ML20137D238
| ML20137D238 | |
| Person / Time | |
|---|---|
| Issue date: | 01/10/1986 |
| From: | Stello V NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO) |
| To: | Asselstine, Palladino, Roberts NRC COMMISSION (OCM) |
| References | |
| AEOD-C504, NUDOCS 8601160574 | |
| Download: ML20137D238 (3) | |
Text
,
JAll 101996 MEMORANDUM FOR: Chairman Palladino Commissioner Roberts Commissioner Asselstine Commissioner Bernthal Commissioner Zech FROM: Victor Stello, Jr.
Acting Executive Director for Operations
SUBJECT:
AE0D CASE STUDY REPORT " LOSS OF SAFETY SYSTEM FUNCTION EVENTS" (AEOD/C504)
Enclosed for your information is a copy of an AE00 case study report on events involving a total loss of safety system function (LSSF). The study identified 133 LSSF events in the 1981 to June 1984 time period, 87 of which (65%) were
+he result of human factors contributions. This report documents AEOD's efforts, findings, and conclusions on the subject and reflects the results of the peer review process. Recommendations from AE00 concerning this study have been previously forwarded to other offices for appropriate action.
I would be pleased to provide any clarification or further information that-you may desire.
Orig'inni siry.cd t*4 y tetop.oug ,v ,
Victor Stello, Jr.
Acting Executive Director for Operations
Enclosure:
As Stated cc w/ enclosure:
SECY OGC OPE ACRS Distribution:
PDR NAS CF (w/ enc 1) H. Denton, NRR (w/o) V. Stello, EDO C. Heltemes, AE00 (w/o) J. Roe, EDO [j),
AE00 SF (w/o)
AE00 CF (w/o) T. Ippolito, AE00 (w/o) T. Rehm, EDO EDO RF
[ /
,)
Please see previously signed concurrence sheet attached, f s1 b.b..! $..........!bbb........!b $. 0.....!b. ! ......!.. wN' J././ !............!...........
NAME :EATrager:eh :KBlack :TAlppolito :CJHeltemes :VS lo : :
DATE :12/ /85 :12/ /85 :12/ /85 :12/.30/85 :-12/r/85 : :
0FFICIAL RECORD COPY ff y g 8601160 4 560110 PDR M 360114 74 PDR
MEMORANDUM FOR: Chairman Palladino Commissioner Roberts Commissioner Asselstine Commissioner Bernthal Commissioner Zech FROM: William J. Dircks Executive Director for Operations
SUBJECT:
AE00 CASE STUDY REPORT " LOSS OF SAFETY SYSTEM FUNCTION EVENTS" (AE00/C504)
Enclosed for your information is a copy of an AEOD case study report on events involving a total loss of safety system f ction (LSSF). The study identified 133 LSSF events in the 1981 to June 1984 ime period, 87 of which (65%) were the result of human factors contributio . This report documents AEOD's efforts, findings, and conclusions on t e subject and reflects the results of the peer review process. ' commendati ns from AEOD concerning this study have been previously forwarded to ther of ices for appropriate action.
I would be pleased to provide an clarification or further information that you may desire.
William J. Dircks Exechtive Director for Operations
Enclosure:
As Stated cc w/ enclosure:
SECY x OGC \
OPE N ACRS
\
Distribution:
PDR NAS CF (w/ encl) H. Denton, NRR (w/o) V. Stello, DEDROGR AE00 SF (w/o) C. Heltemes, AE00 (w/o) J. Roe, EDO W. Dircks, EDO AE0D CF (w/o) T. Ippolito, AE00 (w/o) T. Rehm, EDO EDO RF 0FC :NAS g :C/NAS M :DD/AE)
- D/AE
- EDO : :
7 NAME :EATrager:eh :KBlack : TAlptro o :CJ temes :W0ircks : :
7....__ ..............................__.............................................
DATE :12/N )85 :12/h85 :12/19/85 :12/s,o/85 :12/ /85 : :
0FFICIAL RECORD COPY m .
Document Name:
MD10 CHAIRMAN PALLADINO ET AL Requestor's ID:
BETTYH Author's Name:
G. Trager /B. Hopper Document Comments:
^- ;\ (L L( LE' L.M -
Y gt% 4 L{.f c
/ hh.66)1 .Jeea 'ic oa <>- t 6 [ ')
CsM i au 95 % my/szq Mcppt.
cf 7<ac L,b
$ltO3 A l eGen a co m de,g wk cn ue.uA.yj ie u , A to D w-f- )w .kredh co~ la.w ,
tox twa a a n d c. v. s yx ,e e ] al w Y) G% , Sjt(,.{ O 's eu e5%
- % w 0-a cldv.. cha W
- lla NelSM 0L lL&: , Lct Le.va LAtu. s Tdt,d5 ,
Rat.3
j .s t ..
AE00/C504 i
4 Case Study Report on .
Loss of Safety System Function Events by the Office for Analysis and Eva'luation of Operational Data December 1985 Prepared by:
E. A. Trager, Jr.
r i
,' This report documents the results of a study completed by the Office for Analysis and Evaluation of Operational Data with regard to particular operating events.
r The findings and recommendations do not necessarily represent the final position or requirements of the responsible program office nor'the Nuclear Regulatory Commission.
x
Table of Contents Page EXECUTIVE
SUMMARY
...................................................... 1 1.0 INTR 00VCTION...................................................... 4 2.0 DISCUSSION........................................................ 6 2.1 Events Involving a Loss of Safety System Function............ 6 4
2.2 Human Factors Contributions in LSSF Events................... 33 2.2.1 Categorization of Events Involving Human Factors Contributions................................. 35 2.2.2 Other Characteristics of LSSF Events Involving Human Factors Contributions........................... 39 3.0 FINDINGS AND CONCLUSIONS.......................................... 43 4.0 RECOMMENDATIONS................................................... 47
5.0 REFERENCES
.............,.......................................... 50 Appendix A..................................'..................... A-1 Appendix B....................................................... B-1 Appendix C....................................................... C-1
Executive Summary i
The study discusse! events resulting in a total loss of safety system function.
Although the study identifies 133 losses of safety system function (LSSF) in i the 1981 to June 1984 time period, the major focus of the analysis is on 87 events (65% of the total) that were the result of human factors contributions, e.g., personnel errors. The objectives of the study were to determine the frequency of this type of event, whether or not these events are occurring more at one plant than another, and the causes of such events.
Over the time period of the study, about 0.5 LSSF events were reported per year of reactor operation. The study found that between 1981 and June 1984 no significant trends were observed in this rate of occurrence of LSSF events. ~
This indicates that improvement is not being made, on,an industry-wide basis, in preventing loss of safety. system events.
Variation in the rate of occurrence was observed to be the result of variations among a small number of individual plants rather than differences in NSSS type or plant age (with the exception of the first year). With few exceptions, the events were non-repetitive. About one-half of the PWR events involved the RHR system (shutdown cooling mode) or the containment spray system while BWR events most frequently involved the HPCI, RCIC or RHR systems. However, the following two statements are made to qualify the foregoing: (1) the multiple loss of RHR events at certain plants is evidence of a generic problem with the RHR system hardware or associated factors, such as design, procedures, maintenance, training or management; and-(2) the relatively large numbers of events
t involving the RHR system at PWRs and the HPCI, RCIC and RHR systems at BWRs l are due to the fact that these systems are not designed to meet the single failure criterion.
1 :
The majority of the loss of safety system function events (87 out of 133 l events) were the result of human factors contributions, i.e., they were not !
. attributed solely to equipment failure. However, only 37% of the 87 events were the result of " personnel error," i.e. , 63% of the events were the result of i conditions outside of the control of the worker. This indicated that although training, qualifications and motivation are important, improvements in the areas of management and administrative control, procedures and planning could have a significant impact on reducing the number of LSSF events.
i 1
- The study also found that licensed operators, non-licensed operators, and other personnel (technicians and maintenance personnel) were responsible for roughly I equal numbers of errors leading to LSSF events. This is evidence that it is necessary that licensees establish programs to ensure all types of personnel are well qualified and trained.
It was anticipated prior to the study that by examining data on the length of I time the system was not available and the method of discovery, it might be possible to determine the most effective methods to identify unavailable or 3 ,
degraded safety systecs, to avoid total system losses, and to ensure quick '
! recovery in the event of a loss. However, this was not possible because LERs frequently included no explicit statement of how an event or off-normal j condition was discovered, i
i
' ~
i 3-I l
l The report includes a number of recommendations based on the results of the study. The recommendations include: IE feed back the results of this study to industry; NRR review training and qualification programs to ensure that adequate attention is paid to the programs for personnel other than licensed operators; AE00 perform further technical evaluations of three particular types of LSSF events; AE00 monitor the quality of human factors data in LERs to ensure licensees are meeting the intent of 10 CFR 50.73 requirements regarding completeness; and AE00 collect LSSF event data on a continuing basis and evaluate the data to determine whether LSSF events are a meaningful indicator of licensee performance.
i e
0 e
r F
l L
- 1. 0 INTRODUCTION In response to a request by NRR, AE00 prepared and issued a special study report entitled, " Human Error in Events Involving Wrong Unit or Wrong Train,"
AE00/S401 (Ref. 1). The report concerned 27 events involving loss of safety system function that resulted because an action was performed on the wrong reactor unit (seven events) or the wrong train (20 events) and the error was not immediately detected. The report observed that these errors were most frequently the result of errors in procedures or deficiencies in unit / train /
component identification or labeling.
During the course of that study a number of events were noted that did not fall into the wrong unit / wrong train categories, but that involved'a loss of function of a safety system. As a result, this initial work was expanded to include all such recent events that appeared to involve a loss of safety system function, and to focus more specifically on the extent to which human factors contributed to the events.
This study is based upon Licensee Event Reports required to be submitted to the NRC. Thus, it is recognized that while certain systems included in this study may not be classified as a safety system in the plants FSAR, they are classified as a safety system for the purpose of this study based on one or more of the following: (a) operating restrictions are ir.cluded in the technical specifications if the systen is inoperable, (b) credit is taken for the system in the plant safety analysis, or (c) the safety importance of the system is sufficiently high to require reporting to the NRC should the system be inoperable.
- , . r
-s-l This study inc.luded only those events that involved an actual total loss of !
- system function. Events were excluded where the condition was anticipated or [
readily recognized and the system was immediately recovered, or where there was i i
j en apparent loss of function because of administrative procedures (e.g., a j system was " declared inoperable" because a required surveillance had not been i i j completed, but the system was then shown to be operable). l f
l The purpose of this study was to characterize recent LSSF events and to: "
Determine the frequency of occurrence and compare event totals on an
)
annual basis. !
-- Determine if there is a significant variation among reactors designed j by different reactor vendors.
i .
I --
Determine the reported event duration (length of time the system was not available) and possible contributing factors (factors that may have i influenced the duration).
j --
Determine if there is a correlation between numbers of events and plant '
{ age.
l; --
Identify plants at which events appear to be occurring more frequently than at others, and attempt to determine why.
j l
Describe the method of discovery to determine the most effective methods
. to identify unavailable or degraded safety systems, and to ensure quick-1 recovery in the event of a loss.
Analyze event causes with particular focus on human factors contributions, !
Identify any additional event characteristics, such as particular groups ;
of personnel or types of activities that are more frequently associated ;
with event occurrence, i The Sequence Coding and Search System (SC55) data base was the primary source f
l for events that involved a total loss of system function. In addition, as a I check on completeness, a review was made of the following additional sources.
l '
Report to Conaress on Abnormal Occurrences: (NUREG-0090 series reports) l
{
-- ORNL, Precursors to Potential Severe Core Damane Accidents: 1980-1981 {
(NUREG/CR-3591), July 1984. t l
1 -- NSAC/52, Residual Heat Removal Experience Review and Safety Analysis, i
- January 1983. !
i ,
I i h
I r
This study covers the period from January 1981 through June 1984. 'During this period a total of 133 LSSF events (81 PWR and 52 BWR) were identified. The
- nature and characteristics of these events are discussed in Section 2, with particular emphasis on human factors contributions. Section 3 includes the findings and conclusions from this study, and the recommendations are contained i
- in Section 4 Appendix A contains a listing of the LSSF events, Appendix B contains a summary of details of these events, and Appendix C contains descriptions of these events.
i .
This report interfaces with other AE00 technical studies involving specific systems, such as failure of the residual heat removal system.
i 2.0 DISCUSSION Of the events reported to the NRC from 1981 through June 1984, 133 involved a l total loss of safety system function (LSSF). Table 1 lists the numbers of I
LSSF events by year. The totals for January through June 1984 may not be
{
directly comparable with the totals for earlier years because the LER i reportingre.guirementschangedonJanuary1,1984,when10CFR50.73became effective. One significant, change associated with this revision in reporting ,
l requirements was that events where a Limiting Condition for Operation (LCO) was entered were no longer reportable; events where the LCO time limit was
]
! exceeded continued to be reportable. )
1 2.1 Events Involving a loss of Safety System Function l Frequency of Occurrence i
l As shown in Table 1, the frequency of occurrence of LSSF events averaged about three events per month, and was relatively constant, ranging from 2.6 events
' ~
~7' TABLE 1 Distribution of LSSF Events by Year Jan-June 1981 1982 1983 1984 Total Average Total PWR Events 21 23 26 11 81 Number of Reactors
- 46 48 51 51 --
Events /PWR 0.47 0.48 0.51 0.43** 0.48 Total BWR Events 16 8 16 14 52 Number of Reactors
- 23 26 26 29 --
Events /BWR 0.70 0.31 0.62 0.97** 0.60 Total Events (BWR and PWR) 37 31 42 25 133 ,
Events / Month 3.1 2.6 3.5 4.2 3.2 Number of Reactors (BWR and PWR)* 69 74 77 80 --
Events / Reactor Year 0.54 0.42 0.55 0.63 0.51
- Number of plants that had achieved initial criticality.
- Assuming a constant frequency for the entire year.
I per month in 1982 to 4.2 events per month in the first six months in 1984.
Although the new reporting requirements of 10 CFR 50.73 substantially reduced the annual total number of LERs, the number of LSSF events reported in LERs received in January-June 1984 seems comparable to numbers received in the three earlier years, i.e. , there were no fewer LSSF events reported on an annual basis.
L
A total of 81 events were reported for PWRs and 52 for BWRs. Thus, the i frequency of occurrence per reactor was comparable for the two reactor types (0.48 for PWRs and 0.60 for BWRs) considering the numbers of each type in operation. On a per plant basis, the occurrence rate for PWRs has been relatively constant (about 0.5), while the rate for BWRs has shown considerable variation; for example, the BWR rate in 1984 (0.97) is three
- times that in 1987 (0.31). As will be further discussed below, much of the observed vartation may be due to the perfoneance of a relatively small number of plants. Overall, tra frequen.cy of occurrence of LSSF events has been relatively constant and no significant trends can be seen with regard to i reactor type or frequency of occurrence.- However, the data do not indicate major or clear evidence that there has been any real improvemir.t on an industry-widebasiswithregardtopreventinglosusofsafdysystemfunction in recent years. -
3 Variation Among Reactor Vendors
/
Table 2 shows variation of numbers of LSSF events among reactors from different vendors ~and amor.g the different Westinghouse'PWR Wodels. Tha
, Westinghouse LW) three-loop plants and the General Electric (GE) plants 7 j reported an average number of L5SF events. The W four-loop plants and e Combustion Engineering (CE) plants reported more.and the W"two-loop plants ,
and Babcock and Wilcox (B&',0 plants (two-loop) reported fewer LSSF events than the average. In fact, the rate for W four-loop plants was four times the rato for the two-loop plants. However, the rate is strongly influenced by plants with multiple events. For example, the apparent'high rats.for four-loop W plants is influenced by 13 events at McGuire 1 and 2, and the ;
t _
- TABLE 2 Distribution of LSSF Events by NSSS Vendor Plant Type
- W CE B&W GE Total Number of Loops Year 2 3 4 1981 1 6 6 6 2 16 37 1982 2 6 8 6 1 8 31 1983 0 5 12 7 2 14 40 1984 (Jan-June) 0 0 7 3 1 14 25 Total 3 17 33 22, 6 52 133 Total Operating During 1984 6 12 15 11 7 29 80 Events /1984 Population 0.5 1.4 2.2 2.0 0.9 1.8 1.7
~
have plants with two primary loops while Westinghouse (W) plants have two, three, or four loops. General Electric (GE) plants are direct cycle BWR and have no primary " loops".
apparent high rate for CE plants reflects ten events at Calvert Cliffs 1 and 2 (see Table 3 and Appendix A). Without the events at McGuire and Calvert i Cliffs the W four-loop plants have a rate of 1.5 events / plant and CE plants have a rate of about 1.3, and the overall industry rate drops to about 1.4.
Therefore, with the exception of certain outliers (e.g., McGuire and Calvert Cliffs) W three-loop and four-loop, and CE and GE plants had an occurrence rate of from about 1.3 to 1.8 events / plant. The rate for W two-loop plants was about 0.5 event / plant and the rate for B&W plants was about 0.9. Thus, l .
l v
the only significant variation noted in terms of reactor vendor was a substantially lowar rate of losses for the W two-loop plants and to a lesser extent for B&W plants. However, the reason for these lower rates could not be definitely determined.
Systems Involved -
s, 1
Tables 3 and 4 give a count of the total numbers of LSSF eve'nts and the systems lost by plant for PWRs and BWRs, respectively. Table 3 shows that the system most frequently involved at PWRs wr.s the residual heat removal (RHR) system (31 events). Some other systems affected include the containment spray system (CSS) (11 events), the chemical and volume control system (CVCS)
~ '
(eight), emergency core cooling systems (ECCS) (six), diesel generators (DGs)
(five), and the auxiliary feedwater system (AFW) (four). Table 4 data show that LSSF events at BWRs most frequently involved the high pressure coolant injection (HPCI) system (22 times), reactor core isolation cooling (RCIC) system (eight times), and the. res'idual heat removal (RHR) system (eight times).
Most of the LSSF events at PWRs were nonrepetitive events, even at reactors
)
where there were two or more LSSF events. Exceptions to this observation L include multiple RHR events at Calvert Cliffs 2 (six out of seven events),
North Anna 1 (three out of four), McGuire 1 (three out of nine), McGuire 2 (three out of four), Salem 2 (three out of three), Trojan (two out of six), )
j Millstone 2 (two out of three) and North Anna 2 (two out of three). McGuire 1 l l
also lost the CVCS twice, and Trojan lost the AFW twice. Crystal River had three LSSF events involving the auxiliary building exhaust system.
i TABLE 3 Distribution of PWR LSSF Events by System ,
Total
4 McGuire 1 50-369 9 3 1 2- 1 2 (RB/HVAC, ;
I Calvert -
3 C11ffs 2 50-318 7 6 1 :
l Trojan 50-344 6 2 1 1 2 .
North Anna 1 50-338 4 3 1 McGuire 2 50-370 4 3 1
-l - Salem 1 50-272 3 1 1 1
' Crystal River 3 50-302 3 3
(ABES)
Salem 2 50-311 3 3 Calvert Cliffs 1 50-317 3 1 1 1
, Sequoyah 1 50-327 3 1 1 .1 (ABGTS)
M111 stone,2 50-336 3 2 1 i
North '
Anna 2 50-339 3 2 -1 San Onofre 1 206 -2 1 1 (waste gas) 4 Turkey Pt. 3 50-250 2 1 1 i ,
Turkey Pt. 4 50-251 2 1 1
- Palisades 50-255 2 1 1 -
- (125V dc
. batteries) 1 Oconee 1 50-269 2 1 , .
1 (containment) 4 i ,
4 . . _ . . - _ , . - . ,. . _ _ - . . , .. , . . - , e , . - _ , _ - . . .
P TABLE 3 (Continued) l Distribution of PWR LSSF Events by System Total l Plant Docket # Events RHR SP CVCS ECCS DG AFW CCW RPS LTOP Misc. ,
Kewaunee 50-305 2 1 1 0.C.
Cook 2 50-316. 2 1 1 ,
St.
Lucie 1 50-335 2 1 1 .
San Onofre 3 50-362 2 1 1 4 Indian Pt. 2 50-247 1 1 -
Robinson 2 50-270 1 1 Oconee 2 50-270 1 1.
Prairie .
Island 1 50-282 1 1 Ft.
Calhoun 1 50-285 1 1
~
Zion 2 50-304 1 1
~
~
Maine , . .
Yankee 50-309 1 1 ,
D.C. '
Cook 1 50-315 1 1
, 8eaver Valley 1 50-334 1 1 Farley 1 50-348 1 1 San .
Onofre 2 50-361 1 'l i
Farley 2 50 364 1 1 Total 81 31 11 8 6 5 4 '3 2' 2 9
13 -
Note ,
PWR Systems:
RHR' -
Residual / Decay Heat Removal / Shutdown Cooling -
SP -
Chemical and Volume Control System ECCS -
Emergency Core Cooling DG -
Diesel Generators AFW -
Auxiliary Feedwater ABES -
Auxiliary Building Exhaust System CCW -
Component Cooling Water .
RPS -
Reactor Protection Sy' stem / Solid State Protection System (RPS/SSPS)
LTOP -
Low Temperature Overpressurization Protection RB/HVAC - Reactor Building HVAC ABGTS -
Auxiliary Building Gas Treatment System O
e u
S O
i TABLE 4 Distribution of BWR LSSF Events by System Total Plant Docket # Events HPCI RCIC RHR Cont. DG SBGT Misc.
Brunswick 1 50-325 5 1 2 1 1(CBEAF)
Grand Gulf 1 50-416 5 1 4 Dresden 2 -
50-237 4 4 Hatch 1 50-321 4 ,2 1 1 Arnold 50-331 4 3 1 Peach Bottom 3 50-278 3 2 ,
1 Pilgrim 1 50-293 3 . 1 1 1 Fitzpatrick 50-338 3 3
- 1. Hatch 2 50-366 3 2 1 Susqueha.nna 1 50-387 3 1 1 -
1 .
