ML20135A990
| ML20135A990 | |
| Person / Time | |
|---|---|
| Site: | Salem  |
| Issue date: | 07/19/1994 |
| From: | Zannoni D NEW JERSEY, STATE OF |
| To: | Jeffrey Jacobson NRC |
| Shared Package | |
| ML20135A581 | List: |
| References | |
| FOIA-96-351 NUDOCS 9612040120 | |
| Download: ML20135A990 (65) | |
Text
._
.sg n u. t - e.w u.= t. :.n.
su>
an
~ w m
- L'1 4
\\
\\
JSinte of)Tefa 3rrseg i
DEPARTMENT OF ENVIRONMENTAL PROTECTION AND ENeucy Cnaisner Topo Wanu4u Division of Environmental Safety, Health, gonar c, saisu, ya, covernor and Analytical Programs comma,vonn i
Radiation Protection Programs Bureau of Nuclear Engineering CN 415 July 19, 1994 Mr. Jeff Jacobson, Team Leader NRC Salem 1 and 2 Comprehensive Pilot Inspection U.S.
Nuclear Regulatory Commission
)
Washington D.C.
20555-0001 4
Subject:
New Jersey DEP Compilation Salem 1 and 2 Performance Data
Dear Mr. Jacobson:
1 The New Jersey Nuclear Enginecring Section (NES) ev'aluates various issues portaining to the four operating nuclear power plants in our State. Though a state representativo can not directly participate in the first part of Salem 1 and 2 Comprehensive Pilot Inspection at NRC Headquarters, we.are very interested in'this undertaking. We hope that the results of this NRC inspection will play an important role in assisting PSE&G as they seek to improve the management and operational performance of Salem 1 and 2.
Though I can not assist you directly in this undertaking, the NES has compiled Salem 1 and 2 data which may be of assistance l
during your review. Please find onclosed for your information some performance related data.
The NES also has available a review of the open safety issues at Salom 1 and 2 and specific information related to management oversight of Salem 1 and 2.
We will send this information to you shortly.
l 4
" ~ ~ * -
9612040120 961120 ployer
,,, g
[ILi~ btji.
i t t : 1 - i. i.' '.4 - v.. ' - i.. 'O i..
sui l ':. + 4 14ii. i o.i :
r.>..
i i
i page 2 D. J. Zannoni No response is required. If you have any questions, please contact me at 609-987-2037. Otherwise, I will reach you prior to August 15, 1994 in order to make arrangements in preparation for my participation in the inspection at Artificial Island.
l l
l Sincerely, l
W h.
ennis J.
2Netino Supervisor NES, NJDEP c
Manager Tosch l
1 I
I l
l l
j
< TRANSACTION REPORT >
07-19-1994(TUE) 07:57
[
RECEIVE 3
4 NO.
DATE TIME DESTINATION STATION PO.
DURATION t10DE RESULT J
22095 7-19 07:55 1 609 987 6356 2
O*01'04" NORt1AL OK 2
O'01'04" i
l l
l 1
l l
i 1
i a
=.-
s
/
4
1.0 INTRODUCTION
4 k'
in accordance with the July 1987 general agreement between the Nuclear Regulatory Commission (NRC) and the New Jersey Department of Environmental Protection (DEP), this report has been prepared by the DEP's Bureau of Nuclear Engineering (BNE), Nuclear Engineering Section (NES), to summarize for the NRC and the DEPE management, other l
agencies, and the public the results of the Section's specific reviews and investigations pertaining to the operation of the nuclear power plants operating within New Jersey, The report also informs the nuclear power plant licensees of the NES's activities and specific concerns. Significant concerns have been discussed with the NRC and respective utilities through correspondence and
^
meetings. The report documents the reviews, investigations, and other activities performed by the NES during 1993.
There are seven sections in the report. Section 2 provides background information on l
the function of the BNE and the NES. Section 3 provides a brief description of the nuclear power plants operating within the State (Hope Creek, Salem Units I & 2, and Oyster Creek).
i Sections 4,5, and 6 present the results of reviews and investigations relating to Hope Creek, t
Salem Units 1 & 2, and Oyster Creek, respectively. Section 7 describes other activities of the l
NES, during the year.
J i
J DMT 1993 NES ANNUAL REPORT
i
2.0 BACKGROUND
INFORMATION 2.1 THE BUREAU OF NUCLEAR ENGINEERING The Atomic Energy Act of 1954, as amended, gives the Federal Government exclusive authority and responsibility for regulating the construction and operation of nuclear power plants.
This authority is implemented through a federal agency, the Nuclear Regulatory Commission (NRC).
Although states have no direct regulatory authority over the operation of nuclear power plants, they do have an inherent responsibility to prcitect the health and safety of their residents, and the environment within their borders. Consequently, the NewJersey legislature passed the New Jersey Radiation Accident Response Act in 1981 (N.J.S.A. Title 26:2D-37 et seq.). Pursuant to the Act, the New Jersey DEP's Bureau of Nuclear Engineering (BNE) performs the state functions that are necessary to rronitor the safety of the nuclear power plants operating within New Jersey (Oyster Creek Hope Creek, and Salem Units I & 2).
The BNE consists of three sections (1) tne Nuclear Engineering Section;(2) the Nuclear Emergency Preparedness Section, which is responsible for nuclear emergency planning activities; j
and (3) the Nuclear Environmental Engineering Sectican, which is responsible for radiological environmental monitoring near the power plants. Through the activities of these sections, the BNE is able to provide an adde.' evel of confidence to the residents of the state that the nuclear power plants in New Jersey are operated, maintained, and regulated in an acceptable manner.
In order to perform its function, the BNE routineiy interacts with both the NRC and the utilities that own and operate the plants. The NES-NRC relationship is formally documented in a July 1987 letter from then NRC Region I Administrator W. Russell to then Department of Environmental Protection (DEP) Commissioner R. Dewling. The letter establishes the guidelines for communication between the NES and the NRC, including the observation of NRC inspections by NES staff members. The relationship between the NES and the plant licensees has been established over the years through memoranda of understanding, as well as informally.
2,2 THE NUCLEAR ENGINEERING SECTION The BNE's Nuclear Engineering Section (NES) is responsible for the nuclear safety review of plant operations, including the technical review of nuclear power policy and licensing issues.
The goals of the NES's efforts are to: (1) understand the operation of the nuclear power plants under normal, transient, and accident conditions; (2) assess the operation of the plants and identify potential, or real, problems before they impact the environment or affect the state's ability to respond to a nuclear emergency;(3) assess the effectiveness of the NRC's regulatory process from a state perspective.
The NES currently consists of six engineers with experience in the nuclear industry. Two
)
1
<. o x 2-2 1993 NES ANNUAL REPORT
l cf the engineers are assigned responsibility for the surveillance of the power plants and have full unescorted access to the plants. O: a engineer is responsible for the two boiling water reactors -
Oyster Creek and Hope Creek and the other engineer is reponsible for the two pressurized I
water reactors - Salem I and 2. These engineers visit each nuclear site once every 2 weeks and participate as observers in NRC inspections of the nuclear facilities. These engineers attend NRC enforcement conference meetings and other operations related meetings for the plants operating in New Jersey.
Three other engineers review and analyze pertinent plant safety issues, generic issues and proposed rules. Two of these engineers are NewJersey's "No Significant Hazards Contact" with the NRC for the review of license and technical specification change requests as required under 10 CFR Part 50.91. These engineers frequently attend NRC meetings and workshops at NRC headquarters in Bethesda, Md. and meet with or phone appropriate utility staff to discuss our concerns.
The sixth engineer, the Section's supervisor, coordinates the efforts of the NES with those of the other two BNE sections and other Divisions within the DEPE, other agencies, and the utilities.
The engineering section supports other programs within the BNE. Specifically, engineers have assignments for emergency response to both nuclear power plant emergencies and transportation emergencies. One engineer supports the BNE Manager in his role as the Governor's designee for notifications of high level radioactive waste shipments into New Jersey.
The foundation of the NES surveillance program is the technical review of the documentation that flows between the NRC and the plant licensees. The review of this documentation keeps the NES abreast of activities at the plant. The documentation includes:
NRC notices of violations; licensee event reports (LERs); non-emergency event notifications; monthly operating reports: NRC inspection reports; license change requests: NRC Information Notices; and NRC Generic Letters and Bul!etins, including licensee responses. The NES also reviews proposed NRC regulations and policy; NRC reports; and stays abreast of industry issues and events through such publications as Nucleonics Week Nuclear News, the Nuclear Monitor, Nuclear Waste News, and the Federal Register. The NES reviews the documentation within the context of the section's previously stated goals. In this manner, the NES focuses its resources on those nuclear power plant topics appropriate for state concern.
In addition, the NES visits the plant sites on a routine basis. During these visits, the NES meets with the NRC or the licensee to discuss particular issues and walk through the plant to observe activities at the plant and to assess its physical condition. As outlined in the July 1987 letter from then NRC Region i Administrator W. Russell to then DEP Commissioner R. Dewling, the NES also participates as observers in NRC inspections. By observing these inspections, the l
NES gains greater insight into the focus and scope of the NRC inspection process and can better assess the licensees operational and management ability and the NRC regulatory effectiveness.
if the NES develops a concern with some aspect of plant operation,it is usually expressed U+N 2-3 1993 NES ANNUAL REPORT
directly to the NRC and the plant licensee. In addition, the efforts of the NES result in enhancements to the state's nuclear emergency response plans, increased training and education of state nuclear emergency responders, and improvements of the BNE's radiological environmental monitoring system near the plant sites.
Finally, through attendance at NRC workshops, NRC and utility training classes and meetings with NRC and utility personnel, the BNE obtains first-hand information related to industry and regulatory problems. It also provides an on-going means to insure that the professional development of the staff is maintained. This forum also allows the BNE to interject concerns of the State into the regulatory process.
l DwW 2-4 1993 NES ANNUAL REPORT
3.0 FACILITY DESCRIPTIONS 1
3.1 HOPE CREEK NUCLEAR GENERATING STATION The Hope Creek Nuclear Generating Station i: operated by the Public Service Electric
& Gas Company (PSE&G). The station is located on the east bank of the Delaware River in Lower Alloways Creek Township, Salem County on a manmade isfr.d called Artificial Island.
J 4
Two other nuclear power plants. Salem Units I and 2, share this site. Figure 3-1 is a photograph showing all three power plants. The Hope Creek Station uses a General Electric designed boiling water reactor to generate steam. A natural-draft cooling tower is used to dissipate waste heat.
The licensed thermal power of the station is 3293 megawatts-thermal (MWt) with a design electrical rating of 1067 megawatts-electric (MWe). Hope Creek received its full-term operating license (FTOL) on July 25,1986, and began commercial operation on December.20, 1986. The FTOL expires on July II,2026.
3.2 SALEM NUCLEAR GENERATING STATION The Salem Nuclear Generating Station is also operated by PSE&G, and also located on Artificial Island, approximately one half mile south of the Hope Creek Station. The Salem Station consists of two units, Units I & 2. Each unit uses a Westinghouse designed pressurized water reactor to generate steam. The station draws cooling water directly from, and discharges it back to, the Delaware River (i.e., no cooling towers are used).
i The licensed thermal power of each Unit is 3411 MWt with a design electrical rating of II15 MWe. Unit I received its FTOL on December I,1976, and began commercia operation on June 30,1977. The Unit l FTOL expires on August 13,2016. Unit 2 received its FTOL on May 20,1981, and began commercial operation on October 13,1981. The Unit 2 FTOL expires on April 18,2020.
3.3 OYSTER CREEK NUCLEAR GENERATING STATION The Oyster Creek Nuclear Generating Station is operated by the GPU Nuclear Corporation. The station is located in Lacey Township, Ocean County near Barnegat Bay. The Oyster Creek Station uses a General Electric designed BWR to generate steam. It draws and discharges cooling water from and to the Barnegat Bay.
The licensed thermal power of the station is 1930 MWt with a design electrical rating of 650 MWe, Oyster Creek received a provisional operating license on August I,1969, and um 3-5 1993 NES ANNUAL REPORT
l began commercial operation on December 23,1969. The station received its FTOL from the NRC on July 2,1991. The FTOL expires on April 9,2009.
l I
l l
I l
l l
l l
i M
3-6 1993 NES ANNUAL REPORT
4 5.0 SALEM NUCLEAR GENERATING STATION 5.1
SUMMARY
OF STATION OPERATION 5.1.1 Salem Unit 1 Salem Unit I operated at full power until January 15, when power was reduced to repair a Steam Generator Feed Pump coupling. The Unit was shutdown on January 16 to repair a leaky flange on a reactor head vent line. The reactor was manually tripped during the shutdown due to the failure of the main steam bypass system controls. The Unit returned to full power on January 26.
On February 16, the reactor was automatically shutdown following a suspected failure of a component in the reactor protection system. One of four delta T channels was out of service for calibration when the No. II loop delta T channel failed, satisfying the automatic shutdown logic of two out of four signals. The problem was corrected and the Unit returned to power opaation on February 23. The Unit achiesed full pcwer on February 27, and, with the exception of minor power reductiors for main condenser waterbox cleaning and repairs to the #1 I Heater Drain Pump controls, continued to operate at essentially full power through March.
The Unit operated at reduced power for a majority of April due to high tides and associated debris impingement restricting the heat transfer capability of the Circulating Water System. The Unit operated at full power for most of May. Power was reduced for a few days for condenser waterbox cleaning and main transformer isophase bus cooling unit repair.
On June 8, the plant automatically shutdown due to large islands of matted grass restricting flow to the circulating water pumps. While shutdown for dredging operations to remove the debris accumulation, plant personnel also evaluated the rod control system for any problems similar to those encountered at Salem Unit 2 in 1992. The plant returned to power operation on June 21. On July 11, the reactor tripped on low water level in the #14 steam generator caused by inadvertent closure of a feedwater regulating valve. The Unit was returned to service on July 21 attained 100% power on July 23 and remained at full power until July 28, when power was reduced to 58% due to main condenser vacuum problems. The Unit was returned to 100% power the same day and remained at essentially full power during August and September. The Eleventh Refueling Outage began on October 2,1993. The Outage completion date, originally scheduled for December 16,was delayed untilJanuary 1994 to perform an analysis of a Emergency Diesel Generator (EDG) cylinder liner.
Figure 5-1 is a graph of the Unit's electrical capacity factor for each month of 1993. The capacity factor for 1993 for Salem Unit I was 60%, compared to 54% for 1992. Capacity factor
,W 5-1 1993 NEs ANNUAL REPORT
4 1
j 1
1 1
}
is the plant's actual cumulative electrical output divided by the cumulative output had it operated at 100% of design capacity for the entire period.
1 j
S.1.2 Salem Unit 2 Salem Unit 2 was manually shutdown on January 28,1993 after the loss of both steam j
generator feed pumps due to low suction pressure. The problem was corrected and the Unit returned to full power on February 4. The Unit operated at essentially full power until March 17, when the Unit began it's Seventh Refueling Outage. Completion of the outage, originally scheduled for May 31, was extended to July 5 due to problems identified with the rod control system. These problems were identified during unsuccessful start-up attempts in late May.
a j
The Unit attained 100% power on July 10, and remained at essentially full power until j
October 5, when power was reduced for switchyard modifications. The Unit was returned to full power on October 20, and remained that way until December 3, when the Unit was
)
4 shutdown due to failure of a EDG cylinder liner. The Unit remained shutdown for the duration of December as root cause analysis and subsequent repairs continued.
Figure 5-1 is a graph of the Unit's electrical capacity factor for each month of 1993. The capacity factor for 1993 for Salem Unit 2 was 57% unchanged from 1992.
FIGURE 5-1 Salem Station Unit Capacity Factor 1993 4
e 4,
pfI 't 5-2 1993 NES ANNUAL REPORT
I l
5.2 SITE VISITS l
I NES personnel visit the Station to confer with the NRC Resident inspectors and PSE&G l
personnel on the status of plant operations, technical assessments and corrective action, to observe specific in-plant maintenance and modification activities, to gain first hand knowledge about problems identified in NRC violations and Licensee Event Reports, and to participate as an observer of NRC plant walkdowns and inspections.
NES personnel assigned to visit the nuclear power plants are fully qualified as nuclear workers and badged for unescorted access to all Vital Access areas of the plant. This level of access requires medical and security screening, General Employee Training and testing, and radiation worker training and testing. In addition, these NES personnel have successfully completed specialized inspection training provided by the NRC.
l During 1993, the NES staff member responsible for observing Salem activities visited the Salem site on ten occassions. Some of the activities observed included: NRC inspection of the Salem Technical Support Center (TSC); Salem Unit refueling operations including a walkdown of the Containment Building and Fuel Handling Building; Salem non-radioactive industrial waste water treatment facility operations: N.J. DEPE required oil catch basin installations; and troubleshooting and repair of cylinder liners on Emergency Diesel Generators. Several technical issues investigated included: a technical specification discrepancy; Emergency Response Data System (ERDS) avai%ility; Shift Technical Advisor (STA) duties; outage maintenance and modification activities; and the safety significance of selected NRC Information Notices, Bulletins, Generic Letters and 10 CFR 50.72 notifications. In addition, the NES staff members routinely performed walkdowns of accessible areas of the plant to observe housekeeping, maintenance activities, and general condition of plant equipment.
S.2.1 Coordination of NRC Insoections 1
On March 3,1993, two NES staff members met with NRC resident inspector at Artificial Island. The meeting was held to discuss BNE participation in upcoming NRC inspections. In addition, the NRC resident inspectors identified documents for BNE review in preparation for l
observing an upcoming inspection. Following the meeting, several BNE staff members toured the Salem Station.
In particular, Salem operational personnel provided a brief but informative overview of control room consoles and associated instrumentation.
5.2.2 Integrated Scheduling Program On May 12,1993, an NES staff member attended an NRC/PSE&G meeting at Artificial Island. The meeting was held to provide the NRC with a clear understanding of the PSE&G integrated Scheduling Program. The program was established to provide a comprehensive planning process for major, non-routine projects which would result in a more efficient use of wes 5-1 1993 NEs ANNUAL REPORT
personnel and financial resources on a single and multiple project basis. Major non-routine projects are defined as those which require more than 1000 total man-hours or cost more than
$50,000 to complete.
5.2.3 NRC Exit Meeting for Augmented Insoection Team On January 7,1993, the NRC held a public meeting at Artificial Island to present findings of the NRC Augmented Inspection Team (AIT) investigation. The AIT was formed to investigate a Loss of the Overhead Annunciator (OHA) System in the Salem Unit 2 Control Room on j
December 13,1992. A BNE staff member participated in the AIT investigation and also attended the exit meeting.
The AIT concluded that the incident was caused by design deficiencies associated with the OHA System. The AIT identified other deficiencies as a result of the investigation. These included inadequate system training for the operators and misinterpretation of emergency response procedures. The NRC fined PSE&G and subsequently corrected the overhead annuciator defiencies.
5.2.4 Rod Drive Control System Augmented Team insoection Following the refueling outage at Salem Unit 2, operators attempted to start-up the unit on four occasions between May 26 and June 2. Ench time problems were encountered with the rod drive control system, a system that controls movement of control rods and safety rods into and out of the reactor. On one occasion, one rod moved out of the core when given the signal j
to move into the core. On June 3, NRC Region i dispatched an inspector to investigate this j
problem. Based upon this initial investigation, the NRC decided to establish an Augmented Inspection Team (AIT). The AIT arrived on June 5 and included a BNE staff member as an official observer. On June 5, the AIT investigated the failures of the logic circuits attempting to identify a single root cause. Due to the massive amount of data, each team member began investigating a different facet of the problem based on his area of expertise.
Westinghouse, the designer of the control system, could not dismiss the possibility of a single component failure causing the rods to move out on a signal to move in. Interim corrective action was taken for Salem Unit I so that Unit I could operate until the root cause could be determined and permanently repaired. Westinghouse agreed to issue a notice to the nuclear power industry so that others were advised of the problem. Westinghouse-designed rod control systems are in use in 74 nuclear power plants world-wide.
On June 7, an AIT team member and the BNE staff member observed the Westinghouse testing program and identified concerns which resulted in changes. The BNE team member visually examined several printed circuit cards from the rod control system and discovered numerous flaws that could degrade system performance. The BNE staff member guided the ww 5-2 1993 NES ANNUAL REPORT
NRC inspector in the printed circuit inspection process, using the Salem quality assurance inspection standard. The NRC inspector then verified the findings of inadequate and damaged solder joints on the logic cards. Based on his findings, the NRC recommended that PSE&G perform a 100% visual inspection of the logic circuit cards in the rod drive system.
PSE&G determined that complete testing of every circuit card was required to determine the extent of the collateral damage and degradation to the logic circuits induced by the voltage spike. On June 26, the AIT reviewed the corrective action taken by PSE&G and concluded that the rod drive control problems had been satisfactorily resolved.
5.3 Operational issues 5.3.1 frosion/ Corrosion Program On February I l,1993, two BNE staff members attended a meeting with NRC and Public Service Electric and Gas Company (PSE&G) at NRC headquarters, in Rockville, Maryland. This meeting was scheduled by the NRC to discuss the Erosion / Corrosion Program currently being implemented at Salem and Hope Creek, and the status of licensing issues.
The NRC inspection of the Salem Unit i Erosion / Corrosion Program in May 1992 identified instances of use of operating conditions in place of design conditions for calculating minimum required piping thickness. As a result, PSE&G initiated its own internal review of their Erosion / Corrosion Monitoring Program. PSE&G has completed or has underway long term
)
1 corrective actions which include; development of program documents and implementing procedures; training of personnel to new program requirements, including CHEC family of computer codes; conversion from CHEC to CHECMATE program; and completion of an independent third party review of the program.
PSE&G informed the NRC that company-wide Total Quality Management program is being implemented. As a result, a new Quality Management position has been establi ed and Nuclear Quality Councils are being formed. Each council is a team of employees w'. are tasked with reviewing an existing process looking for ways to improve the process. Cw.cils for the spare parts program and the capital expenditure program are established. Eigid new positions are being filled at the site. These include 40 positions for a Central Maintenance Group and iI systems engineering positions for Salem.
5.3.2 NRC Walkdown Inspection On April 22, two BNE staff membes visited the Artificial Island facility to participate in a walkdown inspection of the Technicat Support Center (TSC) to inspect the operational readiness of the ventilation system. This system has been under review by the NRC and the BNE for the past year. The NRC inspection indicated that PSE&G implemented the appropriate p<
5-3 1993 NES ANNUAL REPORT i
corrective actions.
5.3.3 Integrated Scheduling Program This meeting was held at Artificial Island on May 12 to provide the NRC and other interested parties with a clear understanding of the PSE&G Integrated Scheduling Program. A BNE representative attended this meeting.
The program was established to provide a comprehensive planning process for major, non-routine projects which would result in a more efficient use of personnel and financial resources on a single and multiple project basis. Major, non-routine projects are defined as those which require more than 1000 total manhours or cost more than $50,000 to complete.
5.3.4 Salem Unit i Refueling Outare PSE&G met with NRC Region i personnel to present the status of Salem I refueling outage activities. The meeting was requested by PSE&G and was held in King of Prussia, PA on December 17,1993. A BNE representative attended. During this outage, numerous problems arose. Three events, two fires and one injured, potentially contaminated worker, resulted in the declaration of Unusual Events. PSE&G explained that actions taken to resolve problems were conservative, emphasizing safety over meeting the outage schedule. Examples cited were a work activity standdown (all outage activities on hold for 8 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to reemphasize safety first),
a letter to all employees from PSE&G's Vice President emphasizing safety, and in-depth root cause analysis of several issues. PSE&G reassured the NRC that the lessons learned from the current outage would provide useful insights 5 the planning and implementation of future outage activities.
j 5.3.5 Emergency Die:el Generator Cylinder Liner Failure PSE&G met with NRC Region I personnel to present investigation results regarding the December 3 failure of the 2C emergency diesel generator (EDG) cylinder liner. The meeting was held in King of Prussia, PA on December 21,1993 and a BNE representative attended.
The most probable root cause was determined to be a combination of contributing factors. These were 1) flange flatness, 2) flange perpendicularity, 3) upper "O" ring groove radius, and 4) potential of a flaw / crack. The cylinder liners that failed were manufactured by Canadian Allied Diesel and were not the original liners. These liners were installed in 1992 and 1993. The liners were replaced and the root cause analysis was accepted by the NRC.
pr 5-4 1993 NES AN,UAL REPORT
f 1
5.3.6 Licensee Event Reports NRC regulations require each licensee to submit a written report within 30 days containing information on certain significant operating events or problems. These reports are i
called Licensee Event Reports (LERs). The NES received and reviewed 20 LERs from Salem Unit I, and 13 LERs from Salem Unit 2 during 1993, compared to 26 and 17 LERs respectively during
)
1992. Design deficiencies was the leading cause in both 1992 and 1993.
l l
Figures 5-2 and 5-3 show the number of LERs by root cause in 1992 and 1993.
