relay was the most likely cause of the scram.  ;

Other problems experienced during the scrams were as follows:

-- At about 10:30 a.m., RCIC was declared inoperable due to its trip and throttle valve not engaging the reset circuitry and not opening.

-- At about 1:20 a.m., HPCI was declared inoperable due to its turbine stop valve binding in the mid-position; this binding was the cause of erratic HPCI flow which was experienced during the initial scram.  !

-- When both HPCI and RCIC were determined to be inoperable, plant personnel i depressurized the reactor with the objective of decreasing reactor pressure below 113 psig, as required by technical specifications.

00'th HPCI and RCIC had passed surveillance only three days before the event, l

l 11 l

Plant personnel investigated the RCIC problem, and determined that RCIC's trip and throttle valve was in the continuous trip position due to the centrifugal trip weight's spring becoming loose. The spring apparently became loose during operation, thus causing damage to other parts of the trip / reset mechanism. The trip and throttle valve's trip / reset mechanism was repaired by replacing the spring, spring seat, weight, tappet guide, tappet and ball assembly, and the compression spring and emergency tappet nut. RCIC was functionally tested sat-isfactorily per the "RCIC Pamp Operability" procedure, and was returned to ser-

, vice on January 18, 1985.

Investigation of the HPCI problem determined that its turbine stop valve had stuck in the mid-position due to a galled stem. The valve was repaired by pol-ishing the inside of the valve and the valve's stem. The valve was then func-tionally tested satisfactorily, and HPCI was returned to service on January 17,

] 1985. (Ref. 9.)

I 1.6 Procedural Inadequacy Results in low Voltage Condition on Diesel Generators at Washington Nuclear During a reactor scram and the subsequent loss of normal and preferred power

. incident at Washington Nuclear 2* on January 31, 1985, the standby electrical l diesel generators (DGs) did not reach the required voltage to allow automatic closure of their output breakers. The voltage adjusting potentiometers for both DGs were found to have been adjusted to the low voltage limit. This caused the diesel output to be 10% below its designed voltage output, and precluded the DGs from accomplishing their design basis, automatic safety functions without Operator action. The event is detailed below.

, During full power operation on January 31, a loss of normal and preferred power occurred, and the Division ! and Division !! standby OG sets received a start signal. Both diesels automatically startt.d and accelerated to rated speed.

During an inspection of the DGs, approximately 1/2 hour following the scram, a Plant Engineer observed Division I and Division !! DG output voltages of 3700-3800 V ac, Rated voltage is 4160 V ac. Control room personnel were immediately notified of this discrepancy, and tha generator voltages were adjusted to normal values. This condition was analyzed the following day as preventing automatic DG breaker closure.

An investigation revealed that ten days earlier the voltage adjusting motor-operated potentiometers (MOPS) had been run to their lowest voltage setpoint.

On January 21, Plant Operators had noticed an illuminated voltage regulator

limit indication for DG No.1 in the control room. This limit light indicates that the MOP is at the high or low limit of its travel. No procedural guidance existed to direct Operators on required followup actions. During an investiga-a tion as to the cause of this indication, the DG No. 1 M0P had been adjusted to its low limit point. During N0P operation, a Shif t Electrician attempted to verify operation of the limit switches which provided the high/ low limit signal.

• Washington Nuclear 2 is a 1100 PWe (net) General Electric BWR located 12 miles northwest of Richland, Washington, and is operated by Washington Public Power Supply.

1 12

~

Upon examination of the M0P, it was discovered that the operating cam for these limit switches had slipped and was providing an erroneous signal. The DG No. 2 M0P was then operated, and correct operation of its limit switches confirmed.

Since a Maintenance Work Request would have been required to adjust the DG No. 1 limit switches, and it was felt that the cam adjustments did not affect M0P operability, it was decided that the adjustment could be performed during the next planned maintenance outage. This decision did not receive further management review. The M0Ps for both DGs were left at their minimum voltage adjustment positions. It was erroneously believed that once the M0P control switch was released the M0P would return to a position that provided normal voltage output for the DGs. One DG, the Div;sion III high pressure core spray DG, is designed with this provision.

In summary, the M0P design allowed the potentiometers to be adjusted while the generator was not operating. The Plant Engineer responsible for the startup testing of these diesel generators did not provide input to the operating pro-cedure concerning the voltage adjust high and low limit lights. The procedure did not contain a caution to Plant Operators concerning the fact that voltage could be adjusted outside the range which was required for automatic breaker closure. Nor was a caution present to indicate that if the voltage regulator were adjusted while the diesel generator was secured, the voltage would not return to a preset value upon starting. These precautions should have been included in the procedure.

Corrective actions have been implemented by way of both design and procedural changes to preclude recurrence of this event. These changes include the following:

-- The control circuitry for both Division I and Division !! DGs has been modified to preclude M0P operation while the DGs are shut down. Further design changes will be pursued which will provide an automatic voltage setpoint reset upon receipt of a SG start signal.

The DG operating and surveillance procedures have been changed to ensure that Plant Operators adjust voltage and frequency to obtain rated conditions prior to securing the DGs.

-- An evaluation will be made by the licensee of the human factors aspects of the MOP high/ low limit light indications and whether these particular indications are necessary. This evaluation will include consideration of whether light indicators should be included in annunciator response pro-cedures.

(

-- The Operations Department Manager will reinforce, to operations personnel, the various administrative procedure mechanisms that identify plant opera-ting problems and which provide feedback to the plant staff and management (

for future review and followup action. (Refs.10and11.)

l 13

1.7 Ice Condenser Lower Inlet Doors Blocked Closed Due to Personnel Error at Catawba On December 31, 1984, Catawba Unit 1* had entered hot shutdown with the ice condenser lower inlet doors blocked closed. The incident was not discovered until i January 9,1985, with the unit in startup testing. Investigation revealed that the procedural step verifying that the ice condenser lower inlet door blocking devices were removed had been signed off when, in fact, the devices were still in place. Twenty-three of 24 inlet doors were found blocked closed. The concern raised by leaving the inlet door blocking mechanisms in place is a possible degradation in the ability of the ice condenser to control containnent pressure following a postulated high energy line break inside containment. The event is detailed below.

The ice condenser at Catawba is equipped with 24 pairs of lower inlet doors which are located in lower containment along the lower crane wall. During a postulated loss of coolant accident (LOCA), if lower containment pressure exceeds upper containment pressure by more than 1 lb/sq ft, the lower inlet doors will swing open and allow steam to flow into the ice condenser. This allows for the absorption of thermal energy released in the event of a LOCA, for the purpose of limiting the initial peak pressure in containment.

The licensee's procedures require that after entering cold shutdown, and prior to entering refueling, the ice condenser lower inlet doors be physically blocked closed to ensure that the lower inlet doors do not inadvertently open. This is done to prevent ice from molting. Prior to restarting (entering hot shutdown),

the door blocking devices are required to be removed, per procedures.

On December 9, 1984, the unit entered cold shutdown for an inspection of the control rod drive shafts. The ice condenser lower inlet doors were blocked closed after entering cold shutdown. Prior to entering hot shutdown, Control Room Operators began the procedure for taking the unit from cold shutdown to 15%

full power. A Maintenance Representative signed off the appropriate step of the procedure, believing that the lower inlet door blocking devices had been removed.

On December 31, the unit entered hot shutdown.

On January 9,1985, at 6:00 p.m., several Health Physics Technicians entered the ice condenser to perform a biological shield survey. After entering the ice condenser they noticed that the lower inlet doors were blocked c.losed. The notified the Shift Supervisor, who requested the Shift Technical Advisor (STA) y to investigate the incident. The STA discovered that the doors in Bays 1 through 16 and 18 through 24 were blocked closed. The blocking device for the pair of doors in Bay 17 had slipped out of place. A work request was issued, and at 9:55 p.m., the lower inlet door blocking devices were removed. <

TheStandingWorkRequestforunblockingthelowerinletdoors(SWR 3194) hadbeenissuedtothePlanningStaffbyPreventiveMaintenance(PM)on <

December 31, 1984 Normally, when an SWR is issued to the Planning Staff during an outage, it is proplanned and held until the work is to be performed.

• catawba Unit 1 is a 1145 MWe Westinghouse FWP located 6 miles northwest of Rock Hill, South Carolina, and is operated by Duke Power.

4 I

l 14

1 1 . e i s.

j The responsible group tracks the specific task and notifies Planning when the j work needs to be performed. Planning then issues the SWR to Mechanical or

)

Instrument and Electrical Maintenance staffs.

l During the tracking process of SWR 3194, it was overlooked as an outstanding item for entry into hot shutdown. Therefore, the work request was never issued a to Mechanical Maintenance. The Maintenance Representative was under the im-i pression, from conversations with a coworker, that the door blocking devices had been removed. He then signed the appropriate procedural step. Since an independent verification was not required for this step, no one else verified l that the door blocking devices had been removed prior to entering hot shutdown.

I As a result of this event, the licensee plans to paint the door blocking devices

, fluorescent orange, and they will be numbered sequentially. (Catawba Unit 2 door blocking devices will be painted fluorescent green and numbered.) Mechanical Maintenance will develop procedures (1) to provide a method of documenting the

, status of their technical specification requirements, to ensure that all re-i quirements falling under the responsibility of Mechanical Maintenance have been j satisfied prior to entering each mode of operation; and (2) to provide guide-lines for installing and removing the lower inlet door blocking devices, for which an independent verification will be required.

) The licensee has performed an analysis which shows that at about 0.1 psi diff-l erential pressure, with the blocking mechanisms conservatively assumed to be l wedged in place horizontally, the inlet doors would open. This differential

oressure would develop a force across the doors sufficient to buckle the blocking mechanism. The licensee concluded that the pressure developed by all

! but the smallest high energy line breaks would therefore easily push the mecha-1 nisns aside and allow the doors to fully open. For the very small breaks, which

{ do not develop sufficient differential pressure to open the doors, containment i pressure increases due to bypass leakage would control the pressure increase.

The licensee's analysis is currently under review by the NRC. If the review does not support the licensee's analysis, the NRC staff will reevaluate the report-i ability of the event as an abnormal occurrence. (Refs. 12 and 13.)