! Big Rock Pt. 50-155 2. 2(R05)
Quad Cities 1 50-254 2 1 1 -
Browns Ferry 2 50-260 2~ 2 Cooper 50-298 2 1 1 ,
Brunswick 2 ' 50-324 2 1 1 !
Oyste. Creek 50-219 1 1(CRD)
, Pumps-Nine Mile Pt. 1 . 50-220 1 1(Emer. :
~
Condensers)
Dresden 3 50-249 1 1 l
Peach Bottom 2 50-277 1 1-Browns Ferry 3 50-296 1 1 Total- 52 22 8 -8 4' 3 2 5
. i i ;
I r
.~,..,,_.,.%- - . . - . _ - .,.m- , .. . . - . . . . . , , . . . , ,w , , ,,w*., , ---
I -
15 - !
i .
58X:
BWR Systems: -
i.
I HPCI -
High Pressure Coolant Injection '
RHR -
Reactor Core Isolation Cooling [
Cont. -
Containment (Primary / Secondary) i DG -
Diesel Generators '
ADS -
Automatic Depressurization System (ADS /RDS) [
SBGT -
Standby Gas Treatment !
CBEAF -
Control Building Emergency Air Filtration >
RDS -
Reactor Depressurization System . ,
I i
f i
i r
I h
t k
i E
I 1
5 I
- I
- -- - ,n n- -,--- ,..,- , ~ ., , y.. ,. n ,, . , , , -, . g g-~n.- .. ,- e
The data of Table 4 lead to a similar assessment of system losses at BWRs. I Most of the events are nonrepetitive. Exceptions . include HPCI system losses at ,
i Dresden 2 (four out of four events), Hatch 1 (two of four), Duane Arnold (three .
of four), Peach Bottom 3 (two of three), Fitzpatrick (three of three), and r
Browns Ferry 2 (two of two). Multiple RCIC system losses occurred at Brunswick 1 (two out of five events) and Hatch 2 (two of three). Grand Gulf lost the RHR- ;
7 system four times (out of five events). Big Rock Point lost the reactor depressurization system (RDS) system twice (out of two event's). ;
L That only a few PWRs experienced multiple LSSF events involving the same system ,!
1 over the 31/2 year period of the study appears to indicate that for the trost !
part, losses of safety systems are random events. However, the multiple loss [
j of RHR events at certain plants is evidence of a generic pr blem with the RHR }
, system hardware or associated factors, such is design, procedures, maintenance, f training or management.* -
l Several BWRs experienced multiple losses of the HPCI system. The four HPCI l i failures at Dresden 2 resulted from different causes and give no reason to .
believe a specific problem exists. The three Duane Arnold-HPCI failures were :
the result of unrelated equipment failures and the three Fitzpatrick HPCI i
failures were the result of three unrelated problems (personnel error, defective l l
procedure and equipment failure). The remaining multiple HPCI failures also ,
appear to be unrelated. The four RHR losses at Grand Gulf 1 do not appear to .
in the AE00 Case Study report, AE00/C503, " Decay Heat Removal Problems at U.S. Pressurized Water Reactors," dated December 1985. . .
l ;
1 .
E t
. , . _ _ _ . , , . . - . . ., - ._. ,..,_.. .r, .....,,.--__~,4.,.._,..m. .. - - - ,.. r,_,,_
l l
l indicate a specific problem but do show the vulnerability of the RHR., Multiple losses of safety systems at BWRs do not clearly poi,nt to any generic problem.
Event Significance Safety systems are generally protected against single fa'ilure by incorporating redundancy or diversity. Therefore, events involving total loss of safety system function (LSSF) may be particularly significant from a safety stand-point. However, not all LSSF events are equally significant. For example, a safety system may become momentarily unavailable, but is readily returned to service or an alternate system (s) is available to perform the same function.
It is important to consider the relative significance of events, and that
~
numbers of events alone are not and should not be used as a measure or index of significance.
One type of PWR event that may be relatively significant is loss of the RHR system while the reactor is shutting-down or shortly after shutdown. This type of event comprises .a large fraction of PWR events and has been analyzed separately (Case Study report AE00/C503 has been issued on this subject).
Because the residual heat removal system (in the shutdown cooling mode) is a low pressure system, it is designed to isolate from the reactor coolant system (RCS) on an indication of high RCS pressure. Although the RHR system has two trains at most U.S. PWRs, both trains can be made inoperable by closure of a single isolation valve (the trains share a common suction line). As a result of this design, the shutdown cooling system is subject to single failure.
BWRs also have a single drop line and two trains of RHR in the shutdown i
4 cooling mode, and BWRs are also subject'to a single failure causing loss of decay heat' removal capability. However, the significance of the loss of RHR system for either PWRs or BWRs (in the shutdown cooling mode)
- depends on the decay heat load and the duration of the event.
The total number of losses of the HPCI and RCIC systems at BWRs must also be put in perspective. They are both single train systems and, thus subject.to single failure. However, HPCI is backed up by RCIC for small breaks and by the autonatic depressurization and the low pressure coolant injection and core spray systems (ADS and LPCI and LPCS) for medium and large breaks. Conse-quently, the safety of the plant can b'e maintained during a loss of HPCI if the other systems: remain operable. In fact, technical specifications usually allow continued plant operation for seven days while HPCI is unavailable if-the other systems are operable (the plant mur.t be shut down within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if one of the other systems is rot operable). HPCI is the primary high pressure, high capacity means of replenishing RCS inventory, although PCIC provides an additional high pressure, low capacity source.
Another measure to assess significance is event duration. Tables 5 and 6 list the duration of the reported events (i.e., the length of time the off-normal condition existed) for PWRs and BWRs, respectively. The data indicate about 85% of the PWR events were concluded within eight. hours. For BWR events for which duration was reported, about 65% were concluded in eight hours.
As can be seen from Table 5, PWR loss of RHR events accounted for most of the events that lasted less than one hour. The majority of the PWR events lasting l
i I
TABLE 5 4.,
Distribution of PWR LSSF Events by Event Duration and PWR System RHR SP CVCS ECCS DG AFW ABES CCW .RPS LTOP Misc. Total I min $ t < 10 minutes 8 1 1 1 1 12 10 mins $ t < 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 17 4 1 2 2 1 2 1- 2* 32 I hour 5 t < 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 1 3 2 1 1 1** 9 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 5 t < 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 1 2 1 1(ABGTS) 5 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 5 t < 1 month 2 1 -
1 4 1 month $ t < 3 months 1 1*** 2 3 months $ t 2
[ 2 Not Reported 4 1 4 1 1 1 '2 1(ESFAS) 15 G
Total 31 11 8 6 5 4 3 3 2 2 6 81
- Waste gas, RBHVAC
- 125 dc batteries *
- Containment '
Key:
RHR -
CVCS - Chemical and Volume Control System ECCS - Emergency Core Cooling DG - Diesel Generators A/W - Auxiliary Feedwater
.ABES - Auxiliary Building Exhaust System .
CCW - Component Cooling Water RPS - Reactor Protection System / Solid State Protection System (RPS/SSPS)
LTOP - Low Temperature.0verpressurization Protection 9
l TABLE 6 l .
l Distribution of BWR LSSF Events by Event Duration and BWR System l
! HPCI RCIC RHR CdNT DG SBGT Misc. Total 1 min 5 t < 10 minutes 0 10 mins $ t < 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 2 1 1 1 1* . 6 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> i t < 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 3 2 5 2 1 1** 14 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> $ t < 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 4 1 1 1*** 7 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> $ t < 1 month 1 1 1 1 4 -
1 month $ t < 3 months ,
0 .
3 months $ t 0 Not Reported 11 4 2 1~ 1 2(ADS) 21 .
. B Total 21 9 8 4 3 2 5 -52 '
- Emergency condensers
- CR0 pumps -
- CBEAF -
Key: .
HPCI -
High Pressure Coolant Injection RCIC. -
Reactor Core Isolation Cooling .
RHR -
Cont. ' - Containment (Primary / Secondary)
DG - -~ Diesel Generators .. '
ADS -
Automatic Depressurization System (ADS /RDS) i SBGT - Standby Gas Treatment -
_ _ _ _ _ m
24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or more involved the containment spray system (five events). Three other events lasted 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or more. One involved the unavailability of the auxiliary feedwater system at Turkey Point 3 for five days. The second event involved blocking of automatic safety injection signals for 43 hours4.976852e-4 days <br />0.0119 hours <br />7.109788e-5 weeks <br />1.63615e-5 months <br /> at Trojan, which would have prevented automatic actuation of emergency core cooling during that period, and the third event involved an improperly set reactor building pressure' switch that was not detected for eight months at Oconee 1. The eight events that lasted more than.'.24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> resulted in enforcement actions and four of the eight were determined tn,he abnormal occurrences.
Of the events at BWRs for which the duration was reported, five lasted 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or mtre. In the first event, secondary containment, integrity was compronised for up to five months at Susquehanna 1. In the second event the 3
PCIC was unavailable for up to four days at Hatch 2. In the third event '
primary containment integrity at Peach Bottom 2 was not established during reactor operation for about 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br /> because a test connection was not reisolated after a calibration. In the fourth event, during HPCI system logic testing while Pilgrim I was at 98% power, the HPCI turbine suction piping was overpressurized because of personnel errors and remained inoperable for three days. (The overpressurization ruptured the gland seal condenser gasket on the HPCI turbine, and spray from the condenser resulted in a 250V de battery ground and a large amount of water on the HPCI room floor.) In the fifth event, both trains of the standby gas treatment I
l L_
o .
system at Susquehanna 1 were unintentionally blocked for a period of 25 hou,rs.
The third and fifth events resulted in enforcement actions. None of these BWP events was dc6 ermined to be an abnormal occurrence.
Effect of Plant Age Table 7 lists the time from initial plant criticality to occurrence of the LSSF event. As indicated !in the table, the frequency of occurrence was the highest during the first year following initial criticality, then dropped significantly and remained low for a few years. Starting in the fourth to ,
t fifth year of opera-tion, until about the tenth year of operation, there was a relatively high number of occurrences.
The number of events have been normalized by the number of years of plant operation tc account for opportunities for error. The normalized data are also given in Table 7. Normalization of the data removes some of the variation from the PWR data, but has little effect on the P.WR data. In general, plant age appears to have no significant influe'nce on the frequency of LSSF events.
The Table 7 data are plotted in Figures 1 and 2. ;
Because of the large number of loss of PWR shutdown cooling system events, Table 7a has been developed. The table gives totals of events that involved the RHR system and those that did not. The normalized data of Table 7a are plotted in Figure 3. One observation that can be drawn from the normalized e
t
TABLE 7 .
Distribution of LSSF Events by Time from Initial Criticality Total No. Frequency of Events **
Years Since # of Events of Plant-Yrs * (# of Events / Plant-Yrs)
Initial Criticality Total PWR BWR PWR BWR Total PWR BWR 0-1 19 15 4 9.5 4 1.4 1.6 1.0 1 6 2 4 7.5 3 0.6 0.3 1.3 2 4 4 0 6.5 0.5 0.6 0.6 0 3 6 5 1 7 1 0.8 0.7 1.0 4 9 4 5 9 2.5 0.8 0.4 2.0 5 9 9 0 12 2.5 0.6 0.8 0 6 16 12 4 16 6 0.7 0.8 0.7 7 11 6 5 19 9.7 0.4 0.3 0.5 8 15 11 4 20.5 9.5 0.5 0.5 0.4 9 13 3 10 18.5 11.8 0.4 0.2 0.8 10 11 6 5 15 9.3' O.5 0.4 0.5 11 5 1 4 7.5 9.5 0.3 0.1 0.4 12 4 1 3 4 7.5 0.3 0.3 0.4 ,
13 -
1 0 1 3 5 0.1 0 0.2 14 2 2 0 2.5 1.5 0.5 0.8 -
0
<14 2 0 2 7.5 3.5 0.2 0 0.6 Total 133 81 52
- Since initial criticality.
- The number-of events was normalized by dividing 'the number of events by the number of plant years of operation between 1981 and June 1984 for plants that had operated for a specific number of years since initial criticality.
data is that loss of RHR system events during the 1981-1984 period were not reported at plants more than 10 or 11 years from initial criticality; however, this may reflect the reporting of events under earlier technical specifications rather than the absence of such events. (The earlier technical specifications had less restrictive requirements regarding RHR system operability in the shutdown coolino mode.) ,
l i
l
. TABLE 7a Distribution of LSSF Events by Time from Initial Criticality.
Influence of RHR Events RHR Event Non-RHR Event Years Since Number of Frequency Number of Frequency Initial Number of Events RHR Events (Events / Plant-Yr) Non-RHR Events (Events / Plant-Yr)
Criticality PWR BWR PWR BWR PWR and BWR PWR BWR PWR and BWR 0-1 15 4 5 1 .44 10 3 .96 1 2 4 1 3 .38 1 1 .19 2 4 0 2 0 .29 2 0 .29 3 5 1 4 0 .50 1 1 .25 4 4 5 0 1 .09 4 4 .70 '
5 9 0 4 0 .28 5 0 .34 6 12 4 9 0 .41 3 4 .32 7 6 5 1 1 .07 5 4 .31 8 11 4 3 1 .13 8 3 .37 .
9 3 10 1 1 .07 2 9 .37 m
.04
- 10 6 5 1 0 5 5 .41 11 1 4 0 0 0 1 4 .29 12 1 3 0 0 0 1 3 .35 13 0 1 0 0 0 0 1 .13 14 2 0 0 0 0, 2 0 .50
> 14 0 2 0 0 0 0 2 .18 Total 81 52 31 8 50 44 a
e
i o
)
~
l k
FIGURE 1 Annual Number of LSSF Events as a Function of Plant Age.
l 20 -
l
~ \
l
l D 15 -
N \ '
\ a e
\ /\
\ 10
\ / \ /<\ -
i /
! 5 \ / g/
/
\ '
" \
' h / s
) 5 -
p% \
l 1( f V \
V \ '% A l
0 i i i i I I I I I N .
0-1 1 2 3 4 5 6 7 8 9 10 11 12 13 14 >14 i YEARS SINCE INITIAL CRITICALITY I...- - , . . - _ _ . , . . . - . . , , . _ . . . . - -,._,..,._,_.~--......,_,,my. . _ , , ~ , . . , ~ , , . . , , , , . . . . , , _ . , . , . . , _ _ . ,
! ~
i l
)
l FIGURE 2 Frequency of LSSF Events as a Function l of Plant Age.
i
+
2.0 -
i E 4
i
- y .
a O
! & BWR
\ a w
15 \
[
= e
\ ;\
? \
a 5
t s -
3.0 i
\ w o ;\
I
$ ' m '
I h t
2 0.5 " N / \
j\g 3 g /N A l
k 4
Y \:
1 i I g i i g 1 N 7 g 10 11 34 > 14
^ 0-1 1 2 3 4 5 6 YEARS SINCE INITIAL CRITICAL.lTY 1
i 3..__-._.._________-____________________-_________..__. _ _ _ _ _ _ __ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ . . _ . . - _ . - . _ _ _ _ _ _ _ _ _ _ _ . . _ _ _ . . - _ _ _ _
l I
FIGURE 3 Frequency of Non-RHR and RHR LSSF Events as a Function of Plant Age.
l i
w 2.0 ,
1' m O
l-O ----- RHR EVENTS h
~
NON-RHR
~ e us
>- l 2
m 1.0 I
O 1
m m
m E
, m '
=
z 0.5 -
- = #pi _
l ~%s / $ ,. r
! % # g
- \ ## %
g,"**% % * ,= % - i _ _ _ t _ _ t _ _ t_ _ a V
1 I I I I I i i i
' 0-1 1 2 3 4 5 6 7 8 9 10 11 12 13 14 >14 4
YEARS SINCE INITIAL CRITICALITY
~
Plants with Three or More Ev1nts In the previous discussion of systems involved in LSSF events it was shown that these events have occurred more frequently at some plants than at others.
Tables 8 and 9 list PWR and BWR plants that had three or more events during the time period of the study. As can be seen from Table 8, 12 PWR plants accounted for 51 of the 81 total PWR LSSF events; the other 30 PWP events occurred at 21 plants. Table 9 shows that ten BWR plants accounted for 37 of the 52 total BWP LSSF events; the other.15 BWR events' occurred at ten plants.
A review of the event characteristics indicates the following:
Twenty-seven of the 51 PWR events at the 12 plants with three or more events involved loss of the RHR system (in shutdown cooling mode). In fact, five plants had three or more loss of RHR events.
Thirty-two of the 37 BWR events (at the ten plants with three or more events) involved losses of PPCI, RCIC, or shutdown cooling.
-- Many of the events at plants having three or more events occurred at ,
plants with little operating experience *. (The specific plants are discussed below.)
- This is in agreement with.the observation in NUREG/CR-3673, " Economic Risks of Nuclear Power Accidents" that reactors are more prone to forced outage events in the first years of plant operation. In fact, the authors wrote:
"This behavior is important because it indicates that economic risk from forced cutage events and transient-induced core melt accident risks are not constant over the life of [ light water reactor] plants. Risk management programs in the U.S. LWR industry should ~ direct special attention to plants in the first few years of commercial operation."
I e
~ ' ~
,, TABLE 8 Distribution of LSSF Events at PWRs With Three or More Events -
NSSS/ Total Number RHR Reactor Loops of Events Events McGuire 1 W/4 9" 3 Calvert Cliffs 2 C-E 7 6 Trojan W/4 6 2 North Anna 1 W/3 4 3 McGuire 2 W/4 4** 3 Calvert Cliffs 1 C-E 3 1 Crystal River 3 B&W 3*** 0 Millstone 2 C-E 3 2 Salem 1 .
W/4 3 0 Salem 2 - W/4 3 3-Sequoyah 1 W/4 3 1 North Anna 2 W/3 3 2 Total -
51 27
- Seven of nine within nine months of' initial' criticality. -
- All within eight months of initial criticality.
- All auxiliary building exhaust system.
TABLE 9 ,
Distribution of LSSF Events at BWRs With Three or More Events Total Number RHR HPCI/RCIC i Reactor. of Events Events Even.ts Brunswick 1 5 1 3 Grand Gulf 1 5* 4 1 Dresden 2 4 0 4 Hatch 1 4 0 3 Duane Arnold 4 0 4 Peach Bottom 3 3 0 2 Fitzpatrick 3 0 3 4
Hatch 2 3** 1 2 Pilgrim 1 3 1 2 Susquehanna 1 3* O 1 Total 37
- All within two years of initial criticality.
- All three in 1982.
l l
_c -
-~ _ _ ~ .yy _. . yy , - r ,
A review was made of the LSSF events at plants that reported more than three such events during the period of the study to determine whether there were any reasons for the high LSSF. event frequency. The following is a brief description of highlights of the events at each of those plants. '
McGuire 1 -
Of the nisie events at McGuire 1, seven of the events occurred in the first nine months following initial criticality.
Calvert Cliffs 2 -
Of the seven events at this reactor, six were -
losses of the RHR; five of which occurred during a seven-week period prior to February 1983. Of the six RHR losses, five were human factors-related and all were caused by' interruptions to the electrical signal to the RHR return header valve.
l .
Trojan -
The six Trojan events involved four different systems: RHR, AFW, CVCS, and ECCS. All of the events were associatec with human factors problems and five of the six were ascr ibed to licensed operators.
The number of LSSF events and the number of sy tems involved, and the fact that all involved human factors,'may indicate a lack of attention to operations by management during the time period of this study.
l AE00 recently issued an engineering evaluation of certain events that occurred at Trojan between May 4, 1984 and September 26, 1984.
(Engineering Evaluation AE00/E514; " Core Damage Precursor Event at Trojan")
t l
l l
l l
u
- 31 .
North Anna 1 -
Of the four LSSF events, three involved the RHR and two of these resulted from equipment failure.
McGuire 2 -
All of the McGuire 2 events occurred in a 16-day period about eight months following initial criticality. The plant operated during the final 14 months of the study period.
Brunswick 1 -
One HPCI and two RCIC failures accounted for three of the five events. The fourth involved a loss of shutdown cooling and the fifth the control building emergency air filtration (CBEAF) system.
l Grand Gulf 1 -
All of the five LSSF events at Grand Gulf 1 occurred within the first two years following initial criticality (four of the five occurred during the first three months of 1984). Four involved loss of the RHR system and the fifth the HPCS system.
- i Dresden 2 -
The four Dresden 2 LSSF events involved the HPCI system, and all occurred prior to 1983. Three of the events involved dissimilar
- equipment failures / (.In one, a pump burned out; in another, an amplifier board failed under test; in a third, actuation of a fire suppression system contaminated the HPCI oil system.) Thus, the Dresden 2 events do not appear to show a specific problem area.
Hatch 1 -
The two HPCI and one RCIC events were the result of unrelated equipment failures. The fourth event involved the diesel -
generator system. -
- -_ ~
Duane Arnold -
The four events involved unrelated failures of the HPCI (three events) or RCIC (one event) systems.
In reviewing the LSSF history of the above ten reactors, the large number of events at all except Trojan can be ascribed to limited operating experience (McGuire 1, McGuire 2, Grand Gulf), RHR system problems (Calvert Cliffs 2, North Anna 1), or HPCI and RCIC system failures (Brunswick 1, Dresden 2, Hatch 1 and Duane Arnold). Only the Trojan data appear to point to a potentik1 problem with the management of operations during the time period of the study.
Method of Discovery LERs generally contained-little information on the method of discovery, that is, whether the event or off-normal condition was automatically alarmed, was the result of an inspection, or was just noted fortuitously.
It was anticipated prior to the study that by examining data on the length of time the system was not available and the method of discovery, it might be possible to determine the most effective methods to identify unavailable or degraded safety systems, to avoid total system losses, and to ensure quick i
recovery in the event of a loss. However, this proved not to be possib'le because LERs. frequently included no explicit statement of how an event or off-normal condition was discovered. .
l I
- 1 L
[' .
