ML20154L845

Power Reactor EVENTS.July-August 1985

ML20154L845
Person / Time
Issue date:	02/28/1986
From:	Massaro S NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
References
NUREG-BR-0051, NUREG-BR-0051-V07-N4, NUREG-BR-51, NUREG-BR-51-V7-N4, NUDOCS 8603130131
Download: ML20154L845 (49)

Text

_ __

NUREC/BR-0051 Vol. 7, No. 4 ks.....,h POWER REACTOR EVE NTS I,

/

United States Nuclear Regulatory Commission Date Published:

February 1986 Power Reactor Events is a bi monthly newsletter that compiles operatmg ciperience mformation about commercial nucle r power plants This mcludes summaries of noteworthy events and hstmgs andlor abstratts of USNRC and other doctments that discuss safety-related or possible generic mues it is intended to feed back some of the lessons learned from operational esperience to the various plant personnel, e e. managers. hcensed reactor operators traimng coor.

dmators, and support personnel Ref erenced documents are avadable from the USNRC Pubhc Document Room at 1717 H Street. Washmaton. DC 20555 for a copymg fee Subscriptions and additional or back mues of L'9r cr. Reactor Events may be requested from the Superintendent of Documents. U.S. Covernment Prmtmg Of fice,. (202) 257-20W or -2171, or ct P.O. Box 37082. Washington. D C. 20013-7982.

Table of Contents Page 1.0 SUM.4A RIES OF EVENTS..

I 1.1 Lou of Offsite Power at Drescien.....-=

I 1.2 Safety injection and Rextor Trip Due to Lt>ss of Station Instrument Air Pressure at Beaver Valley.....

7 1.3 Reactor Coolant Pump Seal Damage at St. Lacle.......-.......

9 1.4 Blackout Signalord Interaction Event Between Units at Catawba........................

I2 1.5 High Pressure Coolant injection System inoperability Due to Error in Electrical Connecttons at Cooper....

14 1.6 Diesel Generator Battery Charger Inoperable at Catawba.-

16 f.7 References..........

20 2.0 EXCERPTS OF SEL ECTED LICENSEE EVENT REPOR TS...

21 3.0 ABSTRACTS / LISTINGS OF O THER NRC OPERA TING EXPERIENCE DOCUMENTS.......

33 3.1 Abnormal Occurrence Reports (NUREGM90)....

33 3.2 Bulletinsarwlinformatlon Notices......

35 13 Case Studies arvi Engineering Evaluations..............

39 3.4 Generic letters...

45 3.5 Operating Reactor Event Memoranda....

4G 36 NRC Document Compilations...

41 1

Editor: Sheryl A. Massaro Office for Analysis and Lvaluation l

of Operational Data l

U S Nutlear Regulatory Coinniinion l

Period Covered:

July August 1985 Washington, D C 20555 0603130131 860228 PDR NUREG BR-0051 R PDR

1. 0 SUMMARIES OF EVENTS 1.1 Loss of Offsite Power at Dresden On August 16, 1985, a loss of offsite power occurred at Dresden Unit 2* during normal power operation at 70% power.

The event was initiated by a fault on the secondary side of the Unit I reserve auxiliary transformer TR12 whose primary side was being powered from the same 138 kV source as the Unit 2 reserve auxi-If ary transformer, TR22. When protective relaying sensed the fault, the Unit 2 offsite power source was isolated and power to TR22 was lost.

Because of a design error, buses 22 and 24 (4 kV) did not automatically fast transfer to the unit auxiliary transformer TR21, which is fed from the main generator, result-ing in a partial loss of offsite power.

One of two running reactor feed pumps (RFPs) powered from bus 22 tripped on bus undervoltage and the standby RFP, also powered from bus 22, failed to start.

A low water level scram of Unit 2 resulted and the Unit 2 main turbine and main generator tripped.

Complete loss of off-'te and generator power resulted.

Both emergency diesel generators automaticali,/ started and the unit was brought to a safe shutdown condition.

A detailed description of the event follows.

At 12:21 a.m. on August 16, 1985, Dresden Unit 2 experienced a loss of offsite power which resulted in a scram on low reactor water level from about 70% power.

A fault in Unit 1 transformer TR12 caused the Unit 2 reserve auxiliary trans-former, which fed associated auxiliary buses 22 and 24, to be isolated from the normal 138 kV offsite power source.

Because of a design error, a fast transfer of buses 22 and 24 to the unit auxiliary transformer TR21, which is fed from the main generator, did not occur, and buses 22 and 24, remained without power.

This caused a running 28 RFP to trip and prevented the standby 2C RFP from starting.

The unit subsequently scrammed on low water level (See Figures 1 and 2 for layouts of the Unit 2 electrical distribution).

When the scram occurred, the turbine generator tripped, causing a loss of power to the auxiliary transformer and a subsequent complete loss of auxiliary powr.

The Unit 2 and 2/3 emergency diesel generators (EDGs) started as designed and provided power to their respective buses 24-1 and 23-1.

This provided power to the emergency core cooling system and shutdown systems as necessary; however, none were required during the event.

• Dresden Unit 2 is a 772 MWe (not) MDC and Unit 3 is a 7/3 HWe (net) MDC General Electric BWR located 9 miles east of Morris, Illinois.

They are operated by Commonwealth Edison.

Dresden Unit I was shut down in 1918 and has been defueled.

• • Group I:

main steam isolation valves, steam line drains and reactor water sample Ifnes.

Group II:

drywell ventilation, purge and sample lines, reactor building ventilation system, transient in-core probe withdrawal command, shutdown cooling and head spray modes of residual heat removal.

Group III:

reactor water cleanup system.

1 l

I 1

l ll iC i

f e

=%

H @

~,

=

n ;,

n d

N M

a y

5 l

^

Ci e

guu 5

l

_x_ii,lt*,

L,

a.. c, a e

n-6,2 YW Q

l*agl I vuw; 'l I uf1w' l

i V

gn i

rprp j

l 1 3 U Irc. 6

,O,JL 6

s

..m n E

g l

'(g <,r" m.,aos r

1 eA{lg i

,g sy mL a

g" n

I E

n-C

""L--

q n,

a n

m m

I' l

y l

.x on i

e

,-x E

4-

'E g

n n-a n

u m

s 1

g o

gescg M ECTs m

INT 2 EEN SCB MRIE TMes r%

Tlq2 9-lumG BUS j[

INT MX.

m 345 KV ) {1t IV 18 KY TMNSFORISER 2131 TR-21 2413

^

^

~:

^

^

~

sus 2s sus 2e

(

]>

H% *Nlh

^

4sev

)

.s. wt

i

^

Bus 24 EuS21 BUS 72 bus 23 p

e.

^

.*v" WO

^ e-

,}

g

{.,

2125 2405

^

^

OEsEt sitEW 41087 GENERATORS L}

~~

TOFR3RR IIEsE.NE MX a

M KV 2.1 2

TMa8FORISER BUS 361

- e--

1. eb

{j

^

^.-.

sus m

.us m m 2n y,

i I

CD

,s F

= =

w-TMo

i

. " '"C

~

sus a sus a FIGURE 2. DRESDEN 2 ELECTRICAL DISTRIBUTION L

i

Containment Group I, II, and III** isolations occurred.

Reactor pressure was controlled through use of the isolation condenser, and level was controlled through use of the control rod drive system.

j Other associated effects were a loss of power to in plant radio transmitters and some telephones, including the nuclear accident reporting system (NARS).

Power was also lost to various reactor protection system (RPS) components and the process computer alarm memory, which resulted in the irss of the event alarm history.

The reactor building ventilation systen. tripped, and the standby gas treatment system started as designed.

At about 12:45 a.m., the IIcensee declared a plant " alert" and notified appro-priate personnel and agencies. After removing TR12 from the 138 kV system, power was restored on those buses and auxiliary power was restored to Unit 2 thrcugh TR22 at 4:32 a.m.

This resulted in the licensee restoring normal power, securing the EDGs, and continuing with a normal plant cooldown.

The licensee's investigations found that the loss of of fsite power was due to a fault that developed on the secondary side of TR12.

An insulating board pro-viding support as well as insulation for the A power phast for TR12 failed, causing the conductor to short across the bus duct housing.

Transformer TR12 receives offsite power from 138 kV bus 3.

Transformer TR22 receives offsite power from 138 kV buses 1 or 3.

A normally open bus tie breaker, 138 kV BT 2-3 Cd, electrically separates the two alternative bus sections.

At the time of the fault, both TR12 and TR22 were being supplied power from 138 kV bus 3.

Protective relaying sensed the fault on TR12 and isolated 138 kV buses 3 and 4. resulting in complete loss of offsite power to TR22 and Unit 2.

A review of the electrical drawings for the circuit breaker power transfer scheme on buses 22 and 24 revealed that the feed breakers (2205 and 2413) from TR21 for both buses were not designed to automatically close under the fault condition that prevailed.

For the feed breakers on buses 21, 22, 23, and 24, all contacts must close for power transfer to occur.

During this event, all contacts closed except those from the relay whose contacts close only when a lockout condition exists on TR22.

l.oss of primary feed to TR22 does not result in a TR22 lockout condition. Automatic transfer of power to buses 22 and 24 was not supposed to occur under the fault condition that prevailed.

Af ter further review, it was determined that durir.3 cunstruction of Units 2 and 3, an undervoltage relay protection scheme was installed on the secondary (Iow voltage) side of reserve auxiliary transformer TR22.

The undervoltage relay was originally provided to prevent an automatic transfer of auxiliaries from the unit auxiliary transformer, TR21, to the reser e auxiliary transformer, TR22, if the voltage from the 138 kV system was too low.

After the undervoltage relays were provided, they were also used to trip 4 kV breakers 2105, 2201, 2311, and 2405 if the reserve supply voltage dropped too low.

The relaying scheme was designed to trip the transformer TR22 lockout relay when an undervoltage condi-tion existed.

On November 28, 1973, a low voltage condition existed on 4 kV bus 22, resulting in a Unit 2 scram.

A modification was initiated to remove the TR22 undervoltage trip for 4 kV breakers 2105, 2201, 2311, and 2405.

Under the modification, the lockout relay contacts placed into the breaker automatic clnse circuitry were mistakenly overlooked and left in the close circuitry on both units.

The error remained unnoticed until the August 16, 1985 loss of power event.

4

It is believed that loss of the process computer alarm printer during this event was due to a failure in communication between the printer and the process com-puter.

This failure propagated to the extent that some program data could not be outputed and eventually led to a memory stall within the process computer.

The computer was restarted and all its functions restored by 3:43 a.m.

The safety parameter display system was operable during the entire event.

The radios utilized by the Operating Staff within the plant require the use of a repeater transmitting station.

All radio contact within the plant relies upon this repeater.

The normal power source to the repeating station is motor control center (MCC) 27-1.

During the event, power was lost to MCC 27-1 and was not restored until offsite power was restored to TR22.

A review of the repeater station circuitry has shown that the repeating station does have an alternate power source.

However, the alternate power source is the security emergency diesel generator.

The security diesel generator will only start if an undervoltage condition exists on the security bus.

The security bus is nor-mally fed from 4 kV bus 34-1 and the latter bus did not experience any loss of power daring the event.

Therefore, the security diesel generator never started and the repeater transmitting station remained without power until offsite power was restored.

Also, several telephones within the plant became inoperable during the event.

Among the inoperable telephones was the Nuclear Accident Reporting System (NARS) telephone which is used to contact State and local authorities during Generating Station Emergency Procedure (GSEP) conditions.

An alternate outside telephone line was used instead of the NARS telephone to contact the authorities.

Inves-tigation has shown that the power supply to the NARS telephone and all other inoperative telephones were fed from Unit 1 lighting panels 2L (circuit 17) and 22L (circuit 42).

Both lighting panels became deenergized when offsite power to Unit I was lost.

There is no emergency power source for either lighting panel.

The NARS telephone became operable when offsite power was restored to Unit I through reserve auxiliary transformer TR13.

At approximately 3:30 a.m., during the event, a Reactor Operator nnticed that the control room instruments powered from the A RPS bus were without power.

An Equipment Operator was dispatched to the A RPS bus and found a tripped breaker between the 8 RPS motor generator (MG) set and the A RPS bus.

The Equipment Operator reset the tripped breaker and restored voltage to the A RPS bus.

An attempt was then made to reset the scram.

However, only the B RPS channel would reset.

Suspecting that possibly a mistake had been made in restoring power to the A RPS bus and that the bus was still deenergized, another Equipment Operator was dispatched to the RPS bus.

The Equipment Operator was instructed to transfer the A RPS bus power from the RPS MG set to MCC 25-2.

This power transfer re-quires momentary loss of power to the bus.

When the Equipment Operator arrived at the RPS bus, he veriffud that voltage was supplied to the bus from the MG set.

However, the Operator followed the orders given to him and transferred power to MCC 25-2. When reactor pressure is less than 600 psig, loss of power to one RPS bus results in a full reactor scram if all main steam isolation valves are closed or low vacuum exists in the main condenser.

The transferring of power resulted in the anticipated full scram.

After power had been transferred to MCC 25-2, the scram was reset on both RPS channels.

Several hours later, the A RPS bus power was transferred back to the Rr MG set.

5

It is not known exactly why the A RPS channel would not reset.

A review of the computer alarm printout verities that all the A RPS channel scram relays had been energized prior to the RPS bus power transfer.

Interviews with the Reactor Operator indicate that it is likely that no attempt was made to see if all the A channel annunciator lights would clear just prior to the bus power transfer.

It is suspected that one of the 45% power bypass switches for the generator load reject and stop valve closure scrams was stuck open.

It is likely that the resulting scram closed the contact allowing the A channel to reset.

The following actions were taken by the licensee to prevent recurrence:

The Unit I reserve auxiliary transformer TR12 was placed out of service for repair.

The Unit 2 reserve auxiliary transformer remains tied into the 138 kV bus 3 because of the larger number of offsite power feeds to the bus section.

A procedure was written to modify the Unit 2 main transformer, TR2, during an extended loss of offsite power event.

The ourpose of the procedure will be to instruct station personnel on how to modify TR2 such that it will become an offsite power supply if necessary.

Visual and physical inspection of the 4 kV breaker circuitry was per-formed to verify that the closure circuit wiring matches the design drawings.

