ML20134Q172
ML20134Q172 | |
Person / Time | |
---|---|
Site: | Sequoyah ![]() |
Issue date: | 11/25/1996 |
From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
To: | |
Shared Package | |
ML20134Q121 | List: |
References | |
50-327-96-13, 50-328-96-13, NUDOCS 9612020167 | |
Download: ML20134Q172 (30) | |
See also: IR 05000327/1996013
Text
.. .
- -.-
.
.-.
- -
. - . . .
.
..
'
.
4
.
. .
I
l
'
U.S. NUCLEAR REGULATORY COMISSION
REGION II
Docket Nos:
50-327, 50 328
License Nos:
Report Nos:
50 327/96 13, 50-328/96 13
Licensee:
Tennessee Valley Authority-(TVA)
Facility:
Sequoyah Nuclear Plant, Unit 1 & 2
Location:
Sequoyah Access Road
Hamilton County TN 37379
Dates:
September 19 through November 2, 1996
Inspectors:
M. Shannon, Senior Resident Inspector
D. Starkey, Resident Inspector
P. Kellogg, Reactor Inspector, RII
Approved by:
M. Lesser. Chief
Projects Branch 6
'
Division of Reactor Projects
!
,
j
Enclosure 1
9612O20167 961125
ADOCK 05000327
G
..
-.
-
- . ~ . . .
- _ - _ _ -
.
-
- .
-
_ .
.
.
.
.
$.
j
-
1
i
EXECUTIVE SUMMARY
-
Sequoyah Nuclear Plant, Units 1 & 2
i
'
NRC Inspection Report 50 327, 328/96 13
-
.
f
,
This special inspection was conducted to review the events associated with the
i
reactor shutdown and subsequent manual tripping of Unit 2 on October.11,1996.
Equipment failures and/or complications included excessive reactor coolant
pump seal leakage which caused the need for an immediate reactor shutdown; a
-
turbine runback due to failed turbine impulse pressure switches, which caused
,
i
the need for a manual reactor trip; a failed main feedwater isolation valve to
I
close: inadequate auxiliary feedwater control; and a water hammer in the steam
dump system which caused damage to piping and hangers.
'
In addition, this special inspection was conducted to review issues associated
-
with inadequate maintenance on a reactor trip breaker (RTB) and the subsequent
replacement of the Unit 2 RTB "B" with the spare breaker. The P 4 function
was found to have been inoperable greater than allowed by Technical
i
'
Specifications.
i
The following apparent violations and findings are associated with the
October 11 reactor trip event:
j
e
An apparent violation was identified for the failure to identify the
I
.
cause of the main feedwater isolation valve (MFIV) motor brake failures
1
and to take adequate corrective actions for the water intrusion into the
)
brake assembly. A weakness was identified in the licensee's repeat
i
failure tracking / trending programs associated with Work Requests (WR)
and Problem Evaluation Reports (PER) to identify repeat MFIV equipment
failures.
An apparent violation was identified for the failure to take adequate
.
e
corrective actions to prevent further flexible conduit damage on the
MFIVs.
,
e
An apparent violation was identified for % lure to implement corrective
i
actions related to previously identifies A ficiencies related to ASCO
solenoid valves.
An apparent violation was identified for the failure to implement
adequate corrective actions associated with the fire system actuation in
June 1996.
A positive observation was made in that the shift manager provided good
<
e
oversight for the unit 2 downpower and appropriately ordered the
tripping of the unit when the unanticipated turbine runback occurred.
0)erator performance was good in controlling the event and responding to
t1e abnormal plant conditions during the event.
,
.
l
e
A positive observation was identified in that the operators
appropriately isolated the auxiliary feedwater (AFW) system to prevent
4
'
j
- . . .
.-- .
- - - -
.
-
- - - -..
. - .
---
_.
.'
.
,
-
..
2
<
an uncontrolled cooldown of the reactor coolant system (RCS).
This
required timely management approval due to lacking procedural guidance
in the emergency operating procedures.
i
A weakness was identified following a water hammer event that severely
e
damaged the piping su) ports and cracked the steam dump to main steam
line weld in the disc 1arge line for SD 111.
There have been previous
piping support damage events associated with the steam dump system and
i
the licensee had not identified the root cause.
e
A weakness was identified in that the licensee failed to identify the
'l
malfunctioning steam dump drain tank level switch, causing the steam
dump lines to not drain properly. The operator rounds sheet lacked
'
adequate guidance regarding the steam dump drain tank level controls.
A weakness was identified in that the assistant unit operators failed to
e-
1
identify the damaged piping supports following the reactor trip (8.5
i
hours), although required to monitor the steam dump valves once per
'
shift, in addition to normal roving tours of the building.
e
A negative observation was made concerning the water intrusion into a
single zone actuation fire detector, which resulted in the July 1996,
deluge actuation.
A weakness in the licensee's training program was identified in that the
e
operators lacked knowledge in the functioning of the turbine impulse
pressure switch circuitry,
e
A negative observation was identified concerning the failure of two non-
safety related and non independent switches, which resulted in the
inability of operators to reset an AFW actuation signal.
A weakness was identified for the maintenance practice of using RTV
e
sealant, which could result in acetic acid intrusion into the brake
assembly, which in turn could cause damage to the MFIV brake assembly.
A negative observation was made in that the motor to brake assembly
gasket was missing.
A negative observation was noted regarding a poor maintenance practice
e
which permitted a dust cover to be left in the exhaust port of a
solenoid valve followirg maintenance activities.
o
A negative observation was made due to the improper setting of the air
supply regulator for the reactor coolant pump (RCP) seal leakoff
isolation valve.
e
A negative observation was made concerning the wrong instruments being
referenced in an abnormal procedure.
.
4
.
..
3
The following apparent violations and findings are associated with the
inoperable P 4 function due to reactor trip breaker maintenance.
e'
An a> parent violation was identified when an inoperable reactor trip
brea(er was in service for greater than the time allowed in the
Technical Specification (TS) Limiting Condition for Operation (LCO).
An apparent violation was identified when reactor trip breaker
e
maintenance )rocedure sections were performed out of secuence. A second
example of t1is apparent violation was identified regarcing the
maintenance procedure which did not provide cautions or adequate
instructions regarding the reassembly of the reactor trip breaker
auxiliary contact linkage assembly following lubrication.
An ap)arent violation was identified for failure to perform an
e
opera)ility/reportability determination as required by SSP-3.4. The
lack of action by the event critique team and technical su) port
personnel to report the inoperability of the reactor trip areaker led to
this problems.
e
A weakness was identified in the thoroughness of the root cause
determination process regarding the reactor trip breaker event critique.
e
A positive observation was identified when o)erations stressed the need
to remove a potentially faulty reactor trip areaker (RTB) from service
and in not allowing troubleshooting of the breaker while still in
,
service.
2
e
A negative observation was noted when maintenance failed to ensure that
Quality Control (QC) personnel would be available as necessary during a
l
reactor trip breaker refurbishment.
e
A negative observation was identified when engineering " dummied" a
signal to a computer alarm circuit prior to determining the cause for
the signal.
l
!
,
.
~
.
.
..
,
t
Report Details
j
I. Beactor Trio of October 11. 1996
A.
Ooerational Asoects
1.
Insoection Scoce (71707)
On October 11, 1996 at 8:27 a.m., due to a turbine runback, Unit 2 was
manually tripped.
Several problems were encountered prior to and during
recovery efforts. The inspector observed the unit shutdown, reactor
i
trip, unit cooldown, and placing of RCS on shutdown cooling.
'
2.
Observations and Findinas
On October 11, 1996, at 3:12 a.m., Unit 2 experienced a higher than
norm 61 seal leakoff on the #4 RCP seal #2 of approximately 1.5 gpm. The
seal leakoff for the #1 seal drop)ed to .6 gpm (normally 3.0 gpm).
Plant shutdown is required, per a) normal operating procedure, within 8
hours when #2 seal leakoff exceeds .5 gpm. A controlled plant shutdown
was initiated at 5:22 a.m.
At 8:24 a.m., the ICS computers both failed:
however, this appeared to only affect computer data points and recorder
inputs.
Power was reduced to approximately 50% and one operating
feedpump was stopped. At this point, a main turbine runback
automatically initiated at 200% per minute, all unisolated main steam
dum)s went open as designed, and rod control began inserting rods at a
hig1 rate. The Shift Manager directed that the reactor be manually
tripped.
Following the trip, operators had some difficulty controlling cooldown.
The RCS reached the low Tave setpoint (550 degrees F) and the feedwater
isolation signal was actuated. The #3 feedwater regulating valve
indicated in the mid position (limit switch problem only) and the #4
feedwater isolation valve failed "open" and its MCR indication was lost.
During the unit trip recovery procedure steps, the operators attempted
to take manual control of the AFW pump flow control valves, but were
unable to reset the AFW actuation signal. A decision, by the Operations
Manager, Operations Superintendent, Shift Manager and Unit Supervisor,
was made to place the motor driven AFW pumps in pull-to lock and to
close the isolation valves on the turbine driven AFW pump. Tave dropped
to approximately 538 degrees F and the low-low Tave setpoint (540
- -
- - - .
.
.
,
l
2
I
f
degreesF)wasreachedwhichlockedoutthe3+eamdumps.