LERs prepared since January 1, 1984-are required to include.information regarding the method of discovery, spch as:
j --
Condition was automatically alarmed / annunciated.
l Instrumentation gave clear indication of specific equipment inoperability/ malfunction.
i j --
Operator observed indications of an off-normal condition'(increasing /
j decreasing temperature, pressure, level, etc.).
Personnel noted that a required action had not been taken or.had been "
! taken incorrectly.
I i The LER rule (10 CFR 50.73), effective January 1,- 1984, requires the reporting i
j of such information. Unfortunately, a recent evaluation
- of LERs submitted f the first year following the rule change found that recent LERs are still i
deficient in this respect. Improved reporting of information on the method of j discovery should provide insights into ways in which LSSF events can best be prevented or at least terminated. Close monitoring of LERs will be continued I
to verify the adequacy of reported information in this regard. -
l '
I 2.2 Human Factors Contributions in LSSF Events
~
LSSF events have occurred because of equipment failure or-because of human l
factors contributions. In this study human factors were considered to have l contributed to an event when deviation from required human performance was an-l apparent contributing factor, l
i l
l l
- NUREG-1022, Supplement No. 2, dated September 1985, contains an evaluation of the quality of the 1984 LERs received under the new-reporting require-ments of 50.73. The supplement has been dis.tributed to all licensees.
I l
Table 10 is a listing of the numbers of LSSF. events that involved human factors. Of the 133 LSSF events that,took place during the study period, the events were most frequently the result of human factors contributions (87 events; 65% of the total), i.e., they were not attributed solely to the 4
failure of equipment. This section will focus on those events that involved human factors.
TABLE 10 -l Distribution of LSSF Events Involving Human Factors ,
Jan-June
, 1981 1982 1983 1984 Total l
PWR events involving HF contributions 14 17 22 11 64 .
PWR events involving no HF contributions 7 6 4 0 17 Total PWR events 21 23 26 11 81 Number of reactors
- 46 48- 51 51 BWR events involving
. HF contributions 7 2 7 7 23 BWR events involving no HF contributions 9 6 6 8 29 Total BWR events 16 8 13 15 52 Number of reactors
- 23 26 26 29 Total events !
(BWR and PWR) 37 31 39 26 133 i Number of reactors (BWR and PWR*) 69 74 77 80 i
- Number of plants that had achieved initial criticality .
2.2.1 Cat'egor.ization-of Events Involving Human Factors Contributions The 87 LSSF events that involved human factors were categorized by the type of deficiency that led to the event (Table 11). The categories (discussed below) are intended to point out broad areas where human performance appears to be deficient. Because licensee event reports (LERs) usually provide little detailed information on human factors (e.g. "the event was the result,of personnelerror"),someinterpretationofEERdatawasnecessarytoestablish the probable cause of the error. For example: was the procedure or the planning defective; was the equipment poorly designed or labeled; was the operator inadequately qualified; or was there a combination of all of these .
factors.
Failure to Perform Thirty-seven percent of. events that involved human factors resulted from
" personnel error", or failures by personnel to perform as required. These cerors included incorrect actions (e.g., operated wrong control, opened wrong breaker, installed wrong equipment, installed equipment in wrong location, etc.), as well as failure to perform a required action (e.g., open valve, control pressure, install wiring correctly) or perform a procedure correctly (e.g., verify flow path, isolate test connection, follow up on an annunciator, etc.). The LERs generally did not give enough information to establish a specific root cause(s) for the " improper or inadvertent action," and it was not clear whether this was due to a lack of depth in the licensees' reports or in their investigations.
l l -
/
' i '
TABLE'11 '
Distribution of LSSF Events by Deficiency Type Category -
PWR BWR Total Perc.nt Personnel Error / Failure to Perforn 19 1.3 32 ^37e Management / Administration 17 5 22 25 -
Procedure, Defective 15 3 18 21 Systems Status / Planning 8 2 10 11 Design 5 --
5 6 Total 64 23 8? 100 e
K_el:
Personnel' Error / Failure to Perform , .
Failure to follow procedure or perform procedure correctly; complete all work.
Misidentification. -
Management /A6.sinistration,Deficiehcidsin . ,
Verification Shift turnover ~
Guidelines for verbal conaunication Identificction/ Labeling Control cf contractor activities ,
Control of procedures and +ocedure changes 1
., , - s i Procedure, Defective j Incomplete, incorrect,~andiguous, etc. <
, /
l i' ,
Systems Status /Plinning , ,
i Failure to be aware 6f system configuration / interaction / dependency. ,
Includes:
Channel / train removed from service to perform work, but f (l') more than-was-intended was actually taken out; or (2) work was continued, disabling another; train (operator intended to block one but took action.that affected'all).
Loss of a service system of a redundant train results '
in loss (ur,Lvailability) of both.
< Design ,
Equipment did not ensure' adequate human performance.
l f s
- t
/
- ~ , . - -
_ . , - 3
Management / Administrative Control Systems One quarter of the LSSF events that involved human factors resulted from deficiencies in management or administrative control systems. The broad category included deficiencies in programs for control of personnel access, contractor work activities, procedures and procedure changes, design changes, and shift turnover.
It also.. included deficiencies in programs for labeling and identification, verification of work, and coordination betwe'en operations and maintenance activities.
1 Defective Procedures .
One-fifth of the events resulted because of defective procedures. The deficiencies included procedures that were imprecise, ambiguous, or incomplete.
Procedures were incomplete if they lacked a reasonable caution statement, failed to require necessary monitoring, or permitted an unacceptable condition to exist upon completion of a procedure (e.g., did not require to reopen, reset, recap, reisolate, etc.).
System Status / Planning Approximately 10% of the events involving human factors were the result of a failure to be aware of the system configuration, system interactions, or system dependencies. This category included events in which a train was removed from service for maintenance while the redundant train was unknowingly disabled (e.g., service water to one train was stopped while the
other train was out for maintenance). It also included events in which action to isolate one train resulted in isolation of all trains.
Design r Five events involving human factors were losses of the RHR system that l resulted because of system design deficiencies. System electrical design deficiencies resulted in two events at Calvert Cliffs (because of improperly sized fuses, inad perturbations resulted in RHR return isolation valve s
closures) and one event at Millstone 2 (LPSI tripped due to non-RHR testing but annunciator did not make this known).
The two remaining events, one each at North Anna 1 and 2, resulted from deficiencies in the primary level ,
indication system during RHR operation (because of an ambiguous level ;
indication, leveT dropped until RHR suction was lost). !
When the 87 LSSF events involving human factors contributions were categorized by deficiency type, approximately two-thirds.(63%) of.the events were the , ,
result of factors that were outside of the control of the worker. Even in the -
events that involved a failure to perform, there were a number of instances where improved administrative or operating procedures might have reduced the probability of error. Although training, qualifications, and motivation are -
important, improvements in the areas of management a'nd administrative control, procedures, and planning could have a significant impact in reducing LSSF events.
?
e-- , ,
i e
Reported corrective actions (or actions taken to prevent recurrence) consisted most frequently of procedure changes or personnel actions 'such as counseling or training. The relatively large number of cases in which procedure changes were made to prevent recurrence indicates that licensees considered that the
. existing procedures were not entirely adequate or satisfactory, if not -
necessarily defective.
~
2.2.2 Other Characteristics of LSSF Events Involving Human' Factors i
Contributions Table 12 lists the personnel who were reported to be responsible for the errors leading to LSSF events. Of the 87 errors involving human factors considera- .
tion's, 18 were the result of defective procedures and no specific category of i
personnel was considered fesponsible for these errors. The remaining 69 were i , caused by personnel. 'Non-licensed operators, licensed operators, and other personnel (technicians and maintenance personnel) appeared to be responsible for roughly equal numbers of-the errors (23, 22, and 16, respectively).
1 1
TABLE 12 Distribution of LSSF Events by Personnel Type Personnel Frequency Non-Licensed Operators 23 Licensed Operators . 22 Technician, I&C 9' Maintenance 7 Construction / Contractor 7 Unknown 1 Total 69
i f i
It is sometimes difficult to determine whether the cause of an operator error ,
i is idiosyncratic (operator-determined, e.g., aptitude and motivation) or '
situational (produced by system inadequacies such as inadequate or unrealistic procedures). For example, the shift supervisor has been considered to'be fully i I responsible when one train of a system (e.g., containment spray) is out of !
service and the other train is inadvertently removed from service because of an l
- unrecognized system dependence (e.g., the service water system needed for !
.- . cooling the other train is removed). Because the shift super' visor is apparently well trained and under no unusual strain, it may appear that the problem is idiosyncratic. However, things can get too busy when a lot of maintenance and f i
surveillance is scheduled for the sam.e time period and system dependencies may l
not be recognized (actually a situationa'l cause). Furthermore, the supervisor
. t might not be getting the necessary administrative support, such as an operator i
aid (computer-based or manual program) to record all systems out of service and ,
all systems that will be impacted when a particular component is taken out of ;
service. j Although counseling was an action frequently taken to prevent recurrence of !
errors, it may not be appropriate if errors are in fact due to deficiencies
- I in the system (situational factors) rather than shortcomings in individuals.
Licensees should recognize the importance of thoroughly investigating and ;
identifyin'g to the greatest extent possible, the root cause of the human error .
l
- in order to increase confidence that the corrective action taken will prove i
j effective in preventing recurrence.
i 5
In general, it was not possible to determine the effectiveness of the specific ;
corrective actions taken to preven't recurrence. This is because' licensees I
,_,_- _- . _ _ _ . _ , _ . - . ~ . _ . _ _ . _ _ _ _ - - - . . _ - - -- . - _ , _ - - . . , , , - -
frequently do .not report the full corrective action but only the immediate actions; For example, a procedure may be changed or personnel may be counseled in response to an error, but the full and necessary corrective action might include changes in equipment design, labeling, etc. The full corrective action might be completed at some future time at some facilities and not at others.
The LERs did not contain sufficient information to permit an analysis of this.
i Table 13 is a matrix representation of the data of Tables 11 and 12. In events 4
involving failure to perform or management / administrative control deficiencies, licensed and non-licensed operators,and other personnel (maintenance personnel and I&C technicians) were responsible for equal numbers of errors. Operators (licensed and non-licensed) were involved in all events involving planning and i human engineering discrepancies.* ,
Table 14 is a listing of activities that were underway when the LSSF events occurred. Operations include activities to operate the plant in any mode ,
whether at power or shut down. Roughly two-thirds of the events resulted from errors during maintenance and testing.
- By definition (NUREG-0700), a Human Engineering Discrepancy (HED) is a departure from some benchmark of system design suitability for the roles and capabilities of the human operator.
i l
i l
1 l
l
TABLE 13 -
Distribution of LSSF Events by Deficiency Type and Personnel Type '
Operator Non- Operator Technician Contractor Licensed Licensed I&C Maintenance Construction Unknown N/A Total Failure to Perform 11 10 7 -4 32 Management /
Administration 4 5 2 3 7 1 22 Defective Procedure 17 18 System _ Status /
Planning 4 6 10 Design .
i Deficient 4 1 5 g Total 23 22 9 7 7 1 17 . 87 TABLE 14 Distribution of LSSF Events by Activity Underway When the Events Occurred Activity ,
Frequency Maintenance 28 Testing 25 Operations 22 Plant Modifications 6
Refueling 6 Total 87
,. 43 -
l 3.0 FINDINGS AND CONCLUSIONS , i l
This study identified 133 events between 1981 and June 1984 that involved a loss of safety system function (LSSF). Human factors contributions were involved in 87.of the 133 events, while 46 were solely the result of equipment failure. A review of the LSSF events indicates the following.
(1) Between 1981 and June 1984, there was a relatively constant frequency of LSSF events, and no significant trend in the rate of occurrence could be -
seen with regard to reactor plant type. However, there is no clear evidence that a large improvement is being made, on an industry-wide
. basis, in preventing loss of safety system events.
(2) Variation of rate of occurrence of LSSF events was observed among reactor vendors and among different Westinghouse G ) PWR models, although this variation was largely the result of variations among a small number of individual plants. It seems clear that the W two-loop plants and Babcock and Wilcox (B&W) plants reported fewer than the average number of LSSF events.
(3) LSSF events at PWRs most frequently involved the RHR system (31 events),
i the containment spray system (11), and the CVCS (eight). LSSF events at BWRs most frequently involved the HPCI system (22), the RCIC system (eight) and the RHR system (eight).
With few exceptions, most of the LSSF events at PWRs and BWRs were non-repetitive, even at plants where there were multiple events. The
. - 44 relatively large numbersJof events involving the RHR system at PWRs and the HPCI, RCIC and RHR systems at BWRs are due to the fact that :
these systems are not designed to meet the single failure criterion.
i i
(4) The event duration was less than eight hours in 85% of the PWR events and 65% of the BWR events. PWR RHR system events accounted for most of th'e events lasting less than one hour, while containment spray' 1
isolation events accounted for most of the events lasting more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The five reported events at BWRs that lasted more than #
24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> involved the HPCI, RCIC, SGTS, and containment systems.
(5) The frequency of occurrence of LSSF events was highest in th'e first year following initial plant criticality, then dropped for -
a few years. Starting in about the fourth to fifth year until about the tenth year of operation the number of occurrences was F
relatively high. However, after the first year plant age appeared to have no significant influence on the frequency of LSSF events.
(6) LSSF events have occurred more frequently at some plants than at
, others. Data show that 12 PWR plants accounted for 51 of the 81 total PWR LSSF events and ten BWR plants accounted for 37 of the 52 total BWR LSSF events. A review of the characteristics of LSSF events at plants with multiple events indicated events most frequently involved the residual / decay heat removal system at PWRs, the HPCI, RCIC, or RHR at BWRs, and plants with little operating experience.
In reviewing the operating history of the several plants that b
. reported three or more events, the excess number of events at all except Trojan could be ascribed to limited operating experience (McGuire 1 and 2, Grand Gulf 1), RHR system problems (Calvert P
Cliffs 2, North Anna 1), or HPCI and RCIC system failures (Brunswick 1, Dresden 2, Hatch 1, and Duane Arnold). Only the events at Trojan point to a potential plant operations management problem during the time period of the study.
(7) Of the 133 LSSF events that took place during the study period, 4
the events were most frequently (87 times, 65% of the total) the result of hunan factors contributions, i.e., they were not attributed solely to equipment failure.
(8) Categorization of LSSF events involving human factors contributions showed that 37% of all such events resulted from " personnel error" 4
or failures by personnel to perform as required. That is, the remaining events (almost two-thirds) resulted from conditions that a
j were outside of the control of the worker. For example, events frequently occurred as a result of defective administrative or -
operating procedures. This indicated that although training, qualifications and motivation are important, improvements in the j areas of management and administrative control, procedures and planning could have a significant impact on reducing the number of ,
LSSF events. For the events that were due to personnel errcr the ,
LERs generally did not give enough information to establish a specific " root cause" and it was not clear whether this was due to
. a lack of depth in the licensees' reports or in their investigations.
t
i .
( (9) Licensed operators, non-licensed operators, and other personnel (technicians and maintenance personnel) were responsible for roughly-equal numbers of errors leading to LSSF events. This is evidence that it is necessary that licensees establish programs to ensure all types of personnel are well qualified and trained. ,
(10) Licensee Event Reports were generally unclear regarding the cause for human error, particularly failures to perform tasks correctly or 1
i adequately, perhaps because the events were not promptly and thoroughly investigated or because an attempt was made to assign a single, unequivocal "cause." In any case, the great majority of them seemed to be due to deficiencies in situational factor's (e.g., unsuitable equipment
~
design) rather than idiosyncratic factors-(shortcomings in individuals, such as lack of motivation, lack of skill / training, and/or lack of -
capability).
Licensees should recognize the importance of thoroughly investigating and identifying to the greatest extent possible, the root cause of the human error in order to increase confidence th'at the action taken will prove effective in preventing recurrence.
4
l 4.0 RECOMMENDATIONS i -
i This study identified and evaluated all LSSF events in the 1981 through June
- 1984 time period. The study found that LSSF events most frequently involved the PWR RHR and containment spray systems, the BWR HPCI, RCIC, and RHR systems, and plants with little operating experience. There were also six events at PWRs involving total loss of ECCS systems. However, no problems were.
identified that justify specific recommendations regarding regulatory l
) corrective action. However, the following general recommendations are made:
]
l (1) Licensees should be informed regarding the characteristics of recent
! LSSF events resulting from human factors contributions. Although j .
industry should be made aware of potential problems in this area, j it is particularly important that licensees that. experience more j frequent losses take prompt action to reduce the potential for
- l
- problems. It is recommended that IE consider an Information Notice to feed back this information to industry.
The Information Notice should recommend a review of the adequacy of l procedures for the management and administrative control of work j and planning. In particular, procedures for investigation of events or 1
- off-normal conditions should include specific measures to determine the root cause(s) and all contributi,ng factors.
i
! (2) Equal numbers of events resulting from errors by licensed operators, i '
\
- non-licensed operators, and other personnel (maintenance personnel' ,
i ;
and I&C technicians) point'to a need to ensure sufficient attention l l
o'
- 48 - -
is paid to the qualifications of all personnel. Therefore, it is recommended that NRR.(1) review this aspect of personnel qualification programs for adequacy as part of the maintenance and surveillance program plan (MSPP), (2) determine whether this observation has been adequately considered in the INPO accre'ditation programs for licensee personnel, and.(3) review the Human Factors Program Plan (HFPP) to ensure.that priorities
- assigned to developing NPP personnel qualification and training requirements and to ensuring adequate and effective procedures are appropriate.
(3) An' attempt was made to determine whether any event (s) of the study seemed to have a' level of significance higher than previously
~
recognized. For BWR events it was found this was generally not the case. However, for PWR events it was found that three types of event j (losses of ECCS injection systems, containment spray isolations, and a Salem loss of component cooling water event) may warrant further study. Therefore, it is recommended that AE00 determine whether or not'to perform additional evaluations of these three types of events. .
s e
(4) A major difficulty encountered during this study was the lack of t t
, information on the cause of human error. The revised event reporting requirements that went into effect in January 1984 (LER Rule 50.73) '
! have helped to resolve this problem, because events are being reported/ ,
9 e p 4
i f
I e
t P
---9 - , , , . , , -- .. -, , _,----~_,y_.m,. , . - . , - , . . , - -
f 49 _
in greater detail. However, there is a wiue range of interpretations of what is required to meet the intent of reporting requirements for events that may have been the result of human factors contributions.
This finding confirms a similar finding of NUREG-1022, Supplement 2*,
that recent LERs have frequently been deficient with respect to the quality of the data on'the human factors contributions to events.
Therefore, it is recommmended that AE00 continue to monitor the quality of the data in the LERs that are received, and take further action if improvement is net seen in the extent to which human factors data is being reported. -
(5) Although this study did not find evidence of previously unrecognized .
safety problems, it is an.ticipated that a data base'on LSSF events may be a useful tool for identifying areas in which efforts can be made to improve safety most effectively. Therefore, it is recommended that AEOD continue to analyze LSSF event data and evaluate the data to determiae whether LSSF events are a meaningful performance indicator. If it is determined that these events can be used as an indicator of performance, such data should be fed back to the Regions for any licensee assessments (SALP, etc.).
i
- NUREG-1022, Supplement No. 2, dated September 1985, contains an evaluation i
of the quality of the 1984 LERs received under the new reporting require-ments of 50.73. The supplement has been distributed to all licensees.
50 -
5.0 REFERENCES
(1) NRC, Memorandum from C. J. Heltemes to Harold R. Denton, Special Study Report - Human Error in Events Involving Wrong Unit or Wrong Train, AEOD/S401, January 13, 1984 (and Supplement dated August 8, 1984).
(2) Nuclear Safety Analysis Center, EPRI, NSAC/52, Residual Heat Removal Experience Review and Safety Analysis, Pressurized Water Reactors, January 1983. .
(3) NUREG-1022, Supplement No. 1, Licensee Event Report System, Description of System and Guidelines for Reporting, February 1984.
O e
9 e
6
A-1
'~
. APPENDIX A-1 Table A-1 LOSS OF SAFETY SYSTEM FUNCTION - PWR EVENTS INVOLVING HUMAN ERROR Plant Event Mode / Other NSSS/ Since LER # Date System % Power Duration Reporta Loops ** Crit.***
Indian Pt 2 831129 Cont. 1/100 43 days A0 W/4 .10 y 24783043 Spray Turkey Pt 3 830419 AFW 1/100 5 days x,AO W/3 10 y 25083007 Turkey Pt 4 811128 LTOP 5/0 1&2 mins A0 W/3 8y
- 25181015 Turkey Pt 4 831004 Cont. 1/100 50 hrs x,A0 W/3 10 y .
25183016 Spray I 4
Palisades 810106 125V 1/99 1 hr AO. C-E 9y 25581001 D.C. ,
Batteries 1 Robinson 2 810114 CVCS 1/100 2 hrs x W/3 10 y i 26181003 ,
Oconee 1 820323 Cont. 5/0 51 days B&W 11 y ,
26982008 Spray Oconee 1 830623 Cont. 1/100 NR x B&W 12 y 26982012 Spray Salem 1 830222 RPS 1/20 NA A0 W/4 6y 27283011 Prairie '
Island 1 820827 DG 1/100 1.5 hrs W/2 8y 28282015 ,
1
- x = Wrong Unit / Train (WU/T) Event Special Study Report, 1/13/84 xx = WU/T Event Follow-up Report, 8/8/84 A0 = Abnormal Occurrence l
- NSSS Vendors Comoustion Engineering (C-E) and Babcock and Wilcox (B&W) i plants all have two loops. Westinghouse (W) plants have two, three, or '
i four loops, i *** Time period since initial criticality (y = years, m = months).