1.8 Reactor Scram nn loss of Condenser Vacuum Due to Failed Expansion Joint, and Subsecuent High Containment Pressure at Quad-Cities

] In January 1985, Quad-Cities Unit 2* experienced a reactor scram due to low i condenser vacuum resulting from a failed turbine to condenser rubber expansion 1 joint. The event is detailed below.  ;

, At 6:22 a.m. on January 16, 1985, with the unit operating at near full power an I

alarm received in the control room for Unit 2 indicated that condenser vacuum was

! being lost. The Shif t Engineer and the Shif t Control Room Engineer were notified, i and the Operator began to reduce load. At 6:28 a.m., the reactor scramed on low l condenser vacuum. Closure of the main steam isolation valves (MSIVs) caused i J reactor pressure to increase, t

! Althoughreactorcoreisolationcooling(RCIC)wasstartedat6:43a.m.tocon-j trol reactor pressure, a second reactor scram signal occurred four minutes later l

) '

) iQuad-citiesUnit2isa769MWe(net)GeneralElectricBWRlocated20 miles J northeast of Moline, Illinois, and is operated by Connonwealth Edison, l

j 15 I.

due to high reactor pressure. The high pressure coolant injection (HPCI) was promptly started by the Operator in an additional attempt to control pressure.

Subsequently, a high primary containment pressure condition automatically initiated HPCI, and started the emergency diesel generator, the residual heat removal pumps, and the core spray pumps. The high primary containment temperature and pressure resulted mainly from the additional heat load on the reactor building closed cool-ing water (RBCCW) system and the resulting decreased efficiency of the drywell coolers.

The RBCCW system was unable to accommodate the additional heat loads (relief valves, vessel letdown to the condenser, etc.) because only one RBCCW heat ex-changer was in service at the time. Only one heat exchanger was in service because of the extreme cold river water temperature and the concern for recircu-lation pump seal embrittlement. In the past, when the plant used the spray canals for cooling, this was not a problem because canal temperatures remained warm throughout the winter months. However, even with the colder cooling water temp-erature, the surface area of only one heat exchanger was not sufficient to handle all the heat loads. Also, during the event the operators were discharging reactor water to the condenser, causing additional loading on the RBCCW by bypassing the regenerative heat exchanger on the reactor water cleanup system.

To reduce the likelihood of spurious trips from high drywell pressure, the licensee has requested a technical specification change to increase the high drywell pressure trip setpoint from 2.0 psig to 2.5 psig. This change is now under review.

The root cause of the loss of condenser vacuum was equipment failure. A rubber expansion joint connecting the turbine casing to the condenser had developed a large leak. The expansion joint was original equipment (the plant began comer-cial operation in 1973), and it had become embrittled with age and use. The average expected life of the expansion joint is about 10 years.

The defective expansion joint was replaced, and the expansion joints for the other two sections of the condenser will be replaced during the unit's next refueling outage. (Refs. 14 and 15.)

1.9 Inadvertent Recirculation System Actuation Signal During plant Protection System Testing at Arkansas On January 2, 1985, during monthly surveillance testing of plant protection system (PPS) channel A at Arkansas Unit 2* with the unit at 100% power, an inadvertent actuation of the recirculation actuation system (RAS) occurred.

The RAS automatically caused the suction path for the deactivated engineered safety features actuation system (ESFAS) pumps to be shif ted from the refueling water tank (RWT) to the containment sump, resulting in gravity draining of about 50,000 gallons of borated water from the RWT to the reactor building sump. The cause of the event was attributed to a spurious RAS signal generated within the matrix logic circuit in ESFAS trip path No. 4 while trip path No. I was in the tripped condition during the surveillance testing. This resulted in a two-out-of-four trip logic sequence and subsequent RAS actuation. The RWT level was restored in about 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, and normal processing of the borated water in the

• Arkansas Unit 2 is an 858 MWe (net) Combustion Engineering PWR located 6 miles northwest of Russellville, Arkansas, and is operated by Arkansas Power and Light.

16

containment sump began. Subsequent testing of the ESFAS trip path No. 4 logic matrix relays did not identify a relay degradation or failure; however, the '

matrix relay card which is suspected to have caused the actuation was replaced.

The event is detailed below, i

At about 8:38 a.m. on January 2, 1985, with the unit at 100% power, Instrur mta-tion and Control (I&C) Technicians were performing the PPS channel A logic matrix actuation test for the RAS portion of the ESFAS, as part of normal monthly 3PS ,

surveillance testing. Per procedure, the anticipated result of this testing was the deenergization of the logic matrix relay for ESFAS RAS trip path No. 1, with annunciation, status panel indication, and " half-leg" actuation of the ESFAS RAS. However, due to a spurious signal within the logic matrix relaying of the PPS, a coincident RAS logic matrix relay deenergized, resulting in a two-out-of-four RAS actuation logic. The inadvertent RAS actuation resulted in the gravity draining of the 50,000 gallons of borated water.

The RAS transfers suction of the ESFAS pumps from the RWT te the containment -

sump on low RWT level. Upon RAS actuation, containment sump suction valves open with a normal open stroke time of about 22 seconds. The RWT outlet valves begin to close as soon as containment sump suction valves reach full open with a normal close stroke time of about 80 seconds. During this suction path re-alignment period, the RWT level decreased from 98% to 88%. At 8

40 a.m. during the resetting of the RAS, plant operators noted that control room PPS status lights indicated channel A (trip path No. 1) and channel D (trip path No. 4) had generated the inadvertent RAS.

The system was realigned to the nonactuated condition. Makeup to the RWT was

begun at 8

48 a.m., and the technical specifications required level was restored at 11.00 a.m. At 8:55 a.m., draining of the containment sump and processing of at 11:00 a.m. At 8:55 a.m., draining of the containment sump and processing of i

the borated wate began. The draining of the reactor building sump was completed i

on January 5. A reactor building entry was made on January 7 to inspect the containment floor area. Inspection of the containment sump screen revealed the west side door to be open. Apparently, the door may not have been padlocked and was forced open by the reverse flow from the RWT gravity drain to the con-4 tainment sump. This door is normally closed and locked to prevent debris from entering the sump during sump recirculation. Controls have been implemented to l

, verify the sump doors are closed and secured when the plant is above cold shut- )

down. j At 2:30 p.m. on January 2, I&C technicians recommenced the channel A PPS monthly testing at the RAS procedure section. A temporary procedure change was made i requiring closure of RWT outlet valves as a precaution to prevent recurrence of

! RWT draining should another inadvertent actuation occur. The A PPS channel l monthly functional test was completed with no further incidents.

Subsequent bench testing of each ESFAS trip path No. 4 logic matrix relay did

! not identify a relay degradation or failure. Replacement of the logic matrix relay card containing the relay being tested at the time of the inadvertent RAS has been performed as a precautionary measure. (Ref.16.)

l s

I 17 1

1.10 Reactor Trip Involving Failure of Reactor Trip Breaker at Sequoyah I l

Sequoyah Unit 2* was operating at about 100% power on January 12, 1985 when a reactor trip occurred at 3:29 a.m. Due to all three No. 3 heater drain tank 4

(HDT) pumps tripping off and causing unstable flow conditions at 3:28 a.m., the A main feedwater pump tripped on low seal injection water pressure to the main i feedwaterpump(MFP). Seal injection water is provided by the HDT pumps. The Operator immediately took manual control of the B MFP and increased its speed to i provide sufficient flow to maintain steam generator levels. Simultaneously, a turbine runback was initiated to reduce load to prevent a reactor trip on low steam generator levels; however, Operator actions were unsuccessful, and the unit automatically tripped at 3:29 a.m. on 10-10 level in steam generator No. 3.

The operator immediately verified control room indication, as required, to see if both train A and B reactor trip breakers opened. He noted that the train A breaker failed to open from the automatic signal. The train B breaker did open on the automatic signal from the solid state protection system logic, and all rods inserted as designed. Within 5 seconds of the automatic trip, the operator tripped the train A breaker using the manual handswitch on the main control board.

All other reactor protection and engineered safeguard features operated as l expected upon receiving the automatic trip.

A detailed investigation was made into the failure of the train A reactor trip .

breaker to open on an automatic signal from the solid state protection system (SSPS). Trouble-shooting was divided into three areas: (1) the SSPS output components, (2) the cabling and connection between the SSPS and the reactor trip switch gear, and (3) the reactor trip breaker. In order to troubleshoot areas (1) and (2), reactor trip breaker train B was relocated in the train A compartment. This would allow for testing SSPS output and cabling independent of the failed breaker, and for inspection of the train A breaker in the as-found condition.

With the train B breaker installed and closed in the train A compartment, the instrument mechanics initiated a trip signal from the SSPS cabinets. The train B breaker, which had tripped earlier in its own compartment, failed to open in the train A compartment, indicating that the problem was associated with the SSPS trip signal output or cabling connections between the SSPS and reactor trip breaker. It was found that the output of the undervoltage card would not deenergize, thus holding the undervoltage trip coil energized and preventing the breaker from opening. Train A SSPS was removed from service using procedures, and the reactor trip undervoltage card was replaced. While using a volt meter across the undervoltage output, an automatic trip signal was injected through the system test circuit, and the new undervoltage card was verified to deenergize.

The old undervoltage card was then reinstalled and tested. The output voltage

again failed to deenergize, thus verifying the output card failure. The new

undervoltage card was reinstalled, verified to be operable, including closing

! the reactor trip breaker and verifying that it would trip automatically from the i train A SSPS output signal. Procedure IMI-99-FT-19, " Automatic Test of Reactor

Trip Breaker," was performed to verify operability. The train was returned to service. Additionally, to verify the SSPS input relays, the bistables from steam generator 10-10 level were tripped in every combination to ensure all logic was j functionally acceptable; no deficiencies were noted.

! *5equoyah Unit 2 is a 1148 MWe (net) Westinghouse PWR located 10 miles northeast j of Chattanooga, Tennesee, and is operated by Tennesse Valley Authority.