In addition,
the operators were required by procedure to' hitiate emergency boration
due to being below 540 degrees F.
Steamgentatorlevelswere
maintained as required and approximately 450V gallons of borated water
was injected into the RCS during the eveat. L
'
A controlled cooldown of the RCS commenced at'epproximately 4:15 p.m. on
October 11.
Initially, operators had trouble controlling the cooldown
rate due to s)oradic operation of steam dump valve SD 111. Steam dump
valve 50-111 lad to be isolated and cooldown of the RCS was successfully
continued.
Mode 4 was entered at 8:58 p.m., and RHR was placed in the
shutdown cooling mode at approximately 12:16 a.m., on October 12.
The inspectors observed operator actions during the controlled shutdown,
the trip, the cooldown and while placing RHR in service. The operators
performed well with appropriate supervisory oversight by shift
management and site management. Routine status briefings were held,
which the inspectors considered to be beneficial to the control room
staff and for the control of the event and the event related activities.
The various equipment problems resulted in challenges to the operators.
These individual equipment problems are discussed in the following
sections of this report.
3.
Conclusions
0)erator performance was good in controlling the event and responding to
tie abnormal plant conditions. The Shift Manager provided good
oversight for the Unit 2 downpower and appropriately ordered the
tri) ping of the unit (within 10 seconds) when the unantici)ated turbine
runaack occurred.
These are considered to be a positive o)servations.
There were several equipment failures that complicated operator recovery
actions which indicate continued plant equipment reliability problems,
,
for both safety related and non-safety related equipment.
B.
Steam Dumo Water Hammer Damaae
1.
Insoection Scooe (71707. 62707. and 37551)
When operators attempted to start the RCS cooldown, operation of the
steam dump valve was erratic and resulted in a higher than desired
cooldown rate or no cooldown rate at all. The affected steam dump valve
was isolated and cooldown proceeded with no further problems. The
inspector reviewed the operation of the steam dump valves during the
event and walked down the steam dump system.
2.
Observations and Findinas
During the turbine runback, the inspector observed that all of the steam
dump valves opened (indicator lights in MCR). There were no indications
in the control room or reports from the turbine building to indicate
. .
.
..
._ . .
__
_
,
.
!
.
'.
.
3
that the steam dumps were not operating properly.
Later in the day,
when the operators went to the " pressure mode" of steam dump operation,
steam dump 50 111 exhibited erratic operation and after a couple of
attempts, the operators stopped using the affected steam dump. Cooldown
of the RCS was then continued by using two other steam dumps in the
" pressure mode." Following plant cooldown, 50-111 was found to have a
>
broken feedback arm, which apparently caused the erratic action during
the initial cooldown.
It could not be determined how the feedback arm
became broken.
Reports from the turbine building indicated piping damage and support
damage associated with SD 111. The inspector walked down the steam dump
system and noted significant misalignment of the SD 111 piping and
severe damage to the piping supports.
During the walkdown, the
inspector also noted minor water hammer (noise with no pipe movement)
occurring on three isolated steam dump lines, which indicated that the
lines were partially full of water. Additional inspections by the
licensee noted crack indications on the outside diameter of the main
steam line weld to the steam dump transition pi)ing. The crack
indications were at the 12 o' clock and 6 o'cloc( positions and measured
approximately 17/8 inch long by 1/2 deep and 7/8 inch long by 1/2 inch
deep respectively. The main steam line piping thickness is nominally 1-
,
1/4 inches thick and did not have any reported through wall leakage.
'
During subsequent review, the licensee identified a failed level switch
on the steam dump drain tank.
The failed switch prevented the tank from
draining and due to the common SD drain piping system arrangement,
potentially all of the steam dump exhaust lines to the condenser were
partially full of water prior to the event. There had been leakage
past four of the steam dump valves, SD 103, 50104, 50-105 and SD 109,
since the last outage and two valves had been isolated (SD 103 and SD-
104) due to more significant leakage. These conditions would have
provided a sufficient amount of water to partially fill all of the steam
dump exhaust lines.
Further review noted a history of prior system structural and component
i
problems. The piping supports for 50-107 were damaged during a previous
j
event in 1993. During a recent walkdown of the steam dump system, the
'
inspectors had noted that 50-103 had a broken support strut. A work
i
request had been written.
In addition, following disassembly of SD 103,
the licensee found that the valve had a broken valve stem and the stem
shield plate was cracked and a piece of the shield plate was missing.
The 50 107 support damage, the 50-103 broken strut, and the damage SD-
103 valve internals and stem, appeared to be indicators of system
operational problems and/or previous water hammer events.
The operator rounds sheet directed the operator to inspect various steam
lines and moisture traps associated with the steam dump system but did
not require the assistant unit operators to take routine readings on the
steam dump drain tank level.
Routine readings on this tank could have
identified the failure of the level switch.
.'
".
.
4
The inspector also noted that the damaged SD 111 su) ports were not
identified until 5:00 p.m., on October 11. The run)ack and subsequent
reactor trip took place at 8:30 a.m.
at which time the rapid opening of
the steam dumps took place and the damage to the piping supports was
thought to have occurred. However, the roving assistant unit operators
did not identify the damaged system, although required to verify
operability of the steam dump valves once per shift.
Following the event the licensee repaired the cracked main steam line,
replaced the damaged steam dump piping and supports, repaired the
leaking steam dump valves and repaired the faulted steam dump tank level
switch.
In addition, the licensee performed inspections of the unit 1
and Unit 2 steam dump lines and the Unit 1 steam dump drain tank and its
operation and did not identify any additional problems. The licensee
has also inspected the main condenser internals for damage with no
problems identified.
In addition to the apparent water hammer damage to the steam dump
)iping, during the event, the plant manager observed secondary water
j
lammer indications, with various reliefs lifting and directed that the
<
turbine building be evacuated of non essential personnel.
3.
Conclusions
The licensee failed to identify the malfunctioning steam dump drain tank
level switch, which resulted in the steam dump lines not draining
properly. The operator rounds sheet lacked adequate guidance regarding
the steam dump drain tank level controls and is considered to be a
'
weakness.
Assistant unit operators failed to identify the damaged piping supports
i
following the reactor trip (8.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />), although required to monitor the
steam dump valves once per shift, in addition to normal roving tours of
the building. This is considered to be a weakness.
A water hammer event, in the discharge line for 50 111. severely damaged
the pi)ing supports and cracked the steam dump to main steam line weld.
There lave been previous piping support damage events associated with
the steam dump system. The failure to identify and correct the cause is
considered to be a weakness.
C.
tiain Feedwater Isolation Valve Failure
1.
Insoection Scooe (62707. 40500. and 37551)
Following the reactor trip, the low Tave (550 degrees F) setpoint was
reached and a feedwater isolation signal was generated.
Following the
actuation, the operators noted that the main feedwater isolation valve
(2-MV0P-003-0100-B) for steam generator 4 had lost position indication.
The inspector reviewed the equipment problems related to the failure of
the main feedwater isolation valve to close.
-
.
_
.
_
_
.
.
.
5
,
2.
Observations and Findinas
j
The feedwater isolation signal automatically initiated as expected on a
t
normal reactor trip. The remaining feedwater pump was tripped, the
feedwater regulating valves automatically closed and three of the four
main feedwater isolation valves closed.
The number three main
feedwater regulating valve experienced a limit switch problem and
.
indicated mid position: however, it was verified in the closed position.
,
The number four main feedwater isolation valve, however,-did not close
and was found to be full open.
The breaker for the valve was found
.
tripped on overcurrent.
However, the line was isolated by the
feedwater regulating valve, and also, the feedwater pump had been
tripped by the feedwater isolation signal.
,
During the subsequent investigation, the licensee identified that the
motor brake was partially full of water. The water had caused the motor
brake to rust and prevented operation of the motor operator, however,
the valve could be operated manually. The motor was disassembled and
found to have a melted rotor and damaged windings, due to sustained
locked rotor conditions. Thermal overloads are not available for motor
protection during a main feedwater isolation actuation signal, which, in
this example, resulted in motor destruction.
The valve and operator are located in a high temperature environmer.t
(>120 degrees F) and discussions indicated that the valve was
periodically being wetted down during operation of the steam generator
wet layup system due to system leaks. ' None of the other MFIVs on either
q
unit were located such that this condition was a problem and the area
temperature should not have affected valve reliability. However, the
licensee discovered that the brake was not designed to be waterproof and
therefore this model of brake was susceptible to this mode of failure if
used in an environment that could cause moisture intrusion. The
licensee also noted that the brakes are used in areas where incidental
l
moisture intrusion was possible.
A review of the equipment history found previous failures of 2 HV0P 003-
0100 B.
o
On January 20, 1989, a PER was written to address the action plan
associated with the motor failure of 2 MV0P 003 0100 B.
It noted
that the brake assembly was found to be rusted and locked in
)osition and the motor had failed.
It also noted that the valve
) rakes were not qualified or required to be waterproof, indicating
that the licensee understood the failure mechanism / root cause at
that time.
e
On September 8,1990, the valve failed to close on a feedwater
isolation signal and the breaker was found tripped.
Inspection of
the brake assembly noted a collapse of the air gap adjustment and
rust obscuring the physical location of the air gap match point.