- l 1
A-2 Table A-1 (Continued) ,,
Plant Event Mode / Other NSSS/ Since LER # Date System X Power Duration Report
- Loops ** Crit.***
3 Ft Calhoun 1 840314 CCW 1/100 2 mins C-E 10 y 28584003 :
i
~
Crystal River 3 810508 A8ES 1/100 NR B&W 4y 30281027 .
s Crystal ,
i River 3 840615 ABES 1/99 44 mins B&W 7y 30284012
$ Kewaunee 811016 CCW 1/100 50 mins W/2 7y -
i 30581033 .
- Kewaunee 821004 Cont. 1/100 4 months W/2 8y 30582030 Spray *
}
l Maine Yankee 810610 RHR /0 5 mins C-E 8y 30981008 ,
Salem 2 -
831220 RHR /0 22 mins W/4 3y i 31183066 Salem 2 840209 RHR /0 17 mins W/4 3y ,
31184002
~
, D.C. Cook 1 830201 Cont. 1/100 7 hrs x W/4 8y l 31583009 Spray
) D.'C. Cook 2 830603 Cont. 1/100 3 hrs x W/4 5y I
! 31683048 Spray O.C. Cook 2 840521 RHR /0 25 mins W/4 6y i
31684014
- Calvert l Cliffs 1 830426 LTOP 5/0 17 mins C-E 8y '
31783019
- Calvert 1 Cliffs 1 830524 ECCS 1/100 22 mins C-E 8y !
31783028
- Lost automatic actuation o7 all features actuated by containment pressure.
i ,
- . _ , _ . _ _ - _ . - _ , _ _ - _ _ _ _ _ . . _ _ _ _ , .. . - _ _ _ _ _ ._. .. ~_ , _ _ _ . . ~ . . _ _ _ _ . _ - , . -
A-3 Table A-1 (Continued)
Plant Event Mode / Other NSSS/ Since LER # Date System % Power Duration Report
- Loops ** Crit.***
Calvert Cliffs 1 831012 RHR /0 30 mins C-E 9y
.i 31783061 Calvert i Cliffs 2 810204 RHR '
/0 17 mins C-E 5y 4 31881004 Calvert a
Cliffs 2 821122 RHR /0 4 mins C-E 6y 31882053 Calvert Cliffs 2 821228 RHR /0 NR - C-E 6y .
l .
31882055 1
1 Calvert -
Cliffs 2 830104 RnR /0 15 mins C-E 6y ,
31883001 -
i, Calvert Cliffs 2 830107 RHR /0 9 mins C-E 6y 31883005 Calvert .
I Cliffs 2 840426 DG - /0 10 hrs C-E 7y 31884005
/
Sequoyah 1 810324_ ABGTS 1/98 12 hrs W/4 8m 32781032 Sequoyah 1 820916 RHR /0 6 mins W/4 26 m 32782116 Sequoyah 1 830911 RPS /0 NR W/4 3 y+
32783112 (SSPS)
Beaver Valley 1 810606 ECCS 1/99 NR A0 W/3 5y 33481047 (HHSI)
St. Lucie 1 830329 RHR 6/0 10 mins C-E 7y 33583021 Millstone 2 810102 DG 1/100 3 brs C-E 5y 33681101
o . .
A-4 Table A-1 (Continued)
Plant Event Mode / Other NSSS/ Since LER # Date System % Power Duration Report
- Loops ** Crit.***
Millstone 2 811209 RHR 5/0 2 mins C-E 6y 33681043 (LPSI)
North Anna 1 821019 RHR 6/0 36/33 mins W/3 4y 33882067 North Anna 1 821206 ECCS 3/0 22.5 hrs W/3 4y 33882082 (SI) <
, North Anna 2 820528 Cont. 3/0 17 mins x W/3 2y 33982022 Spray North Anna 2
- 820520 RHR 5/0 8/26/60 mins W/3 2y 4
33982026 North Anna 2 830503 RHR 6/0 NR W/3 3y 33983038 Trojan 810626 RHR /0 1.25 hrs W/4 5y l 34481012
Trojan 830122 AFW 2/4 7 mins W/4 7y 34483002 1
Trojr.n 830908 CVCS 1/100 3 hrs xx W/4 7y 34483013 Trojan 840320 AFW 1/? '1.3 hrs W/4 8y 34484005 Trojan 840504 RHR 6/0 40 mins W/4 8y 34484010 l
1 Farley 1 820510 Cont. 1/100 7 hrs A0 W/3 4y 34882021 Spray' J
San Onofre 2 830621 CVCS 5/0 NR C-E 11 m
- 36183071 San Onofre 3 821205 CVCS /0 7.5 hrs C-E Om 36282005 i
I v - _ , , , - - . , . _ . . , . ,
- .o . . .,
i A-5 Table A- 1 (Continued) ;
Plant -
Event Mode / Other NSSS/ Since .
LER # Date System X Power Duration Reporta Loops ** Crit.***
San Onofre 3 840317 Cont. 1/100 13 days A0 C-E 8m j 36284009 Spray L
l Farley 2 821028 Cont. 1/100 17 months A0 W/3 .19 m +
l_ 36482043 Spray -
! McGuire 1 811112 R8/HVAC /48 10 mins x W/4 3m
- 36981180 r
l McGuire 1 811118 RHR /0 22 mins W/4 3m
! 36981185 '
McGuire 1 820212 ECCS /50 < 1 hr W/4 , 7m l j 36982017 ~(UHI) !
1 McGuire 1 820302 RHR /0 < 1 hr W/4 8m [
)
36982024 -
l 4 McGuire 1 820423 CVCS /50 NR -W/4 9m
- j ~36982030 i
! McGuire 1 830405 RHR 6/0 NR W/4 21 m 'l
} 35983017 i l McGuire 1 830929 Cont. 1/100 4.7 hrs A0 W/4- 27 m 36983084 Spray l
].
McGuire 2 831231 RHR /0 43 mins .W/4 7m l' 37083092 3
McGuire 2 840109 RHR /0 40 mins W/4 8m ;
, 37084001 I T
l McGuire 2 840115 RHR /0 49 min", W/4 8m .
l 37084002 i 1 . i
! McGuire 2 840115 CVCS /0 NR W/4 8m 1 l
37084004 L i !
l Total: 64 Events !
i ;
I :
4
-i !
I i
A-6 TA8LE A-2 f LOSSES OF SAFETY SYSTEM FUNCTION - 8WR EVENTS INVOLVING HUMAN ERROR 4 Plant Event -
Mode / Other Since !
LER # Date System % Power Duration Report
- C ri t. ** :
i Big Rock Pt 810917 RDS 1/80 NR x '
19 y ,
15581022 ,
i
! Oyster Creek 820614 CR0 1/82 2.5 hrs 13 y 21982031 Pumps '
Dresden 2 810526 HPCI /44 NR 11 y 23781030 .
Quad Cities 1 811209 Cont. 1/98 7 hrs 10 y- .
.l 25481024 (Sec) -
Peach Bottom 2 830323 Cont. 1/? 80 hrs 9y -
27783006 (Pri) l
! Peach Bottom 3 810211 -
Cont. 1/100 93 mins. x 6y :
27881008 (Prf) [
}.
l Peach Bottom 3 840602 'HPCI & 4/0 2 hrs - 9y [
27884007 RCIC Pilgrim 1 811211 RHR /0 5 hrs x 9y 29381064 Pilgrim 1 830929 HPCI 1/96 3 days 11 y 29383048 i
{ Cooper 810613 RCIC /0 < 8 hrs 7y l 29881017 . .
Cooper 840414 $8GT 1/70 13 hrs 10 y 29884007 i
Brunswick 2 830825 RHR 1/100 3 hrs 8y
( 32483069 4
Brunswick 1 810220 RCIC 1/97 15 mins 4y i 32581031 i
4 a x - Wrong Unit / Train (WU/T) Event Report, 1/13/84 '
- Time period since initial criticality (y = years, m = months) i
. . - . - . ~. . ._ - - .
.i j A'- 7 TABLE A-2 (Continued)
Plant Event Mode /
Other Since i LER # Date System X Power Duration Report
- Crit.**
Fitzpatrick 840207 HPCI & 1/100 6.5 hrs 9y 33384003 RCIC 4 Fitzpatrick 840210 HPCI & 1/100 30 mins 9y i
33384004 RCIC i Hatch 2 820817 RHR 1/99 < 8 hrs x 4y I 36682095 l Susquehanna 1 830301 SGTS 1/100 25 hrs x 0m !
38783026 -
Susquehanna 1 830310 Cont. O < 5 months 6m 1 38783033 (Sec) '
l . Susquehanna 1 830311 HPCI O NR 6m '
38783044 Grand Gulf 1 830523 RHR 0 1 hr 9m (
l 41683069 i
)
i Grand Gulf 1 840114 RHR 0 1 hr , 17 m i
- 41684013 , !
Total: 23 Events I i
l 1 ,
i
[
4 I
I 9 ,
l ,
[
t ,
h I -- .. .- - _ . . - . - . . - , . - .
A-8 TABLE A-3 LASSES OF SAFETY SYSTEM FUNCTION - PWR EVENTS WITH NO HUMAN ERROR INVOLVED Plant Event Mode / NSSS Since LER # Date System % Power Duration Loops Crit.**
San Onofre 1 810717 Waste 5/0 18 mins W/3 14 y 20681018 Gas San Onofre 1 810903* ECCS 1/88 30 mins W/3 14 y 20681020 (SI)
Turkey Pt 3 811112 DG 5/0 30 mins W/3' 9y .
25081015 Palisades 810718 RHR 5/0 NR C-E 10 y 25581030 Oconee 2 810919 RHR 0 17 hrs B&W 8y 27082017 Salem 1 820106 DG 5/0 2 days W/4 5y
.27282003 Salem 1 820316 CCW/SW*** 5/0 45 mins W/4 5y 27282015 Crystal
- River 3 831018 ABES 1/96 2 hrs 8&W 6y 30283044 Zion 2 810914 AFW 4/0 NR W/4 8y 30481020 Salem 2 830713 RHR 5/0 55 mins W/4 3y .
31183032 Calvert Cliffs 2 821124 RHR 6/0 18 mins C-E 6y 31882054 ,
St. Lucie 1 821023 CVCS 0 15 mins C-E 6 y;'
33582050 ,
P
- Abnormal occurrence. -
- Time period since initial criticality (y = years, m = months). -
i A-9 l
TABLE A-3 (Continued)
Plant Event Mode / NSSS Since LER # Date System % Power Duration Loops Crit.**
)
Millstone 2 820106 - RHR '6/0 7 mins C-E 6y .
33682002 i North Anna 1 830122 RHR 5/0 4 mins W/3 5y 33883003 North Anna 1 830218 RHR 5/0 5 mins W/3 5y
- 33883009 1
McGuire 1 811216 ESFAS 5/0 NR W/4 4m 36981188 McGuire 1 E20212 CVCS 1/50 NR W/4 6m
, 36982015 Total: 17 Events i
l , .
J e &
i I
A-10 TABLE A-4 LOSSES OF SAFETY SYSTEM FUNCTION - SkR EVENTS WITH NO HUMAN ERROR INVOLVED Plant Event Mode / Since LER # Date System % Power Duration Crit.**
Big Rock Pt. 840222 RDS /0 NR 21 y -
15584001 Nine Mile Pt. 1 811120 Emer. 1/99 20 mins 12 y 22081053 Condensers Dresden 2 810602 HPCI /46 NR 11 y 23781033 Dresden 2 811223 HPCI 1/99 NR 12 y 23781079 -
Dresden 2 820622 HPCI 1/78 NR 12 y 23782021 Dresden 3 811023* DG /66 1 hr 10 y 24981033 Quad Cities 1 820622* DG /53 17 mins 10 y 25482012 Browns Ferry 2 830801 HPCI 1/100 NR 9y 26083046 Browns Ferry 2 831110 HPCI 1/98 NR 9y 26083074 Peach Bottom 3 830126 HPIC.& 1/86 NR 8y 27883002 RCIC ,
Pilgrim 1 830413 RCIC- 1/99 NR 11 y 29383022 Browns Ferry 3 810317 .HPCI 1/100 NR 4y 29681015 Hatch 1 820805 >
. HPCI /0 NR 6y 32181013 ,
Hatch 1 810405 DG 6/0 NR 6y 32181026 l
- Abnormal Occurrence i ** Time period since' initial criticality (y = years, m = months) i i
A-11 Table A-4 (Continued)
Plant Event Mode / Since LER # Date System % Power Duration Crit.**
Hatch 1 810805 HPCI 1/98 < 24 hrs 7y 32182070 Hatch 1 830523 RCIC 1/99 NR 8y 32183056
~ '
Brunswick 2 810410 HPCI /37 NR 6y .
32481029 Brunswick 1 810120 RCIC /0 NR 4y 32581010 Brunswick 1 840109 RHR/SW 1/100 NR, 7y 32584001 Brunswick 1 840331 HPCI 1/100 NR 7y 32584007 Brunswick 1 840606 CBEAF 1/100 11 hrs 7y 32584008 .
Arnold 820912 HPCI & 1/34 11 hrs 8y .
33182056 RCIC Arnold 830803 HPCI 1/96 < 24 hrs 9y 33183028 Arnold 830904 RCIC 1/80 10 hrs 9y 33183032 Arnold 840210 HPCI & 1/100 5 hrs 10 y 33184012 ADS Fitzpatrick- 840518 HPCI & 1/100 3 hrs 9y 33384012 RCIC Hatch 2 . 820126 RCIC 3/3 NR 3y 36682012 Hatch 2 820828 RCIC /10 4 days 4y 36682100 Grand Gulf 1 840107 RHR /0 NR 17 m 41584002 Total: 29 Events
R-1
~
l APPENDIX R ;
TABLE R-1 ,
LOSSES OF SAFETY SYSTEM FUNCTION INVOLVING HUMAN ERROR PRESSURIZED WATER REACTOR EVENTS LER # Event Plant Dr'e System Activity % Power Person Cause/ Contributing Factors Corrective Actions
}
l f
247-83-043 831129 Cont. Maintenance, 100 Operator, Personnel Error Training (improve-Indian Pt 2 Spray Unscheduled Non- (Failure to perform pro- ment in area of licensed cedure correctly (S! equipment status checkoff list))/ Failure identification)
- to verify by second operator (Note: Appears independent, verification was not required) 250-83-007 830419 AFV Modification 100 Operator, Deficient Management / Procedure Changes Turkey Pt 3 Mon- -
Administration (Mis-licensed identification / Failure to independently verify) 251-81-015 811128 LTOP Testing 0 N/A Defective Procedure Procedure Changes l Turkey Pt 4 -
251-83-016 831004 Cont. Operations 100 Operator, Deficient Management / Labeling. Design Turkey Pt 4 - Spray non . Administration licensed .
255-81-001 810106 125V Testing 99 Mainten- Deficient Management / Design (add CR Palisades DC Surveillance ance/ Administration indication of
-Batteries ~ Electrical station battery '
operability) 9 +, - , --.--y - - . * .rw- ~-p --c + --w- y- - y y .-tw y,m w-.s ---
w y- wa 9 y-+wsvywy w- yy . y -e2--- -
g- --m+<- re- w ' -, - w - awry
B-2 ,
l TABLE B-1 (Continued)
LER # Event Plant Date System Activity % Power Person Cause/ Contributing Factors Corrective Actions ,
l 261-81-003 810114 CVCS Maintenance 100 N/A Procedure Procedure Changes Pobinson 2 -
269-82-008 820323 Cont. Testing, O Technician, Deficient Management / Work verification Oconee 1 Calibration IAC Administration program changes; (Independent veri-fication would be required in all instrumentation and electrical procedures that components are returned to required status);
Procedure Changes 269-82-012 830623 Cont. Testing 100 Operator, Planning Training Oconee 1 Spray licensed 272-83-011 830222 RPS Operations (Power) Operators, Management / Administration Procedure Changes; Salem I licensed Training 282-82-015 820827 DG Maintenance 100 Maintenance Personnel error Procedure Changes Proirie Island Electrical (Failure to follow procedure) 9 1
B-3 TABLE B-1 (Continued)
LER # Event Plant Date System Activity % Power Person Cause/ Contributing Factors Corrective Actions 285-84-003 840314 CCW Testing 100 Operator, Personnel error Procedure Changes Ft Calhoun 1 Licensed (0pened wrong breaker) .
302-81-027 810508 ABES Maintenance 100 f*/A Defective Procedure Procedure Changes Crystal Piver 3 ,
302-84-012 840615 ABES: Modificatten 99 Contractor, Mananement/ Administration Damage Repaired ,
Crystal River 3 - Non- (Instrument air line licensed damaged by contractor personnel) 305-81-033 811016 CCW Maintenance 100 Operator, Planning; incorrect Counseling Kewaunee Non- removal from service licensed (for maintenance) 305-82-030 821004 Cont. Testing 100 Technician, Management / Administration Labeling Kewaunee Spray
- IAC (Inadequate Labeling) (Penetrations Tagged)
Procedure Changes 309-81-008 810610 PHP Maintenance O Contractor, Management /Administra' tion Counseling Maine Yankee Electrician (Contractor displaced (of contractor
- connector on flow personnel who were controller) involved)
- Loss of automatic actuation of features actuated by containment pressure.
4
. B-4 TABLER-1(Continued) -
LER # Event Plant Date System Activity % Power Person Cause/ Contributing Factors Corrective Actions
' ~
311-83-066 831220 RHR Maintenance 0 Operator, Planning Counseling -
Salem 2 Non-licensed 311-84-002 840209 RHP Maintenance 0 Operator, Management / Administration Procedure Changes Salem 2 Licensed (Problem updating status ,
in control room) 315-83-009 830201 Cont. Testing
- 100 Operator, Personnel error Procedure, D.C. Cook 1 Spray Non- (Misidentification)/ Counseling licensed Failure to independently verify 316-83-048 830603 Cont. Testing 100 Operator, Personnel error Counseling D.C. Cook 2 Spray Non- (Perform incorrect action)/
licensed Failure to. verify 316-84-014 840521 RHR Operations 0 N/A Defective Procedure Procedure Changes D.C. Cook 2 (CSD) (Regarding I1CS Inventory) 317-83-019 830426 LTOP Operations 0 Operator, Personnel Error Counseling Calvert Licensed Cliffs 1 317-83-028 830527 ECCS Maintenance 100 Operator, Inadequate Planning Procedure Changes Calvert Licensed (Failure to recognize Cliffs 1 system interdependency)
B-5 -
TABLE B-1 (Continued) ,
, LER # Event
. Plant Date System Activity % Power Person Cause/ Contributing Factors Corrective Actions 317-83-061 831012 RPR '
Testing 0 N/A Defective Procedure Procedure Changes Calvert.,
Cliffs 1 318-81-004 810204 RHR Preventive O N/A Defective Procedure Procedure Changes Calvert Maintenance Cliffs 2 318-82-053 821122 RHR Testing 0 Technician Personnel error Counseling Calvert (Performed action Cliffs 2 incorrectly)~
318-82-055 821228 RHP Operations 0 Operator, Design Deficiency (Fuse Design '
Calvert Non- coordination scheme) Modifications Cliffs 2 licensed 318-83-001 830104 RHR Testing 0 Operator, Design Deficiency Design Calvert Non- (same as #318-82-055) Modifications Cliffs 2 licensed 318-83-005 830107 RHR Testing 0 N/A Defective Procedure Procedure Changes Calvert Cliffs 2 318-84-005 840426 DG Preventive - 0 Operate.r, Planning (Failure to Counseling Calvert Maintenance Licensed recognize system dependence /
Cliffs 2 status)/ Improper removal .
from servide e
9 m r- , -
,,- e-- e -
B-6 TABLE B-1 (Continued)
LER # Event Plant Date System Activity % Power Person Cause/ Contributing Factors Corrective Actions 327-81-032 810324 ABGTS Testing 98 Operator, Personnel error Training Sequoyah 1 Licensed (Misinterpretation of LCO Pequirements) 327-82-116 820916 RHR Modification 0 N/A Defective Procedure Prncedure Changes Sequoyah 1 (SSPS) 327 Al-112 830911 RPS Testing 0 N/A Defective Procedure Procedure Changes Sequoyah 1 (SSPS) (Review quality assurance procedures on chances to pro-cedures) 334-81-047 810606 ECCS Operations 99 Unknown Management / Administration Procedure Changes Beaver (HHSI) (To control Valley 1 personnel access) 335-83-021 830329 RHR Refueling 0 Construc- Management / Administration ,Not Reported St Lucie 1 tion (Failure t6 control construction activity) 336-81-001 810102 DG Testing 100 Operator, Personnel error Labeling Millstone 2 Non- (Misidentification)
(Inspection licensed Report)
B-7 TARLE R-1 (Continued), -
LER # Event Plant Date System Activity % Power Person Cause/ Contributing Factors Corrective Actions 336-81-043 811029 RHR Operations 0 Operator, Inadequate Design / Design Change Millstone 2 (LPSI) (Shutdown) Licensed Defective Procedure (Install annunci-ator for loss of LPCI); Procedure Changes 338-82-067 821019 RHR Refueling 0 Operator, Design (ambiguous level Not Reported H2rth 821020 Non- indication)
Anna 1 -
licensed 338-82-082 821206 ECCS Operations 0 N/A Defective Procedure Procedure Changes N3rth (SI)
Anna 1 .
339-82-022 820528 Cont. Testing 0 Maintenance, Personnel Error / Procedure, North Spray Electrical Labeling Labeling Anna 2 .
. 339-82-026 8200520 RHR Operations 0 Operator, Inadequate Design fyocedure Changes North Non-Anna 2 licensed 339-83-038 830503 RHR . Refueling 0- Operators, Personnel error Counseling North Non- (Failure to monitor RCS Anna 2 licensed level adequately) a 4
4 n . , y 3 - . - - , .-.