18

1

On January 14, 1985, troubleshooting of the defective undervoltage card, serial

1 number 0101, confirmed that transistor Q3 (output transistor on Westinghouse Drawing 6058090) had failed. The failure was an emitter-to-collector short

! which prevented the outage voltage from deenergizing. The transistor was re-j placed, and the undervoltage card was retested using a card test box and facility -

t procedure, and all functions of the card were verified operable. The failure of

transistor Q3 probably occurred on December 29, 1984 during the performance of j IMI-99-FT-18. " Manual Test of Reactor Trip Breaker." The test was being performed 4 as a result of a unit trip which occurred on that date (reference 1.ER 50-328/84-02),

i During the test, a digital volt meter was inadvertently used on the current scale t

of measure voltage across the undervoltage coil. The low resistance of the current scale could have drawn enough current to fail transistor Q3. This is a '

! potential common mode failure mechanism for the reactor protection system. ,

Immediate corrective action was to replace the failed undervoltage card and verify operability through testing. To prevent further recurrence, a note was

, sent to all Instrument Maintenance Foremen to ensure that the automatic test of reactor trip breakers, FT-19, is perfomed after the manual test, FT-18. This will ensure the breakers and the undervoltage cards are fully operable before i

returning the system to service. Further, FT-18 and FT-19 have been revised and '

1 combined into one instruction which is structured to perform the automatic test after the manual test. The use of a meter to measure the voltage of the under-

voltage coil has been discontinued. These measures will reduce the possibility of inadvertently damaging the output transistor on the SSPS undervoltage card, and will also reduce the overall time needed to perform the breaker test. This revision was completed on January 25, 1985.

} An inspection was also performed on the train A breaker in the as-found condition by Electrical Maintenance. The Westinghouse 08-50 breaker was checked for smooth manual closing, alignment trip bar movement, adequate contact surfaces, and overall condition in accordance with Maintenance Instruction MI-10.9. The under-voltage trip assembly linkage was lubricated with the recomended Westinghouse a lubricant, and the linkage was exercised manually to allow penetration of the lubricant. A de power supply was connected to contact points 11 and 12, and  ;

j rated voltage was applied to the undervoltage coil. The voltage was slowly

, lowered until the breaker tripped at approximately 19 volts dc. This was re-i peated with the same results. This voltage is within the range of acceptance j criteria as set forth by the Westinghouse Owners Grcup for actuation of the i undervoltage relay. There were no deficiencies found with the 08-50 breaker F i

assembly. A response time test of the reactor trip breaker from logic through the breaker was performed after all maintenance activities were complete. Major maintenance to the breaker will continue to be performed using MI-10.9. An

. overall timing test is presently required by MI-10.9 u post-maintenance logic '

is operable after breaker maintenance. .

l After the replacement of the SSPS undervoltage card, serification of proper breaker operation, and repair of the condensate system No. 3 HDT level control

valves, an evaluation of the unit by Operations personnel and plant management l l concluded that the unit was safe for restart. (Refs.17,18,and19.)  :

t i

i j 19 1

1.11 References (1.1) 1. Georgia Power, Docket 50-366, Licensee Event Report 85-01, l February 18, 1985.

2. NRC, Preliminary Notification PNO-II-85-13, February 11, 1985.

3. Mississippi Power and Light, Docket 50-416, Licensee Event Report 85-07, March 12, 1985.

4. GPU Nuclear, Docket 50-219, Licensee Event Report 84-17-01, December 24, 1984.

(1.2) 5. Baltimore Gas and Electric, Docket 50-317, Licensee Event Report 85-01, February 8, 1985.

(1.3) 6. Duke Power, Docket 50-369, Licensee Event Report 85-04, February 27, 1985.

(1.4) 7. Alabama Power, Docket 50-364, Licensee Event Report 85-05, March 5, 1985.

8. NRC, IE Information Notices 85-10 (February 6,1985), and 85-10, Supplement 1 (March 8,1985).

(1.5) 9. Georgia Power, Docket 50-321 Licensee Event Report 85-10 February 14, 1985.

(1.6) 10. Washington Public Power Supply, Docket 50-397, Licensee Event Report 85-08, February 27, 1985.

11. NRC, Region V Inspection Report 50-397/85-09, March 9, 1985.

(1.7) 12. Duke Power, Docket 50-413, Licensee Event Report 85-02 February 8, 1985,

~

13. NRC, Region !! Inspection Report 50-413/84-106, March 1, 1985.

(1.8) 14. Commonwealth Edison, Docket 50-265 Licensee Event Report 85-03, February 13, 1985.

15. NRC, Region III Inspection Report 50-265/84-25, January 28, 1985.

(1.9) 16. Alabama Power and Light, Docket 50-368. Licensee Event Report 85-01, February 6, 1985.

(1.10) 17. Tennessee Valley Authority, Docket 50-328, Licensee Event i Report 85-02, February 11, 1985.

18. NRC, Region !! Inspection Report 50 328/85-06, February 27, 1985.

(

20

e

19. NRC, IE Information Notice 85-18. " Failures of Undervoltage Output Circuit Boards in the Westinghouse-designed Solid State i Protection System," March 7, 1985.

).

These referenced documents are available in the NRC Public Document Room at 1717 H Street, Washington, DC 20555, for inspection and/or copying for a fee. (AE00 reports may also be obtained by contacting AE00 directly at 301-492-4484 or by letter to USNRC, AE00, EWS-263A, Washington, DC 20555.)

2 I

l I

1 l

4 1

1 I

i i

4 4

(

1

! (

1

I i

21 l

1 u-___--___________--_____----_-_-_---------_---_----_----- - - - - _ - _ _ _ - - - _ _ _ _ _ _ _ _ - - - - _ _ - -

- -- .. . ~..- . - .- . . _ . _ _ _

i 1

2.0 EXCERPTS OF SELECTED LICENSEE EVENT REPORTS 4

On January 1, 1984, 10 CFR 50.73, " Licensee Event Report System" became effec-tive, This new rule, which made significant changes to the requirements for

) licensee event reports (LERs), requires more detailed narrative descriptions of the reportable events. Many of these descriptions are well written, frank, and informative, and should be of interest to others involved with the feedback of

] operational experience, i

This section of Power Reactor Events includes direct excerpts from LERs. In il 4

general, the information describes conditions or events that are somewhat unusual or complex, or that demonstrate a problem or condition that may not

! be obvious. The plant name and docket number, the LER number, type of reactor, i and nuclear steam supply system vendor are provided for each event. Further

] information may be obtained by contacting the Editor at 301-492-4499, or at J U.S. Nuclear Regulatory Commission, EWS-263A, Washington, DC 20555.

I Excerpt Pg 2.1 Inadvertent Activation of Containment Spray Due to Bistable Cross-talk at Kewaunee..................................... 24

2.2 Movement of Heavy Load Over Spent Fuel Due to Inadequate Ope ra to r T ra i ni n g a t Zi on . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Failure of Hydraulic Control Unit Accumulator Pressure

^

2.3 i Switches Due to Setpoint Drift at LaSalle.................. 26 2.4 Water Leakage Events Causing Operational Problems at North Anna, Kewaunee, and Callaway............................... 27

) 2.5 Opening of Reactor Trip Breakers Due to Deenergized Under-vol tage Trip Coil s a t Callaway. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 1

2.6 HPCI Problems at Dresden, Brunswick, and Browns Ferry........ 29 2.7 Cold Weather Affects Safety Systems Availability at Arkansas, j McGuire, and Susquehanna................................... 31 1

! 2.8 Generic Problems involving Design Deficiency at Oyster Creek, <

1 McGuire, Palo Verde, Salem, Millstone, Robinson, Catawba, i and 0conee................................................. 33 i

(

! 2.9 Events involving Equipment Qualifications at Trojan,

Washington Nuclea r, Cook , and Callaway. . . . . . . . . . . . . . . . . . . . . 36 l 2.10 Problems Caused by Lack of Proper Operator Attentiveness at Susquehanna, Catawba, Zion, Kewaunee..and Surry............ 38 4

1 l 23 t i L_______._______.____ _ _ _ __ _ _ _ _ _ _ _____ _ _______ _ ___ _ _ _ ___ _ __ _ __ _ _ ____ _ __ _ _ _ _ _ . . _ -

2.1 Inadvertent Activation of Containment Spray Due to Bistable Cross-Talk Kewaunee; Docket 50-305; LER 85-01; Westinghouse PWR At 1437 on January 22, 1985, during full power operation, there was an inadver-tent actuation of the IB internal containment spray system (ICS). The IB pump ran for 1 minute and 40 seconds, discharging an estimated 2500 gallons of borated water into the containment building before being secured. The pump start occurred during the performance of SP55-155 " Engineered Safeguards Logic Test." This test is performed monthly to satisfy plant technical specification (TS) requirements.

Each safeguards logic train is tested individually. A contact is opened to prevent the slave relay on the train in test from being energized by the master i relay. By procedure the I&C personnel are to monitor the comput2r printout, the sequence of events recorder points, annunciators and/or trip status lights and the test lamps or permissive status lights actuated by the procedure. When the pump start occurred, the operator verified that it was inadvertent, secured the system and reset containment spray. The operators received battery ground alarms as a result of instrument malfunctions in containment. Among the alarms received were 1A reactor coolant pump (RCP) fire protection, IB RCP upper bearing temperature, and rod deviation alarms.

At 1525 it was discovered that the refueling water storage tank (RWST) level was below TS limits. Refilling was started and preparations were made to begin a plant power reduction. The RWST was above TS setpoint at 1555, hence no reduction in power was initiated.

At 1610 a containment entry was made by Operations personnel and plant elec-tricians. They found pools of water, at all elevations of containment, that were evaporating and leaving boric acid residue. Everything else appeared normal with no visible evidence of ground faults.

At 2040, indication for control rod K-7 in Bank D began behaving erratically.

All other core conditions showed normal behavior and the rod position indication for rod K-7 was declared out of service.

A review of the surveillance procedure performance was initiated to identify the cause of the actuation. From the Sequence of Events Recorder printout, it was discovered that during the performance of the containment Hi pressure logic testing, the Hi-Hi containment pressure alarm actuated twice. This Hi-Hi con-tainment pressure bistable actuation during the test on the Hi containment pres-sure logic is attributed to an interaction between the two bistables, referred to as cross-talk. This is possible because the Hi and the Hi-Hi containment pressure actuation circuitry are contained in the same duplex bistable unit.

The problem of cross-talk has been detected before and has been the subject of letters between the licensee and the bistable manufacturer, Foxboro. This cross-talk may have resulted in energizing the containment spray master relay.

At the end of the procedure, when safety injection was reset, the slave relay was energized and the IB ICS pump actuated.

24 l

s .

A retest was performed two days after the event in an attempt to reproduce the occurrence. In two of 17 attempts, Hi-Hi containment pressure alarmed during testing of the Hi containment pressure channel. In addition, recorders were set up to monitor the coils on the bistable outputs. Fluttering of the deener-gized bistable was observed. This evidence indicates that cross-talk may have occurred, but is not conclusive as to the cause of the pump start. Additional testing is planned during the in-progress 1985 refueling outage.