. - -
.
, _ -
.
.
,
6
The mechanics identified the root cause of the failure as
incorrect assembly of the air gap adjusting nuts and stop nuts on
the brake adjustment plate.
In addition, the documentation noted
,
that, "The brake mechanism was of a type which we do not normally
have to deal" and with foreman and general foreman approval
"further information from vendors manuals would be needed prior to
disassembly of brake unit for inspection and/or repairs."
l
In September 1994, a work request was initiated to re) air a.
e
damaged brake flexible conduit. Water was found in tie brake
compartment and the motor. brake was found to be highly corroded.
The brake assembly was replaced.
,
On April 6,1995, the valve failed to close and the work request
e
noted that the valve thermaled out when given a closed signal.
The mechanics noted that the motor amps went high during the valve
>
stroke and smoke came out of the motor casing.
The mechanics identified the root cause of the failure as
intermittently grounded motor brake leads and the motor brake was
replaced.
Discussions with the mechanics indicated that the old
brake was full of rust, however, this was not identified in the
work package.
Various work packages identified occurrences of flexible conduit damage
since 1989. There were approximately 20 instances of flexible conduit
damage on Unit 2 main feedwater isolation valves, with 8 instances of
damage on 2-MV0P-003 0100 B.
On October 15, 1996, the inspector observed the testing of the Dings
Motor Brake in its as found condition.
Initial observation of the air
gap, which was to be set at .035 inches,-indicated that no gap existed.
1
The brake was energized and no apparent movement of the pressure plate
was observed. A torque wrench was then used to attempt to rotate the
brake, however, the brake would not rotate with 250 ft.lbs of torque
applied. The brake air gap was adjusted to .035 inches and when power
was then applied to the brake, the pressure plate moved and the brake
rotated freely.
Power was then removed from the brake and it was turned
at 50 ft-lbs as required. With the brake in a condition where it
released at 50 ft lbs, even if the brake failed to release, the motor
would be able to overcome the brake friction and to operate the valve as
required.
Based on the rust lines within the brake assembly, it appeared that the
water was leaking into the brake assembly through the damaged flexible
conduit. The manufacturer's technical representative assisted in the
disassembly of the motor brake.
He noted that no rust should be present
in the brake assembly and that the rust had caused the loss of air gap
and resulted in brake failure.
He also noted that a gasket on the brake
housing was missing: however, the gasket had not been recuired by
Limitorc ue.
He also noted that the brake had been sealec using RTV and
informec the licensee that acetate from the RTV curing process could
._.
.
.
_
_.
_
~
'
.
I..
-
,
7
cause damage to the brake assembly. The licensee was not aware that a
motor gasket was needed and that RTV (acetate) could cause a problem.
However, neither of these conditions appeared to contribute to the
previous brake failures.
The previous root cause determinations for the brake failures were
!
inadequate. -In 1989,1990, and 1994 there was a significant amount of
rust in the brake' assembly: however, the cause and overall effect of the
rust were not addressed.
In 1995, the grounded leads were identified as
i
the failure mechanism; however, the ins)ector concluded that this could
not be the root cause because even if t1e brake failed to release it'
still should have o>erated. The motor is rated with 250 ft lbs of
starting capacity w111e the brake is set for 50 ft-lbs.
Grounded / shorted leads would have caused a loss of the power source
fuses, in order to make the brake inoperable: however, the fuses did not
fail. The failure to develop an adecuate root cause, led to the failure
to identify and correct the water incuced failure of the brake assembly.
The failure to identify and correct the root cause of the brake failure.
is considered to be an apparent violation of the licensee's corrective
action program as required by 10 CFR 50. Appendix B, Criterion XVI.
'
Corrective Action, and as required by SSP 3.4 (EEI 50 327, 328/96-13-
01).
Following the October 11 failure, the licensee determined that the root
cause for the failures of the brake assembly was an inadequate
specification of design requirements for this component. The feedwater
isolation investigation team documented that "A component that could
J
withstand incidental moisture intrusion would have prevented this-
condition."
The equipment work history noted repeated occurrences of flexible
conduit damage in Unit 2.
This led to the multiple water intrusions
into the brake assembly and the subsequent failures. After repeated
repairs of the flexible conduit for MFIV MV0P-003 0100-B in 1990, the
work history noted " suspect that it makes a good stepping place for
climbing in the area." In addition to the water intrusion, in 1995 the
wiring was found grounded which affected the environmental qualification
a
of the assembly. The failure to take adequate corrective actions to
prevent continued damage to the flexible conduits, is considered to be
an apparent violation of the licensee's corrective action program as
required by 10 CFR 50. Appendix B. Criterion XVI. Corrective Action, and
as required by SSP-3.4 (EEI 50 327, 328/96 13 02).
The licensee and the inspectors noted that the work history and the
previous PER history had identified the repeat failures of the MFIV
brake and flexible conduits.
However, the licensee's trending programs,
for repeat failures of WRs and/or PERs, did not identify the repeat
failures of the MFIV brake or the MFIV flexible conduits. This was a
missed opportunity to identify and correct a repeating adverse
condition.
-
.-
_,
.
.-
l
'
.
,
8
-
3.
Conclusions
The failure to identify the cause of the brake failures and to take
adequate corrective actions for the water intrusion is considered to be
'
an apparent violation.
1
The failure to take adequate corrective actions to prevent further
flexible conduit damage is considered to be an apparent violation.
The use of RTV could result in acetic acid intrusion into the brake
assembly, which in turn could cause damage to the brake assembly. The
previous use of RTV to seal up the brake assembly is considered to be a
weakness.
The manufacturer's technical representative noted that the motor to
brake assembly gasket was missing and should be installed. The missing
gasket is considered to be a negative observation.
The failure of the licensee's repeat failure tracking / trending programs,
associated with WRs and PERs. to identify repeating equipment failures
on the NFIVs is considered to be a weakness.
D.
Failure of RCP Seal Leakoff Isolation Valve
'
1.
Insoection Scooe (62707 and 37551)
The initial abnormal plant indication which resulted in the shutdown of
Unit 2 was RCP low seal leakoff flow. The inspector reviewed the root
causes which led to the low seal leakoff flow indication.
2.
Observations and Findinas
On October 11. Unit 2 received indications of # 4 RCP # 1 seal low
leakoff flow. # 2 seal high leakoff flow and seal return line standpipe -
,
alarms. Based on these indications, operators concluded that the # 2
j
seal had failed (excessive leakoff) and they commenced a shutdown of the
unit as required by A0P-R.04. Reactor Coolant Pump Malfunctions,
Revision 5.
Subsequent licensee investigation revealed that, rather
'
than a failure of # 2 seal, the # 1 seal leakoff isolation valve. 2-FCV-
62-48, had failed closed and blocked leakoff flow.
Valve 2 FCV 62 48, is a pneumatic air to close, spring-to open valve and
is normally open during plant operation.
It was not classified as an EQ
valve or as a safety related valve. however, it was classified as
Quality Related, which places it in the licensee's Appendix B program.
The inspectors reviewed the piping diagrams associated with the RCP seal
leakoff lines and isolation valves. The diagrams noted that the
downstream side of the # 1 seal leakoff isolation valve has a system
design rating of 200 psig. The low pressure design rating of the
downstream piping would dictate that this valve would be important to
safety and would be required to close on a RCP seal failure event to
prevent an unisolatable RCS leak inside containment.
-
.
.
',
.
9
The licensee's investigation noted that the ASCO solenoid valve
contained Buna-N rubt.er o ring seals which failed due to temperature age
hardening and thus permitted air to escape past the seals and to be
vented to the diaphragm of the pneumatic valve. Additionally, other
problems that contributed to the failure of the valve were noted:
Upon removal of the exhaust port tubing, a piece of foreign
e
material was found in the port which caused partial blockage of
the exhaust ] ort. The material was determined to be a plastic
dust cover w1ich had apparently been left in the exhaust port
following previous maintenance.
The as found regulator output pressure was 76 psig (the required
e
value was 50 psig). While this increased pressure was not
believed to have caused the failure of the solenoid (120 psig
design rating), it did exceed the pressure rating of the air
operated isolation valve. 2-FCV-62-48.
It appeared that the higher pressure provided additional air to leak
past the failed "0" rings and the vent plug did not allow the air to
leak out of the exhaust port. This apparently caused a pressure buildup
in the ASCO valve which caused the seal leakoff isolation valve to go
closed. The failure to remove the dust cover from the ASCO prior to
installation and the failure to properly set the supply air regulator
are considered to be poor maintenance practices and are identified as a
negative observation.
The licensee concluded that the root cause of the ASCO solenoid failure
was temperature age hardening of the Buna-N 0-rings in the solenoid
which allowed air to leak past the 0-rings and )ressurize the valve
diaphragm. This solenoid was .1 stalled in Octo)er 1990 and had been in
service for six years and it was also installed in an area where
temperatures could be as high as 150 degrees F.
Buna-N elastomers
installed in solenoids in this environment (approximately 150 160
degrees F) have a service life of less than one year. The solenoid
vendor indicated that the Buna N upper temperature limit is 125
degrees F.