This was done to prove that the automatic transfer of power to buses 22 and 24 was not supposed to occur und the fault condition that prevailed.

Modifications were made to the circuit breaker close circuitry to feed circuit breakers 2101, 2205, 2303, and 2413.

The modification will allow an automatic transfer of cffsite power from TR 22 to TR 21, independent of the cause of power interruption to TR22.

A post-modification test was performed to determine that the bus transfer will occur when required.

The test simulated breaker trip signals for feed breakers 2105, 2201, 2311 and 2405 without the trans-former TR22 lockout relay actuated.

Feed breakers 2101, 2205, 2303 and ?413 were verified to automatically close.

Attempts were made to simulate the failure of the process computer alarm printer by jumpering some of the compater inputs that were in-cluded in the scram and forcing the communication failure.

All attempts failed to reproduce the failure.

To prevent recurrence of this failure in the future, the hardware between the computer and alarm printer will be enhanced.

A work request was written to provide another alternative power source for the radio repeater transmitting station.

Approximately 80 replace.

ment radios were ordered.

The replacement radios have the capability.

of radio to radio contact without the use of the repeater transmitting' station.

A work request was also written to provide an emergency power supply to the NARS telephone such that direct telephone communi-cation to the State and local authorities will not be lost.

6

The safety significance of this event was minimized by the fact that all safety systems functioned as designed and the unit was placed in a safe shutdown condi-tion.

This was the first occurrence of this type at Dresden.

The Dresden Unit 3 circuit breaker design is the same as that found on Unit 2; similar modification changes were therefore made during the Unit 3 refueling outage in fall 1985.

(Refs. I and 2.)

1.2 Safety Injection and Reactor Trip Due to Loss of Station Instrument Air Pressure At Beaver Valley On August 29, 1985, at 12:48 p.m., while Beaver Valley Unit 1* was at 100% power, a low station air pressure alarm was received.

Operations personnel responded by starting the standby station air compressor.

The reduced air pressure ini-tially caused one main steam isolation valve to drift closed.

The resultant increased steam flow caused steam line pressure to drop in the other two steam lines.

The pressure drops were sufficient to actuate the rate-compensated low steam line pressure safety injection (SI) signal, which resulted in a reactor trip.

The control room operators followed the applicable emergency procedures and stabilized the plant in hot standby.

The low station air pressure was the result of a failed solder fitting on the instrument air system.

The solder fitting failed due to a faulty heater control on an instrument air dryer. Dur-ing subsequent plant recovery actions, water was found spraying from both low head safety injection pump wedge control rod seals. Both pumps were declared inoperable, which required an entry into cold shutdown. Postulated failure of the control rod seals was from a minor flow induced pressure transient that failed the aged 0-rings. Following equipment repair, a plant startup to full power operation began on September 1,1985. A detailed sequence of events follows.

On August 29, 1985, at 12:48 p.m., a " station instrument air receiver pressure low" alarm was received in the control room.

In response to this alarm, the Control Room Operators started the standby station air compressor. Additionally, operators were immediately dispatched to determine the cause of the low station instrument air pressure. Attempts were made to start the emergency diesel air compressor, but these attempts were unsuccessful.

The failure of the emergency

)

diesel air compressor to start was apparently due to improper starting tech-niques, resulting from overcranking.

A portable battery charger was jumpered onto the diesel battery and the diesel was successfully started.

To prevent future occurrences, additional starting instructions were placed on the air compressor detailing proper starting techniques.

The operators then went to the area of the station air compressors and began isolating air to the station air system, except for air supplying the instrument air system.

The operators then discovered that the common outlet 2-inch line from the instrument air dryers had separated at an elbow fitting.

They imme-diately began to isolate the affected portions of the instrument air system and place in service the installed bypass air drying filters.

Due to the reduced air pressure, the main steam isolation valves (which require air to be held open) started to close.

The main steam isolation valve on the 1A main steam line dropped low enough for the valve to be rapidly closed by the

• 8eaver Valley Unit 1 is an 810 MWe (net) MDC Westinghouse PWR located in Pennsylvania, 5 miles east of East Liverpool, Ohio, and is operated by Duquesne Light.

7

steam flow.

This caused increased steam flow to the IB and 1C main steam lines with a corresponding drop in the steam pressures within the steam lines.

The pressure drops were sufficient to actuate the SI system due to low steam line pressure at 12:50 p.m.

The low steam line pressure SI actuation signal is rate-compensated to act as an anticipatory signal.

The SI signal caused a reactor trip, a turbine trip, the generation of a steaa line isolation signal and a feedwater isolation signal.

The steam generator atmospheric relief valves actuated to maintain temperature.

The Control Room Operators took actions to terminate and recover from the SI actuation, and to stabilize the plant in hot standby. At 12:58 p.m., the SI signal was reset and all non-essential equipment was placed in the standby mode.

An unusual event was declared due to the SI system actuation, and the appropriate emergency preparedness plan notifications were initiated.

The unusual event was terminated after the cause of the SI was identified, and stable plant condi-tions were established.

Following plant stabilization, a Plant Operator, during his normal tour, found water leaking from the discharge head seal package area of the 1A low head SI pump.

The pump was started (bumped) in an attempt to seat the seals because the seals may not have seated when the pump was shut down.

However, this action failed to terminate the leakage.

Closing the pump suction valve terminated the leakage. The 1A low head SI pump was then declared inoperable and the " action statement" of technical specifications was entered.

Subsequently, water was noted leaking from what appeared to be the seal package on the 18 low head safety SI pump. The pump was manually rotated in an attempt to seat the seals, but the leakage continued.

The suction valve to the pump was then closed to ter-minate the leakage. The 18 low head SI pump was then declared inoperable.

This prompted an entry into cold shutdown at 12:20 a.m. on August 31, 1985, to comply with the technical specification " action statement" for loss of the low head SI system.

During attempts to place the residual heat removal (RHR) system in service, the 1A RHR pump failed to start.

The 1B RHR was placed into service during trouble-shooting of the starting problems on the 1A RHR pump.

The 1A RHR pump failed to start due to an overcurrent protection relay tripping on the A phase. This relay was swapped with the C phase relay, and the pump was successfully started.

It was determined that the A phase draws slightly more starting current than the other two phases due to the motor characteristics, and that the setting for the A phase relay was at the low end of its tolerance band.

This relay was recalibrated and returned to service.

The cause for the failed solder fitting was due to a combination of a malfunc-tioning timer on the heater control for the instrument air dryer and the asso-ciated troubleshooting and repair activities.

The heater control timer was repaired and a power transformer was replaced.

The fitting was brazed along with other affected fittings, and the system returned to service.

A protective step was installed over this line to prevent accidental striking or impingement l

which could lead to a possible failure or possible line rupture.

The leakage from both low head SI pumps was determined not to be from the seals, but from a failed 0-ring and gasket assembly on several of the seismic wedge control rods that penetrate the pump casings.

The failure of the 0-rings is attributable to end-of-life aging.

These rods were installed undev a design change package in 1980 as part of a seismic upgrade modification.

These rods l

8 I

L

adjust wedges that are intermittently spaced along the shaft pump casing to dampen any vibration during a seismic event.

The cause of the gasket failure is postulated to be from a minor flow induced pressure transient during pump start /stop which was sufficient to blow out the gaskets and extrude two 0-rings.

These control rod seals normally operate under pump suction pressure.

The minor pressure transient was determined to be less than or at worse case limited to the lift setpoint of the commonly installed discharge relief valve.

Since the l

pressure rating of this relief valve is lower than the design pressure rating of the suction piping and the pump casing, no damage to the piping / casing could have occurred due to the pressure transient.

The low head SI pumps were re-paired by replacing all the 0-rings and gaskets on each pump and ensuring that the gasket seals were properly tightened to accommodate pressure transients.

After repairs, surveillance tests were performed on both pumps.

No leakage was observed on either pump.

(Refs. 3-5.)

1.3 Reactor Coolant Pump Seal Damage at St. Lucie On August 8, 1985, with St. Lucie Unit 2* operating at near full power, a reactor trip occurred when both main steam isolation valves (MSIVs) were closed by a spurious A side engineered safety features actuation signal (ESFAS). Oper-ator error during the post-trip response caused a B safety injection actuation signal (SIAS) due to low reactor coolant system (RCS) pressure.

As designed, no water was actually injected to the RCS because RCS pressure remained above the shut-off head for the high pressure safety injection (HPSI) pumps.

However, due to the existing electrical system arrangement, the SIAS actuations deener-gized the reactor coolant pump (RCP) seal cooler heat exchanger isolation valves.

Without cooling, RCP seal damage resulted.

This event is of interest because of the multiple power supply failures, the related systems interactions, and the RCP seal damage that occurred.

During this event, however, all safety equipment actuated as required and functioned as designed, and all plant param-eters remained within the design basis of the plant.

The event is detailed below.

At 2:02 a.m. on August 8, 1985, the reactor was at 99% power with all systems o;2 rating in their normal mode.

No maintenance or surveillance was in progress.

The event was initiated by a spurious loss of power to the A ESFAS system relays.

These relays are deenergized to actuate, so an A SIAS, containment isolation, and main steam isolation were actuated. The reactor tripped on low steam generator l <(

water level immediately after the MSIVs closed. The main steam safety valves (MSSVs) opened.

The RCS pressure increase actuated the pressurizer power oper-ated relief valve (PORV) for nine-tenths of one second; PORV reseating was con-firmed by observation of the acoustic monitor.

The auxiliary feedwater actua-tion signal started all three auxiliary feedwater (AFW) pumps and initiated full AFW flow to both steam generators.

The immediate actions for a reactor trip were carried out; then one licensed Reactor Control Operator (RCO) assumed control of the atmospheric steam dump valves (ADVs) while the other licensed control room personnel (operators) began investigating the spurious A ESFAS actuation.

• St. Lucie Unit 2 is an 827 MWe (net) MDC Combustion Engineering PWR located 12 miles southeast of Ft. Pierce, Florida, and is operated by Florida Power and Light.

9

4 Several minutes later, the Assistant Nuclear Plant Supervisor (ANPS) noted that RCS pressure and temperature were below normal and reviewed the actions of the RCO controlling the ADVs.

The ANPS observed that AFW flow was maximum and the i

ADVs were excessively open.

The ANPS ordered the ADVs closed and the AFW throt-tied to the required value.

These actions terminated the RCS pressure drop with RCS pressure just above the SIAS setpoint (1580 psia). At 2:09 a.m., the 2A1 and 2B2 RCPs were secured due to approaching 10 minutes since the A SIAS had secured component cooling water (CCW) flow to the RCP seal cooler heat ex-j

. changers.

It should be noted that isolation of CCW to the RCP seal cooler heat exchangers was the result of the electrical supply arrangement to the heat ex-changer isolation valves and not the CCW containment isolation valves, which can be overridden. Just seconds after the RCPs were secured, a B SIAS was actuated on low RCS pressure.

The operators evaluated the B SIAS and determined it was duo to the excessive RCS cooldown.

The operators directed their attention to restoring RCS pressure to normal, and to investigate the cause of the spurious ESFAS.

Nine minutes after the B SIAS actuated, the other two RCPs (281 and 2A2) were secured because of approaching the 10-minute limit since their RCP seal cooler heat exchangers were isolated.

Natural circulation of the RCS was initiated with one RCO assigned to manually control RCS pressure and temperature using manual control of pressurizer heaters and auxiliary spray, and manual control of AFW flow and ADV position. At 2:23 a.m.,- the RCS pressure recovery reset the 8 SIAS, and by 2:30 a.m., natural cir-culation of the RCS was confirmed.

At 2:41 a.m., the B HPSI and low pressure safety injection (LPSI) pumps and diesel generator were secured and returned to their automatic actuation lineup.

One minute later, two PORV actuations were recorded due to the RCO manually l

controlling RCS pressure near the setpoint.

For the next 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> the RCS was held stable in natural circulation while troubleshooting the spurious A ESFAS.

At 3:28 a.m., the A HPSI and LPSI pumps were secured by placing their control switches in "off."

l-At 5:50 a.m., a blown fuse in the A ESFAS actuation cabinet was discovered and replaced.

The A ESFAS signals were reset.

The A diesel generator was secured.

4 The A HPSI and LPSI pumps and the A diesel generator were returned to their automatic actuation lineup.

At 6:31 a.m., RCP 2B1 was started.

Ten minutes later, RCP 2A2 was started and RCS cooldown was commenced.

One lesson to be learned from this event is that the testing of the ba.kup power supply should be conducted with loads equivalent in size and duration to those encountered in service.

The cause of the reactor trip was closure of both MSIVs due to the spurious ESFAS actuation. The actuation occurred because both the A and C power supplies for the A ESFAS actuation relays were deenergized.

The A power supply was deenergized by a loose connection in a fuse holder in the 125 V ac input power circuit.

The C power supply for the A actuation re-lays was lost when an erroneously installed undersized fuse blew as the C power supply picked up the load.

A previous identical event in which the same C power supply fuse blew occurred on November 29, 1984.

After that event the root cause of the fuse failure was not revealed because the post-trip investigation was j

concluded after several manual cycles of the A side power supply breaker did not reproduce the fuse failure.

The conclusion at that time was that the fuse 10

-c

.n n

--.~.--,n,----~,---n..-

r failure was a random event.

After this second event an underlying problem was suspected, so the A power supply breaker was opened and left open for several minutes.

The fuse blew after 2 minutes; the undersized fuse was discovered after the technical manual was consulted.

The fuse installed was a Littelfuse Model 313-003-3AG rather than the required Model 313-015-3AG.

It is assumed the wrong fuse was installed due to a personnel error by a Utility Instrument and Control Technician who did not understand the fuse size coding.

The cause of the valid 8 SIAS was a personnel error by a utility licensed oper-ator, since the operator failed to closely monitor the RCS parameters.

The operator distractions caused by the ESFAS actuations were exacerbated by the electrical scheme in that the SIAS actuation deenergized the nonsafety grade control instrumentation, including strip chart trending recorders.

This loss of power, and the resulting interruption of CCW, also caused the RCP seal fail-ures and is discussed below.

The two PORV actuations during manual RCS pressure control also were personnel errors in that the operator was controlling RCS pres-sure too high.

This resulted from the long-term containment isolation which secured RCS letdown.