The immediate concerns following this event were proper operation of equipment.

The containment tour verified that there was no major problem and abnormal instrument indications could be attributed to water intrusion.

The other concern was possible corrosion of carbon steel components covered by mineral based insulation material when exposed to boric acid solution. Accord-ing to information received from Westinghouse, when the solution evaporates boric acid crystals are left; as long as the crystals remain unwetted there should be no short or medium term corrosion concern. However, because of the design of the insulation and the high operating temperature of the carbon steel components it is unlikely that the solution came in contact with the components.

Containment humidity returned"to normal conditions (the 15-20% range) by 1937 on January 22, indicating that the water inside containment had dried, with boric acid crystals coating exposed surfaces.

Immediate actions were taken to assess the situation and identify the cause.

Long term actions planned are to clean the containment interior, and perform an evaluation to identify potential hardware modifications which would prevent reoccurrence.

A related event occurred on February 10, with the plant in cold shutdown and RCS pressure at approximately 320 psig. The control room operator noticed l that the IB RCP had started without switch action. Upon discovery the operator secured the pump and started the associated oil lif t pump. Residual water (believed to be from the ICS actuation) discovered in the pump pressure switch housing had grounded the RCP 4160 V breaker SCR circuitry, sending a close signal to the breaker and starting the pump. (Reference LER 50-305/85-04; item 2.4.2 below.)

2.2 Movement of Heavy Load Over Spent Fuel Oue to Inadequate Operator Training l Zion 1; Docket 50-295; LER 85-06; Westinghouse PWR On February 7,1985 in preparation for removing a reactor coolant pump (RCP) motor from the containment, a section of the RCP motor transporter structure ,

was to be moved from the fuel building trackway to the containment equipment hatchway. The transporter structure was stored just beyond the fuel building railroad trackway, which required bypassing the crane interlocks system in ,

order to obtain a straight lift. After the lift was made and the structure was moved inside the trackway, the interlocks were not reset. This allowed the crane operator to move the load freely anywhere within the crane's range. The crane operator had not been trained in the restrictions on the movement of heavy loads, and was not being directly supervised by his foreman as required

(

25

by the Maintenance Department Administrative Instructions. The crane operator, unaware of the significance of his actions, moved the load over the spent fuel pool in an effort to complete the move in the shortest pathway. The event was discovered by another mechanic who was aware of the heavy load controls. The move was completed without incident.

Apparently, neither the mechanical maintenance crane operator nor the mechanical maintenance foreman the crane operator reported to, had received adequate train-ing on heavy load movement, although this issue had been discussed with this foreman the previous day as part of a departmental training session. Although the crane operator had received the Production Training Department crane opera-tion course, it apparently does not cover heavy load movement restriction. In addition to the above, procedural documentation in place may not have been adequate.

Within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of the event, all mechanical maintenance personnel were trained or retrained in the control of heavy loads.

All lift movement of the fuel building and containment cranes will be directed by a mechanical maintenance foreman, a properly trained mechanic or a manage-ment person.

The keys for both the fuel building crane and containment polar crane are currently controlled by the mechanical maintenance foreman. Second keys will be controlled by the fuel handling foremen.

l Control of fuel building crane interlock will be reviewed. (If the interlock i had been reset after picking up the heavy load, movement over the spent fuel pool would not have been allowed.)

l Production Training crane operator training will be augmented by site specific training which will cover heavy load movement.

2.3 Failure of Hydraulic Control Unit Accumulator Pressure Switches Due to Setpoint Drift LaSalle 1 and 2; Dockets 50-373 and -374; LER 85-10; General Electric BWRs It was found that on Units 1 and 2 the hydraulic control unit accumulator pressure switches were out of calibration (low) at various times between l February 15 and March 1, 1985. On Unit 1, 180 out of 185 switches had drifted and on Unit 2, 184 out of 185 switches had drifted out of calibration.

C The cause of the event is apparently due to setpoint drift, with the setpoints drifting to a lower pressure (non-conservative). No cause for the drifting has been determined at this time. c Since the units were in power operation and pressurized at all times, scram ,

action was not significantly affected. Reactor pressure is sufficient alone '

to insert the control rods. Weekly checks of HCU accumulator pressure prior to the event have verified that control rod accumulator pressures were acceptable.

Increased surveillance of accumulator pressure during the event and until. (

resolution ensures scram capability will remain intact.

26

1 t

2.4 Water Leakage Events Causing Operational Problems 2.4.1 Corrorion and Failure of Valves Due to Flooding of Valve Pits North Anna 1 and 2; Dockets 50-338 and -339; LER 85-02; Westinghouse PWRs Testing of the Unit I recirculation sprey and safety injection valves was per-formed between February 15, 1985 and February 18, 1985. Testing of MOV-RS-155A, a 12-inch Velan (EIIS vendor reference No. V085) gate valve, resulted in this valve " sticking" in the three-quarters open position and subsequently being declared inoperable. The remaining valves were tested with satisfactory results.

Maintenance personnel found that deposits between the threads of the valve yoke nut and valve stem had caused the valve to " stick." This valve is underwater a significant amount of time, and it appears that dissolved impurities in the water solidified on the valve stem in the valve yoke nut area. The problem of ground water infiltrating the valve pit that contains these valves is being addressed.

The originally installed valve pit sump pumps are inadequate and cannot be main-tained in an operable status. An improved dewatering system design has been requested from the Engineering and Construction Department. In the interim, temporary sump pumps are being used to pump the sump down, but the water level often rises above the valves. The valve stem and yoke nut of M0V-RS-155A were cleaned and lubricated and the valve returned to operable status on February

17. The stems of the other motor operated valves in the Unit i valve pit sump ,

were cleaned and lubricated. The outside recirculation spray pump suction l valves on Unit 2 (M0V-RS-255A,B) are also subject to submergence. These valves were tested in accordance with the valve inservice testing program in mid February 1985 with satisfactory results. The motor operators for the valves are located approximately 60 feet above the valves and are connected to the valves with long shafts. The motor operators are not subject to the wet con-ditions in the valve pit sump. The valves normally are open and receive an open signal following an accident.

Valves MOV-RS-155A,B and MOV-RS-255A,B had been replaced during the 1984 refuel-ing outages. The Unit I refueling outage was during the summer and the Unit 2 outage was during the fall of 1984. A review of the maintenance histories of these valves from the time they were replaced revealed several failures which appear to be similar in nature to the failure of M0V-RS-155A on February 15, 1985. Three failures, including this February 15 failure, have occurred on Unit 1 and one failure has occurred on Unit 2. Further investigation and evalu-ation is being performed to provide recommendations which will ensure the relia- ,

bility of these valves.

2.4.2 Inadvertent Reactor Coolant Pump Start Due to Ground Caused by Water Accumulation in Pressure Switch Kewaunee; Docket 50-305; LER 85-04; Westinghouse PWR

(

27

1 At 1230 on February 10, 1985, a Control Room Operator noticed the IB reactor coolant pump (RCP) running. Subsequent investigations revealed that the pump had inadvertently started due to a grounded condition in the actuation circuitry associated with the 4160 V switchgear. The ground was caused by water accumu-lation in a pressure switch as a result of an inadvertent containment spray (reference LER 50-305/85-01). The ground provided enough current to gate the solid state starting circuitry.

The safety significance of this event is that inadvertent actuation of 4160 V switchgear creates a personnel safety hazard. This concern can be dealt with through administrative controls.

Also, the inadvertent actuation of 4160 V switchgear could affect the assumptions of the safety analysis with potentially adverse effects on nuclear safety. There are 48 4160 V switchgear cubicles at Kewaunee, of which 22 are considered to be safety related. Of these, 12 are associated with motors and the remaining ten are bus feeder or bus tie breakers. However, the effect of inadvertently starting a safeguard motor, at worst, is the disruption of the sequence load-ing associated with the diesel generator upon loss of offsite power. This is not expected to result in a failure or affect the conclusions of the safety analysis.

The inadvertent closure of the safety related bus tie or bus feeder breaker could result in damage to a diesel generator. However, a review of the loca-tion of the switchgear and associated cabling showed that they are located in areas where adverse environmental conditions are considered incredible.

Consequently, there is no postulated event which would result in inadvertent actuation of this switchgear in a manner which would affect the results of the safety analysis.

Although no corrective actions were required, a hardware modification which would eliminate the potential for this event is being evaluated. In addition, the emergency operating procedures will be revised to instruct the operators to place the RCP's in pull out when they are required to be tripped due to low reactor coolant system pressure.

2.4.3 Loss of Startup Transformer Due to Short in Deluge System Callaway 1; Docket 50-483; LER 85-11; Westinghouse PWR During a reactor startup on February 22, 1985, the reactor was manually tripped and emergency diesel generator (DG) B automatically started and loaded when the startup transformer was lost. The required safety-related equipment performed c as designed during the incident.

The startup transformer was tripped off by an interlock between the transformer c and its deluge system due to water leakage into the hand pull station for the deluge system. Power was lost to the motor / generator sets which supply power ,

to the control rods, thus preventing rod movement. When the operators attempted to move rods in and no movement occurred, the reactor was manually tripped. ,

(

28

An investigation into the cause of the deluge system actuation revealed a short in the electrical box of the hand pull station (mounted outside on the f

turbine building wall) for the startup transformer deluge system. The short was a result of water intrusion into the pull station during a period of heavy -

rain. Water had seeped in around a pipe plug opening used for conduit at the top of the box. The plug was not tight and water had seeped in with no path to drain out. The pull station was replaced and the plug was sealed with caulk.

Other outside pull stations were inspected for internal water and resealed.

To prevent a similar recurrence, the control circuitry for the startup trans-former's fire suppression deluge system has been modified such that the deluge

! system will not operate until the transformer trips off for a reason other than j a deluge actuation.

2.5 Opening of Reactor Trip Breakers Due to Deenergized Undervoltage Trip Coils Cellaway 1; Docket 50-483; LER 84-48; Westinghouse PWR On October 6, 11, and 22, 1984, a feedwater isolation signal (FWIS) was gener-ated when reactor trip breaker A immediately reopened when operators attempted to close the reactor trip breakers. In all three incidents, equipment and per-sonnel responded as expected following the FWIS.

