ML20195G747
Jump to navigation
Jump to search
| ML20195G747 | |
| Person / Time | |
|---|---|
| Site: | Oyster Creek |
| Issue date: | 09/28/1987 |
| From: | Kane W NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | Phyllis Clark GENERAL PUBLIC UTILITIES CORP. |
| References | |
| NUDOCS 8711200114 | |
| Download: ML20195G747 (3) | |
See also: IR 05000219/1987029
Text
{{#Wiki_filter:P
. \
.
2 8 SEP 1987
Docket No. 50-219
GPU Nuclear Corporation
ATTN: Mr. P. R. Clark
President
100 Interpace Parkway
Parsippany, New Jersey 07054
Gentlemen:
Subject: Augmented Inspection Team Report No. 50-219/87-29
This refers to the Augmented Inspection Team (AIT) special review conducted by
this office on September 11-17, 1987 at the Oyster Creek Nuclear Generating
Station, Forked River, New Jersey. This inspection was conducted by a team led
by Dr. L. H. Bettenhausen and included a representative from Region I and the
Office of Nuclear Reactor Regulation. The team performed a technical analysis
of the circumstances surrounding events which resulted in your reported Techni-
cal Specification Safety Limit Violation on September 11, 1987 as directed by
the AIT Charter (Appendix B). The preliminary findings of this inspection were
discussed with you and members of your staff by Dr. Bettenhausen at the conclu-
sion of the inspection. %
The areas examined during this special inspection are discussed in the NRC
Region I Inspection Report which is enclosed. The areas examined were
prescribed by the AIT Charter and were selected to provide NRC management with
a comprehensive analysis of the root causes and safety significance of the
event.
Issues resulting from this inspection including possible enforcement actions
will be subjects for future correspondence.
Sincerely,
Vol i
M(
William F. Kane, Director
Division of Reactor Projects
Enclosure: Augmented Inspection Team Report 50-219/87-29 w/ Appendices
.
I 2M l M ' 0FFICIAL RECORD COPY -29 - 0001.0.0
yfa,^
Leo i
c >
- -
-. . . . _ . __
_,
_
'
1 ,: i
0 -
GPU Nuclear Corporation 2
cc w/ encl: ~
P. Fiedler, Vice President and Director, OCNGS
M. Laggart, BWR Licensing Manager
Licensing Manager, Oyster Creek
Public Document Room (PDR)
local Public Document Room (LPDR)
Nuclear Safety Information Center (NSIC)-
NRC Resident Inspector
State of New Jersey
bec w/ encl:
Region I Docket Room (with concurrences)
Management Assistant, DRMA (w/o encl)-
Section Chief, DRP
R. J. _ Bores, DRSS
8. Boger, A/D, RI
B.-Clayton, ED0
W. Johnston, DRS
T. Martin, DRSS
W. Russell, RA
J. Allan, DRA
J. Stolz, NRR/PD I-4
W. Lanning, NRR/0EAB
M. Hodges, NRR/SRXB
J. Rosenthal, AEOD/ROAB
L. Bettenhausen, DRP
D. Holody, RI
J. Lieberman, OE
J. Goldberg, OGC
F. Miraglia, NRR
1
1
-
L ~J
' o i *
!
GPU Nuclear Corporation 2
cc w/ encl:
P. Fiedler, Vice President and Director, OCNGS
M. Laggart, BWR Licensing Manager
Licensing Manager, Oyster Creek
Public Document Room..(PDR)
Local Public Document. Room (LPDR)
Nuclear Safety Information Center _ (NSIC)
NRC Resident: Inspector
State of New Jersey
bcc w/ enc 1:
Region I Docket Room (with concurrences)
Management Assistant, DRMA (w/o-encl)
Section Chief, DRP
R. J. Bores, DRSS
B. Boger, A/D, RI
_
B. Clayton, EDO
W. Johnston, DRS
T. Martin, DRSS
W. Russell, RA
J. Allan, DRA
J. Stolz, NRR/PD I-4
W. Lanning, NRR/0EAB_
M. Hodges, NRR/SRXB
J. Rosenthal, AE00/R0AB
L. Bettenhausen, DRP
D. Holody, RI
J. Lieberman, OE
J. Goldberg, OGC
F. Miraglia, NRR
,
I
l
RI ES :D -
G
Cowgill/mjd Holody Co ns rez
9fd /87 9/z[/87 / / 9/At/87
RI3fg RI:DRA RI:RA
Il rg, Allan Russell j
/JO/87 9/ /87 9/ /87 l
OFFICIAL RECORD COPY IR OY 87-29 - 0002.0.0 l
09/24/87 j
!
!
2
r-
,
,
. 9, .
O
DCS 50219870911
U.S. NUCLEAR REGULATORY COMMISSION
REGION I
Report No.- 50-219/87-29
Docket No. 50-219
License No. OPR-11 Priority -
Category -
Licensee: GPU Nuclear Corporation
P. O. Box 338
Forked River, New Jersey 08731
Facility Name: Oyster Creek Nuclear Station
Inspection At: Forked River, New Jersey
Inspection Conducted: September 11 - 17, 1987
Participating Inspectors:
C. Cowgill, Chief Reactor Projects, Section 10
W. Bateman, Senior Resident Inspector, Oyster Creek
D. Allsopp, Resident Inspector, Hope Creek
A. Oromerick, Licensing Project Manager, NRR
J. Wechselberger, Resident Inspector, Oyster Creek
Aoproved By: d,MN 9/25/#7 ,
Ese H. Bettenhausen, Chief Date !
Reactor Projects Branch 1, 'ORP
Inspection Summary:
Inspection on September 11 - 17, 1987 (Report No. 50-219/87-29)
Areas Inspected:
<
Technical issues associated with the reported violation of Safety. Limit 2.1.E ,
on September 11, 1987 wherein a condition requiring at least two s'ets of l
suction and associated discharge valves in the five reactor recirculation loops
'
to be in the full open position was not met.
Results:
See inspection summary.
It d -
-
4 ? I k m q ) n g>
a
]
.
r,
,, 'c.
.
TABLE OF CONTENTS
1. Summary
2. Background
3. Plant Status and Sequence of Events
3.1 Plant Conditions Immediately Prior To Event
3.2 Sequence Of Events
3.3 Analysis Of Safety Significance
4. Maintenance Activities Leading To Event
5. Safety Limit
5.1 History of Technical Specification Safety Limit 2.1.E
5.2 History of Recirculation Loop Alarm Interlock -
6. Human Factors in the Control Room
6.1 Procedural Requirements for Operation of Recirculation Valves
6.2 Procedural Requirements _ for Operation _of Recirculation Pumps
6.3 Operator Training -- Motor Operated Valves
7. Contamination Incident
8. Notifications
9. Review of Sequence of Alarms Recorder Tapes and Control Room Operator Logs
10. Licensee Review of Event
11. Conclusions
Figure 1 --
Photographs of Valve V-5-1~7
Figure 2 --
Photographs of Control Roon, and Panels
Figure 3 --
Plot of Process Computer Data - Recirculation Flows
Figure 4 --
Plot of Process Computer Data - Recirculation Loop Temperature
l
Table 1 --
Sequence of Events
Appendix A -- Procedures and Documents Used
Appendix B -- Augmented Inspection Team Charter
Appendix C -- Confirmation of Action Letter
Appendix D -- Equipment Release Memorandum
Appendix E -- Time Correction
Appendix F -- Attendees at Exit Meeting
'
,
.
..
i
1. Summary
On September 11, 1987, maintenance activities'in progress at the plant led
to the violation of a Technical Specification Safety Limit. The purpose
of this inspection was to review the technical issues associated with this
event to determine its causes and safety implications. An ' Augmented
Inspection Team was dispatched on September 11, 1987 to . conduct the
inspection in a timely, thorough, and systematic manner. This reports the
results of the inspection.
On September 11, 1987, Oyster Creek Nuclear Generating Station reported to
the Nuclear Regulatory Commission that a violation of Safety Limit 2.1.E
had occurred in that fewer than two sets of recirculation loop valves were-
not fully open for a short period of time as required by the limit. This
Augmented Inspection Team confirmed by' their review and analysis of plant
records that this condition existed for about two and a half minutes. The
control room operator involved quickly recognized the error .and took
prompt action to recover from the sitpation. The team concluded that the
event had minor significance from a reactor safety viewpoint for the
following reasons:
1. The plant had been shutdown for one day and was being cooled by the
shutdown cooling system; this system continued to function throughout
the event.
2. With the combination of valves being opened and closed, there was
always sufficient fluid communication between the reactor core region
and the annulus region of the reactor vessel to assure fluid commun-
ication and ascertain fluid level in the core region; this is the
reason the Safety Limit was imposed in 1979.
3. Since the imposition of the Safety Limit in 1979, a fuel zone fluid
level indicator had been added as part of the enhancement required by
the Three Mile Island Action Plan for all nuclear power plants. This
level indicator was operable and provided a record of adequate level
throughout the event.
The team also inspected the circumstances leaoing to the event and several
of the related activities. A maintenance a tivity led to a leak in a
cooling water system and resulted in an immediate need to secure recircu-
lation pumps; the consequent valving error led to the violation. This
maintenance activity, discussed in detail in the report, was conducted
with poor adherence to plant procedures, poor communications among the l
several individuals involved and one apparent lack of skill and knowledge
by a licensed reactor operator. The recovery from the leak and the hand-
ling of the resulting minor personnel contamination / personal safety
problems were accomplished promptly and properly.
Reporting of the event to the Nuclear Regulatory Commission met the four i
hour reporting requirement for events of this type. ;
- - - - - - - . - _ _
7
,
',
.
2
The inspection report details the history of the safety limit, incluc'ing a
brief recap of the May 2,1979 event that explains its need. Al so t.'i s-
cussed is the history of the alarm installed in 1986 which notifies the
operator when there are an inadequate number of valves full open.
Since a missing or destroyed rec.z ' was identified by the licensee subse-
quent to the event, some inspection effort was spent examining similar
records to ascertain whether there was any pattern of missing records. No
pattern was evident from the limited sample examined.
A review of the procedures governing the activities conducted in the con- i
trol room showed that the activities did not strictly adhere to the pro- l
cedures written. In this instance, it appears that the recirculation loop
operating procedures had not been revised to reflect current plant prac-
tices for shutting down and operating recirculation pumps and valves.