The secured RCS letdown caused the operator some concern for rising pressurizer 1cvel, and resulted in his limiting the use of charging pumps to provide auxiliary pressurizer spray.

The cause of the RCP seal damage was the electrical supply arrangement.

At the time of this event, the RCP seal cooler heat exchanger isolation valves and the control room nonsafety grade control instruments were powered from the "non-essential" section of the safety-related load centers.

The result was that although power was available, the "non-essential" section supply breaker could not be re-closed because of the SIAS lockout.

The A side RCP seal coolers and nonsafety instruments were deenergized for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> as a result of the spurious A ESFAS actuation.

The B RCP seal coolers and nonsafety instruments were de-energized for 14 minutes as a result of the B SIAS actuation.

It should be noted that even with the spurious A ESFAS actuation, this coul' have been a routine reactor trip except for the effect of the electric power supply arrangement which existed at the time of the event. This arrangement allowed an SIAS actuation to cause RCP seal damage and caused control room instrumentation conditions adverse to operator response.

i Other systems affected by deenergizing the ESFAS relays were the A containment spray actuation signal and the A recirculation actuation signal.

The availabil-ity of these systems was not affected, only their automatic feature; i.e., these A train systems could have been actuated manually. The redundant B train systems l

were not affected and were available to provide the affected functions through-out the event.

I

(

As corrective actions, the loose fuse holder connection was tightened.

Similar j

fuse holders were examined.

Training and procedures for proper fuse replacement l

were developed.

All RCP seals were replaced and a plant change was implemented to power the RCP seal cooler heat exchanger isolation valves and the control l

room nonsafety-related instrumentation from a source which is not deenergized l

by an ESFAS actuation.

(Ref. 6.)

11

{

1.4 Blackout Signal and Interaction Event Between Units at Catawba On August 15, 1985, Catawba Unit I was operating at 95% power and Unit 2* was undergoing preoperational testing.

While a Unit 1 Nuclear Equipment Operator (NEO) was performing a routine operability test on diesel generator (DG) 18, he actuated the wrong breaker, which caused a blackout signal.

The Unit 1 contain-ment chilled water chillers tripped and containment pressure began to rise.

A Unit 2 Nuclear Control Operator (NCO), who was in the process of making up the Unit 2 volume control tank (VCT), came over to Unit 1 to assist in recovering from the blackout.

The blackout also caused a Unit 2 VCT outlet valve to close.

With flow from the positive displacement charging pump taking suction from the refueling water storage tank (RWST) still being supplied, level and pressure in the Unit 2 VCT continued to rise out of control until the VCT was full and potentially overpressurized.

This event is of interest due to the systems interaction that occurred and the associated operator errors, altnough the event did not result in any significant consequences.

The event is detailed below.

At about 10:30 p.m. on August 15, 1985, the NEO was sent to perform a routine operability test on DG 18.

The DG was started, but on the NE0's first attempt to parallel DG IB with the IETB bus (normal incoming breaker) within 60 seconds, che chart paper for the DG visicorder became jammed and the test had to be halted.

DG 1B was shut down, and was restarted at about 10:53 p.m.

The NEO then tried to close IETB-18 (DG breaker) to parallel the DG onto the IETB bus.

The breaker would not close, so the NEO reached up and adjusted the synchro-scope to match the DG's frequency to that of the IETB bus.

While still observ-ing the synchroscope, the NE0 reached down with his other hand and inadvertently pressed the "open" pushbutton for the breaker supplying normal incoming power, 1ETB-3.

This breaker tripped open, causing an undervoltage condition on the IETB bus. The DG 18 sequencer actuated. After a sustained loss of voltage for 8.5 seconds, the bus load shed, and the IETB-18 breaker closed.

The se-quencer then allowed all load groups to reenergize in 2-second intervals.

At 10:45 p.m., upon loss of power to motor control center (MCC) IEMXB, the con-tainment chilled water chillers A and 8 tripped. Shortly afterwards, containment pressure began to rise until it reached a maximum of 0.4 psig.

Because the two Unit 1 NCOs were busy recovering from the blackout, the Unit 2 NCO came over to the Unit I controls to reduce containment pressure by opening four contain-ment air release and addition valves. At 11:09 p.m., chillers A and B were re-turned to service, and cont 'nment pressure had been restored to normal condi-tion by 11:17 p.m.

Upon initiation of the blackout logic, the turbine driven auxiliary feedwater (AFW) pump No. 1 auto-started as designed. Due to the radioactive sodium iso-tope Na24 being used in the moisture carryover test on the secondary side of Unit 1, there was concern that a radioactive release may have occurred since the exhaust steam from the AFW turbine is routed to the atmosphere.

Health Physics was contacted to sample the secondary side of the steam generators to

• Catawba Units 1 and 2 are 1145 MWe (net) MDC Westinghouse PWRs located 6 miles north northwest of Rock Hill, South Carolina, and are operated (Unit 2 being in preoperational testing) by Duke Power.

12

I determine if any radiation limits had been exceeded.

It was found that no re-leases of the sodium isotope to the atmosphere had occurred.

Recovery from the incident began at about 10:57 p.m., when the sequencer was reset.

Then, all the loads that were energized by the sequencer which were not needed for plant operation at that time were shut down.

Breaker 1ETB-3 was closed, breaker 1ETB-18 was opened, and DG IB was shut down.

Before the Unit 2 NC0 came over to Unit 1 to assist in recovering from the black-out, he was in the process of making up the Unit 2 VCT.

This is accomplished by opening either valve 2NV252A or 2NV2538 [ chemical and volume control system (designated as "NV" by this licensee) pumps' suction from the RWST) until VCT level returns to normal. When the blackout occurred on Unit 1, power was lost to MCC aMXH, which was being fed by Unit I load center IELXB.

MCC 2EMXH sup-plies 120 V ac panel 2EKPH, which provides control power to certain interlocks which will close 2NV1898 (VCT outlet isolation) and open 2NV253B on a loss of voltage from 2EKPH.

Therefore, the Unit 1 blackout caused the outlet of the Unit 2 VCT to be isolated with flow from the Unit 2 RWST still being supplied by the positive displacement pump. When the Unit 2 NCO returned to the controls, level in the VCT had increased to almost 100%, and pressure had increased to about 80 psig.

The control switch for valve 2NV172A (three-way divert to the VCT/ recycle holdup tank) was in the VCT position, and therefore did not divert on high level.

Reactor coolant system letdown to the VCT was immediately secured and pressurizer power operated relief valve (PORV) 2NC34A was opened to stop flow pressure input. When 2NV1898 was opened, VCT level and pressure were rapidly restored to normal.

When the Unit 2 NC0 left the control board unattended to assist in lowering Unit 1 containment pressure, he was unaware that the blackout on Unit I would cause the VCT outlet valve to close and the valve supplying makeup to the VCT to open, thus increasing level and pressure above normal conditions.

If the NCO had been present, this situation could have been prevented.

Prior to this incident, Unit 2 NCOs were allowed to perform work on Unit 1 if it was necessary, provided proper turnover status was given.

MCC 2EMXH, which should normally be aligned to Unit 2 power, was being fed by 1ETB because IETB had an operable backup DG, whereas 2ETB did not at that time.

Further investigation showed that the normal power to the controlling relays in the valve motor operator circuits is not strictly unit related.

Train A relays for both units' valves are fed from Unit 1 power, and Train B relays for both units' valves are fed from Unit 2 power.

As a result of this incident, there was concern that the Unit 2 VCT may have been overpressurized. An overpressurization of the Unit 2 VCT had occurred earlier this year during cold hydrostatic testing, resulting in the rupture of the tank.

An investigation was initiated to determine the amount of pressure the tank had been subjected to.

The level trace and alarm typer showed that the NCO shut down the reciprocating charging pump, which was supplying about 12 gpm of input to the Unit 2 VCT, at roughly the same time the indicated tank level reached 100%.

After 100% indication is reached, there is still an addi-tional 15% volume available in the VCT.

Further licensee investigation showed that the Unit 2 VCT had not been overpressurized.

i 13 1

The problem with containment pressure increasing above the technical specifica-tion limit of 0.3 psig to a high of 0.4 psig was caused by the loss of the con-tainment chillers.

This resulted from an optical isolator in the control cir-cuit of nuclear service water (RN) valve IRN4378 (outside isolation supply to lower containment ventilation units) that is normally energized by IEMX8, and trips the chillers upon loss of power.

Chiller high temperature indication in the control room consisted of the " operable" light going out. More positive control room indications probably would have identified the problem of the loss of the chillers earlier.

Subsequently, the licensee initiated a station modi-fication to provide a control room annunciator on high chiller temperature.

An intrastation letter was issued to Shift Supervisors on August 16, 1985, stating that Control Room Operators assigned to Unit 2 will under no circum-stances be used on Unit 1, or vice versa.

This order can only be overridden by the Shift Supervisor during emergency situations.

A review was conducted of the loads powered from MCC IEMXG and 2 EMXH and their panels.

The NV valve control circuits (1 and 2NV188A, 252A, 1898, and 2538) were the only unit related loads supplied from these busses.

These control circuits will be moved to unit related power sources from the same units as the associated valves.

The licensee has determined that this was an isolated case in which the NV control circuits were not assigned to the proper unit panel.

The onsite DGs provide class IE power to specified equipment in the event that the normal system power becomes unavailable.

The system functioned as designed when power was lost to the essential switchgear by automatically starting, load-ing, and operating until normal system power could be restored.

Therefore, Operations had the capability to safely shut the plant down if the need had arisen.

(Refs. 7 and 8.)

1.5 High Pressure Coolant Injection System Inoperability Due to Error in Electrical Connections at Cooper At 3:02 p.m., August 24, 1985, the high pressure coolant injection (HPCI) system at Cooper

• was declared inoperable during startup from an extended refueling and pipe replacement outage.

During surveillance testing to prove auto-initiation operability, the turbine tripped on overspeed.

Reactor pressure was approximately 940 psig, and reactor power was approximately 6%.

The reactor had been critical for about 4 days.

The HPCI system had been successfully tested at 160 psig on August 21, 1985.

Upon declaration of system inoperability on August 24, the active components of the other coolant injection systems and the automatic depressurization system were promptly tested and verified operable in accordance with technical specifications.

Subsequent troubleshooting determined that the electrical connections between the governor control and the governor valve electro-hydraulic servo were in error, causing the governor valve to fail full open.

The system was successfully retested and returned to service approx-imately 25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> after it was declared inoperable.

Applicable operating proce-dures have been revised to functionally test the HPCI povernor control system during the low pressure surveillance testing.

The event is detailed below.

• Cooper is a 764 MWe (net) MDC General Electric BWR located 23 miles south of Nebraska City, Nebraska, and is operated by Nebraska Public Power.

14

At 3:02 p.m., on August 24, 1985, the HPCI system turbine tripped on overspeed during surveillance testing to demonstrate auto-initiation operability.

The HPCI system was immediately declared inoperable.

Startup activities were in progress following an extended outage for refueling and pipe replacement.

Upon declaration of HPCI inoperability, the active components of the other coolant injection systems (reactor core isolation cooling, low pressure coolant injection and both core spray subsystems) and the automatic depressurization system were promptly tested and verified operable in accordance with technical specifications.

During troubleshooting following the trip, the governor electronics were cali-brated and found satisfactory. Although the electro-hydraulic servo (EGR) had been replaced earlier during the outage as part of equipment qualification retrofits, the EGR was again replaced and the turbine retested unsuccessfully.

Further troubleshooting found that the two wires between the governor control unit (EGM) and the EGR were reversed at the EGM. With the control wires re-versed, the actions of the hydraulic servo and, likewise, the governor valve, were reversed.

Upon system initiation, the governor valve remained full open, overspeeding the HPCI turbine.

The mechanical overspeed trip functioned properly to trip the HPCI turbine and prevent damage.

The two EGR wires were restored to their proper positions and the turbine retested successfully.

About 25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> elapsed from the discovery of the failure until the system was returned to service.

The wire reversal occurred during the 1984/1985 refueling and pipe replacement outage, most probably during modification activities involving the electronics of the HPCI turbine Woodward governor system. Quality control for the modifica-tion consisted of assembling the wiring in its as-built condition before remov-ing any components and performing an independent quality control inspection to verify proper reconnection.

Post-modification acceptance testing to verify proper reconnection consisted of performing Surveillance Procedure 6.2.2.3.17, "HPCI Control System Calibration Test." Part A of the procedure had been per-formed.

Part B of the procedure required HPCI operation at 3000 to 3500 rpm, and was scheduled to be performed in conjunction with the auto-initiation test.

After repair and successful retest of the system, Part 8 of the surveillance was performed successfully.

It is important to note that when the HPCI system was tested on August 21 at 160 psig, the wire reversal was not detected.

The surveillance procedure used to verify HPCI operability at 150 psig (6.3.3.1) instructs the operators to set the flow controller at rated flow, 4250 gpm.

The valves are aligned such that the pump discharges through a restricting orifice and back to the emergency condensate storage tanks.

This is referred to as the " test loop mode," and is designed to simulate a discharge to the reactor vessel under rated conditions without actually injecting water into the reactor.

At rated reactor pressure, HPCI will deliver 4250 gpm at a discharge pressure of 1060 psig in the test mode.

At a reactor pressure of 160 psig, HPCI will deliver 3350 gpm at a pressure of 670 psig in the test mode.

Because the controller is set at 4250 gpm, the gov-ernor valves are not required to throttle if reactor pressure is only 160 psig.

However, if HPCI was actually initiated to inject to the reactor vessel at a reactor pressure of 160 psig, the pump would easily achieve 4250 gpm and the governor valves would be required to throttle to avoid overspeeding the turbine.

If the EGR was nonfunctional, the turbine would trip on overspeed.

In summary, any failure of the governor system which would cause the governor valve to fail open would not be detected by a rated flow test in the test mode at a reactor pressure of 150 psig.

15

To prevent recurrence, a procedure change was made so that any similar failure in the future would be discovered during performance of the HPCI operability test at 150 psig.

The procedure (6.3.3.1) will require that following the rated flow test, the operator should adjust the flow controller setpoint to decrease flow by 500 gpm.

Pump runback and flow stability should then be verified.

This will functionally test the entire flow control and governor subsystem.