,
NRC IE Bulletin 78-14. Deterioration of Buna N Components in ASCO
Solenoids and Generic Letter (GL) 91-15. Operating Experience Feedback
Report, Solenoid-0perated Valve Problems at United States Reactors,
characterized the industry problems associated with the solenoid valves.
'
The GL addressed many failure modes including thermal aging and the need
for replacement or refurbishment of resilient parts. The GL did not
require a written response, however, the NRC expectation was that
utilities would review the report and apply the information as
appropriate to avoid similar problems.
In late 1993. TVA developed an
l
action plan to address the issues identified in Generic Letter (GL) 91-
i
15 and the NRC recommendation. The licensee could find no evidence to
indicate that the action plan was ever implemented. The licensee noted
!
that implementation of the action plan that was developed in response to
,
j
GL 9115 could have prevented the solenoid valve failure.
i
!
i
.
e
i
10
In addition, the licensee noted that a previous PER had been initiated
i
to address repeat failures of solenoid valves due to the elastomer
i
material (Buna N) becoming hard and brittle due to being in an area with
'
elevated temperature (>140 degrees F). However, the scope of condition-
-for resolution was narrowly focused in that only secondary side systems
,
were evaluated for a thermal degradation issue which was also applicable
to primary and safety related systems. The failure to implement
corrective actions for previously identified deficiencies related to
ASCO solenoid valves is considered to be an apparent violation of the
licensee's corrective action program as required by 10 CFR 50, Ap)endix
B. Criterion XVI, Corrective Action, and as required by SSP-3.4 (EEI 50-
327, 328/96 13 03).
,
During the review, it was noted that the seal leakoff valve fails open
i
on a loss of power or a loss of containment control system air pressure.
For a RCP seal failure, this valve must remain closed or the downstream
seal leakoff low pressure piping could be damaged.
It was not clear
whether the accident analysis considered the open condition of the seal
<
leakoff valve following a seal failure event. This is considered to be
an unresolved item (URI-327, 328/96-13 04).
3.
Conclusions
f
The inspectors concluded that the ASCO solenoid failed due to
temperature aging of the Buna N seals. An apparent violation was
identified for failure to implement corrective actions for ASCO solenoid
failures.
.,
A negative observation was noted regarding a poor maintenance practice
which permitted a dust cover to be left in the exhaust port of a
solenoid valve following maintenance activities and the failure to
properly set the air supply regulator to the proper setting.
E.
Turbine Runback and Enaineerina Sucoort
1.
Insoection Scoce (37551)
When the operator stopped one of the two operating feedwater pumps, the
plant experienced a turbine runback. The plant was below the runback
setpoint of 80% turbine load and a runback should not have occurred.
The inspector reviewed the equipment problems related to the turbine
runback.
2.
Observations and Findinas
The plant shutdown proceeded to approximately 50%, at which point one of
two operating feedwater pumps was procedurally required to be removed
from service. When the operator tripped the feedwater pump, the plant
experienced a main turbine runback, all of the. steam dumas opened and
the bank D control rods were automatically driven into t1e core.
I
1
i
_ _ _ .
a
.
.
11
A turbine runback signal is initiated on a main feedwater pump trip with
l
turbine power above 80%. Main turbine power was approximately 50% and
l
the turbine runback was not expected. There is a total of nine pressure
,
instruments. located in the turbine building, associated with turbine
!
impulse pressure. Two were safety related pressure transmitters (PT 1-
l
72 and PT 173) that supply signals to reactor control and interlock
circuits. One pressure transmitter (PT 47 13) supplies a signal for
turbine impulse control. Two pressure switches (PS 1-81 and PS 1 82)
provide a pressure setpoint actuation for AMSAC. Two pressure switches
(PS 47 13A and PS47-13D) provide inputs to the heater drain tank
turbine runback circuit.
The last two pressure switches (PS 47 13B and
'
PS 4713E) provide inputs to the loss of main feedwater pump turbine
runback and AFW actuation circuits.
After the event, the associated pressure switches were inspected by the
licensee.
Pressure switches (PS47-13B and PS47-13E). which develop
the two out of two actuation signal for the turbine runback, were
partially filled with water.
In addition, one of the pressure switches
used in the heater drain tank turbine runback circuit, was also found
partially filled with water. The water had corroded the switches,
causing them to become stuck and they erroneously indicated power above
i
80%. This sealed in the turbine runback signal as well as an AFW
actuation signal. The licensee determined that the water had leaked
,
into a common junction panel above the pressure switches and then leaked
into the individual pressure switch enclosures. The source of the water
appeared to be from a fire system deluge actuation, caused by a failed
fire detector in July 1996. The water from the actuation entered the
top of various junction boxes and then drained down the wiring into the
switch enclosures. During further investigation of the water intrusion,
the licensee identified 18 additional instruments affected by the fire
system actuation. Ten instruments, that provide secondary plant control
functions, were repaired prior to plant startup.
Following the fire system actuation in July 1996, the licensee did not
adequately evaluate the consequences of the deluge actuation and soaking
down of plant equipment.
This led to the subsequent failure of the
impulse pressure switches. The failed switches caused a turbine runback
1
and sealed in an AFW actuation signal.
In addition, the switches could
have failed in a position that would have prevented a turbine runback
and blocked the associated AFW actuation signal. The licensee's
corrective action process, as implemented by station procedure SSP-3.4,
Corrective Action. Appendix H. requires an extent of condition review in
order to bound the problem.
However, following the deluge actuation,
the PER corrective actions did not adequately bound the adverse
conditions, in that they did not identify the adverse condition of the
turbine impulse switches. This is considered to be an apparent
violation (EEI 50-327, 328/96 13-05).
l
All of the associated impulse pressure switches, on both units, were
inspected and the three sticking pressure switches were replaced (to
'
date, one awaiting parts). The licensee had previous problems with the
operation of these pressure switches resulting in a turbine runback:
__
.
_
. _ _
_..
.
_
_ _ _
'
'
.
.
.
17
Engineering " dummied" a signal to a computer alarm circuit prior to
. determining the cause for the signal. This is considered to be a
negative observation.
,
B.
Unit 2 Reactor Trio Breaker Maintenance
1.
Insoection Scooe (62707)
The inspectors reviewed the activities related to refurbishing the spare
RTB and the subsequent replacement of the Unit 2 RTB "B" with the spare
refurbished RTB.
2.
Findinas and Observations
i
On September 19. 1996, with Unit 2 at 130% power RTB "B" was replaced
with a refurbished spare RTB.
Due to a malfunction of auxiliary
contacts and subsequent insistence of Operations management. the rebuilt
RTB was removed and the original breaker was reinstalled. Upon
i
inspection of the removed refurbished RTB it was determined that linkage
'
control to the auxiliary contacts had not been reconnected during the
breaker refurbishment activities.
The following is the sequence of events related to the refurbishment of
the spare RTB.
e
On Seatember 13, 1996 (Friday), maintenance personnel began
refuraishment of the spare RTB in accordance with Maintenance
Instruction (MI) 10.9.1, Reactor Trip Breaker Type DB50 Inspection
Associated with System 99, Revision 16.
Procedure Section 6.2.6.
'
Breaker Auxiliary Switch Inspection and Test, was completed on
this date.
j
e
On September 14, 1996 (Saturday), maintenance personnel requested
i
QC support in order to complete the remaining lubrication
i
'
activities in Section 6.4.
Since it was the weekend and no QC
inspectors were on site, maintenance requested that a QC inspector
be called in: however, the request was denied.
Maintenance supervision determined that it was acceptable to
proceed with the steps of MI-10.9.1. which did not require QC
su) port.
They determined that activities involved with
lu)rication would not affect those maintenance activities already
'
completed on the breaker and they made a decision to proceed with
Section 7.0. Post' Performance Activities, and to perform the
lubrication activities of Section 6 when QC was available on
Monday.
e
On September 15, 1996 (Sunday), work continued on the post
performance activities of Section 7.
e
On September 16, 1996 (Monday), with QC support, maintenance
personnel began performance of the remaining steps in MI 10.9.1,
.
-
._.
.-
.
_ -.
.
.
'.
.
E
18
l
!
Sections 6.4 through 6.7.
These activities included inspection
j
and lubrication of the inertia latch which required removal of one
!
end of a link to the auxiliary contact linkage assembly. During
the reassembly of the linkage assembly, neither the QC inspector
nor maintenance personnel noticed that a portion of the linkage
had not been reconnected.
Following the lubrication of the
inertia latch, subsequent steps of Section 6 required that the
breaker be opened / closed several times during which maintenance
personr.el did not notice the disconnected linkage.
MI-10.9.1 was
,
completed with the linkage still. disconnected.
e
On September 19, 1996 (Thursday), the refurbished RTB was
installed in Unit 2.
The inspector reviewed MI-10.9.1 and the RTB refurbishment activities.
and had the following observations,
MI-10.9.1. Section 6. contained a " NOTE" which permitted steps
o
within Section 6 to be performed out of sequence. This " NOTE"
only applied to Section 6 and did not intend that Section 7 be
'
completed prior to Section 6.
If Section 6 had been completed
prior to Section 7. the Post Maintenance Test (PMT) of Section 7
'
may have identified the linkage reassembly errors made in
Section 6.