1 FIGURES-2 Salem Unit 1 LERs l
Root Cause Analysis 1993 T
1 I
i E
4 f
^
r i
3 l
i l
j 1992 Total - 26; 1993 Total 20 4
i i
}
b 4
i i
i l
4 l
vs. W W 1
5-5 1993 NES ANNUAL REPORT 1
3 l
I 4
r._._._.__.___.__._._
f i
l FIGURE 5-3 l
Salem Unit 2 LERs j
Root Cause Analysis 1993 i
a l
e 2
1992 Total 17.1993 Total-13 l
5.3.7 Non-Emerrency Event Notifications
]
l NRC regulations require notification from each licensee on an expedited basis for l
certain types of operational problems.
These are problems which are not classified as i
emergencies, but still warrant notification of the NRC within a short time, e.g. one hour or four l
hours.
t The NES receives all of these reports, referred to as nm-emergency event reports (NEEs). Figure 5-4 shows the number of NEEs by initiating condit. a, and Figure 5-5 shows the number of NEEs by root cause. During 1993, the NES received 47 NEEs compared to 101 in 1992. Actuation of Engineered Safety Features was the leading initiating event in 1992 and 1993.
i I
)
FU 5-6 1993 NES ANNUAL REPORT l
1 1
l 4
4
n-~.-.-
t t
1 1
1 i
FIGURE 5-4 Salem Non Emergency Event Notifications Root Cause Analysis 1993 o
l 1
I i
i l
l 1992 Towl - 101; 1993 Total 41 i
EMERGENCY CLASSIFICATION GUIDE - INITIATING CONDITIONS:
8E -
DISCHARGE OF ANY NON-RADIOACTIVE HAZARDOUS SUBSTANCE IN SUCH A CONCENTRATION AS MAY BE HARMFUL 8F -
C ISCHARGE OF OIL INTO OR UPON THE RIVER.
l l
10D -
MAJOR LOSS OF EMERGENCY ASSESSMENT CAPABILITY, OffalTE RESPOWSE CAPABILITY, OR COMMUNICATIONS i
CAPABILITY.
l 17D -
MAIOR LOSS OF EMERGENCY ASSESSMENT CAPABILITY, OFFSITE RESPONSE CAPABILITY, OR COMMUNICATIONS l
CAPABILITY.
17E -
UNUSUAL CONDITIONS WARRANTING A NEWS RELEASE OR NOTIFICATION OF GOVERNMENT AGENCIES.
IBF -
THE INITIATION OF ANY PLANT SHUTDOWN REQUIRED BY THE TECHNICAL SPECIFICATIONS.
18H -
ANY EVENT OR CONDITION DURING OPERATION THAT RESULTS IN THE CONDITION OF THE PLANT BEING SERIOUSLY
{
DEGRADED
[
1 81 -
MAJOR LOSS OF EMERGENCY ASSESSMENT CAPABILITY, OFFSITE RESPONSE CAPABILITY, OR COMMUNICATIONS CAPABILITY 18L -
ACTUATION OF ENGINEERED SAFETY FEATURE EXCEPT PREPLANNED.
l I BM -
REACTOR TRIP EXCEPT PREPLANNED.
18N -
ANY EVENT FOUND WHILE SHUTDOWN THAT WOULD HAVE SERIOUSLY DEGRADED PLANT.
l l
18P-EVENT CONDITION THAT ALONE COULD HAVE PREVENTED CERTAIN SAFETY FUNCTIONS I
t Ce # f l
5-7 1993 NES ANNUAL REPORT f
3 i -.
- =
l l
l l
FIGURE 5-5 l
l Salem Non Emergency Event Notifications Initiating Conditions 1993 t
4
)
I.
I e
5.3.7 NRC insoection Report Reviews & Notices of Violation (NOVs) l The NES routinely receives and reviews NRC Inspection Reports related to activities at the Salem Station. The NRC performs these inspections to ensure that activities are conducted in full compliance with NRC requirements. The NRC issues Notices of Violation (NOVs) for l
occurrences of non-compliance with NRC regulations. NOVs are classified as Severity Level I, 11, Ill, IV, or V according to the significance of the non-compliance, with Level I being the most severe.
The NES received and reviewed 33 NRC Inspection Reports during 1993, compared to 21 during 1992. Salem Units l And 2 were issued six NOVs in 1993, compared to three in 1992. A Severity Level IV violation was issued in all nine instances.
i Though the NRC inspections increased dramatically, the performance did not improve.
Says something about the NRC effectiveness.
i i
i i
WW 5-8 1993 NEs ANNUAL REPORT b
1
~
9 5.3.8 Systematic Assessment of Licensee Performance (SALP) i i
On July 29,1993, the NRC issued their initial report on the SALP for Salem Units I and 2 for the period of December 29,1991 and June 19, 1993. The purpose of the SALP is to determine how a particular plant is meeting regulatory expectations and to identify performance trends over a 12-18 month period.
The NRC rates performance on a scale of one to three. These are defined as:
Category 1: Licensee management attencion to and involvement in nuclear safety or safeguards activities resulted in a superior level of performance.
Category 2: Licensee management attention to and involvement in nuclear safety or safeguards actitities resulted in a good level of performance. NRC will consider j
l maintaining normal levels of inspection effort.
Category 3: Licensee management attention to and involvement in nuclear safety or safeguards resulted in an acceptable level of performance; however, because of the NRC's concern with a decreaase in performance may approach or reach j
an unacceptable level, NRC will consider increased levels of inspection effort.
The NRC can furthe-clarify the ratings as improving or declining. The NRC assessment of the Salem Station was fairly consistent with previous SALPs. Radiological controls, Emergency Preparedness, and Security functional areas were given the highest possible rating. The declining trend in Emergency Preparedness was primarily the result of failure to maintain the staff's ability to develop correct Protective Action Recommendations (PARS), as demonstrated during training, drills and exercises.
Table 5-1 provides the latest SALP ratings along with the results from the previous three rating periods.
5-9 1993 NEs ANNUAL REPORT
TABLE 6 Comparison of SALP Ratinas at Salem FUNCTIONAL AREA 88/89 89/90 90/91 91/92 Plant Operations 3
2 2
2 Radiological Controls 2
2 2+
l Maintenance / Surveillance 2
2-2 2
l I
l-Security i
I I
I Engineering / Tech. Support 2
2 2
2 Safety Assessment /
2 2
2 2
Quality Verification a
These SALP scores, though fairly constant over the past 4 rating periods, which cover j
approximately 6 years, is not indicative of the performance observed this past year. Contrary to the above SALP scores, the NES is recommending that increased NRC resources be directed at Salem I and 2 in order to assist PSEAG identify problems and develope proper corrective actions in order to bring about overall improved performance at Salem I and 2.
)
5.3.9 Performance Statistics Salem I had a three (1991 to 1993) year Net Capacity Factor was 61.27%, shich was 86 out of 108 reactors. Salem 2 had a three (1991 - 1993) year Net Capacity factor of 61.10%,
which was 87 out of 109 reactors. The best Net Capacity Factor in the country was Surry I with a Net Capacity Factor of 87.05%.
The capacity factor change from this period to the last period was a drop of 5.13% for Salem I and a drop of 4.38 for Salem 2. This ranks them 82 and 80, respectively. Salem I had a NET DER capacity factor of 66.40% during 1988 to 1990 period and Salem 2 had a net capacity factor of 65.48%. As indicated earlier, Artificial Island ranked 24 out of 35 for multi-plant site ranking with 68.2% down from 69.6% for 1988 to 1990. a drop of 1.4%. This is due to the dramatic decrease in performance output of both Salem I and 2.
PWR's have improved dramatically from the previous rating period. The average capacity factor for all PWR's during 1988 to 1990 rating period was 70.00% and the present average for all PWR's was 76.9%. Obviously Salem I and 2 fall well short of this average and in fact has l
l 5-10 1993 NEs ANNUAL REPORT
9 dropped when most other PWR's have improved. Again with the good perfromance of Hope a
Creek this raises questions about how Salem I and 2 were managed. Tha data also supports that most older reactors have made progress in improving output but not Salem I and 2.
. The Institute for Nuclear Power Operations (INPO) track eight performance indicators for the industry.
q
- 1. The average number of unplanned automatic scrams was.9 scrams for 7000 hours0.081 days <br />1.944 hours <br />0.0116 weeks <br />0.00266 months <br /> critical for 1993. The goal INPO established for the industry by 1995 was I scram per 7000 hours0.081 days <br />1.944 hours <br />0.0116 weeks <br />0.00266 months <br /> critical. Salem I had 1.5 unplanned automatic scrams for 7000 hours0.081 days <br />1.944 hours <br />0.0116 weeks <br />0.00266 months <br /> critical and Salem 2 had 1.9 unplanned automatic scrarns for 7000 hours0.081 days <br />1.944 hours <br />0.0116 weeks <br />0.00266 months <br /> critical. This is well short of the national average and short of INPO's goal..
2
- 2. The unplanned capability loss factor was 4.3% capability loss for 1993. The INPO goal l'
for 1995 is 4.5%. Salem l's unplanned capability loss factor was 16.9% for 1993 and Salem 2's j
unplanned capability loss factor was 23% for 1993. This is way above the national average and the INPO goal.
3 l
2
- 3. The collective radiation exposure at PWR's for 1993 was 193 man-rem per unit. The goal is 185 man-rem per unit for 1995. Salem l' accumulated 267 man-rem and Salem 2 accumulated 161 man-rem during 1993. Salem I exceeded the national average and is above the INPO goal. Salem 2 on the other hand, is below both the national average and has alrady met the INPO goal.
- 4. The average unit capability factor'for PWR's was 77.3 for 1993. The INPO goal for 1995 is 80.00%. Salem I had a unit capability factor of 63.3% and Salem 2 had a unit capability factor of 61.8%. Both Salem I and 2 are far below the national average and the INPO goal.
- 5. The volume of low level radioactive waste (LLRW) generated at PWR's was 45 cubic meters per unit in 1993. The INPO goal for 1995 is i10 cubic meters per unit. Salem I generated 38 cubic meters and Salem 2 generated 39 cubic meters. As in the case for Hope -
Creek, PSE&G should be credited with making substantial progress in reducing the amount of LLRW generated at Salem I and 2.
6 The thermal performance for 1993 PWR's was 10,191 bru/kwh. Salem I had a thermal performance of 10,241 btu /kwh and Salem 2 had a thermal performance of 10,407 btu /kwh.
Salem I and 2 were at the national average.
- 7. The industrial safety accident rate for 1993 was.77 accidents rer 200,000 man-hours.
The INPO goal for 1995 is.5 accidents per 200,000 man-hours. Salem I had 1.24 accidents per 200,000 man-hours and Salem 2 had 1.24 accidents per 200,000 mm-hours. Some improvement in this area is needed.
5-11 1993 NES ANNUAL REPORT
- 8. The safety system performance for 1992 was 92% of systems achieving 1995 goal. The INPO goal is 85%. Salem I and 2 had a 100% safety system performance. This is for HP Injection System, Aux feedwater system and Emergency AC Electrical System 5.4 Review of Technicalissues 5.4.1 Soent Fuel Storage PSE&G met with the NRC on March 4,1993 to discuss the content of the license change request that is needed to rerack the spent fuel pools at Salem Units I and 2. The current spent fuel pools have i170 cells. At the current discharge rate the ability to discharge a full core into the spent fuel pool will be lost in 1998 and 2002 for Salem Units I and 2, respectively. The reracking will expand the existing capacity to 1632 cells at each unit. This will provide storage, while maintaining the ability to discharge a full core until 2007 and 201I for Salem Units I and 2, respectively.
The additional space will be achieved by changing the pitch of the cells. The old racks had a pitch of 10.5 inches and the new racks will have a pitch of 9.05 inches. The fuel handling crane, which has a 5-ton limit will be upgraded or replaced so that it can be used to remove the old racks and install the new racks.
PSE&G submitted Licensing Change Request 93-02 to the NRC in April 1993 which requested approval for this increased storage capicity. As of the end of 1993 the NRC and NES reviews were not complete.
5.4.2 NUREG-1435. Suoolement 2. " Status of Safety issues at Licensed Power Plants" In December 1992, the NRC issued NUREG-1435, Supplement 2. " Status of Safety issues l
at Licensed Power Plants." The NUREG documents the implementation status of four different l
categories of safety issues at U.S. nuclear power plants through September 1992. The four categories are (1) Three Mile Island Action Plan Requirements,(2) Unresolved Safety issues (3)
Generic Safety issues, and (4) Other Multiplant Action issues. In this revision, the NRC added the status of Multiplant Action issues for the first time. This category consists of Generic Letters and Bulletins.
j After reviewing the information presented in NUREG-1435, Supplement 2, the BNE concluded that the nuclear power plants operating within New Jersey have all made progress in resolving applicable safety issues. The closure of these types of issues for New Jersey plants is on a par with the rest of the industry.
Three Mile Island (TMn Action Plan Reauirements I
l
\\
f I
D(Y 5-12 1993 NEs ANNUAL REPORT
i 1
1 Of the more than 100 safety issues that arose as a result of the accident at TMI, only i
Salem Units I and 2 have any of these issues open. Each unit has the same issue still open, the Control Room Design Review.
1 Unresolved Safety ls5ues (US!s)
For Salem I, two of 16 applicable USIs remain open. The two remaining issues are Station Blackout and Seismic Qualification.
I For Salem 2, two of 17 applicable USis remain open. The two remaining issues are Station l
Blackout and Seismic Qualification.
Generic Safety issues (GSis)
Two of 26 applicable GSis remain open for both Salem units. These are Pilot Operated Relief Valve and Block Valve Reliability and Additional Low Temperature Overpressure Protection.
Other Multiolant Action issues (MPAs)
Since these are issues that are contained in Bulletins and Generic Letters, there will be l
increases in the numb ^ of issues from one year to the next. The previous three categories are stagnant because most,if not all, new issues will be MPAs. For Salem Unit I twelve out of 88 i
applicable MPAs remain open. For Salem Unit 2, twelve out of 53 applicable MPAs remain open.
5.4.3 CAFRA Permit On January 5,1993, several BNE staff members met with the DEPE Land Use Regulation (LUR) staff to discuss tne status of PSE&G's application to modify their CAFRA (Coastal Area 4
Facility Review Act) construction permit for several new buildings including the Interim '.ow-Level Radwaste Storage Facility at Artificial Island. The BNE staff provided its comments on the application to LUR staff in September 1992. LUR provided a copy of the letter sent to PSE&G that transmitted the BNE comments.
px 5-13 1993 NES ANNUAL REPORT
The supplemental information was provided by PSE&G letter dated June 4. The BNE reviewed this information and provided several comments and questions to PSE&G. A meeting was held on July 29 with PSE&G and LUR. PSE&G presented design details of the building and specific information on storage plans which resolved BNE's comments.
A public hearing on PSE&G's permit application was held on August 25,1993, in the Lower Alloways Creek Township building. Representatives of the DEPE's LUR Program and the BNE attended this hearing. A representative of LUR was the hearing officer. At the hearing, PSE&G made a formal presentation of their plans for building additional facilities on Artificial Island. This was followed by questions from the public.
A New Jersey Deputy Attorney General contacted the BNE for additional information during the legal review conducted prior to issuing the permit modification. On November I, 1993, the DEPE issued the permit modification to PSE&G.
5.4.4 Licensee Change Requests A.
Comments Transmitted to the NRC During 1994 Salem Unit 2 License tnange Reauest 92-10 The BNE reviewed this proposed change to the Technical Specifications for Salem Unit
- 2. This change revises the heatup and cooldown limits established to protect the reactor vessel from a brittle failure. By letter to the NRC dated May 21,1993, the BNE commented that the j
region on the revised heatup curve labeled as the acceptable operating region was incorrectly shown to be above the criticality limit. The comment was resolved by the NRC.
Salem License Change Reauest (LCR) 92-14 PSE&G submitted LCR 92-14 to the NRC on February 5,1993 and provided supplemental information to the NRC on April 13,1993. This request proposes to revise the Salem Units I and 2 Technical Specifications to delete the trip signal resulting from a steam /feedwater flow mismatch coincident with low steam generator water level. This request is a result of the proposed installation of the Westinghouse advanced digital feedwater control system. By letter dated June 29. the BNE commented to the NRC that this control system may be susceptible to electronic failures similar to those experienced in the Westinghouse rod control system. Failures in the Salem Unit 2 rod control system resulted in an NRC Augmented Team Inspection, Information Notice 93-46, and Generic Letter 93-04. The BNE further commented that a detailed review of the design of the feedwater control system must be performed to assess the system's ability to withstand voltage spikes or any other anomaly identified to be a contributing cause of the rod control failures. This concern was resolved by PSE&G. PSE&G explained verbally and later in writing that the voltage suppression devices used in the feedwater control pn 5-14 1993 NEs ANNUAL REPORT
system are different than those used in the rod control system.
B.
The NES reviewed the following LCRs for Salem during 1992 and expressed no concerns to the NRC.
Salem License Change Reauest 89-06. Rev.l By letter dated February 2,1993, PSE&G submitted Revision I of the subject LCR to the NRC. In their original submittal dated May iI,1992, a number of minor discrepancies were identified which are corrected in this submittal. Additionally, PSE&G has included several administrat ve Technical Specification changes that were not identified in their original request.
i Salem Unit 2 License Change Reauest 93-01 By letter dated August 24,1993, PSE&G submitted to the NRC the subject request.
PSE&G proposes to amend its technical specification to extend the Allowed Outage Time for one inoperable offsite power circuit from 72 to 120 hours0.00139 days <br />0.0333 hours <br />1.984127e-4 weeks <br />4.566e-5 months <br />, to allow for switchyard modifications.
)
Salem License Change Reauest 91-07 The BNE completed review of this change request which proposes to revise the Salem Units I and 2 Technical Specifications to ensure that the same surveillance testing and acceptance criteria are utilized for the hydrogen recombiners at each unit.
Salem Emergency License Change Reauest On June 17, PSE&G requested an emergency license amendment that was needed prior to start-up of Salem Unit 1. The amendment was necessary because of the discovery of an unreviewed safety question regarding the single failure capabilities of the rod drive control system.
Salem Unit 2 License Change Reauest LCR 91-04 By letter dated August 30,1993, PSE&G submitted the subject license change request to i
the Nuclear Regulatory Commission (NRC). The proposed change to the Unit 2 Technical Specifications replaces the main feedwater control and control bypass valves with the main feedwater stop check valves for the Containment isolation function.
Salem Units I & 2 License Change Reauest 93-23 By letter dated August 24,1993, PSE&G submitted the subject request to the NRC.
PSE&G proposed to modify a section of the Environmental Protection Plan (Appendix B to the ccMW 5-15 1993 NEs ANNUAL REPORT j
Technical Specific t ons) pertaining to monitoring requirements intended for the preservation of i
i endangered or threatened marine species (e.g. sea turtles). PSE&G seeks to incorporate into the Plan the changes included in the May 14,1993 Section 7 Consultation Biological Opinion, issued by the National Marine Fisheries Service. These changes include:
(1) Increasing the monitoring frequency of the intake screens from bi-hourly to hourly if a lethal incidental take occurs.
(2) Required bi-hourly monitoring of the Circulating System intake through October 15 instr.ad of September 30.
(3) Required daily cleaning of the circulating system trash bar racks until October 15 instead of September 30.
The request was also reviewed by the staff of DEPE's Division of Fish, Game and Wildlife (DFG&W), which concurred with the proposed changes as long as the criteria adopted by the National Marine Fisheries Service is met.
Salem Unit 2 License Change Reauest LCR 87-07. Rev I By letter dated March 6,1991, PSE&G submitted the subject license change request to the NRC. The request was then supplemented three times, most recently on September 30, 1993. The request proposes changes to the Unit 2 Technical Specifications to modify Limiting Conditions for Operation and Surveillance requirements for the diesel generators. The proposed changes incorporate recent NRC guidance and PSE&G's updated degraded grid calculations.
toff 5-16 1993 NEs ANNUAL REPORT
d y
JUNE 24,1994 I
1 Docket Nos. 50-272 50-311 EA No.94-112 Mr. Steven E. Miltenberger Vice President and Chief Nuclear Officer Pub'ic Service Electric and Gas Company P. O. Box 236 Hancocks Bridge, New Jersey 08038
Dear Mr. Miltenberger:
SUBJECT:
NRC AUGMENTED INSPECTION TEAM (AIT) REPORT NOS.
50-272/94-80 AND 50-311/94-80 The enclosed report refeu to a special onsite myiew by an NRC Augmented Inspection Team (AIT) from April 8 through April 26,1994. The team reviewed the circumstances surrounding the automatic reactor shutdown and two automatic actuations of the " safety injection" system that occurred at Salem Unit I on April 7,1994.
The report discusses areas examined during the inspection. The inspection focus was on the potential safety significance of the events, and included detailed fact-finding, determination of root causes, and evaluation of operational and managerial performance. The inspection consisted of selective examination of procedures and representative records, observations, and interviews with personnel.
The AIT determined that the predominant cause of the event was the combination of pre-existing equipment pmblems or vulnerabilities and the resultant challenges to the operators, and operator crrors that occurred during the transient. Other failures and their causes were reviewed and are discussed in the attached report. The AIT concluded that both the equipment problems and operator enors could, and should have been avoided by licensee management thmugh a closer review of the operator needs in response to the frequent and expected transient conditions resulting from the grass intmsions at the circulating water structure.
The AIT found the licensed operator response to the initiating event, a loss of circulating water, was weak. Operators did not take some actions that they were trained to perform. However, overall operator response was successful in achieving a stable plant condition; unfortunately, much later in the event sequence than expected, and too late to avoid a significant challenge to the pressurizer power operated relief and safety relief valves.
While we note the actions of PSE&G to improve plant hardware and procedures prior to the
(
event, both hardware deficiencies and inadequate procedures played key roles throughout the
)
l event sequence. Also, the actions taken by PSE&G before and during the event to mitigate the frequent grass intmsions at the Salem circulating water structure were both well conceived and
Mr. Steven E. Miltenberger 2
generally well performed. However, these initiatives were not accompanied by a similar review of task perfonnance and procedural guidance in the control rooms to ensure that licensed operator response to the potential or actual loss of circulating water would also be successful.
It is for these reasons that the NRC views the relatively poor perfonnance of the operating crew during the April 7,1994 event to indicate not just weak perfonnance of cenain licensed operators; but mther, and more imponantly, an inadequate assessment by management of the prevalent operating conditions at the plant and subsequent development of an appropriate operating philosophy to meet the expected needs.
It is not the responsibility of an AIT to detennine compliance with NRC rules and regulations or to recommend enforcement actions. These aspects will be devroped following additional NRC management review of this repon.
A representative from the State of New Jersey, Depanment of Environmental Protection and Energy (DEPE), observed parts of the onsite AIT inspection activities. A copy of a letter from Mr. Anthony J. McMahon, Acting Assistant Director, Radiation Protection Element, NJ DEPE to ICC is enclosed with th:s letter. That correspondence describes three issues not specifically l
addressed in the AIT repon. Also enclosed is the NRC reply letter describing our plans to address those concerns.
In accordance with 10 CFR 2.790 of the Commission's regulations, a copy of this letter and the enclosures will be placed in the NRC Public Document Room.
We will gladly discuss any questions you have concerning this inspection.
Sincerely, ORIGINAL SIGNED BY:
James T. Wiggins, Acting Director Division of Reactor Safety
Enclosures:
- 1. Inspection Repon Nos. 50-272/94-80
- 2. Letter, dated May 20,1994, from A. J. McMahon, NJ DEPE to J. T. Wiggins, NRC
- 3. Letter, dated June 24, 1994, from J. T. Wiggins, NRC to A. J. McMahon, NJ DEPE 1
Mr. Steven E. Miltenberger 3
cc w/encls:
J. J. IIagan, Vice President-Operations / General Manager-Salem Operations S. LaBruna, Vice Pmsident - Engineering and Plant Betterment C. Schaefer, External Operations - Nuclear, Delmarva Power & Light Co.
R. Hovey, General Manager - Hope Creek Operations F. Thomson, Manager, Licensing and Regulation R. Swanson, General Manager - QA and Nuclear Safety Review J. Robb, Director, Joint Owner Affairs A. Tapen, Program Administrator R. Fryling, Jr., Esquire M. Wetterhahn, Esquire P. J. Curham, Manager, Joint Generation Depanment Atlantic Electric Company Consumer Advocate, Office of Consumer Advocate William Conklin, Public Safety Consultant, Iewer Alloways Creek Township K. Abraham, PAO (2)
Public Document Room (PDR)
Local Public Document Room (LPDR)
Nuclear Safety Information Center (NSIC)
NRC Resident Inspector State of New Jersey D. Davis H. Otto, State of Delaware, Depanment of Natural Resources & Environmental Control i
6 i
l Mr. Steven E. Miltenberger U. S. NUCLEAR REGULATORY COMMISSION REGION I REPORT / DOCKET NOS. 50-272/94-80 50-311/94-80
{
LICENSE NOS.