(Ref. 9. )

1. 6 Diesel Generator Battery Charger Inoperable at Catawba During an investigation on August 19, 1985 into the cause of indicating light socket shortings on the Catawba Unit 1* diesel generator 1A battery charger (IDGCA) and diesel engine (DE) 1A control panel, it was discovered that 1DGCA had been inoperable from 2:47 p.m. to 8:30 p.m. on July 29, 1985, and the condi-tion had gone unrecognized.

Thus, the availability of alternate power sources was not verified as required by Technical Specification 3.8.1.1.

Unit I was in power operation in the process of power escalation at the time of the event.

The event was caused by a combination of design deficiency, perso'nnel error, and procedural deficiency.

It is detailed below.

The Train A 125 V dc essential diesel auxiliary power system consists of a bat-tery (IDGBA), a battery charger (1DGCA), and a distribution center (1DGDA).

Charger IDGCA, which is manufactured by Power Conversion Products, is fed from a 600 V ac motor control center, and supplies power to the diesel de loads while maintaining IDGBA on float charge.

Inside battery charger IDGCA, power trans-former T1 changes the ac input voltage to a required level.

T1 has three 2-amp fuses connected to its secondary side.

These fuses supply voltage to the char-ger internal circuitry, such as the silicon control rectifier (SCR) firing module and alarms. The power failure relay K1, connected downstream of 1-amp fuses F5 and F6, monitors the ac input to indicate ac power failure. When a power failure occurs, a reflash module, " battery charger 1 DGCA trouble," alarms.

This reflash module will cause a control room annunciator,125 V dc "DG 1A con-trol power system trouble," to alarm.

Also connected downstream of fuses F5 and F6 at the same connection point of relay K1 is an "ac-on" pilot light.

This light indicates that ac power is supplied to the SCR firing module.

The charger de output voltage is measured by a voltmeter which is mounted on the front panel of the charger.

This voltage normally reads 132 V on float charge.

Also connected downstream of the voltmeter are the batteries.

Therefore, if ac input is lost, the voltmeter will read battery voltage, which after a full charge, should be greater than 129 V.

The charger / battery assembly feeds into the DE control panel through 10 amp companion trip breakers CBS and CB6.

The "dc control power on" indicating light, manufactured by Cutler Hammer, provides the status of dc power to the DE circuitry.

If dc control power is lost to the DE circuitry, a bypass alarm signifying "DG bypass" will be received in the control room.

Per Technical Specification 3.8.1.1, an operable battery charger and battery are required to be connected to each DG's control loads in power operation through hot shutdown modes.

If an operable battery charger causes the DG to be

• Catawba Unit 1 is a 1145 MWe (net) MDC Westinghouse PWR located 6 miles north northwest of Rock Hill, South Carolina, and is operated by Duke Power.

16

s inoperable, the operability of the remaining power sources must be demonstrated by performing specified surveillance requirements within I hour and at least once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter.

On July 29, 1985, a Nuclear Equipment Operator (NED) performing auxiliary build-ing rounds had noticed the "ac-on" indicating light on 1DGCA not lit. Upon removal of the light lens, he found that the bulb was missing. After the NE0 obtained a replacement bulb, he inserted it in the indicating light socket.

The bulb lit dimly and then burned out.

Another replacement bulb was inserted in the socket by the EEO.

This bulb also lit dimly.

At 2:47 p.m., when the NE0 moved the bulb in the socket in an attempt to make the bulb light brighter, IDGCA voltage and amperage increased rapidly and returned to normal.

The bulb then burned out.

After the NE0 had informed the Shift Supervisor of the problem, a work request was originated to investigate and repair the "ac-on" light fixture on IDGCA.

When the NE0 returned to the control room, the Unit 1 Operator at the Controls (0ATC) informed the NEO that a "125 V dc DG 1A contol power system trouble" annunciator had been received recently.

The 0ATC asked the NE0 to investigate and determine the cause of the reflash module alarm and then insure the battery charger breakers were closed as described in the annunciator response procedure.

After the NE0 checked the reflash module and saw the " battery charger 1DGCA trouble" alarm on, he proceeded to the charger.

After he investigated the charger, he found all breakers closed and voltage and amperage readings close to normal. These findings were reported to the OAlC.

However, the NEO never reset the reflash module.

From this time until the end of the shift, the cause of the alarm was pursued no further by either the OATC or the NE0 due to other items in progress concerning reactor power escalation.

At about 7:00 p.m. on July 29, the relief shift arrived.

When the oncoming Shift Supervisor and the offgoing Shift Supervisor were reviewing the control board, the oncoming Shift Supervisor noticed the "125 V dc DG 1A control power system trouble" annunciator in the alarm mode.

The offgoing Shift Supervisor informed him that they had trouble with the charger "ac-on" bulb earlier, but did not realize an alarm had been received.

At 7:30 p.m., the Unit 1 Supervisor cal. led an Instrumentation and Electrical (I&E) Supervisor to verify the opera-bility status of 10GCA. When the I&E Supervisor measured battery IDG8A voltage, he found it to be 3 V below the technical specification limit of 125 V.

After the Shift Supervisor was informed of the low battery voltage at 8:30 p.m., DG 1A was declared inoperable.

From 9:00 to 9:25 p.m., periodic tests were performed as required by Technical Specification 3.8.1.1.

When I&E investigated the reason for the decrease in battery voltage, they found that fuses F5 and F6 in IDGCA were blown.

They concluded that when the NE0 moved the light in the socket earlier, a short circuit had occurred, blowing the fuses as a result.

1&E then installed test fuses to verify charger oper-ability.

After the test proved successful, fuses were obtained from Unit 2 2DGCA and placed in IDGCA (spare replacement fuses were not available).

DG 1A was declared operable at 8:30 a.m. on July 30, 1985.

On July 31, 1985, a similar type incident had occurred.

The NEO who had been involved in the incident on July 29 discovered that the "dc control power on" indicating light on DE panel 1A was inoperable. When the NE0 replaced the bulb, a short circuit occurred at 11:00 a.m.

A bypass alarm in the control room was 17

received, indicating "DG 1A bypass." An immediate investigation into the cause of the alarm revealed that breakers CBS and CB6 in the DE panel 1A had tripped when the bulb shorted. A work request was originated to repair the indicating light socket, DG 1A was declared inoperable at 11:25 a.m., and periodic tests were performed as required by Technical Specification 3.8.1.1.

At about 3:00 p.m., I&E determined that the socket was unrepairable and thus removed it.

At 1:12 a.m., on August 1,1985, socket replacement was completed, and breakers CBS and CB6 were closed.

DG 1A was subsequently declared operable at 1:20 a.m.

On July 29, 1985, when the NEO had been asked by the OATC to check the charger for a problem, he found everything satisfactory, including the voltage reading on the charger.

Even though the charger was producing no output voltage because of the blown fuses, the voltage reading was normal due to the fact the the volt-meter was reading battery vcitage.

This led the NEO to believe the charger was still operable even though it was not.

If the voltmeter only read charger out-put voltage, the voltmeter would have read "0" when the NEO arrived at the charger. This would have indicated to him that the charger was inoperable, and immediate corrective action would have been taken to correct the problem.

Therefore, this constituted a design deficiency.

After the NE0 could not find a problem with the charger, he had informed the control room.

The OATC then assumed that the only reason the "125 V de DG 1A control power system trouble" annunciator was in alarm was because the reflash module had not been reset by the NEO.

Shortly after the NEO had called the control room, the OATC began to get involved with the items involving reactor power escalation.

The OATC did not pay attention to the alarm the remainder of the shift.

Also, the NEO was supposed to reset the reflash module after check-ing the charger, but did not.

If the OATC.had continually pursued clearing the alarm, such as asking the Shift Supervisor to call I&E or reminding the NE0 to reset the reflash module, the charger problem may have been found.

If the NEO had returned to reset the reflash module, he would have found that the alarm would not clear. This would have alerted the NEO that an undetected problem was present, and the proper corrective action could have been performed.

There-fore, this constituted a personnel error.

A procedural deficiency also was involved.

When the NEO and 0ATC referred to the annunciator response for "125 V dc DG 1A control power system trouble," the immediate and supplemental actions were not adequate to prevent this event.

The response procedure instructed the NEO to check the reflash module and battery charger breakers. This was performed by the NEO.

The response should be ex-panded to tell the OATC to immediately declare the DG inoperable, contact I&E and begin verifying the availability of alternate power sources.

This would have prevented the event.

During the incident on July 29, 1985, IDGBA voltage decreased to a value less than the technical specification limit.

If DB 1A had been called upon to start, it would have, but would have only run for about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> before 1DGBA had drained to a point where sufficient dc voltage was not being supplied to its control circuitry. The batteries would not have charged because of the blown fuses.

However, if there was a need for a diesel to start, DG IB was operable and available.

Also, there were no disturbances with respect to the offsite power system while the charger was inoperable.

1 18

During these incidents, the same NEO performed bulb replacements.

This NE0 is a qualified individual and has performed many such replacements before without incident. However, these Cutler Hammer " slide in" bulb sockets are apparently very susceptible to short circuits.

For example, two other incidents at Catawba Unit I, described in Licensee Event Reports 50-413/85-22 and 50-413/85-27, in-volved Cutler Hamer " slide in" light socket shortings.

The licensee took the following corrective actions:

For the first light socket problem, fuses F5 and F6 were replaced in charger IDGCA. The Shift Supervisor discussed with his shift the importance of continually pursuing action to clear annunciator alarms that are unexpectedly received.

For the second light socket problem, the socket was replaced, and breakers CBS and C86 were closed to return DG 1A to operation.

The annunciator response procedure "125 V dc DG A and 8 control power sys-tem trouble" will be revised to give more adequate immediate and supple-mental actions.

Station problem reports will be initiated to (1) replace the present type of light sockets and control circuitry with screw-in type sockets, and (2) modify all plant battery charger circuitry so that the charger de out-put is the only voltage read by its voltmeter.

(Ref. 10),

19

1.7 References (1.1) 1.

Commonwealth Edison, Docket 50-237, Licensee Event Report 85-34, September 11, 1985.

2.

NRC, Region III Inspection Reports 50-010/85-14, 85-237/J5-31, 85-249/85-27, September 23, 1985.

• (1.2) 3.

NRC, Preliminary Notification PNO-I-85-62, August 29, 1985.

4.

Duquesne Light, Docket 50-334, Licensee Event Report 85-15, September 26, 1985.

5.

NRC, Region I Inspection Report 50-334/85-18, September 10, 1985.

(1.3) 6.

Florida Power and Light, Docket 50-389, Licensee Event Report 85-08, September 9, 1985.

(1.4) 7.

NRC, Region II Inspection Reports 50-413/85-35 and 50->?.4/85-32, September 9, 1985.

8.

Duke Power, Docket 50-413, Licensee Event Report 85-51-0.L.

November 21, 1985.

(1.5) 9.

Nebraska Public Power District, Docket 50-298, Licensee Event Report 85-08, September 23, 1985.

(1.6) 10. Duke Power, Docket 50-413, Licensee Event Report 85-53, September 13, 1985.

These referenced documents are available in the NRC Public Document Room at 1717 H Street, Washington DC 20555,for inspection and/or copying for a fee.

(AE00 reports may also be obtained by contacting AE00 directly at 301-492-4484 or by letter to USNRC, AE00, EWS-263A Washington, DC 20555.)

20

_ = - _

s 2.0 EXCERPTS OF SELECTED LICENSEE EVENT REPORTS On January 1,1984,10 CFR 50.73, " Licensee Event Report System" became effec-tive.

This new rule, which made significant changes to the requirements for licensee event reports (LERs), requires more detailed narrative descriptions of the reportable events. Many of these descriptions are well written, frank, and informative, and should be of interest to others involved with the feedback of operational experience.

This section of Power Reactor Events includes direct excerpts from LERs.

In general, the information describes conditions or events that are somewhat un-usual or complex, or that demonstrate a problem or condition that may not be obvious.

The plant name and docket number, the LER number, type of reactor, and nuclear steam supply system vendor are provided for each event.

Further information may be obtained by contacting the Editor at 301-492-9752, or at U.S. Nuclear Regulatory Commission, EWS-263A, Washington, DC 20555.

Excerpt Pajte 2.1 Primary Containment Group I Isolation and Core Spray Injection Due to Deviation from Plant Procedures and Installation of Incorrect Relay............................................

22 2.2 Reactor Trip and Engineerec Safety Features Actuation Due to Faulty Power Supply on Nuclear Instrumentation Channel.....

24 2.3 Mechanical Draft Cooling Tower Bypass Valve Deenergized Closed Due to Operator Error......................................

25 2.4 Residual Heat Removal Shutdown Cooling High Suction Flow Switch Inoperable Due to Reversed Piping...................

28 2.5 Emergency Service Water Pipe Coating Failure Results in Partial Plugging of Heat Exchanger Inlet Tubesheets........

29 2.6 Pressurizer Power Operated Relief Valves Open in Cold Shutdown During Efforts to Stabilize Pressure Following Reactor Coolant Pump Start.................................

31 2.7 Reactor Core Isolation Cooling System Inverter Failure.....

31 2.8 Reactor Trip Following Non-1E Instrument Bus Transient.....

32 21

j

?

2.1 Primary Containment Group.I Isolation and Core Spray Injection Due to t

Deviation from Plant Procedures and Installation of Incorrect Relay Brunswick Unit 1; Docket 50-325; LER 85-39-01; General Electric BWR On July 30, 1985, at 2236, while Unit I was in a refueling / maintenance outage, a reactor low level No. 3 loss-of-coolant accident (LOCA) signal occurred, re-sulting in an automatic initiation of the 1A core spray (CS) system.

Emergency ac diesel generators (D/Gs) 1, 3, and 4 automatically started on the LOCA signal and a primary containment Group 1* isolation occurred on a low level No. 2 signal.

At the time of the event the reactor was defueled with the vessel head removed, the reactor refueling cavity flooded, and the fuel pool gates removed.

t[

The IB CS system and D/G 2 were under equipment clearance and the suppression chamber was drained for plant modification work.

An estimated 25,000 gallons were pumped to the reactor, flooding the reactor refueling cavity and fuel pool m

and overflowing into the reactor building via the building heating ventilation and air conditioning (HVAC) ducts.

The 1A CS system was manually secured within 3 minutes of the event.