Technical Specification 6.8.1.a requires, in part, that procedures
i
shall be established, implemented, and maintained covering the
activities recommended in Regulatory Guide 1.33. Revision 2.
'
'
Appendix A. including procedures for performing maintenance.-
Procedure MI-10.9.1. did not authorize personnel to perform
procedure " sections" out of sequence. The failure to follow
procedure MI-10.9.1 is considered to be example one of an apparent
violation of TS 6.8.1.a (EEI 50-328/96 13-08).
e
MI-10.9.1 was written such that the auxiliary contacts were tested
in Section 6.2.6.
Later, in Section 6.4.1 of the procedure, the
auxiliary contact linkage assembly was disconnected from the
i
inertia latch to allow lubrication of the inertia latch. After
the performance of Section 6.4.1 there was no further check or
test of the auxiliary contacts to ensure the linkage was intact
prior to returning the RTB to service. Additionally. there was no
guidance in the procedure to caution that the linkage could become
,
disconnected during the inertia latch disassembly process.
The inspector also reviewed MI 10.9.1 to determine if there had
!
been any recent procedure revisions which had changed the method
i
i
of inertia latch lubrication. The inspector noted that Revision
l
13. dated July 29, 1994, was changed such that the inertia latch
was removed for inspection and lubrication.
Prior to Revision 13,
!
the latch had been lubricated without removal of the latch.
Revisions 14 and 15 also required removal of the inertia latch as
,
did Revision 16 under which this most recent RTB inspection was
,
,
i
.-
-
. -
-
-
.
'
j
-
.
19
1
,
performed. The inspector concluded that Revision 13 to procedure
l
!
MI-10.9.1 did not adequately address the evolution of removing the
'
inertia latch in that it did not consider ap)ropriate precautions
!
regarding reinstallation of the inertia latc1 to ensure proper
'
reassembly.
Procedure MI-10.9.1 was inadequate in that it did not provide
precautions or adequate instructions regarding the
disassembly / reassembly of the reactor trip breaker auxiliary
contacts linkage assembly during lubrication.
The failure to
provide an adequate MI 10.9.1 procedure is considered to be an
additional example of an apparent violation of TS 6.8.1.a (EEI 50-
328/96-13 08).
e
The licensee did not adequately plan the refurbishment of the RTB
to recognize the need for weekend QC support. The absence of QC
support started a chain of events which led maintenance
supervision to make an inappropriate decision to perform the Post
Performance Activities, Section 7 of MI-10.9.1. without first
completing Section 6.
!
e
Neither the maintenance person performing the reassembly of the
linkage nor the person performing the "2nd check" noticed that the
,
linkage was disconnected. After several strokes of the breaker
during bench testing and with the breaker mechanism apparently
functioning normally. maintenance personnel did not notice the
J
disconnected linkage.
e
The inspector reviewed the licensee's corrective action plans and
concluded that the licensee had completed corrective actions to
revise MI 10.9.1. The procedure revision included moving the
auxiliary contact check and test to the end of the 3rocedure to a
place where all partial disassembly of the breaker las been
completed. Additionally, a caution note was added to the step
requiring removal of the inertia latch to ensure that the
auxiliary contact linkage was connected following lubrication of
the inertia latch. The 3rocedure revision contained clarification
'
as to the meaning of wor (ing steps out of sequence and to which
sections this applied. The licensee visually verified that the
remaining RTBs contained correctly assembled linkages.
Management
expectations were also ex)ressed to personnel that, to the extent
practical, extra effort siould be extended to ensure components
are properly reassembled and will perform their required function.
3.
Conclusions
The inspector concluded that the MI-10.9.1 procedural " NOTE" permitting
'
steps to be performed out of sequence did not permit the " performance"
section and the " testing" section to be performed out of sequence. The
failure to follow a procedure guidance is considered to be an apparent
violation.
i
.
.
20
The inspector concluded that procedure MI-10.9.1 was inadequate in that
it did not 3rovide cautions regarding the reassembly of the auxiliary
contact lincage assembly following lubrication. The use of an
inadequate procedure is considered to be an apparent violation.
The inspector concluded that, during the planning for the RTB
refurbishment. Maintenance failed to ensure that QC personnel would be
available when required by the procedure. This issue is considered to
be a negative observation.
C.
Licensee Self Assessment Activities (40500)
1.
Inspection Scope (40500)
The licensee performed a root cause investigation to determine
corrective actions associated with the reactor trip breaker event. The
inspectors reviewed the Event Critique Report and its associated
corrective actions.
2.
Observations and Findings
The inspectors reviewed the licensee's Event Critique Report which
addressed the problems identified in PER No. SQ962451PER related to
failure of the auxiliary contacts in the refurbished RTB breaker. The
licensee concluded that "...the root cause of this event was inadequate
skills and knowledge resulting from inadequate training. Specifically.
the training associated with the DB 50 breakers did not adequately
address the mechanical linkage between the inertia latch and the
auxiliary contacts.
Further. the procedure (MI 10.9.1) did not identify
the )ossibility of linkage disengagement while removing the inertia
latc1. Additionally. the Westinghouse vendor manual does not adequately
address this mechanical linkage...."
The inspectors concluded that the licensee's event critique accurately
described the lack of training and knowledge which were most probably
due to vendor manual deficiencies regarding inertia latch lubrication.
However. the inspectors concluded that the event critique was not
thorough in that it (1) did not address operability of the refurbished
RTB (2) did not address the functions of the auxiliary contacts which
'
were disabled, and (3) did not address the effect of a revision to MI-
10.9.1 (July 29.1994) which changed the method of lubricating the
inertia latch.
3.
Conclusions
The inspectors concluded that the failure of the RTB Event Critique to
discuss (1) RTB operability. (2) the function of the auxiliary contacts.
and (3) the revision to the maintenance procedure, represented a
weakness in the thoroughness of the root cause determination process.
.
',
.
21
D.
Failure to Perform an Ooerability/Recortability Determinatiorl
1.
Insoection Scooe (40500)
Following removal of the refurbished reactor trip breaker on
September 19, 1996, the licensee identified that the linkage for the
auxiliary contacts had not been reconnected properly. The operations
Shift Manager and the PER event critique team questioned the function of
the contacts due to concerns with the operability of the reactor trip
breaker.
In addition, the Management Review Committee (MRC) reviewed
the PER and noted that the reactor trip breaker issue potentially
affected reportability. The inspectors followed up on the function of
the disconnected contacts.
2.
Observations and Findinas
Following identification of problems identified with the reactor trip
breaker, the Shift Manager expressed concerns regarding the proper
functioning of other RTB auxiliary contacts.
His concerns led to an
addendum to the initial PER and he also expressed to the operation's
representative on the RTB event critique team the need to evaluate the
disconnected contacts.
The MRC met on September 20, 1996 and determined that the PER condition
could potentially affect re)ortability and appro)riately checked the
potentially reportable bloc ( on the PER form. T11s action required that
the PER be hand carried to Operations so that Appendix E of SSP- 3.4,
Corrective Actions, could be implemented. Appendix E details the
requirements for performing an operability /reportability determination.
As of approximately two weeks later the PER was not returned to
Operations and the subsequent operability /reportability determination
was not performed until questioned by the inspectors. The failure to
perform the operability /reportability determination is an apparent
violation of NRC requirements (EEI 50 328/96-13-09).
In addition, as follow up on the Shift Manager's concerns, the review
team questioned the function of the disconnected auxiliary contacts in
order to determine if the contacts affected the operability of the
reactor trip breaker. During the week following the RTB malfunction,
technical support completed its review of the function of the
disconnected auxiliary contacts and supplied a memo to the event
critique team. The memo noted that the disconnected auxiliary contacts
affected the turbine trip and feedwater isolation outputs from the
reactor trip breaker.
NRC discussions with an event critique team member indicated that the
team understood that the disconnected auxiliary contacts affected P-4:
and therefore, affected the operability of the reactor trip breaker.
This information was thought to be common knowledge, however, neither
technical support or the event critique team formally reported the
inoperability of the RTB to appropriate levels of management. The lack
.
-
-
-
..
.-
_.
-
.
' . .
-
12
however, the previous event was not due to water intrusion into the
pressure switch enclosures.
The licensee's review also noted that the fire system detector had
failed (in July) due to water intrusion into the detector. The water
had leaked into the detector, possibly due to overflow from the gland
t
sealing steam system.
During a review of control diagrams and alarm response procedures
associated with the turbiae runback, the inspector noted that alarm
response procedure 2 AR M2 A-B-1. Turbine Runback, did not identify the
same instruments for the alarm inputs as depicted on control diagram CCD
No.1, 2 47 W610 47-2. Although inconsistent, this error would not
1
affect operator actions associated with the turbine runback alarm.
3.
Conclusions
The failure to implement adequate corrective actions associated with the
!
fire system actuation is considered to be an apparent violation.
The water intrusion into a single zone actuation fire detector, which
resulted in the deluge actuation, is considered to be a negative
observation.
l
Inconsistencies in the control diagrams and the abnormal procedures is
considered to be a negative observation.
F.
AFW Actuation Sianal Sealed In
1.
Insoection Scoce
During recovery actions the operators could not reset the AFW actuation
signal and could not take manual control of the AFW system. This
contributed to reaching a low low Tave condition. The inspector
reviewed the circuitry associated with the AFW actuation and the
operator's response to the loss of AFW control.