2. Background
;
1
Oyster Creek is a boiling water reactor located in Ocean County, New I
Jersey with a power rating of 1930 megawatts thermal and 650 megawatts )
electric. In May of 1979, as a result of closing all 5 recirculation j
system valves simultaneously during a transient, a reactor zone water j
, i
level transient occurred that went undetected until the receipt of the l
low-low-low level alarm. I
Soon after this incident, the NRC imposed a Safety Limit on the facility
that required at least two loops to have both the recirculation pump suc-
tion and discharge valves open during all plant conditions unless the
reactor vessel head was removed. Technical Specification 2.1.E states,
"During all modes of operation except when the reactor head is off and the
reactor is flooded to a level above the main steam nozzles, at least two
(2) recirculation loop suction valves and their associated discharge
valves will be in the full open position."
As part of the post-Three Mile Island Action Plan, the NRC imposed re-
quirements for an interlock to prevent less than two loop operation. This
was subsequently changed to an alarm in the control room that would
actuate if less than two recirculation loop suction and discharge valves
were fully open. This alarm was installed during the recent (11R) refuel-
ing outage which was completed in December 1986, some 8 years after the
original event at Oyster Creek.
On September 10, 1987, Oyster Creek was taken off line at 0107 hours for
plant maintenance. Included in this maintenance was a planned job to
repack valve V-5-167. This valve is a primary containment isolation valve
in the Reactor Building Closed Cooling Water (RBCCW) System. On the
September 10 day shift, tagging to support accomplishment of this activity
was completed. At 0200 on September 11, 1987, the plant was in cold shut-
down, reactor vessel vented, and primary coolant temperature at approxi-
mately 140'F. Recirculation pumps B and C were operating; A, 0 and E were
secured and their pump discharge valves closed. The shutdown cooling
system attached to Loop E was in operation.
,
__
. 8
.
3
Around 0210 hours on September 11, 1987, during removal of packing from
V-5-167, a leak occurred from the packing gland which required securing
the RBCCW system. This was done by isolating the drywell portion of the
RBCCW system. Since this cools recirculation pump components, the pumps
were to be secured. The control room operators, while in the process of
shutting down the two running recirculation pumps, entered into a.condi-
tion which violated the Safety ' Limit imposed by Technical Specification
2.1.E. The plant remained in this condition for approximately two-and-
a-half minutes. The NRC was notified of the event at 0403 on. September
11, 1987.
3. plant Status and Sequence of Events
3.1 plant Conditions Immediately prior to Event
The reactor plant was subcritical reading approximately 40 counts per
second on the source range instrumentation with the mode switch .
locked in the shutdown position. Reactor coolant temperature was !
approximately 141 F with the "C" shutdown cooling loop operating.
Reactor water level was being maintained at approximately 160 inches i
above the top of the active fuel; letdown flow to the reactor water '
cleanup system was in progress with an auxiliary pump running. Total
recirculation flow was approximately 4.3 x 10' gallons per minute l
(gpm) maintained using the "B" and "C" recirculation pumps. The !
control rod drive system was in operation with the NC08B pump in
service with automatic flow control. The "C" condensate pump was ;
operating and hot well level control was in manual. The (RBCCW)
'
system was operating with both pumps running maintaining a discharge
temperature of 89* F. The reactor was vented through the main steam
lines. Torus draining was in progress and the "A" and "D" recircula-
tion pump motor generator sets were being warmed up prior to start-
ing. preparations were being made to conduct maintenance on V-5-167, i
an RBCCW drywell isolation valve.
;
3.2 Sequence of Events
<
During the early morning of September 11, 1987, at approximately I
0210, a radiological control technician reported a leak to the con-
trol room. The group operating supervisor (GOS) responded to the 23
foot elevation to investigate while the shif t personnel prepared to
take action in the control room. The GOS recognized the purplish i
color water as RBCCW system fluid,- remembered maintenance was in '
progress on V-5-167, a RBCCW system containment isolation valve, and
reported to the control room that the leak was from V-5-167. After
studying piping diagrams, the control room operators (CR0's) prepared
to isolate that section of RBCCW system piping, directing equipment
operators to manipulate a manual isolation valve while they closed a ,
<
F
.
'.
%
4
motor-operated valve. Action was taken in the control room to remove
the recirculation pumps from operation as isolating this section of
RBCCW system piping will interrupt cooling flow to the "B" and "C"
recirculation pumps. From analyzing available information on plant
parameter'., and alarms, the inspection team's best judgement is that
the "B" recirculation discharge valve was shut at approximately
02:17:20 followed immediately by closure of the "C" recirculation
discharge valve at approximately 02:17:22. The graphic time history
of significant parameters used to draw these conclusions is shown in
Figures 3 and 4 and events are described in detail in Table 1. The
conclusion that "C" recirculation discharge valve was shut can not
be verified, however, the weight of technical evidence supports this
conclusion.
As the "B" and "C" discharge isolation valves stroked shut, the alarm
annunciator in the control room "Less Than 2 LPS" was actuated. This
alarm indicates that less than 2 recirculation system loops are
unisolated and is described in the Oyster Creek technical specifica-
tion as a safety limit. (See paragraph 5.1 for further detail.) At i
this point with "B" and "C" valves shutting and the annunciator
alarming, action was taken by the CR0 to immediately open "0" and "A"
recirculation discharge valves at approximately 02:17:28 and 02:17:30
respectively. Action could not have been taken to simply reopen the
"B" and "C" recirculation discharge isolation valves since the valve
closing signal seals in, requiring the valve to full stroke closed
prior to permitting the valve to be reopened.
)
l Opening "D" and "A" was accomplished to assure adequate fluid com-
munication between the reactor vessel core region and the annulus
region (safety limit basis). This is important as most of the reac-
tor level instrumentation measures water level in the annulus region
with the exception of the fuel zone level instrumentation which meas-
l '
ures the core region level. (See paragraph 5.2 for further detail.)
With the "B" and "C" recirculation pumps still running and the dis-
charge valves shutting, the operator reduced recirculation flow using
the master recirculation flow controller prior to tripping "B" and
"C" recirculation pumps at approximately 02:18:10 and 02:18:14
'
respectively. During this time, shift personnel were able to stop
the RBCCW leak by isolating RBCCW to the drywell and as a result to
the recirculation pumps.
At this point, the recirculation pumps were coasting down and two
isolation valves were stroking open and two isolation valves were
stroking shut. The less than two loops alarm was still illuminated.
The "E" recirculation loop remaind isolated with shutdown cooling
system operating throughout the event.
.
.
.
. - ____ _ __.
F .
'
,
.
5
.
The valve stroke times are such that the "C" valve was able to stroke
shut prior to the npening valves clearing the "Less Than 2 LPS"
annunciator. The inspection team concluded that when "C" valve
closed it was irnmediately reopened which would support the "C" loop
suction temperature decrease identified later in the event. Immedi-
ately after "C" loop was reopened, the "Less Than 2 LPS" alarm
cleared at 02:19:17, since "A" and "0" valves were now full open.
(See Figure 3.)
Subsequently, cleanup letdown flow was stopped and condensate flow
was increased to raise reactor water level to 185" to enhance shut-
dov(n cooling circulation and develop natural circulation flow. The
"B" discharge recirculation valve was opened approximately 27 minutes
after start of the event and about 25 minutes prior to the start of
the recirculation pumps. V-5-167 was eventually backseated, permit-
ting restoration of RBCCW flow to the recirculation pumps and start-
ing of the "A" and "D" recirculation pumps.
After the initial event and prior to starting recirculation pumps "A"
and "D", the loop suction temperatures trended down for the open
recirculation loops A, C, and D. This occurred prior to water level
being raised to 185" inches above Top of Active Fuel (TAF) to facili-
tate natural circulation and shutdown cooling flow. Prior to this
time, shutdown cooling flow likely was backflowing in the open recir-
culation loops to cause the suction temperature decline as indicated
on Figure 4. Almost 40 minutes arter the event, the "A" and "D"
recirculation pumps were started causing increased reverse flow
through unisolated loop "B" and 'C" and increased core flow. The
increased flow promoted uniform mixing of the reactor coolant and
eliminated any stagnant water. As a result the loop suction tempera-
ture profiles responded as indicated in Figure 4. The maximum recir-
culation suction water temperature occurred at this time and was
155 F.
3.3 Analysis of Safety Significance
The safety significance of this event is considered low based upon
the analysis of the events by the inspection team. The basis of the
safety limit is to maintain fluid communication between the core
region and the annulus region of the reactor vessel. The annulus
region is where most of the level instrumentation measures reactor
vessel level. Only the fuel zone level instrumentation measures
level in the core region. The re fo re, to accurately measure vessel
level and activate the associated alarms and safety features, at
least two loops must be open to facilitate adequate fluid communica-
tion between the core region and the annulus, according to Technical
. - .
.
.
.
6
Specifications. The licensee has determined that one loop open would
be sufficient to maintain communication and _that during a plant shut-
down, if no action is taken upon isolating all' five recirculation'
loops, it would take approximately six hours before boiloff. of water
would lower vessel level to the- top' of active fuel from the normal
water level band. The inspection team review agrees with this
analysis.
In this case, two isolation valves were opening as two isolation
valves were closing and in addition all five recirculation discharge
bypass isolation valves (2" valves) were full open. The inspection
team's analysis indicates that the time span from - when the first-
isolation valve started.to close until second isolation valve reached
the full. open position and cleared the less-than-two-loops-isolated
alarm, the time was approximately two minutes. The maximum possible
time duration for this valve stroke sequence to occur would have been
approximately two and one half minutes. Therefore, considering
actual valve stroke times and time duration of the sequence, there
was no time period during which the core region was completely
isolated from the annulus region. In addition, the pump discharge
bypass valves were open throughout.
In conclusion, this event is considered to be a literal violation of
the safety limit Technical Specification, but its safety significance ,
is considered low. 'he basis for this conclusion is that core cool-
ing was always adeqtate due to the low decay heat levels, fluid com-
munication between vessel regions was always maintained and, in addi-
tion, the fuel zone level instrumentation was functional and indi-
cated that the fuel region water level .was always maintained at
appropriate levels for a shutdown reactor.
4. Maintenance Activities Leading Up to the Event
A leak of approximately 250 gallons of mildly radioactive liquid froa the
Reactor Building Closed Cooling Water (RBCCW) system occurred while re-
-
placing the packing on isolation valve V-5-167 shortly after 0200 hours
on September 11, 1987. This occurred over a period of 10-15 minutes, con-
taminated the worker involved in the valve packing, and required plant
operations to secure the leak and render assistance to the worker.
The RBCCW systen is a closed loop cooling water system which provides
cooling to the following components in the drywell:
--
Reactor Recirculation
pump and motor
coolers (5) l
--
Orywell cooling
units (5 with one spare)
--
Drywell equipment
drain tank (1)
I
l
I
.i
*
. .
.
7
The RBCCW system normally operates at approximately 100 psi, with tempera-
ture maintained in the low end of the 70 to 150 F operating band.