Starting logic relays in the CS system (K10C and D) overheated, caught fire, and were extinguished within 7 minutes.

Recovery actions to permit recommencement of the refueling / maintenance outage activities were performed.

5 The initiating cause of tb. event is attributed to a venting evolution during plant modification work.

.erformance of the plant modification required that an equipment clearance be placed on the instrument process isolation valves I

sharing the same reference / variable legs.

Due to the length of time required j

to complete this modification, the clearance was partially removed to allow work to be performed on anothar plant modification.

Plant procedures require that when a modification is to deviate from the prescribed sequence, an appro-priate revision be written to assure proper steps / precautions are taken.

In this case, when the subject equipment clearance was partially removed (an out-of-sequence step), a field revision to the plant modification should have been F

written to assure that clearance was reestablished prior to proceeding with subsequent steps.

The variable sensing leg to reactor level instrument B21-LT-N026A was vented.

A slight depressurization of the variable leg resulted, causing reactor level instruments sharing the same leg (821-LT-N031A and C and 821-LT-N024A-1 and B-1) to see false low level Nos. 2 and 3 level signals.

The false signals resulted in the incurred Group 1 isolation and CS system initiation.

The incurred failure of CS starting logic relays K10C and D resulted from the installation of an incorrect relay type under a plant modification during the ongoing refueling / maintenance outage. An investigation revealed ac type relays had been installed within the CS starting logic, which is dc powered.

The sub-ject relays were installed as part of an in progress containment instrument air isolation modification.

These relays had been bench tested prior to installa-tion.

The bench test procedure did not specify the type of relays (ac or dc).

The technician subjected the relays to an ac source and they performed satis-factorily.

The relays ordered for installation were ac relays.

This error has been traced to an error on a Bill of Material.

Acceptance testing of function-ability of relays has not yet been performed.

During the acceptance test re-quired by the plant modification procedure, the incorrect relay problem would have been discovered.

• Group I: Main steam isolation valves, steam line drains, and reactor water sample lines.

22

=

A walkdown and inspection was performed on August 1, 1985, to assess the extent of water damage to electrical components in the Unit I reactor building.

The equipment inspected included 480 V motor control centers (MCCs); local con-trol panels on the -17', 20', 50', and 80' elevations; and selected electrical termination boxes on the 20' and 50' elevations northwest of the building.

Some general observations were made regarding the inspection:

(1) No water was found inside the panels inspected on -17', 50', or 80' elevations.

(2) The ma,iurity of wetted panels were located on 20' elevation northwest.

(3) The MCCs with the environmentally qualified (EQ) seals did not receive water inside the panels.

MCCs IXa, IXA2, and IXC, which had EQ seals recently installed, were wetted on the top and sides of the cabinet but remained dry inside. MCC IXDB had water on the inside bottom cover of the panel.

This is attributed to plugged floor drains in the vicinity as no evidence of moisture was found elsewhere inside the MCC. MCC IXJ, located in the northwest corner of the reactor building 20' ele-vation, sustained extensive water damage.

Since this is not a sealed unit, large amounts of water entered the cubicles causing widespread corrosion and sediment deposition.

This MCC has been reworked in accordance with a plant modification, which replaced starters, breakers, and associated components, and on September 4, 1985, it was returned to service.

This 480 V MCC does not supply safety loads and does not fall under NRC's IE Bulletin 79-018 for environmental qualification.

The SRM/IRM drive control instrument rack had water on the outside and inside bottom of the cabinet.

It is believed water entered through an electrical con-duit and ran down the side of the cabinet. Wetting of internal components in the cabinet was not apparent.

Several local panels, including the remote shut-down panel, were wetted on the outside only.

The licensce felt the effects of the flood were localized and of short duration.

Components whose operation was disrupted by the water have been reworked and returned to service.

This event was discussed with appropriate personnel to stress the importance of adhering to plant procedures with respect to plant modifications and equip-ment clearances.

Personnel directly involved with the failure to properly revise the subject plant modification procedure have been appropriately disciplined.

The plant Engineer Support Unit manual of instruction has been revised to provide for adequate identification of untested devices in plant technical specifica-tions-related operable systems or circuits.

It is felt this will help prevent future occurrences similar to the encountered improperly installed ac relays within a de circuit.

23

2.2 Reactor Trip and Engineered Safety Features Actuation Due to Faulty t

Power Supply on Nuclear Instrumentation Channel

=

Wolf Creek; Docket 50-482; LER 85-58; Westinghouse PWR On July 31, 1985, at approximately 0348 CDT, a reactor trip and engineered safety features actuation occurred as a result of an electrical spike on a power range nuclear instrumentation (NI) channel while another channel was out of service.

O Prior to this event, the plant was in power operation, at a reactor power level i

of approximately 86%.

At approximately 0340 CDT, power range NI chcnnel 43 had been taken out 01 service for surveillance testing.

With one channel out of service, the trip 'iogic is satisfied by a trip signal from one of the other L

three in-service channels.

At 0348 CDT, power range channel 42 spiked low, k

satisfying the negative rate trip logic, and resulted in a reactor trip and main turbine trip.

The reactor trip, coupled with a low reactor coolant system average temperature, initiated a feedwater isolation. When steam generator C water level reached the low-low level setpoint, a motor-driven auxiliary feed-3 water actuation and steam generator blowdown and sample isolation ~ occurred.

Shortly thereafter, a turbine-driven auxiliary feedwater actuation occurred when g

steam generator B water level also reached the low-low level actuation setpoint.

k All required engineered safety 'eatures and reactor protection system equipment performed their intended functions.

One equipment problem was noted:

there was no indication on the main control board of auxiliary feedwater flow to steam generator C.

However, the expected auxiliary feedwater flow to steam generator C was indicated at the auxiliary shutdown panel.

L During this event, pressurizer level decreased to approximately 20%, and reactor coolant system average temperature reached a minimum of 550 degrees Fahrenheit.

=

Water levels in all four steam generators reached the low-low level setpoint.

[

The power operated relief valve on steam generator C opened for approximately 3 minutes during this transient.

Normal feedwater flow was restored at approxi-mately 0431 CDT.

b During the restoration of normal feedwater flow to the steam generators, valve p

AL-HV-07, auxiliary feedwater flow control to steam generator A, was throttled F

closed and could not be reopened from the control room.

This valve had to be 2

partially opened manually before normal control could be established.

The prob-

[

able cause of this occurrence was a limit switch setting misadjustment, which has been corrected.

(Further discussion of this situation is provided in Licensee Event Report 50-482/85-054-00.)

r-;,

Two other valves, AL-HV-8 and AL-HV-10, turbine driven auxiliary feedwater flow 5-discharge valves to steam generators B and C, could not be reopened from the control room once they were closed and the turbine driven auxiliary feedwater pump had been secured.

These valves are normally in the full open position, and are throttled closed during restoration of normal feedwater flow.

In this instance, the valves had to be partially opened manually prior to restoration of normal control from the control room.

An investigation identified a potential reverse differential pressure condition which could restrict valve opening if r-E M

L 24

the turbine-driven auxiliary feedwater pump was secured while the valves are in the fully closed position.

The investigation also confirmed that the valves would be capable of remote opening if the turbine-driven auxiliary feedwater pump was energized because the potential reverse differential pressure condition could not exist, and since the valves are flow-assisted to open.

As an adminis-trative control to prevent this situation, the operating procedure governing securing of the turbine driven auxiliary feedwater pump has been revised to ensure the flow discharge valves are partially open prior to securing the pump.

Subsequent investigation into the problems with power range NI channel 42 revealed the existence of a faulty power supply.

The power supply was replaced, and NI channel 42 was tested, demonstrating operability and returned to service.

The faulty power supply was Model UPMD-X54W, manufactured by Power Designs, Inc.

Troubleshooting identified that the power supply had experienced internal arcing, resulting in a zero output signal.

The rate circuitry sensed the output changes and initiated a high-rate trip.

The power supply was disassembled and tcsted, but no further arcing was observed.

It has been returned to the vendor u inspection and evaluation.

Subsequent investigations also revealed that the lack of indication of auxiliary feedwater flow to steam generator C was due to a failed flow indicator which has been replaced. There was adequate flow to steam generator C as evidenced by the similarity between the level traces of all four steam generators, computer j

point indications, and auxiliary shutdown panel indication.

There was no damage to plant equipment or release of radioactivity as a result of this event, and at no time did conditions develop that may have posed a threat to the health and safety of the public.

2.3 Mechanical Draft Cooling Tower Bypass Valve Deenergized Closed Due to Operator Error Fermi Unit 2; Docket 50-341; LER 85-47; General Electric BWR At 1900 hours0.022 days <br />0.528 hours <br />0.00314 weeks <br />7.2295e-4 months <br /> on July 29, 1985, valve E11F603A was found closed and the motor control center (MCC) breaker feeding the valve was deenergized. The incident that prompted the discovery of valve E11F603A in the closed position was when alarm "EDG Service Water Pump A Water Flow Low" annunciated in the control room.

The alarm was received shortly after starting EDG #11 for surveillance test 24.307.14, " Emergency Diesel Generator No. 11 - Start and Load Test." Because EDG #11 was being run for a surveillance test only, the Nuclear Assistant Shift Supervisor (NASS) directed a reactor operation to shut down the diesel to deter-mine the cause of the alarm. While investigating the alarm, E11F603A was found closed. The valve was opened, thus restoring the flow path for Division I EDG service water.

E11F603A is the cold weather bypass valve in the Division I service water return line. With this valve open, and valves E11F604A and E11F605A in a parallel line to the mechanical draft cooling towers closed, service water return flow is bypassed from the mechanical draft cooling towers to the residual heat removal (RHR) reservoir. With all three of the above valves closed, the flow path for the return of Division I service water to the RHR reservoir was blocked.

25

r rr This blocked flow for Division I of the residual heat removal service water c'

(RHRSW) system, emergency diesel generator service water (EDGSW) system, and the E

emergency equipment service water (EESW) system.

In turn, Division I of the 6

core spray system and RHR systems, including low pressure coolant injection (LPCI), Division I EDGs #11 and #12, and Division I of the emergency equipment a

cooling water system, were inoperable.

The automatic depressurization system was not affected and was operable, r

IE Based on an investigation of this event, the Operation Group determined that 7

E11F603A had been closed at about 1319 hours0.0153 days <br />0.366 hours <br />0.00218 weeks <br />5.018795e-4 months <br /> on July 23, 1985.

With this valve i

closed, Division I emergency core cooling systems (ECCSs) that are dependent on j~

service water for proper operation and Division I EDGs were made inoperable.

On that day, E11F603A was used to modulate system flow during startup of the 2

Division I RHRSW pumps.

Normally, valve E11F068A is used for that purpose, but y

because of a previous problem the valve internals had been removed and the valve g

could not be used to control RHRSW service water flow.

[

To operate E11F603A, an operator has to be dispatched to the RHR complex to 5

energize the MCC breaker feeding the valve.

The normal condition for this valve 3

is to be in the open position with the breaker deenergized.

This is a gate s;

valve and is not intended to be operated with normal system differential pressure E

across the disc.

It has exhibited a tendency to trip either the thermal over-

=

loads or the torque switches during stroking and an operator has been required if to partially stroke the valve to the desired position as well as reset the ther-mal overloads to allow continued stroking from the control room.

Later that day, the Division I RHRSW system was shut down and a Power Plant Operator (PPO) was directed to the RHR complex to assist in restoring E11F603A to its normal condition.

However, the instructions given to the PPO were not entirely clear to him, because instead of leaving the valve open with the breaker deenergized, the PPO left the valve closed with the breaker deenergized.

This occurred at about 1319 hours0.0153 days <br />0.366 hours <br />0.00218 weeks <br />5.018795e-4 months <br /> on July 23, 1985.

When the valve breaker is deenergized, the valve position indicators on the g

control room panel are not lit, and therefore, the valve's position cannot be independently verified from the control room.

This factor contributed to the valve being left in the wrong position.

Another factor that may have contributed to leaving the valve mispositioned was that within minutes of the time the RHRSW system was being shut down on July 23, the plant had just begun, at 1315 hours0.0152 days <br />0.365 hours <br />0.00217 weeks <br />5.003575e-4 months <br />, a planned shutdown sequence.

Only one feedwater pump was in service at the time, and the operating feedwater pump was experiencing problems with a malfunctioning pressure switch.

In anticipation of a feedwater pump trip and resulting level control transient, the control room operators were directed to decrease reactor pressure to a point where the heater feed pumps could maintain water level if required.

It was at about this point, when the operators were making reactor pressure changes, that the PPO was deenergizing the breaker and valve E11F603A was left closed.

As noted above, on July 23, 1985, the plant commenced a planned rtactor shutdown at 1315 hours0.0152 days <br />0.365 hours <br />0.00217 weeks <br />5.003575e-4 months <br /> and was in startup. When in this condition, and with Division I core spray and LPCI inoperable, the plant was in an operating condition prohi-bited by the plant's technical specifications.

As such, the provisions of 26 i

e

technical specifications require that within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> action be initiated to place the plant in a operational condition in which the specification does not apply.

Since a reactor shutdown had already begun, the plant had to be in hot shutdown within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of the time E11F603A was left closed, or 1919 hours0.0222 days <br />0.533 hours <br />0.00317 weeks <br />7.301795e-4 months <br /> on July 23, 1985.

However, because at the time the operators did not recognize the plant was in a condition where the latter technical specification applied, the plant was not in hot shutdown until 1520 hours0.0176 days <br />0.422 hours <br />0.00251 weeks <br />5.7836e-4 months <br /> on July 24, 1985, about twenty hours beyond that required by technical specifications.

The plant was in cold shutdown at 0115 hours0.00133 days <br />0.0319 hours <br />1.901455e-4 weeks <br />4.37575e-5 months <br /> on July 25, 1985, which for the same reason was about 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> beyond the time prescribed by technical specifications.

The plant was still in cold shutdown 4 days later when E11F603A was found closed on July 29, 1985.

The reactor was at atmospheric pressure and about 130 degrees F.

Under this operational condition, technical specifications re-quire one operable division of CS and LPCI.

This was met with the Division II systems.

Therefore, from the time the plant entered cold shutdown, the plant was operating within the conditions of the technical specifications.

The technical specification actions required to be taken with the Division I EDGs inoperable when in startup and hot shutdown were also not met.