B-8 TABLE B-1 (Continued)
LER # Event Plant Date System Activity % Power Person Cause/ Contributing Factors ~ Corrective Actions 344-81-012 810526 RHR Operations 0 Operators, Personnel error Prucedure Changes i 3
Trsjan Licensed (Failure to perform procedure adequately (veni prc:surizer))
344-82-015 820820 ECCS Operations 0 Opera tors , Personnel error Counseling' Trojan (SI) Licensed (Failure to perform procedure adequately)
- 344-83-002 830122 AFW Operations 4 Opera tor. Personnel error Procedure Changes; Trojan (Mode 2) Licensed (Failure to perform Training
- ' procedure adequately) 344-83-013 830908 CVCS Maintenance 100 Opera t'or, Personnel error Counseling Trojan Licensed (Failure to prepare correct tagout) i 344-84-005. 840320 AFW Testing (Power) Operator, Planning (Lack of Improvements Trojan Licensed coordination between in planning of maintenance and operations and ,*
operations) . maintenance 344-84-010 840504 RHR Refueling 0 N/A Procedure Procedure Changes
- Trojan 348-82-021 820510 Cont. Testing 100 Operator, Personnel Error C'ounseling
'Farley 1 Spray Non- (Misidentification and licensed failure of operators tn investigate when condition was indicated by an i annunciator) -
B-9
~
TABLE B-1 (Continued) l l LER # Event j Plant Date System Activity % Power Person Cause/ Contributing Factors Corrective Actions 361-83-071 830621 CVCS Testing 0 Technician, Personnel Error Counseling San Onofre 2 IRC 362-82-005 021205 CVCS Maintenance 0 Operator, Inadequate Planning Training, San Onofre 3 Non- (Incorrect removal from Counseling licensed service) 362-84-009 840317 Cont. Testing 100 Operator, Management / Administration Procedsire Changes San Onofre 3 Spray Licensed (Lack of control over (to ensure correct procedures) valve alignment prior to entering a given mode of -
operation and to ensure control over changes to procedures);
Training 364-82-043 821028 Cont. Operations 100 Operator, Management / Administration Procedure Changes Farley 2 Spray Non- (Valve position (Valve position licensed verification) verification '
i required) 369-81-180 811112 Cont. Operations 48 Construction Management / Administration Label Corrected McGuire 1 Vent. (Labelino) 369-81-185 811118 RHR Maintenance 0 Operator, Management / Administration Counseling McGuire 1 (Mod) Licensed (Control of construction pers.nnnel) 0
9 B-10 TABLE B-1 (Continued) -
i
- LER # Event Plant Date System Activity % Power Person Cause/ Contributing Factors Corrective Actions T
369-8?-017 820212 ECCS Operations 50 Construction Management / Administration Fitting replaced McGuire 1 (UHI) (Fitting installed and correctly incorrectly) installed ,
]
369-82-024 820302 RHR Maintenance 0 Operator, Personnel error (Incorrect RC water level McGuire 1 Non- operator of equipment) indication system licensed design changed 369-82-030 820423 CVCS Testing
- 50 Operator, Management / Administration Procedure Changes McGuire 1 Non- (Design change (to improve control licensed implementation program) over plant '
modifications) 369-83-017 830405 RHR Refueling 0 N/A Defective Procedure Procedure Changes McGuire 1 369-83-084 830929 Cont.- Maintenance 100 Opera tor, Planning (Failure to Procedure Changes McGuire 1 Spray Licensed recognize system (technical specifi-dependency) cations had not addressed the CS
. system dependency on the Nuclear Service Water System for operability)
A 370-83-092 831231 RHR Maintenance O N/A Defective Procedure Procedure Changes McGuire 2
B-11 TABLE B-1 (Continued) .
LER # Event Plant Date System Activity % Power Person Cause/ Contributing Factors Corrective Actions 370-84-001 840109 RPR Maintenance O N/A Defective Procedure Procedure Changes McGuire 2 (regarding RCS level to be maintained during RHR operation);
Design Changes 370-84-002 840115 RHR Maintenance 0 N/A Procedure Procedure Changes; McGuire 2 Counseling 370-84-004 840115 CVCS Operations 0 Operator, Personnel error Counseling (emphasis McGuire 2 Licensed '(Incorrect operation on verification of of equipment) flow paths and the proper response to alarms)
E
B-12 TABLE B-2 LOSSES OF SAFETY SYSTEM FUNCTION INVOLVING HUMAN ERROR BOILING WATER REACTOR EVENTS LER # Event Plant Date System Art:*Ity % Power Person Cause/ Contributing Factors Corrective Actions 155-81-022 810917 RDS Maintenance 80 Operator, Personnel Error Labeling Big Rock Pt Non- (Misidentification)/
licensed Labeling s i 219-82-031 820614 CRD Maintenance 82 Operator, Inadequate planning Procedure Changes Oyster Creek pumps Licensed (Failure to recognize Training dependency between systems)
P37-81-030 810526 HPCI Maintenance 44 Maintenance Management / Administration Procedure Changes Dresden 2 Mechanical (to include veri-I' , fication of correct disc installation) 254-81-024 811209 Cont. Maintenance 98 Operator, Personnel error. Training
-Quad (Sec) Non- (Failure to perform task Cities I licensed correctly (use procedure .
i to maintain containment integrity))
i 277-83-006 830323 Cont. Testing,. (*) Technician, Personnel Error Counseling '
Peach (Pri) IAC ,
3 Bottom 2 i
278-83-008 810211 Cont. Modificaton 100 N/A Procedure Procedure, ,
4 Peach (Prf) Labeling Bottom 2
(
- At power, level not reported.
~
B-13 Table B-2 (Continued) -
LER f Event Plant Date System Activity % Power Person Cause/ Contributing Factors Corrective Actions 278-84-007 840602 HPCI A Operations 0 Operator, Personnel error Counseling Prach RCIC Licensed (Failure'to follow TS)
Bottom 3 l
t 293-81-064 811211 RHR Refueling 0 Operator, Management / Administration Procedure (Control Pilgrim 1 -
Licensed (Shift turnover and Room Administrator) control room activity) 293-83-048 830929 HPCI Testing 96 CP0 Personnel error Procedure Pilgrim (and IAC (Miscommunication because (instructions Technician) of inadequate instructions for verbal for verbal comunication) communications);
Counseling 298-81-017 810613 RCIC Maintenance O Maintenance, Personnel' error Electrical .
Cooper Electrica1 (Failure to perform task maintenance
.felectrical wiring] personnel informed correctly) of event l 298-84-007 840414 SBGT Modification 70 Bulldozer Management / Administration N.R. "'
Cooper Operator (Inadequate control of
- contractor employees)/ '
i ' Personnel error (Incorrect j restoration of pressure) 324-83-069 830825 RHR Operations 100 . Maintenance Management / Administration Procedure Changes Brunswick 2 (Inadequate preventive (Preventive maintenance program) maintenance) i j ,
B-14 TABLE B-2 (Cotitinued)
LER # Event Plant Date System Activity % Power Person Cause/ Contributing Factors Corrective Actions 325-81-031 810220 RCIC Operations 97 Operator, Personnel error Counseling Brunswick 1 Non- (Failure to recognize licensed potential problem with tripping RCIC turbine) 333-84-003 840207 RCIC Maintenance 100 Technicians, Personnel error Labeling; Fitzpatrick I&C (M,isidentification; Training.
wrong system) 333-84-004 840210 HPCI & Operations 100 N/A Defective procedure Procedure Changes .
Fitzpatrick RCIC 366-82-095 820817 RHR Maintenance 99 Operator, Personnel error Counseling, Hatch 2 Non- (Misidentification)/ Labeling, licensed Labeling Design 387-83-026 830301 SGTS Maintenance 100 Operator. . Planning / Procedure Training
'Susquehanna 1 Non-licensed 387-83-033 830310 Cont. Modification 0 Construction Management / Administration Procedure Changes Susquehanna 1 (Sec) (Inadequate program for unit separation)/
Inadequate tagging
~
387-83-044 830311 HPCI Testing 0 Technician, Personnel error Counseling Susquehanna 1 IltC (Performed task incorrectly; wrong test connections)
l B-15 TABLE B-2 (Continued)
LER # Event Plant Date System Activity % Power Person Cause/ Contributing Factors Corrective Actions 416-83-069 830523 RHR Operations O Maintenance, Personnel error N.R. (action to Grand Gulf 1 (CSD) Electrical (Procedure not completed) prevent recurrence was not reported)
Technician,' Personnel error
~
416-84-004 840114 RHR Maintenance 0 Counseling
- Grand Gulf 1 I&C (Failure to perform procedure correctly) i 416-84-008 840202 HPCS Operations 0 N/A Defective Procedure Procedure Changes l
Grand Gulf 1 416-84-013 840322 RHR Testing 0 Technician Personnel error Counseling Grand Gulf 1 (Failure to verify reset of trip) j .
e 6
k i
e
C-1 APPENDIX C-1 LOSSES OF SAFETY SYSTEM FUNCTION INVOLVING HUMAN ERROR Descriptions of PWR Events
- LER #
Plant Event Date Description / Notes 247-83-043 831129 AC#84-1, IEN#84-39 Indian Pt 2 -- Isolation of containment spray.
-- When returning from non-scheduled maintenance, valves (2) were not opened or verified opened.
-- 43 days (October 18-November 30,1983). '
Training " Improvements made to place new emphasis on equipment status verification."
-- Identified during bimonthly containment spray pump surveillance test.
250-83-007 850419 A0#83-4 ,
Turkey Pt 3 While operating at 100% power, a Nuclear Turbine Operator (NTO) discovered that all steam supply lines to unit 3 auxiliary feedwater pumps B and C were closed. Auxiliary feedwater pump A was out of service. All auxiliary feedwater pumps had been ;
inoperable from April 14, 1983 to April 19, 1983 (5 days).
Evidence indicated that the NTO had closed isolation valves in the steam supply lines rather than valves -
fn the redundant steam supply lines. The verification signoff for the NTO's action was not understood or performed. Numerous system alignment checks over next five days missed identifying the incorrect alignment. .
TMs was significant, not only because of the misalignment error but also because the independent verification was not understood or perfonned and because AFW alignment checks on all shifts for the next five days did not identify the error.
- Independent verification of the rehanging of the tags, which may have detected the operator error, i was not performed because the requirement was not completely understood by the personnel. The licensee had impleminted independent verification for tagging operations but left it ambiguous regarding the
- Events are in order of increasing Docket /LER number.
e
,,, ._..r._ _ _ _ - ,
_y - - - - - _ , , , , . . , , ..m, . . . . _ , , - .,,--._m
, O I C-2 APPENDIX C-1 (Continued) ,
Plant Event Date Description / Notes 250-83-007 830419 (Continued)
Turkey Pt 3 need for independent. verification during temporary lifts of-tags for testing and restoration. The twice ,
per shift NTO AFW system checks were not properly '
detailed in instructions. As part of actions taken.to l'
prevent recurrence, the licensee issued instructions .
to operators emphasizing the need for independent '
verification and revised the NTO log sheets to improve detail and clarity.
251-81-015 811128 A0#82-2, NSAC/52, Precursor, AEOD/C401 Turkey Pt 4 When beginning plant heatup, two overpressure condi-tions developed for which the overprab ure monitoring system (Oii$) failed to operate. A presure transient caused automatic closure of the RHR system suction isolation valves and the OMS failed tc operate because 4
one train was inoperable for maintenance and the 1 other was not correctly aligned (the root valve to the pressure transmitter had been isolated during a previous hydrostatic test). The following day the second overp.ressurization event occurred because of
, a failed summator in the OMS actuation circuitry.
l The failed summator had not been detected because of a defective surveillance procedure. Surveillance procedure changes were made to prevent recurrence. 1 i .
251-83-016 831004 Referred to in A0#84-1.
Turkey Pt 4 On October 4, 1983, a manual isolation valve on the discharge side of each of the redundant containment spray pumps for unit 4 was found in the locked closed position. Unit 4 was operating at power and unit 3 was proceeding from hot to cold shutdown for a 1
refueling outage.
In the process of proceeding from hot to cold shutdown for unit 3, an operator was dispatched on October 2 to lock out several valves as required by procedures.
Included in the list of valves were manual valves (891A&8) on the discharge side of unit 3 redundant containment spray pumps. The operator closed and 4
locked the valves on the discharge side of the unit 4 containment spray pumps, but did not initial the tagout sheet, as required. (He did not have the
, tagout sheet with him.) Subsequent to this action,
, the operator was isolating a sample line and was i exposed to contaminated mist from a leak. The operator was relieved to receive medical attention.
I i
j i l
-l k
C-3 ]
j !
APPENDIX C-1 (Continued) [
i Plant -
Event Date Description / Notes l
[
k 251-83-016 831004 (Continued) j Turkey Pt 4 His replacement proceeded to'the correct valves on ,
unit 3 and noted they were open. He closed, locked j and tagged the valves in accordance with procedures !
and was apparently unaware that tha . valves on.the i unit 4 discharge lines were in the closed position.
I On October 4,1983, the licensee's technical . staff
- were performing monthly periodic tests of the. unit 4 i
{
' containment spray pumps and noted that the discharge !
valves were in the closed position. Containment spray l was unavailable for over 28 hcurs. !
t
- ' It is important to note that the operator was )
considered experienced and competent and had a good ;
operating record. In fact, the operator claimed I responsibility when the condition was discovered.
(Otherwise the cause would have been " unknown.")
g The operator had just begun work on the Sunday l dayshift and went to the wrong set of valves 891 l A and B and cle' sed, locked and tagged them. -The !
, operator did not bring the tagout sheet along and was l unable to sign that he believed he had closed valves -
on unit 3. - -
This error was not caught, because there was no !
, documentation that the operator closed the (what r
- he believed to be) unit 3 valves. The licensee now ,
l strictly enforces a requirement to bring the tagout i sheet to the job site and immediately initial when an !
action has been taken. 1, As a result of this event the licensee color-coded the i
- locks (using red and green fluorescent spray pair.t to
help distinguish between units. In addition, different keys were to be used for the locks of the j different units. /
=
- - 255-81-001 810106 A0#81-1; Precursor; IEN#81-05 i Palisades --
While performing monthly surveillarn tests on both station batteries, breakers s.o 125V DC buses were left open for approximately one i hour, i --
The two electricians failed to follow the. test )'
procedure. (Real Puzzle - They had procedure _
(and procedure was adequate), had performed test ;
previously, and had been briefed by supervisor.) ,
s n
w , a y--eew e e v-..a =,-e. ,,-we ev+,-r e wma-,e -- g,----sy.e y e-+=-- %e,w--,v=e -- ,
C-4 APPENDIX C-1 (Continued)
Plant Event Date Description / Notes 255-81-001 810106 (Continued)
Palisades --
Added verification by a second qualified individual for work in safety-related areas.
Additional training added.
Review to be made of adding CR indication to show battery circuit operability.
261-81-003 810114 Both channels of heat tracing for both boric acid Robinson 2 transfer pumps were unintentionally deenergized during maintenance on one of the pumps. The procedure for deenergizing the heat tracing for the pump ambiguously specified "open" circuit E-1. However, opening the circuit supply breakers deenergized the heat tracing for both pumps since the circuits were supplied from the same breaker. The procedure was changed to ,
specify " fuses removed" to deenergize circuit E-1.
269-82-008 820313 EA#82 : Oconee 1 --
July 1981 to March 1982.
l --
Reactor building pressure switch was not properly returned to service upon completion of calibration testing (the test tee was not capped).
The particular procedure was changed to add a step signoff and an independent verification for cap removal and replacement.
Additional (independent) verification requirements were added to all instrumentation and electrical procedures. In addition, procedures are now reviewed by shif t supervisors (to check that they are clear).
269-82-012 820623 Both trains of reactor building spray (RBS) were Oconee 1 inoperable due to the '8' train RBS pump being out of service while the 'A' train RBS pump suction valve was shut.
Although the technical specification may not have been entirely clear, the problem resulted because the Assistant Shift Supervisor failed to consider consequences of the RBS lineup for testing.(lack of planning).
. l C-5 APPENDIX C-1 (Continued)
Plant' Event Date -
Description / Notes 272-83-011 830222 A0#83-3, ATWS.
Salem 1 -- Reactor trip breakers failed to open in response to trip signal.
-- 272-83-011 for February 22, 1983 event and 272-83-012 for February 25, 1983 event.
Corrective Actions: Training and procedure on RT8.
6 282-82-015 820827 With D1 D/G out for preventive maintenance, Prairie Island operability test of D2 was done, but D2 was not returned to service correctly after test.
-(Personnel trror; failure to perfnrm procedure.)
252-84-003 840314 In the process of tagging out Instrument Inverter B Ft Calhoun for maintenance, a switching error was made.
Maintenance Procedure MP-EE-9 for Instrument Inverter Maintenance was being used. The procedure called for opening the de feeder breaker to the inverter but instead the operator opened a breaker which supplies -
de power to Control Room Panel Al-419. As a result, two reportable even.ts occurred. The first event was that both channels of Steam Generator Low Signal (SGLS) which is an Engineered Safety Feature, unblocked and tripped. The second event was that the Component Cooling Water (CCW) system which is a safety system became inoperable. Several CCW valves failed open on loss of de power. The increased flow demand in the system caused a drop in CCW system pressure. When the CCW system dropped below 60 psig, the raw water back-up valves to several components normally cooled by CCW opened. When the Raw Water back-up valves opened the head pressure in the CCW system caused a CCW inventory loss through the back-up valves to the extent that the running CCW pump began cavitating and had to be secured.
Approximately two minutes after the event occurred, the operator realized his mistake and reclosed the '
breaker restoring de power to the distribution panel in the control room. The control room operators then -
. closed the raw water back-up valves that had opened.
Refilling of the CCW system was started. Approximately one-hour later the CCW system inventory was restored and the system was returned to service. !
5 0
n- . - - - . , , ., . , . . - , ,,
C-6 o
APPENDIX C-1 (Continued)
Plant ' Event Date Description / Notes 285-84-003 840314 (Continued)
Ft Calhoun The approved procedure which was being used was correctly written. The error was made when the wrong breaker on the panel was opened. The error was made by a licensed reactor operator (R0 license).
302-81-027 810508 During performance of SP-187, Auxiliary Building Crystal River 3 Exhaust Ventilation System Testing, it was discovered that on May 5,1981, three of four Auxiliary Building filter' systems were rendered inoperable by removal of cells for replacing charcoal canisters used for surveillance. Each system should have been
-determined operable prior to proceeding to perform maintenance on the next system. All three systens failed the flow bypass test. At 1600 it was recognized that Technical Specification requirements had been exceeded and plant shutdown was initiated as required by Technical Specification 3.0.3. The reactor was tripped at 1654 to comply with the
! one-hour shutdown requirement. At 1800 on May 9, 1981, operability had been restored to three filter systems and the cooldown was secured. Full operability was restored at 2219 on May 9, 1981.
The event occurred because the controlling procedures did not adequately reflect TS requirements. The
- procedures were reviewed and revised as necessary.
302-84-012 840615 While in steady state operation at 99% reactor power, Crystal River 3 contract workers were moving materials into the ventilation area of the Auxiliary Building 143' elevation for a plant modification. At 1436, while carrying a large support structure into the ventilation area, an instrument air supply line was inadvertently struck by the support structure, thus rupturing the instrument air line. The instrument air line supplied air to the suction and discharge dampers (VP, DMP) for. AHF-14A,B C and D (VF, FAN).
These. dampers closed when supply air was lost.
Control Room operators were not automatically alerted to the event until notified by a technician working in the area of the air line rupture. A flow switch (VF,FS) AH-31-DPS, should have closed to cause an alarm. When the dampers closed, it was suspected the dampers did not fully close allowing some continued air flow. Upon notification the control room operator l
C-7 APPENDIX C-1 (Continued) i Plant Event Date Description / Notes i
I
! 302-84-012' 840615 (Continued) .
! Crystal River 3 promptly secured the operating pair of exhaust fans' ,
to prevent fan damage. The supply fans to the I auxiliary building were tripped by an interlock when -
the exhaust fans were secured.- All doors'(NF,DR) ;
into the aux;11ary building were closed. ,
! . The ruptured instrument air supply line was repaired ;
at 1520 and fans AHF-14A and C were restarted.
{ Approximately 40 minutes elapsed from the time the j
.. exhaust fans were secured until they were returned to
~
service. ,
305-81-033 811016 Improper removal from-service (. condition existed Kewaunee 50 minutes). Emergency diesel generator (EDG) IB was ;
4 removed from service for maintenance. However, i service water to the 1A CCWHX was later isolated and '
! the supply MOV. breaker opened, i.e., both trains of cooling via the CCWHX's.were made unavailable. -
!i
! 3015-82-030 821004 IEN#83-23; EAf83-17; AEOD/T313.
, Kewaunee --
Six containment pressure transmitter sensing l l lines capped rendering all containment pressure ,
i transmitters and vacuum breakers inoperative for
! months. Therefore, automatic actuation of '
- containment spray and containment isolation would '
not have been possible during this time period. - t Also, with containment pressure indication i disabled the operator may have taken an incorrect- !
4 action in response to an accident (e.g., LOCA). r The six lines were identical to vent and drain t lines that were required .to be capped. However, >
the pressure sensing lines were not labeled to make clear they must remain open, ,
309-81-008 810610 NSAC/52 t l
RHR cooling interrupted for five minutes when.
Maine Yankee --
2 RH-M-2 (outboard stop valve) closed. While- '
I pulling cables behind the main control panel,
! . contractor electrician displaced the connector
- on the flow controller for RH-M-2. f l -
A warning was given to contractor employees.
i 'l
! i
i C-8 APPENDIX C-1 (Continued)
LER #
Plant Event Date Description / Notes 311-83-066 831220 On December 20, 1983, during a maintenance shutdown, i Salem 2 2RH1 (suction isolation) closed, resulting in a loss i of RHR flow. The event took place during the transfer L of 2B4KV vital bus fr.om one station power transformer to the other while 'the backup power supply for 2B '
instrument inverter was deenergized for maintenance.