V-5-167 is an outboard primary containment isolation valve used to isolate
the RBCCW system drywell cooling return header. V-5-167 is a six inch
motor operated gate valve mounted upside down (Fig.1) in that the gate is
above the valve stem (packing leakage travels down'the valve stem).
V-5-167 failed to meet its required valve stroke time during a surveil-
lance test conducted on Jt ly 31, 1987. An investigation' determined that a
corrosion inhibitor (Boren Nitrate) used in the RBCCW system had leaked
from the packing down tha valve stem (valve is mounted upside down). This
packing leakage allowed boron crystals to form in the limitorque operator
stem nut, increasing ialve stem friction to the point that the limitorque
motor cut off on high torque. The licensee cleaned up the stem nut and
applied a nuclear grade lubricant on the valve stem while . stroking the
valve. This action enabled the valve to meet its required stroke time
demonstrated during M0 VATS testing conducted on August 3,1987. However,
the MOVATs testing also determined that the motor operator was still
experiencing higher than desired motor current during valve operation. As
the long term corrective action, the licensee initiated a work order . on
August 6, 1%/ to repack the valve with Chesterton live loaded packing.
This packing usually prevents or minimizes packing leaks and would prevent
recurrence of the previous problem. Until the valve could be repacked,
the licensee implemented additional action to ensure valve operability.
This action included partially closing the valve monthly using the manual
operator and fully closing the valve quarterly using the electric motor
operator.
The maintenance planner specified the use of a Chesterton . repacking pro-
cedure (700.1.030) which required the valve to be isolated and vented as a
prerequisite to repacking the valve. On the morning of September 10, 1987,
the Maintenance Supervisor (MS) submitted a tagging request to'the Group
Shift Supervisor (GSS) which was in accordance with the procedure refer-
enced in the work order.
The GSS on shift then correctly advised the MS that the valve could not be
isolated at the time since the system was supplying cooling to critical
loads which could not be secured, and that the tagging request would have
to be revised to repack the valve on its backseat.
The MS informed his -superiors that he did not think he could perform the
repacking work under the procedure referred to in .the work plan. His
management discussed the adequacy of the procedure with plant engineering
(including the procedure's author) and the maintenance planner. A commun-
ication misunderstanding occurred in that plant engineering's position was
that the procedure would be adequate only with a temporary change to the
.. .. . .-.
_ _
.. .
.
0
.
'
.
l 8
procedure or additional precautions. However, maintenance management and
the maintenance planner concluded .from these conversations that -plant
engineering concurred that the referenced procedure was adequate without
any . additions or modifications (communication problem #1). This is con-
trary to procedure control procedure 107 which stipulates a modification
to a procedure prerequisite requires a temporary change to the procedure
with approval of one of the following personnel:
1. Plant Operations Director
2. Manager Plant Operation
3. Operations Control Manager
4. Manager Plant Materiel
5. Plant Engineering Director
6. Director / Deputy Manager Radiological Controls (Rad Con require-
ments only)
7. PRG Chairman or Vice Chairman
8. Director / Deputy Director, Oyster Creek
During the day (September 10), maintenance management held additional dis- +
cussions within their department including the maintenance functional ;
manager and concluded the valve could be repacked on its backseat without
procedure modification. In the afternoon, the 8 A.M. to 4 P.H. shift MS
submitted a revised tagging request that specified the valve was to be
placed on its backseat and tagged for repacking. The MS told the GSS he
desired the valve to be manually placed on its backseat and a tag hung on ,
the valve. The GSS refused to manually backseat the valve due to concern
for damaging the valve stem and backseat and gave instructions to backseal
electrically. The GSS incorrectly thovaht that he was backseating the
valve by giving the valve a two second !ditional open signal on the nor-
mal control switch. The GSS believed tl , the two second additional open
comand would allow the torque switch to adequately backseat the valve
without any valve damage (technical problem #1). This method to backseat
the valve is not in accordance with any station approved procedure (proce-
dure problem #1). This action, accomplished late in the 8:00 a.m. to 4:00
p.m. shift, did not place the valve on its backseat as the limit switch
is not bypassed in the open direction. The GSS assumed the valve was
being repacked due to a visible packing leak. He reasoned- that if his
attempt to backseat the valve was unsuccessful, the packing leak would
still be evident. The GSS cautioned the MS to look for and report.any
indication of packing leakage so an operator could be dispatched to
manually backseat the valve. The station has two approved procedures
which could have been utilized to backseat this valve, a manual backseat-
ing procedure (A100-SMM-3917.06) and an electrical backseating procedure
(700.2.012), both of which require completion of a data sheet which was
not filled out. The electrical backseating procedure (700.2.012) is not
applicable for the subject valve and could only have been utilized by
first obtaining concurrence from plant engineering, which was not done.
l
, . *
- .-
l
9
A Reportable Occurrence (50-219/81-65/01T) occurred on December ~ 23, 1981,
and involved limitorque operators and isolation valves for the Isolation -
Condenser System which were found to have defects which did affect the
operability of one valve and could affect those on other systems that per-
form a reactor coolant pressure boundary and primary containment isolation
function. Corrective action taken for this incident required that all
station operating procedures would be reviewed and modified such that
safety system isolation valves would be backseated in an approved manner.
Neither the GSS, the maintenance planner, nor the MS knew that approved
station procedures were available- on the proper method to backseat this
valve (procedure problem #2). A detailed discussion of operator training
in the area of limitorque valve operations is discussed in paragraph 6.3
of this report.
A second communication misunderstanding occurred when the dayshift GSS
advised the MS that the valve was very close to its backseat or just on
its backseat. The MS left the control room understanding that the valve
had been electrically backseated (communication problem #2). The valve
was in fact, approximately one and 1/4 turn off its backseat. The day-
shift GSS directed that the breaker that provides power to V-5-167 motor
operator be tagged out. This is the only tag that was hung for the re-
packing of V-5-167. This is contrary to equipment control procedure 108,
paragraph 5.1.9, which requires that "If equipment or piping is to be
opened, valves and switches shall be aligned and tagged so as to insure
that the work does not present a hazard to personnel or equipment from
pressure, vacuum, fluids, gasses, or radioactive contamination. . ." Also,
paragraph 5.1.15 requires that "If a tag is placed on a component's power
supply, a tag shall also be placed on each remote control. A tag need not
necessarily be placed on the component's manual operator in this case, if
the manual operator or its associated component is not part of the safety
boundary."
The 4 to 12 P.M. shift on September 10 was unable to accomplish the re-
packing due to required machining on the packing follower. The September i
11, 12:00 midnight to 8:00 A.M. operation shift was turned over with the
information that the valve was backseated (communication problem #3). The
mechanic performing the maintenance went to the control room to verify
valve position prior to commencing work. The operating shift confirmed
, ~
that the valve was backseated. The mechanic proceeded to remove the valve t
packing one ring at a time and observed no leakage while removing the
first four rings of packing. At approximately 2:10 A.M. , the mechanic
commenced removal of the fif th ring of packing (8 rings total) when the
remaining packing blew out causing a sizable RBCCW system leak. Personnel
in the area responded promptly und took effective action to isolate the
leak and minimized the size of the spill area. The radiological impact of
this event is discussed in paragraph 7 of this report.
. _ _ _
.
.
.
.
10
@Jmmary of Maintenance Activities
1. The final work package as written effectively communicated to the MS
and the GSS that V-5-li7 was required to be on its backseat to per-
form the valve repacking. The GSS overruled the MS's request that
the valve be manually backseated and tagged. The GSS was not aware
of the approved station procedures for backseating this valve. The
GSS did not request guidance from plant engineering or Technical
Functions as to the method or procedure which should be used to back-
seat this valve.
The GSS developed and implemented his own method which he thought
would place the valve just on its backseat or very close to its back-
seat for maintenance work that would remove all the valve packing
from the stuffing box. The GSS and MS did not understand from the
work package that all the packing would be removed from the stuffing
box. The GSS's method actually placed the valve approximately one
and a quarter turns off its backseat. .
2. The system conditions for the repacking maintenance did not meet the
prerequisites in the procedure referenced in the work package. Pro-
cedure 107 requires a modification to a procedure prerequisite obtain
approval of senior level review, which was not done.
The work package did not specify the specific procedure to be uti-
lized to backseat the valve for the maintenance work (plant-wide
standard practice).
3. The equipment control procedure 108, Sections 5.1.9 and 5.1.15 were
not complied with in that the manual operator on the valve was not
tagged and its operation affected the safety boundary. Several other
procedure problems, three communication problems, and a technical
problem were identified and are highlighted in the above write-up.
5. Safety Limit
5.1 History of Technical Specification Safety Limit 2.1.E
On May 2, 1979, an event occurred at Oyster Creek involving closure
of all five recirculation pump discharge valves shortly after a
reactor scram and subsequent initiation of the isolation condensers.
Because the five discharge valves were closed, there was a break in
the communication of fluid between the annulus and reactor fuel
spaces within the reactor vessel. Since the reactor vessel low and
low-low level alarms are sensed from level indicators that monitor
water level in the annulus region, the loss of water inventory from
the fuel region caused by isolation condenser operation remained
undetected until the low-low-low level alarm was received. This
alarm was received because its water level system's variable leg is
the core spray sparger which is within the reactor fuel space region
of the vessel.
.
.
.
.
11
Prior to this event, the Technical Specifications (TS) did not spec-
ifically address any requirements for recirculation loop valve
positions. The TS did, however, specify in Safety Limit 2.1.0, the
minimum water level during the shutdown mode. Subsequent to this
1979 event, TS Amendment No. 36 was issued on May 30, 1979 to amend
Safety Limit 2.1.0 to specify the minimum water level in all modes of
operation and add Safety Limit 2.1.E that required two recirculation
loops to remain open during all modes of operation except with the
reactor vessel head removed. At about the time this amendment was
issued, all affected site procedures were revised to reflect the new
Safety Limit and plant operator training was updated.
5.2 History of the Recirculation Loop Alarm / Interlock
As a result of the incident described in Paragraph 5.1 above, the
licensee investigated the use of an interlock scheme to prevent iso-
lating more than three recirculation loops.2* Following the Three
Mile Island (TMI) 2 event, the NRC issued NUREG-0626 on May 7, 1980.