DPR-70 t
DPR-75 LICENSEE:
Public Service Electric and Gas Company P.O. Box 236 t
Hancocks Bridge, New Jersey 08038
{
FACILITY:
Salem Nuclear Generating Station j
INSPECTION DATES:
April 8-26,1994 INSPECTORS:
Stephen Barr, Resident Inspector, Salem, DRP (Asst. Team l
Leader) l J. Scott Stewan, Examiner, DRS Iqbal Ahmed, Senior Electrical Engineer, NRR Warren Lyon, Senior Reactor Systems Engineer, NRR l
John Kauffman, Senior Reactor Systems Engineer. AEOD 12rry Scholl, Reactor Engineer, DRP Richard Skokowski, Reactor Engineer, DRS Howard Rathbun, NRR Intern STATE OBSERVER:
Richard Pinney, New Jersey Department of Environmental Protection and Energy ORIGINAL SIGNED BY:
6/23/94 TEAM LEADER:
R. J. Summers, Project Engineer Date Projects Branch 2, DRP ORIGINAL SIGNED BY:
6/23/94 l
APPROVED BY:
James T. Wiggins, Acting Director Date l,
Division of Reactor Safety l
a i
f i
Mr. Steven E. Miltenberger EXECUTIVE
SUMMARY
Areas Insoccted: An Augmented Inspection Team (AIT), consisting of personnel from Region I AEOD and NRR, inspected those areas necessary to ascertain the facis and determine probable causes of the automatic reactor shutdown and multiple automatic initiations of the safety injection system that occurred on April 7,1994. The team assessed the safety significance of the event, including the resultant plant operation with a water (liquid) filled pressurizer and its challenge to the primary coolant boundary integrity and the potential vulnerability of the ultimate heat sink to the same marsh grass intmsions that challenged the plant nonnal heat sink, which was the initiating event for the sequence of events on April 7. The adequacy of the licensee's design, maintenance and troubleshooting practices relative to the safety injection system was reviewed.
The possibility for any potential generic implications posed by the Salem event was assessed.
ResulM: The Augmented Inspection Team (AIT) developed a sequence of events detailing the circumstances surrounding a Salem Unit I plant trip and a series of safety injection system actuations. It was found that the events led to the loss of the pressurizer steam bubble and the nonnal reactor coolant ystem pressure control system, and an Alert declaration. The AIT noted through an event sequc.;ce and causal factor analysis that the root causes of key events generally a
included a combination of component failure and human error. Additional procedural guidance fer, and prioritization of woik activities of control room operators would have resulted in a better response to the event. The AIT found in general that the licensee response to the almost daily event of grass clogging of the circulating water screens was very well planned and coordinated for the additional workload at the circulating water structure. However, as indicated by the perfonnance of personnel and equipment in response to the April 7 event, the licensee did not adequately plan for, and coordinate, the activities corresponding to the additional work. load in the control rooni resulting from the same event.
Finally, even though some equipment and licensed operators perfonned poorly during the ensuing transient on April 7, the core and its primary protective barriers were maintained throughout the event.
In addition, the following conclusions were developed as a result of the AIT review and discussed at a public exit meeting held on April 26,1994:
Summary of
Conclusions:
l.
No abnonnal releases of radiation to the environment occurred during the event (Section 3.4).
I 2.
The April 7,1994 event challenged the RCS pressure boundary resulting in multiple, successful operations of the pressurizer power operated relief valves and no operations of the pressurizer safety valves (Section 3.2).
4
Mr. Steven E. Miltenberger 3.
Operator errors occurred which complicated the event (Section 4).
EXECUTIVE
SUMMARY
(CONT'IB 4.
Management allowed equipment problems to exist that made operations difficult for plant operators (Section 7.2).
5.
Some equipment was degraded by the event, bu: overall, the plant perfonned as designed (Section 3).
6.
Operator use of emergency procedures was good. However, procedural inadequacies were noted with other operating procedures (Section 4).
7.
Licensee's investigations and troubleshooti.ig efforts were good (Section 5).
iii
Mr. Steven E. Miltenberger TABLE OF CONTENTS EXECUTIVE SUMMA'RY ii EXECUTIVE
SUMMARY
(CONT'D).............................. iii TABLE OF CONTENTS
.............. iv 1.0 I NTRO D U CTI ON....................................... I 1.1 Event Overview I
1.2 Augmented Inspection Team Activities......................
I 2.0 GENERAL SEQUENCE OF EVENTS 2
3.0 PLANT RES PONS E TO EVENT.............................. 4 3.1 Solid State Prdtection System (SSPS) Response................. 4 3.2 Pressurizer PORVs, Safety Valves & Associated Pipe.............
7 3.3 Circulating and Service Water Systems.....................
13 3.4 Reactor Systems Response.............................
16 3.5 Atmospheric Steam Dump Valves and Steam Generator Safety Valves..
21 4.0 PLANT OPERATOR PERFORMANCE & PROCEDURE ISSUES........
21 4.1 Operator Response Prior to the Phnt Trip...................
22 4.2 Operator Response Following the Plant Trip and Safety Injections.....
25 4.3 Procedure Adequacy and Use...........................
28 4.4 Event Classification & Notifications.......................
30 4.5 Simulator Demonstration
.................................30 4.6 Reactor Vessel Level Indication System (RVLIS) Monitoring........
30 4.7 Operations Conclusions...,...........................
32 5.0 EVALUATION OF TROUBLESHOOTING ACTIVITIES..............
34 6.0 OTH ER FINDINGS...................
.................40 7.0 SAFETY SIGNIFICANCE AND AIT CONCLUSIONS...............
42 7.1 Safety Significance
.................................42 7.2 AIT Conclusions...................................
43 8.0 EXIT M EETING........................................ 49 ATTACHMENT 1 - AIT Chaner ATTACHMENT 2 - Safety Injection System Imgic Diagram ATTACHMENT 3 - Confirmatory Action Letter A'ITACHMENT 4 - Sequence of Events ATTACHMENT 5 - Acronyms A'ITACHMENT 6 - Exit Meeting Attendees ATTACHMENT 7 - Figures iv
Mr. Steven E. Miltenberger DETAILS
1.0 INTRODUCTION
1.1 Event Overview On April 7,1994, opemtors at Salem Unit I were operating that unit at 73% power. The plant was at a reduced power level due to the reductions of condenser cooling efficiency resulting from the pmblems river grass had been causing at the unit's condenser circulating water (CW) i intake structure. Shortly after 10:00 a.m. that morning, a severe grass intrusion occurmd at the intake stmeture, and many of the Unit I CW pumps began to trip. Operators consequently began to reduce plant power in order to take the unit turbine offline. As a result of operator error and equipment complications, a Unit I reactor trip and automatic safety injection occurred at 10:47 a.m., and a subsequent second automatic safety injection occurred at 11:26 a.m. The subsequent sequence of events resulted in the Unit I primary coolant system filling, resulting
)
in a loss of nonnal pressurizer pressure control at nonnal operating tempemture and pressure.
i The licensee declared an Unusual Event and subsequently an Alen condition at the unit.
The events of April 7, from the initiating downpower tmnsient to the ensuing reactor trip and safety injections, were momplex and involved a combination of personnel errors and equipment
]
failures.
l 1.2 Augmented Inspection Team Activities On April 7,1994, senior NRC managers detennined that an AIT was warranted to gather infonnation on the plant trip and subsequent safety injection system actuations at Salem Unit 1.
The AIT was initiated because of the complexity of the events, the uncenainty of the root causes of some of the conditions and equipment problems that had been encountered during the events, and possible generic implications. A chaner was fonnulated for the AIT and transmitted to the team on April 8,1994 (Attachment 1). The NRC Region I Regional Administrator dispatched j
the AIT carly on April 8,1994. The AIT met with PSE&G management and staff regarding the facts known at that time for the April 7 event.
On April 8,1994, NRC Region I issued a confirmatory action letter (CAL) that documented the verbal commitments made by the licensee to the NRC regarding the control of activities for equipment that failed to eperate properly during the event, PSE&G suppon of the team inspection activities and the subsequert restan of the unit. The CAL is enclosed as Attachment 3.
The team completed initial inspection activities on April 15, 1994. Additional onsite inspection was conducted on April 17,20 and 21,1994, to perfonn additional operator interviews and to review the results of ongoing troubleshooting and testing activities. The work directed by the AIT charter was completed and a public inspection exit meeting was held on April 26,1994.
The AIT panicipated in two congressional staff briefings, a public NRC and PSE&G i
Mr. Steven E. Miltenberger 2
l management meeting on May 6,1994 and an NRC Commissioners' briefing on May 11, 1994.
The AIT provided infonnation/ findings to NRC Region I for use in developing the issues
)
j warranting corrective action or further analysis prior to restan of Unit 1.
2.0 GENFRAL SEQUENCE OF EVENTS 1
l On April 7,1994, prior to the reactor trip and safety injection events, Salem Unit I was opera'ing at approximately 73% power. Operators were operating the plant at less than full power due to the effect marsh grass in the Delaware River was having on the Salem units' circulating water (CW) systems. Over the course of late winter and early spring, heavy accumulations of the river grass at the CW structure were clogging the CW system travelling screens which protect the CW pumps from river debris.
By approximately 10:30 a.m. on April 7, the power level at Unit I had been decreased to about 60 % power as a result of an increase in condenser back pressure due to river grass interfering with the travelling screens at the CW stmeture. In response to the approaching loss of CW, Unit I opemtors began..mit load reduction at i 7 power per minute. From 10:15 a.m to 10:40 a.m., seveml of the Unit 1 CW travelling screens clogged with grass and caused the corresponding CW pump to trip off line. Operators attempted to restore the pumps as they j
tripped, but by 10:39 a.m. only one CW pump was available. As the CW pumps were lost from service, operators increased the rate of the downpower maneuver from 1 % to 3% to 5% to eventually 8% per minute. As the operator responsible for controlling turbine power reduced the unit load, the operator responsible for reactor power correspondingly reduced reactor power by insening the reactor contml rods and by boration.
Initially, during the downpower maneuver, opemtors reduced turbine power ahead of reactor power, and the resulting power mismatch caused slightly higher than nonnal tempemture for the primary coolaut system. At about 10:43 a.m., iiie Nuclear Shift Supervisor (NSS) directed the operraor controlling reactor power to go to the electrical distribution control panel to begin shifting plant electrical loads to offsite power sources. At that time the control room crew members believed the plant was stable; however, they failed to recognize that reactor power was still decreasing due to the delayed effect of a boren addition that had been made. This led to reversal of the power mismatch and a decreasing T,,,.
At 10:45 a.m., the NSS identified the resultant over-cooling condition, went to the reactor control panel and began withdrawing control rods to raise coolant temperature, and then turned over control once again to the original operator. This operator continued to withdraw the control rods, and reactor power increased from approximately 7% to 25 % of full reactor power. Since power dropped below 10% power, the power range "high neutron flux-low setpoint" trip had automatically reinstated, establishing 25 % reactor power as the automatic reactor trip setpoint. When reactor power reached the 25 %
setpoint, at approximately 10:47 a.m., the reactor automatically tripped.
Almost immediately following the reactor trip, an automatic safety injection (SI) actuated. The SI was initiated only on Train A of the SI logic on high steam flow coincident with low primary coolant T,,,.
Although the operators did not recognize it at the time, the licensee later 1
=.
1 Mr. Steven E. Miltenberger 3
i i
detennined that the high steam flow signal was a result of a pressure wave created in the main l
steam lines by the closing of the turbine stop valves when the turbine automatically tripped. In response to the reactor trip and SI, the operators entered Emergency Operating Procedure (EOP)
EOP-Trip 1 at 10:49 a.m. Due to the nature of the initiating signal, the SI actuation did not l
successfully position all necessary components to the expected, post-actuation position, and the operators, as part of EOP perfonnance, manually repositioned affected components. At i1:00 l
a.m., the licensee declared an Unusual Event based on a " manual or automatic emergency core cooling system actuation with a discharge to the vessel." During further perfo.mance of the EOP, operators had to reset the SI logic, and it was at this point that they realized that Tmin B of the SI logic had not actuated and that there was thus an apparent logic disagreement.
l As the operators were performing the required EOP steps, the primary coolant system continued to heat up due to decay heat and running the reactor coolant pumps. As the primary heated up, steam generator pressure consequently increased, and because of pre-existing problems with the steam generator atmospheric relief valve (MS10) automatic control, steam generator pressure was not properly controlled by these valves. Concurrently, due to primary heatup and the value of water added by the SI, the pressurizer filled to solid or near-solid conditions, and the pressurizer power operated relief valves (PORVs) periodically automatically opened to control primag pressure. Shortly before 11:26 a.m., steam generator pressure increased to the ASME code safety valve lift setpoint in the Number i1 and/or 13 steam generator (s). The opening of the safety valve caused a rapid cooldown of the primary coolant system, and due to the solid water state of that system, a coincident mpid decrease in primary system pressure. At 11:26 a.m., primary pressure ieached the automatic SI setpoint of 1755 psig, and since Train B of the SI logic remained anned, a second automatic SI was actuated by that train of logic. Operators had also identified the decreasing primary pressure and manually initiated SI moments after the automatic initiation.
Following the second SI, operators remained in the EOP network and pursued stabilizing plant conditions. At 11:49 a.m., the pressurizer relief tank (PRT) rupture disk ruptured to relieve the increasing tank pressure which resulted from the volume of primary inventory relieved to the PRT. At this point, the operators were faced with cooling down the plant from nonnal operating temperature and pressure without having a steam bubble in the pressurizer to control primary pressure during the transient. Once the ECCS injection was tenninated, operators controlled plant pressure through a combination of charging and letdown using the chemical and volume control system. At 1:16 p.m., licensee management declared an Alen under Section 17.B.
" Precautionary Standby," of the Salem Event Classification Guide. The licensee decision to voluntarily enter this Emergency Activation Level was made in order to assure the activation of the Salem Technical Suppon Center (TSC) to provide the Salem operators with any technical assistance that would be required as they cooled down the plant. By 2:10 p.m., the TSC had l
been fully staffed, and at 3:11 p.m., the operators restored a bubble in the pressurizer.
t l
hir. Steven E. Miltenberger 4
At 4:30 p.m., operators restored pressurizer level to the nonnal band and retumed level control to automatic. The operators subsequently exited the EOPs and used integrated operating procedures to cool the plant down to Afode 4 (Hot Shutdown), which was achieved at 1:06 a.m.
on April 8, and then to Afode 5 (Cold Shutdown), which was achieved at 11:24 a.m. on the same day.
A detailed sequence of events is provided in Attachment 4.
3.0 PLANT RESPONSE TO EVENT 3.1 Solid State Protection System (SSPS) Response 3.1.1 SSPS Description The function of the reactor protection system is to sense an approach to unsafe conditions within the reactor plant and then initiate automatic actions to protect the reactor fuel, the reactor coolant system and the primary containment from damage. A block diagram of the system logic is given in Attachment 2. Process sensors monitor various plant conditions and provide an output to the system bistables. When a trip setpoint is exceeded the bistable deenergizes its associated input relays which then pmvide an input to the solid aate logic circuitry. The solid state logic processes the various inputs, detennines if an unsafe condition is being approached and, when appropriate, actuates the output relays to cause a protective action. The protective action may be a reactor trip or the actuation of the safeguards equipment. As shown in the block diagram, each channel bistable controls a relay in both Protection System Trains A and B.
The two protection trains have identical functions to ensure that in the event of a failure of one train the automatic protection actions will be ensured. Another design feature of the system is that, once initiated, a protective action shall go to completion. This feature is achieved by various means for the different safeguards equipment. In some cases relays within the solid state protection system electrically seal in and thereby ensure the protective action continues to completion regardless of the duration of the signal. For some components this feature is accomplished by components and circuitry dowustream of the solid state protection system circuitry. For example the main steam isolation valve closure (MSIV) action is " sealed-in" when a mechanically latching relay, within the MSIV control circuitry, is released by the action of a solid state protection system buffer relay. For these components, the duration of the input signal must last long enough for the latching relays to actuate.
System Actuation Imgic The protection system is designed such that the failure of a single component cannot prevent a desired automatic protective action from occurring. Likewise, the design ensures that a single component. failure cannot cause an unnecessary system actuation. These design objectives are accomplished by having multiple instmmentation channels and redundant protection trains. A vital component of the protection trains is the solid state logic. This logic ensures that more than one instrumentation channel is sensing an unsafe condition; however, it does not require i
l l
Mr. Steven E. Miltenberger 5
t all channels to initiate a protective action. For example, to protect the plant from the effects of a main steam line break accident, the protective system monitors differential pressures from which main steam line flow rates may be inferred, main steam line pressures and the average reactor coolant temperature (T ). One of the conditions required to cause e protective action m
is the coincident existence of both:
l 1.
High steam flow in two of the four main steam lines. (Each steam line has two flow instruments with an associated bistable. The logic considers steam flow it. a particular l
steam line to be high if one of the two bistables are tripped.)
1 l
- and, l
2.
Iow T condition on two of four reactor coolant system loop temperature instmment m
channels; gr low steam line pressure on two of the four main steam line pressure channels.
When this logic is satisfied the protective actions that are initiated are the isolation of the main steam lines and a safety injection. The safety injection logic then results in closure of the feedwater control and bypass valves, main feedwater isolation, trip of the feedwater pump turbines, realignment of various system valves and dampers and actuation of the safeguards equipment control systems (e.g. safety injection pump and emergency diesel generator staning).
The solid state logic processes the various system inputs in a similar manner as necessary to generate the appropriate protective action based on the particular accident analysis.
Some of the safeguards equipment receives actuation signals from both protection trains (e.g.
emergency core cooling pumps, emergency diesel generators). Other equipment (consisting j
mostly of train specific safety injection system valves) receive actuation signals from only one of the protection trains. The system design is such that the components that are actuated from a single train alone, result in completing the safety function. Therefore, a single logic system failure will not result in a total loss of safety function.
When the solid state logic generates a protective aJion signal one of two actions occur. For a reactor trip the undervoltage coils of the reactor trip circuit breakers are deenergized directly by the solid state logic circuits. For all of the other protective actions, the solid state logic circuits control the operation of a master relay in the Safeguards Equipment Cabinet. Depending on the number of relay contacts that are needed to accomplish a protective function, additional slave and buffer relays are utilized. The slave relays are controlled by a master relay and buffer relays by a slave relay. Some of the control circuits use additional control relays in the l
operation of the safeguards equipment, as discussed previously. For the MSIV system, each latching relay, once actuated, operates solenoid valves that cause individual MSIVs to close.
i The resultant effect is that for the MSIVs the series operation of a master, slave, buffer and latching relay is required before the protective action, generated by the SSPS logic, is assured of going to completion.
l l
l Mr. Steven E. Miltenberger 6
3.1.2 SSPS Response During the Event During the plant transient that occurred on Salem Unit 1 on April 7,1994, the solid state protection system responded to a sustained low T,., condition and coincident shon duration high steam Cow indications.
The low T,,, condition wa-a result of actual plant conditions experienced during the rapid plant power reduction. The shon duration high steam Dow signals occurred following the main turbine trip. These high steam flow signals were not the result of an actual high steam Cow condition resulting from a postulated steam line break; but rather, were caused by a pressure wave in the main steam lines that occurs when the turbine stop valves rapidly close during a turbine trip.
l Hich Steam Flow Signal Analysis The team reviewed PSFAG's analysis of the high steam flow signal associated with the initial safety injection on April 7,1994. At Salem Generating Station the steam flow in each main steam line is detennined by measuring the pressure difference across the steam line flow restrictor. The Dow rc.rictor is a venturi type Dow meter. However, the pressure taps are on each side of the Dow rstrictor and there is no pressure tap at the throat.
Following a reactor trip the P-4 pennissive selects a new setpoint for the high steam flow safety injection and steam line isolation. This new setpoint is equal to a 40% power ste:un flow equivalent. Additionally, P-4 also initiates a turbine trip. According to PSE&G analysis, the quick closing of the turbine stop valve associated with a turbine trip generates compressive pressure waves in the main steam line. These pressure waves travel upstream toward the steam generator and are reflected back and fonh from the two ends of the pipe. These waves are also reflected such that they enter the pressure sensing lines for the pressure transmitters, where a pressure difference is then indicated, and intennittent, shon duration, high steam flow signals are generated.
The team questioned whether either Salem unit had experienced similar intennittent high steam flow signals following previous reactor / turbine trips. PSE&G reviewed past reactor / turbine trips and identified at least three occasions where shon duration high steam flow signals were generated following reactor / turbine trips. Although PSE&G had identified short duration high steam flow signals following previous reactor / turbine trips, as a result of the analysis during those prior events they detennined that the condition resulted from the P-4 high Meam flow setpoint change and the time actual steam flow decreases below 40%. PSE&G considered tids to be an expected response of the instmmentation and that no modification was necessary. The spurious high steam flow signals caused by the pressure waves following a reactor / turbine trip were not identified; and therefore, not evaluated until the April 7,1994 event.
l l
Also, following the April 7,1994, event PSE&G found that safety injections due to the spurioas l
high steam flow signals had occurred at another Westinghouse plant and that time delay circuits were installed to address this problem.
I i
l Mr. Steven E. Miltenberger 7
Plant Response A review of the sequence of events generated by the plant computer following the reactor trip and turbine trip indicated that protective action signals were generated in response to the high steam Dow/ low T.,, signals two times. The sequence of events program divides each one second time interval into 60 cycles and identifies events that occur and/or clear within each one cycle time interval. AIT review of the sequence of events computer printout detennined that the i
coincident high steam flow and low T,,, conditions were logically satisfied twice just after the reactor trip on April 7. The first occurrence occurred and cleared within one electrical cycle (0.0167 second). The second occurrence occurred during one cycle and cleared in the next cycle. Since it is not possible to determine when, within the first cycle, that the initiation occurred, or when, within the second cycle, the trip condition cleared, the actual duration that the trip signal was present cannot be determined other than it was present for a maximum of two cycles (0.033 second).
The first occurrence was of such shod duration that neither the A nor B protection system trains was.sle to actuate any safeguards equipment prior to clearance of the input signal.
The second occurrence was sufficient for protection train A to respond and resulted in a panial actuation of the safeguards equipment. The difference in the response times of the A and B logic trains resulted in the single train actuation. The reason for the partial actuation of the equipment associated with the A protection train is that the shon duration signal did not allow sufficient time for all of the seal-in and/or latching relays to respond.
The safeguards components that are actuated as a result of operation of a solid state protection system slave relay (with a seal-in design) all performed as expected for the A protection system train. Other components, that have seal-in or latching relays within their specific control circuits, did not all operate. The later set of components included two of the four MSIVs that failed to close, the main feedwater pump turbines that failed to trip and the main feedwater isolation valves that failed to close. PSE&G tested the system response to varying duration input signals to validate these conclusions. This testing is discussed in Section 5 of this repon.
3.2 Pressurizer PORVs, Safety Valves & Associated Pipe The pressurizer for each Salem reactor coolant system (RCS) is equipped with two power operated relief valves (PRI and PR2) that can be isolated from the pressurizer by block valves.
The PORVs are set to open at 2335 psig. They actuated over 300 times during the event to relieve water and successfully prevented an RCS overpressure condition that could have challenged the pressurizer safety valves. Also, they successfully opened and closed several times after the event.
i l
Post-event examination showed that both PORVs incurred wear of the valve internals; however, the valves still worked after the event. Prediction of future valve operation, particularly due to l
the galling observed in PR2's valve stem, is judged impractical by the AIT. The galling could I
Mr. Steven E. Miltenberger 8
lead to failure at any time, or the valve may operate numerous additional times before failure.
Damage to PRI was found to be generally less severe than to PR2. The licensee subsequently replaced the worn internals, which the AIT considered an appropriate action.
1 PORV Design Figure 1 in Attachment 7 shows the Salem PORV design. The valve is air actuated with the actuation diaphragm moving a stem (9) that passes through packing located in the valve bonnet.
The stem is threaded into a plug (20) and an anti-rotation pin (8) is driven through the threaded junction to prevent rotation. The bonnet is bolted in place, and holds the cage (19) against a gasket (18) in the bottcm of the valve body via the cage spacer (21). The valve seat surfaces are on the bottom of the plug and along the inside of the cage toward the bottom. Lifing the plug moves the plug seat away from the cage seat, allowing flow. At the time of the event for Salem Unit 1, the stem was 316 stainless steel with a chrome plating, the anti-rotation pin was 300 series stainless steel, and the plug and cage were 420 stainless steel. The valves are manufactured by Copes-Vulcan.
This valve model was tested in the 1981 EPRI test program except that a combination of two different valve internals types were tested (a Stellite plug in a 17-4 PH cage, and a 17-4 PII plug in a 17-4 PH cage). Some delayed closures were iiatified in the EPRI tests due to scoring and galling of some surfaces for the valve with the 17-4 PH plug. Originally, Salem Unit I used the 17-4 PH plug and cage internals. Subsequently, the licensee changed to a 316 stainless steel, Stellite plug.
The change to the 420 stainless steel valve internals was completed in 1993. These new intemals had no service life other than testing prior to the April 7,1994 event.
Subsequent to the event, the licensee replaced the salve internals using the 316 stainless steel stellite plug in a 17-4 PH cage.