These actions require increased surveillance of the remaining ac sources and support systems. When Operational Condition 4 was achieved, technical specifica-tion 3.8.1.2 required only one operable division of EDGs which was met with Division II. At that time, the plant was no longer in violation of technical specifications 3.8.1.1.b and c.

The normal position for valve E11F603A as mentioned above is open, with the MCC breaker open.

The position of this valve is specified in the Fermi 2 Facility Operating License NPF-43, under License Condition 2.C.(9)(d).

The license con-dition is an interim measure until certain long term fire protection features are incorporated at the plant.

The purpose of the license condition is to en-sure the proper functioning of the EESW tystem in the event of spurious valve activations caused by a fire. As a result, a license condition in the Fermi 2 Ifcense was also violated.

The total time the Division I systems were inoperable and required by technical specifications was about 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

During that time, the plant was in a shut-down sequence and at low power levels (less than 1%). While the Division I ECCS and EDGs were inoperable, the automatic depressurization system, the Division II ECCS except for HPCI, and the Division II EDGs were available if required.

Corrective actions taken include:

Reverified all ECCS system lineups.

Revised System Operating Procedure (SOP) 23.208, "RHR Complex Service Water System," to provide separate instructions for the operation of the Divi-sion I and II systems to account for the differences between the two.

This includes a note that valve E11F068A internals have been removed, a caution to maintain an operator ready to reposition E11F603A if necessary when starting the Division I service water pumps, and a step to leave E11F603A open and deenergize the breaker.

27

Information signs will be placed on MCCs directing operators to the appli-cable 50P prior to operating a valve.

This will provide additional assur-ance that valves and their breakers will be positioned properly and are controlled by procedure.

Review in Licensed Operator Requalification the four valve operators in the plant which are currently deenergized, the position of the valve, and the reason for this status.

Magnetic signs have been placed on the control room panels advising oper-l ators of the current status of deenergized equipment.

1 Modified procedure 21.000.01, " Shift Operations and Control Room," to require the verification of the operational status of additional systems and equipment during shift turnovers.

Modified the valve position indication circuit on E11F603A so that indica-tion is provided even with the valve circuit deenergized.

Generated a Work Order to determine the cause for valve E11F603A tripping, and repair or propose corrective action.

The operators involved reviewed key plant procedures and discussed this event and other similar events with the Operations Engineer.

Standing Order 85-7 was generated to inform all operations personnel of this event, the causes, and the potential severity of the event.

In addition, this LER was placed in the required reading for operations personnel.

2.4 Residual Heat Removal Shutdown Cooling High Suction Flow Switch Inoperable Due to Reversed Piping LaSalle Unit 1; Docket 50-373; LER 85-53; General Electric BWR On July 17, 1985, at approximately 1500 hours0.0174 days <br />0.417 hours <br />0.00248 weeks <br />5.7075e-4 months <br />, the Unit 1 residual heat removal (RHR) suction high flow switches 1E31-N012AA/AB/8A/88 were found to be piped in reverse of proper system design.

1E31-N012AA and AB share the same high and low process lines to panel 1H22-P018, and 1E31-N0128A and BB share the same high and low process lines to panel 1H22-P021.

At the time of the discovery, Unit I was in cold shutdown, Operational Condi-tion 4, and Sections F.9 through F.12 of special test procedure LST 85-88,

" Unit 1 Flow Switch Sensing Line Verification," was in progress.

LST 85-88 is a functional test from the process to the switches. With the RHR A loop shut-down cooling mode in operation, system flow was varied while the differential pressure across the flow switches was measured via differential pressure test transmitters across the test taps.

These test transmitters are designed to mea-sure positive as well as negative differential pressures.

In each case the differential pressure reading was opposite in sign of the value required by proper primary containment isolation system design, such that the required isolation actions of the flow switches would not have occurred.

28

a The installation of the RHR suction high flow switches 1E31-N012AA/AB/BA/BB was performed during the Unit 1 3/21/85 through 4/7/85 outage to implemer. the re-placement of the original flow switches 1E31-N012A and 8 as part of modification package M-1-1-84-091.

This modification changed several Unit 1 differential pressure flow and level instruments to meet Environmental Qualification Rule (EQ) requirements.

Following the identification of the problem, the 1E31-N012AA/AB/8A/BB process lines were traced back to the outboard root valves and drywell penetrations and were found to be satisfactory per the M-1-1-84-091 revised controls and instrumentation (C&ID) drawing.

Per these results, an in-vestigation of another drawing, M-2096-5, commenced with the following comments:

On 5/10/82 it had been discovered that the original flow switches 1E31-N012A and IE31-N0128 were piped backwards due to the hi and lo process lines being reversed inside the containment.

Accordingly, Modification #M-1-1-82-054 was implemented to correct the piping and (in addition) install pressure snubbers.

Snubbers were added and the repiping was performed by reversing the tubing locally at the instruments.

Upon satisfactory resolution of M-1-1-82-054, Drawing Change Request (DCR)

1. 73-93 was submitted to reflect:

(1) the inclusion of pressure snubbers, and (2) the changes to the process line, root valve and excess flow check valve numbers associated with 1E31-N012A and B (with the drywell penetra-tion numbers remaining the same).

Based on their request for more informa-tion with regard to the snubber installation, Sargent & Lundy rejected DCR 73-83.

Accordingly, DCR 73-83 (which included the revised drawing #M-2096-5) was mistakenly closed out without the appropriate changes being made.

Therefore during the 3/21/85 through 4/7/85 outage when 1E31-N012A and B were removed and later replaced by 1E31-N012AA/AB/BA/BB, their process inputs (Hi vs Lo) became crossed, due to drawing #M-2096-5 having never been revised.

Upon resolution of the 1E31-N012AA/AB/8A/BB piping and switch recalibration, LST 85-88 was satisfactorily reperformed on 7/22/85.

In conjunction with LST 85-88, the piping from the affected switch taps to the associated root valves was also satisfactorily verified on 7/22/85 via LST 85-106.

In addition, the Unit 1 differential pressure reactor vessel level switches replaced by EQ Modi-fications #M-1-1-84-0091 and M-1-1-84-106 were satisfactorily functionally tested via LST 85-99.

2.5 Emergency Service Water Pipe Coating Failure Results in Partial Plugging of Heat Exchanger inlet Tubesheets Oyster Creek Unit 1; Docket 50-219; LER 85-18; General Electric BWR During an emergency service water (ESW) System II operability test conducted on July 10, 1985, heat exchanger 1-3 baffle plate differential pressure was noted to decrease from 8 psid to 3 psid.

System II heat exchangers 1-3 and 1-4 were subsequently opened to determine if baffle plate damage had occurred.

Examination of the units revealed that the inlet tubesheets were blocked with fragments of ESW pipe lining material.

In addition, the inspection revealed 29

that heat exchanger 1-3 was blocked more extensively than heat exchanger 1-4.

The baffle plates, however, showed no signs of damage.

Heat exchangers were cleaned on July 19, 1985, and the operability of System II was tested by running the system through the night. On the morning of July 20, 1985, heat exchanger 1-3 was opened.

Examination of the heat exchanger revealed that significant tubesheet blockage had again occurred.

Heat exchanger 1-4 was subsequently opened and inspected.

The examination revealed that only a small amount of material was present in the tubesheet.

Both heat exchangers were closed and System II was ru1 through Sunday morning (July 21, 1985) until baffle differen-tial pressure reached the operability limit.

System II was declared inoperable until the baffle plate differential problem could be resolved.

During the final run of System II, an operability test was conducted on System I.

Performance problems with pumps 52A and 528 led to further demonstration of System I operability, consisting of a 24-hour test beginning on the evening of July 21, 1985.

By the next morning, System I baffle plate differential pressure had approached its limit.

A meeting was held on the morning of July 22, 1985 and the decision was made by plant management to shut down the plant, inspect / repair the ESW piping and clean the ESW heat exchangers.

ESW System I heat exchangers 1-1 and 1-2 were opened.

The high differential pressure was caused by the presence of an accumu-lation of material consisting of dead marine debris and fragments of pipe lining material which blocked the inlet tubesheets.

Accumulations of dead marine debris were also found in both systems, which contributed to heat exchanger inlet tube-sheet blockage.

The coating fragments were an ESW internal pipe coating (coal tar), which is pastulated to have resulted from coating failure due to repeating thermal cycles of the outdcor exposed portion of the piping while drained during the last refueling outage.

The dead marine debris were transported to the heat exchangers during System I and II operability runs.

The accumulation of marine debris in the System I heat exchangers has been attributed to operational problems with the intake structure screen wash system.

i Screen wash nozzles were clogged and were not properly washing debris from the screens and into the troughs.

In addition, flappers which are designed to brush remaining debris from the screen into the trough were worn out and allowed debris to be carried over to the pump side of the intake screens.

A visual inspection of the pipe internal pipe surface was performed at strategic locations in each ESW system piping run to identify damaged coating areas.

The inspection revealed that the extent of coating damage was limited to the piping immediately downstream of the ESW pumps.

The section of piping that was shown to have coating damage and heavy barnacle growth was subsequently cleaned by hydrolazing the surface using high pressure water.

The coating in the a'fected areas was removed up to the next mechanical joint (the mechanical joint will provide a barrier against propagation of coating degradation); approximately 50 feet of piping in each system was cleaned.

After the hydrolazing was com-plete, the pipe interior was reinspected and the adequacy of the cleaning opera-tion confirmed.

The potential for further blockage of the heat exchangers has thus been minimized by removal of coating from the areas considered to be affected.

The screen wash nozzles were cleaned and adjusted for proper performance.

The flappers were replaced to properly brush debris off the screens and into the 30

troughs.

In order to prevent a similar occurrence in the future, the screens and flappers are no,, examined regularly on operator inspection tours.

In addi-tion, the screen wash nozzles and the flappers will now be inspected as part of the plant preventive maintenance program on a monthly basis.

2.6 Pressurizer Power Operated Relief Valves Open in Cold Shutdown During Ef forts to Stabilize Pressure Following Reactor Coolant Pump Start North Anna Unit 1; Docket 50-338; LER 85-10; Westinghouse PWR On August 14, 1985, North Anna Unit I was in cold shutdown preparing to return to power following a maintenance outage.

Reactor coolant system (RCS) tempera-ture was approximately 135 degrees F and pressure was approximately 350 psig.

The pressurizer was solid (100% level).

Both pressurizer power operated relief valves (PORVs) were in automatic control to provide low temperature overpres-surization protection.

The A loop reactor coolant pump (RCP) was started and then secured because of rapidly decreasing RCS pressure due to air trapped in the system.

RCS pressure was increased and stabilized by operator actions.

The C loop RCP was then started, which again caused RCS pressure to decrease rapidly.

Subsequent adjustments made to charging and letdown flow rates by the control room operator to increase RCS pressure caused both pressurizer PORVs to momen-tarily open twice.

The control room operator was attempting to maintain RCS pressure high enough to have a sufficient pressure drop across tne RCP seal and low enough to prevent PORV actuation.

The PORV actuation initially reduced RCS pressure; subsequent operator action reduced RCS pressure below the PORV setpoint.

Technical specifications require the PORVs to open at less than or equal to 430 psig whii RCS cold leg tempera-ture is less than 140*F.

The PORVs opened at approximately 400 psig, which was the maximum pressure during this transient.

The PORVs have two different setpoints which change with RCS temperature. When RCS cold leg temperature is less than 140 degrees F, the PORVs are required to open at less than or equal to 430 psig. When RCS cold leg temperature is less than or equal to 320 degrees F and greater than or equal to 140 degrees F, the PORVs are required to open at less than or equal to 505 psig.

To decrease the probability of lifting a PORV, procedures used to start RCPs will be revised to state RCS temperature should be increased to greater than 140 degrees F, when possible, before starting an RCP.

2.7 Reactor Core Isolation Cooling System Inverter Failure Ouane Arnold; Docket 50-331; LER 85-31; General Electric BWR At 1108 hours0.0128 days <br />0.308 hours <br />0.00183 weeks <br />4.21594e-4 months <br /> on August 2, 1985, with the reactor in run mode at 93% power, the reactor core isolation cooling (RCIC) system turbine / pump initiation and control power static inverter was removed from service, rendering the RCIC system in-operable.

Per technical specifications, a 7-day limiting condition for opera-tion (LCO) was entered, contingent upon the operability of the high pressure coolant injection (HPCI) system.

The HPCI system satisfactorily enmpleted its operability test at 1256 hours0.0145 days <br />0.349 hours <br />0.00208 weeks <br />4.77908e-4 months <br /> on August 2, 1985.

The RCIC system static inverter (PN-INVT-K603) provides 115 V ac power to the RCIC turbine / pump initiation and control instrumentation.

It receives its input power from 125 V de System I.

At 1108 hours0.0128 days <br />0.308 hours <br />0.00183 weeks <br />4.21594e-4 months <br /> on August 2, the "125 V dc System I 31

Trouble" alarm was received in the control room, followed a few seconds later by the control room panel IC04 smoke alarm and an indication on the control room fire system annunciator panel. An Operator in the immediate vicinity of the rear of panel IC04 quickly investigated, and found the RCIC static inverter emitting smoke. He secured power to the inverter and the smoking stopped. When the in-verter was turned off it was noted that the "RCIC Inverter Power Failure" annun-ciator in the control room did not come in.

However, reactor level indicator on a front panel in the control room, powered off the inverter, failed downscale when the inverter power was secured, indicating that the inverter had not failed prior to being turned off.

The inverter unit was replaced and the RCIC system declared operable following its post-maintenance operability test at 1825 hours0.0211 days <br />0.507 hours <br />0.00302 weeks <br />6.944125e-4 months <br /> on August 2, ending the 7-day LCO.

The source of the smoke within the RCIC static inverter was oil which had leaked from a capacitor.

The inverter is a Topaz Electronics Model 125-GW-125-60-115, Mod. R.

The historical performance of this and other inverters of its type at Duane Arnold has proven them highly reliable and trouble-free.

Presently, no preventive maintenance is performed on this inverter.

A preventive maintenance procedure is being developed and will be scheduled for once per refueling outage.

The "RCIC Inverter Power Failure" annunciator did not come on due to dirty con-tacts on its relay, which were cleaned on August 2, when the inverter was re-placed.