Recommendation A.8 stated interlocks should be installed on all
nuclear power plants without jet pumps for recirculation to assure
that at least two recirculation loops are open for recirculation flow
for modes other than cold shutdown. Later in 1980, gosition
II.K.3.19 in NUREG-0660 and 0737 reiterated this statement and clar-
ified it to be a post TMI Action Item. The licensee's initial re-
sponses to these NUREGs indicated they intended to install the inter-
lock.2 An installation specification was developed, and the project
planned for the 1983-84 refueling outage. It was subsequently can-
celled. Because of delays encountered with designing and installing
the modification, the licensee took compensatory measures by adding
hinged covers to the 3F control room panel that covered the control
switches for each pair of recirculation loop isolation valves. An
engraved caution sign was affixed to each cover alerting the opera-
tors to avoid less than three loop operation.
On March 14, 1983, the NRC issued a Confirmatory Order to GPUN set-
ting forth dates by which various TMI Action Plan Items were to be
completed. This Order stated that the licensee had until the end of
the 11R outage to complete installation of the interlock modifica-
tion. In September 1985, the licensee informed NRC by letter' that
an alarm would meet the functional requirements of an interlock. The
letter went on to say the alarm provides positive active indication
to the operator that a fourth loop has been isolated and further
explained that the NRC Staff evaluation, presented in NUREG-0626, did
not take into consideration a fuel zone level monitorir.g system for
Oyster Creek vintage plants. During the 1979-80 Cycle 9 refueling
outage wide range fuel zone level indication and a recorder were
installed. With recirculation pumps tripped, this instrumentation
provides the reactor operator with level indication in the core
region.
* Footnote references can be found in Appendix A.
. ..
..
.
.
.
12
A meeting between GPUN and NRC/NRR to discuss this proposal occurred
on October 9,1985. The NRC requested further amplification of the
proposal which was provided by GPUN in a January 1986 letter." This
letter explained that: (1) the alarm on closure.of the fourth loop
isolation valve.would alert the operator that a Safety Limit had been
violated, (2) analysis concluded only. one unisolated/ recirculation
loop is required to provide coolant communication between the annulus
and- core regions, (3) with one loop open in addition to the five-
2-inch discharge valve bypass valves open the recirculation flowrate
is about 5 to 6 times the boiloff rate in the core region, thus,
indicating the conservativeness of the Safety Limit that requires two
open loops, (4) with the alarm modification, an operator would have
to disregard training, violate procedures and ignore posted warnings,
and be unaware of the significance of the switch covers in order to
violate the safety limit.
NRC accepted GPUN's : proposal for the alternat.ive in a July 1986
letter' that accompanied TS Amendment No. 106. This letter stated it
documented revising the requirement in the March 14, 1983 Order to
agree with the change from an interlock to an alarm. NRC concluded
that the alarm only modification and trained operators would'have the
same effect as the interlock without the complexity introduced by the
interlock. The alarm was installed during the 11R outage and has
been functional during cycle 11 operation. It is a unique alarm in
that when it alarms the alarm light has a green background whereas
other alarms have a white background. The engraving on the alarm
states, "Less than two recirc loops open". It should be noted that,
until the recent installation of this alarm, operators would not have
been alerted had they violated Safety Limit 2.1.E. '
6. Human Factors in the Control Room
6.1 Procedural Requirements For Operation of Recirculation loop Valves
Station Procedure 301, Nuclear Steam Supply System, contains the pro-
cedure for operation of the recirculation loop valves. Paragraph
4.2.2, which is a precaution, restates Safety Limit 2.1.E.
Paragraphs 4.3.3 and 4.3.4 are the steps to open or close a suction
or discharge valve and appear to be poorly written regarding closing l
the valves as described in the last paragrt.ph of this section. l
l
!
i
_ _ ..
,..
.. ...
..
13
The steps read:
"4.3.3 To 'open suction or discharge valves, hold their
- respective control switches on 3F in the "0 PEN"
position and then rslease.the switch. ,
4.3.4 Repeat the same' procedure for valve closure.
NOTE: Torque switches . shut of f ' the valve drive
motors to prevent strain on valve parts
should an obstruction or damaged valve pre-
vent proper operation. If the valve does
not stroke in its normal time -+ 10 sec.
(suction valve - 2 min., 20 sec.; discharge
valve - 2 min.), release the control ' switch
and investigate the cause of the '
malfunction."
The last sentence of the "NOTE" in 4.3.4 implies 5he operator holds
the switch in the closed Sosition for a specified time. Yet the.
3
'
initial action in .4.3.4 is to repeat 4.3.3 which requires the oper-
ator to position the swite.h ard then release it. Because the 'close'
contact locks in after th9 switch is positioned to close the valve,
it is not necessary for the operator to hold the switch in the close
position and, in actual practice, the operators do not hold the i
switch.
4 6.2 procedural Requirements for Operation of the Recirculation pumps '
Station procedure 301 also contains the steps for normal operation of
the recirculation pumps. Steps 6.2.4 and 6.3.1 discuss how to change
recirculation flow and require that the individual recirc pump speed
control units should be in AUTO. In actual practice, operators do
not adhere to this requirement. The individual speed control units ;
- are left in BALANCE. While thi: is not a problem from the
operational performance, it is a departure from present practice. 1
<
Paragraph 7.0 of Standard Procedure 301 contains the steps * . aired i
to remove a recirculation pump from service under normal conditions.
It restates Safety Limit 2.1.E requirements. The sequence i s de-
- signed for normal plant operation, act an emergency type situation.
e The steps require the operator to, in order:
(1) Run the speed for the pump to be secured to the minimum
possible value.
;
,
!
-. . - . . - .
..
. .
.
14
,
(2) ' Check open the pump' discharge bypass valve and .then close
the discharge valve. There is a CAUTION-in the procedure
at this point that states: The suction and main discharge
valves of at least two (2) recirculation loops must ' remain
open.
(3) Stop the recirculation pump drive motor.
This procedure is lacking in specifics if three pumps are secured and
their respective discharge valve closed which is generally the case
when the plant is in cold shutdown. The-steps create the potential
during cold shutdown that the operator would unknowingly violate
safety limit 2.1.E; that is to say three valves are shut during cold
shutdown Nt the procedure tells the operator to close the valve
associated with the pump to be secured thereby resulting in four of *
five valves closed. The quandary could be avoided if the procedure
specifically instructed the operator to open an idle loop discharge
'
valve before entering the shutdown sequence for the fourth pump.
t
Abnormal Procedure 2000-ABN-3200.19, RBCCW Failure Response, contains :
;
'
the steps required.to remove recirculation pumps under abnormal con- '
ditions, e.g. , complete loss of RBCCW flow, major RBCCW leak, etc,
The steps in paragraph 3.1 of this procedure require the operator in
sequence to:
,
,
(1) Scram the reactor;
.
1
(2) Trip all operating recirculation pumps; and
(3) Confirm that all recirculation pump suction and discharge
J
valves are open. '
Based on a post event review of available data, it appears the
operator did not respond in accordance with this procedure.
.
6.3 Operator Training - Motor Operated Valves
A review of operator training in the area of motor operated valves
(MOVs) indicated that all licensed operators received training on
, MOVs in December 1986, Ja nua ry, and February 1987. The training
- described, in part, that the motor can be stopped by a signal to its <
control circuit frca either a torque switch or a limit switch. It
4 was explained that valve travel in the closed direction can be
stopped either by limit switch or torque switch and in the open ,
direction by limit switch. Additionally, a torque switch will stop
valve travel in either direction to prevent valve damage. This would
prevent, for example, damage to the valve if the open limit switch
failed. J
)
l
,
,- -
. - , . , -- , ,
-.
.
.
.. -
.-
15
The training material consisted of several handouts, a video tape I
presentation, and an actual valve and motor operator. The classroom
-material' that was discussed included backseating for leakage control, J
r
including electrical backseating using site procedures and standing 1,
orders. It appeared from a review of this training that the recipi-
ents should have been aware that a MOV could not be backseated elec-
trically using the valve's control switch. This knowledge should
have been reinforced by the routine use of site procedures to elec- N
trically backseat valves. These procedures require overriding a
contactor locally at the breaker and monitoring ' current to the motor
using an ammeter.
7. Contamination Incident
The maintenance worker performing the valve repacking was sprayed with
water from the RBCCW system. He was quickly removed from the area and his
clothing removed. He was frisked and found to have less than 100 cpm
contamination on his skin. He then showere'd and had a. whole body count
performed. The results of the whole body count identified no abnormal
activity. The individuti also received water containing boron nitrate in
his eyes and was treated for eye irritation.
7,
One AIT inspector discussed the incident with station personnel, reviewed
the applicable Radiatian Work Permit (RWP), the results of a whole body
count on the affected individual and a_ statement by a licensee physician
who examined the individual. During the review, the inspector noted that "
the individual performing the maintenance was dressed only in rubber
gloves and a hood. Review of the RWP identified that anticontamination
clothing was only required if the surface area surrounding the valve was /
contaminated. The inspector asked about this requirement. Licensee
representatives stated that based on conditions in the RBCCW system, the
backseating of the affected valve and the fact that a catch basin was
being placed under the work ares to catch minor leakage, no further pro- '
tect';n was required. The licensee representative further stated that had :
they expected a large amount of water, plastic suits would have been
required. The inspector, in consultation with Region I radiation protec-
tion personnel, determined that the licensee's actions were ar ,1riate
i for the circumstances. The inspector had no further questions , garding
this matter.
8. Notification
On September 11, 1987, at about 0218, while performing maintenance on the
Reactor Building Closed Cooling System (RBCCW) leakage occurred from the
system and an operator proceeded to shutdown-the two recirculation pumps,
which were in service at the time as a result of a need to isolate the
a
_ _ _ - _ _ _ _ - _ _ _ _
~
c ; 1
' *
c - ,
k.
r,
16
-
RBCCW system leak. This is in violation of Technical Specifica ton 2.1.C.
Fuel Cladding Integrity, which requires two recirculation _ loo,1 to have
-'
their suction and discharge valves 19 the fula'open position turing all
modes of operation. At the time of the event, _ the Oyster ' Creek plant was
in cold shutdown conditions. The licensee notified' the NRC On erations
Center in Bethesda, MD of this event at 0403 on-September 11, 1'87/(ohi
hour and forty-five minutes after the event).
~
10 CFR 50.72(b)(2) requires that for such an' event that occurred at Oyster
Creek, the licensee shall notify the NRC as soon as practical and in all
cases within four hours of the occurrence.'
I
'The staff is presently reviewing the licensee's internal management
notification of this event. Preliminary information indicates that oper-
ations management was not advised of the event in a timely manner and that
some details were not communicated to management by the operations staff.
9. Review of Sequence of Alarms Recorder Tapes and Control Room Operator Logs
Late on the morning of September 11, 1987, the licensee reported to. NRC
that a portion of the Sequence of Alarms Recorder- printout was missing.