PORV Performance During Event The PORVs actuated over 300 times during the event to relieve water and successfully prevented an RCS overpressure condition. Figure 2 in Attachment 7 depicts the RCS pressure during the transient after the second SI actuation. It was during the period from about 11:30 a.m. to 12:00 noon that the PORVs experienced the greatest amount of operation.
Each PORV is equipped with a " valve not fully closed" position indication activated from the valve stem. This provides a positive indication if the valve is more than ~ 5 % open and is a recorded indication. The licensee reconstmeted the number of valve cycles from this indication by counting a cycle as a combination of passing 5 % on an opening motion followed by passing 5% on closing. On this basis, PRI cycled 109 times and PR2 cycled 202 times. Cycle times varied from 0.3 see to 2 sec.
p _..__
i Mr. Steven E. Miltenberger 9
Post-Event Examination and Evaluation The licensee obtained the following infonnation for temperature downstream of the PORVs from the Technical Suppon Center logs:
Approximate time, Tail pipe Pressurizer Pressurizer April 7 temperature, F temperature, F gressure, psi 3:30 p.m 215 650 2250 4:16 p.m 212 2260 l
6:53 p.m.
211 l
7:00 p.m.
605 1800 8:00 p.m.
205 595
- 1500 Roughly 212 F or greater is expected under these conditions if the valve is open or leaking significantly. The observed behavior from 6:53 p.m. to 8:00 p.m. indicated that the PORVs were closed and not lening significantly. The earlier values could be due to tailpipe cooldown following the event. For comparison, the Unit 2 themlocouples indicated 135 - 150 F at about 5:00 p.m. on April 23,1994, while that unit was operating at power.
Following the event, licensee personnel observed that the leak rate into the pressurizer relief tank (PRT) was similar to that existing before the event (0.66 gpm prior to the event; about 0.64 gpm at 5:00 p.m. following the event). The source of the leak appeared to te from a pressurizer safety valve, as is discussed later in this section.
The AIT noted that the licensee initially intended to accept the PORVs as operable following the event without a visual inspection of the valve components. However, as a result of an AIT request for the engineering evaluation of the PORVs upon which that operability determination was based, the licensee then elected to open the valves for inspection.
The licensee post-event, preliminary examination of PORV PR2 showed galling of the stem where it passed through the bonnet and severe wear /sempes, but little or no galling, along part of the plug and cage. The damage was concentrated on the side toward the outlet, which the licensee indicated was consistent with past experience. The licensee also indicated the cage appeared softer than the plug. The seat did not exhibit obvious cutting. The plug was reported as freely movable in the cage by hand. Valve PRI did not exhibit stem wear, although there was some wear to the plug and cage and there was a possible cut in the valve seat. Both valves had an axial crack on both sides of the anti-rotation pin. This crack passed through the backseat.
i
i Mr. Steven E. Miltenberger 10 The licensee planned to reassemble the internal pans and the bonnet from PR2 in a different valve body and test to destmetion with water at - 2300 psi if a test facility can be found that will use the radioactive components. The internal pans from PRI will be carefully examined.
The licensee will examine new internal pans for the PORVs to see if there are cracks in the vicinity of the anti-rotation pins.
Primary Code Safety Valvg3 The pressurizer for each Salem reactor coolant system (RCS) is equipped with three safety i
valves (PR3, PR4, and PR5) that are set to open at 2485 psig (
1 %). Pressure never reached the safety valve setting during the event, although the PR4 tailpipe temperature indicated high.
Post-event testing showed that PR4 was weeping; a condition the AIT judges to have existed before the event. The licensee plans to replace PR4 and will also remove and test PR3 and PR5.
Valve tailpipe temperature for PR4 was observed to be ~ 216 F at ~ 12:00 noon on April 7 (220 *F via post trip review repon), while PR3 and PR5 indicated a more nonnal 130 - 135 "F range. (Roughly 212 T or higher is expected under these conditions if the valve is open or leaking significantly, dcpending upon both the pressurizer and pressurizer relief tank conditions.
Note that the Unit 2 thennoco'uples indicated 135 - 150 "F on about 5:00 p.m. on April 23 while the unit was in mode 1.
Also note that these temperatures are not recorded. The only infonnation was from logs and personnel recollections.) This elevated tailpipe temperature raised the question of whether PR4 lifted during the event.
Attempts to evaluate the tailpipe temperature indication operability following cooldown failed; apparently mistakes were made by the licensee in selecting sensors to test and the instmmentation was damaged during PORV disassembly and during instrumentation evaluation.
Review of RCS pressure data and PORV open/close behavior shows that the pressure never significantly exceeded the PORV lift pressure of 2335 psig. Thus, PR4 should not have lifted unless its setpoint was significantly low. Each pressurizer safety valve has a 0.15 to 0.3 inch limit switch, which corresponds to - % to % open. There is no record of a limit switch indicating open during the event.
The leak rate into the pressurizer relief tank (PRT) was 0.66 gpm before the event and was estimated as - 0.64 gpm at 5:00 p.m. following the event. This is consistent with a leak that was unaffected by the event.
Post-event testing of PR4 at Wylie Laboratories showed valve lift at 2515,2516, and 2524 psig, with seat leakage at 90% of the setpoint value. (The valves are supposed to open at 2485 psig with a i 1 % tolerance, which gives a maximum allowable of 2510 psig.) Wylie indicated to the licensee that 25% to 35 % of the safety valves they test will exhibit such leakage.
The combination of event pressure, leak behavior, and post-event valve testing suppon a conclusion that PR4 was leaking prior to, during, and following the event and did not lift during the event. The AIT did not assess the slightly out-of-tolerance lift setpoint for PR4 since it had no effect on the event.
1 l
Mr. Steven E. Miltenberger 11 PORV/ Code Safet_y Valve Pinin_e i
The licensee perfonned a visual inspection of the piping and supports downstream of the PORV and safety valves immediately after the event and stated there was no evidence of damage.
Later, after examining piping upstream of the valves, the licensee reponed two support rods were bent; but that these were not believed to have been damaged during the event. The licensee found no other pipe or support related damage. After the AIT effon, the licensee completed their evaluation of the associated piping and determined that no Daws occurred as a result of this event. This evaluation was reviewed by Region I as part of the effort supponing restart assessment and will be documented in a future report.
The licensee discussed pressurizer nozzles and its piping system with Westinghouse regarding pressure transients upstream of the PORVs and reponed an expectation that there was little effect. The pressurizer volume would be expected to dampen such transients and no safety valve operation would be expected. The licensee reported that an analysis assuming 2350 psig and 680
- F resulted in a usage factor of 0.01 for 350 full-open/ full-close cycles.
The licensee's analysis was based upon PORV opening times of 0.5 see and 2 sec for closure.
The licensee did not address shorter times, the influence of a lower temperature (pressurizer temperature during the event was probably as low as ~ 550 F), the effect of both valves being in operation rather than one, or the influence of the valve not going fully open before receiving a close signal. The AIT believed additional analysis was necessary to establish the lack of i
impact upstream of the PORVs. This concern was discussed with the licensee. Subsequent to the AIT completing its inspection activities, the licensee provided additional evaluations of the associated piping to the NRC for review prior to restan. The AIT did not assess this additional information.
ALT Evaluation of PORVs. Safety Valves and Associated Pipe The galling (or deep gouging) observed on the stem of PR-2 is of concern. The valve is designed with a clearance around the stem such that it should not touch the bonnet. With this clearance closed and with the stem dragging against the inside of the bonnet, the ability of the plug to open or close could be severely affected. Of interest, the stem damage and plug damage were both on the downstream side of the internal assembly which leads to the hypothesis that the damage could have been at least panly flow-induced.
As previously mentioned, this valve model was tested in the 1981 EPRI test program, except that different valve inter.1als were tested. The 420 stainless steel plug and cage in the PORVs at the time of the event, is a manensitic stainless whose hardness is dependent on the heat treatment. This is a much-used alloy where wear and corrosion resistance are both imponant.
PSE&G and Copes Vulcan indicated the valve with the 420 stainless steel internals performed well in the field in similar applications.
i
i i
Mr. Steven E. Miltenberger 12 The AIT found the PORVs' operability to be indetenninant after the event because of the observed damage, although noting that the valves opened and closed upon command shortly before disassembly. The AIT also notes the PORVs were relied upon for low temperature overpressure protection (LTOP) following the event, but prior to disassembly, and were also relied upon as a vent. The AIT concluded that the licensee met the legal requirements for demonstrating the PORVs operable prior to reliance for LTOP purposes. However, the AIT believed that since the PORVs were operated in a condition beyond that envisioned in the FSAR (i.e. multiple actuations involving steam and water), additional evaluation was appropriate.
Salem's FSAR analyses include an allowance of 20 minutes to reset safety injection for inadvenent actuations. Westinghouse recently provided information on this topic to the licensee as required by 10 CFR 21.21(b) (Gasperini, J. R., "Inadvenent ECCS Actuation at Power,"
Ixtter to Dave Perkins, Public Service Electric and Gas Company from Westinghouse Electric Corporation, PSE-93-212, June 30,1993.). This stated that:
" Westinghouse has discovered that potentially non-conservative assumptions were used in the licensing analysis of the Inadvenent Operation of the FCCS at Power accident.
Based on preliminary sensitivity analyses, use of revised assumptions could cause a water solid condition in less than the 10 minutes assumed for operator action time. If the PORVs were blocked, the PSRVs (safety.alves) would relieve water and potentially cause the accident to degrade from a Condition II incident to Condition III incident without other incidents occurring independently.
Per ANS-051.1/N 18.2-1973, a Condition II event cannot generate a more serious event of the Condition III or IV type without other incidents occurring independently."
i The letter funher stated that Westinghouse adopted the following criterion:
"The pressurizec shall not become water solid as a result of this Condition II transient within the minimum time required for the operator to identify the event ani tenninate the i
source of fluid increasing the RCS inventory. Typically, a 10 minute operator action time has been assumed."
i (NOTE: Chapter 15 of the Salem FSAR defines Condition 11 events as faults of moderate frequency including " spurious operation of the safety injection system at power;" and, Condition III events as infrequent faults including small break LOCAs.)
The AIT concluded that the Westinghouse recommended actions may need to be re-examined in light of the Salem experience. The Salem operators took about 17 minutes to tenninate safety injection during the first SI and 12 minutes to tenninate the injection on the second SI. The pressurizer did in fact become water solid and yet, plant operators responded appropriately to the inadvertent EECS actuations per approved EOPs.
l Mr. Steven E. Miltenberger 13 Solid plant operation as encountered during the event is not specifically addressed in Salem's licensing basis as addressed in Chapter 15 of the Final Safety Analysis Report (FSAR).
Licensing basis analyses generally do not reach solid plant conditions. For example, the applicable LOCA analyses involve two phase conditions rather than the single phase resulting from a solid RCS, and a licensing basis inadvertent safety injection does not lead to a solid RCS.
Regardless, the pressure and temperature challenge to he RCS pressure boundary is genemlly enveloped by the composite of analyses addressed iu Chapter 15 of the FSAR.
Consequently, the AIT evaluated the event with respect to challenge to the RCS pressure boundary and addressed whether the event could have logically progressed to a more serious condition. The AIT found that no RCS pressure boundary design parameters were exceeded during the event. The operators restored a pressurizer steam bubble before conducting a planned plant cooldown, thus eliminating the potential problems that may have occurred if a solid cooldown were attempted. The AIT judges that not being strictly within the licensing basis envelope is not a significant safety concern for this event.
The AIT adJressed the possibility of progression to a more serious accident due to PORV or safety valve problems and concluded that multiple additional failures would have been necessary.
Further, the AIT judges the most likely such accident sequence would have been a loss of coolant accident (LOCa), which is within the design basis for the plant.
3.3 Circulating and Service Water Systems Overview As discussed previously, the event of April 7,1994 evolved from an initial problem of plugging of the Salem circulating water (CW) intake screens followed by CW pump automatic trips as water level difference across the intake screens reached the 10 foot trip value. Although CW is necessary for plant operation at power, it is not essential to the plant's safety. However, the vulnembility of the CW system to grass intrusions challenge continued power operation of the plant as well as challenge the plant operators and safety systems in response to the resultant transient conditions, as occurred during this event. Consequently, the AIT assessed aspects of CW operation.
1 In contrast to CW, service water (SW) is vital to safety - it provides the safety related ultimate heat sink. Salem CW, Salem'SW, and Hope Creek SW are located in three similar intake structures along the Delaware River. This observation immediately mises the question of whether the problems that occurred with CW could also occur with SW. Consequently, the AIT assessed the potential for a loss of Salem SW in light of the problems with the Salem CW.
Hope Creek experienced a loss of one SW pump while the team was on site, and the AIT briefly assessed this event for applicability to general SW reliability, and concluded that the failure was unrelated to the events causing CW difficulties at Salem.
Mr. Steven E. Miltenberger 14 Findings The AIT found that the continuing problems experienced with Salem CW present an imponant challenge to plant operation. This could become a safety concern because of continuing plant penurbations that cause unnecessary plant transients, distracts the operators, and potentially leads to unnecessary challenges to the operators and plant safety systems. While noting that the licensee had previously approved a long tenn fix by modifying the CW design, the AIT believed a shon tenn fix was warranted, such as improving the operating pmcedures to respond to the resultant transients.
SW operability was found to not be a shon tenn issue, requiring corrective actions. The licensee indicated that they have never had a SW failure due to debris and the AIT found no other evidence to the contmry, indicating that SW was not vulnerable the same initiator. The AIT suspected that the design of the circulating water structure lends itself to such vulnerability and that the service water structure design is potentially unaffected by debris. The AIT funher concluded that additional NRC review of service water system vulnerability was warranted but was not within the sco,, of the AIT inspection.
Description of Salem and Hone Creek Water Intake Stmetures and Related Machineg Salem and Hope Creek have three water intake stmetures positioned as shown in Fig. 3 in.
Salem's SW intake is about 100 yds upstream (nonh) of the CW intake and Hope Creek's SW intake is about 3/8 mile upstream of the Salem SW intake. Water entering each intake structure passes through a trash rack, a moving screen, a pump, and, for SW, a filter. These are shown in Figs. 4 - 6 in Attachment 7. The bottom of both SW intakes is at about the river bottom, about 30 feet below surface grade. The CW intake bottom is 50 ft. below grade and the river bottom is dredged to that depth for the width of the intake stmeture and for a distance of 100 ft. from shore.
CW Performance During the Even1 In anticipation of additional grass intmsion events, the licensee had removed the front covers of the traveling CW screens and laid fire hoses that were used to wash accumulated grass and debris from the screens before the built-in screen washes were reached. Quick-disconnects had been provided on covers in the screen drives so that shear pins could be replaced quickly (3 to 7 minutes).
Despite the fire hoses and nmning the screens as fast as possible, the screen loads became so heavy during the event that shear pins were failing and screen clogging was causing a significant water level drop across the screens. One licensee representative estimated that the water level drop across the trash racks was about 1 - 1% ft. CW pumps tripped when level reached a 10 foot differential across the screens.
Mr. Steven E. Miltenberger 15 There is no easily obtainable record of CW screen operation. However, CW pump operwn was obtained and is summarized as follows:
Five CW pumps were in opemtion during the initial part of the grass intrusion. Various pumps tripped and were restored to operation by the efforts of the personnel staged at the CW structure. Just before the reactor trip, only one pump remained, and at the time of reactor trip, two were in service.
An AIT member observed one grass intrusion during the onsite inspection. Fire hoses were being operated to clean an estimated 1 - 1% inch thickness of debris off of the screens.
Immediately after the attack, debris around the screen machines was ankle to knee deep.
Licensee personnel said the debris was waist deep following the April 7 event.
SW Reliability Licensee representatives infonned the AIT that they had never seen a correlation between Salem CW Jebris problems and ; roblems with SW at the Salem or Hope Creek sites. They further indicated no historical problems with loss of SW due to debris. The AIT found no instances that contradict those descriptions.
The licensee provided excerpts from its evaluation of a June 1993 turbine trip / reactor trip due to loss of CW (SERT Report 93-07). (That loss of CW cvent was attributed to actions of a diver cleaning a circulator trash rack.) This stated that:
... service water rake and screens are not challenged by debris as are the circulating water systems. As a result, service water screens operates (sic) periodically as compared with constantly for circulating water. The service water trash rake is used infrequently while the circulating water trash rack must be cleaned at least daily during heavy grassing periods....
The Service Water intake has not been subject to the same accumulation of trash and silt as the circulating water intake. For example, while the Corps of Engineers was dredging upriver in 1983, silting caused the shutdown of all circulating water pumps, but the service water intake was not affected. This difference in susceptibility to tmsh and silting is attributed to the location of the service water intake directly on the river front. The circulating water intake is in a diverging section of the river and the resulting drop in velocity and eddy formation is more conducive to (msh and silt accumulation."
Licensee personnel also often cited the high vekicity at the CW intake as a major contributor.
In addition to such factors, the AIT judges that the CW high flow mte is a major factor in that it affects a much larger section of river bottom than affected by the SW systems and a 20 foot deep " pit" is dredged in front of the CW stmeture. Material falling into this pit is likely to be sucked into the CW intakes.
l Mr. Steven E. Miltenberger 16 Based on this information, the AIT concluded that there was no immediate concern regarding the reliability of the service ' vater system; however, as previously stated, this issue warnmts funher review by NRC as pan of the planned reviews of service water systems and individual plant evaluations.
Additional Information Regarding Hope Creek SW The Hope Creek licensee stated that no recent SW traveling screen failures have occurred due to shear pin failure. Several years ago, the screens were not routinely in operation unless there was a pressure differential across the screen. Then the screen would start at normal speed and immediately shift to high speed. Shear pin failure would often follow.
Each screen at Hope Creek is now operated whenever the respective SW pump is operating, and a shift to high speed does not cause shear pin failure. An unacceptable increase in pressure differential when the screen is opemting at high speed is addressed by starting another SW pump and stopping the first pump to allow the screen to clear via normal wash while it continues to operate. Accarding to the licensee, switching between pumps in this.nanner has always been sufficient to prevent a problem. The potential is still recognized in procedure HC.OP-AB.ZZ-0122 (Q), " Service Water System Malfunction," 7/9/93, which states:
" Loss of service water can occur due to reed intnision. The event typically occurs following marsh burns followed by heavy rains and the next high tide... This heavy j
intmsion overloads the screen wash system with subsequent intrusion of the reeds into the suction of operating service water pumps. The resulting heavier than nonnal fiber intrusion clogs the service water pump strainers."
The inspector was told that there are relatively heavy debris " hits" roughly 3 times in the fall and 3 or 4 times in the spring in which high differential pressure alarms across the traveling screens are received in the Hope Creek control room. The response is to start a different SW pump and shut down the operating pump while the screen continues to operate. The built-in screen spray system has always been adequate to clean the screen once the flow was removed, and the problem has been handled without further complication by swapping back and fonh, a capability made possible by the two trains of three pumps each.
3.4 Heactor Systems Response The Salem Unit I event included aspects of potential concern with respect to the reactor fuel and the reactor coolant system (RCS). These are as follows:
1.
Power and criticality control 2.
Adequate margin to the depanure from nucleate boiling ratio (DNBR) 3.
Adequate subcooling margin (SCM) 4.
Rate of change of temperature 5.
Rate of change of pressure
f
'l Mr. Steven E. Miltenberger 17
+
6.
Challenge to fuel cladding 7.
Low temperature overpressure 8.
Pre-Cooldown and Cooldown Operations 9.
Post-Event Usage of the PORVs (power-operated relief valves) 10.
Piping Considerations Each is addressed as follows:
Power and criticality control Control of power and avoidance of conditions that could lead to rapid power excursions are important to protection of the fuel cladding and the RCS pressure boundary. Although power was rapidly reduced during the April 7,1994 event, no unusual configurations resulted and the reduction rate was small when compared to a typical transient associated with a reactor trip from full power. This aspect of the event was not a challenge to the fuel or the RCS.
The power increase rate just before the reactor trip was about normal, and actual power was small in comparison to full power. Heatup aspects of the transient were probably of little corcequence since there was not a large local transient effect. For this reason, the AIT did not investigate such areas as transient temperature distribution within the fuel.
Reaching a lower tempemture than pennitted by Technical Specifications raises questions such as: adequate rod control to attain shutdown; and, could a positive moderator temperature coefficient have been encountered. The licensee investigated these questions and reported that shutdown margin was always significantly greater than required. The moderator temperature coefficient always remained significantly negative.
These conclusions were independently verified by the AIT.
Examination of intennediate and power range nuclear instrumentation indications was perfonned by the licensee and no significant deviations ivere found between the indications and actual plant power during the power ascension transient.
The AIT concludes that no local or overall power conditions were reached that are of concern.
Adequate depanure from nucleate boiling ratio (DNBR)
An adequate DNBR is necessary to assure that the fuel cladding does not become blanketed with steam, a condition that would cause a rapid cladding temperature excursion. The licensee investigated core thennal limits and the axial power distribution during the event and concluded that DNBR limits were not approached. The AIT concurs with this assessment.
Mr. Steven E. Miltenberger 18 Adeauate subcooling margin (SCM) l t
l Maintenance of an adequate SCM with an adequate DNBR assure that the fuel claddmg remams l
cooled.
The reactor coolant pumps (RCPs) remained running throughout the event and consequently large t;mpemture variations did not result and the reactor vessel upper head l
remained cooled. The pressure / temperature behavior during the event was evaluated and the l
i minimum SCM was detennined to be 39 F. This occurred during the pressure transient at the i
time of the steam generator safety relief valve (s) lift. Much of the time the SCM was > 80 F.
j Although all temperature and pressure indications substantiated that adequate SCM was always maintained, annunciator data indicated loss of SCM at approximately 12:20 p.m. during the event. The licensee investigated these alarms and reported that overhead windows D-40 and D-48, SCM low, are set to actuate at s 10 'F SCM, and that post event evaluation of annunciator historical data showed the following alanns:
'"m Date Time Train 1
4/7/94 12:20:02 - 12:20:05 A
2 4/7/94 12:22:57 - 12:23:00 B
3 4/7/94 21:21:38 - 21:29:01 B
4 4/7/94 21:48:03 - 21:56:58 A
i 1
5 4/8/94 03:30:42 - 03:46:36 B
l 6
4/8/94.
04:00:55 - 04:10:31 A
The licensee attributed these apparent losses of SCM to the core exit thermocouple processing system (CETPS) indication that results from pushing a train A or train B CETPS reset button or when a train of the CETPS is tested.
Each of the two CETPS trains is provided with the following inputs:
1.
29 incom thennocouple temperatures 2.
RCS pressure 3.
Containment radiation 4.
Containment pressure The licensee stated that the apparent losses of SCM indicated in items 1 and 2 were due to the nuclear control operator pressing the CETPS reset button. The mtional is as follows. The bottom of the containment radiation scale is 1 R/hr whereas actual containment radiation is close to zero. A zero will cause an alann. The operator will respond by acknowledging it on CETPS followed by pushing the system reset button to re-ann the containment radiation input alann.
I I
Mr. Steven E. Miltenberger 19 i
Depressing the reset button causes indicated SCM to go to zero, a result noted in the operator's procedure. The speciDeation for CETPS data transmittal time provides a maximum of 4 sec, consistent with the 3 sec time obsen'ed in table items I and 2.
Table items 3 - 6 were attributed to perfonnance of RCS hot leg pressure channel functional testing. Placing the channel switch in the test position causes.nc RCS pressure input to CETPS to be zero. The licensee stated it verified this testing as the cause by reviewing the control room narrative logs and the overhead annunciator historical data.
g 4
The AIT concurs with this explanation of the loss of SCM indications and concurs that adequate SCM was maintained throughout the event.
Rate of chance of temperature The temperature change prior to initiating the controlled cooldown was less than 100 F and the cooldown was conducted slowly and deliberately without approaching cooldown rate limits. Rate of c...nge of temperature v.as not a problem.
1 Rate of chance of oressure No large pressure excursions occurred that would represent a direct challenge to the RCS pressure boundary (except as noted below) or the fuel cladding.
Challenge to fuel cladding The licensee reported that there was evidence of one or two fuel cladding defects before the event and observed an iodine spike consistent with that number of defects after the reactor trip.
As discussed above, no conditions were found that could represent a challenge to the cladding during this event.
The licensee obtained a gas sample from the reactor vessel head on April 13 that consisted of about 96% nitrogen, 3% hydrogen, and minor amounts of other gases.
No significant radioactive components were found. This is consistent with a conchision of no fuel damage since no signiDeant quantities of fission product gases were found.
I The AIT concludes that there was no fuel cladding damage and no conditions existed that represented a challenge to the fuel cladding.
Low temperature ovemressure Temperature during the eveut never reached a value where low temperature overpressure would be a concern.
i
r i
Mr. Steven E. Miltenberger 20 Pre-Cooldown and Cooldown Opemtions l
The operators elected to restore the vapor space in the pressurizer after the initial solid operation in which pressure was controlled by the PORVs rather than initiating an immediate cooldown.
l They additionally elected to not trip the RCPs. The AIT concurs with these decisions. A choice to trip the RCPs or to attempt a solid plant cooldown could have significantly complicated the event.