2.
Observations and Findinas
While performing the reactor trip recovery steps in the emergency
response procedures, the operators had difficulty in controlling the
cooldown of the RCS. This led to dropping below the low-low Tave
setpoint of 540 degrees F which resulted in a main feedwater isolation
j
signal and also required the operators to emergency borate the RCS.
Because of the operators quick response to abnormal plant conditions.
Tave only dropped to 538 degrees F.
However., the operators had to
control the steam generator level by fully opening / closing the AFW
isolation valves (cannot be throttled).
The operators had difficulty in controlling RCS cooldown because the AFW
actuation signal was sealed in and they were unable to take manual
control of the motor driven AFW system flow control valves or to take
]
.
.
,
)
13
1
manual speed control of the turbine driven AFW pump.
Operators, with
management approval, disabled the AFW pumps by placing the motor driven
AFW motors in pull-to-lock and by closing the turbine driven AFW pump
discharge isolation valves. This resulted in all three AFW pumps being
technically inoperable with TS 3.7.1.2 LC0 actions preventing any mode
change and also requiring immediate initiation of corrective actions to
return one pump to operable status.
Following the reactor trip, the
l
operators maintained adequate steam generator water levels (>10% in all
four SGs) by operating the turbine driven AFW pump discharge isolation
valves and maintained acceptable RCS temperature conditions (approximate
545 degrees F).
1
The operators were unable to reset the AFW actuation signal because the
signal was sealed in by the failed im)ulse pressure switches. A review
of the wiring diagrams noted that wit 1 a main feedwater pump trip above
i
80% turbine power, the AFW system receives an automatic actuation
I
signal .
Since the impulse pressure switches were stuck, the signal was
sealed in and could not be reset by the operators.
During the event.
the o)erators were unaware of the interlock between the turbine runback
)
and tie locked in AFW actuation signal. At 10:44 a.m.. following
discovery by the licensee of the failed switches, a lead was lifted in
the impulse pressure switch circuitry and the operators were then able
to reset the AFW actuation signal, which allowed normal control of the
AFW system.
Further review noted that if the operators had reset the main feedwater
pump after it was manually tripped, then the turbine runback would have
i
reset automatically and the AFW actuation could have been manually
i
reset.
However, this was not proceduralized and the operators did not
understand the operation of the runback circuitry and did not reset the
main feedwater pump. Discussions indicated that a turbine runback, due
to impulse pressure switch problems, had occurred before and the
inspector concluded that knowledge of the circuitry should have been
available based on the previous event. The lack of knowledge appeared
i
to be a deficiency in classroom training and in simulator scenarios.
The AFW actuation signal following a main feedwater pump trip 1s
designed to compensate for a loss of feedwater
It is not safety
related and not subjected to any separation requirements.
In this case
a common mode failure occurred due to a lack of separation.
It does not
appear to provide a safety function but rather assists the unit in
maintaining steam generator levels and preventing a reactor trip
following a feedwater pump trip at high power levels. The licensee was
reviewing the continued need for the circuitry as designed and is
considering potential modifications to the circuitry which would allow
for manual resetting of the (main feedwater pump trip / turbine power
>80%) AFW actuation following a reactor trip.
Mitigating actions are required for a reactor trip, a steam line break
inside containment, a steamline break outside containment, and a SG tube
rupture. Operators are required to take manual control of the AFW
system (UFSAR assumption within 10 minutes) to ensure that the plant can
,
14
meet.the analysis for the above listed events. The UFSAR Section
10.4.7.2.3, Safety Evaluation, states, "The AFW system is automatically
initiated by redundant. coincident logic to preclude loss of function
due to a single failure." However, based on the system failure due to
water intrusion, it does not appear that the system was. properly
designed to preclude a loss of function with a single failure. This
issue is identified as an Unresolved Item pending further NRC review.
(URI 50 327, 328/96 13 06).
3.
Conclusions
The operators lacked knowledge in the functioning of the turbine impulse
pressure switch circuitry and this lack of knowledge indicated a
weakness in the licensee's training program, considering the previous
problems with this circuit.
The operators appropriately isolated the AFW system to prevent an
uncontrolled cooldown of the RCS. This is considered to be a positive
observation.
The failure of two non safety related and non independent switches
i
resulted in the inability of operators to reset an AFW actuation signal.
This could have led to an RCS overcooling event or could have affected
plant safety during one of several events discussed in the safety
analysis and its design is an unresolved item.
II.
Inocerable Reactor Trio Breaker
A.
Operational Aspects
1.
Insoection Scope (71707)
On September 19, 1996, a refurbished RTB was placed in service. The
breaker had position indication problems that caused alarms in the
control room and the RTB was subsequently removed. A PER was initiated
and a root cause investigation was performed.
Following completion of
the root cause investigation, the inspectors reviewed the facts
surrounding the event. The NRC review found that the breaker had been
inoperable and the licensee had exceeded an LC0 required shutdown.
l
2.
Observations and Findinas
At 9:29 a.m., on September 19, 1996, the licensee entered TS 3.3.1,
Action 12 for installation of the refurbished breaker in the RTB "B"
cubicle. Testing was performed to ensure that the breaker functioned
.
properly. The breaker opened and closed as required; however, when the
l
bypass breaker was cycled, the " computer alarm rod deviation NIS power
I
'
range tilts" annunciator went into alarm and cleared. This occurred
several times during the testing process. At 10:48 a.m.. the testing
was complete, the refurbished reactor trip breaker was considered to be
operable, the bypass breaker was opened, and the rod deviation alarm
came in and stayed in alarm. Discussions with operations indicated that
ll
l
_
.
_
. . .
_
-_.
. _ . _ _ _ _ _ . _ - _ _ . _ _ _
..
.
,i
.
o,
.
15
the operators were concerned that the alarm was associated with the
i
reactor trip breaker, .but were unable to confirm the relationship.
.
At 11:30 a.m., engineering personnel confirmed that the computer rod-
deviation alarm was due to an input from RTB."B", which was erroneously
~
'
indicating that.RTB "B" was not closed. The operator -logs noted that
the most likely _cause for the alarm was due to a malfunction 'of an
auxiliary contact in RTB "B".
Discussions with operations indicated
that the operators were concerned that if one contact was malfunctioning
-
that other contacts in the breaker could also be malfunctioning and they
wanted the breaker removed.
'
At-1:28 p.m., engineering " dummied" the computer signal to the
Integrated Computer System (ICS) computer so that the input-to the rod
bank deviation circuit would indicate a closed signal from RTB "B".
This cleared the " Tilt" alarm which reduced the surveillance frequency
,
requirements for operators-taking rod position readings. At this time,
the breaker was considered to be operable based on the com)leted breaker
operability surveillance: however. the surveillance only clecked the
operation of the breaker and did not verify the breaker position output
signals to the computer or to the P 4 circuits.
Discussions with o)erations noted that engineering and maintenance-
wanted to troubles 1oot RTB "B" in its closed position and.were reluctant
to remove RTB "B" and to replace it with the original breaker.
Operations insisted on not troubleshooting the breaker and asked for
removal of the potentially faulted breaker. The Operations' Manager was
i
called to the site for a staff meeting _to discuss the various options.
l
The Operations Manager agreed with the Shift Manager that the breaker
I
needed to be replaced and that no troubleshooting would be performed
while the breaker was in service.
l
At 5:45 p.m., the breaker replacement was initiated and at 6:34 p.m.,
RTB "B" replacement was completed. When the faulted breaker was opened,
the licensee determined that a linkage that operated two of three sets
of breaker position contacts, was not connected.
Following completion
of the licensee's root cause investigation, the inspectors noted that
the licensee still did not appear to know the function of the
-disconnected contacts. The inspectors reviewed the logic diagrams and
'
believed that the contacts supplied the P 4 permissive function which
provides a turbine trip, feedwater isolation, and steam dump arming
signal following a reactor trip and was based on the position of the
reactor trip breaker.
Discussions with the licensee's compliance personnel noted that the
turbine trip associated with the RTB had been reviewed and evaluated for
operability. Compliance personnel stated that the turbine trip was not
taken credit for in the accident analysis: therefore, the RTB
"B" was
considered to be operable. The inspector noted that the turbine trip
'
function, following a reactor trip, provides protection for an
overcooling event on the RCS and, in addition, is part of the P-4
-.
-
.
-
. - .
_
_ .
4
.
,
16
.
circuit which is a TS required function with a 6-hour LC0 for shutdown
- to hot shutdown, if the circuit is not functional.
l
In response to questions by the inspectors, the licensee reviewed the
functions of the disconnected contacts and determined that the contacts
supplied signals for reactor trip alarm, high steam flow interrupt, a
computer point for the rod deviation program, turbine trio. feedwater
isolation (which orovides feedwater isolation coincident with a low
Tave sianal. maintains a feedwater isolation. turbine trio. and trio of
main "eedwater cumos sianals after a steam aenerator hiah level trio).
and a' lows bloc (ina of the safety in.iection sianal after a SI so that
the SI sianal can be reset. The above underlined signals are part of
the P 4 circuitry required to be operable by TS. The inspectors noted
that the ino)erable P 4 circuitry exceeded the TS requirements for
shutdown (6 lours). The failure to follow TS 3.3.1.22.G. Action 14,
requirements is considered to be an apparent violation (EEI 50 327,
328/96 13 07).