Later in the day, an operator disclosed that he tore off the tape, dis-
carded some in wastebaskets and threw some in a toilet. The circumstances
surrounding this missing record are subjects of invlestiga. tion . by the l
licensee and by NRC. The inspection team examined a sample of similar !
records to ascertain patterns.
l
l
l
A review of the sequence alarms recorder. tapes from the period of August !
l 28, 1987 at 3:15 A.M. through September '10, 1987 at 4:53:00 P.M.
(two i
i large rolls of recorder tape) did nnt reveal any evidence that recorder l tape had been destroyed or missing. The ' inspector also reviewed ' Centrol
Room Operator logs for the period of August 1,1987 through September 10, j
1987. Based on his review of this information, the inspector concluded j
that control room operator logs were in order. I
i
In Inspection Report 50-219/86-38, the resident ingpector of Oyster Creek
stated in his review of an event which occurred on December 27, 1986,
that, "During the course of reviewing this sequence of events, the inspec-
tors' investigation was hampered by the sequence of alarm recorder missing
approximately seven hours of information. Apparently, the operator
neglected to insert new paper tape when the recorder ran out." Basd on
the fact that similar information was missing during .the Safety Violation
event, the inspector again reviewed the information provided on the sub-
ject tape. The inspector concluded that there were no irregularities on
the subject sequence of alarms recorder tape. The physical examination of ,
the tape corroborated the original view that the operator neglected to
insert a new tape when the recorder tape ran out.
r
a
f
u_ m__.___m_Q
. - - - --
p - - - -
n
y
w w
.
..
Q{g o N - -
.._. L
'
, Q.
,cv '
*.i %
(, e
k. ' '
:$ ,1s
-
c .
,
I-
.
, .
D _
,
s
'
' 10. Licensee Review of Event '. / * '
,
- By the time the AIT leader arrived at the site on Seatember s,1987, the .
licensee had formed .two internal task ' groups fand ehgaged investigative:
, consultants. -One onsite ! review group exan.ined the maintenanceactivities
discussed in Section. 4 ott this freport. The(onsite' oroup completed its
review during this inspection _ per,iod 'and, is ~.fcrnulating. corrective-
acti ca s.- Inspector interaction with' the licensee myiew ~ found st" to be-
objective and. self-critical in ' it(' deteref nat ton : of root ;causes. 'The .
'
second effort was the' technical review:and anal.,isti of 'the event an'd it W L
safety implications. While consider &hle' work is still .in. progress,
'1
inspector interactions with members of thiogrobp found the effort to be. ',
directed to complete consideration of the event' and its. ramifications end ,
to be a detailed reconstrJCtion.of- the sequence of events and explanation
, of exactly what happenea.- The 'results. . of this group s' work wil10 be' - 8 '
. focused toward submitting- the 3 required (TS 6.7) report to' L9 Comission.
,
,
4
TheinvestigativeconsultantswereretainedbythRlf;;enseetdexaminethe .
circumstances of missing records. The investiguiton was ongoing at the
_
:
conclusion of this inspection and was beyond the; scope.of the AIT charter? -'
,
11. Conclusions !
,
!
! On the basis of our . review and analysis of ' plant' records as discussed in l
this report, the inspection team has concluded that a violation of Safety
, Limit 2.1.E had occurred in-that fewer than tw> sets of valves wen fully .
open.
l ,
9
The inspection team also concluded that the event- has miner significanct.
j from a reactor safety viewpcint for the following reasons: * i
; 1. The plant had been shut down for one day and was being cooled by
4 the shutdown usaiing system as described in Section 4 of this ~
i
'
report.
i 2. With the combination of valvts being opened and closed, the
augmene.ed inspection! team has concl9ded u.. discussed in Section
.
3 of thils report and depicted in Figure 3'that there wts always
; suf fici<ent fluid communication between the reacter core region
and the annulus region of the reactor vesesl to asem.ain fluid
level in the core region. ,
l
!
- 3. The fuel zone level indicator was oper ble throughout-the event
and, as discussed in Section 3 et this report, the water. level
was always capable of being monitored.
' .
L
;-
i
f
>
4 ,
=I
.
..I d
-
.(
\ u ,
Y
. n . , , --.,, - , e -n ,ago - - - - ,
--nn-
,
_; o ,
7
.. . .
y
.- ,
[' 18
G E
- As . discussed in ' Sections 3 and 4 of this report, the. Augmented Inspection
Team determined .that a maintenance activity led to . a leak in a cool.ing
,
; water system which resulted in, a rapid need to secure recirculation pumps
and a consequent valving error led to.the violation of the safety limit.
On the basis of our ' review of maintenance activities, and as discussed in
Section 4 of this report, the inspection team concluded that:
,- -1. The--final work package as written effectively communicated to
i the MS and GSS that V-5-167' was required to be on its backseat
to Mrform the valve repacking, - but the GSS - overruled the MS
request - that the valve be manually backseated' and. tagged. The
GSS was not aware of the approved station procedure for back-
seating the valve and did not request guidance from Plant
Engineering nor Technical Functions as to the- method or-
,
procedure which should be used to backseat the valve.
I 2. The system condition' ' for the repacking maintenance did not meet
the prerequisiter, in procedure 107- referenced in the work
i pankage. I 3 !- The equipment control procedure 108, sections 5.1.9 and 5.1.b5
were not complied with in that the manual operator on the valve
a was not tagged.
i
'
Basec .on our review of procedures governing the activities conducted in
.
4 i the control rcom, the inspection team concluded that the activities did 1- not strir.tu follow the procedures written. In this instance, it appears
: that the protaduras had not been revised to reflect existing plant prac-
tices -'nr .snJttin$ doWh and operating recirculation pumps and valves.
Detat';.s of our review are presented in Section 6 of this reprt. Further,
all licenssti operators received training on motor-operated valves (MOV) in
the period Decembr.r 1986 - February 1987. From lesson plans, operators
should have been aware that MOVs could not be backseated electrically
using only the control switch.
The inspection team also reviewed the recovery - from the leak and the
handling of the resulting minor' contamination / personnel safety problems.
As discussed in Section 7 the team concluded that actions taken were
accomplished promptly and properly and were appropriate for the circum-
j stances.
! The Nuclear Regulatory Commission was notified approximately one hour and
1. forty five minutes after the event. Therefore, the licensee met the four [ ,
hour reporting ' requirement of Section 50.72, paragraph (b) of 10 CFR 50.
2
The operators' actions subsequent to the event were not reviewed during.
this inspection. The reviews of those activities and the corrective
ections taken as a ressit of licensee evaluation will be conducted
j_ Xparately. , 4
. . _ _ . . _ . _ _ _
_ . . _ _ _ _ _ . . . _ . _ _ _ - - _ . . _
_ . - - - - . . _ . - - - - . _ - - - - - . _ - . - . - - . - . _ . - . . ~
l -
FIGURE 1
,
.-
-
j
..
.
l
'
b: j .
l
-
.
$ '- ,
,
;~~ -
-
4 l yg
5
-
,. sn (-
\
, :- ,
!
.
-
. --
.
g
., ,
,
c- .
'
..- ,
-
' ,# ~
j' s
' *
l ,.
c .: cP: RAT:a tec e; ear.4:st Ear::T tea sie: Ars, 1
]
l 'iM'!E V-5-lC7
.L , Y
g 'j kEs I -
.
%
'-
6
~
.
, fy . [. a -
*
'
, .,
1 )- .
. .;
-
l f
i
e .,-y.
t . .E
: . .
.,
3 C .P/G:1:G J AFB,
' I i
..- - - - - - - -----,.-... -.-- -._ - - -
-
- . - - - - - . . - - - - . - - - - - - - - - - -- -- - - - - - -
- _ _ . ,
i
-
FIGURE 2
'
~
-
-
h I~
-
..
h ff \[ [
;
-
IMutus
' m;n
Rd35 mi
'
"'
-
f
'
-
air a %' m t,.Ei
.
i$sy'
TE l EtY E6"E'4('4 E"4
.
=[.*lgp,a g\=*\h==g\,.*'
a '//la llE I R t U
.,
-
_ .. -
2 -
.c L
'
.
View of 3F panel. Five individual
recirc purp speed controllers en
'
View of 3F and 4F panels from behind bogg o
aggr igof
centrol roce desk. discharge valve operaticn.
!
._
i
' ~
..
(-
*
]
\
m h J
i
"?"'* " '" nummmm ; . ..
e f
r- 1-.- - -
. _ ,
l g' $
$) 1 : & ; 5+
v
.
..
-
:
*
q
-
.
'
]
j
!
i
_ , 9
. . ,
*
..
.
.
*
..
.1 s- ; ) !
'
't ; *:
*I'* '.$ '
-
.- . s-
l e ,. ,., ;* .1e.
,'- e. ,
,g g
j -
-
f
i
;
-
Illf. 's i
p<.~;.,g.g.
l .
.
,
,
i
- , .
'
. . .a .
i
j
,
,
l
i
,
;
'
s
u '
~ '
Alarr display E en 3F panel. Alarr
j !
4-b reads "LESS THAN 2 RECIRC LOOPS Seouence of Alarms Recorder (StR)
OPEN." with tape coming out.
l
!
i
1
,
- - , - - - , , , - - , , - - -
- - - , - , ,,-_ _ _ ,- __,.,_ _.,,-._,,____,,_- , _,_,-- _ _
.
.
*
.
GALLONS PER HINUTE n 10 *
, .
g6 50 3).00 6f.50 93 00 115.50 1,57.00 188.50 220.00
-
g. on .__ ..,,, ,. . . ~ ,6. . -. ,. m .u.
_ oumu e miu. ,atvc stans re e6.si.t***nt') '. "
-
D
I.
w 8 ao e i,
n
u,xem oo n ,, e
o o- ot:m 24 'Ltss vie ne 2 6 's" asArna y g r--
E ,,, ,
3
'
o o~ or:11: t o .n* o.sc ri ind. snais vm o'tiJ D
g o o - c2:e7: to .a* t,.cw vatvg senats ro esco
h
g . . . , . O o n l, o
*
. D oo e n 2:
8 $. .Il si
n o
g oo n
g p
;
o n - or 7:43
oi, su u'a*d'
ete'ac
c" ev
s *au cauta.u.stue a su m Deu,u vs.=o. maceva,g-
,,
o
,
- -
I ! E I $ **F .
s
D
.
g o o
-
n
4 g
o ll ei ITI
P ::. o o M
~ ~ .