-The transfer resulted in a momentary loss of the i
instrument bus and 2RH1 closed on interlock. When 2RH1 closed, the operator secured 22 RHR pump. The cause was determined,'and 2RH1 was reopened. The 22
! RHR pump was started, and RHR flow was reestablished i within 22 minutes of the start of the occurrence. A '
i newsletter item was issued to inform all Operations
{ Department personnel of the incident.
i 1 . :
i 311-84-002 840209 RHR common suction valve 2RH1 shut while testing was i Salem 2 being performed of the pressurizer overpressure
! protection system (17-minute loss of DHR flow).
The breakers for the RHR common suction valves were
- required to be opened and tagged, in accordance with i
^
the POPS testing procedure, to prevent 2RH1 or 2RH2
~
! from closing during the testing process. The controls for these valves, on the control room console, i contained red bezel covers, which indicated that the j valves already contained Shift Supervisor _ tags for a j previous job. Since the tags are not required for {
. personnel safety, the POPS testing was authorized with :
the use of the existing tags. Unknown to the Shift Supervisor, the tags had been temporarily released, ;
and the bezel covers had not been removed to reflect !
the release. Upon testing, 2RH1 closed upon a control signal from the RCS wide range pressure transmitter. 2 i
A system was to be established for updating the status ;
of control room console bezel covers, whenever tagging ;
releases or requests are initiated, j l
i r i i 315-83-009 830201 During a routine plant tour at 0915 hours0.0106 days <br />0.254 hours <br />0.00151 weeks <br />3.481575e-4 months <br /> on ;
i D.C. Cook 1 February 1, 1983, an operator found the spray additive ;
- tank outlet valve sealed in the closed position. With j the valve closed, the NaOH would not have been added l to the containment spray system in the event of an !
accident. The valve was in the closed position for 7 !
l hours. ,
! [
i f I
L . _ _ _ _ _ _ __ _ ._ _ _ _ _ _ _ . _ ~ _ _ _ _ _~.,_.
. - . . .- . - . - . _ _. . -= __.- .. . . . _ . . -
C-9 ,
1 APPENDIX C-1 (Continued)
LEP. #
j Plant Event Date Description / Notes i.
315-83-009 830201 (Continued)
D.C. Cook 1 The surveillance test procedure (STP) for the system had been completed at 0203 on February 1,1983.
During the STP, the valve was required to be closed.
After the test was completed, the valve was to have -
been reopened and sealed and the seal number recorded.
The valve lineup was also to have been completed and
. verified by another operator.
TiieAuxiliaryEquipmentOperator(AEO)whoperformed the test and did the initial signoff had started to )
open the valve when the rest of the system's valve i i seals fell out of his pocket. He picked up the seals t 4
and put one on the valve without further opening the '
valve. l The Reactor Operator (RO) who verified the val"a I l lineup looked at the unit 2 valve and saw it was open
- but the seal number was not right (both unit's tank's
, are in.the same room). He then realized his mistake ;
j and checked the seal number on the right valve, saw j 4
the numbers matched, and signed it off without !
l checking that the valve was open. l Surveillance was being done on the morning / graveyard f
, shift to prepare for the dayshift (a need to complete ;
i the surveillance). .The auxiliary operator was.having i.
difficulty opening the valve because he was in an !
! awkward position and because the valve had been closed i with excessive force. When the valve opened, he lost l l his balance and became further distracted when valve i.
- seals fell from his pocket. He did not then check ;
i that the valve was fully open before applying the j seal. The second operator who was responsible for j independent verification was also distracted because ;
j he first went to the wrong unit and when he got to the.
correct unit he actually verified that the valve was
- sealed rather than opened. .
! In this case, the licensee's system for independent ;
i verification was adequate. Furthermore, it was understood by the second operator. The errors resulted primarily because the operators were working :
under stressful conditions. Because of the high t workload that they planned to accomplish, the ,
operators became frustrated and then distracted when j they encountered minor problems. -
1 i
t 3 _
-..._,.c . - . - . - - . ~ . . . _ , , . . , . :,,,,.,.. --,,,,,,...w- ~ . . , ,.y~, _ ,- - - - , ,,e - _ . , . - . ~
C-10 APPENDIX C-1 (Continued)
LER # .
Plant Event Date Description / Notes 315-83-009 830201 (Continued) .,
D.C. Cook 1 The licensee started a practice of performing more of the heavy surveillance during the afternoon of the dayshift to alleviate the crisis atmosphere that had
. been more common during early morning surveillance testing.
316-83-048 830603 A scheduled test on the containment spray system was D.C. Cook 2 being performed when. operators inadvertently closed and did not reopen a manual isolation valve on the heat exchanger of the train not under test rendering both trains inoperable. (A surveillance test condition required the containment spray.HX inlet and outlet valves to be closed during test to prevent the inadvertent spraying of containment.)
Appropriate administrative action was taken with the individuals involved.
The heat exchanger inlet valves were located near -
each other and were operated with reach rods. The initial " double" verification failed to det'ect the error. The error was detected by the person who was providing a " third party verification" (in this case it was a supervisor). This third party verification was actually an independent verification.
~
316-84-014 840521 CR0s started RHR pump in preparation for taking the D.C. Cook 2 other out of service. The resulting high flow at half loop conditions caused air binding of the pumps.
Procedure was revised to clarify instructions to stop the operating pump prior to starting the second pump while at half loop.
e 317-83-019 830426 During mode 5 operation at 2014 while raising RCS Calvert Cliffs 1 pressure, a power operated relief valve (PORV), i ERV-404 opened. It was immediately isolated by shutting its upstream isolation valve (Tech Spec 3.4.9.3). While troubleshooting the problem with ERV-404 at 2150, a short circuit caased a loss of l
control power to ERV-402, rendering it inoperable. '
t (At this point the normal means of automatic initiation of low temperature overpressurization l protection system was unavailable.) Control power i
C-11 APPENDIX C-1 (Continued)
LER #
Plant Event Date Description / Notes i 317-83-019 830426 (Continued) ,
l Calvert Cliffs I was restored to ERV-402 by 2207. RCS pressure was-lowered to below the reset point, and ERV-404 unisolated by 2230. Similar events: None. The cause of the actuation of ERV-404 was a failure of the control room operator to monitor RCS pressure .
carefully enough. The short circuit in the ERV-402 4
control circuitry was due to technician error.
Personnel involved in this event were counselled, i All operators and. instrument maintenance technicians-
! were informed of the details of this event.
317-83-028 830524 EA#83-58; IEN#83-56.
Calvert Cliffs 1 During normal power operation at 1615, discovered that both ECCS pump room air coolers were out of service from'about.1900 on May 24, 1983 to 1715 on May 25, 1983. With No. 12 cooler out of service for main-tenance, the salt water inlet valve to No. 11 cooler
, was shut to facilitate draining the. salt water piping
- on No. 12 cooler. -
Without this room cooling, both trains of the ECCS and the containment spray system (CSS) were considered inoperable in that required auxiliary equipment, specifically the pump room air coolers, was out of j service. This occurred primarily because operators
- did not recognize that the coolers provided a 1
necessary support function for the ECCS and CSS. !
! Consequently, an operator shut the inlet valve to the- l l
operating cooler while maintenance was being performed ,
on the other cooler. A causative factor in this ,
l incident was that the procedures used to perform .
l the maintenance activity on the coolers were not !
! sufficiently detailed. As a result, one cooler was .
! . drained into the redundant cooler by means of a
! temporary hose connection without a formal and l systematic evaluation of the safety implications. ,
317-83-061 831012 Inadvertent isolation of shutdown cooling was caused i Calvert Cliffs 1 '
by failure to deactivate RCS pressure sensing instru- .
i mentation prior to perfoming a hydro test on instru-- !
ment sensing lines. Procedure changes would require a f review of transmitter electrical process functions :
. prior to pressure testing. '
{
O 9 C-12 I
APPENDIX C-1 (Continued) t LER #
Plant Event Date Description / Notes ,
318-81-004 810204 NSAC/52. Loss of shutdown cooling because a vital i Calvert Cliffs 2 . ac bus was " inadvertently" deenergized causing a shutdown cooling return header valve to shut.
Preventive maintenance procedures for vital ac inverters and backup bus components were revised to include the required power source lineup necessary ;
for the maintenance.
318-82-053 821122 SDC flow was lost when return valve, 2-51-652, shut Calvert Cliffs 2 when the instrument power supply panel was deenergized due to an incorrectly installed temporary jumper. ,
The technician assigned to determine the electrical i lineup required failed to clarify the exact power supply being deenergized. This resulted in incorrect i temporary jumper location. Also, the technician did :
not clearly. describe the power supply on the lineup document. The technician was reinstructed on the ;
requirements related to temporary lineups.
318-82-055 821228 A vital ac inverter failed causing a 120V ac vital bus l Calvert Cliffs 2 to deenergize closing shutdown cooling return [
isolation valve, rendering both shutdown loops inoperable. The initial investigation of the event found that use of an improper fuse had caused the event. However, further investigation found the original fuse coordination scheme was not well
., designed. In addition, problems were experienced with ;
the current limiters that fed the inverters.
Corrective action included modifying the fuse coordination scheme and removing the current limiters. ,
i 318-83-001 830104 Same problem as described in 318-82-055.
Calvert Cliffs 2 i~
318-83-005 830107 Because of a test procedure deficiency (lack of Calvert Cliffs 2 caution statement) the operating DHR pump stopped due to test of recirculation actuation signal.
I C-13 APPENDIX C-1 (Continued)
LER #
Plant Event Date ' Description / Notes w
318-84-005 840426 With the plant in mode 6, an electrical lineup was Calvert Cliffs 2 performed to-allow preventive maintenance on a 24A 480V ac bus. This lineup powered 21 diesel generator *
(DG) auxiliaries from a bus receiving its backup power from 12 DG, thereby causing a less of independence between 21 and 12 DGs. Although 21 DG was considered inoperable at this point, that fact was not conveyed to personnel on subsequent shi(ts. Since only one DG is required operable in mode 6, no technical specifi-cation action statements were entered and hence no log entry to the effect that 21 DG was inoperable was .
made. The following shift, not realizing the lack of independence, removed 12 DG from service, which resulted in inoperability of both DGs.
To prevent a recurrence of a similar event the following corrective actions were to be taken: (1) A list of equipment required to maintain DG operability wou?d be, prepared for each DG. When a condition arose that required a DG to be placed out of service, these lists would be used as an operator aid for verifying the operability of the redundant DG. The lists include both mechanical and electrical systems, that are required to maintain DG operability; (2) All licensed operators would receive training during the annual requalification cycle on the conditions surrounding this event. Particular emphasis would be given to the role electrical distribution plays in supporting DG operability.
327-81-032 810325 With the unit in mode 1 at 98% RTP, at 0436(c), the Sequoyah 1 2B-B diesel generator was removed from service for inspection to fulfill a surveillance requirement. At 1325(c), the ABGTS 'A' train was removed from service to reroute an air line for FC0 30-146B. On March 25, 1981 at 0030(c), it was determined the operability requirements for ABGTS could not be met with both the 28-B diesel generator and the ABGTS 'A' train
< inoperable. This resulted in both the ABGTS trains being inoperable. This error was the result of mis-interpretation of LCO 3.0.5 by the assistant shift engineer. The ABGTS 'A' train was returned to service at 0125(c) within the one-hour time limit of LCO 3.0.5. The requirements of LCO 3.0.5 were discussed with all shift engineers, assistant shift engineers, unit operators, and shift technical advisors.
l
C-14 APPENDIX C-1 (Continued)
LER #
Plant Event Date ' Description / Notes 327-82-116 820916 The W supplied proceduit did not adequately describe ,
Sequoyah 1 precautions that should be taken when cutting off i power to the output relays of the SSPS, train 'B'.
When the power fuses were pulled, the train 'B' RHR
, suction valve closed, rendering both trains of the RHR system inoperable.
327-83-112 830911 IEN#84-37. Manual reactor trip channel test procedure Sequoyah I was incorrect in that it allowed for the disabling of both trains of the SSPS (Solid State Protection System) automatic trip logic during testing. This could have prevented an automatic reactor trip in the event of uncontrolled rod withdrawal with the reactor subcritical.
The procedure instructed the instrument mechanics to install a jumper in both trains of the SSPS cabinets from the energized 48V bus bar to the UV coil rela's. y This was done to ensure that the reactor trip breakers tripped from the trip (shunt) coil instead of the UV coil, thus independently testing this trip mechanism as recommended by I&E Circular 81-12 dated July 22, 1981. The installed jumpers caused the UV coil to remain energized, preventing any automatic trip actuation.
Further investigation into the history cf the procedure shows that in March 1980 the procedure was revised from RO to R1 which added the jumpers to allow for independent testing of the shunt coil. The error in the procedure was undetected in the review l process and in the subsequent performance of the test i
for three years. The test was performed during startup prior to going critical. At no time during i
this period did the testing exceed one hour.
l To prevent recurrence the procedure was revised to open the MG set load breakers to ensure that the rods were deenergized prior to closing the reactor trip breakers.
' (Note: The " shunt trip modification" due to be completed during an outage beginning August 1985 would result in trips from the shunt coil or the UV coil and would eliminate the need for jumpering during the test.)
l t
l
.. . . ~-
I C-15 APPENDIX C-1 (Continued) t'
'LER #
l Plant Event Date Description / Notes 1
1 334-81-047 810606 A0#P'-3; Precursor; E201. ,
j- Beaver Valley 1 Manus dy operated suction isolation valve in the ECCS
- was found closed rather than locked.open. Loss of I
high-head safety injection capability because water from the RWST would not have been available auto-
, matically to the three HHSI pumps for injection into the core under emergency conditions.- NRC investi-gation identified two. generic procedural concerns that may have contributed: (1) procedures did not ;
, ensure timely withdrawal of access authorization of {
personnel being terminated under adverse circum- !
- stances, and (2) criteria for. authorizing unescorted ,
j access to vital areas were not sufficiently selective. [
I l 335-83-021 830329 The shutdown cooling hot leg suction valves closed - !
- St Lucie I when construction personnel shorted ou.t the power ,
1 supply to one of the control grade pressure indicator.
t control circuits which gave a close signal to the '
valves. , Action to prevent. recurrence was not [
- reported. -
t 1 ,
! i
! 336-81-001 810102 Precursor; PRE V.3 #3; C104. -
l
! Millstone 2 Reactor trip occurred when the main de breaker was !
! (Inspection opened (subsequent events include loss of PP instru- l 1 ReportNo.) mentation). Operator opened breaker instead of ;
j rotating the ground detector switch. Although both the mistaken ground detector and breaker switches are i located on.the face of the switchgear-cabinet:and are .
adjacent to each other, the switch handles are of' '
different styles and the breaker control switch is !
covered with a plastic cover plate. It was considered )
3 that any additional physical protection of the breaker. !
! control switch would interfere with.the possible !
i requirements for rapid manual operation of the- i i breakar; however, licensee upgraded the switchgear ;
j component labels.
{
l 336-81-043 811209 NSAC/52; Trip signal deactivated LPSI. !
l '
Millstone 2 Heatup and cooldown limits (TS) were exceeded (Mode 5- i to Mode 4) for two minutes. LPSI pump tripped due to .- !
turbine generator circuitry activated by switchyard i breaker testing. Intermediate corrective actions .
- included changes to the operations procedure to bypass i that trip circuit when the LPSI pump was used for SDC.
j Final action to prevent recurrence was installation of !
an annunciator to signal a LPCI pump trip. i i ;
C-16 APPENDIX C-1 (Continued)
LER #
Plant Event Date Description / Notes 338-82-067 821019 With vessel drained to centerline of hot leg nozzles, North Anna 1 821020 RHR suction was lost on both trains because of ambiguous le' vel indication (10/19, 36 min. loss; 10/20,33 min. loss). No action to prevent recurrence was reported.
338-82-082 821206 The automatic safety injection block was not reset North Anna 1 following an inadvertent safety injection on December 5, 1982. This condition was recognized 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> and 30 minutes later. Licensee revised emergency procedures concerning securing a safety injection. A step was added to cycle the reactor trip breaker to reset the automatic safety injection block.
4 339-82-022 820528 Both trains of the North Anna 2 Quench Spray Subsystem' North Anna 2 and the Recirculation Spray Systems wers inoperable for 17 minutes because jumpers had been instal?ed in'the Train A instead of the Train B Solid State Protection '
0utput Cabinet, and double verification did not detect ..
the error, i The engineer and electrician involved each had approximately one year of experience. However, the electrician was just carrying out the instructions.
from the engineer. The engineer had expected 'te work on Train A and had that on his mind when he was sent to work on Train B. They went to the Train A '
cabinet. Even though he had the correct procedure, j component markings in the, Train A.c'abinet were the same as those in the Train B cabinet. LThe LER stated that color coding of the solid state protection cabinets was "being considered as a prevention against -
personnel entering the wrong train," hcwever, although the licensee's electrical engineering staff had recommended color coding of the cabinets, this was ,
never done.
Note: According to records kept by the engine'er, he had worked 13-hour backshifts on four consecutive days prior to this event. However, he felt that this had no influence on his. performance.
9 L
l
.Q . 9 C-17 APPENDIX C-1 (Continued)
LER #
Plant Event Date Description / Notes 339-82-026 820520 On May 20, 1982, with unit ? in mode 5, the suction
- North Anna 2 to the residual heat removal system (RHR) pumps from the reactor coolant system (RCS) was lost on three occasions; once for 8 minutes, once for 26 minutes, and once for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. . In each case the RHR pumps were not deenergized for <1 hour and no dilution of the RCS occurred.
The primary cause for each of the above mentioned events was unreliable primary level indications while draining the RCS. The higher than normal indications in the primary level hose were occurring because the level hose was connected to the aerated primary vent system. This system operated at a slight vacuum as it was evacuated through the gaseous waste system to the release point. Such a situation resulted in a higher than actual level being indicated in the primary level hose.
x The immediate action was to start a charging pump and to refill the RCS from the refueling water storage tank. Subsequent to reffiling the RCS, a RHR pump, was placed in service and RHR flow was restored.
A procedure change to 0P-11.3, Aerated Primary Vent
. System (VA), to connect the primary level hose to the pressurizer vapor space, rather than to the- VA header, was initiated to eliminate the AP problems that were occurring between the RCS and the primary level hose and causipg unreliable primary level indications.
Unreliable primary level indication was the cause of a subsequent, similar event on July 30, 1982. In that event, RCS level gradually dropped because of a mechanical seal leak on the "A" RHR pump, until both RHR pumps had inadequate suction and became air bound.
. (LER #339-82-049)
N 336-83-038 830503 With unit 2 in mode 6, suction to the 'B' residual North Anna 2 heat removal (RHR) pump was lost while transferring water from the reactor coolant system (RCS) to the refueling water . storage tank (RWST) via the refueling
(
purification (RP) system.
s i
\ -
C-18 APPENDIX C-1 (Continued)
LER #
Plant ,
Event Date Description / Notes 336-83-038 830503 (Continued)
- North Anna 2 Suction to the RHR pump was lost because the RCS was pumped below the established operating limit. Pumping i of the RCS continued without adequate monitoring of the RCS level. The RCS was refilled and RHR pump suction restored. .The responsible senior operator was reinstructed.
.344-81-012 810626 NSAC/52. During RCS level reduction the RHR pump
. Trojan began cavitating and was stopped to prevent pump
' damage. Investigation found the RCS level stand ,
pipe to be indicating erroneously due to inadequate j venting of the PZR. The RCS was vented, the level was '
restored and the pump was restarted in about 75 i minutes. (Cause was inadequate venting of the PZR and corrective action was review of procedures and review of importance with operating personnel.) ;
-i ;
344-82-015 '820820 Plant' entered mode 4 and then mode 3 on August 18, Trojan ' 1982 with'both trains _ of automatic safety injection (SI) blocked. Operators on ' shift were not aware that both trains of ECCS automatic SI were required by ;
technical specification. This event was discussed with the shift supervisors.
344-83-002 830122 AE0D/T416 dated August 1,' 1984.
Trojan
- While the plant was at 4% reactor power preparing for shutdown, a high-high level on one steam generator caused an automatic, trip and an automatic start of the auxiliary feedwater (AFW)-pumps from the control room. The operator manually shut off the AFW pumps ,
and was unable to restart them. Auxiliary feedwater '
was supplied by the non-ESF electric AFW pump until the other pumps could be restarted. A combination of :
1 inadequate neccedures and operator . training caused the event 'he method of manually securing the -
turbina 'efs.1 AFW pump rendered it incapable to -
restir~ atrL Jt local manual reset. '
6 By manually shutting down and trying to restart the AFW pumps when he did, the operator interrupted the,'
sequences which assure that the correct equipment is available for the pumps to operate. In the case of the diesel-driven pump, the pump had already reached e
- ,, .. - . . . . . . ~ ~ - -
C-19 APPENDIX C-1 (Continued)
LER #
Plant Event Date Description / Notes 344-83-002 830122 (Continued)
Trojan its minimum operating speed when the operator turned the control switch to stop and released it before the diesel came to a full stop. When he released the stop switch, it went to " AUTO AFTER STOP" and the pump again received a signal to start because the main feed pumps had tripped. Since the pump had not stopped and the engine was still rotating at more than 40 rpm, the starter motor was disengaged, thus preventing pump start. In addition, shortly after the second auto start signal was received, the low lube oil. pressure switch trip engaged because the automatic start signal opens the trip and throttle valve over a 20 second time period to prevent turbine overspeed.
When the cperator manually stopped this pump from the control room only the startup valve was closed.
Therefore, when the operator attempted to restart the pump and the startup valve opened, the trip and throttle valve was also full open and the pump tripped on overspeed. This overspeed trip would occur each '
time the operator used only the startup valve to manually start or stop the pump. Corrective actions included revisions to procedures (diesel and turbine-driven pump operation) and additional operator training.