Due to the failure of the contacts, the breaker was
inoperable from the time it was installed (9:29 a.m.) until it was
removed (6:34 p.m.).
"
The inspectors noted that the "A" train RTB would have been able to
actuate the turbine trio and feedwater isolation signals.
However,
blocking of the SI signai would have been prohibited by the faulty
reactor trip breaker.
Following an SI, due to the failure of the RTB
i
P 4 contacts, the operators would have been required to manually isolate
all of the SI actuated components, which would have complicated recovery
'
actions.
,
On November 4,1996, licensee staff was still convinced that the turbine
trip contacts from the reactor trip breaker were not part of the P 4
circuitry.
However, following additional questions and review of the 18
month surveillance SI IFT 099 0P4.0, Periodic Verification of P 4
Interlock Function From Reactor Trip Breakers, Revision 1, the plant
staff agreed with the inspectors that the turbine trip in question was
part of the P 4 circuitry.
<
3.
Conclusions
Operations did a good job in stressing the need to get the potentially
>
faulted RTB out of service and in not allowing troubleshooting of the
breaker while still in service. This is considered to be a positive
observation.
The inoperable RTB was in service for greater than the allowed TS LCO
time period and this is considered to be an apparent violation of NRC
requirements.
The plant staff did not realize that the turbine trip contacts on the
reactor trip breaker were part of the P 4 circuitry and this is
considered to be a weakness.
-
.-
.
-
. - - -
.
-
.
.-
.
,
,
,
22
of action by the critique team and technical support personnel to report
the inoperability of the RTB is considered to be a weakness.
,
3.
Conclusions
!
The failure to perform an operability /reportability determination as
required by SSP-3.4 is considered to be an apparent violation.
The lack of action by the event critique team and technical su) port
'
personnel to report the inoperability of the reactor trip brea(er is
i
considered to be a weakness.
III.
Exit Meeting Summary.
The inspectors ) resented the inspection results to members of licensee
management at t1e conclusion of the inspection on November 5.1996. The
licensee acknowledged the findings presented.
The inspectors asked the licensee whether any materials would be
considered proprietary. No proprietary information was identified.
j
,
PARTIAL LIST OF_ PERSONS CONTACTED
Licensee
- Adney, R., Site Vice Presiderit
- Beasley, J., Acting Site Quality Manager
- Bryant. L., Outage Manager
- Burzynski, M., Engineering & Materials Manager
Driscoll. D., Training Manager
- Fecht
M., Nuclear Assurance & Licensing Manager
Fink, F., Business and Work Performance Manager
- Flippo, T., Site Support Manager
- Harrington, W., Acting Maintenance Manager
- Herron, J., Plant Manager
Kent, C., Radcon/ Chemistry Manager
,
Lagergren.
B., Operations Manager
!
Rausch, R. Maintenance and Modifications Manager
Reynolds. J..-Operations Superintendent
- Rupert, J., Engineering and Support Services Manager
- Shell, R., Manager of Licensing and Industry Affairs
Skarzinski, M., Technical Support Manager
- Smith,
J., Licensing Supervisor
Summy, J., Assistant Plant Manager
Symonds, J. Modifications Manager
- Attended exit interview
l
1
,
..
-
-.
.
.-.-
- - - - - _
.
..
.
- _- -
4
.
i
-
.
.
23
1
INSPECTION PROCEDURES USED
i
,
'IP 37551:
Onsite Engineering
i
'IP 40500:
Effectiveness of Licensee Controls In Identifying. Resolving, &
Preventing Problems
IP 62707:
Maintenance Observations
IP 71707:
Plant Operations
i
ITEMS OPENED. CLOSED. AlO DISC _USSEj
Opened
50-327, 328/96 13-01
Failure to correct re)etitive problems
(water intrusion) wit 1 the MFIV #4 MOV
brake assembly (Section I.C.2).
l
50-327, 328/96-13 02
Failure to implement adequate corrective
actions to prevent repetitive damage to
1
the MFIV flexible conduits (Section
I.C.2).
50-327, 328/96-13-03
Failure to implement adequate corrective
actions to address ASCO solenoid valve
elastomer aging (Section I.D.2).
50 327, 328/96 13 04
Evaluate the adequacy of the fail open
j
design of the RCP seal leakoff isolation
valve, which is needed to mitigate the
consequences of a RCP seal failure
(Section I.D.2).
50-327. 328/96-13-05
Failure to perform an adequate extent of
condition review required by SSP-3.4 for
deluge event which resulted in the impulse
pressure switch failures (Section I.E.2).
50 327, 328/96 13-06
Evaluate the adequacy of design of the
turbine impulse AFW actuation circuitry
which the UFSAR required to be independent
to prevent a common mode failure (Section
I.F.2).
50 327, 328/96-13 07
Failure to follow TS 3.3.1.22.G. Action 14
(Section II.A.2).
,
. - . _ . _ _ . . . _. . . _ . . . . _ . _ . _ . _ _ . . _ _ _
. - . _ . _ . . _ _ _ - _ . . _ . _ . . .
. . . _ . _ _ _ . . _ .
. _ . . .
,
F
,
!
'
2
.
.
.
.
,
>
\\
24
i
i
i
~
i
2
50 327, 328/96-13 08
Failure to Follow Procedure mil 0.'9.1 and
!
j
Failure to Provide an Adequate MI 10.9.1
.
!
Procedure (Section II.B.2).
l
1
!
50 327. 328/ % 13-09
Failure to Perform an
l
d
Operability /Reportab111ty Determination
!
(Section II.D.2).
.
i
q.
,
,
s
l'
i
-
<
i
!
i
>
r
i
l
\\
j
l
-
3
i
)
.
i
!
i
!
I
i
l
1
l
-
l
i
i
l
1
i
.
_..
'34386
Federal Register / Vol 60, No.126 / Friday, June 30, 1995 / Notices
factors in arriving at the appropriate
is not held, the licensee will normally
is a matter of public reco ci, such as an
severity level will be dependent on the
be requested to pr~4de a written
adjudicatory decision trf the
circumstances of the violation.
response to an inspan report,if
Department of Labor. la addition, with
However,if a licensee refuses to correct issued, as to the licensee's views on the the approval of the Exo:utive Director
a minor violation within a reasonable
apparent violations and their root
for Operations, conferences will not be
time such that it willfully continues, the causes and a description of planned or
open to the public where good cause has
violation should be categorized at least
implemented corrective action.
been shown after balancing the benefit
at a Severity LevelIV.
During the predecisional enforcement of the public observation against the
D. Violations ofReporting Requirements c nference, the licensee, vendor, or
potentialimpact on the agency's
other persons will be given an
enforcement action in a particular case.
The NRC expects licensees to provide opportunity to provide information
As soon as it is determined that a
complete, accurate, and timely
consistent with the purpose of the
conference will be open to public
information and reports. Accordingly,
conference, including an explanation to observation, the NRC will notify the
unless otherwise categorized in the
the NRC of the immediate corrective
licensee that the conference will be
-
Supplements, the severity level of a
actions (if any) that were taken
open to public observation as part of the
violation involving the failure to make
following identification of the potential agency's trial program. Consistent with
a required report to the NRC will be
violation or nonconformance and the
the agency's policy on open meetings,
based upon the significance of and the
long-term comprehensive actions that
" Staff Meetings Open to Public "
circumstances surrounding the matter
were taken or will be taken to prevent
published September 20,1994 (59 FR
that should have been reported.
recurrence. Licensees, vendors, or other 48340), the NRCintends to announce
However, the severi y level of an
persons will be told when a meeting is
open conferences normally at least to
t
untimely report, in contrast to no report, a predecisional enforcement conference. working days in advance of conferences
,
may be reduced depending on the
A predecisional enforcement
through (1) notices posted in the Public
circumstances surrounding the matter.
conference is a meeting between the
Document Room,(2) a toll-free
A licensee will not normally be cited for NRC and the licensee. Conferences are
telephone recording at 800-952-9674,
a failure to report a condition or event
normally held in the regional offices
and (3) a toll-free electronic bulletin
unless the licensee was actually aware
and are not normally open to public
board at 800-952-9676. In addition, the
of the condition or event that it failed
observation. However, a trial program is NRC will also issue a press release and
to report. A licensee will, on the other
hand. nermally be cited for a failure to
being conducted to open approximately notify appropriate State liaison officers
25 percent of all eligible conferences for that a predecisional enforcement
,
report a condition or event if the
i
public observation, i.e., every fourth
conference has been scheduled and that
licensee knew of the information to be
eligible conference involving one of
it is open to public observation.
reported.,but did not recognize that it
three categories of licensees (reactor,
The public attending open
was reqmred to make a report.
hospital, and other materials licensees)
conferences under the trial program may
V, Predecisional Enforcement
will be open to the public. Conferences
observe but not participate in the
Conferences
will not normally be open to the public
conference. it is noted that the purpose
c
"
'
,
Whenever the NRC has learned of the if t e enforcement action being
, al pr g a
nttm Im ze
C " you,ld b'e taken against an
public attendance, but rather to
existence of a potential violation for
,
(3)
which escalated enforcement action
appears to be warranted, or recurring
individual, or if the action, though not
determine whether providing the public
,
nonconformance on the part of a
taken against an individual, turns on
with opportunities to be informed of
whether an individual has committed
NRC activities is compatible with the
vendor, the NRC may provide an
doing.