The question of tripping RCPs was raised during the event. The AIT considers such questions to be part of a reasonable examination of alternative actions. In discussion with key personnel who were in the control room area during the event, it became clear that this alternative was never seriously considered for implementation.
Maintaining RCP operation during solid operation assured unifonn RCS temperature, provided better temperature control, and allowed eventual entry into cooldown with a nonnal plant configuration. Tripping RCPs would have introduced a significant temperature variation into the RCS and would have caused average RCS temperature to increasv, a particularly difficult situation since a variation of only 1 F would change RCS pressure by about 100 psi.
Reactor coolant system pressure for several houu following the second safety mjection is summarized in Fig. 2 in Attachment 7. The pan of the event during which the PORVs were controlling pressure occurred from about 11:30 a.m. to 12:00 noon. Following that, the PORVs were not challenged again. The operators essentially set the letdown rate and RCS temperature, and controlled pressure by varying the charging rate with the objective of maintaining 2150 i 50 psig. A pressurizer bubble was restored and pressurizer level reached 50% at 4:30 p.m. A nonnal cooldown from hot standby was initiated at 5:15 p.m. and was conducted without difficulty.
Post-Event Usage of the PORVs The pressurizer PORVs were relied upon for low temperature overpressure protection and for venting following the event. There was no evidence of a malfunction during this usage although, as discussed in Section 3.2, significant damage was found when the PORVs were disassembled.
Pining Considerations As discussed in Section 3.2, the AIT has little concern with piping downstream of the PORVs and safety valves. Previous analyses, tests, and the post-event examination of the piping by the licensee have shown this piping was not challenged during the event. The AIT questioned the licensee regarding the potential for damage upstream of the PORVs. The principal concern was the possibility of damage that could lead to a LOCA. This question had not been closed at the time of the AIT's exit from the facility, but was addressed by the licensee prior to requesting
~
i i
Mr. Steven E. Miltenberger 21 l
restart agreement from NRC Region I. This additional information was reviewed by NRC Region I in order to lift the provisions of the CAL that was in place. Results of that review will be documented in a resident inspection report.
Pressuri7er Relief Tank (PRT) Rupture Disk Du:ing the safety injection actuations, the PRT rupture disk ruptured to relieve the increasing tank pressure, which resulted from the volume of primary coolant inventory relieved to the PRT.
As a result, approximately one gallon of primary coolant was spilled onto the containment floor.
. Subsequent to the event, the mpture disk was replaced and the PRT inspected. The nipture disk
]
operated as designed and no damage occurred to the PRT.
Based on the AIT assessment of the reactor systems response during the event, no protective barriers failed and no abnonnal releases of radiation to the environment occurred.
J 3.5 Atmospheric Steam Dump Valves and Steam Generator Safety Valves Following the plant trip and initial safety injection, the reactor coolant system temperature increased as a result of core decay heat and reactor coolant pump heat. This RCS heatup, and the corresponding inuease in steam generator pressures were not recognized by the plant operators. Steam generator pressures increased above the setpoint of the steam generator safety valves because of the failure of the atmospheric steam dump valve (MS10) controllers to i
promptly respond. Consequently a steam generator safety valve lifted and the steam release through the valve caused a cooldown that initiated the second automatic safety injection due to an actual low pressurizer pressure condition.
The reason for the slow response of the atmospheric steam dump valve was investigated by PSE&G and reviewed by the team. The results of this review is described in Section 5 of this report. The steam generator safety valves and low pressurizer pressure safety injection initiation circuitry operated as designed.
4.0 PLANT OPERATOR PERFORMANCE & PROCEDURE ISSUES l
Gmss intrusions at the circulating water intake stmeture at Salem are a seasonal phenomenon, with more severe attacks in spring and autumn. Losses of circulating water pumps or screens affect condenser vacuum. Degradation of condenser vacuum can necessitate reducing reactor power or removing the turbine from service. The operator actions to cope with a grass intrusion are governed by procedures. In general, however, the actions taken by opemtors are a function l
of the extent and rapidity of the gmss intmsion (and resultant loss of circulators and condenser vacuum), and prospects for recovery of any lost circulators.
l l
l l
1 l
l 1
Mr. Steven E. Miltenberger 22 l
4.1 Operator Response Prior to the Plant Trip t
l Preparations and Response At The Circulating Water Intake Structure l
l PSE&G management had undertaken extensive efforts at the intake structure to combat the j
l circulating water grass intrusion and minimize the resultant, at least twice daily, tmnsient.
Management had assigned a shift supervisor, a maintenance supervisor, and an approximate 12 person crew at the circulating water intake stmeture for expected grass intrusions following diumal tide changes. Fire hoses and shovels were pre-positioned and used to remove grass from the screens during grass intrusions. However, during heavy grass intmsions, as occurred on April 7, a high screen differential pressure rapidly develops and disables the travelling screens by sacrificial failure of the shear pins that connect the screen motor to the screen gear.
The extensive PSE&G effoits at the intake structure had generally positive results in dealing with prior grass intrusions. Management established special work control procedures to facilitate quick restoration of failed circulating water screen shear pins. The special work control j
procedures allowed the.ocal shift supervisor to approve work and blocking tags during screen i
repair, thus bypassing uonnal work control oversight. Records were procedurally required to i
be maintained by the local shift supervisor for all work perfonned however, the tagouts and work control history used during the April 7 event were lost and no permanent record was made.
The local shift supervisor provided direct continuous communication with both Salem control rooms.
1 Preparations and Response at the Turbine Hall Two off-duty shift supervisory personnel were stationed at the water box area during grass intmsion to assist in restoration of circulators to service should trips occur. These individuals were available to assist in pump priming operations.
The inspectors learned that shift supervisory personnel would, at times in the past, override the water box priming protective interlock for the circulators by manually lifting contacts. This was found to be the case during the April 7 transient when an attempt to restore the 12A circulator to service was unsuccessful.
The on-duty Senior Nuclear Shift Supervisor (SNSS) manually lifted contacts, an action which is not directed in approved operating procedures.
This action by an SNSS sets a poor supervisory example for other crew members. As will be described and developed below, the l
SNSS's presence would have likely been more beneficial in the control room. His absence from the control room was an example of inappropriate prioritization of activities by shift crew management.
In spite of the efforts in planning and guidtnce outside the control room to effectively respond to grass intmsions, personnel response actions at the circulating water intake stmeture did not fully meet plant management expectations, and an action in the turbine hall (jumpering a protective interlock) was not procedurally directed and was taken by the senior crew manager.
I
i Mr. Stevon E. Miltenberger 23 Preparatio; Land Operator Response In The Control Room (Pre-trio)
Plant and crew management had made no special preparation for control room operator response to routine, expected grass intmsion into circulating water, even though the plant was operating with an important automatic control system in manual. The event revealed weaknesses in the i
existing procedures and training for control room response that might be required for a significant gmss intmsion.
Despite twice daily grass intrusions which caused power reductions and restomtions, no compensatory actions had been taken by management to ensure adequate reactor and plant j
control during the power swings. Automatic rod control was out or service on April 7 due to corrective maintenance. Operators had suspected that the T - T,a compamtor did not work m
properly and rods were being manually controlled.
No compensatory actions had been established to ensure manual rod control would not adversely hinder rapid power changes, apparently because management did not foresee the potential difficulties that could arise. Crew management expected the two reactor operators to coordinate the reactor transient during the gram intrusion. In particu ar, crew management foresaw no difficulties with one operator on control rods and bomtion, controlling reactor power and tempemture, while monitoring pressurizer level; and the other operator perfonning turbine load reduction while monitoring steam generator levels, and controlling balance of plant equipment such as heater drain pumps, feedwater pumps, and circulating pumps and screens.
Review of control room logs revealed some differences between those logs and the final sequence of events which suggested some minor confusion among the crew members. The operator assigned to control the reactor was also assigned to maintain a control ro(m log of j
activities. Review of the log revealed that all circulator pumps were removed from service or j
tripped during the event. At the time of the reactor trip, control room logs showed all pumps out of service and none returned. However, subsequent PSE&G review of circulator pump amperage, taken from computer data obtained during the event, reveal that two pumps were running at the time of the reactor trip.
i The inspectors considered the alann response procedures for low vacuum conditions to be weak because no specific turbine trip criteria were provided. Main condenser vacuum is monitored by the operators as turbine last stage back pressure. The operator's attempt to maintain back pressure as low as possible, with annunciator alarms at 25 inches of vacuum (Low alann) and 23 inches of vacuum (Low-Low Alann). The abnormal procedure for high backpressure (Iow vacuum) conditions contained no reactor trip criteria. The setpoiut for the low vacuum turbine trip was not specified by the procedure and the proceiure stated that the operator should restore vacuum unless a turbine trip occurred between 18 and '.2 inches Hg vacuum.
At 10:34 a.m. c,n April 7, the 12A, and 13A and 13B circulators were out of service. T*
abnonnal procedure for circulating water requires that loss of both 13 pumps in combination with any 12 pump out of service, requires the turbine be taken off line within one hour. It was clear to control room personnel that action was progressing to perform a normal, but rapid,
Mr. Steven E. Miltenberger 24 turbine shutdown until and unless the minimum number of circulators could be retumed to service. The rate of turbine load reduction was an attempt by the turbine operator to maintain a minimuni backpressure in the main condenser. The operators started the transient with the nonnal 1 percent per minute load reduction rate. Within a few minutes, an 8 percent per minute mte was used to unload the turbine. The reactor control operator was required to control reactor tempemture and power while simultaneously adding boron and inserting control rods while the turbine was being unloaded.
Expectations that circulating water could be returned to service in a shon period of time and prior experience in maintaining turbine operations through grass intmsions were contributing factors in the operators continued attempts to maintain turbine operations while progressing to a nonnal turbine shutdown. The SNSS left the control room during the transient to over-ride a circulator pump pennissive interlock and restan the 12A circulator pump in an attempt to maintain condenser vacuum and prevent a turbine trip. The SNSS would nonnally provide direction to the NSS on when a reactor or turbine trip should be initiated. The actions of the SNSS in combination with the extensive effon undenaken by station personnel to maintain turbine opemtion at both the circulating water intake and in the turbine hall reflected perceived management expectations that extraordinary effon would be used to overcome grass intmsions; and when viewed in conjunction with the below-described lapses in control of reactor power and coolant tempemture, indicate that attention was mappropriately divened from the primary systems to the balance of plant.
Numerous distractions were present in the control room during the load reductir i Continuing communications with circulating water opemtors required numerous assessments of plant conditions and restans or trips of circulators. In the ten minutes prior to the reactor trip, during the cooldown of the reactor; seven circulator pump trips and three restans occurred on Unit 1.
Additionally, the communications included Unit 2 activities as well as repeated circulator screen trips and restans. During this period, the rod control operator made at least one boron addition and moved control rods nearly 150 steps into the core. At low power, a feedwater pump oscillation occurred and the BOP operator requested and received authorization to idle a feedwater pump. The rod control opemtor was directed to leave the rod control panel and shift nonnal plant electrical loads from the main generator to an offsite power source. This evolution required three to five minutes to complete.
The reactor cooled to below the minimum temperature for critical operation.
The shift supenisor noted the cooldown and made a reactivity change by personally withdrawing control rods while the rod control opemtor was shifting nonnal plant electrical loads. The result of this change could not be detennined by the inspectors. The rod control operator returned to the control panel. He was given a direction to raise power to restore plant temperature and began a steady control rod pull. The shift supervisor did not discuss the fact that he had manipulated the control rods with the rod control operator when he returned and his direction to raise power lacked specificity, i.e., how far or how fast to raise power. The reactor trip occurred when power reached the 25 percent power high flux trip. At the time of the reactor trip, the only licensed personnel in the control room were the shift supervisor and the two assigned control operators. Other shift supervisory personnel including an SRO, an SRO-licensed shift technical l
1 i
i l
Mr. Steven E. Miltenberger 25 advisor, and the SNSS were in the turbine hall attending to water box priming. The AIT concluded that these resources could have been more effectively used for ensuring reactor control and coordination of primary and secondary plant operations.
Summarv PSE&G management's preparation for control room operator response to routine, expected grass intrusion into circulating water was weak. Automatic rod control, an important system for j
automatic reactivity control during rapid downpower maneuvers, was considered non-functional.
j This posed an additional burden to the operators. Operator guidance and procedures for rapid i
downpower maneuvers, loss of circulators, and restoration of T below the Technical m
Specifications minimum were weak or did not exist. This necessitated on-the-spot, subjective decision-making and opemtor response; mther than a pre-planned, thought out, operator
'l response. The above weaknesses were manifested in poor command and control of control room activities (confusion and lack of supervision of a relatively inexperienced reactor operator) prior to the reactor trip and safety injection. When the operators' effons were unsuccessful, the resultant plaat conditions (Lo-Lo T ) combined with a long-standing equipment problem (main m
steam line pressure spiking on turbine trip) to cause the first safety injection. The event suggested training weaknesses associated with the above topics, as well as perfonnance weaknesses (multiple, simultaneous reactivity changes and monitoring of reactor response) and control room supervisory weaknesses associated with supervision of operator activities and resource allocation, e.g., extra licensed operator personnel were used outside the contml room for balance of plant equipment, rather than inside the control room to assist with control room activities associated with reactor control.
4.2 Operator Response Following the Plant Trip and Safety Injections Reactor trip and first safety injection At 10:47 a.m. on April 7, the reactor tripped on low power high flux (25 %) while temperature was below P-12 (543 degrees F). The reactor trip response was as expected. However, momentary main steam flow instrument spikes while in the Low-T condition allowed panial m
actuation of Safety Injection logic. While operators recognized the SI actuation occurrence, no "First Out" alarm indicated the cause.
Injection equipment actuated as expected. Other equipment failed to respond as the operators expected when solid state protection system (SSPS) train B did not actuate as described in Section 3 of this repon. Emergency Operating Procedures (EOPs) account for SI actuation failures by directing operators to align individual components to the SI position. Ten valves required manual repositioning during sheet 1 of EOP-TRIP-1, the applicable EOP. Operators made one minor error in that they missed one letdown isolation i
valve during the initial valve alignments. During this time high head safety injection was filling l
the pressurizer. Prior to reset of safety injection and realignment of charging and letdown, more than thiny minutes had passed, the pressurizer filled solid, and the power operated relief valves had actuated repeatedly.
t
Mr. Steven E. Miltenberger 26 Operators took approximately 5 minutes to realign valves. Four more minutes were required to complete EOP steps that included control of auxiliary feedwater and isolation of main steam isolation valves (MSIVs). The operators took about seventeen minutes (reset at 11:05 a.m.) to reset from the initial safety injection. In addition, operators needed seventeen more minutes to establish pressure control with letdown and charging.
PSE&G had recognized that safety injection train disagreements wem possible occurrences and operator training included diagnosis of train disagreement conditions. However, no procedural actions were specified when train disagreement occurred. During the transient, the operators considered that tmin B of SSPS did not automatically actuate and took action to manually align the components as specified in the EOPs. Some discussion took place that train B should be declared inopemble due to the failure to actuate. At i1:26 a.m., train B manual actuation was used to insen a safety injection actuation signal during the solid plant cooldown, although automatic actuation occurred prior to the manual actuation. Because train A safety injection had actuated without any apparent coincident logic (as would have been indicated by the "First Out" alarm) in the control room, the operators could not be assured that either train was fully operable.
Solid Pressure Control The condition of the solid pressurizer should have been anticipated by the operators. The pre-trip cooldown below the minimum temperature had caused a shrink of pressurizer level due to contraction of coolant. The pressurizer level contro: system attempted to maintain level by limiting letdown and increasing charging into the reactor. The pressurizer level had contracted to less than 17 percent and the pressurizer heaters had cetout as expected on low pressurizer level. The subsequent safety injection added inventory to the reactor coolant system. In addition, the rapid reactor heatup after the first safety injection caused a swelling of reactor coolant making the pressurizer solid. Apparently, none of the operators had predicted the result of the operating sequence although all were trained to do so.
Following the initial safety injection, as they had been trained, the reactor control operator assumed the responsibility for stating the required initial actions of the EOPs. The BOP operator conducted the initial actions as read by the reactor operator. The initial actions were completed in approximately five minutes.
Because he was involved in the numerous manual valve alignments needed in this event, the secondary plant operator did not adequately monitor and maintain a stable steam generator pressure, and the automatic feature (steam generator atmospheric steam dumps or MS10's) used to control RCS temperature did not function because of the characteristics of the controller. Section 5 of this repon describes this characteristic.
Also, the operators not recovering the use of that feature led to the lifting of the steam generator code safety valve.
The opemtors did not anticipate the effect of the lifted steam generator code safety valve on the solid plant pressure and no attempt was made to control pressure prior to the rapid pressure decrease that led to automatic and manual actuations of the safety injection system.
Mr. Steven E. Miltenberger 27 Although the command and control function during EOP-TRIP-1 was as practiced, the operators neither diagnosed that the post-SI sequence would result in a solid pressurizer nor developed an adequate plan of action for contml of solid plant pressure when realized. The secondary plant operator did not establish adequate heat removal using the atmospheric steam dumps.
Second Safety Injection and Continued Solid Plant Pressure Control After a steam generator code safety lifted, cooldown of the solid plant caused a second, automatic safety injection on low pressure. The operators initiated a manual safety injection about the time when RCS pressure reached the SI setpoint. The second safety injection caused numerous PORV actuations. The PRT rupture disc failed as would be expected during this time.
The rapid pressure reduction was not anticipated by the operators. The operators did not have clear guidance on solid plant pressure control. They did not consider that establishing a bubble in the pressurizer was within the scope of the EOPs. The yellow path for high pressurizer level was not recognized nor used as guidance in drawing a bubble. Although in the Westinghouse systua of EOPs, a yellow path represents and optional approach to the event, the licensee did not provide for procedurally-controlled altematives to it. Thus, the AIT's view is that the correct path would have been identification of coolant inventory yellow path, then use procedure, Functional Recovery Coolant Inventory (FRCI-1) to establish a bubble.
Restoration of Normal Plant Pressure Control Stable plant conditions were established prior to staning the pressurizer heatup. EOP guidance was adequate in maintaining plant control and although there were numerous technical i
discussions and distractions in the control room during and subsequent to the safety injections, the operators controlled the plant to a safe endpoint. Event declarations were in accordance with station procedures.
The opemtors reset the second Si at !1:41 a.m. Operators were controlling RCS temperature by manual control of the MS10s. Earlier, during the response to the opening of the steam generator code safety valve (s), the operators experienced difficulty with the controls for 1IMS10 and, as a result, maintained this valve in a manual and closed condition. About an hour after reset, at 12:54 p.m., the 1IMS10 opened to about 50% open position, but was immediately closed with no noticeable cooldown. The plant pressure and temperature were then maintained l
using the other three MS10s with no funher difficulties.
Following reset of the second safety injection and establishment of solid plant pressure control using charging and letdown, the operators determined that the action statement of Technical Specification 3.5.2, which required two operable ECCS injection systems (or cooldown to below 350 F within six hours) could not be met. By design, the automatic ECCS actuation capability was not available following the safety injection actuation and would not be re-instated unless reactor trip breakers were cycled after the safety injection was reset. Salem procedures did not include a provision of restoring the automatic functions of the safety injection system from these l
i
Mr. Steven E. Miltenberger 28-conditions. In addition, the operators were not sure if either protection trains were operable based on performance during the preceding events. Since Salem operators had no procedural guidance for re-establishing automatic safety injection capability, and since it was not clear that the automatic logic was operable, and due to the estimated six hours required to re-establish a pressurizer steam bubble, the operators could not complete a reactor cooldown in the time required by the Technical Specification. PSE&G management considered the use of 10 CFR 50.54(x) while the EOPs were in effect. However, later, after restoring normal pressure control and completing the EOPs, PSE&G requested and was granted enforcement discretion by the NRC for the additional time necessary to allow a reactor cooldown in a controlled manner, in accordance with nonnal cooldown procedures without automatic safety injection capability.
Event Declarations Declaration of the Notification of the Unusual Event was timely and in accordance with Salem Emergency Action Ixvels. The decision of the emergency coordinator to declare an Alert to obtain technical assistance when EOPs did not provide clear guidance was prudent.
Summary Operator response to the reactor trip and safety mjection was per the emergency operating procedures. Operators maintained adequate sub-cooling margin throughout the event. Operator control of engineered safeguards equipment was appropriate throughout the event. The post-trip phase of the event revealed weaknesses in operator knowledge, performance, and procedural guidance for: solid plant pressure control; use of functional recovery procedure " yellow paths;"
j handling of SI train disagreements; and, control of MS10 controllers.
4.3 Procedure Adequacy and Use Prior to the Reactor Trin Prior to the reactor trip, direction to the operators for clogging and loss of the circulating water system was provided by procedure, SI-OP-AB.CW-0001(Q), Circulating Water System Malfunction. This procedure directed reduction of load and removal of the turbine from service when a minimum combination of three circulators was not met. The power reduction was conducted using the direction provided by procedure, St.OP-IO.ZZ-0004(Q), Power Operation.
Neither procedure provided management expectations as to when operators should cease the effort to maintain plant operations and instead, stabilize plant conditions by either turbine or reactor trip. As a result of the lack of guidance, operators went to an atypical rate of power j
reduction (8 percent per minute) in an attempt to maintain main condenser and turbine operation.
The inspectors did not identify procedural expectations for operator action if the plant temperature is not controlled above the minimum temperature for critical operations, except that l
Technical Specifications require recovery within 15 minutes.
I
Mr. Steven E. Miltenberger 29 The team identified that the Senior Nuclear Shift Supervisor, instead of directing control room activities during the transient, ignored operations directives for equipment control and manually defeated a circulator stan interlock located in the turbine building while attempting to ensure continued plant operation.
Following Reactor Trin At the time of reactor trip, operators correctly implemented procedure,1-EOP-TRIP-1, Reactor Trip or Safety Injection. The EOP directs that components not aligned by the automatic actuation be individually aligned to the safety injection position. Manual actuation of safety injection is directed if safety injection is required but not indicated on the control panel indication. In this case, actuation was indicated. but not required, hence no manual actuation was inserted. It was not clear to the AIT, that the operators could specifically associate the failure of the large number of components to respond to the safety injection actuation with a failure of SSPS train B logic. The team noted that no guidance had been provided to the operators on proper response to ECCS train disagreement, which was identified to the operators during the transient by flashing lights on status panel RP-4, on the main control board.
The operators correctly transitioned to procedure,1-EOP-TRIP-3, Safety Injection Termination, j
when appropriate plam conditions were established.
Following the initial trip and safety 1
injection, operators attempted to establish stable plant conditions but were unable due to the steam generator safety valve actuation and cooldown that resulted in a second safety injection.
j Quasi-stable conditions were established upon recovery and re-entry into procedure,1-EOP-TRIP-3, following the second safety injection. At this time, the plant was in solid plant pressure j
control. Specific control guidance for solid plant control is not provided by the SI termination procedure.
Guidance for re-establishing pressure control with a steam space in the pressurizer was available to the operators by Critical Safety Function; Coolant Inventory Status Tree, yellow path directive,1-EOP-FRCI-1, Response to High Pressurizer Level. However, this option was not used. Instead, the operators continued through 1-EOP-THIP-3, and with technical support from the Salem Technical Support Center, re-established the steam space in the pressurizer outside of direct EOP guidance.
As mentioned previously, given the resultant conditions of the transient, and absent procedural guidance to restore the automatic safety injection capability from those conditions, operators could not achieve the shutdown requirements of the plant technical specifications within the time allowed. A Notice of Enforcement Discretion was issued by the NRC to allow the operators to proceed with a nonnal cooldown.
Mr. Steven E. Miltenberger 30 4.4 Event Classification & Notifications Event Classifications and Notifications were per procedure.
The Alert declaration was panicularly prudent, given that the operators felt they wanted or needed additional resources.
During the initial notiHeation of the Unusual Event, NRC expectations were not met regarding the level of detail of the telephone reports to the NRC and the ability to discuss the event and answer questions that would enable the NRC to quickly assess the event to detennine the appropriate NRC response posture. The initial notification to the NRC did not convey to the NRC infonnation that complications were associated with the event. It was determined that the licensee's Emergency Plan and Event Classification Guide required the licensee's communicator to Gil in a data sheet (NRC Data Sheet - Attachment 8 of the ECG) that, if properly completed, would have given the NRC sufHeient detail within the required notification time. These problems with level of detail and knowledge of the event were due to the physical location and the pre-event activities of the communicator, combined with the limited background and experience level, in general, of communicators at Salem; and, an apparent lack of oversight by the senior nuclear shift supervisor in approving the infomiation developed for transmission to the NRC.
4.5 Simulator Demonstration On April 12, 1994, the Salem training depanment provided a demonstration of the event of April 7,1994 to AIT team members. The demonstration included an explanation of plant response, indications available to the operators, associated emergency operator procedures, and a walkthrough of the EOP actions. The demonstration provided the inspectors with a good understanding of the event dynamics, man-machine interface, and relevant procedures. The demonstration was valuable in fostering the team's understanding of the event and expected operator response. The team acknowledges the cooperation of site management and the Salem training depanment in facilitating the simulator demonstration.