Had the inverter failed while the failure annunciator was inoperable, Control Room Operators would have noted the downscale reactor level indicator, which is monitored and recorded each shift.

2.8 Reactor Trip Following Non-1E Instrument Bus Transient San Onofre Unit 2; Docket 50-361; LER 85-41; Combustion Engineering PWR On 8/1/85, at 1535, with Unit 2 at 100% power, the reactor tripped in response to loss-of-load trip signals.

The loss-of-load signals were generated as result of a spurious turbine trip.

All safety systems were verified to have functioned properly.

The spurious turbine trip was caused by a voltage transient on Phase A of the non-1E uninterruptible power supply (UPS) inverter 2Y012.

This inverter sup-plies power to two auxiliary relays associated with the control element drive mechanism (CEDM) undervoltage relays which make up part of the turbine trip cir-cuitry.

The transient deenergized the auxiliary relays, closed their contacts and completed the turbine trip logic.

The transient was verified to have oc-curred based on alarms on several instruments powered by Phase A, with no such indications on instruments powered by other phases of the UPS.

No defects were found in inverter 2Y012.

The cause of the voltage transient is unknown.

As corrective action, a design change was implemented to rearrange the auxiliary relays so that a single phase voltage transient will not cause a turbine trip.

32

3.0 ABSTRACTS / LISTINGS OF OTHER NRC OPERATING EXPERIENCE DOCUMENTS 3.1 Abnormal Occurrence Reports (NUREG-0090) Issued in July-August 1985 An abnormal occurrence is defined in Section 208 of the Energy Reorganization Act of 1974 as an unscheduled incident or event which the NRC determines is significant from the standpoint of public health or safety.

Under the provisions of Section 208, the Office for Analysis and Evaluation of Operational Data reports abnormal occurrences to the public by publishing notices in the Federal Register, and issues quarterly reports of these occurrences to Congress in the NUREG-0090 series of documents. Also included in the quarterly reports are updates of some previously reported abnormal occurrences, and summaries of cer-tain events that may be perceived by the public as significant but do not meet the Section 208 abnormal occurrence criteria.

Date Issued Report 8/85 REPORT TO CONGRESS ON ABNORMAL OCCURRENCES, JANUARY-MARCH 1985, VOL. 8, NO. 1 There were eight abnormal occurrences during the report period.

One occurred at a licensed nuclear power plant, three occurred at other licensees (industrial radiographers, medical institutions, industrial users, etc.), and four occurred at Agreement States licensed facilities.

The occurrence at the plant involved premature criticality during startup at Summer Unit 1 on February 28, 1985.

The occurrences at other licensees involved:

(1) diagnostic medical misadministration at St. Luke's Hospitals in Chesterfield, Missouri; (2) diagnostic medical misadministration at Tolfree Memorial Hospital in West Branch, Michigan; and (3) unlawful possession of radioactive material by the John C. Haynes Company of Newark, Ohio.

The occurrences at Agreement States licensed facilities involved:

(1) overexposure of an employee of Gulf Nuclear, Inc. in Webster, Texas; (2) radiation hand burn to an assistant radiographer at Baytown Industrial X-Ray of Houston, Texas; (3) overexposure of an assistant radiographer at Magnaflux Industrial Radiography Company of Houston, Texas; and (4) lost well logging source as reported by Schlumberger Well Service of Houston, Texas.

Also, the report provided update information on (1) the nuclear acci-dent at Three Mile Island (79-3), first reported in Vol. 2, No. 1, January-March 1979; and (2) large diameter pipe cracking in boiling water reactors (BWRs) (83-5), first reported in Vol. 6, No. 3, July-September 1983.

33 m

i i

i

+

Date Issued Report In addition, items of interest that did not meet abnormal occurrence criteria included:

(1) numerous errors in technical specifications submitted by Mississippi Power and Light Company for Grand Gulf Unit 1; (2) failure of tendon anchor heads in coritainment post-tensioning system at Farley Unit 2, and (3) recent emergency diesel generator failures at Fermi Unit 2, McGuire Unit 2, North Anna Unit 1 Susque-hanna Unit 1, Washington Nuclear Unit 2, and Zion Units 1 and 2.

4

)

a i

e I

s i

34 n

3.2 Bulletins and Information Notices Issued in July-August 1985 The Office of Inspection and Enforcement periodically issues bulletins and information notices to licensees and holders of construction permits.

During the period, 27 information notices, one information notice supplement, and one revision were issued.

Bulletins are used primarily to communicate with industry on matters of generic importance or serious safety significance (i.e., if an event at one reactor raises the possibility of a serious generic problem, an NRC bulletin may be issued requesting licensees to take specific actions, and requiring them to submit a written report describing actions taken and other information NRC should have to assess the need for further actions).

A prompt response by affected licensees is required and failure to respond appropriately may result in an enforcement action.

When appropriate, prior to issuing a bulletin, the NRC may seek comments on the matter from the industry (Atomic Industrial Forum, Institute of Nuclear Power Operations, nuclear steam suppliers, vendors, etc.),

a technique which has proved effective in bringing faster and better responses from licensees.

Bulletins generally require one-time action and reporting.

They are not intended as substitutes for revised license conditions or new requirements.

Information Notices are rapid transmittals of information which may not have been completely analyzed by NRC, but which licensees should know.

They require no acknowledgement or response, but recipients are advised to consider the applicability of the information to their facility.

Information Date Notice Issued Title 85-49 7/1/85 RELAY CALIBRATION PROBLEM (Issued to all power reactor facilities holding an operating license or construction permit) 85-50 7/8/85 COMPLETE LOSS OF MAIN AND AUXILIARY FEEDWATER AT A PWR DESIGNED BY BABC0CK & WILCOX (Issued to all power reactor facilities holding an operating license or construction permit) 85-51 7/10/85 INADVERTENT LOSS OR IMPROPER ACTUATION OF SAFETY-RELATED EQUIPMENT (Issued to all power reactor facilities holding an operating license or construction permit) 85-52 7/10/85 ERROR IN DOSE ASSESSMENT COMPUTER CODES AND REPORTING REQUIREMENTS UNDER 10 CFR PART 21 (Issued to all power reactor facilities holding an operating license or con-struction permit) 85-53 7/12/85 PERFORMANCE OF NRC-LICENSED INDIVIDUALS WHILE ON DUTY (Issued to all power reactor facilities holding an operating license or construction permit) 35

(

Information Date Notice Issued Title 85-54 7/15/85 TELETHERAPY UNIT MALFUNCTION (Issued to all NRC licensees authorized to use teletherapy uni,ts) 85-55 7/15/85 REVISED EMERGENCY EXERCISE FREQUENCY RULE (Issued to all power reactor facilities holding an operating license or construction permit) 85-56 7/15/85 INADEQUATE ENVIRONMENT CONTROL FOR COMPONENTS AND SYSTEMS IN EXTENDED STORAGE OR LAYUP (Issued to all power reactor facilities holding an operating license 3

or construction permit) 85-57 7/26/85 LOST IRIDIUM-192 SOURCE RESULTING IN THE DEATH OF EIGHT PERSONS IN MOR0CCO (Issued to all power reactor facilities holding an operating license or construction permit; fuel facilities; and material licensees) 85-58 7/17/85 FAILURE OF A GENERAL ELE'CTRIC TYPE AK-2-25 REACTOR TRIP BREAKER (Issued to all power reactor facilities designed by Babcock & Wilcox and Combustion Engineering holding an operating license or construction permit) 85-59 7/17/85 VALVE STEAM CORROSION FAILURES (Issued to all power reactor facilities holding an operating license or construction permit) 85-60 7/17/85 DEFECTIVE NEGATIVE PRESSURE AIR-PURIFYING, FUEL FACEPIECE RESPIRATORS (Issued to all power reactor facilities holding an operating or construction permit) 85-61 7/22/85 MISA0 MINISTRATIONS TO PATIENTS UNDERG0ING THYROID SCANS (Issued to all power reactor facilities holding an operatinc. license and certain fuel facilities) 85-62 7/23/85 BACKUP TELEPHONE NUMBERS TO THE NRC OPERATIONS CENTER (Issued to ali power reactor facilities holding an operating license and certain fuel facilities) 85-63 7/25/85 POTENTIAL Fel b S4ON-MODE FAILURE OF STANDBY GAS TREAT-MENT SYr ? O!!

)SS OF 0FFSITE POWER (Issued to all power 'et.1.v ',:ilities holding an operating license l '

or consuuct..u permit) 85-64 7/26/85 BBC BROWN BOVERI LOW-VOLTAGE K-LINE CIRCUIT BREAKERS, WITH DEFICIENT OVERCURRENT TRIP DEVICES MODELS OD-4 and -5 (Issued to all power reactor facilities holding an operating license or construction permit) 36 L.

m

Information Date Notice Issued Title 85-65 7/31/85 CRACK GROWTH IN STEAM GENERATOR GIRTH WELDS (Issued to all pressurized water reactor facilities holding an operating license or construction permit) 85-66 8/7/85 DISCREPANCIES BETWEEN AS-BUILT CONSTRUCTION DRAWINGS AND EQUIPMENT INSTALLATIONS (Issued to all power reactor facilities holding an operating license or construction permit) 85-67 8/8/85 VALVE-SHAFT-TO-ACTUATOR KEY MAY FALL OUT OF PLACE WHEN MOUNTED BELOW HORIZONTAL AXIS (Issued to all power reac-tor facilities holding an operating license or construc-tion permit) 85-42 8/12/85 LOOSE PHCSPHOR IN PANASONIC 800 SERIES BADGE THERMO-Rev. 1 LUMINESCENT 00SIMETER (TLD) ELEMENTS (Issued to all materials and fuel cycle licensees) 85-68 8/14/85 DIESEL GENERATOR FAILURE AT CALVERT CLIFFS NUCLEAR STATION UNIT 1 (Issued to all power reactor facilities holding an operating license or construction permit) 85-69 8/15/85 RECENT FELONY CONVICTION FOR CHEATING ON REACTOR OPERATOR REQUALIFICATION TESTS (Issued to all power reactor facilities holding an operating license or construction permit) s 85-70 8/15/85 TELETHERAPY UNIT FULL CALIBRATION AND QUALIFIED EXPERT REQUIREMENTS (10 CFR 35.23 and 10 CFR 35.24) (Issued to all materials licensees) 85-71 8/22/85 CONTAINMENT INTEGRATED LEAK RATE TESTS (Issued to all power reactor facilities holding an operating license or construction permit) 85-72 8/22/85 UNCONTROLLED LEAKAGE OF REACTOR COOLANT OUTSIDE CONTAIN-MENT (Issued to all power reactor facilities holding an operating license or construction permit) 85-73 8/23/85 EMERGENCY DIESEL GENERATOR CONTROL CIRCUIT LOGIC DESIGN ERROR (Issued to all power reactor facilities holding an operating license or construction permit) 84-70 8/26/85 RELIANCE ON WATER LEVEL INSTRUMENTATION WITH A COMMUN Sup. 1 REFERENCE LEG (Issued to all power reactor facilities holding an operating license or construction permit) 85-74 8/29/85 STATION BATTERY PROBLEMS (Issued to all power reactor facilities holding an operating license or construction permit) 37 a

Information Date Notice Issued Title 85-75 8/30/85 IMPROPERLY INSTALLED INSTRUMENTATION, INADEQUATE QUALITY CONTROL AND INADEQUATE POST-MODIFICATION TESTING (Issued to all power reactor facilities holding an operating li-cense or construction permit) i 4

4 1

38

...-.- - : L

3.3 Case Studies and Engineering Evaluation Issued in July-August 1985 The Office for Analysis and Evaluation of Operational Data (AE00) has as a pri-mary responsibility the task of reviewing the operational experience reported by NRC nuclear power plant licensees. As part of fulfilling this task, it se-1ects events of apparent interest to safety for further review as either an engineering evaluation or a case study.

An engineering evaluation is usually an immediate, general consideration to assess whether or not a more detailed protracted case study is needed.

The results are generally short reports, and the effort involved usually is a few staffweeks of investigative time Case studies are in-depth investigations of apparently significant events or situations.

They involve several staffmonths of engineering effort, and result in a formal report identifying the specific safety problems (actual or potential) illustrated by the event and recommending actions to improve safety and prevent recurrence of the event.

Before issuance, this report is sent for peer review and comment to at least the applicable utility and appropriate NRC offices.

These AE00 reports are made available for information purposes and do not impose any requirements on licensees.

The findings and recommendations contained in these reports are provided in support of other ongoing NRC activities concerning the operational event (s) discussed, and do not represent the position or require-ments of the responsible NRC program office.

Special Date Study Issued Title P501 7/9/85 1 RENDS AND PATTERNS ANALYSIS OF FEEDWATER TRANSIENTS AT WESTINGHOUSE PRESSURIZED WATER REACTORS (PWRs)

Feedwater transients comprise the most frequent cause of PWR reactor trips which, in turn, are the most frequent class of transients.

Thus, feedwater transients as a class often cause situations requiring operator response and the operation of backup systems to maintain the unit in a safe condition.

In the worst case, loss of main feedwater with-i out prompt recovery is part of a risk-dominant transient se-i quence.

This study, based upon available information, was initiated to characterize the incidence of feedwater tran-i sients and, if possible, pinpoint the causes.

This report l

covers the time period January 1981 through June 1983.

The l

inquiry was limited to the largest single vendor class of nuclear units (i.e., Westinghouse PWRs) in order to keep the analysis tractable.

l Based on the analysis described in this report.

AEOD con-cluded that 2-loop and early 4-loop Westinghouse plants share a transient rate which is a factor of 10 lower than that for 3-loop and later 4-loop units.

AE00 believes that the higher rate for the latter two types of plants is due, at least in part, to the use of turbine-driven vice electric-driven main feedwater pumps in two 3-loop and all later 4-loop units, and will analyze this relationship further as l

part of its in-depth study of the causes of reactor scrams.

39 l

In addition, AE00 found that, when all Westinghouse units are viewed as a group, Salem Unit 2 is an outlier due to its high transient rate.

In their response to the draft of the report, NRC Region I noted that the problems had been recog-nized, and addressed in inspection and SALP reports.

The licensee had comitted in 1982 to replacing the condensate pumps with higher head models, installing a heater drain tank quench system, revising station operating procedures, and implementing additional operator training. AE00 recom-mends that Region I continue to monitor the improvements underway to determine if they are effective.