344-83-013 830908 While at 100% power a maintenance tagout was prepared Trojan at 0545 for the Trojan 'A' train boric acid transfer
' pump by the assistant control operator. The tagout correctly deenergized the 'A' train pump'b.ut incorrectly called for valving out. the 'B' train transfer pump. The tags were then bung as called for in the tagout. At 0840 when.the maintenance person went to work on the 'A' train pump, this verification !
check of the tagout discovered that theB' train pump was improperly valved out. He . informed the control room and the tags on the 'B'. train valves were removed restoring the boric acid flow path. The j boric acid flow path was inoperablejfor three hours i in violation of technical specification.
344-84-005 840320 EA#84-33. Operations personnel f' ailed to recognize Trojan 4
that one AFW pump was out of se'rvice and that the !
surveillance testing of the RPS rendered the other l inoperable per technical specification.
1
C-20 APPENDIX C-1 (Continued)
^
LER #
Plant Event Date Description / Notes 4
344-64-005 . 8403D (Continued) '
i Trojan Inspection Report and Notice of Violation EA84-33, dated May 4,1984, points to improvements necessary in the management commitment to improving the coordination of maintenance and operations activities.
344-84-010 840504 During an RCS drain down to support refueling, a Trojan faulty level measurement led.to air binding of the RHR pump. The RCS was ' vented to atmosphere. A tygon manometer configuration was being used to measure RCS level, however, " crud blockage" of the manometer tap 1edtoerroneguslevel went from 105 F to 210, measurement.
RCS temperature 3
F during the 40 minute loss.
In order to p'revent recurrence a number of changes were made to procedure OI-3-2, " Draining the Reactor Coolant System": -
Alert the operator to promptly restore RHR flow, if lost, especially during high decay heat generation conditions.
1 - --
Do not permit removal of the RHR system from service for-a planned evolution until the reactor-
{ >
has been shut down for greater than ten days and :
j only after considering the decay heat load, i duration of evolution, and available backup heat ,
removal mechanisms.
A curve was developed that provides direction for ;
I the operator to verify that-the RCS level decrease '
i during drain down.is consistent with the indicated ;
volume of liquid drained from the system. ;
Require the level stand pipe 'B' loop. lower be flushed at approximately 150 psig pressur. e to tap'to ,
remove any corrosion products prior to placing the system into service.
. Require the.RHR discharge valves to be closed prior to star' ting RHR pumps'and initiate RHR flow slowly with a maximum allowable RHR flow when drained to loop centerline. ;
348-82-021 820510. (Referred to in AO#84-1). While performing Farley 1
" Penetration' Room Exhaust and Air Filtration System _
Train Operability and Valve Inservice Test," an ,
operator inadvertently closed the containment spray ;
suction ~ valves from the refueling water storage tank. ;
The valves were closed at power for seven hours. ->
I
, o i
C-21 APPENDIX C-1 (Continued)
LER #
Plant Event Date Description / Notes
' 361-83-071 830621 With the plant in mode 5 and during surveillance San Onofre 2 testing in accordance with procedure 5023-3.23, diesel generator 2G002 (Train A) was declared inoperable at 1009 when it failed to start. Since boration equipment (i.e., HPSI and charging pumps) was either aligned to Train A or out of service per procedure, inoperability of 2G002 resulted in no operable boration flow paths powered by emergency power sources.
Diesel generator 2G002's failure to start was due to air supply valve MUO82 being closed. This valve was located on the air supply line to the set of air start motors on engine #1 for the diesel It was considered most likely that MUO82 was it.odvertently closed during the line-up to conduct the surveillance test on June 21. At that time, similar valves in Train A were deliberately closed. However, because there was the possibility of an unauthorized manipulation of MUO82 between June 9 and June 21, 1983, the seriousness of unauthorized valve manipulations was reemphasized to operating personnel. Also Special Order 83-39 which responds to IE Bulletin 83-27 and details action to be taken when misalignment of a system is discovered, was implemented. No other misalignments were noted.
362-82-005 821205 On December 4, 1982 at 2242 with unit 3 in mode 5, '
San Onofre 3 Train B Diesel Generator 3G003 was removed from service requiring entry into the Action Statement associated with LCO 3.1.2.3 since other boration paths were not available at the time because of various inoperable equipment. (No boration flowpath powered by an emergency power source was available.)
A.lthough the detennination that the Action Statement was to be invoked was not made until 0545 on December l5, 1982, the requirement of the Action Statement had been satisfied since no core alterations or positive
-reactivity changes were in progress at the time.
This occurrence was caused by failure to recognize the full impact of taking the Train B diesel out of service. Train B diesel generator was returned to service at 0600 on December 5, 1982. As corrective action to prevent recurrence, responsible operations personnel reviewed the circumstances of this event
- - - - - _ _ . . + _ . _ _ . -
C-22 APPENDIXC-1(Continued)
LER #
Plant Event Date Description / Notes 362-82-005 821205 (Continued)
San Onofre 3 and were directed to perform a more detailed review of the im' pact on plant operations of taking a diesel generator out of service. This was to be included in their monthly retraining session.
362-84-009 840317 A0#84-6; referred to in A0#84-1; IEN 8-39; Enforcement San Onofre 3 Notice 84-29. While performing routine surveillance at nearly full power, manual isolation valves in both of the containment spray headers were found closed.
System was inoperable for about 13 days. Cause of the misalignment of the isolation valves was improper use of the valve alignment checklist.
On February 27, 1984, unit'3 went from mode 5 to mode 4, but a need was later identified to return to shutdown cooling, which was done on February 29, 1984. Following the required repair work a partial valve alignment checklist was developed to realign the containment spray system (CSS) for mode 3 entry.
CSS valves MU012 and MU014 were omitted from the list.
The licensee revised written procedures to ensure the proper alignment of valves prior to entering a mode of operation for which the system is required to be operable. Steps were also taken by the licensee to ensure more effective controls over the preparation of and changes to operating procedures. The licensee's training program was revised to provide additional emphasis on operator recognition of proper system alignments during various plant evolutions.
364-82-043 821028 A0#82-7 and referred to in A0#84-1.
Farley~2 Farley unit 2 was taken to cold shutdown on October :
24, 1982 to begin a refueling and maintenance ;
outage. On October 28, 1982, while aligning valves for certain scheduled inservice inspections, the ,
i . licensee found the containment spray header isolation valve on each of the two supply headers locked in the
, closed postion. The valves, located inside the unit 2 containment building, supply separate, redundant, containment spray rings. After investigation and record searches of valve movement -
documentation, the licensee concluded that the valves had been closed since before the plant achieved i
C-23 APPENDIX C-1 (Continued)
LER #
Plant Event Date Description / Notes 364-82-043 821028 (Continued)
Farley 2 initial criticality on May 8, 1981. Thus, the redundant containment spray systems were inoperable during this period (17 months) and consequently would have been unable to fulfill their safety function.
The event was caused by the valves not being in conformance with design drawings and by a procedural inadequacy used for operator determination of valve position. A unique condition developed in these valves when the vendor, Westinghouse, made a design change that lengthened the valve stem to increase the valve's adaptability to a motor operated valve (however, as described above, the valves are manually opera.ted at Farley). The design change resulted in a valve stem that makes the valve appear to be open .
when it is actually closed. That is, in the closed position, the extra long valve stem shows six inches of threaded stem extending out of the bonnet.
Therefore, operators who were instructed and trained to observe valve stem positions in order.to verify the valve positions, erroneously interpreted these valves as being open when they were, in fact, closed.
In addition, Westinghouse had not provided revised drawings showing the valve modification. As a result, the overall dimension of the installed valve stem was six inches longer than that specified.
As part of the corrective action, Alabama Power obtained concurrence from Westinghouse Corporation to cut the excess stem off the valves so as to conform with design drawings and with other rising _ stem gate valves throughout the plant. In addition, as a further safeguard to prevent recurrence, plant administrative procedures covering valve position verification were changed to require that manual valves which are locked open would be moved in the shut direction to verify their position; then the .
valve would be returned, if applicable, to the original position. .
_ ~ _ . - , _ , . . - , , _ .e
+
4 C-24
- APPENDIX C-1 (Continued) i
! LER #
Plant Event Date Description / Notes 369-81-180 811112 While at 48% power, the containment temperature McGuire 1 excegdedTechnicalSpecification3.b.1.5 limits
', (120 F as145)F.and For two temperature sensors personnel-safety, indicated aswas the containment high evacuated. The containment temperature was only
- excessive for about 10 minutes and was quickly brought under control once the unit I containment ventilation '
i cooling water valve was reopened. Thus, no heat i
damage to containment and equipment. occurred.
Unit I containment ventilation return isolation valve IRN153 (B1F) had been mislabeled 1RN863 (unit 2 containment ventilation return isolation), by -
construction and was closed inadvertently isolating i
containment ventilation cooling water to the unit 1 containment ventilation system. The valve was re-opened, the metal valve labels switched and construc-tion valve documentation changed.
Incorrect identification of equipment is likely to lead to errors. When the NEO initially closed IRN153 (mislabeled 1RN863) he noticed he seemed to be throttling flow though no flow should have existed and he notified the assistant operating engineer who .
verified that.1RN863 should be closed.
369-81-185 811118 NSAC/52. On November 18, 1981, with Unit 1 in mode 5, McGuire 1 cold shutdown, both residual heat removal (RHR) loops were rendered inoperable when an inlet isolation valve inadvertently shut. Concurrently a pressurizer high temperature alarm was received. RHR pump A was immediately stopped to protect the pump, and action to restore the system to operation was initiated. The j valve was reopened and the system was operating afer a
- 22 minute shutdown.
Investigation revealed that construction personnel l working in accordance with a shutdown request had disconnected the pressurizer vapor space temperature sensor signal cable. This signal is used as a diverse i
means of providing overpressure protection to.the RHR system. When the signal. lead was disconnected a, fail-safe characteristic caused the valve actuator to close the valve.
Operators were cautioned about the possibilities of RHR isolation due to actuation of protective features.
i I
e
-. .- -- - . - . . - - - - _ . . . . - = - .- -
C-25 APPENDIX C-1 (Continued)
LER #
Plant Event Date Description / Notes 369-82-017 820212 While in mode 1, control room alanns indicated the McGuire 1 closing of all four accumulator discharge isolation <
valves, rendering the upper head injection (UHI) portion of the emergency core cooling system inoperable.
Investigation discovered an open-ended leak on an impulse line to a UHI level switch which resulted from the failure of a Parker-Hannifin- fitting to hold the impulse line intact, probably due to an installation deficiency. The train A valves were successfully reopened using control room manual, actuators. The leak was repaired, and t'* train B valves reopened within an hour. Appropriate Parker-Hannifin fittings were verified installed correctly.
369-82-024 820302 While draining the reactor coolant system for steam McGuire 1 generator inspection, investigation of a residual heat removal (RHR) pump low discharge pressure alarm resulted in RHR pump 1A being stopped due to signs of cavitation. With the redundant pump IB out of service for maintenance, no means existed for removing core residual heat, which violated and was reportable per technical specification. RHR was restored in less than one hour. Analysis indicated that RHR could have been shutdown almost four hours before the onset of boiling.
A misapplication of the transmitter for the control board level gauge led to inaccurate indication of the l
reactor coolant (RC) system water level. RC level '
was raised to the minimum level for RHR. operation,
- and normal RHR flow was resumed. A modification to
- have the reference leg of the transmitter connected i to the PORV discharge line, redundant level l
indication and expanded scale in the normal RC level range for RHR operation was planned (design modifi-l cation). -
l E________ _ . .__ .. -_ ._ _ _ _ . . _ . _ ,_ __ ,
C-26 APPENDIX C-1 (Continued)
LER #
Plant Event Date Description / Notes 369-82-030 820423 While in mode 1, diesel generator (D/G) 1A failed to McGuire 1 start for a periodic test and was declared inoperable.
Since centrifugal charging pump (CCP) IB was out of service for periodic maintenance, neither CCP was operable and a unit shutdown was commenced. During the shutdown the reactor was manually tripped due to an unrelated feedwater problem. Offsite power was available throughout the incident.
Apparent cause of the incident was the failure of the station design change implementation program to adequately control work on station modifications. ^
CCP pump 18 and D/G 1A were returned to service on April 24. Drawings would be prepared to accompany each modification with changes marked to avoid confusion and a training program on the design change process and the proper usage of drawings was to be -
developed. .
369-83-017 830405 RHR pumps began to cavitate because the valve for the McGuire 1 level sensor had been closed and because procedures did not require visual monitoring of cavity level.
369-83-084 830929 (Referred to in A0#84-1.)
McGuire 1 On September 28, 1983, containmentspray(CS)systen train 'B' was declared inoperable due to a loss of power indication to the containment pressure control - i system (CPCS) pressure transmitter. On September 29, 1983 (with CS train B still out) nuclear service water (RN) train A was declared inoperable due to water in the oil reservoir of RN pump 1A. Since RN is required for CS operability, both CS trains were inoperable.
The power supply for the CPCS failed and was subse-quently replaced. The drain line for RN pump 1A seal catch basin was clogged, allowing water to back up and enter the outboard bearing. The oil reservoir was refilled. The failure to identify the impact of RN train A on CS train A's operability was attributed to personnel error. Appropriate personnel were counseled and a TS reference manual revised (procedure now requires a logging of all systems that ,
are impacted when a given system is taken out of service).
C-27 APPENDIX C-1 (Continued)
LER #
Plant Event Date Description / Notes 369-83-084 830929 (Continued)
McGuire 1 The shift supervisor knew better, but was over-whelmed. Certain periods (e.g., between 8:00 and 10:30 a.m.) can be particularly demanding (because of numerous requests for clearance of systems to perform e i surveillance and maintenance).
370-83-092 831231 During draining operations of the reactor coolant l McGuire 2 (RC) system, residual heat removal (RHR) pump B i was observed to have zero discharge flow and was '
4 subsequently tripped and RHR train B declared .
inoperable. This constituted a degradation of the
. reactor coolant system (cold shutdown loops noti filled; similar to LER 370/84-01and369/82-24).
Immediate action was taken to restore both RHR loops to operable status (restored in 43 minutes). Had the i return to service been further delayed, core cooling, i could have been provided by additional valve
- cycling. This was attributed to procedural deficiencies, due to inadequate guidelines regarding the water level to be maintained in the reactor coolant (RC) loops during RHR operation. The fueling ;
4 water storage tank to RHR pump isolation valve was ;
cycled to provide core cooling and raise RC system
, level until flow was restored. Procedures were to be
! revised by March 31, 1984. Additional corrective actions were detailed in LER IP370/84-01. ,
4 i
370-84-001 840109 On December 31, 1983, at approximately 1640, during
- McGuire 2 draining operations of the reactor coolant (RC) system, residual heat removal (RHR) pump B was !
- observed to have zero discharge flow. Pump B motor f amperage was low, and the RHR system pressure and pump B discharge pressure were equal. Based on these i factors, RHR pump B was tripped and RHR train B was ,
declared inoperable at 1650. The FWST to RHR pump i isolation. valve was twice cycled to provide core cooling and raise RC system level with water from the fueling water storage tank, while venting the RHR suction line and pump B. The core temperature rate !
i of rise decreased after the first water addition and
! the second addition resulted in slightly decreased i core temperatures. RHR pump B was restarted at 1720 and flow was restored.
l !
i
, ._ . . _ . - . - , . . , - , . . _ , . . . _ . . _ . . . _ . _ . . . . . , _ . , , . , . . _ _ _ _ . - _ . . . _ . . ~ . . . . _ _ _ . . _ . . .
C-28 APPENDIX C-1 (Continued)
-LER #
Plant Event Date Description / Notes 1 i
370-84-001 840109 (Continued)
McGuire 2 On January 9,1984, operators were again decreasing level in the reactor coolant loops when a computer alarm for low RHR pump A discharge pressure was i received. Fluctuations in RHR pump A motor amperage i
were noted and simultane.ous fluctuations in discharge pressure and flow also occurred.
i After the " Low RHR l Flow" annunciator alarmed, RHR pump A was tripped at
' 1246, and RHR train A was therefore inoperable.
Operators manually opened the RHR system to FWST ;
j isolation valve, raising the reactor coolant loop level with water from the FWST. The suction line and pump were vented and the pump was restarted at 1348.
l
- These incidents were attributed to procedural 4
' deficiencies, due to inadequate guidelines regarding the water level to be maintained .in the reactor . ,
coolant loops during RHR operation. A number of design and procedural changes were made to prevent recurrence of this event. '
] 370-84-002 840115 During filling and venting operations for Unit 2
! McGuire 2 star. tup, operators closed the breakers for valves 2NO-1B and 2ND-2A ['C' reactor coolant (RC) loop to :
residual heat removal (RHR) pumps isolation valves) on !
, January 15, 1984. Fuses for the A and B train output
}
relay cabinets of the solid state protection system (SSPS) had been removed on January 9, 1984, to permit ;
l transmitter time response testing. Normally closed r
! contacts in the CL0fE circuits of the valves are i controlled by SSPS output relays. With SSPS outputs .
j deenergized, the contacts completed the circuits, l
! providing CLOSE signals for 2ND-1B and 2A. Thus, !
I when the breakers for 2ND-1B and 2ND-2A were closed ,
! the valves immediately closed, isolating RHR I
{ suction. Both RHR trains were declared inoperable at :
1 2207. Unit 2 was in mode 5 with the reactor coolant !
[ loops not filled at the time of the incident. t Operators responded by tripping RHR pump A and j chemical and volume control pump A and reopening the i breakers for 2ND-1B and 2A. The valves were manually [
opened and RHR pump A was restarted. I r
?
4 q
- r i
l i
i i
l i
C-29 APPENDIX C-1 (Continued)
LER #
Plant Event Date Description / Notes 370-84-002 840115 (Continued)
McGuire 2 The incident was attributed to personnel error.
Appropriate measures to ensure control over 2ND-1B and 2A were not taken on. January 9, 1984, when the SSPS output relay cabinets were deenergized.
Procedures were revised and appropriate personnel were counseled.
370-84-004 840115 Chemical and volume control (CVC) pump 2A was declared McGuire 2 inoperable at 2317 on January 15, 1984, after the pump was started and run.for;approximately 19 minutes without suction. The volume control tank outlet isolation valve inadvertently closed prior to starting the pump, causing destruction of the pump.
During this time, CVC pump 2B was inoperable for -
maintenance. With both CVC pumps inoperable, the limiting conditions of technical specifications were not met. However, the Action Statements were met since no operation involving core alterations or positive reactivity changes were conducted. Unit 2
, was in Mode 5 at the time of this incident.
This event was attributed to personnel error due to the operators' failure to verify a suction path prior to operating CVC pump 2A. Also, they subsequently failed to identify the loss of suction to the pump during operation despite control board indications and numerous indirect operator aid computer (OAC) alarms. CVC pump 2A was repaired. Appropriate
' personnel were to be counseled with emphasis placed en verification of flow paths prior to starting any pump and giving OAC alarms proper attention.
C-30 APPENDIX C-2 LOSSES OF SAFETY SYSTEM FUNCTION INVOLVING HUMAN ERROR Descriptions of BWR Events
- LER #
Plant Event Date Description / Notes 155-81-022 810917 Reactor depressurizing system (RDS) Channel A (one of Big Rock Pt four channels) was being removed from service at 1230 hours0.0142 days <br />0.342 hours <br />0.00203 weeks <br />4.68015e-4 months <br /> on September 17, 1981 to allow maintenance work on the battery pwer supply for that channel.
Switching had been completed at the' actuation and sensor control panels making one of four blowdown loops inoperable. The auxiliary operator then went to a remote location to complete the switching and
! tagging order for channel A. He inadvertently entered the small room containing the battery and power supply controls for channel C and opened two breakers (CB-8 and CB-9) which made a second loop inoperable. '
Unaided by any indication or other communication he realized that he was at the wrong panel and immediately reenergized the equipment. Several more steps on the switching and tagging order had not been done. The auxiliary operator then notified the control operator in the main control room of the error. Annunciations of an abnormal condition with channel C registered properly in the control room so the potential for operation with less than three loops in service for an extended time would be improbable.
Reset of the two breakers (CB-8 and CB-9) by the '
auxiliary operator cleared the abnormal condition.
Additional verification of operability of channel C was subsequently made using the standard monthly I surveillance test.
The auxiliary operator was briefly misled because the !
four RDS battery rooms and equipment were similar in appearance and were unidentified and corresponding circuit breakers and controls on the four power panels in the separate rooms had identical markings (i.e. ,
there were four breakers marked "CH-8"). Prominent
. identification was installed in the four individual rooms and on the panels.
The event was reported because two of four blow down loops were inoperable, when three or four were re-quired to be operable to mitigate a small break LOCA. '
However, minor safety significance was associated with this event because the operator immediately returned the third loop to operation.
- Events are in order of increasing Docket /LER number. -
. o .
C-31 -
4 l APPENDIX C-2 (Continued)
LER #
{ Plant Event Date Description / Notes t i 219-82-031 820614 While et power, with control rod drive (CRO) pump A
, Oyster Creek out of service, the diesel generator associated with J
CR0 pump B was removed from service for monthly maintenance. In this configuration, if off-site ac -
power was lost, both CRD pumps would be unavailable, This was in violation of technical specifications, L Section 3.7.C.2 which required that none of the .
j engineered safety features normally fed by the '
operational diesel generator be out of service before i
the reactor was placed in the cold shutdown condition. Diesel generator surveillance procedures I
' were, changed to give prerequisities for removal from :
service. Licensed. operators were informed of this l problem. ;
i :
1 ,
l 237-81-030 810526 During normal operation an operator noticed the HPCI !