It was first discovered that residual heat in the undervoltage (UV) trip coils on the breaker would not allow the coil to reenergize after a trip. The UV coil was replaced on reactor trip breaker A on October 15. Further investiga-tion revealed a potential concern that the contact development on the reactor trip /close handswitch, located on the main control board, would also cause the UV coil to remain deenergized in certain situations following a trip operation.

]

A design change to rewire the contacts has been approved.

2.6 HPCI Problems at Several BWRs l 2.6.1 Inoperable HPCI System Due to Valved Out Service Water Dresden 3; Docket 50-249; LER 85-06; General Electric BWR During normal operation on February 22, 1985, the Operating Department discovered that the service water leading to the Unit 3 high pre:sure coolant injection (HPCI) room cooler was valved out, causing it and the HPCI system to be inoper-able. Safety significance was minimal since the isolation condenser and auto-matic depressurization systems were operable and capable of relieving high reactor pressure. The valves were immediately opened and system operability was restored. <

, The cause of the event was personnel error. An investigation revealed that station personnel had valved out the service water supply to the Unit 3 HPCI room <

cooler sometime between January 14 and 23,1985, without proper authorization.

Results of this investigation produced a list of recommendations for corrective 4

actions. One of these corrective actions is that all service water supply valves to HPCI, low pressure coolant injection and containment cooling service water vault coolers will be locked open to prevent a recurrence.

. I 29

2.6.2 Inoperability of HPCI System Due to Problems with HPCI Turbine Components Brunswick 2; Docket 50-324; LER 85-02; General Electric BWR On February 15, 1985, the Unit 2 high pressure coolant injection (HPCI) system was declared inoperable following operability testing which revealed the HPCI pump discharge valve, E41-F006, would not open. Unit 2 was operating at 100%

power. A unit shutdown was commenced in accordance with technical specifications after determination that the unit low pressure coolant injection (LPCI) loop B was inoperable. Within five hours, operability of the LPCI loop was reestablished j and reactor shutdown was terminated at approximately 10% reactor power. An ascension to full reactor power was then comenced.

The following troubleshooting and operability testing of the HPCI system was conducted:

(1) Valve E41-F006 would not open due to an open auxiliary contact in the valve motor starting time-delay relay, 2A, located in the valve opera-l tor motor control center. The contacts in the relay had slid out of posi-

^

tion. The contacts were repositioned; the relay, General Electric 1

Part No. IC 2800-A501-AF023C, was manually operated to ensure contact j position; and the E41-F006 valve was satisfactorily operated and returned

) to service.

(2) The HPCI turbine speed instrument, E41-C002-4, General Electric Part No. 724-672-93, would not calibrate as a result of a failed instrument main spring. The main spring was replaced.

j (3) While performing a calibration check of the HPCI turbine electronic speed controller, it was found the controller was not functioning within cali-bration tolerances due to a faulty adjustment potentiometer. The con-troller, Woodward Part No. 698-867-11, was replaced.

(4) On February 17, 1985, during startup of the HPCI turbine, the HPCI turbine stop and control valves, E41-V8 and V9, operated erratically. The needle valve, which supplies hydraulic fluid to the control valve, was found out of adjustment. The needle valve was adjusted and proper operation of E41-V8 and V9 was reestablished. ,

(5) On February 20, 1985, during operation of the HPCI turbine, the turbine tripped on apparent overspeed. At the time of the overspeed trip, turbine speed was approximately 3600 rpm. Troubleshooting revealed the overspeed trip device had malfunctioned due to hydraulic control pressure being out /

of specification and low reset spring tension. The reset spring, Terry Turbine Part No. 105-594-A02, was replaced, and the hydraulic control pres-sure was adjusted to return the overspeed trip device to service.  ;

These HPCI problems were resolved through appropriate repair, replacement, or engineering evaluation. The HPCI system was returned to service within 13 days following the satisfactory performance of system operability testing.

30

- .- ~. .- = . - - _ . . ._ _ .__

2.6.3 Inoperability of HPCI System Due to Improper Setting on Limit Switch Browns Ferry 3; Docket 50-296; LER 85-03; General Electric BWRs During performance of a scheduled surveillance instruction (SI) on January 11, 1985, the time necessary for the high pressure coolant injection (HPCI) system to reach rated flow was 35 seconds. This is 10 seconds longer than the criteria of 25 seconds specified in the SI; therefore, the HPCI system was declared inop-erable. The failure investigation that followed determined that a limit switch on FCV 73-16, which starts the auxiliary oil pump and, consequently, the HPCI turbine, had been set incorrectly.

Following HPCI inoperability, technical specifications require that the reactor core isolation cooling (RCIC) system operability be demonstrated immediately.

During performance of the RCIC pump operability SI before the turbine is rolled, turbine trip capability is demonstrated by tripping the turbine trip throttle valve FCV 71-9, which isolates the steam supply to the RCIC turbine. After i this valve was tripped, the Limitorque operator would not reopen the valve.

l The failure of the operator was caused by a worn brass worm gear. The worm

! gear was replaced and RCIC system operability was proven after successful com-pletion of the applicable sis. The failure of the brass worm gear is the first i of this type that has been observed on a Limitorque operator. A program will be initiated to inspect other Limitorque operators to determine if similar problems exist.

In addition, to ensure that the time required for HPCI to achieve rated flow will be within the Final Safety Analysis Report and SI limit of 25 seconds, additional post-maintenance testing of the HPCI system will be performed when corrective maintenance is performed on the HPCI system. Specifically, anytime corrective maintenance which could affect HPCI start time is perfonned on com-ponents such as FCV 73-16, the HPCI flow controller, or the hydraulic system, the applicable sis will be included as part of the post maintenance testing of j the HPCI system.

2.7 Cold Weather.Affects Safety Systems Availability 2.7.1 Inoperability of Refueling Water Tank Level Transmitters Due to Freezing Arkansas 2; Docket 50-368; LER 85-02; Combustion Engineering PWR l

1 On January 20, 1985, with the unit operating at 100% power, refueling water tank (RWT) level transmitters 2LT-5639-3 and 2LT-5640-4 failed high due to transmitter freezing as a result of ambient weather conditions, 2*F with a 20 MPH wind ,t speed. This rendered channels 3 and 4 of the recirculation actuation system i (RAS) inoperable and caused entry into the action requirements of technical ,

i specifications. RAS channel 1 level transmitter 2LT-5636-1 also failed high .l j due to transmitter freezing. This resulted in 3 of 4 RWT level transmitters l being inoperable.

0 31

Corrective actions included constructing temporary enclosures around the existing transmitter weather protection cabinets and providing additional heat sources for the instrumentation to supplement installed freeze protection. No damage to the instrumentation was observed and it.strumentation calibration was verified prior to declaring an instrument operable. Additional Engineering and Operations evaluation of this event is in progress.

2.7.2 Safety Injection Bistable Disabled to Prevent Possible Spurious Actuation Caused by Frozen Lines McGuire 1; Docket 50-369; LER 85-03; Westinghouse PWR On January 20, 1985, freezing temperatures caused instrument lines to freeze and send erroneous signals to the reactor protection system, thu creating a likelihood of a spurious trip. Steam Generator A main steam line pressure transmitters began failing low and sending erroneous signals to the low pres-sure steam line isolation and safety injection circuits. Due to the record demand for electricity because of the cold, a course of action was developed to prevent an unnecessary reactor trip.

At about 0400 on January 21, the NRC was notified of the licensees plan to jumper a failed channel of the process control system, in order to disable the output to the reactor protection system. The jumper was installed, and additional weatherization was added to the exterior doghouse area where the instrument freezing problems were occurring. After the weatherization was complete, the temperature in the doghouse rose enough to remove the potential for freezing, and at about 0700 the jumper was removed, and the NRC was notified that the unusual situation was under control.

2.7.3 Reactor Scram Caused by Ice in Isophase Bus Ducts Susquehanna 1; Docket 50-387; LER 85-03; General Electric BWR On January 24, 1985, with the reactor at 82% power, the unit scramed .on a main turbine control valve fast closure signal resulting from a main generator lockout.

Throughout the transient, the unit functioned as designed. No emergency core cooling systems actuated and no system isolations occurred.

The main turbine trip which resulted in the reactor scram was caused by a main generator primary lockout. The lockout relay was triggered by the generator neutral overvoltage relay. The overvoltage relay's calibration was checked and found satisfactory. Further investigation found ice formations in main genera-tor's A and C isophase bus ducts at the low point in the ducts where they make c 90 degree turns to connect to the unit's auxiliary transformer. The ice had formed a bridge between the buses themselves and the ducts. Removal of the ice was accomplished on January 25. Main generator doble tests as well as doble (

testing looking back at the transformers through the isophase buses had accept-able results.

A drainage hole was drilled in each isophase bus duct inspection cover as an interim action to prevent recurrence. Preventive maintenance activities, which will be performed during refueling outages, will be reviewed to assure 'ie clean- .

liness and integrity of the neutral grounding system and isophase bus dt ts. C 32

i .

2.7.4 Diesel Generator Starting Problems Due to Cold Weather j Susquehanna 1; Docket 50-387; LER 85-02; General Electric BWR The B diesel generator was removed from service at 0820 on January 21, 1985 for 4 18-month preventive maintenance. A 3-day limiting condition for operation was entered and the remaining diesel generators were tested as required by tech-i nical specification. A start attempt was made on the A diesel at 0902 which re-sulted in a trip. The diesel was declared inoperable; technical specification

action statement requires three diesels to be restored to operable status

within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or be in hot shutdown within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. At 0935, the C diesel was successfully started. A start attempt was made at 1018 on the D diesel; the diesel failed to start, was declared inoperable, and the technical specification action statement remained the same. The maintenance activity on the B diesel was postponed and the B diesel was successfully started at 1058.