4.6 Reactor Vessel Level Indication System (RVLIS) Monitoring On April 12,1994, the NRC Senior Resident Inspector noted that the RVLIS indications in the control mom were at 93% (indicating that the reactor vessel was not completely full of water) and questioned the operators about the indications. The SRI was told that operators at Salem are not required to monitor RVLIS indications while in cold shutdown. The team reviewed training material associated with RVLIS. This training material indicates that RVLIS provides accurate indication while in cold shutdown.
Assessment of the Gas Bubble in the Reactor Vessel Upoer Head The Salem RVLIS indications are readily visible on a back panel from the nonnal operator station at the control board. Further, the indication can be displayed on a control board monitor, although, this was not in use when discovered by the SRI The Senior Resident Inspector
l Mr. Steven E. Miltenberger 31 discovered that each of the two RVLIS readings were showing - 93% on April 12, 1994.
When this was identified to the operators, they were not aware of the indication and initially judged the instrumentation to be incorrect.
As a result, the AIT was concerned with the effectiveness of operator training on thic system.
In this case, RVLIS was specifically installed to provide an independent indication of waer level for events initiating from power operation. A full understanding of shutdown operation would instill the insight that RVLIS is imponant to shutdown operation as well. Apparently, the licensee did not expect that a gas bubble would fonn during its shutdown operating conditions.
Ultimately, after much discussion with the NRC, the licensee took the following actions:
a.
A sample of the gas bubble was drawn in a careful, well planned manner.
b.
Operating plans were changed to avoid plant penurbations until the gas bubble and its implications were understood. For example, the licensee typically switches residual heat removal (RHR) pu.nps from time to time to equalize use. A planned switch was postponed because the licensee had not yet investigated whether gas bubbles existed at other locations that could impact RHR system operation if the switch were made.
c.
An investigation was initiated to identify the source of the bubble. The investigation showed that the reactor coolant system (RCS) letdown, volume control tank (VCT) conditions, and charging were consistent with generating a bubble in the reactor vessel by introducing nitrogen from the VCT via the charging system. (NOTE: During shutdown operations a nitrogen " blanket" is maintained in the VCT to ensure proper pressure for the charging system and minimize the amount of oxygen in the system.)
The AITjudged that the gas bubble was too smW to be of immediate safety concern although it would have been a concern if significantly larger. Imponantly though, the AIT concluded that the bubble was slowly increasing when discovered. For the bubble to potentially penurb RCS J
cooling during normal RHR operation, it would have to expand into the hot leg. The most likely expansion process would result in draining all steam generator (SG) tubes, perhaps followed by lowering the pressurizer level, before a loss of RHR would occur due to vonexing at the RHR inlet. Loss of RHR due to the bubble was judged very unlikely based upon the bubble volume and pressure at the time it was discovered.
In addition to being concerned about the apparent lack of operator awareness about the formation of the gas bubble, the AIT was also concerned, however unlikely based on other indicators, whether the gas bubble could have been an indication of fuel damage. The licensee reponed an iodine spike following the reactor trip that was expected from its knowledge that one or two fuel pins were leaking. No indications of fuel damage due to the event were evident at the time of discovery of the bubble, nor were any found at any time by the AIT. The licensee obtained a gas sample at approximately 5:30 p.m. on April 13. Analysis showed it to consist of about 96%
nitrogen, 3% hydrogen, and minor amounts of other gases.
No significant radioactive 1
Mr. Steven E. Miltenberger 32 components were found. The analysis was as expected for a gas bubble at that location due to nitrogen being introduced from the VCT. The sample was consistent with a conclusion of no fuel damage since no significant quantities of fission product gases were found.
Based on the system operations since the plant shutdown and the evidence gathered through the licensee's sample analysis, the AIT detennined that the most likely cause of the bubble is gas transpon from the VCT. The composition of the gas sample is consistent with an origin in the VCT. Shonly after discovery of the bubble, the VCT pressure was 38 psig at a tempemture of 64 F, in contrast to essentially atmospheric pressure in the pressurizer gas space (and a higher pressure in the hot leg due to the head of water in the pressurizer) and an RCS tempemture of 170 F. Conditions existed for absorbing nitrogen in the VCT and releasing it in the RCS.
Licensee calculations confinned the plausibility of this behavior. The licensee reduced VCT pressure to 15 psig during the evening of April 12 to reduce gas transport into the RCS.
4.7 Operations Conclusions The event revealed a number of weaknesses in plant systems, procedu.es, operator actions and management controls that are nonnally maintained to assure plant safety:
Extensive response effons had been establisned by plant and crew management for rapid response to grass intrusions, including placing maintenance and opemtions supervisors in the circulating water structure during periods when grass intrusions occurred, streamlining of work controls including use of on-the-spot tagouts and elimination of individual component work orders, and the use of direct, continual communications between an SRO at the circulating water stmeture and the control mom. However, even the streamlined work controls were not fully adhered to during the April 7 event. Also, CW equipment control was still maintained by the control room operators without assistance, even though the resultant transient conditions were expected.
I The control room operators had not been provided adequate guidance on management expectations for control room activities during grass intrusions. During the rapid power reductions that had become almost routine, circulating water screens, circulating water pumps, main turbine load, steam plant equipment controls, and reactor controls required quick, on-the-spot manipulations to meet all of the guidelines for power reduction. The lack of management guidance was aggravated when rod control was placed in manual instead of the nonnat automatic condition, requiring direct reactor control and oversight as power was reduced. In spite of the daily power reductions and escalations, and the inoperable automatic feature of rod control, management had not provided additional measures to ensure that the control room operators could successfully respond to a rapid transient condition.
Pre-trip command and control of operator activities were weak as evidenced by: a poorly controlled rapid downpower with multiple reactivity changes; vague directions from the NSS to the reactor controls operator to " pull rods" to restore T above minimum m
temperature for criticality; an excessive rod pull; an operator being directed to leave the reactor controls console to transfer electrical loads while reactivity was not stable; and, the fact that supervisors did not obtain additional operator (s) in anticipation of the
l l
Mr. Steven E. Mittenberger 33 tmnsient to compensate for having rod control in manual. Additionally, the on-duty Senior Nuclear Shift Supervisor (SNSS) was outside the control room, manually defeating l
a circulating water protective pennissive interlock, when his presence in the control room would have better served nuclear safety.
The operators had not been provided direction an actions required for operation with reactor tempemture below the minimum temperature for critical operations.
Although the number of CW pumps and screens was below the minimum required for turbine operations, operations effons were directed toward plant recovery without a trip.
l This unsuccessful effon resulted in the conditions leading to the safety injections and subsequent loss of the pressurizer steam space.
Post-trip operator perfonnance and command and control were generally good, and in accordance with applicable procedures, although some weaknesses were noted.
Opesators implemented and appropriately followed EOP TRIP-1 and EOP-TRIP-3; with one minor exception, i.e., one letdown isolation valve was missed during the initial valve alignments.
The MS10 controller characteristics inhibited the control of atmospheric steam dumps.
Ineffective direction had been provide.1 to the operators to ensure adequate control of plant tempemture following reactor trips without condenser bypass capability. While training includ:a discession and simulator modeling of the MS10 control problems, the condition remained uncorrected for years. The inability to control the atmospheric dump valves wntributed to a steam generator safety valve lifting and the second safety injection during solid plant pressure control.
The operators had not anticipated that the cooldown and subsequent heatup would fill the e
pressurizer. No diagnosis of the effect of the open safety valve on the solid plant had been made by the operators until pressure rapidly fell.
Use and knowledge of functional recovery procedure " yellow paths" was weak. In particular, the availability and applicability of a yellow path to establish a pressurizer bubble was not known by to the operators.
The operators had not been provided sufficient direction regarding safety injection train logic disagreement, to minimize the recovery actions and possible avoidance of loss of the pressurizer steam space.
l Event Classifications and Notifications were per procedure. The Alen declaration was particularly prudent, given that the operators felt they needed additional resources. NRC
Mr. Steven E. Miltenberger 34 expectations were not met regarding the description of the event with the complications that occurred. Emergency Plan procedures for developing necessary infonnation to be transmitted to the NRC were not fully implemented.
Operators knowledge and use of RVLIS during cold shutdown conditions was weak.
o 5.0 EVALUATION OF TROUBLESIIOOTING ACTIVITIES The AIT reviewed the licensee's troubleshooting plans to ensure that the causes of the unexpected plant equipment response would be detennined. Also, the review ensured that the cause of any identified malfunction would be corrected. The AIT observed portions of the troubleshooting activities to verify that the activities were appropriately accomplished.
t i
Solid State Protection System Following the safety injection on April 7,1994, PSE&G personnel perfonned extensive testing of the SSPS to detennL.e the root cause of the event and to detennine if the system perfonned as designed. These efforts included visual inspections, perfonnance of established surveillance tests and event specific tests and troubleshooting. These activities included the following:
A visual inspection of the SSPS components, including the high steam line flow input relays was perfonned. Discoloration of the relay cases was noted and some relays had a powdery residue on the bottom of the case.
The response times of the high steam line flow input relays were tested to detennine the time from actuating the bistable to input relay contact closure. All relays operated and the drop out times varied from 4.2 to 14.8 milliseconds.
Surveillance tests St.IC-ST. SSP-0008(Q)(0009Q)," Solid State Protection System Train A(B) Functional Test," were perfonned.
The test results for both trains were satisfactory.
l Ponions of surveillance test St.OP-ST. SSP-0009(Q)," Engineered Safety Features SSPS j
Slave Relay Test Train 'A'," were perfonned to test the operation of slave relays K616
)
and K621. These relays control the closing of the MSIVs, the feedwater isolation valves and the tripping of the steam generator feed pump turbines and the main turbine. All relay tests were satisfactory.
Continuity checks of the release coils for the MSIV control auxiliary relays were also found to be satisfactory.
Surveillance test St.IC-TR. SSP-0004(Q), " Response Time of SSPS Imgic - Safety l.
Injection Train B," was perfonned with satisfactory results.
l l
Mr. Steven E. Miltenberger 35
" Mini SI Test" was developed and perfonned on each of the SSPS trains to detennine l
how long a Tafety injection signal must be present to cause the MSIV close circuit l
latching relays to energize. For this test, one main steam line high flow instrument was I
placed in a trip condition and a pulse generator was connected to the input of a second.
The plant was in a cold shutdown condition resulting in all of the low T instmments m
being in the tripped condition. With these conditions, a pulse signal input to the second high steam line flow instrument completed the trip logic necessary to generate a MSIV isolation and SI protective signal.
The results of these tests detennined that all of the latching relays operated as designed.
However, this testing demonstrated that consistent, predictable behavior could not be achieved unless the input signal lasted longer than about 50 milliseconds. Furthennore, the as found condition of the relays associated with Train A actuated faster than those associated with Train B; and therefore, a shoner input pulse duration on Tmin A would effect valve closure.
A similar time response test to that for the MSIVs was perfonned to determine if the feedwater isolation signal would close the four feedwater isolation valves and trip the main feedwater pump turbines. This testing also showed that the equipment actuation was dependent on the duration of the input signal. All components opemted as designed.
PSE&G decided to replace the high steam flow input relays based on the results of their visual inspection. A difference in response times of the two trains could also have been caused by differences in the input relay perfonnance. Following the relay replacements, the " Mini SI Test" was reperfonned for Train B. The results of this testing determined that the response time for the MSIV closing relays had decreased and the overall response times more closely approximated those for Train A.
Atmosoberic Steam Dumo Valve Controls The design function of the air-operated atmospheric dump valves (ADV) is to remove heat from the reactor plant when the main condenser is not available, and to prevent operation of the main steam safety valves (MSSVs) during operating transients. The main steam system pressure is normally approximately 1005 psig at zero power and decreases to approximately 850 psig at full power. The ADV controllers are set to open the valves at 1035 psig (whereas the MSSVs open 1
at 1060 psig). This setting results in a demand signal (actual steam pressure vs. "open" setpoint) that maintains the ADVs closed and charges capacitor;. in the ADV controllers. When steam pressure rises above the controller setpoint, the capacitor.: must discharge before the controller can begin providing signals to open the ADV. However, due to the actual pressure being below the controller setpoint for an extended period of time (850 psig vs 1035 psig), the controller output saturates low (a phenomenon called reset wind up) and causes a delay in opening the ADV. Switching the ADV controller to manual will bring it out of satumtion in a few seconds.
l
i l
Mr. Steven E. Miltenberger 36 However, the specific time period required for the controller to be in the manual mode to discharge the internal capacitor, removing the reset wind up, is not known.
l The team noted that the operators were trained to use the manual operating mode, however, the emergency operating procedures did not address the use of the manual mode.
The response of the controllers during the testing with a simulated ramp input pressure showed that the ADVs may begin to open before the pressure reaches the MSSV setpoints, but they may not limit the pressure increase to prevent opening the MSSVs.
To minimize the delay in the ADV controller response, PSE&G has installed a clamping circuit to decrease the full power setpoint from 1035 psi to 1015 psi and decreased the controller gain from 12 to 3 and the reset time from 180 seconds to 2 seconds. These changes should improve the response time of the ADV controllers to prevent a rapidly increasing steam pressure from unnecessarily opening the MSSVs.
The reset windup problem associated with atmospheric steam dumps was the result of a plant controls modif; cation implemented in the late 1970's to prevent an inadvertent opening of the valves. The AIT found that PSE&G had recognized this problem for many years, and had intended to address :t during a planned design change to the feedwater control system.
Licensee troubleshooting effons also detennined that the problem that occurred with 1IMS10 on April 7, was due to a bad servo in the controls, which was then replaced.
Rod Control System The team reviewed the following two issues related to the rod control system operation: first, why the rod control system was being operated in the manual mode prior to the event; and second, whether the rod control system responded appropriately when it was momentarily switched to automatic control during the event. To address these questions, the team reviewed the following:
maintenance history of the rod control system prior to the event; opemtion of the rod control system during the event; and e
troubleshooting and testing of the rod control system after the event.
The team reviewed the recent maintenance history of the rod control system to determine why it was in manual control at the time of the event. This review indicated that troubleshooting of l
the rod control system had begun on February 25,1994, to investigate three separate instances of unexpected control rod insenion while the system was in automatic control. The results of l
initial troubleshooting identified multiple grounds within the T,jT,,, recorder, which were corrected. However, on March 14, 1994, the rods again experienced unexpected control rod insenion.
Troubleshooting the same day identified noise at the T,a input from isolator
_.=
Mr. Steven E. Miltenberger 37 ITM505A. Noise was also identified on the T,,, input from isolator ITM412N. Subsequently, both isolators were replaced and the noise was eliminated. After isolator ITM412N was replaced, it was found to be drifting. The isolator was recalibrated and PSE&G continued to
^
i monitor it to detennine if the drift was a problem.
At the onset of the April 7,1994 event, the rod control s" stem was being operated in the manual mode. During the rapid load reduction the operator switched rod control to automatic with the NSS' approval. The rod speed indicated seven steps per minute and the rods stepped in approximately two steps then stopped. The operator observed the T,,, recorder and noticed a five degree temperature error between T,,, and T,,,, and de unined that rod speed should be 72 steps per minute. Therefore, the operator thought that automatic rod control had not responded appropriately and switched back to manual control.
PSE&G perfonned the troubleshooting to determine whether the rod control system responded appropriately in automatic during the event. This troubleshooting included the satisfactory perfonnance of procedure, SI.IC-CC.RCS-001 (Q), " Rod Control System Automatic Speed Verification," that verified proper rod control system opemtion et 6 and 72 steps per minute.
The rod speed and direction demand are based on a compensatx1 temperature error signal.
Temperature error is defined as the difference between T,cr and T,,, and is compensated by a power mismatch signai. The magnitude of the compensation sigual is dependent on the power i
mismatch between main turbine power and reactor power. Additional troubleshooting was perfonned to verify the preper operation of the rod control system by varying one input pammeter while maintaining the other input parameters constant. The results of these tests indicated proper operation of rod control in the automatic mode.
PSE&G also perfonned a dynamic test to verify proper operation of automatic rod control. This j
test established initial conditions where nuclear power, turbine power and T,,, were set at 10%,
while T,,, was set at negative five degree error. Nuclear power was then ramped from 10% to 25 % over a one-minute time interval. This test also indicated proper operation of automatic rod control.
PSE&G perfonned other troubleshooting to confinn that the problems identified prior to the event were adequately resolved. These tests included a verification that the system grounds were removed and that the isolator drift was within specification. Additionally, PSE&G concluded that the T,,, recorder should not be used as an indicator of required rod speed during power
^
changes and intended to communicate this to the licensed operators and reinforce it in operator training.
Intennediate Range (IR) Nuclear Instnmmntation System (NIS)
In addition to other functions, the IR instrumentation channels provide reactor trip capability and bk>ck both automatic and manual withdrawal of control rods (rod block) at 25 % reactor thermal power (RTP) and 20% RTP, respectively.
4-
l l
l Mr. Steven E. Miltenberger 38 This trip, which provides protection during reactor stanup, can be manually bypassed if two-out-of-four power range channels are above approximately 10% of full power. During the event, the reactor tripped at 25% RTP by the power range (PR) NIS low setpoint when the reactor power increased from 7% RTP to 25% RTP under manual control of the control rods.
During this power escalation, the IR instmmentation channels 1-out-of-2 logic did not provide either the md block or the reactor trip functions. It was determined that the IR instruments were indicating a lower power than the PR instruments and never exceeded the IR rod block or reactor trip setpoints.
The licensee stated that the IR rod block and trip function are for startup protection; but, the PR startup trip is used in the safety analysis (and the IR functions are not credited). The licensee's investigation found that the difference between the PR and IR instmment's indicated power was due to the different locations of these two detectors around the core. The IR detectors are in the middle-upper region of the core anil thus experience more neutron shielding from the control rods in the core (rod shadowing) than the PR detectors. The PR detectors are located at the upper and lower regions of the core and are, the efore, less affected by the re<l positions. For a given reactor power a..J control rod position, this phenomenon may result in a higher power indication on PR instn..nentation channels than on the IR instrumentation channels, as was observed during this event. PSE&G detennined that rod shadowing due to the control bank "D" rod position (operator pulled 35 steps, from step 55 to step 90 on control bank D) was responsible for the failure of the IR NIS to provide rod blocks at 20% RTP and reactor trip at 25% P.TP. Westinghouse study of this phenomena found that detector IN35 would not initiate signals for rod block and reactor trip until the RTP was 28.1% and 35.1 % respectively, while its redundant detector IN36 would not initiate those signals until 25.3% RTP and 31.6% RTP respectively. This translates into a maximum error of 10.1 % RTP on IN35 and 6.6% of RTP on IN36.
The existing setpoints of the IR instmmentation channels are based on WCAP-12103,
" Westinghouse Setpoint Methodology for Protection Systems, Salem Units 1 & 2."
In this analysis the assumed "setpoint uncenainties" used percent span accuracies for various Rack Parameters (RP) and Process Measurement (PM) that were consistent with the standard Westinghouse methodology. This analysis used a combined uncertainty value in tenus of percentage RTP for all PM components which contained allowances for power calorimetric down-comer temperature, radial power redistribution and rod shadowing.
A subsequent Westinghouse analysis WCAP-13549 "Setpoint Uncenainties for IR NIS of Salem Units 1&2" separated the rod shadowing from the rest of the PM components and perfonned calculations to detennine the maximum value for rod shadowing that would preserve the total allowance. Total allowance is the difference between the Safety Analysis Limit and the nominal trip setpoint assuming all uncertainties at their maximum values. The new calculation used an uncenainty of 1.8% RTP for rack drift which resulted in an increment of rod shadowing effect from 6.25%
RTP to 11.87% RTP. This value is found to encompass the observed error in the setpoint of the IR NIS channels due to the rod shadowing phenomenon (10.1 % RTP on IN35 and 6.6%
I l
Mr. Steven E. Miltenberger 39 l
l RTP on IN36) as long as the actual as-found IR NIS Rack Drift is less than 1.8% RTP. The post-incident as-found setpoints of both IN35 and IN36 instmment channels were found to be l
within this assumed Rack Drift value.
l l
The team observed that the rod shadowing effect was used in the standard Westinghouse instrument setpoint methodology and may have been reevaluated in the plant specific analyses (e.g WCAP-13549) for other Westinghouse Nuclear Power Plants.
l Ujgh Steam Flow Setooint Chance Circuitrv 1
l PSE&G performed testing to determine if the automatic change in the high steam Gow setpoint l
following a reactor trip (P-4) was inducing electrical noise that may have caused momentary high steam low signals.
The resuhs of this test indicated that summator IPM505B dropped its setpoint slightly below the
)
expected setpoint for a period of time following the reactor trip, while summator IPM506B resin aded as expected by geing directly to the new setpoint. PSE&G mied this out as a possible cause of the event since high steam flows were received on both channels and this would require that both summators exhibit the same setpoint drop.
PSE&G continued troubleshooting the high steam flow setpoint circuit to identify the cause of the summator IPM505B setpoint dropping below the expected setpoint. Initially, PSE&G thought that the summator had failed, however, a replacement module yielded the same test results. Further investigation by PSE&G revealed that both the replacement module and the module that was installed at the time of the event were not the proper module. This module and the one used to replace it during the current troubleshooting were of the proper part number, but did not contain the "special" designation specified by the vendor. This "special" designation was used to identify the incorporation of a capacitoi in the summator circuit. Upon determining that the wrong module was installed, the licensee installed the proper module. The test was perfonned again, and the same results occurred. At the conclusion of this inspection, PSE&G was continuing to investigate the reason for the high steam flow setpoint dropping below the expected setpoint following a reactor trip and how the incorrect module was installed in 1989.
The AIT concluded that neither of these two concerns contributed directly to the April 7,1994 event; but, that the second issue was a potential loss of configuration control.
Conclusion The AIT closely monitored the licensee's troubleshooting and testing activities. The team found that the planning, control and performance of troubleshooting activities were very good and I
resulted in the thorough validation of the root causes for the unexpected equipment responses.
l The results indicated that the plant responded as designed for the conditions present on April 7,1994.
Also, some equipment perfonned poorly, as a result of pre-existing vulnerabilities or deGeiencies such as the CW screen wash system, the high steam flow relays l
and the MS10 controllers. As described in Section 3.2, the licensee was initially prepared to
1 l
l l
Mr. Steven E. Miltenberger 40 accept the pressurizer PORVs without a visual examination of the valve internals. While this activity was noted as weak by the AIT, this was not indicative of the licensee's generally very good troubleshooting effons.
6.0 OTHER FINDINGS Condenser Vacuum Alarms and Associated Procedures The team reviewed the alann printouts and the SPDS printout of the condenser vacuum values for the April 7,1994 event. This review revealed the following:
The vacuum sensed on the west side of the condenser was consistently 2" - 3" Hg lower than that of the east side as recorded by the SPDS; The vacuum sensed on the west side of the condenser dropped below 23" Hg at 10:40 e
a.m. and remained below 23" Hg for approximately three minutes, with the lowest value being 21.67" Hg for over one minute during that time; and e
The condenser vacuum low-low alarm came in at 11:23 a.m., while the condenser vacuum low alann did not come in during de event.
The condenser vacuum sensed on both the east and west sides of the condenser are used to provide indication. Additionally, the condenser vacuum sensed on the east side is used to provide alann functions. These alann functions are a condenser vacuum low alann with a setpoint of 25" Hg, and a condenser vacuum low-low alann with a setpoint of 23" Hg.
Discussions with PSE&G staff revealed that the condenser is a single-pass condenser, with the circulating water entering on the east side. This design explains the variations between the sensed vacuum for the east and west side.
The team reviewed the alann response procedure for the condenser vacuum low-low alann.
This procedure described the alann serpoint, the cause, automatic actions associated with the alann and operator actions required in response to the alann. The automatic actions described in the procedure were a turbine trip and reactor trip if power is greater than 49%, and just a turbine trip if power is less than 49%. The team detennined this statement is incorrect since the device that trips the turbine is a mechanical device not related to the device actuating the alann. Additionally, review of the last calibration of the turbine trip device indicated that it was set within its specified range of 18" - 22" Hg, at 18.4" Hg, and would not have actuated at the same time as the alann. To address this issue PSE&G developed a procedure revision request to revise the alann response procedure so that it properly reflects that the turbine trip is not an automatic function associated with the condenser vacuum low-low alann, i
l
Mr. Steven E. Miltenberger 41 SSPS Confonnance with IEEE-279 Code of Federal Regulations in 10 CFR 50.55a(h) requires the nuclear power plant protection system to meet the requirements of IEEE Standard 279, " Criteria for Protection Systems for Nuclear Power Generating Stations." As a result of the equipment responses experienced during this event the team reviewed the SSPS design relative to two sections ofIEEE-279.
Section 4.16 ofIEEE-279, " Completion of Protective Action Once it is Initiated," states that the protection system shall be so designed that, once initiated, a protective action at the system level shall go to completion and return to operation shall require subsequent delibemte operator action.