*
Lh ll si g,
E ll al I
$ oi -ot:17:ss ,stsee or envtesc ates twewon 's' p
a ; ,. on Mi'.J t*l,la**~'" "c om ~'t
4
S P : n r
2 8 n
- ot ria4 4 svaa,
, Ruite o, enviest.a
6cer es *u.ie,c.ec Te a.oon
ose,e'A" i,n
,o
; va 6ve. str e< a s oce u
4
'
3 "
*
, y
. e
I
4-1, o2 1e:30 *4* eme c Dwu p ts vaippcs n [
. i b
8 na o -osu6:lf 'c ' m uses, Dwup y s rein. hts @
.a
Z
,
- * ~0
rei43 :n o . .
E
-
~
X'
.
*
\h I* ,o e
p
e, "
(,
- - -c.
g8 b#a J,
a
4
t. t.3
o
y
B[
,, y
, ,
v: m <,
.
u+x>a 8 .8
.
rn n
e
E g
.3 o O N
g
n - h
te: o '
-
g D r1
=
m+x*O g
f ,
- ettlS:32 s a ce w ceuu.o << ouyg ge pestsvec
n
C
.
1
o I J
E
o 8
i ,
2wetasit 7 n.c,. c,eess % es to
5"u tt' * 6-
q"
=====,
,,,,,.
Y-s-in awa v r-7e t.
:. Lia j, ,,a
E
, .I. _I _Ia.I. .I. ."_ - m <a n ,
o
, . ,
ha y z
g 8 n i gr
n
, i i ,
r'-
t
:
5
*
i >y o
s
.
o
, i a E
G o g[ u.,
JElih,
3
-
D
, ,o m., -
4 .
1()IH,
E.
. 3 10 r, M
1E i-i
,8 j- 10 +' ~ osiltsed *o" n,s vetva .s cer6J(u.vas :Ta.wa vius t 9r.,
.
g ,..
io
,
sace,u bs) Tiu te Fa.a4 ewyr g g )
o a6
$ g. 41r12 *s* >u w v4(vt eteses (wevat sta.us veute to? str.ves ;
** 3,h4 ,, -- ositols
a
; 3N .
-
02: neeve.cas est stav v. t AthewAwcCs t.d. ser.=es;
* h l
$ g :EI %
TbTAb Siteer & Teut t E il3 s E C.esbg;-rlu 9 6 FE.*'8 eFJf'lp)
~
m ,o 6-~ * n t14:Is e* o.un vnve e sat s (wsu sve t '."t : loc., su.~~t
N'l E 6 t et e.c a s 3.c.ie., 7.,g au..,,ng e : g.r,,g o ,,,es;
Q
,
TeTat sTie.si Twg r ? Jgj g gg.uDs,TM b reand es /tys)
-
.. io 4 'c" >se. vatve 2.urs,amy its. , cure.(v. m w
m t. : E 1oc. s a c ,=) ;
.
L f s1 rw A.J 1 4. Ps s/ee M A[
.
'
'
*i *
I
% a'
{j
. . .MM P i
...
o
k
N, i
4
. i,
t
9 < l
6)
4 1 %
, .
3 . p. . . . . . . _ . . - . - . ..
3
,,;
-
f.S N
l. .
4
,I. . .
-
- . . . ..=_ . ' . d
8
As
bo% .pp
n
. ,N *
8
y . . .
. .. . ; . .Ny \ . . g .-. . i
y i E o 9
f, 4, . ,; J. / @4 v .ii -- - i ..;
f.4 - . . . . - - . - - - .$ ---] l iQ
. . . . . . ....
lk _ . . .
N
__.._.g.-
j
'
er' '
E1 -
-
,
g *
,
T 1 ,
i
,
o
-*--9-- -(
*
- .., ... ._ ._ .. .. . . . - . . . - + . . . - - - - - - - ---+- ~ - - - "
*.
J_
_.
...
% f. y we m . ....a..----* --
_4., _ _ _ . . . . . . - . - . . . . - - . - -, - - - - - < - - - . - - + - + - - - - - ----- '
l
o
8 .
o.
d. j- iso
-
_ . . _ . . _ . . - . _ . . i. .-.--i .
, - - , - - -g - - - A
4
). _ . _ . _ . . - . . . . . . . -
*
=- ~
e. ._ y .
k .
g :
'
b *
*
Ri
, !
?
1
km(._ .. '
_ . . - - . - -
l
-
,
-"
._
.
! f
.k _k. - .. . .. - -. -
{
---- - -
' ,
8 '
a ! ; Ur 9
4
*
.. 4 .I..__.. _ _ . . - - - .
-
' - -i
@
i = . i- +
t i
g. t
Np 1 i
4 i l l l
I i l *
_
'
_ ._ ... _.. _ .--- , ,' ,
L..
< o ,
, ,-
O , i 1
H * n
, i
c
,
o.I
~. .),2 ggArt) tno)S)Q- . .
*
, o
r, o ._....., ,. _ - . - _. - _ . .____.
-.
o e
. .4
,
o
..... . . _ _ . _ . .. _. ___ . 11 .
:
'
k
#
es 4 ._.. _ _ ._ _ . ... .... _.._ _
v __t p
$ 8 3
_
y 8
%h
t3
k. -@-{-4 - - . _ _ _M k, L i. in ,' d
r.
l
OED i., . . ..- . - . . i[
c ,
o.
_$
3
C &
_. .
g -
7_..- _ . . . .$. g m_ . .. _ $, . . y.( .
-
.L*.,
. o
A 6 .
g e, . 4
{- g . - - - .
g __ g . _ . _ _ _ _ _ . . _
v
., ..p.
t 4
.g.Q. ,f
%
-
o
.- k Ny- -..f -_-, .~
4 ,f.
x
4
q . . .. .. % &. . y [ .__.
o
C.
g4 3 5' A -
3! 0 8
_{s u.3_-..>
_4 g
.,
.bi L
_w .__. . g
a
-
4 _
__L -, ,g ,
j--. . .a .- .. y >
.g
.jg.- .Vg.
va i
.. . y- _ ... . _ . . _ __ ..
o y en o
."j s 0 *
fs u A I 9
. .
u
h-
s s
go
.o
..
air
-
;a ,~
~
'.
I
- ; .
- . . ... .. . ... .
---_m- w ,. .. .w,...
. . ....... . ... .... .
- --
o - g. ,
9
.
-_.
g. 4..
('a
._. . ..i. <
.
AsWHelh)*72 h N
.
- -
3,,,, .. .3._._.._,._._ 3 a
EC W
a
*
- - . - . . . - . - . . -
. . _ . . . _. - .
y4
c4
_. }' ,
__
[
=
_ y
e
k 8i.;
ocSei on te's co sis' 'orsii e,iii,.irro.eit e6 64, e,.ogi eg.ggi ,, .g gi- e, ,,, p-
(301 Nll 1A3'l 02H XW . , ,
; , j
00' Ode 00'0dt 00'0i9 00 * c t'$ Co * C o'h
. 01 '= ;WH/ b'066M N0$0* Cit 3 C 'Ost 00'09'l
WiM0333 9 -' 00'os #b
00'cil co'ssi t t l 00 0; g
co est co est co gii co cii co sti co e(i ca.gii ca.,ai
.. .
(3 0301 *dW31 3W133W ca.odi E
.
. *
.
.-. _ ~ . . ~ - - . - . -. -. .
.
, - .
.
i
TABLE 1
,
SEQUENCE OF. EVENTS !
OYSTER CREEK EVENT,-SEPTEMBER 11, 1987 >
l Time Source Event i
02:02- Control Room "A" and "0" motor generator set motor winding
Recorder temperatures start to in' crease. "A" and- "0" reci rcu-
lation pumps are not operating. Temperatures increase
from approximately 85* F to 100': F over .a period of
about 16 minutes. The recorder - chart shows these s
,
temperatures remained at 100* F for about 25 minutes
-
J
'
until "A" and "0" recirc pumps were started. l
02:10 Operator Major-spill reported to control room from 23' ,
Estimated Interviews, elevation by radiological control technician .-
Time * Calculations, ;
Security -
Computer Group Operating Supervisor .(GOS) . dispatched to 23'
elevation l
GOS reports water coming from RBCCW
Shift personnel suspect leak' is coming from V-5-167
which was undergoing maintenance ,
Leak confirmed to be from V-5-167 l
;
2:17:20 SAR & "B" recirculation discharge valve started to close,
Analysis This time is based on the operator closing "B" recir- !
culation discharge valve shortly before the annunci- ~ !
ator alarm "less than 2 LPS" actuating. . Time was l
, allowed for "B" recire discharge valve travel from an ,
electrically backseated position.
~
(From backseat to
95% limit switch position: 5-6 seconds; valve stroke :
time: 107 seconds.) !
,
i
i
,
a 1
l
l
;
)
l
-
. - - , - - -
.
.
.
.
Table 1 2
Time Source Event
02:17:22 SAR & Probable "C" recirculation discharge valve closure
Analysis commences. This time as above is based on considered
operator action prior to actuating the annunciator
indicating less than 2 loops are operating or idle.
(Backseat to 95% limit: 5-6 seconds; valve stroke
time: 106 seconds.) In addition, examining the "B"
and "C" flow coastdown (see Figure 3), no gradual
tailoff is evident as would be apparent with the dis-
charge valve full open. Comparing the flow coastdown
for "B" and "C", the flow decrease compares favorably.
Therefore, whatever actions taken to produce the "B"
flow curve would have to be duplicated for the "C"
loop.
Note that the operator opened "A" and "D"
recirculation valves within 2 seconds.
02:17:26 SAR & "Less Than 2 LPS" annunciator actuated in control room
Analysis and printed on the sequence of alarm recorder (SAR).
The actual time of the annunciator could not be deter-
mined exac+1y from the SAR paper tape but a time check
on the tape immediately af ter the "Less than 2 LPS"
alarm indicated 02:17:45. This time was corrected to
the new plant computer system time to yield 02:17:38.
This time represents the latest time the alarm could
have actuated. Based on the valve stroke times to
clear the annunciator and analysis of plant parameters
02:17:26 was considered a probable time for
annunciator actuation.
02:17:28 SAR & "0" recirculation discharge valve starts to open.
Analysis This time was estimated from the "Less than 2 LPS
Normal" indicated on the SAR tape considering valve
stroke time and analysis of plant parameters. (Valve
stroke time: 96 seconds)
02:17:30 SAR & "A" recirculation discharge valve starts to open.
Analysis This time was estimated from the "less than 2 LPS
normal" indicated on the SAR tape considering valve
stroke time and analysis of plant parameters. (Valve
stroke time: 107 seconds)
.
.
.
.