Dresden 2 steam line was cold and filled with water. Investi- !
gation found the valve disc had been installed '
, backwards in the HPCI turbine steam supply valve *
(thus preventing the drainage of condensate). The i i procedure for this job was changed to require !
verification of correct disc installation.
! 254-81-024 811209 Secondary containment was inadvertently lost while Quad Cities 1 making preparations for an internal inspection of the i underground length of the Unit 1 RHR 'A' service
{
- water line. Both ends of the pipe were open for a -
i ,
seven hour period during which time secondary containment was open to the Unit 1 turbine building. :
This happened because procedures for opening secondary l
. containment were not properly used in preparation for i the job. The personnel involved were trained in the
(
- proper use of the procedure.
l t 277-83-006 830323 EA#83-46 i i Peach Bottom 2 On March 23, 1983, investigation of a downward
! l spike on a torus level recorder identified an open :
- instrument vent valve to the containment. This valve !
i should have been closed and capped during reactor !
1
' operation. The investigation found that during a !
previous investigation (March 20,1983) into a torus !
level recorder spiking problem, the torus level :
transmitter was removed from service for ,
L calibration. After completion of the calibration, E l
f i
i
- .,, ,-.- - - -_ _ .- . - - - - , - - . . - , . . , , . - . . - - - - - - - - - - - - , - - . - - - - - ~ - - - - - - - -
_ _ _ _ .__ . . - - _ . . _ _ . - ._ _ ~ . . __ __
~
C-32 APPENDIX C-2 (Continued)
I LER #
l Plant Event Date Description / Notes 277-83-006 830323 (Continued) i Peach Bottom 2 the transmitter was apparently returned to service' without isolating the test connection (improper return to service). Based on the primary containment integrity definition in the technical specifications, i primary containment was not established for about j 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br /> during reactor operation.
278-81-008 810211 During the installation of a new penetration test Peach Bottom 3 connection to a 1" containment atmospheric dilution i
line (CAD), primary containment integrity was
! breached to secondary containment for 90 minutes.
I With unit at full load, a safety block was applied to l a portion of the CAD system to install a new test
! connection. A section of the 'A' loop CAD system .
l piping to be modified should have been isolated by l closing the manual valve be, tween containment and the :
location where the pipe was to be cut. Due to an incorrect location identification for the manual valve on a system check-off list, the manual <
, isolation valve was closed on the 'B' CAD loop instead of the isolation valve on the 'A' loop. The >
construction work force then proceeded to cut the 'A' I
loop piping and to install a new welded tee connection. The slight differential pressure which ,
i existed between containment and secondary containment i alerted the craftsmen to the problem.
This event occurred because the systeN check-off list - -
incorrectly located the 'A' loop valve and a valve on- l the 'B' loop was isolated. When the valving error was discovered, the 'A' loop isolation valve was closed, (
f reestablishing primary containment integrity. The !
system check-off list was corrected, and identifi- [
cation tags were put on the valves. '
This event had medium significance because primary l containment was unknowingly breached to secondary I containment. It was fortuitous that containment integrity could be reestablished by closing the 'A' !
manual isolation valve. '
I
! -I l i
. . _ _ _ . _ . _ - _ _ . _ _ _ _ - , - _ _ _ . _ _ . . , . - _ . . _ . . . - . - _ . - - - _ _ . _ _ . - . . - _ . , . , . . . ~ . . , ~ . .
C-33 APPENDIX C-2 (Continued)
LER F Plant Event Date Description / Notes 278-84-007 840602 On June 2, 1984 at approximately 8:05 a.m., with Peach Bottom 3 unit 3 at zero percent power level, the high pressure coolant injection (HPCI) system was made inoperable for maintenance work with the reactor pressure greater than 105 psig. At the time of the event, RCIC was out-of-service due to the inoparability of the inboard isolation valve. In less than two hours, the reactor pressure was reduced below 105 psig and HPCI was no longer required by technical specifi-cations to be operable. Unit 3 was in the process of being placed in the cold shutdown condition at the time of the event and was in such a condition within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The cause of the event was the failure of operations personnel to realize that making HPCI inoperable would lead to a technical specification limiting condition for operation. The individual involved was counseled on the importance of adhering to technical specifications.
293-81-64 811211 During a refueling outage while performing a power Pilgrim i supply transfer, power was momentarily lost causing a high reactor pressure isolation signal. This resulted in automatic closure of the residual heat removal (RHR) shutdown cooling suction valves. The running RHR pump should have tripped when the RHR valves left their full open position, but did not because of corroded contacts in the trip logic.
However, there'was indication in the control room that the valve's were closed. This condition went unrecognized by the operators of two shifts for approximately five hours. The control room operator failed to notice the discrepancy (running pump and shut valve).
Operators on two consecutive shifts were so overloaded with administrative duties and distracted by control room activity that they failed to notice loss of all shutdown cooling. Contributing factors were (1) poor shift turnover procedures, and (2) failure by management to recognize the importance of controlling activity in the control room and controlling the responsibilities of control room operators. Licensee now has " shift administrative assistants" to help relieve operators from this burden.
r C-34
~
APPENDIX C-2 (Continued)
LER #
Plant Event Date Description / Notes !
i 293-83-048 830929 (Referred to in Case Study AE00/C502, "Over-i Pilgrim 1 pressurization of Emergency Core Cooling Systems in Boiling Water Reactors," dated September 1985.)
l! On September 29, 1983 during HPCI system logic '
testing while the plant was at 98% power, the low pressure suction piping of the HPCI system was -
overpressurized to near operating reactor pressure *
- u. ,' .
and temperature. The event occurred when two HPCI i pump discharge motor operated valves were
{ simultaneously opened as a result of personnel j errors. The errors consisted of conducting more than one surveillance test at the same time and not 4
ensuring that test prerequisites and initial test conditions for all steps in the test procedures were l
met. The overpressur.ization occurred, when the pump discharge valves were opened, because the testable ,
isohtion check valve downstream of the discharge
! , valves was also partially stuck open at the time. ,
The overpressurization of +he suction piping (which ;
l is designed for 150 psi) ruptured the glanrf :: cal j condenser gasket on the HPCI turbine. This in turn caused a mixture of water and steam to spray from the i i
condenser onto a limit switch. The water spray ,
resulted in a 250V de battery ground and a large !
amount of water on the HPCI room floor. Smoke :
detector alarms also were set off by the vapors from -
1
' the heated paint on the low pressure piping. A high l l suction pressure alarm and a lube oil high !
l temperature alarm were also actuated. !
- I j
i To prevent a recurrence of the personnel errors, i, instructions for verbal communications were to be
. implemented at the plant.
i ,
! '298-81-017 810613 During hot startup, while attempting to warm up the Cooper l l steam supply line, RCIC-MOV-M016 failed to open. i Troubleshooting revealed a wiring error which l resulted in the torque switch being in the open !
' control circuit instead of being bypassed. The '
i jumper required to bypass the torque switch during !
I valve movement in the open direction was missing. i The purpose of the jumper was to positively ensure i
that the valve opened during system initiation ,
without regard for over-torque protection of the !
motor operator. This jumper was probably omitted . ,
i from the limit switch contact block when the block !
l was replaced during maintenance on July 5, 1978. The
! [
t f
, _ _ _ _ _ _ _ _ . . . _ _ _ _ _ _ ._ _ _ _. _ _ _ _ _ _ ... _ _ _ _ u
. . e 1
- C-35 !
APPENDIX C-2 (Continued) i
! LER # ;
- Plant Event Date Description / Notes i
298-81-017 810613 (Continued)
Cooper problem was immediately corrected by increasing the
- setting of the 'open' torque switch during
- troubleshooting. After a subsequent engineering j evaluation by the licensee, the jumper was installed and the valve tested satisfactorily. A copy of the
- LER was routed to the electrical maintenance .
] personnel. ;- -
i
! 298-84-007 840419 While scheduled construction work was in progress, a ,
j Cooper bulldozer inadvertently sheared a hydrant from the :
- fire protection system within the Cooper nuclear 1
- station restricted security a ia. The station fire ,
pumps automatically started, het were later -
! temporarily secured while the h.drant was being ;
, isolated from the system. At thi. noint, the fire protection system header pressure had dropped from 140 psig to approximately 10 psig. After the hydrant '
j was isolated, the fire protection system was
! repressurized by using the electric fire pump.
i Starting of the electric fire pump caused a pressure j surge which resulted in a system water hammer. This j water hammer forced open the clappers on the SSGTS {
j automatic deluge valves which flooded the charcoal !
- filters on the S8GTS trains, rendering both trains .
l inoperable. This placed the plant in a technical '
t specification LCO requiring cold shutdown. The reactor was placed in a, cold shutdown condition until
- the inoperable SBGT trains were made operable.
i Immediately after declaring the 58GTS inoperable, ,
! steps were taken to acquire new charcoal filters to !
replace the damaged sets. The new charcoal filters
- arrived April 20, 1984. Diocty1phthalate (00P) and ;
j freon tests were completed and the system was -
- returned to an operable condition. The $8GTS was ,
i inoperable for a total of 31-1/2 hours.
! Lack of attention paid by the bulldozer operator to
! his working environment, and the failure'of the ,
l control room operators to restore system pressure l l gradually, were personnel errors which were l l identified, t
)
, , - - , , -.--..,,,-+--.,ww, . _ , . - ,,,,--e. -,------,--w ---,--+a, ,~~,-m ,n,..,,rw-,.,--n,,,,,,n. -,n - , . - -mn-,--o-v -,n .ev--~,,.--s--e~
~ -
C-36 APPENDIX C-2 (Continued)
LER # !
Plant Event Date Description / Notes
'- 324-83-069 830825 During unit power operation while attempting to place 4
Brunswick 2 2A and 28 RHR room coolers into service in order to i
cool the RHR rooms, it was found that neither room cooler would start. RHR room coolers are related support subsystems of the RHR system. As a result of
- this event, the LPCI and suppression pool cooling modes of the RHR were declared inoperable. Neither room cooler started because the fan r.t. art limit
switch of 2A was out of adjustment while the airflow-dampers of 28 were mechanically binding. The subject j limit switches of 2A were adjusted and the damper
! joints of 2B were lubricated to return each cooler to -
! service. A preventative maintenance program for the
, RHR and core spray room cooler's dampers was to be implemented. .
I
- 325-81-031 810220 During normal plant operation a RCIC system " turbine i Brunswick 1 . tripped" annunciator was received in the control room.
An investigation determined that the RCIC turbine had l tripped and could not be reset from the control l room. The RCIC system was declared inoperable. This ;
event. occurred because an auxiliary operator manually l tripped the RCIC turbine without the consent of the i control operator while demonstrating to another !
j employee how to reset a RCIC turbine pechanical ,
i overspeed trip. At the time of this event, the HPCI '
l '
system was undergoing periodic maintenance and was j
, unavailable for service. The RCIC turbine was reset !
and the RCIC system restored to operability. All operations personnel were counseled concerning this <
event with particular emphasis on good plant ;
communications, j 333-84-003 840207 During normal full power operation the high pressure ;
Fitzpatrick coolant injection (HPCI) system was intentionally !
i removed from service to permit maintenance and modifi-
- i cation. On February 7,1984, the I&C technicians e l
assigned the task of calibration of HPCI speed !
indication reported to the I&C supervisor that the i
{
task was complete and noted that the speed indication -
circuit had been found out of procedural tolerance by ,
i approximately 40 percent. 'The magnitude of the "as '
! found" out of tolerance speed indication led the ;
supervisor to initiate an investigation into the cause. The investigation revealed that the I&C s technicians'had calibrated ths RCIC turbine speed ;
. t
j C-37 -
5.
i
, APPENDIX C-2 (Continued)
LER #
Plant Event Date Description /'.otes l
- 333-84-00'3 840207 (Continued) i Fitzpatrick indication using the procedure for HPCI speed indication. Calibration of the RCIC turbine speed indication utilizing the proper procedure was ,
initiated immediately under the direct supervision of an I&C supervisor. (Completed approximately six
. and one-half hours later.) Long tern licensee corrective action to reduce the probability of recurrence or similar errors with other systems /
l . components was as follows: (1) label the HPCI and ;
- RCIC turbine control enclosures for positive j identification; (2) develop and implement a program 2-for verifying the awareness of I&C technicians with
- respect to the physical locations of safety related 1
- equipment; and (3) continue a program in which I&C ;
- technicians complete a plant specific BWR technology
- course. -
1
{ 333-84-004 840210 During power operati 7 with the high pressure coolant l Fitzpatrick injection (HPCI) syste' out of service for scheduled '
i maintenance, a de grour ' occurred on ' A' station i i
battery. During the performance of the ground '
, isolation procedure the de control power to the RCIC v inverter was momentarily interrupted. The momentary j loss of de power to the RCIC inverter requires a -
{ manual reset to.repower up the inverter. The ground
- i isolation procedure did not inform the operator that a manual reset was required. The loss of both HPCI j
i j and RCIC placed the plant on a 24-hour limiting i condition for operation. The operator, after .
! determining that the inverter would not reset auto- ,
i matica11y, performed a manual reset. Surveillance i
testing for RCIC operability was immediately l conducted'and RCIC was declared operable. The l consequences of this occurrence were minor due to i
the short outage of the RCIC system (approximately
. 30 minutes) and because the ADS and low pressure !
injection systems were operable.
jl ;
A change to the ground isolation procedure was
! incorporated to instruct the operator to manually reset the RCIC inverter. :
I
- I
\ :
l
- i i
i !
l .
l l
l C-38 i
APPENDIX C-2 (Continued)
LER #
i Plant Event Date Description / Notes
! 366-82-095 820817 With 'B' loop of residual heat removal service water ,
i Hatch 2 system (RHRSWS) out of service for maintenance, personnel tasked with closing 'B' loop strainer inlet valve secured the 'A' loop valve instead. This i
j blocked the only open flow path in the 'A' loop and i thus made the 'A' loop inoperable.
t For corrective action new identification tags were i
added to both 'A' and 'B' loop valves. Also, valve '
locks were changed such that the key for one loop would not open locks on valves of the other loop '
- (design improvement).
I i
387-83-026 830301 '
While operating at 100% power, an operator tagged out Susquehanna 1 the 'A' standby gas. treatment system to allow removal i of a test canister from the charcoal bed. However, ,
! due to the extent of the blocking used, the operator
- , unknowingly caused both trains of SGTS to be
, inoperable. The reactor building HVAC was operable and maintained a 1/4" negative. pressure during the event. No other events occurred which required SGTS i to operate.
l The operator used a common point.for tagging out i
- equipment without knowing the consequences of his actions. This resulted from inadequate planning and j
understanding. The control room operator had l accepted the responsibility for specifying the l electrical tagout, although the electrical diagrams l were of poor quality and were hard to follow.
i Administrative procedures were changed to relieve the
! operator from things like specifying'tagouts i
1 (operators could still approve). EA 83-26.
1 i 387-83-033 830310 While the reactor was in a cold shutdown condition and '
i
~
Susquehanna the standby gas treatment system was being run to i verify secondary containment integrity, two blank :
! flariges were found to be missing on HVAC duct-work .i i
that established a flow path from unit 2 to unit 1. '
By definition this compromised secondary containment l l
integrity and resulted in higher flow rates than '
l allowed for secondary containment integrity per *
! technical specification. (This was the result of an ,
l inadequate tagout program, i.e., program to control i the boundary for separation of the units.) The' l blanks were removed by an unknown person (s) on an !
i
- . . _ . _ - . - . . . - _ _ _ _ _ , , - - - . . _ _ _ . . . . . . . . _ . - . , . - _ . - , _ . . - . _ . . . _ . ~ ~ . . - _ - . . - . . _ _ . _ , _
I- .
C-39 APPENDIX C-2 (Continued)
LER # l Plant Event Date Description / Notes ,
387-83-033 830310 (Continued)
Susquehanna 1 unknown date (secondary containment flow rate was last checked five months earlier).
The blanks were installed, the fasteners were tack welded and the blanks were tagged as unit separation '
items. The SGTS surveillance test was performed and resulted in an acceptable flow rate for secondary containment integrity. To prevent recurrence, the following actions were planned or in progress: (1) perform an adequacy review of unit separation; (2) revise the -
boundary tag program to include as a controlled document the summary sheets of separation components; i (3) revise the plant modification request program to include a unit separation review and the -
implementation of the boundary tag program when a
, modification is being performed; (4) verify that the identified boundaries have a unique boundary tag utilizing operations and electrical maintenance personnel followed by an independent verification by quality control personnel; (5) perform a review on unit separation components located in unit 2 for adequate security control in order to avert unauthorized removal; (6)~ review the analysis reports of the charcoal beds made from the SGTS test cannisters that were removed; and (7) develop .
surveillance procedures to routinely check safety related and radiation protection components that are part of the separation program.
387-83-044 830311 While in operating condition 2 (startup) vith steam Susquehanna 1 dome pressure greater than 150 psig, a technician inadvertently caused the high pressure coolant injection system to isolate. A technician was performing a monthly surveillance functional test of the main steam line tunnel temperature channels and inadvertently connected his test equipment to an adjacent HPCI temperature isolation switch and brought in a trip signal.
The core spray, LPCI, ADS, and RCIC system were operable. HPCI was unisolated and returned to service. Personnel were counseled on the importance of proper test connections. .
e
C-40 j
APPENDIX C-2 (Continued)
LER #
Plant Event Date Description / Notes i ;
416-83-069 830523 While personnel were attempting to reenergize some l Grand Gulf 1 RWCU system and RHR shutdown cooling MOVs following
- a planned Division II electrical outage, the valves isolated (during the outage the valves were blocked open per a temporary directive for the Division II i electrical outage), as a result of an isolation signal from the MOV's isolation logic. The isolation' logic relays deenergize to produce an isolation i signal. The signal was present due to some power i
fuses being removed during work under an approved
! design cha l place thisnge package.
removed voltage 'Since the the from fuses were not isolation logic in
' relays and placed the logic in the actuated state.
! The end result of this event was that both shutdown .
cooling loops and the RWCU system were isolated, .
thereford,' decay heat removal / coolant circulation capability was lost for approximately one hour.
j' Immediate actions were to manually override the f
closed valve signal and place both systems back in operation.
i i
A licensee investigation verified the above information. Power fuses were installed and normal F system operation was attained.
l 416-84-004 840114 Grand Gulf 1 On January 14, 1984, at approximately 1632 hours0.0189 days <br />0.453 hours <br />0.0027 weeks <br />6.20976e-4 months <br />, 4
3 shutdown cooling system isolation occurred while a utility technician was performing work in an ' 1 electrical panel. The technician loosened a screw on i l
i a relay which was deenergized to install a spade lug i behind the terminal. The relay terminal also had a l
i jumper installed in accordance with a temporary directive to prevent the isolation of shutdown cooling during the Division 1 outage. It was concluded that the technician caused a momentary .
i break or short in the circuit causing a fuse to blow !
i i
and isolating the suction valve common to both.
shutdown cooling loops. 3 i
i
' The plant was in cold shutdown at the time of the I l incident and in a Division 1 outage for maintenance t
} work. Approximately 58 minutes elapsed between the I
time of the isolation and system restoration. The j reactor water cleanup system was operated as an y j alternate method of reactor. coolant circulation i until shutdown cooling was returned to service. -
i I .
f*
- - - - ,--- - ~ ,__. - -._,.-- - ~ - ~ _...----- -, - --..
- go n .
j C-41' '
i
. APPENDIX C-2 (Continued)
I LER #- -
Plant Event' Date Description / Notes i
416-84-004 840114 (Continued)
Grand Gulf 1 The technician was installing the spade lugs for the ,
purpose of connecting test equipment or jumpers for 1
! use during future surveillances. . The work instruc- '
- tions specifically stated that the task was to be ;
i i performed during the Division 1 outage. The tech- l nician was counseled and instructed that he should- !
i have investigated the abnormality (temporary jumper) !
l . prior to performing the activity. .;
! l
, 416-84-008 840202 At 1430 hours0.0166 days <br />0.397 hours <br />0.00236 weeks <br />5.44115e-4 months <br /> on February 2,1984, while the plant was l j Grand Gulf 1 in cold shutdown, control power was lost to the HPCS :
- pump for about 30 minutes. This left LPCI 'B' the i
! only operable ECCS system available. The control !
power was lost when'its supply breaker was opened in error. The breaker was incorrectly opened while [
i performing an electrical lineup for the HPCS diesel +
' generator (the diesel was being tagged out for .
maintenance). This_ happened due to a procedural ,
i error in the system operating instruction electrical r l lineup for the HPCS diesel generator which listed the i
- breaker incorrectly. The error was found and HPCS l
- was returned to operable status within 30 minutes. !
! LPCI 'B' was available during this time period and !
l there were no evolutior.s in progress with a potential l l
for draining the vessel. The system operating i instructions for HPCS and the HPCS diesel generator j j were changed to correct the breaker information'in :
j the electrical lineup. }
l
! 416-84-013 840411 'At 1445 hours0.0167 days <br />0.401 hours <br />0.00239 weeks <br />5.498225e-4 months <br /> on March 22, 1984, while the plant was !
! Grand Gulf 1 in cold shutdown, a MP&L instrument technician was !
! performing the functional surveillance test for the j
{ reactor vessel high pressure trip systems. This j
- j. involves the logic for RSS scram and shutdown cooling i
- isolation. The technician failed.to verify that the !
l trip generated by the test was reset, as required by {
! the procedure. As a result, the trip was still !
i present when power was restored to the shutdown. ,
l j cooling suction isolation valve's motor operator. l j The valve shut, and since the isolation valves are in i series, both loops of shutdown cooling were isolated, i I L The isolation valve was immediately reopened (making l
! . both shutdown cooling loops operable) and a shutdown
- l l cooling loop was returned to operation. The tech- l nician involved was verbally reprimanded. ;
i ;
I !
- _ ~. . _ . _ . _ . _ _ _ _ , _ _ _ _ _ . . - _ , . _ _ . _ . . _ _ _ _ _ _ . _ _ _ _ __ 2