NRC's ability to exercise its regulatory
wron$nvolves significant personnel
and safety responsibilities. Therefore,
op ortunity fora predecisional
(2)
en orcement conference with the
failures where the NRC has requested
members of the public will be allowed
i
licensee, vendor, or other person before that the individual (s) involved be
access to the NRC regional offices to
taking enforcement action. The purpose
of the conference is to obtain
present at the conference:
attend open enforcement conferences in
information that will assist the NRC in
(3)Is based on the findings of an NRC accordance with the " Standard
Office ofInvestigations report;or
Operating Procedures For Providing
determining the appropriate
(4) Involves safeguards information.
Security Support For NRC Hearings And
enforcement action, such as:(1) A
Privacy Act information, or information Meetings," published November 1,1991
common understanding of facts. root
which could be considered proprietary; (56 FR 56251).These procedures
causes and missed opportunities
In addftlon, conferences will not
provide that visitors may be subject to
associated with the apparent violations, normally be open to the public if:
personnel screening, that signs, banners,
(2) a common understanding of
(5) The conference involves medical
posters, etc., not larger than 18" be
corrective action taken or planned, and
misadministrations or overexposures
permitted, and that disruptive persons
(3)a common understanding of the
and the conference cannot be conducted may be removed.
'
significance ofissues and the need for
without disclosing the exposed
Members of the public attending open
lasting comprehensive corrective action. Individual's name: or
conferences will be reminded that (1)
If the NRC concludes that it has
(6) The conference will be conducted the apparent violations d!scussed at
sufficient information to make an
by telephone or the conference will be
predecisional enforcement conferences
informed enforcement decision, a
conducted at a relatively small
are subject to further review and may be
conference will not normally be held
licensee's facility.
subject to change prior to any resulting
unless the licensee requests it. However,
Notwithstandmg meeting any of these enforcement action and (2) the
an opportunity for a conference will
criteria, a conference may still be open
statements of views or expressions of
normally be pruvided before issuing an
if the conference involves issues related opinion made by NRC employees at
order based on a violation of the rule on to an ongoing adjudicatory proceed %g
predecisional enforcement conferences,
Deliberate Misconduct or a civil penalty with one or more intervenors or where
or the lack thereof, are not intended to
to an unlicensed person. If a conference the evidentiary basis for the conference
represent final determinations or beliefs.
8
Enclosure 2
____
____.________-.m
. . ~ .
- __ _ __ _ _ _ -
___
,
,
i
'
-
.
.
.
.
Federal Register / Vol. 60, No.126 / Fridry, June 30, 1995 / N:tices
34387
.
.
-
<
)
Persons attending open conferences will to be under oath. Normall , responses
management involvement in licensed
j
be provided an opportunity to submit
under oath willbe required only in
activities and a decrease in protection of
wntten comments concerning the trial
connection with Severity Level l, II, or
the public health and safety,
3
program anonymously to the regional
- IIIviolations or orders.
office.These comments will be
The NRC uses the Notice of Violation
1. Base Civil Penalty
,
l
subsequently forwarded to the Director
as the usual method for fonnalizing the
The NRC imposes different levels of
j
of the Office of Enforcement for review
existence of a violation. lssuance of a
penalties for different severity level
{
and consideration.
.
Notice of Violation is normally the only violations and different classes of
- _
When needed to protect the public
enforcement action taken, ~ xcept in '
licensees, vendorr, and other persons.
e
health and safety or common defense
cases where the criteriefor issuance of
Tables 1A and 1B show the base civil
and security, escalated enforcement
civil penalties and orders, as set forth in penalties for various reactor, fuel cycle,
action, such as the issuance of an
Sections VI.B and VI.C. respectively, are materials, and vendor programs. (Civil
2
.
immedbtely.ffective order, willbe
met. However, special circumstances
penalties issued to individuals are
taken before tb conference.In these
regarding the violation findings may
determined on a case-by. case basis.) The
!
cases, a confer ace may be held aner the warrant discretion being exercised such structuiu of these tables generally takes
j
escahted enforcement action is taken.
that the NRC refrains from issuing a
into account the gravity of the violation
VI.Enfamnt Actim
Notice of Violation. (See Section VII.B,
as a primary consideration and the
Mitigation of Enforcement Sanctions.,,)
in addition, licensees are not ordinarily ability to pay as a secondary
This section describes the
consideration. Generally, operations
.
enforcement sanctions available to the
cited for violations resulting from
i""l'i"8 8
uct*
ri 1
N 'C and specifies the conditions under matters not within their control, such as
wlich each may be used. The basic
equipment failures that were not
[j
c", to
c : d licensee
d
lal
i
i
enforcement sanctions are Notices of
-
p
avmdable by reasonable licensee quality 'mPgf" recoghigher c
Violation, civil penalties, and orders of
assurance measures or management
' 8
i.
various types. As discussed further in
controls. Generally, however, licensus ["*
- b
I
"'"*Y*****
8
'*
Section VI.D, related administrative
are held responsible for the acts of their j' *
'
actions such as Nctices of
emplo
. Accordingly,this policy
nW
nt t on
" " *
'
be construed to excuse
j
Conf at
Acti n
s,
tt
f'
economic impact of a civil penalty be so
per onne e 9g
i
Reprimand, and Demands for
severe that it puts a licensee out of
Information are used to supplement the
B. Civil Penalty
business (orders, rather than civil
I
!
enforcement program. In selecting the
A civil penalty is a monetary penalty
Penalties, are used when the intent is to
Su8 Pend or terminate licensed,s ab
activities)
j
enforcement sanctions or administrative that may be imposed for violation of (1)
or adversely affects a licensee
t
actions, the NRC will consider
certain specified licensing provisions of
enforcement actions taken by other
the Atomic Energy Act or
to safely conduct licensed activities.
Federal or State regulatory bodies
supplementary NRC rules or orders: (2)
The deterrent effect of civil penalties is
having concurrent jurisdiction, such as
any requirement for which a license
best served when the amounts of the
,
e
in transportation matters. Usually,
may be revoked: or (3) reporting
Penalties take into account a licensee's
-
whenever a violation of NRC
requirements under section 206 of the
ability to pay,in determining the
l
requirements of more than a minor
Energy Reorganization Act. Civil
amount of civil penalties for licensees
concern is identified, enforcement
penalties are dosi ned to deter future
for whom the tables do not reflect the
'
action is taken. The nature and extent of violations both b the involved licensee ability to pay or the gravity of the
i
!
the enforcement action is intended to
as well as by oth r licensees conducting violation, the NRC will consider as
I
reflect the seriousness of the violation
similar activities and to em hasize the
necessary an increase or decrease on a
j
involved. For the vast majority of
need for licensees to identih violations
case-by. case basis. Normally, if a
j
licensee can demonstrate financial
i
violations, a Notice of Violation or a
and take prompt comprehensive
,
l
Notice of Nonconformance is the normal corrective action.
hardship, the NRC will consider
1
action.
Civil penalties are considered for
Payments over time, including interest,
i
Severity Level III violations. In addition, ratbr than reducing the amount of the
,
j
civil penalties will normally be assessed civil penalty. However, where a licensee
j
j
A Notice of Violation is a written
for Severity Level I and II violations and claims financial hardship, the licensee
j
notice setting forth one or more
knowing and conscious violations of the will normally be required to address
i
i
violations of a legally binding
reporting requirements of section 206 of why it has sufficient resources to safely
requirement. The Notice of Violation
the Energy Reorganization Act.
conduct limnsed activities and pay
normally requires the recipient to
Civil penalties are used to encourage
license and inspection fees.
provide a written statement describing
prompt identification and prompt and
2. Civil Penalty Assessment
.
(1) the reasons for the violation or, if
comprehensive correction of violations,
'
contested, the basis for disputing the
to emphasize compliance in a manner
In an effort to (1) emphasize the
violation: (2) corrective steps that have
that deters future violations, and to
importance of adherence to
i
been taken and the results achieved: (3) serve to focus licensees' attention on
requirements and (2) reinforce prompt
j
corrective steps that will be taken to
violations of significant regulatory
- self-identification of problems and root
4
prevent recurrence; and (4) the date
concern,
causes and prompt and comprehensive
when full compliance will be achieved.
Although management involvement,
correction of violations, the NRC
4
The NRC may waive all or portions of
direct or indirect,in a violation may
reviews each proposed civil penalty on
!
a written response to the extent relevant lead to an increase in the civil penalty,
its own merits and, after considering all
information has already been provided
the lack of management involvement
relevant circumstances, may adjust the
i
to the NRC in writing or documented in may not be used to mitigate a civil
base civil penalties shown in Table 1A
J
an NRC inspection report.The NRC may penalty. Allowing mitigation in the
and 1B for Severity Level I, II, and III
l
require responses to Notices of Violation latter case could encourage the lack of
violations as described below,
i
9
4
.
. _ _ _ _ _ ._, ,__
_
_
-
__ _,
.
..
.!