Table 1 3
Time Source Event
02:17:42 Analysis "B" and "C" recirculation pumps are run back in auto-
matic control .from the master recirculation flow con-
troller. The computer graphical representation of
recirculation flow for the 9/11/87 event almost
exactly duplicates a 9/10/87 recirculation - flow'- re-
sponse in which both "B" and "C" recire pumps were -
ramped down in automatic control. The instrumentation
and control supervisor had installed strip chart
recorders monitoring "B" and "C" recirculation pump
controller responses for a troubleshooting effort to
correct flow oscillations with the "C" recirculation
pump. The 9/10 controller signal matches the 9/11
recorded controller response for "B" recirculation
pump during the event. "C" recirculation pump con-
troller was.not available-for comparison as-the strip
chart recorder had run out of paper. at approximately
1800 on 9/11/87. Comparing controller signal re-
sponses and recirculation flow responses for 9/10 and
9/11, it was concluded that the responses were essen-
tially the same and thati the operator had ramped both
"B" and "C" recirculation pumps back together using
automatic control from the master recirculation flow
controller.
02:17:58 Analysis Reverse flow is indicated in "0" recirculation loop as
"D" recirculation discharge valve strokes open.
02:18:04 Analysis Reverse flow is indicated in "A" recirculation loop as
"A" recirculation discharge valve strokes open.
02:18:08 SAR & RBCCW isolation alarm (due to closing V-5-166)
Analysis V-5-166 and V-5-709 were closed to stop RBCCW 1eak
02:18:10 Analysis "B" recirculation pump tripped. "B" recirc loop flow
starts to coast down "B" motor generator (MG) set
motor winding temperatures start decreasing from =
137' F to about 90 F over a period of hours. "B"
pump motor winding temperatures decrease slightly.
(Control room recorder)
_ ..
.
.
.
Table 1 4
.
Time Source Event
The str!p chart . recorder that was monitoring "B"
recirculation pump controller signals 'at the- time of
the- event captures the "B" recirculation pump trip.
The blind controller output ' signal indicates-a step
decrease in demanded recirculation flow, followed
immediately by the pump trip . indicated- by the tach-
ometer feed back signal dropping precipitously to zero
and the blind controller output signal immediately
positioning to the low limiter setpoint which on = the
chart is reflected as approximately 38 ma. (An I & C
supervisor later recalibrated the recorder and deter-
-
mined -the reading to be approximately 24.43 'ma which-
corresponds roughly to. a 20% limiter setting. This is
an appropriate _ limiter setting for a- running- recirc
-
- pump. Other limiter settings were as follows ,_ "A" ,
!
recirc pump: Lo-20; HI-97, "B" recirc pump: Lo-98;
HI-100, "C" rectre pump: Lo-100; HI-100, "D" rectre
pump: Lo-100; HI-100, "E" recirc pump: Lo-20; HI-100.
! "A", "D", and "E" pumps were running at the time.)
Upon recirculation pump trip, the low lin: iter setpoint
becomes the controlling-input to the blind controller.
Af ter approximately 6 minutes,. the controller output .
signal step increases offscale which might correspond
to raising the low limiter setpoint up to 100. After
the event, the "B" pump . limiter setpoint was dis-
.
covered to be set at 93. Possibly there was some con-
sideration given to restarting the "B" pump af ter the
trip as one would raise the limiter setpoint up to 100
to warm MG set hydraulic fluid prior to restarting the
pump. This is a plausible explanation for the strip
chart recorder trace. Others were explored, but this
one was found to be nest suitable.
02:18:14 Analysis "C" recirculation pump tripped. "C" recirc loop- flow
starts to coastdown. "C" motor generator set motor
winding temperatures start decreasing. "C" pump motor
winding temoeratures start decreasing from approxi-
4
mately 137* F to about 90* F over a period of hours.
i
(Control room recorder)
,
Core delta P goes to zero. If all pumps are tripped
at this time, fuel zone level turned on, but does not
come onscale until later.
'
02:18:32 Analysis RBCCW common heat uchanger outlet pressure increases
approximately 7 psig in pressure step increments cor-
responding to the time V-5-166, V-5-709 were shut.
+
.. _ . . . - -
.
.
.-
.
Table 1 5
I
Time Source Event :
02:18:34 SAR Reactor level high alarm 170" yarway.- Level increase
.
due to rectre - pump- trips and reduction- in letdown ,
flow.
02:18:36 SAR Reactor level high alarm
02:18:38 SAR "A" recirc pump CCW low flow due to isolation of
V-5-166 and V-5-709
02:18:39 SAR "0" recirc pump CCW low flow
02:18:50 SAR "B" recirc pump CCW low flow
02:18:51 SAR "C" rectre pump CCW low flow
02:19:04 Analysis "0" recirculation discharge' reaches. full stroke and is
open. (Valve stroke time: 96 seconds)
This estimated time is based on the valve being opened
at 02:17:28.
Note that if "C" had been open at this point the "Less
than 2 LPS" alarm would have cleared.
02:19:12 Analysis "B" recirculation discharge valve closes. (Valve
stroke time: 107 seconds; electrical backseating-time
allowance: 5-6 seconds.)
This time is based on the valve starting to close at
02:17:20.
02:19:13 Analysis Probable "C" recirculation discharge valve closure.
(Valve stroke time: 106 seconds; electrical backseat-
ing allowance: 5-6 scconds.) The > operator probably
now reopened the valve as the "Less than 2 LPS"
annunciator would be still illuminated and "C" loop is
more preferable to reopen as "B" loop has RWCU on the
loop. "C" has no other systems tied into loop piping.
02:19:17 SAR & Less than 2 loops isolated normal alarm. At least 2
Analysis recirculation loops are open.
"A" recirculation discharge isolation valve reaches
full open position and clears the "Less than 2 LPS"
annunciator. Stroke times are essentially based on
the amount of time it takes the valve to travel from
the 95% oper. limit switch to the full close position.
The licensee estimated approximately 0.3 seconds
travel time from the full open position to the .95%
open limit switch under the no rectreulation flow and
unbackseated condition.
-.
.
-c .
.-
Table 1 6
Time Source Event-
02:20 Licensee Cleanup letdown flow stopped. Commenced raising Rx
Operator water level to 185 ; inches for natural circulation
Interviews
02:20:24 Analysis "C" recirc suction temp decreases from 144 to 142* F.
This occurs as shutdown ' cooling flow backflows in the
loops.- "C" recirc discharge valve is approximately
66% open.
02:20:34 Analysis Fuel zone water level comes onscale. Fuel zone water
level is turned on with no recirculation pumps running
but only indicates core region water level below.180"
TAF. Considering plant conditions with level. trans -
ients from turning off pumps and opening valves, it
was not considered unlikely that this instrument would
take nearly two minutes to indicate. onscale as level
drops accordingly.
02:20:59 Analysis "C" _ recirculation discharge isolation valve reaches
full open position.
02:21:30 Analysis "C" recirculation loop temperature decreases from 142
to 137' F. This occurs as shutdown cooling flow back-
flows in the loops and possible cold feedwater flow
distribution. Condensate flow is : increased from =
71.5 x 10' lb/hr to 80.35 x 10" lb/hr. This likely
resulted from operator action to open a bypass valve
around a main feed regulating valve to raise reactor
vessel level to 185" to facilitate shutdown cooling
flow circulation.
02:21:32 Analysis "A" recirculation loop suction temperature decreases
from 143 to 139' F.
02:22:16 Analysis "0" recirculation loop suction temperature decreases '
from 142' F to 138 F.
02:24:24 SAR
02:24:57 PSMS Computer Reactor water level Hi/Lo Alarm (170"; GEMAC)
Graph
02:30 Interviews V-5-167 Backseated; RBCCW 1eak stops.
02:44 Analysis "B" recirc pump discharge valve opened.
.
- .
.
Table 1 7
Time Source Event
02:54:49 SAR V-5-166 opened. RBCCW isolation alarm normal.
02:58:19 SAR RCD "C" CCW Lo flow alarm normal. V-5-709 opened
restoring RBCCW to RCP's
02:58:29 SAR RCP "B" CCW Lo flow normal
02:58:31 SAR RCP "D" CCW Lo flow normal
02:58:39 SAR RCP "A" CCW Lo flow normal.
03:08:41 SAR "0" recirc pump started.
03:15:03 SAR "A" recire pump started; normal shutdown conditions
restored.
,
;
;
!
!
!
,
_ _ _ _ _
.
-
.
.
APPENDIX A
EFFECTIVE
PROCEDURE TITLE REV. DATE
703.1.030 Generic Repack Procedure for 3 8/21/87
the use of Chesterton style
5300 style one (1) packing
Standing Backseating/Unbackseating of 4 3/23/87
Order 33
700.2.012 Electrically Backseating 4 5/06/85
Station Valves
A100-SMM-3917.06 Manually backseating station 0 11/13/86
valves
107 Procedure Control 32 8/14/87
108 Equipment Control 38 6/08/87
301 Nuclear Steam Supply System 39 3/29/87
2000-ABN-3200.19 RBCCW Failure Response 4 11/22/86
l l Bibliography for Section 5.2 1
1. Engineering Request ET. No. 391 issued 7/31/79
2. Letter from Finfrock to Eisenhut dated 6/23/80 .
Letter from Finfrock to Director NRR dated 4/3/83
Design Criteria 391-80-3, 9/12/80
Engineering Evaluation 391-80-1, 7/29/80
Installation Spec 391-80-4, 3/20/81
Modification Proposal 391-80-2, 3/18/81
Installation Spec 391-80-5, 12/10/81 (BA 402207)
3.
Letter from R. F. Wilson to J. Zwolinski dated 9/19/85 (RFW-0614)
4. Letter from R. F. Wilson to J. Zwolinski dated 1/30/86 (RFW-0770)
5. Letter from J. Donohew to P. Fiedler dated 7/15/86
.
.
_ _ _ _ _ _ _ _ _ _ .
.,' *
APPENDIX B '
.
SEP 151987
MEMORANDUM FOR: William F. Kane, Director
Division of Reactor Projects
FROM: William T. Russell
Regional Administrator
SUlklECT: AUGMENTED INSPECTION TEAM - SAFETY LIMIT VIOLATION AT OYSTER
CREEK
You are directed to perform a prompt inspection of the causes, safety implica- .
tions, and associated operator actions during a radioactive coolant spill and -
subsequent actions which resulted in a Safety Limit Violation at Oyster Creek
on September 11, 1987. The inspection shall be in accordance with NRC Manual'
Chapter 0513, Part III, and additional instructions in this memorandum.
DRP is assigned to conduct this inspection and Dr. L. H. Bettenhausen is
designated as the Team Leader. The team will also include the provision for
participation by the Office of Investigation and NRR.
,
I
OBJECTIVE .
,
The general objectives of the AIT are to:
l'
a. Conduct a timely, thorough, and systematic inspection related to the
circumstances surrounding the Safety Limit Violation. ,
b. Assess the safety significance of the events and communicate to Regional
and Heacquarters management the facts and safety concerns related to the
.