The A diesel was successfully started at 1122 and the D diesel was successfully started at 1142. All four diesels were declared operable at 1200.

i The starting problems were determined to be cold temperature related. Corrective I actions have been initiated to prevent the diesel buildings and related diesel l equipment (governor) from future cold temperature complications. Interim cor-j rective measures included use of temporary space heaters and repair of diesel generator outside air supply dampers.

l 2.8 Generic Problems Involving Design Deficiency 2.8.1 Design Deficiency in Core Spray Pump Logic Oyster Creek; Docket 50-219; LER 85-03; General Electric BWR On January 29, 1985, a design deficiency was discovered in the core spray system booster pump failure logic. Discharge pressure of the booster pumps is utilized to detect a booster pump failure which will trip the failed pump and provide a start signal to the backup booster pump. Two events were identified which can

! cause this instrumentation to misinterpret Core Spray System status and result in the system not perfonning according to its original design intent. The cause

of this occurrence is a deficiency in the original plant design. i I Corrective action consisted of performing a modification to replace the pressure switches on the booster pump discharge with differential pressure switches. The differential pressure switches will sense differential pressure across the booster i pump. This modification will allow the pump failure logic to perform as origi-nally designed under all postulated conditions. g 2.8.2 Negative Flux Rate Trip Setpoint Found to be Outside Design Analysis McGuire 1; Docket 50-369; LER 85-05; Westinghouse PWR

! On February 1,1985, the Westinghouse response to a licensee inquiry concerning the negative flux rate trip setpoint led to the conclusion and subsequent report ,

to the NRC, that McGuire was in a condition outside the design. analyses assump-tions. A Westinghouse analysis demonstrated that conservatisms in the dropped 0

33  ;

1

rod analysis for assumptions other than the flux rate setpoint are adequate to ensure safe operation with the bistable setpoint equal to 5% rated thermal power (RTP) and the rate function time constant equal to 2.0 seconds. In order to satisfy the licensing basis analysis and the most conservative interpretation i

of the technical specifications, the bistable setpoint was reduced to 2.5% RTP.

i 2.8.3 Unanalyzed Safety Condition Involving Auxiliary Feedwater System Palo Verde 1; Docket 50-528; LER 85-08; Combustion Engineering PWR The assumption in the CESSAR-F Safety Analyses for Palo Verde regarding the

, delivery of auxiliary feedwater flow states that the maximum flow delivery to the steam generators following automatic actuation is 1750 gpm. Recent analysis i and close examination of pump head-flow curves indicate that auxiliary feedwater

flow rates may exceed 1750 gpm for some accidents. It was then assumed that operator action would prevent this from occurring.

However, after meeting with the Architect-Engineer (Bechtel) and Combustion Engi-neering on February 4, 1985, it was determined that operator action could not ,

be guaranteed to prevent the occurrence since it occurs very soon after actuation of the automatic feedwater signal. At this time it was realized that

! the plant, as built, may not meet the criteria established in the safety analysis assumptions.

j Preliminary results from subsequent analyses show that even though the feedwater flow rate may be exceeded, there is no decrease in the safety margin of the analysis.

2.8.4 Failure of AFW Pump Circuitry to Meet Single Failure Criteria Salem 1 and 2; Dockets 50-272 and -311; LER 85-01; Westinghouse PWRs On February 5,1985, as a result of an ongoing review of implemented design changes, it was discovered that the low suction pressure trip circuits for the auxiliary feedwater (AFW) pumps in both Unit 1 and Unit 2 do not meet the single failure criteria as specified by 10 CFR 50, Appendix A. The low suction

pressure trip circuits, which are " armed" only when severe storm conditions are i forecast for the area, were disabled to preclude the possibility of a single i failure affecting the operability of all AFW pumps. A safety evaluation, which

was performed and discussed with the NRC prior to the installation of the

! circuits, concluded that there are adequate alarms and indications available to 1 the operator to indicate the impending loss of suction due to decreasing level in the AFW storage tanks. These circuits were only added to further enhance the overall design of the AFW system, and the disabling of this trip feature I poses no safety concern with continued plant operation.

l This design error occurred as the result of an improper interface between control-grade and safety-related equipment. The circuits will be redesigned, and the AFW pump low suction pressure trip features will be reinstated. The  !

scope of the design change review is being expanded to include the design l i change review process, and to confirm the isolated nature of this type of l l design error. [

34

2.8.5 Safety Analysis Error Involving Axial Shape Index Millstone 2; Docket 50-336; LER 85-01; Combustion Engineering PWR 4

An inconsistency was found between the technical specification requirement on axial shape index (ASI) and the safety analysis assumptions on ASI that are input to the Millstone 2 small break loss of coolant (LOCA) analysis. The Unit 2 small break LOCA analysis was performed by Combustion Engineering. The event was declared immediately reportable by site procedures.

This ASI inconsistency could have allowed plant operation in an unanalyzed region should a small break LOCA occur. Administrative controls were immediately implemented to preclude any unanalyzed operation until further corrective actions could be implemented.

Reanalysis has shown that when the correct ASI inputs are used in the small break LOCA model, peak clad temperatures (PCT) increase from 1971 degrees F to 2035 degrees F, still within the 2200 degrees F 10 CFR 50.46 LOCA limits on PCT.

2.8.6 Design Deficiency Involving Main Steam Isolation Valves Robinson 2; Docket 50-261; LER 85-02; Westinghouse PWR The plant was preparing to start up following an extended steam generator replacement outage. On January 5, 1985, a design deficiency with the main steam isolation valves (MSIVs) was identified. A single failure of a relay in the MSIV safeguards logic could result in the failure of MSIVs to close during a safeguards MSIV closing signal.

The MSIVs have been modified to correct this situation. The cause was the apparent lack of understanding of valve operation during the original design.

The problem was identified during discussions with another utility which had reported a problem with their MSIVs to the NRC.

2.8.7 Automatic Start of Diesel Generators During Generator Troubleshooting Catawba 1; Docket 50-413; LER 85-07; Westinghouse PWR On January 22, 1985, diesel generators 1A and IB started on a blackout signal (undervoltage on the 4160 V essential switchgear). The unit was in power opera-tion at 14% thermal power, with the main generator off-line. During the trouble-shooting of generator power circuit breaker 18, a Zone B lockout initiated inad-vertently, causing B train incoming feeders on all 6900 V switchgear to trip, <

and all four tie breakers to close. Present design allows an instantaneous undervoltage condition to be detected on the essential buses before the tie breaker closes to restore normal voltage. Therefore, this incident is classi- (

fied as a design deficiency. Automatic closure of the tie breakers imediately restored normal voltage to the essential buses, and load shedding did not occur.

(

35

2.8.8 Adjustment to ESFAS High Pressure Injection Actuation Setpoint Oconee 1, 2, and 3; Dockets 50-269, -270, and -287; LER 85-03; Babcock & Wilcox PWRs On February 22, 1985, it was determined that the Oconee units' emergency safeguard features actuation system (ESFAS) setpoint for the initiation of high pressure injection (HPI) should be adjusted from 1550 psig to 1600 psig. The change to 1600 psig was based on Babcock & Wilcox's reanalysis of small break loss of coolant accident transients, which indicated that the reactor coolant system (RCS) might not depressurize to the extent previously calculated. The motivation for the revised analysis arises from lessons learned as a result of the accident at Three Mile Island, and other investigations performed in response to NRC's NUREG-0737.

Changes in the setpoint for all the low RCS pressure bistables at all three Oconee units were incorporated on February 22, 1985, and all affected documen-tation was revised accordingly.

2.9 Events Involving Equipment Qualifications 2.9.1 Incomplete Seismic Qualifications of Auxiliary Feedwater Control Valve Control Elements Trojan; Docket 50-344; LER 85-01; Westinghouse PWR During a review of the seismic qualification for the auxiliary feedwater control valves in November 1984, it was discovered that the valve control units may not

, be fully seismically qualified. Documentation does not exist to show that the valve position control elements were functionally tested after excitation during seismic qualification testing. Although the controller design is such that the most likely probability of a seismic induced failure would be for the valve to fail approximately 50% open, it must be conservatively postulated that all eight valves could fail closed. The lack of complete seismic qualification was then determined to be reportable on January 31, 1985 under 10 CFR 50.73(a)(2)(v),

since it is a condition which could have affected the capability of a safety system from removing residual heat or mitigating the consequences of an accident.

No seismic events of significant magnitude (great enough to activate the seismic event recorder) have occurred at Trojan. Even if a seismic event did occur, and every one of the eight feedwater flow control valves failed closed, the valves can be manually repositioned as required. In addition, plant procedures are in place to recover from a total loss of secondary heat sink. Corrective (

action will be to replace the non-seismically qualified components with seis-mically qualified equivalents.

(

2.9.2 High Energy Line Break Analysis Washington Nuclear 2; Docket 50-397; LER 85-01; General Electric BWR

(

36

Similar to the condition noted in IE Information Notice 84-90, non-conservative assumptions were found in the reactor core isolation cooling and reactor water cleanup high energy line break calculations which determined the reactor build-ing environmental profiles used in determining equipment qualification per 10 CFR 50.49. Further analysis has determined that correction of these no'1-conservative assumptions did result in predicted environmental conditions more severe than those used in the equipment qualification. However, a review of the equipment involved has determined that required equipment could be qualified or justified for interim operation to the more severe conditions, and that mit-igation of the event and safe shutdown would not be compromised.

2.9.3 Discovery of Equipment Not Meeting Environmental Qualification Requirements Cook 2; Docket 50-316; LER 85-04; Westinghouse PWR On January 25, 1985 with Unit 2 at 97% power, the plant was advised that con-tinued environmental qualification research by the service corporation resulted in the determination that the connection on the resistance temperature detector (RTD) monitoring reactor coolant system (RCS) loop 2 cold leg temperature was not environmentally qualified.

The RTD in question, manufactureu by the RDF Corporation, was installed on November 20, 1984, as a replacement for the then-installed RTD which was of Rosemount manufacture. Research indicates that this is the only active instal-lation of an RDF manufactured RTD being utilized for RCS temperature monitoring in Unit 2.

On January 26, 1985, a Unit 2 trip occurred due to an unrelated component failure.

Before the unit was restarted, the unqualified RTD was removed from service and replaced with an environmentally qualified spare (manufactured by Rosemount).

Design change RFC-DC-12-2839, which provides instruction necessary to upgrade installed RDF manufactured RTD's to meet environmental qualifications, has been approved. This design change will be implemented on the Unit 2 installed RDF RTD at the next opportunity.

2.9.4 Discovery of Non-Environmentally Qualified Terminal Blocks Callaway 1; Docket 50-483; LER 85-07; Westinghouse PWR While reviewing compliance with NRCs Generic Letter 84-24, " Environmental Qualification of Electrical Equipment Important to Safety for Nuclear Power c Plants," and NRC Information Notice 83-72, " Environmental Qualification Test-ing Experience," it was discovered between the dates of February 1 and 7, 1985 that six valves at Callaway did not have environmentally qualified terminal (

blocks installed in Limitorque actuators. Three of these valves are contain-ment isolation valves identified in technical specifications, and are required to be operable in power operations, startup, hot standby, and hot shutdown.