Section 4.12, " Operating Bypass," which states that where operating requirements necessitate automatic or manual bypass of a protective function, the design shall be such that the bypass will be removed automatically whenever pennissive conditions are not met.
The team found that there were latching relays or seal-in features in all of the component control circuitry such that if there were actual conditions requiring an MSIV isolation and safety injection, all actions are designed to go to completion. Also, the team detennined that the manual bypass of SI (Auto SI block following reset) in response to an EOP step is not an operating bypass. The t)h>cking of automatic SI following a system reset, pennits the opemtors to take manual control of equipment as necessary to recover from a plant transient or accident.
The period of time that the auto SI may be blocked is controlled by plant Technical Specifications.
i The team concluded that the SSPS at Salem was in compliance with IEEE-279.
i SSPS Modification History The team reviewed the modification history associated with the SSPS, including changes to the i
steam flow transmitters. It was detennined that the changes made to the system did not have any effect on the April 7,1994, event. Additionally, the team also reviewed the design specification for the SSPS, and found no specification related to the minimum pulse length required for actuation of the SSPS/ESF systems.
Input Relay Chatter The team found that the main steam line flow indications have experienced drifting during the operating cycle. The drifting resulted in the instrumentation output reaching the high steam line flow trip setpoint and caused momentary drop out and pick up (" chattering") of the associated input relays.
To climinate the relay chatter the flow instrumentation was periodically recalibrated. As discussed in Section 5 of this report, a visual inspection of the relays indicated some discoloration of the relay cases and the evidence of a powdery residue in the cases. The input relays were subsequently replaced. The response time of the Train B of the SSPS appeared to improve following the installation of new relays, however the team could not
Mr. Steven E. Miltenberger 42 determine if the relays had been degraded by the chattering. The cause of the instmmentation drift had not been identined prior to completing the AIT inspection. The AIT judged that the relay chattering did not play a key role in this event and should be reviewed by NRC as part of routine inspection. NRC inspection in this area was continuing after the AIT effort, as pan of the NRC Region I effort to review and assess licensee actions prior to restan. This effon will be documented in a future inspection report.
7.0 SAFETY SIGNIFICANCE AND AIT CONCLUSIONS 7.1 Safety Significance The AIT found that the event was not a significant threat to the reactor fuel, the fuel cladding or the containment. The RCS pressure boundary was maintained within its design throughout the event; however, the pressurizer PORVs and piping upstream of the PORVs were challenged by frequent cycling of the valves to maintain RCS pressure.
The PORVs functioned.a designed to prevent an RCS overpressure although they were damaged in the process. This dmnage did not appear to affect PORV functionality during or following the event. The licensee did not complete evaluation of piping upstream of the PORVs prior to the AIT exiting the site, and consequently the AIT was unable to complete its assessment of that piping.
1 The PRT rupture disk relieved to containment as designed during the event. The amount of coolant released to containment was minimal and readily cleaned up following the event. The containment pressure boundary was not challenged.
The most likely complication with significant consequences if funher failures had occurred during the event is a small break LOCA. Multiple equipment failures would have been necessary for this to occur, such as: coincident failures to close both a pressurizer PORV and its block valve; or, coincident failures to open both PORVs and a resultant opening of the pressurizer safety valve (s) and a subsequent failure of one or more valves to close. However, initiation of the LOCA would be within the design basis for the plant, and equipment necessary to mitigate such conditions responded as designed to the inadvertent safety injection actuation and hence, would have been available to respond to any funher degradation had it occurred.
The Salem April 7 event resulted in no protective barrier failures. However, the event led to a loss of the pressurizer steam space and significantly challenged RCS pressure boundary j
components.
While, as described above, the safety consequences of the event were minimal, the AIT considered the equipment, personnel perfonnance and procedural problems to be notewonhy and to warrant addressal by the licensee.
l Mr. Steven E. Miltenberger 43 7.2 AIT Conclusions No abnormal releases of radiation to the environment occurred during the event.
l The AIT developed an independent sequence of events and perfonned an assessment of key operating parameters that would indicate a failure to a primary barrier such as fuel cladding, reactor coolant pressure boundary or containment. The AIT determined that the primary boundaries remained intact throughout the event.
The pressurizer PORVs functioned properly on numerous occasions to maintain the RCS pressure boundary within the previously analyzed envelope. As a result of these opemtions, the j
pressurizer relief tank (PRT) mpture disk mptured, as would be expected, to prevent destmetion of the tank. As a result, a few gallons of reactor coolant from the PRT were released to the containment floor. The AIT reviewed the radiological surveys of the area near the PRT and concluded that the level of contamination was minor and consistent with the nonnal activity contained in the PRT.
Event challenged RCS pressure boundary resulting in multiple, successful operations of pressurizer PORVS and no operations of the pressurizer safety valves.
As stated earlier, the AIT findings disclosed that the event sequence provided a challenge to the RCS pressure boundary. As a result of the initial safety injection, the RCS filled with water.
Without the nonnal pressurizer steam space to dampen pressure excursions, the continued injection, both from the initial and second automatic safety injection actuations, resulted in repeated, successful actuations of the pressurizer PORVs to limit the RCS pressure within the analyzed envelope.
The AIT concluded that the event did in fact pose a significant challenge to the pressure boundary by challenging the PORVs; that the pressure boundary protective devices (PORVs and safety valves) functioned properly throughout the event; that no limits were exceeded during the event; and that some equipment degmdation resulted.
Operator errors occurred which complicated the event.
The AIT reviewed plant event data and interviewed the operators involved in the event. It was concluded that operator errors occurred throughout the event sequence. However, it was noted that operator perfonnance was better after the reactor trip than prior to the trip.
The opemtors responded appropriately to the potential loss of condenser circulating water by decreasing reactor and turbine power, ultimately with the intent to remove the turbme-genemtor unit from service. Power was reduced, using a combination of control rods and boration, to a l
point that the operators began to switch onsite electrical loads to offsite power supplies in I
anticipation of removing the turbine from service. The shift supen'isor directed the operator on j
the reactor controls to perform the electrical load swaps. At that time, neither the shift
Mr. Steven E. Miltenberger 44 supervisor nor the reactor operator recognized that the reactivity change, due to borations, was incomplete. In fact, when this was complete, the reactor power was less than the turbine power so that T,,, began to decrease. This decreasing T,,, was not immediately identified; however, upon discovery the shift supervisor responded to this condition by pulling rods in manual. Thus, the shift supervisor was no longer in a position to properly direct the activities of the reactor J
operators. The RO completed the electrical load swap, returned to the reactor controls without I
adequate communications from the shift supervisor regarding the shift supervisor's actions and commenced to raise reactor power. The RO noted that T,,, had gone below the Technical Specification minimum temperature for criticality, but failed to effectively communicate such to the senior reactor operator. Also, the shift supervisor directed the RO to raise power, but, was not explicit regarding how far or fast to raise power. Absent such direction, the RO continued to raise reactor power while monitoring T,,, for an indication that temperature was recovering and failed to identify that a reactor trip on low power-high flux condition would occur. As a result of the above operator errors, a reactor trip occurred on high flux (25%) and the low T.,, condition was still present. The low T.,, condition in coincidence with an indicated high steam flow signal initiated the first automatic safety injection.
After the reactor trip and safety injection, the operators appropriately entered the EOPs and successfully completed the required actions. As a result of the unusual equipment response to the initial safety injection system actuation, descriisd previously; numerous valves were not in the expected or required position per the EOPs. The operator responded to these conditions per the EOPs. One letdown isolation valve that was mispositioned was not initially identified and corrected by the operator. This was subsequently discovered by the operators during the tennination/ recovery actions after identifying that the safety injection was not needed. Itis noted by the AIT that a redundant valve for :his same isolation line did close.
At about this time in the event sequence at least one steam generator code safety valve lifted causing a rapid secondary and primary cooldown.
This cooldown, from the solid RCS condition, induced a very rapid depressurization of the RCS, and ultimately the second safety injection. The AIT concluded that the operators were not properly monitoring the RCS heatup resulting from decay heat and the running Reactor Coolant Pumps, after the initial safety injection. The AIT noted that the automatic steam generator atmospheric relief valves should have lifted before the steam generator code safety valve set point was reached, but due to a characteristic of the controller for the relief valves (reset windup), which the operators were trained to handle, the valves did not open sufficiently to limit the main steam pressure rise.
Following the code safety lift, operators properly responded by taking manual control of the steam generator atmospheric relief valves in order to lower pressure to re-seat the safety (s). The resulting rapid RCS depressurization was observed by the operators and they decided to manually re-initiate safety injection. A second automatic SI occurred prior to the manual operation; however, the operators continued with the manual actuation. The operators then appropriately re-entered their EOPs at this time without funher error.
1
4 i
i Mr. Steven E. Miltenberger 45 In addition to the above, the AIT also identified the following two concerns regarding operator actions:
During the down power transient, the senior shift supervisor, also SRO-qualified and the senior management representative in the control room, left the control room area to bypass a condenser l
vacuum permissive switch in an attempt to restan one of the inoperable circulating water pumps, hoping to restore adequate condenser cooling. The AIT concluded that this was an inappropriate work activity and also, poorjudgement on the senior shift supervisor's pan to leave the control j
room during the transient.
After the initial safety injection, the senior shift supervisor left the control room proper in order to classify the event and initiate notifications per the emergency plan implementing procedures.
While this activity was timely, the initial notification message developed for a communicator provided minimal information to the NRC in that it failed to describe the complications that had.
occurred.
e Management allowed equipment problems to exist that made operations difficult for plant operators.
1.
The AIT founu that during this event and for about a month prior to the event, that the automatic rod control system was not in service. This led to the operators having to manually control reactor power to maintain RCS T.,, within progmm.
During the event of April 7,1994, the operators initially decreased turbine power at 1 %/ minute, but quickly increased that rate change to a maximum of 8%/ minute. At this i
rate of change, even the automatic rod control system would not have been able to maintain T,, in program without operator action to assist by boration. With the rods in 1
manual, as was the case, operator action in response to the 8%/ minute rate of change j
was very difficult.
The AIT noted that PSE&G management was addressing the automatic rod control system problem and that, in fact, the control system was available at the time of the event. However, operations management had not yet restored the system to service since a final surveillance test had not been completed. That test had been scheduled for the day of the event.
2.
The AIT found that the short duration, high steam flow signal, resulting from the turbine trip, had been previously identified by the licensee following prior post-trip reviews conducted after similar turbine trips in the past. Information provided the AIT indicated this condition had been recognized as early as 1989. The high steam flow signal was of very short duration, on the order of 20 to 30 milliseconds, and appeared about I second after the turbine trip. While this condition had been recognized previously, the licensee attributed the cause to be a combination of the logic (the reactor trip automatically reduces the high steam flow setpoint from about 110% to about 40% of rated steam flow)
Mr. Steven E. Miltenberger 46 and the actual decay in steam flow following a reactor trip-turbine trip. Upon closer analysis following this event, the licensee identified that the actual cause of the indicated high steam now signal following a turbine trip corresponds to a pressure wave initiated by the turbine stop valve closure.
The AIT concluded that this pressure wave did cause the indicated high steam Dow, and, coincident with the low T condition induced by operator error, resulted in the initial m
automatic safety injection actuation. The AIT further concluded that earlier licensee 4
assessment ofindicated high steam flow after turbine trips was inadequate in that it failed to identify this mechanism and therefore the problem remained uncorrected, j
3.
The AIT found that the automatic controls for steam generator atmosphere relief valves were not maintained. This, coincident with the opemtors failure to recognize that RCS l
and steam genemtor temperature and pressures were increasing after the initial safety injection, led to the steam generator code safety (s) actuation and resultant second safety injection actuation. The atmospheric relief valves (MS10s) control system had been i
modified in tht, ; ate 1970's, which resul:ed in the controls not responding properly in automatic withut operator action. Plant operators had been trained to make up for this deficiency by placing the system in manual for a few seconds and then restoring the system to automatic. This would result in the control system then working properly.
During the events of April 7,1994, the operators failed to take adequate manual control of this system prior to pressure increasing to the lift setpoint of the steam generator code
)
safety (s).
The AIT detennined that the control system for the MS10s was known to be deficient.
Modi 0 cations had been planned, but never implemented to correct these conditions and operators had been expected, through training, to make up for the control deficiencies by manual actions.
4.
The AIT found that the circulating water system was vulnerable to periodic grass intmsions. This had been documented by the licensee for a number of years. Records indicating that this condition was especially aggravated in the spring of 1994 were provided the to AIT. However, the vulnembility had been previously recognized by the licensee and modifications had been planned to make the system less susceptible to grass intmsions. These modifications had not been implemented prior to the event. During i
the spring of 1994, as the river grass conditions worsened, the licensee began to initiate special work teams and work controls at the circulating water structure in response to the predictable grass intrusions that occurred coincident with daily tide changes. These special practices were quite effective at responding to the degrading circulating water conditions and usually resulted in restoring inoperable traveling screens and circulating water pumps without the need for control room operators tripping the turbine or reactor.
The AIT noted that on one occasion prior to the April 7 event, operators had been forced i
to remove the turbine from service as a result of a grass intrusion; but, the reactor was maintained in low power operation. No further complications had occurred on that
Mr. Steven E. Miltenberger 47 i
event. It was also noted by the AIT that the event of April 7 was apparently more severe than earlier events, resulting in operators decreasing power at a maximum of 8%/ minute.
This was done to reduce turbine power fast enough to minimize the increasing back j
pressure in the condenser. The prior grass intmsion events did result in operators frequently reducing power to maintain condenser vacuum, while the special work activities at the circulating water structure restored inoperable circulators. However, no prior event required such a high rate of change in power to compensate for the loss of circulating water.
The AIT determined that the grass intrusion event of April 7 was very severe; however, the vulnerability of the design was previously recognized and modiGcations to improve the system had not yet been implemented.
Some equipment was degraded by the event, but overall, the plant performed as e
designed.
The NIT observed the licen3ee's troubleshooting effons. It was noted by the team that certain valves for the safety injection systems, containment isolation systems, feedwater isolation system, and steam line isolation system did not respond in the usual manner to the initial automatic safety injection actuation. This was a result of the short duration of the initiating signal, which was only of sufficient duration for parts of the protection logic to respond, resulting in the unexpected behavior. However, functional testing of the protection logic clearly indicated that it would have perfonned properly in response to real accident conditions had they been present.
The AIT further concluded that licensee troubleshooting methods clearly demonstrated the logic responded as would be expected to the shod duration signals. The AIT detennined that the plant response to the event was as expected for the conditions that occurred.
The troubleshooting effons clearly demonstrated that the protection logic response, as well as the response of the main steam and feedwater isolation systems, were a direct result of instrument sensitivity and response behavior to short duration signals. Testing demonstrated that consistent, predictable behavior could not be achieved unless the input signal lasted longer than about 50 milliseconds. The vulnerability of the protection system to short duration signals had not been previously identified or evaluated by the licensee prior to the April 7 event.
Due to the repeated operation of the pressurizer PORVs, the AIT requested, and the licensee completed an assessment of the PORVs, pressurizer code safety valves and attendant piping and suppons. The licensee and NRC inspected the PORV internals, which exhibited wear requiring funher evaluation and corrective action prior to restart.
As a result of the troubleshooting activities, other equipment conditions requiring repairs were also identified, including the PRT rupture disk, main steam high steam flow input relays, and various MS10 control components.
Mr. Steven E. Miltenberger 48 e
Operator use of emergency procedures was good.
The AIT detennined that the operators' use of the EOPs in response to the multiple automatic safety injection actuations was good; however, some errors happened after entry into the EOPs.
The AIT found that operators were not specifically knowledgeable in the use of EOP " Yellow Path" procedures for solid plant recovery. " Yellow Path" system function restoration procedures are optional in the Salem EOP scheme; but, for this event and the solid plant condition, no alternative procedures had been provided. Knowledge, training and practice in the use of
" Yellow Path" procedures could have aided the operators earlier in the recovery of the pressurizer steam space following the multiple SI actuations.
Operator actions to manually. initiate SI on rapidly decreasing RCS pressure and in declaring the Alen to ensure appropriate engineering suppon for plant recovery from the solid RCS condition were considered appropriate by the AIT.
Prior to entry into the EOPs, the operators committed a number of errors dealing with command control and coordination of the downpower tmnsient. Most of these errors could have been avoided if appropriate guidance had been developed and implemented in the normal integrated operating procedures and in the abnonnal or alann response procedures.
e Licensee investigations and troubleshooting efforts were good The AIT closely monitored the licensee's troubleshooting activities and, to a lesser extent, the licensee's independent investigation. Based on the direct observation of the logic testing and other troubleshooting activities, the AIT detennined that the licensee approach was clearly to ascenain the root causes of the events of April 7, identify necessary corrective actions and then implement such measures. However, it was noted by the AIT that the licensee was prepared to accept the operability of the pressurizer PORVs witiiout a visual inspection of the components.
The AIT asked for the necessary engineering evaluation of the PORVs upon which the licensee was to base their opembility assessment. Prior to developing this evaluation, the licensee then elected to open the components for a visual inspection. This led to the Gndings of the degraded PORV internals resulting from the event. While this specific activity was not pursued rigorously by the licensee without NRC prompting, this was not indicative of the other troubleshooting activities observed by the AIT.
The AIT met with members of the licensee's investigation team to discuss preliminary findings; and, reviewed the operations post trip report and the investigation report. Infonnation gathered from these reports was useful to the AIT assessment. Funher, the licensee's sequence of events and facts supponing the event sequence were found to be consistent with the AIT's. The AIT concluded that there was evidence of noteworthy management oversight and control weaknesses due to the coincidence of equipment issues, both recent and historical, operator errors and procedural guidance deficiencies that all contributed signiGeantly to the April 7 event. In contrast, the licensee's investigations placed a greater emphasis on the operator errors in contributing to the event. The AIT noted that the licensee's investigation did not attempt to
Mr. Steven E. Miltenberger 49 ascertain why the operator errors occurred, but identified the errors as root cause. However, it was also noted by the AIT that licensee's recommended corrective actions clearly addressed the equipment and procedural deficiencies that contributed to the event.
8.0 EXIT MEETING On April 26,1994, the AIT conducted a public exit meeting at the site discussing the inspection scope and preliminary findings. The exit meeting slides were provided to the public and made an official record under separate correspondence to the licensee, dated April 26,1994. The attendees at the exit meeting are listed in Attachment 6. Following the public meeting, the AIT met with and responded to questions from the public and media representatives in attendance.
l j
)
5 I
l
\\
l l
July 6, 1994
]
i i
Docket Nos.
50-272
)
50-311 Mr. Steven E. Miltenberger Vice President and Chief Nuclear Officer Public Service Electric and Gas Company
-P.O.
Box 236 Hancocks Bridge, New Jersey 08038 1
Dear Mr. Miltenberger:
l 4
SUBJECT:
APPARENT VIOLATIONS RELATIVE TO THE APRIL 7, 1994 E i
i The NRC inspect! n findings relative to the circumstances surroun i
partial loss of clant circulating water flow and subsequent plant were detailed in the Augmented Inspection Team (AIT) Report 94-80 s
our letter, dated June 27, 1994.
Further discussion of several o in NRC Inspection Reports 94-11 and 94-13.
These reports identif l
consider important to the safe operation of the Salem units, and complicated recovery from this event, or were indicative of weak t
.important plant activities.
\\
The April 7th event _is of concern to the NRC since'it resulted in Salem operators and plant safety systems.
The control room comma j
transferred or relinquished for pivotal parts of the event, and a i
l the reactor cooldown in progress and prevent the ensuing safety i j
occur.
Longstanding equipment deficiencies that also led to, and specifically, the atmospheric relief valve controls and steam lin L
and corrective actions were not aggressively pursued.
Communicat l
the early stages of the event were ineffective in characterizing i
transient, including the scope of equipment failures, the causes I
the resultant condition of the plant, and the planned recovery ef for dealing with the abnormal plant conditions (namely, grass int reduction, and recovery from a water-filled pressurizer or " solid inadequate, insufficiently detailed, or nonexistent.
Finally, de
.found to be inadequate, in that the pressurizer power-operated re component materials, although satisfactory for use, were not as s a solid state protection system (SSPS) 3cgic card was subsequentl wrong type.
This event and the concerns outlined above are more troubling giv
-frequency of hardware initiated events at Salem over the past fou problems with procedural adherence, depth of root cause assessmen i
of long-term effectiveness of corrective actions.
i Apparent violations, as described in the enclosure, are being con enforcement action in accordance with " General' Statement of Polic 3
Enforcement Actions" (Enforcement Policy), 10 CFR Part 2, Appendif i
Notice of Violation is being issued for these inspection findings 1
I 1
number and characterization of the apparent violations may change NRC review.
The apparent violations and the need for an enforcement conferenc in a telephone conversation on July 6, 1994, and the conference h NRC Region I office for July 28, 1994.
This conference will be o in accordance with the Commission's trial program as discussed in Register notice.
Although not required, we encourage you to prov how you believe holding this conference open to public observatio presentation and your communications with the NRC.
The decision conference does not mean that violations have occurred, or that taken.
The purposes of this conference are: (1) to discuss the a cause and safety significance; (2) to provide you with an opportu our inspection report, and identify corrective actions, taken or any other information that will help us determine the appropriate the Enforcement Policy.
The conference is also an opportunity fo information concerning your perspectives on the severity of the a application of the factort that the NRC considers when it determi penalty that may be assessed in accordance with Section VI a.2 of
. -. ~ -. - -
l i
In accordance with'10 CFR 2.790 of the NRC's " Rules of Practice,"
its enclosure'will be placed in the NRC Public Document Room.
No is required at this time, and your cooperation is appreciated.
Sincerely,
{
ORIGINAL SIGNED BY James T. Wiggins, Dir Division of Reactor S
Enclosures:
i 1.
Apparent Violations Considered for Escalated Enforcement I
Report 94-80) 2.
Federal Register Notice (Vol. 57, No. 133, July 10, 1992) i for Conducting open Enforcement Conferences - Policy Stat l
cc w/ encl:
J. J.'Hagan, Vice President-Operations / General Manager-Salem Oper S. LaBruna, Vice President - Engineering and P4 ant Betterment-l C. Schaefer, External Operations - Nuclear, Delmarva Power & Ligh R. Hovey, General Manager - Hope Creek Operations F. Thomson, Manager, Licensing and Regulation i
R. Swanson, General Manager - QA and Nuclear Safety Review J. Robb, Director, Joint Owner Affairs A.
Tapert, Program Administrator
- R. Fryling, Jr.,
Esquire M. Wetterhahn, Esquire P.
J. Curham, Manager, Joint Generation Department, Atlantic Electric Company Consumer Advocate, Office of Consumer Advocate William Conklin, Public Safety Consultant, Lower Alloways Creek T K. Abraham, PA0 (2)
Public Document Room (PDR)
Local Public Document Room (LPDR)
Nuclear Safety Information Center (NSIC)
NRC Resident Inspector State of New Jersey State of Delaware i
i I
l I
i I
bec w/ encl:
Region I Docket Room (with concurrences)
Kay Gallagher, DRP D. Holody, RI J.
Lieberman, OE DRS File (2) bec w/ enc 1: (Via E-Mail)
J.
Stone, NRR W.
Dean, OEDO l
C. Miller, PDI-2, NRR M.
Shannon, ILPB M.
Callahan, OCA 1
i l
l l
RI:DRS*
RI:DRS*
RI:DRP RI:DRP NRR BMcDermott EKelly RSummers JWhite CMille.
7/
/94 7/
/94 7/
/94 7/
/94 7/
/94 l
l RI:DRP RI:DRS*
RI:OE*
RI:DRS RI:RA RCooper JWiggins DHolody WKane TMartin 7/
/94 7/
/94 7/
/94 7/
/94 7/
/94
- SEE PREVIOUS CONCURRENCE OFFICIAL RECORD COPY A:AITENF.LTR i
3 1
ENCLOSURE 1
'j f
i APPARENT VIOLATIONS CONSIDERED FOR ESCALATED ENFORCEMENT ACTION l
(AIT REPORT 50-272, 50-311/94-80; AND INSPECTION REP 50-272, 50-311/94-11 AND 50-272, 50-311/94-13) 1 i
l A.
Technical Specification 6.1.2 requires that the Senior Nu or, during his absence from the control room, a designate responsible for the control room command function.
Techn 4
administrative procedures, as referenced in Regulatory Gu Administrative Procedure NC.NA-AP.ZZ-002 (Q), Attachment 3 4
Responsibility for Station Operation, requires, in part, to survey and analyze all operating parameters.
The proc l
involvement in any particular detail may run the risk of of the overall operation."
The following two examples on demonstrated a loss of perspective regarding overall plan j
function of the senior nuclear shift supervisor:
i 1)
The SNSS left the control room during the loss of c override a circulator pump protective interlock, an command function ir. the midst of a significant plan absence, operators caused reactor coolant temperatu minimum temperature for criticality; and 2)
While the SNSS was absent from the control room, th (NSS), designated as responsible for the control ro assumed the duties of a reactor operator by perform movements.
As a result, for the period of time the controls, no individual was properly exercising the f"nction.
i B.