P502 7/21/85 TRENDS AND PATTERNS ANALYSIS OF 1981 THROUGH 1983 LER DATA This study documents the results of a trends and patterns analysis of 1981 through 1983 LER data, which was prepared by the Idaho National Engineering Laboratory (INEL) using methodology developed jointly by INEL and AE00.

The main tool for the analysis was the display of computer-generated tables of events counts from the Sequence Coding and Search System data base.

These tables primarily focused on component faults contributing to reportable events.

Twenty-two groups (e.g., pumps, valves, circuit breakers) of hardware components were explored in plant-specific de-tail.

The analysis was performed on BWR and PWR groupings.

The PWR plants were further subdivided and analyzed based on their NSSS vendor.

In comenting on the trends and patterns analysis of 1981 LER data (NUREG/CR-4071), a number of offices recomended normalizing count data by component population to aid plant-to plant comparisons.

Unfortunately, this proved to be impractical at this time on the scale necessary for a report of this scope.

In many cases, INEL retrieved and read LER abstracts where a plant-component combination showed a relatively high count.

Through this process, INEL generated a wealth of material which succinctly sumarizes the problems reported via LERs over the three year period covered.

The report also pro-vides information on which plants contributed most to a particular hardware category and which hardware category dominated a particular plant's reporting.

Thus, AE00 be-lieves the report provides an excellent perspective across the licensee population and a basis for feedback discussions of operating experience with individual licensees.

Throughout the report, INEL makes specific recomendations for further investigation based on their analysis.

In a number of cases, these recomendations are not based on event frequency per se, but on the wording in an LER abstract which describes a problem as generic or repetitive.

40

P503 8/85 TRENDS AND PATTERNS ANALYSIS OF ENGINEERED SAFETY FEATURE ACTUATIONS AT COM4ERCIAL U.S. NUCLEAR POWER PLANTS This report is a trends and patterns analysis of engineered safety feature (ESF) actuations which occurred during the first six months of 1984 at commercial U.S. nuclear power plants.

The investigation documented in this report was limited to those ESF actuations which involved systems other than the reactor protection system, which were the subject of a companion AEOD study (P504; abstracted below).

Based on the analysis and evaluation described in this re-port, AE0D concluded that, in general, the events necessi-tating ESF actuations, including emergency core cooling systems, have not been individually significant, and their occurrence frequency should not be a major concern.

This holds true for failures and problems which have been asso-ciated with these ESF actuations.

It is readily apparent, however, that the majority of the reported ESF actuations were unnecessary and that the rate of these actuations could be greatly decreased by (a) reducing the number of equipment failures during normal operation, (b) reducing the number of personnel errors during maintenance and testing, and (c) re-vising actuation setpoints to more appropriate protective levels.

AE00 also concluded that ESF functions associated with isolation or ventilation should receive first priority in these regards.

AE00 determined that nine units are of potential concern, because they appear to be experiencing repeated unresolved actuations which could ultimately challenge continued equipment operability and proper personnel response.

These units are:

D. C. Cook 2, Ft. Calhoun, LaSalle 1 and 2, San Onofre 2 and 3, Sequoyah 1 and 2, and Washington Nuclear Project Unit 2.

AE00 will continue to monitor these units to see if indicated corrective actions are being taken to resolve these actuations.

Further, AE00 found that four potentially significant prob-lems occurred in the ESF actuations studies.

These problems were:

(1) improper temperature switch configuration, (2) steam supply transfer relay seal-in circuitry, (3) pres-sure switch location and setpoint calibration, and (4) compo-nent cooling water system interaction. AE00 will investigate these items in an attempt to determine the generic applica-bility of these problems and define if further actions, whe-ther generic or unit specific, should be required to properly address the concerns.

Finally, AE0D concluded that the limited number of ESF actu-ations, the wide variety of ESF systems, and the differences in the types of ESF actuations make comparison between units very difficult.

In cases where frequent actuations are being l

l 1

41

experienced at a unit, however, the information associated with such actuations should be useful in analyzing the per-formance of the licensees on an individual basis.

P504 8/85 TRENDS AND PATTERNS REPORT OF UNPLANNED REACTOR TRIPS AT U.S. LIGHT WATER REACTORS IN 1984 This report is a trends and patterns analysis of unplanned reactor trips (i.e., reactor scrams) that occurred in 1984 at U.S. nuclear power plants.

In this analysis, reactor trips are defined as reactor protection system actuations accompanied by control rod motion, j

Based upon the evaluations and analysis described in this report, AE00 has arrived at the following general observa-tions with regard to reactor trips:

(a) the reduction of hardware failures, primarily in balance of plant (BOP) sys-tems, would significantly reduce the number of reactor trips; (b) there are a number of post trip recovery complications due to equipment failures and personnel errors unrelated to the original trip cause that have the potential for having significant safety implications; and (c) many reactor trips are being initiated by unlicensed personnel (approximately 50% of all reactor trips above 15% power caused by human error are traceable to activities by unlicensed personnel).

In addition to these general observations, the report con-tains a number of specific conclusions based upon the analy-sis of the 494 reactor trips which were identified in 1984.

Overall, AE00 observed a slight decline (9%) in the rate of automatic and manual reactor trips from 1983 to 1984.

As part of this analysis of reactor trip experience, trip rates for plants in other countries were also collected and analyzed. Only rough comparisons were possible at the time, due to the age and relative lack of documentation of foreign data.

However, it appears that the average reactor trip rates for the countries examined (France, Japan, West Germany, Sweden) were below those for the U.S. reactor population of both BWRs and PWRs.

Eng.

Date Eval.

Issued Title E509 7/25/85 SALEM UNIT 2 DEPRESSURIZATION EVENT On July 25, 1984, with Salem Unit 2 at 66% power while performing pressurizer power operated relief valve (PORV) testing, inadvertent reactor coolant system (RCS) depressur-ization occurred upon opening the PORV block valve.

This depressurization was caused by a failed-open relief valve.

This relief valve provided low temperature overpressure pro-l tection (LTOP).

The LTOP relief valve was supposedly dis-abled.

The RCS depressurized to the reactor trip and l

l 42

subsequently to the safety injection setpoints because the motor operator control circuitry for the PORV block valve prevented the valve from closing against system differential pressure in the required time.

Failure of the PORV block valve motor operator to allow closure against system differ-ential pressure appears to have been caused by an attempt to close the block valve while it was still traveling in the open direction.

The combined forces of momentum, friction, and flow that resulted from valve reversal operation caused torque switch actuation with the valve in mid position.

The torque switch contacts later reclosed as the spring pack gradually unloaded and the block va!ve then traveled to the closed position.

Accidental depressurization of the RCS is an analyzed con-dition II fault in the licensee's Updated Safety Analysis Report (USAR).

The resultant depressurization transient from the failed-open LTOP valve would be a conservative case com-pared to the analyzed transient for this accident.

Thus, the Salem depressurization event of July 25 was bound by the accident analysis.

Corrective actions taken by the licensee and the NRC were judged to be appropriate.

E510 7/85 DISABLING OF A SHARED DIESEL GENERATOR SET DUE TO ELECTRICAL POWER SUPPLY ARRANGEMENT FOR SUPPORT AUXILIARIES This report provides information concerning electrical power supply arrangements for support auxiliaries associated with shared diesel generator sets.

It describes a situation at the Surry Station on May 8,1984, where for a certain con-dition of the onsite power system, the engine louvers asso-ciated with the swing diesel generator set would not be pro-vided with electrical power necessary for operation.

This situation was significant since without the louvers opening the swing diesel would overheat and be unable to perform its safety function.

In view of the potential significance of this situation, five additional facilities which use shared diesel generator sets were reviewed so as to determine if a similar concern was also applicable to these facilities.

One result of this review was that the identified or similar concern does not appear to be applicable to these facilities.

Based on this result and the knowledge that certain support auxiliaries must be supplied with electrical power in order for proper operation of a diesel generator set, AE00 believes that the i

concern identified for the Surry Station is not a concern for i

most nuclear facilities which use shared diesel generator sets.

E511 8/9/85 CLOSURE OF EMERGENCY CORE COOLING SYSTEM MINIMUM FLOW VALVES On June 1, 1984, an engineering review at Brunswick deter-mined that the control logic for the core spray system 43

minimum flow valves did not permit the valves to perform their required containment isolation' function.

Based on this find-ing, the normally open minimum flow valves for both trains of the. Brunswick 1 and 2 core spray systems were closed and deactivated.

The operating staff did not declare the core spray systems to be inoperable, however, even though closing L

and deactivating the minimum flow valves rendered the mini-num flow bypass line inoperable.

Only. later did the oper-ating staff recognize that the minimum flow line provided an essential pump protection feature.

The Brunswick event, along with strallar events involving closed minimum flow by-pass valves at Peach Botton Unit 3, were investigated to evaluate the underlying cause(s), the potential f.afety sig-nifance and the generic applicability of operating events involvirg closed emergency core cooling system (ECCS) mini-mum flow valves.

The study found that the minimum flow bypass ifnes provide an essential pump protection feature and that pump operabil-ity is generally dependent on minimum flow valve operability.

This finding leads to.the conclusion that the affected safety system trains at both the Brunswick and Peach Bottom units should have been declared inoperable when the minimum flow valves for these systems were closed and deactivated.

Additionally, an evaluation of a data search for similar events at other plants coupled with the reported Brunswick and Peach Bottom events clearly indicate that not all licen-sees may recognize the importance of minimum flow valves for ECCS pump operability.

In view of these conclusions, AE00 suggested that the Office of Inspection and Enforcement (IE) j consider issuing an Information Notice to remind licensees

~

of the importance of the minimum flow bypass line pump pro-tection feature and the dependence of pump operability on minimum flow valve operability.

The control logic of the Brunswick core spray system minimum flow valves was also reviewed to assess the generic safety implications.

The evaluation concluded that the design was inadequate to assure that the valves could perform their con-tainment isolation function in all required situations. Ad-ditionally, the Brunswick units have operated for over eight years with the logic error undetected.

It would appear pos-sible, therefore, that the same minimum flov valve control logic problem may exist and remain undetected at one or more other light water reactors.

Based on these findings, the study also suggested that the IE Information Notice emphasize that licensees review the control logic of ECCS minimum flow valves to ensure that it is adequate to satisfy contain-ment isolation requirements.

On December 13, 1985, IE issued Information Notice 85-94, " Potential for Loss of Minimum Flow Paths Leading to ECCS Pump Damage During a LOCA,"

emphasizing the suggestions above.

44

, - - - _., ~. - - -.

.-,-_--n-

3.4 Generic Letters Issued in July-August 1985 Generic letters are issued by the Office of Nuclear Reactor Regulation, Division of Licensing.

They are similar to IE Bulletins (see Section 3.2) in that they transmit information to, and obtain information from, reactor licensees, appli-cants, and/or equipment suppliers regarding matters of safety, safeguards, or environmental significance.

During July and August 1985, three letters were issued.

Generic letters usually either (1) provide information thought to be important in assuring continued safe operation of facilities, or (2) request information on a specific schedule that would enable regulatory decisions to be made regard-ing the continued safe operation of facilities.

They have been a significant means of communicating with licensees on a number of important issues, the reso-lutions of which have contributed to improved quality of design and operation.

Generic Date Letter Issued Title 85-14 8/1/85 COMMERCIAL STORAGE AT POWER REACTOR SITES OF LOW-LEVEL RADI0 ACTIVE WASTE NOT GENERATED BY THE UTILITY (Issued to all licensees) 85-15 8/6/85

~INFORMATION RELATING TO THE DEADLINES FOR COMPLIANCE WITH 10 CFR 50.49, " ENVIRONMENTAL QUALIFICATION OF ELECTRIC EQUIP-MENT IMPORTANT TO SAFETY FOR NUCLEAR POWER PLANTS" (Issued to all licensees of operating reactors) 85-16 8/23/85 HIGH BORON CONCENTRATIONS (Issued to all licensees of oper-ating reactors and applicants for an operating license) 45

3.5 Operating Reactor Event Memoranda Issued in July-August 1985 The Director, Division of Licensing, Office of Nuclear Reactor Regulation (NRR) disseminated information to the directors of the other divisions and program offices within NRR via the operating reactor event memorandum (OREM) system.

The OREM documents a statement of the problem, background information, the safety significance, and short and long term actions (taken and planned).

Copies of ORENs are also sent to the Office for Analysis and Evaluation of Operational Data, and of Inspection and Enforcement for their information.

No ORENs were issued during July-August 1985.

t 46 l

3.6 NRC Document Compilations The Office of Administre fon issues two publications that list documents made publicly available.

The quarterly Regulatory and Technical Reports (NUREG-0304) compiles bib 1to-graphic data and abstracts for the formal regulatory and technical reports issued by the NRC Staff and its contractors.

The monthly Title List of Documents Made Publicly Available (NUREG-0540) contains descriptions of information received and generated by the NRC.

This information includes (1) docketed material associated with civilian nuclear power plants and other uses of radioactive materials, and (2) non-docketed material received and generated by NRC pertinent to its role as a regulatory agency.

This series of documents is indexed by Personal Author, Corporate Source, and Report Number.

The monthly L_icensee Event Report (LER) Compilation (NUREG/CR-2000) might also be useful for those interested in operational experience.

This document contains Licensee Event Report (LER) operational information that was processed into the LER data file of the Nuclear Safety Information Center at Oak Ridge during the monthly period identified on the cover of the document.

The LER summaries in this report are arranged alphabetically by facility name and then chronologically by event date for each facility.

Component, system, keyword, and component vendor indexes follow the summaries.

Copies and subscriptions of these three documents are available from the Super-intendent of Documents, U.S. Government Printing Office, P.O. Box 37082, Washing-ton DC 20013-7982.

i i

47

UNITED STATE 3

., em NUCLEAR RET,ULATORY COMMISSION

'o** *** o n* * ***

WASHINGTON, D.C. 20566 nn 7e.

..e = om OFFICIAL BUSINESS PENALTY FOM PRIVATE USE. 6300, 0

078877 1 1 A NIN411M11st ADM-DIV 0F TIOC

' (.0Q Y F. P UB MG T ng.PDR f;UREG I

WASHINGTON DC 20555 1

r

[

[

0 1

L