The plant first entered hot shutdown on August 10, 1984

(

37

Upon determining that the terminal blocks were not qualified, the valves were declared inoperable and the appropriate actions required by technical specifi-cations were taken. The terminal blocks for the six valves were replaced with environmentally qualified Marathon 300 type terminal blocks. In addition, an evaluation and/or reinspection of the remainder of the Limitorque valves in the equipment qualification program is in progress.

2.10 Problems Caused by Lack of Proper Operator Attentiveness 2.10.1 SGTS Train Inoperable During Containment Purge Susquehanna 2; Docket 50-388; LER 85-07; General Electric BWR During a purge of the Unit 2 conta'nment on January 30, 1985, one train of the standby gas treatment system (SGTS) became inoperable. Unit 2 technical speci-fications require both trains of SGTS to te operable prior to commencing a purge, and while the purge system is in use.

The purge was initiated using SGTS Train A by one shif t at approximately 0640.

Sometime during the next shift, the SGTS B heater failure alarm annunciated in the control room and caused the B Train of SGTS to be inoperable. The shift d'd not recognize that purging should have been suspended.

The ability of operations personnel to analyze the situation was impacted due to a difference in Unit 1 and Unit 2 technical specifications and the fact that maintenance was in progress on a damper in the B Train.

The event will be reviewed with all licensed operators and alarm response for SGTS will be reviewed and revised as necessary to identify the technical specification requirement regarding purging. In addition, a change to Unit 1 technical specifications was submitted to the NRC in May 1984, and is expected to be issued soon.

2.10.2 Both Trains of Safety Injection Inoperable Due to Personnel Error Catawba 1; Docket 50-413; LER 85-11; Westinghouse PWR On February 7, 1985, from 0920 hours0.0106 days <br />0.256 hours <br />0.00152 weeks <br />3.5006e-4 months <br /> to 1030 hours0.0119 days <br />0.286 hours <br />0.0017 weeks <br />3.91915e-4 months <br />, and from 1255 hours0.0145 days <br />0.349 hours <br />0.00208 weeks <br />4.775275e-4 months <br /> to 1325 hours0.0153 days <br />0.368 hours <br />0.00219 weeks <br />5.041625e-4 months <br />, safety injection (SI) trains A and B were inoperable. This was due to the concurrent inoperability of SI pump 18 and solid state protection system (SSPS) train A. This incident was discovered at approximately 1300 hours0.015 days <br />0.361 hours <br />0.00215 weeks <br />4.9465e-4 months <br /> during review of the technical specification action items logbook (TSAIL). After discovery of this incident, the Shift Supervisor began the necessary corrective action to re- c turn SI pump 18 to service and, at 1325 hours0.0153 days <br />0.368 hours <br />0.00219 weeks <br />5.041625e-4 months <br />, SI pump 1B was declared operable.

This incident is classified as a personnel error. The senior reactor operator c in command should not have allowed both trains of SI to be rendered inoperable.

2.10.3 Computer Failure Misleads Operator Determination of Tref and Tave Zion 1; Docket 50-295; LER 85-05; Westinghouse PWR C

38

t With the unit at 20% power on January 21, 1985, the operators were controlling feedwater flow and reactor coolant temperature manually. The operator was reading Tave and Tref off of a computer driven chart recorder. He was unaware that a process computer failure was causing that chart recorder to give misleading temperature indication. Only after the shift engineer noticed that steam dumps were 20% open did the operator realize that the computer had failed, and that Tave was in fact higher than Tref. By this time, the large swings in coolant temperature had induced swings in the feedwater regulation system. The system was unable to respond quickly enough, and the unit tripped on high steam gen-erator level.

The computer failure was traced to a tripped central processing unit (CPU),

which did not give any control room indication. A change has been made so

, that when a CPU fails it is annunciated in the control room.

Operators use the computer indication for startup because the temperature indications coming directly from the field do not have a narrow enough range to be useful for fine temperature control during startup. The computer failure, feedwater control system sensitivity, and the difficulties usually experienced in generator load pickup during synchronization all contributed to the cause of the trip. The station is investigating possible improvements to the instrumen-tation used during this evolution.

2.10.4 Steam Generator Examination in 1985 Discovers Tubes Incorrectly Plugged in 1984 Kewaunee; Docket 50-305; 1ER 85-06; Westinghouse PWR On February 20, 1985, while shutdown for refueling and during the steam genera-tor tube eddy current examination, a time in the 1A steam generator requiring plugging in 1984 was found plugged it tae hot leg only. An adjacent tube, not requiring plugging, was found plugged a the cold leg only. The tube that re-quired plugging had a 55% through-wall indication in 1984 and a 91% through-wall indication in 1985. The exact cause of this event remains unknown; however, it is suspected that-the cold leg tube sheet was mismarked during the 1984 steam generator tube plugging effort.

To prevent recurrence of this event the tubesheet templates, rather than the l tubesheets, are marked to identify the tubes to be plugged. These templates

! are independently verified prior to tube plugging. The installed plugs are verified against the tube plugging list and a video tape is made of the tube sheets for final verification.

C Twenty-six tubes in the 1A steam generator and 22 tubes in the IB steam generator were removed from service as a result of tube plugging in 1985.

2.10.5 Reactor Trip Resulting from Steam Dump Leakage Surry 1; Docket 50-280; LER 85-04; Westinghouse PWR C

39

$ On January 27, 1985, the unit was critical with reactor power stable at 5%

j during startup following a reactor trip. The steam dump valves were isolated

earlier because of known but not specifically identified or quantified leakage.

i As the dumps were unisolated, the resulting leakage led to a primary system

! temperature decrease which caused reactor power to increase. As power neared

} 10%, it was decided to laten the turbine to prevent a trip. Approximately 2 l minutes after the turbine was latched, the four turbine stop valves closed,

, resulting in a reactor trip.

i One factor contributing to the trip was not sufficiently considering the effect of the steam leakage on plant parameters. Another contributor to the event was that only one electro-hydraulic (EH) pump was available and running when the turbine was latched, and it did not satisfy the EH demands during the latching I

operation.

I

{ The steam dump leakage was identified and isolated. The Human Perfomance Eval-uation System Coordinator is investigating this event and will provide feedback to the Operating Staff to improve human performance in similar circumstances.

l I

I J

i J

l C

t  ?

C i

e

(

l 40

i . .

i .. i i

i .!

! 3.0 ABSTRACTS / LISTINGS OF OTHER NRC OPERATING EXPERIENCE DOCUMENTS l 3.1 Abnormal Occurrence Reports (NUREG-0090) Issued in January-February 1985 '

l i An abnormal occurrence is defined in Section 208 of the Energy Reorganization ,

Act of 1974 as an unscheduled incident or event which the NRC determines is l j significant from the standpoint of public health or safety. Under the provi- f 1 sions of Section 208, the Office for Analysis and Evaluation of Operational j i

Data reports abnormal occurrences to the public by publishing notices in the r i Federal Register, and issues quarterly reports of these occurrences to Congress l l in the NUREG-0010 series of documents. Also included in the quarterly reports j are updates of some previously reported abnormal occurrences, and summaries of (

i certain events that may be perceived by the public as significant but do not l l meet the Section 208 abnormal occurrence criteria.

i j No abnormal occurrence reports were issued during January-February 1985.

( L 1

d l

'l I J .  ;

1 1

I l

i 1

l 1

1

(

l 4

41 4

3.2 Bulletins and Information Notices Issued in January-February 1985 The Office of Inspection and Enforcement periodically issues bulletins and information notices to licensees and holders of construction permits. During the period, 16 information notices were issued.

Bulletins are used primarily to comunicate with industry on matters of generic importance or serious safety significance (i.e., if an event at one reactor raises the possibility of a serious generic problem, an NRC bulletin may be issued requesting licensees to take specific actions, and requiring them to submit a written report describing actions taken and other information NRC should have to assess the need for further actions). A prompt response by affected licensees is required and failure to respond appropriately may result in an enforcement action. When appropriate, prior to issuing a bulletin, the NRC may seek coments on the matter from the industry (Atomic Industrial Forum.

InstituteofNuclearPowerOperations,nuclearsteamsuppliers, vendors,etc.),

a technique which has proved effective in bringing faster and better responses from licensees. Bulletins generally require one-time action and reporting.

They are not intended as substitutes for revised license conditions or new requirements.

Information Notices are rapid transmittals of information which may not have been completely analyzed by NRC, but which licensees should know. They require no acknowledgement or response, but recipients are advised to consider the applicability of the information to their facility.

Information Date Notice Issued Title 85-01 1/10/85 CONTINUOUS SUPERVISION OF IRRADIATORS (Issued to all material licensees possessing irra-diators that are not self-shielded and contain more than 10,000 curies of radioactive material 85-02 1/15/85 IMPROPER INSTALLATION AND TESTING OF O!FFERENTIAL PRESSURE TRANSMITTERS (Issued to all power reactor facilities holding an operating license or construction permit 85-03 1/15/85 SEPARATION OF PRIMARY REACTOR COOLANT PUMP SHAFT AND IMPELLER (Issued to all pressurized water power reactor facil-ities holding an operating license or construction c permit) 85-04 1/17/85 INADEQUATE MANAGEMENT OF SECURITY RESPONSE DRILLS C (Issued to all power reactor facilities holding an operating license or construction permit, and fuel ,'

fabrication and processing facilities) .

b 85-05 1/23/85 PIPE WHIP RESTRAINTS .