10 CFR 50, Appendix B, Criterion XVI, Corrective Action, j
licensees identify significant conditions adverse to qual take corrective action to preclude recurrence.
Two examp requirement occurred:
- 1) During previous reactor / turbine trips on June 10, 1989 February 10, 1994, the licensee failed to identify and spurious high steam flow signals.
As a result, the li unnecessary safety injection actuation on April 7, 199 1
trip; and j
l-I i
- 2) In March 1977, the licensee modified the control syste atmospheric relief valves (MS-los) and has since faile introduced during the modification.
As a result, the l
second unnecessary safety injection actuation on April i
opening of the main steam safety val m3 in lieu of the reactor coolant system heatup follow >ng the initial sa C.
10 CFR 50.57 requires, in part, that emergency plans and classification and notification of offsite authorities be Plan and Event Classification Guide, Attachment 8, NRC Da specified information regarding the event description be provided to the designated communicator for transmission minutes.
The specified information includes,
... systems i
their initiating signals, causes, effect of event on plan Note anything unusual or not understood..."
On April 7, 1994, the following information was not commu described:
(1) the apparent logic mismatch of the protec unexpected operation of the emergency core cooling system and the unexpected condition of the main steam and feedwa (2) the cause of the reactor trip was not described; (3) plant (namely, the resultant filled pressurizer or " solid operator plans to recover from the solid RCS condition.
D.
Technical Specification 6.8.1, requires, in part, that th procedures referenced in Appendix A of Regulatory Guide 1 February 1978.
Appendix A of Regulatory Guide 1.33, Sect procedures for combating emergencies and other significan transients and acts of nature.
During the April 7, 1994, event, the initial response to intake structure and recovery from the subsequent transie operators.
Procedural guidance was inadequate or nonexis activities:
- 1) Recovery of RCS temperature from below the minimum tem criticality;
- 2) Rapid power reductions due to grass intrusion;
- 3) Recognition of and response to safety injection train
- 4) Recovery from " solid" plant conditions.
E.
10 CFR 50, Appendix B, Criterion VIII, Identification and Parts, and Components, requires in part, that measures be identification and control of parts and components.
Thes identification of the item is maintained throughout insta incorrect parts.
The following are two examples that dem maintain configuration control:
[
- 1) During the 19D3 Unit 2 outage, power operated relief v l
made of 17-4PH stainless steel (original design materi 2PR1 and 2PR2, in lieu of internals made of type 420 s recommended and licensee-approved design change replac
{
1
~.
. =... -.. - - ~
l j
l i
l f
}
i 1
J l
1
- 2) The post-trip investigation for the April 7, 1994, eve summator module for the high steam flow setpoint did n identification and contained an incorrect electronic p determined this component did not affect the plant res an example of failure to properly identify components j
l F.
Technical Specification (TS) 3.5.2 requires two operable j
system (ECCS) injection systems, or a plant cooldown to b 1
hours.
During the event on April 7, 1994, and following.
actuation signals, automatic actuation capability was not l
l because the reactor trip breakers were not cycled.
This l
no procedural guidance for re-establishing the safety inj q
that the logic was operable, and because a cooldown could j
hours due to the time required to re-establish a pressuri 1
l This was recognized by the licensee, in that, TS' action 3 enforecment discretion was later granted by the NRC in re I
would not be below 350'F within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (or by approximat safety injection actuations that occurred on April 7, 199 l
i l
t I
r i
i I
i i
\\.
k[ t, s.,, a.f,
~
j Public Service
\\
l f
Electric and Gas Company a
}
i l
NRC ENFORCEMENT CONFERENCE l
l JULY 28,1994 1
i I
i SALEM l
GENERATING STATION I,
,C s
=
=
g
SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE l
AGENDA INTRODUCTION S. MILTENBERGER l
APRIL 7,1994 EVENT J. HAGAN Event Analysis Independent Assessment Event Significance i
POTENTIAL VIOLATIONS l
Failure to take corrective actions C. LAMBERT Loss of configuration control Command and Control L. CATALFOMO E-Plan Communications Procedural Adequacy Request for Discretionary Enforcement F. THOMSON
^ REGULATORY ASSESSMENT F. THOMSON SALEM IMPROVEhENT FOCUS S. MILTENBERGER.
Equipment Procedures l
People SUMh0LRY S. MILTENBERGER l
l f
1 l
SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE 4
l EVENTS ANALYSIS fj p.g (
^i l
Initial load reduction to reacter trip
- Circulating water pumps tripping due to marsh.
{
grass l
- Dedicated team at circulating water structure j
experiences difficulty due to quantity of grass
- Operators make decision to take Unit off-line l
- Shift supervisor directs transfer of electrical l
busses i
- Operator has primary temperature trending down but does not communicate this to shift supervisor 1
l
- Control rods manually withdrawn to restore l
primary temperature; results in an automatic l
- Automatic plant protection systems function as l
designed to trip the reactor i
Root cause l
- Control rods withdrawn farther than required l
e Inadequate command and control i
l i
j 94cc24
1 e
0 SALEM GENERATING STATION 4
NRC ENFORCEMENT CONFERENCE EVENTS ANALYSIS First Safety Injection i
e Immediately following the reactor trip a safety injection occurs
- Main turbine stop valve closure generates a pressure pulse in the main steam lines
- Main steam flow transmitters respond to the short duration pressure pulse e Operators enter the emergency operating procedures
- Operators recognize only Train A actuation
- Single train actuation results in additional component l
verification and. positioning per procedures o Pressurizer goes solid, PORVs operate as designed to control primary system pressure e Operators verify plant conditions and reset safety injection allowing the securing of Emergency Core Cooling System equipment e Primary system temperature increases due to residual heat
]
Root cause l
- Operator error allowed a low primary system l
temperature. This, coincident with a false short duration i
high steam flow signal, generated the safety injection.
- The false high steam flow signal was due to a steam flow transmitter design vulnerability.
94EC2 5
4 l
SALEM GENERATING STATION i
NRC ENFORCEMENT CONFERENCE I
EVENTS ANALYSIS Second safety injection j
- Primary system temperature increase results in secondary system pressure increase
- Operators do not adequately communicate this with each other
- Atmospheric Relief Valves (MS-10) do not open at their setpoint 1
- Operator does not take manual control as trained j
- Steam generator safety valve operates to control secondary system pressure
- Second safety injection results from low pressurizer pressure l
- Pressurizer PORVs operate as designed to control primary system pressure
- Pressurizer relief tank rupture disc functions as l
designed Root cause
- Personnel performance
- Less than adequate crew communications (primary system temperature increase and effect on secondary system)
- Operator not taking manual control of MS-10
- Inadequate design of the MS-10 automatic control l
system 94EC2-7
1 SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE INDEPENDENT ASSESSMENT OF EVENT Three independent assessments
- Post trip review
- Salem Operations & Technical Departments
- Significant Event Response Team
- Multi-disciplined team convened by station manager
- Specific charter
- NRC Augmented Inspection Team
- Dedicated team formed oy NRC to assess significant industry events
- Specific charter Conclusions of the three independent assessment efforts are similar 1
l SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE EVENT SIGNIFICANCE 4
l Inadequate management direction and l
inappropriate operator actions resulted in j
unnecessary challenges to protection j
equipment l
- Non-conservative operational decisions during the transient resulted in inappropriate focus on secondary plant recovery with degrading RCS i
conditions l
- Operator errors and supervisors' failure to maintain command and control complicated i
transient response l
- Crew communications and teamwork were below performance expectations 4
)
- Long term tolerance of hardware issues led to RCS pressure boundary challenge
- Contingency actions not adequately addressed j
for control room response based on circulating l
water problems l
I SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE POTENTIAL VIOLATIONS i
i Summary of Potential Violation (B)
Contrary to 10CFR50, Appendix B, Criterion XVI, i
PSE&G failed to identify and take corrective actions for conditions adverse to quality
- Spurious high steam flow signals leading to l
unnecessary safety injection
- Main Steam Atmospheric Relief Valve (MS10) reset / windup condition j
PSE&G Position We agree with the finding Spurious high steam flow signals l
- PSE&G did not recognize that rapid closure of 4
turbine stop valves caused a pressure wave to reflect back and forth initiating the high steam j
flow signal l
- Computer analysis was required to confirm that rapid turbine stop valve closure initiated a j
reflective pressure wave resulting in subsequent high steam flow signals i
i i
94EC2 50 2
i, SALEM GENERATING STATION l
NRC ENFORCEhENT CONFERENCE POTENTIAL VIOLATIONS 1
I l
MS10 Reset Windup l
- Since 1977, issue had been addressed via operator intervention and training l
- Elimination of reset / windup was included in l
scope of Digital Feedwater System design change initiated in 1991. Implementation scheduled for Spring 1995 Outage Root Cause i
i
- Management failure to take appropriate and l
timely corrective actions i
i i
i i
i SALEM GENERATING STATION i
NRC ENFORCEMENT CONFERENCE POTENTIAL VIOLATIONS i
Corrective Actions Taken Generic Corrective Actions
- Reinforcement that individuals are expected to j
identify and participate in the correction of,;,j identified problems gg P"' '
- Line management owns the problers and the l erminent solutioHs i
j
- Monitoring effectiveness of corrective action l
Spurious High Steam Flow Signals
- Steam Hammer Hydraulic Analysis performed l
to determine effect on pressure sensing lines l
resulting from rapid stop valve closure l
- Modifications implemented for Salem Units 1 and 2 to reduce transmitter sensitivity to high i
steam flow spikes
- Root Cause Analysis Procedure being developed to provide guidance from low level problems up to and including highly sigmficant issues 94EC2-50b
]
SALEM GENERATING STATION np NRC ENFORCEMENT CONFERENCE
- \\ "
POTENTIAL VIOLATIONS N/i y
De:[w,7,?
.o' y
y,,p
' ~,;.p;O.y
" j%[y ;/
1 d
)
MS10 Reset / Windup
/
p l
- Modifications implemented for Salem ni s 1
{
and 2 to correct response of MS10s
- Verification of modification adequacy i
i confirmed on Salem simulator and through j
post modification testing l
- Systematic re. view of woik-arounds completed with prioritization of followup actions in j
process
- All work lists being integrated and priorities l
being evaluated by station management Safety significance l
Combination of these deficiences unnecessarily l
challenged operators and automatic safety systems and complicated recovery from the event i
)
+ [0,.l m ;: ;wma k'u i i n tu in
' *4 l 'A
~ ol.t l tl C ^ g (i vt.I'&'ly l
I 94EC2 50c
i SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE POTENTIAL VIOLATIONS p
d g;,,s J e;e Summary of potential violation (E) eif /p
.y. c 1
Contrary to 10CFR50, Appendix B, Criterion VIII, 1
identification and control of materials, parts, and i
l components, requires in part, that measures be j
established for the identification and control of parts l
and components i
]
e Unit 2 Power Operated Relief Valve (PORV) internals made of 17-4PH stainless steel (original design material) were installed in valves 2PRI and 2PR2, in lieu of internals made of type 420 stainless steel
- Installed Unit 1 summator module for the high steam flow setpoint did not have the proper j
identification and contained an incorrect electronic part I
PSE&G Position We agree with the finding. Our review determined these examples to be isolated occurrences. These i
occurrences were self-identified b
i 4
SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE POTENTIAL VIOLATIONS Root Cause
- PORV internals
- The primary causal factor is that the work order planning process for DCPs, with shared i
installation activities, did not assure the proper parts are installed l
- Installation and Test Engineer (I&TE) and the station planner did not perform adequate l
comparisons between the work order and the DCP
- I&TE did not follow through with station personnel involved in the valve work l
- Upon completion of field activities the work package review by several groups was niadequate due to a lack of attention to detail
- Late issuance of the DCP
- Summator module
- Installation of the wrong module by the I&C tecimician was personnel error i
SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE POTENTIAL VIOLATIONS Corrective actions taken J
- PORV internals
- Safety evaluation on 17-4PH SS justified continued operation with this material until the 8th refueling outage
- All other joint 2R7 (E&PB/ Maintenance) installation DCP projects were reviewed to assure no other similar occurrences. Similar DCPs for 1R11 are being reviewed.
- Major DCPs SORC approved six months prior to outage start
- An independent root cause investigation is complete and under review by management. Corrective actions include:
A The E&PB planning procedure will be modified to assure the proper review of the work order parts list against the DCP BOM.
A E&PB will prestage all material for DCPs where joint installation responsibilities are agreed upon.
A A project directive will be issued to reinforce project expectations relative to scope of responsibilities and attention to detail as delineated in the Root Cause Report.
A Investigation results rolled down to project personnel 94EC2 Sic
f SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE POTENTIAL VIOLATIONS 7
. ~n=
4 l
l
- Summator module J
l
- All Unit 1 "special" modules were removed and checked for the correct electronic configuration
- All Unit 2 modules were verified based on external ID on the case. All Unit 2 "special" modules will be removed and checked for the correct electronic i
j configuration during the 2R8 outage j
- A configuration upgrade to provide a sketch for each special application is in process j
- I&C Techs were briefed by supervision on this error l
and management expectations I
Safety Significance l
- PORV Material
- The 17-4PH SS is an acceptable alternative material.
The PORVs are capable of performing as required and did not contribute to the April 7 Event as this was a Salem Unit 2 issue 1
- Summator Module
- Steam flow summator replacement did not contribute j
to the April 7th Event and resulted in a conservative SI actuation setpoint bounded by the Accident Analysis.
- These are isolated occurrences 94EC2-31d 1
1 l
SALEM GENERATING STATION i
NRC ENFORCEMENT CONFERENCE POTENTIAL VIOLATIONS S.ummary,&. i. :,J e [ ;3 s m., he Ix.
of po. 'ntial violation (A)..
te l
Contrary to Technical Specification 6.1.2 and its j
j implementing procedure NC.NA-AP.ZZ-0002(Q),
i Command and Control was not properly exercised on April 7,1994 m
l
"'hh".
M
,.c PSE&G position l
We agree with the fm' ding that there was inadequate l
command and control demonstrated on April 7,1994 j
- Delay in decision to trip turbine
- Utilization of resources e
I Root Cause_
g c-l Management did not provide adequate guidance specific to the recurring grass intrusion problems which resulted in rapid down transients Poor judgment on the part of shift supervisor 7
[h 4
.~
,, ~ ',.
'f6
.L U
f')f,f y:l p
5 j f,
f,.! #
\\
p+
'7
.\\
J ffy
.' f f N
ey? )
94EC247a
SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE POTENTIAL VIOLATIONS i
Corrective Actions Taken Personnel / Training l
- Individuals whose performance was less than j
expected have been provided additional
~
training and evaluation
- Additional simulator training sessions have been conducted for all operating crews to reinforce
- Low power / low temperature operation issues
- Rapid down power transients
- Importance of team interaction within the crew
- Information Directive issued to all shift personnel to reinforce and clarify management expectations
- Command, control and communications
- Proper resource management Safety significance Inadequate command and control resulted in unnecessary challenges to the plant protection systems ma.m
.. ~.
t SALEM GENERATING STATION l
NRC ENFORCEMENT CONFERENCE POTENTIAL VIOLATIONS i
Summary of apparent violation (C)
Contrary to 10CFR50.57 and PSE&G's implementing procedure, Event Classification Guide Attachment 8, PSE&G failed to communicate within the prescribed time frame all required information, specific omissions:
- SI logic train disagreement and subsequent failure of certain plant equipment to align as expected
- Exact cause of the reactor trip
- Effect of event on the plant
- Operator plan to recover from solid plant condition 4
l 94EC248a
=
L.
j SALEM GENERATING STATION j
NRC ENFORCEMENT CONFERENCE POTENTIAL VIOLATIONS 1
i PSE&G position j
We agree with the finding. Event information was not i
fully communicated and documented on the N.RC Data Sheet
- Information provided was inappropriately judged to be adequate based on Emergency Coordinator assessment of plant conditions and expected plant response Root Cause Failure to provide adequate training to the Emergency Coordinator on the information needs of the NRC Operations Center HEC 2 52a
l SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE J
POTENTIAL VIOLATIONS l
Corrective Actions
- ECG Attachment 8 procedure has been revised to address maintaining open line with NRC Operations Center if requested
- NRC Data Sheet will be revised to direct l
Emergency Response Data System (ERDS) requests at Initial Notification
- Additional guidance has been provided to all l
Emergency Coordinators discussing NRC data requirements
- Emergency Coordinator training program to be revised to include additional guidance on
)
filling out NRC Data Sheet l
Safety Significance
}
NRC must have adequate information relative to plant j
events in order to properly exercise its emergency i
response procedures i
94EC2 52b i
i
+
SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE 4
POTENTIAL VIOLATIONS l
Summary of potential violation (D) l 4
j Contrary to the requirements of T.S. 6.8.1 and R.G.
1.33 Appendix A, inadequate or nonexistent j
procedural guidance existed relative to:
- Recovery of RCS temperature from below j
mmimum temperature for criticality j
- Rapid power reduction due to grass intrusion
- Recognition of and response to SI train logic disagreement
- Recovery'from solid plant conditions i
94EC2 46A
4 SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE POTENTIAL VIOLATIONS I
PSE&G position i
On April 7 existing procedures met the requirements of Reg. Guide 1.33 and TS 6.8.1 i
- Recovery of RCS temperature
- Alarm response procedure A AR.ZZ-0004 RCS Tave LO l
]
- Rapid Power Reduction
- Integrated Operating Procedure IOP-4 Power Operation A
- Abnormal Operating Procedure l
AB.CW-0001 Loss of Circulating Water A
A AB.COND-0001 Loss of Condenser Vacuum l
- SI Train Logic Disagreement
- Emergency Operating Procedures EOP. TRIP-0001 Reactor Trip or Safety Injection A
- Solid Plant Conditions
- Emergency Operating Procedure A EOP. TRIP-0003 SI Termination EOP-FRCI-0001 Response to High Pressurizer Level A
4 SALEM GENERATING STATION l
NRC ENFORCEMENT CONFERENCE l
POTENTIAL VIOLATIONS i
j PSE&G position (cont'd)
Procedures exist to address a broad spectrum of events and conditions but cannot be expected to
,l address every possible event scenario l
- Simulator training scenarios are established to supplement procedural guidance
- Events are evaluated for lessons learned and enhancements to procedures and training programs j
- Past experience with rapid down power transients did not result in similar problems.
4 l
This was an isolated problem due to inappropriate control of RCS temperature j
- Existing procedures met Reg. Guide 1.33 requirements and combined with training (classroom and simulator) provided the required guidance e
Lessons learned.
i i
- Procedure enhancements and training improvements implemented l
94EC2E
i SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE POTENTIAL VIOLATIONS l
.v AM' l
Summary of Potential Violation (F) f a Failure to meet Technical Specification 3.0.3 I
requirements to bring the plant to hot shutdown within six hours PSE&G Position l
We believe discretionary enforcement was appropriate and l
could not have been reasonably anticipated
)
- Both trains of SI declared inoperable after secone safety injection was reset due to block of auto j
j actuation capability l
- EOPs structured around SI being blocked after reset. Operating procedures call for reset in Mode 5 only 4
- Decision made to utilize Tech. Spec. while in l
- Per TS 3.0.3 plant was required to be in Hot l
Shutdown in six hours
- Additional time was needed prior to initiating a plant cooldown 4
- Operator made prudent decision to re-establish a bubble in the pressurizer to assure a well controlled plant cooldown 94EC2-53A
]
i SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE POTENTIAL VIOLATIONS i
i PSE&G Position (cont'd)
- Request for discretionary enforcement was j
consistent with intent of NRC policy
- Literal compliance with the Technical Specification was not in the best interest of the l
Public Health and Safety l
I
- Additional action statement time allowed cooldown at a lower rate thus minimizing unnecessary challenges to the plant
- Seeking a license amendment was impractical due to short time period involved PSE&G could not reasonably have predicted the exact 4
sequence of events on April 7,1994 nor the need for enforcement discretion 1
[
i i
i
i
~
l i
SALEM GENERATING STATION l
NRC ENFORCEMENT CONFERENCE REGULATORY ASSESSMENT i
j Based on the prior discussion of the potential j
violations, the following mitigating factors apply l
i l
- Comprehensive corrective actions taken j
i l
- Event consequences bounded by updated Final
~
Safety Analysis Report (UFSAR) Condition II accident analysis criteria i
l
- No safety limits exceeded I
i
- Plant safety equipment performed as designed
- Comprehensive investigation of the event
- The health and safety of the public was not affected 94EC2-35a
SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE SALEM IMPROVElVENT FOCUS l
Equipment 1990 Assessment
- Materi l condition below the industry average
- Reliability of plant systems below acceptable levels I
- Service water piping leaks
- Repetitive equipment failures
- CM backlog at 1600 work orders (priority A,B,1,2)
- PM/CM ratio of 29.3%
- Total plant leaks 760 l
l
l t
1 l
i SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE l
SALEM IMPROVEMENT FOCUS Equipment Progress To Date a 300 Million dollars spent to date addressing equipment and materiel condition concerns
- 307 Discrete areas identified for ongoing materiel condition evaluation
- Rating system established with overall goal of 2.80
- Present station rating is 2.14 and improving
- CM backlog reduced to approximately 350 (Priority A, B,1, 2) work orders per unit
- PM/CM ratio increased to 57.1% as of June 1994
- Total plant leaks reduced to 97 as of May 1994
- Completed Reliability Centered Maintenance review of 34 key systems 94EC2-42 l
l i
j SALEM GENERATING STATION l
NRC ENFORCEMENT CONFERENCE l
SALEM IMPROVEMENT FOCUS l
l I
Equipment i
I Tactical Plans i
4
- Approximately 150 million dollars in projected expenditures to complete presently defined scope of work i
- Improvements in Maintenance Program as implementation of NRC Maintenance Rule l
progresses
- Prioritization using PSA j
- Improved trending to assess long term corrective action effectiveness
- Continued management emphasis on improving plant material condition and overall equipment reliability i
3 94EC241
l SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE SALEM IMPROVEMENT FOCUS Procedures l
1990 Assessment
- Recognized weakness of implementing procedures
- Lack of detail
- Generic procedures not adequate for specific applications
- Lack of detailed acceptance criteria Nonexistent criteria A
Poorly organized in procedure A
- Procedures not user friendly
- Initiated Procedure Upgrade Project
- Overall objective to provide improved procedures of consistently high quality in terms of format, content, level of detail, technical accuracy and ease of use 1
94EC243 l
i j
SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE SALEM IMPROVEMENT FOCUS i
i Procedures l
Progress To Date l
- Procedure Upgrade Project completed l
- 3500 Procedures reviewed, developed and l
upgrad;d j
- Developed computerized procedure control j
system l
- PSE&G commitments annotated in procedures l
- Reduction in number of procedure related j
LER's j
- Procedures recognized as state of the art i
l l
]
1 3
l l
SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE SALEM IMPROVEMENT FOCUS i
k 1
2 j
Procedures Tactical Plans i
i
- Ongoing procedure maintenance to assure high quality is maintained
- Continue to emphasize procedural adherence through work standards, training, and supervisory oversight ww,
SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE SALEM IMPROVEMENT FOCUS People 1990 Assessment
- Developing a Vision Statement with an emphasis on people
- Initiating cultural changes to focus personnel on
- Ownership
- Attention to detail
- Performance standards 94EC2-38
SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE l
SALEM IMPROVEMENT FOCUS i
a j
People l
Progress To Date
- While improvements have been noted, l
personnel performance still does not meet our expectations l
- Clearly communicating our performance expectations l
- Salem reorganization / unitization being implemented d
l
- Many personnel having to re-bid their existing l
positions l
Emphasis on putting best qualified people in A
all positions Poor performers identified and appropriate A
action taken
- Emphasis on compliance with established l
work standards j
- Increased supervisory oversight in the field i
)
I l
SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE i
SALEM IMPROVEMENT FOCUS i
People i
Tactical Plans J
- Complete Reorganization / Unitization l
- Personnel Performance Improvement is considered an ongoing process with the following key elements
- Clear Expectations
- Regular Reinforcement
- Accountability
- Feedback
- Improved Work Environment
- Fully incorporate work standards into culture i
94EC2 39
SALEM GENERA TING STATION
]
NRC ENFORCEME. T CONFERENCE j
COMPREHENSIVE PERFt,RMANCE ASSESSMENT
- Multi-disciplinary team review ofincidents over last few years l
i j
- Comprehensive action plan developed i
- Integral part of Nuclear Department Business Plan
{
- Senior Management monitoring of Action Plan progress 1
l
- Multiple performance indicators to continually j
assess effectiveness i
i i
i l
94EC212b i
l SALEM GENERATING STATION NRC ENFORCEMENT CONFERENCE l
SUMMARY
4 April 7,1994 event was significant l
- Unnecessary challenges to plant protection system j
- Inappropriate operational decisions
- Inadequate Command and Control complicated i
event response l
- Failure tu address hardware problems with MS-10 controls resulted in challenge to RCS i
Pressure Boundary Integrity j
- Crew response and interaction was below l
expectations
- Extensive corrective actions have been taken to address the root causes PSE&G acknowledges our need for performance improvement and is focusing on personnel performance improvement.
.