'
problems identified.
c. Collect, analyze, and document all relevant data and factual information
to determine the causes, conditions and circumstances pertaining to the :
events.
,
d. Evaluate the adequacy of the licensee's internal review of the event.
SCOPE OF THE INSPECTION
The AIT response should identify and document the relevant facts and determine
the probable causes and should be limited to the issues directly related to the
Safety Limit Violation event and operator responses.
I
39 '
,
_ - _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ - _
.
, . . - .
..
-Memorandum for William F. Kane 2
g
Specifically, the AIT should:
a. Develop a chronology of the event.
b. Determine the scope and quality of itcensee's internal review of the '
event.
c. Develop 'a history of the Safety Limit and why it exists,
d. Review the maintenance activities leading to the event.
e. Determine operator response.
SCHE 00LE
The AIT shall be dispatched to the Oyster Creek Nuclear Generating Station not
later than September 12, 1987, and shall remain there as long -as necessary to
accomplish the objectives of this inspection. It is expected that this will
take no longer than five working days.
A written report on this inspection will be provided to me by September 30,
1997. It may be necessary to report on operator integrity issues at a later
date as they are explored and identified.
TEAM COMPOSITION
The assigned team members are as fo11cws:
L. Bet'.enhausen, DRP, Ri
C. Cowgill, DRP, RI
W. Dateman, SRI - Oyster Creek
J. Wechselberger, R1 - Oyster Creek
D. Alsopp, RI - Hope Creek
A. Dromerick, NRR
Q ( t0-
William T. Russell
Regional Administrator
-,-
.. * .*
*
,
-
Memorandum for William F. Kane- 3
cc:-
J. M. Allan DRA
W. V. ' Johnston, DRS
T. T. Martin, DRSS
bec:
Team Members
S. Collins
R. Blough
W. Baunack
i
I
l
i
!
l
i
I
l
I
t
!
I
_ _ _ _ _ _ _ _ _ _ _ _ _ - -
.
. .
.
# *g UNITED 8TATES
! NUCLEAR REGULATORY COMMISSION
$ k REGION I
c, sa PAnx avrwve
WIWo 0F PMuesta, Pt NNSYWANIA teeos
APPENDIX C
%, e . . . * ,
*
11 SEF 1987
Docket No. 50-219
Confirmatory Action Letter No. 67-12
EA No. 87-185
GPU Nuclear Corporation
ATTN: Mr. P. R. Clark
President
100 Interpace Parkway
Parsippany, New Jersey 07054
Gentlemen:
Subject: Confirmatory Action Letter 87-12 - Violation of Technical
Specification Safety Limit and Subsequent Operator Actions
Pursuant to the telephone conversation on September 11, 1987 between
Mr. Samuel Collins of n.y staf f and Mr. Ed Kintner of your staff, it is
our understanding that you will:
1. Maintain the plant in a shut down condition per the requirements of 10
CFR 50.36 which require'. Cev.ission approval for restart.
2.
Estabitsn and raintain es found ceriditions for relevant hardware and
prccess systens which pertain to analysis of the event. These Cordttiens j
I
will be maintained until released by the NRC. l
,
3. Condset, an independent review of the circumstances surrour. ding the events
and forward a report to the Comnission per the requirertents of Technical i
Speciftcation Section 6.7.
l l It is our understanding that upcn complet. ion of formulation of your methodolcgy
to assess the violation of Technical Specification Safety Limit events and
subsequent c;erator actions, these plans will be discussed with the NRC prior
to implementation.
If your understanding of the actions to be taken dif fers from the above
description, please contact this of fice within 24 hours of receipt of this
letter and before restarting the plant from its current outage.
Sincerely,
*
W. w
'illiam T. Russell
Regional Administrator
't
c c a>wiw m
._ _ _
-
3
'
.. o * APPENDIX D
O
SEP 141987
Doc i;et IJo. 50-219 (CAL)
Con f i r raa t or y Action Letter 87-10
EA flo. 97-185
t1Ello:
To: Mr. P. P. f~iedler
Vi c e f'reci dent and Di rect or.
O ftter Creel:
Subiect: 11 0 :11 f a ceti on of CAL 07-12
I hav e ber.n ruthorized to releas e all plant equipment which
unc to be rnai n t ai nod er fcund by Concli t i on 2. of the sub.iFct
3 c- t t er . 1 h tuf e e r. 4 otind corat12 t i one are no 1onoer needed to
nr.alvre the e vc nt .
> /_
VM
i.et- H. lie t.t enh Aunen
Leodtr. Auonien t c d
Inr pec ti on Tram
l i l l l l
l
l i . i
I t l e _ _ _ _
~ -
Y(
l l l
, ,I
.
APPENDIX E
,
Time Correction
PSMS computer was approximately 5 minutes and 49 seconds different from new
plant computer time, which is considered accurate as it is updated via
satellite. The licensee conducted a time check at approximately 1000 on the
morning of 9/11/87 of the PSMS computer, new plaat computer and the sequence of
alarms recorder (SAR) to establish their accuracy using the new plant computer
as a reference. Previously, the PSMS computer was restarted and as a conse-
quence its time updated. Therefore, when time check was conducted, the PSMS
computer time was approximately 30 seconds ahead of the new plant computer, but
at the time of interest for the event, a 5 minute and 49 second time discrep-
l ancy existed. The SAR time was 7 seconds ahead of the new plant computer time.
There was no reason to believe that either the SAR or new plant computer time
had been changed.
.
'
i
,
l
!
l
,
l
,
.- _ _ _ _ _ -
. < '.
APPENDIX F
bg QEwt % c,( OMEEC. C9,CG d WNfl
bM E-_ be _ . . . . . . . . . _
bey i Icdk ( t
ki UA Ed*MCf/cl' ln ko i, 6/4A/4Gf 6v3f u b'if< A' ~ 4/A C
.' 1 1 ._ k C~} d. O .._.._.__. 3 LO . Stay._ [ gyfa/g____ c ._J/vf1/.
TD.RCAldLSX/ Oc siceassi; _ /f r . . . . _ .. Gfu^)
YY
.
6 Mc .
YhAn $Y
3Mpwww se . %Toewns.Accus.bss e - sou-oc
H TSI.L.L , - . Adalgied klula__ kmC -.Rw m.
M o R.cb. . ._ v.P /DireKr ..Qud$ f 8dtp .G 6 6 _ c:,/wJ
m o. x .. 3. , , e,.. u . e y . m _ -
S .Es W S Q #1 Mnpira se .-. - _ _df"J
h/MACfi4Rdr4"'.S X d'i7e #44Ws7_ iW/7 . _ _ _ _ YRA/
-
-0AAlod 0g bfRU
SC% % ,GA % ,____.. _ cdow
M.lMQyL _ .ntp 2se-g % y _om_ s f e, T
r ,1
cerro: ,i m t e _ _ __ _ ._ _ _ _
D 3 W od1 ._ . WiUX __ _ _ NT 1 DW-
V1 Of M -
. N 5 bh"h*
%.c_4}}Mua N 4 n' At M m e _ c 4
W.s 6n my n n .u ten . p orars . ..
yn
ht M c,rsoru /Js c t., n os C, e
*Ea g
A N []CSONt: D $ CL . h .--. -. - - . ..~. ... - A uj..
szmusla .. . ce- n. uu n . n . . se-
0.L tur, _ m u. - eu~r em. st ~
Y . inht,'sse y _, N9' i'J las ter.fefef _
6Pval ( /d Ot$ee,1
. . . _ . . . _ . .
_. . . _ . _ _ . .
_ _.
..
es . e a~m
er =* *_m m. . .m .me 4-a
e 4 *
O
'
{Qg -
\!aw;-_ INe.- . C&.he [N b
sh m ., m % s . .
qdwJ
!) L , 4 oe,a .. _ ._ 0. .i_a-v. % 8l. 9.- 2M.:.4. . %A/y . .c.fJ.h/ - . - . . - .
/7 L _vdA Dut . O C . _. - . . .
r W _ - .. W up . DJ(wee R $CA5 S___ee. . c-/WCl-
. .
1 _ GfdA
@ %e . - %%-.H M L~ Wwo .
uud
D.(. dwism,6 _ . Ac=*- twec .RocTs
JR Ibt)% __ - -. , _ %.edu - ?Nevs9iy S .)&c _
C,Puy
C- A Tra q R r ec den.:En g r. Assa n . CNOAl
D..x. . .n u.scM L r, we- c serx . - m: c-
AG V/ECBGEL.lbOcf4 5 ' MAT ~i O. C A]2C-
dM.hdem.t.n
I dRT, C.C. - . ANC
L._0sY%bDw6en . Teaan Wt , AW NRC
. .
. .
-.
*-.- - e.=,eam = e m 4 .e s
w
6 .
d* . wn
m a e
ne -+- N -4 -- a W .g a
,mm-wa g. m -me e e. --== wee-m-- e e -4 eg g--W 1m M eene- -aemus ge e a mm ee
p ..mmieum e-s e --+ w .
. - . ... . . . _ . . .--.
. ._---_..-~e w_ ... ., . _ _ _ ._ _ - . _. _ _
== m mamE e- d e e,
4 *
' ' " " ' * * - - e+e e * **ee e ses y .M a e - W_.aus.._+- ge e- esse - 4 wla e
- - -- = mow e w_w g w %,.4g q 4 e,ge,* N , e e o e a P4 -
'6 - * - * - * * 4 e e@ e ,
(
. , .
- - - - - - - - - - . . - - - . - . . ._. . . - _ _ . _
-
*4 9 h * em
6 % e surev M e . - e -e-gssy,- ea e- ggw - M-em u-= M +6
,.y*awa & 4q.--eneemn.., mm.e-e- m' weens.gz = m
e, --emr+. mN --
e--ew.i- --w .-e a p - -
h
.. 4 m .m _ _ _ . - -- _.e _ ~ __.. - . . . . m,
.%.
-ew e= mew--- e .m e.emi--=g
*==.=een-e,,,,,
.
-
e
._ , -i. # .
-er-. Gee.t=4-.m -
e6 -ene '. W 3e y e w*.6 6m *M-**
9
%
-
-.
_
. , _
..3.
o
GPU Nuclear Corporation 2 11 SEP 1987
'
cc:
P.B. Fledler. Vice President and Director
M. Laggart, BWR Licensing Manager
Licensing Manager, Oyster Creek
Pubite Document Room (POR)
Local Public Document Room (LPOR)
Wuclear Safety Information Center (NSIC)
NRC Resident Inspector
State of New Jersey
}}