(Issuedtoallpowerreactorfacilitiesholdingan operating license or construction permit) 42

~ _- _ ___ _ _ _ _ _ ___ _ __ _ _ _ ___ _ __ ._ _ _ . _ . _. _ _ _ _

i . . ,

l

• 1 i

! Information Date i Notice Issued Title I

85-06 1/23/85 CONTAMINATION OF BREATHING AIR SYSTEMS

! (Issued to all power reactor facilities holding an j operating license or construction permit)

, 85-07 1/29/85 CONTAMINATED RADIOGRAPHY SOURCE SHIPMENTS i (Issued to all NRC licensees authorized to possess j industrial radiography sources) i 85-08 1/30/85 INDUSTRY EXPERIENCE ON CERTAIN MATERIALS USED IN SAFETY-RELATED EQUIPMENT

] (Issued to all power reactor facilities holding an

operating license or construction permit) i 85-09 1/31/85 ISOLATION TRANSFER SWITCHES AND POST-FIRE SHUTDOWN l CAPABILITY

] (Issued to all power reactor facilities holding an 1 operating license or construction pemit)  ;

85-10 2/6/85 POST-TENSIONED CONTAINMENT TENDON ANCHOR HEAD FAILURE

! (Issued to all power reactor facilities holding an j operating license or construction permit) L

' l 85-11 2/11/85 LICENSEE PROGRAMS FOR INSPECTION OF ELECTRICAL RACEWAY AND CABLE INSTALLATION (Issued to all power reactor facilities holding a I i

construction permit) '

85-12 2/11/85 RECENT FUEL HANDLING EVENTS

(Issued to all power reactor facilities holding an i j operating license or construction pemit) l 85-13 2/21/85 CONSEQUENCES OF USING SOLUBLE DAMS I t

(Issued to all boiling water and pressurized water >

j reactor facilities holding an operating license or  !

)

constructionpermit)

! 85-14 2/22/85 FAILUREOFAHEAVYCONTROLR00(84C)DRIVEASSEMBLY TO INSERT ON A TRIP SIGNAL i (Issued to all power reactor facilities holding an operating license or construction permit) .

85-15 2/22/85 NONCONFORMING STRUCTURAL STEEL FOR SAFETY-PELATED USE i (Issued to all power reactor facilities holding an .

! operating license or construction permit)  ;

j 85-16 2/27/85 TIME / CURRENT TRIP CURVE DISCREPANCY OF t ITE/SIEMENS-ALLIS MOLDED CASE CIRCUIT BREAKER ,

I (Issued to all power reactor facilities holding an ,;

! operating license or construction permit) , '

1

! 43

3.3 Case Studies and Engineering Evaluations Issued in January-February 1985 The Office for Analysis and Evaluation of Operational Data (AE00) has as a primary responsibility the task of reviewing the operational experience reported by NRC nuclear power plant licensees. As part of fulfilling this task, it selects events of apparent interest to safety for further review as either an engineering evaluation or a case study. An engineering evaluation is usually an imediate, general consideration to assess whether or not a more detailed protracted case study is needed. The results are generally short reports, and the effort involved usually is a few staffweeks of investigative time.

Case studies are in-depth investigations of apparently significant events or situations. They involve several staffmonths of engineering effort, and result in a formal report identifying the specific safety problems (actual or potential) illustrated by the event and recommending actions to improve safety and prevent recurrence of the event. Before issuance, this report is sent for peer review and coment to at least the applicable utility and appropriate NRC offices.

These AE00 reports are made available for information purposes and do not impose any requirements on licensees. The findings and recomendations contained in these reports are previded in support of other ongoing NRC activities concerning the operational events (s) discussed, and do not represent the position or require-ments of the responsible NRC program office.

Engineering Date Evaluation Issued Subject E501 1/17/85 MOTOR-0PERATED VALVE FAILURES DUE TO HAMMERING PROBLEM In the AEOD screening of licensee event reports, LER 50-237/84-003 and LER 50-254/84-014 were identified

, as significant events that required additional follow-up action based on the generic implications of the failure mode experienced by motor operated valves at Dresden 2 and Quad-Cities 1. These LERs described events involving mechanical failure of motor-operated valves (MOVs) due partially to what is termed as " ham-mering effect." Hammering effect is that phenomenon experienced by MOVs when the valve is subjected to repeated closing attempts after the valve has already (

reached the fully closed position. Investigations by the licensees have found that the repeated closing attempts experienced by the MOVs were the result of (

the design of the control circuit of the valve. Based on these events a detailed review of the design of a ,

typical MOV control circuit was conducted by AE00. i The review concluded that the problem could be gene-ric to MOVs that are designed to close on mechanical torque and have a control circuit design similar to the one used at Dresden and Quad Cities. The review h l I

44

O l Engineering Date Evaluation Issued Subject also concluded that this problem would likely be appli-

! cable to M0Vs at many operating reactor units. The l

consequence of such failures of MOVS in safety-related

' systems is that the safety function of the system in which they are located can be impaired.

To verify this conclusion, a search of the Sequence Coding and Search System (SCSS) for the period 1983-1984 was conducted for events involving failures of l MOVs specifically attributed to the hamering problem.

Surprisingly, none was found. A further analysis of the hamering problem was performed to identify the symptoms of failures of MOVs due to hamering. Failure and damage due to mechanical overloading, overheating of valve operator motor, repeated cycling and failures of starter contactors, thermal overloading, circuit breaker trips, valve seat jaming, etc., could be in part caused by the hamering problem. On a review of i the 179 LERs obtained from the SCSS, 47 LERs were found which had one or more of these kinds of failures.

Based on the review and evaluation of operational ex-( perience and the design of the control systems of MOVS, it was concluded that licensees in their investigation of MOV failures have not consistently identified the root cause of failure, but only the symptomatic ones.

This has already been the subject of an IE Information Notice (IE IN 82-10); however, IE IN 82-10 did not specifically identify the hamering problem nor its correlation to valve control design. It should be noted that "hamering" can only be detected by obser-vation at the valve or at the starter cubicle; thus,

- it is not surprising that failures due to " hammering" are not generally identified as such. The licensees at Dresden and Quad-Cities have initiated certain design changes to affected valves' control circuitry to eliminate the hamering problem. This engineering evaluation included information regarding similar modifications.

E502 1/25/b5 FAILURE OF RHR SUPPPRESSION POOL COOLING VALVE T0 c OPERATE With Brunswick Unit 2 at full power on March 25, 1983, c it was discovered that 2-E11-F0248, residual heat removal (RHR) Division !! suppression pool cooling -

valve, could not be opened by using either the valve motor-operator or manual operation. This rendered i the RHR Division II suppression pool cooling subsystem t inoperable. The setscrew on the antirotation device g for the valve had loosened, and allowed this device to shift position resulting in the shearing of the 45 j

l - - - - - - - - _ - _ -_- _ - ----_----_----------_-- - - - - - - - - - - - -

Engineering Date Evaluation Issued Subject valve stem key when the motor-operator was operated.

The valve was a 15-inch Anchor Darling globe valve.

The loosening of anti-rotation device setscrews on Anchor Darling globe valves has recently occurred at WNP-2, Shoreham, Zimmer, Limerick and Duane Arnold.

Most of those affected valves were installed in safety systems such as RHR, reactor isolation cooling, and high and low pressure core spray. The cause of the loosening could be attributed to inadequate design consideration of normal system vibration.

The generic implication of the problem and the corrective actions for Anchor Darling valves have been addressed by an IE Information Notice, a 10 CFR 21 Notification and an Industry Report. However, similar problems have occurred at four plants with valves supplied by Blaw-Knox, Rockwell-Edward, WKM, and Copes-Vulcan such that the problem may be generic to industry rather than Just to one particular supplier.

+

4 O

I 4

l 46 ..

3.4 Generic Letters Issued in January-February 1985 Generic letters are issued by the Office of Nuclear Reactor Regulation,

Division of Licensing. They are similar to IE Bulletins (see Section 3.2) in -

l that they transmit information to, and obtain information from, reactor licen-sees, applicants, and/or equipment suppliers regarding matters of safety, safe-guards, or environmental significance. During January and February 1985, four letters were issued.

Generic letters usually either (1) provide information thought to be important in assuring continued safe operation of facilities, or (2) request information 4 on a specific schedule that would enable regulatory decisions to be made regarding the continued safe operation of facilities. They have been a significant means i

of communicating with licensees on a number of important issues, the resolutions of which have contributed to improved quality of design and operation.

Generic Date Letter Issued Title j 85-01 1/9/85 FIRE PROTECTION POLICY STEERING COMMITTEE REPORT i (Issued to all power reactor licensees and all appli-J cants for power reactor licenses) 85-03* 1/28/85 CLARIFICATION OF EQUIVALENT CONTROL CAPACITY FOR STANDBY LIQUID CONTROL SYSTEMS (Issued to all boiling water reactor licensees and applicants for boiling water reactor licenses) s 85-04 1/29/85 OPERATOR LICENSING EXAMINATIONS (Issued to all power reactor licensees and applicants for an operating license) 85-05 1/31/85 INADVERTENT BORON DILUTION EVENTS

! (Issued to all pressurized water reactor licensees)

C D

l

• Generic Letter 85-02 had not yet been issued during the report period .

1 47 lI

4 3.5 Operating Reactor Event Memoranda Issued in January-February 1985 The Director, Division of Licensing, Office of Nuclear Reactor Regulation (NRR), disseminates information to the directors of the other divisions and program offices within NRR via tl.c4 perating 3 reactor event memorandum (OREM) system. The OREM documents a statement of the problem, background information, the safety significance, and short and long term actions (taken and planned).

Copies of OREMs are also sent to the Office for Analysis and Evaluation of Operational Data, and of Inspection and Enforcement for their information.

No OREMs were issued during January-February 1985.

1 4

i 4

9 4

q d

i 48 i

.s 6

3.6 NRC Document Compilations The Office of Administration issues two publications that list documents made publicly available.

. The quarterly Regulatory and Technical Reports (NUREG-0304) compiles biblio-graphic data and abstracts for the formal regulatory and technical reports issued by the NRC Staff and its contractors.

. The monthly Title List of Documents Made Publicly Available (NUREG-0540) contains descriptions of information received and generated by the NRC.

This information includes (1) docketed material associated with civilian nuclear power plants and other uses of radioactive materials, and (2) non-docketed material received and generated by NRC pertinent to its role as a regulatory agency. This series of documents is indexed by Personal Author, Corporate Source, and Report Number.

The monthly Licensee Event Report (LER) Compilation (NUREG/CR-2000) might also be useful for those interested in operational experience. This document con-tains Licensee Event Report (LER) operational information that was processed into the LER data file of the Nuclear Safety Infonnation Center at Oak Ridge during the monthly period identified on the cover of the document. The LER summaries in this report are arranged alphabetically by facility name and then chronologically by event date for each facility. Component, system, keyword, and component vendor indexes follow the summaries.

Copies and subscriptions of these three documents are available from the Super-intendent of Documents, U.S. Gover ment Printing Office, P.O. Box 37082, Washington, DC 20013-798?.

C C

49

- _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _