Text

Power Reactor EVENTS.November-December 1985
	ML20203B081
Person / Time
Issue date:	06/30/1986
From:	Massaro S; NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:	;
References
	NUREG-BR-0051, NUREG-BR-0051-V07-N6, NUREG-BR-51, NUREG-BR-51-V7-N6, NUDOCS 8607180001
	Download: ML20203B081 (47)
	v • d • e

NUREGlBR-0051 Vol. 7, No. 6 fy/p,,APOWER REACTOR EVENTS t

WW,..e I United States Nuclear Regulatory Commission y

Date Published: J UNE 1986 Power Reactor Events is a bi-month!y newsletter that compiles operating experience information about commercial nuclear power plants. This includes summaries of noteworthy events and listings and/or abstracts of USNRC and other documents that discuss safety-related or possible generic issues. It is intended to feed back some of the lessons learned from operational experience to the various plant personnel, i.e., managers, licensed reactor operators, training coor-dinitors, and support personnel Referenced documents are available from the USNRC Public Document Room at 1717 H Street, Washington. D C. 20555 for a copying fee. Subscriptions of Power Reactor Events may be requested from the Superintendent of Documents, U.S Government Printing Office, Washington, D.C. 20402, or on (202) 783-3238.

Table of Contents l

Page 1.0 SUMMARIES OF EVENTS g

1.1 Loss of Power and Water Hammer Event at San Onofre Unit 1 -

1 1.2 Loss of Integrated Control System Power and Overcooling Transient at Rancho Seco.-

2 1

1.3 Inadvertent Engineered Safety Features Actuation and Subsequent Reactor l

Trip at Palo Verde Unit 1.-

4 l

1.4 Reactor Scram on Loss ofInstrument Air at Nine Mile Point Unit 1.-

8 1.5 Inadequate Service Water Buildir.g Ventilation at Davis-Besse.-

10 1.6 Failure of Diesel Generator Exciter Regulator at Summer.--

11 1.7 Loss of Essential Guses Due to Altered Electrical Distribution System Lineup at Fort Calhoun...

.~

12 1.8 Rextor Trip on Loss of Main Feedwater Pump Due to Design Deficiency at Catawtsa.

14 1.9 Flooding of Safety.Related Areas at Hatch Unit 1--

17 1.10 References..

19 2.0 EXCERPTS OF SELECTED LICENSEE EVEN' REPORTS...

21 T

3.0 ABSTRACTS / LISTINGS OF OTHER NRC OPERA TING EXPERIENCE DOCUMENTS....

33 l

3.1 Abnormal Occurrence Reports (NUREG-0090)..

33 l

3.2 Bulletins and information Notices...

35 3.3 Case Studies and Engineering Evaluations...

38 3.4 Generic Letters...

44 3.5 Operating Reactor Event Memoranda:-

45 3.6 NRC Document Compilations.=

46 Editor: Sheryl A. Massaro l

Office for Analysis and Evaluation i

of Operational Data U.S. Nuclear Regulatory Commission Period Covered.

November-December 1985 I

Washington, D.C. 20555 8607180001 860630 PDR NUREG BR-OO51 R PDR

\\.

1.0 SUMMARIES OF EVENTS 1.1 Loss of Power and Water Hammer Event at San Onofre Unit 1 At 4:51 a.m., on November 21, 1985, San Onofre Unit 1* was operating at 60%

power when a ground fault was detected by protective relays associated with a transformer which was supplying power to one of two safety-related 4160 V elec-trical buses.

The resulting isolation of the transformer caused the safety-related bus to deenergize, which tripped all feedwater and condensate pumps on the east side of the plant.

The pumps on the west side of the plant were un-affected, since their power was supplied from another bus connected to the main station generator.

The continued operation of the west feedwater and condensate pumps, in combination with the failure of the east feedwater pump discharge check valve to close, resulted in overpressurization and rupture of an east side flash evaporator low pressure heater unit.

The operators, as required by emergency procedures dealing with electrical systems, tripped the reactor and turbine generator.

As a result, the plant experienced its first complete loss of steam generator feedwater and inplant ac electrical power since it began commercial operation in January 1968.

The subsequent 4-minute loss of inplant electrical power started the emergency diesel generators (which by design did not load), deenergized all safety-related pumps and motors, significantly reduced the number of control room in-strument indications available for operators to diagnose plant conditions, and produced spurious indications of safety injection system actuation.

Restora-tion of inplant electrical power was delayed by improper operation of an auto-matic sequencer that should have established conditions for delayed remote-manual access to offsite power still available in the switchyard.

The loss of steam generator feedwater was the direct result of the loss of power to the two main feedwater and one auxiliary feedwater pump motors, and the designed 3-minute startup delay of the steam powered auxiliary feedwater pump. The loss of the feedwater pumps, in combination with the failure of four additional feedwater check valves to close, allowed the loss of inventory from all three steam generators and the partial voiding of the long horizontal runs of feedwater piping within the containment building.

The subsequent start of feedwater injection by the steam powered auxiliary feedwater pump did not result in the recovery of steam generator level because the backflow of steam and water to the leak in the evaporator carried the auxiliary feedwater with it.

Later, operators isolated the feedwater lines from the steam generators, as required by procedure, unknowingly initiating the process of refilling the feedwater lines in the containment building.

Before all feedwater lines were refilled, a severe water hammer occurred that bent and displaced one feedwater pipe in the containment building, damaged its associated pipe supports and snub-bers, broke a feedwater control valve actuator yoke, stretched the studs, lifted the bonnet, and blew the gasket from a 4-inch feedwater bypass check valve.

The damaged check valve developed a significant steam-water leak, the second leak in the event.

j CSan Onofre Unit 1 is a 436 MWe (net) MDC Westinghouse PWR located 5 miles south of San Clemente, California, and is operated by Southern California Edison.

1

The second leak, in combination with an earlier inadvertent reestablisFment of steam generator blowdown, caused all three steam generator water levels to drop below indicating levels.

Steam from all three steam generators fed the leak, because all steam generators at the plant are tied together by a common steam header inside containment without individual main steam isolation valves.

Despite these problems, operators later succeeded in recovering level indica-tion in the two steam generators not directly associated with the feedwater piping leak. With the reestablishment of steam generator levels, the operators safely brought the plant to a stable cold shutdown condition, without a signifi-cant release of radioactivity to the environment (a pre-existing primary to secondary leak of about 3 gallons per day was not exacerbated) and without addi-tional damage to plant equipment.

On the day following the event, and in conformance with the recently established Incident Investigation Program, an NRC Incident Investigation Team was sent to the site.

The team was selected because of its broad experience in operating plant event analyses, with individual team members having specific knowledge and experience in operations, human factors, electrical and reactor systems, and water hammer phenomena.

The scope of this fact-finding effort was limited to the circumstances surrounding the events of November 21, 1985, including operator and NRC actions, equipment damage and malfunctions, equipment mainten-ance and testing history, and regulatory involvement.

The team was directed to (1) determine what happened; (2) identify the probable causes; and (3) make appropriate findings and conclusions to form the basis for possible follow-on actions.

The resulting report is referenced here as the most comprehensive source of information on the event:

NRC's incident investigation report, Loss of Power and Water Hammer Event at San Onofre Unit 1 (NUREG-1190), January 1986.

This report is available in the NRC Public Document Room at 1717 H Street, N.W.,

Washington, D.C.

20555, for inspection or copying for a fee; copies may be ordered from the National Technical Information Service, Springfield, VA 22161.

1.2 Loss of Integrated Control System Power and Overcooling Transient at Rancho Seco At 4:14 a.m., on December 26, 1985, Rancho Seco* was operating at 76% power, when a loss of integrated control system (ICS) dc power occurred as a result of a single failure.

The loss of dc power to the ICS (a nonsafety-related system) caused a number of feedwater and steam valves to reposition auto-matically and also caused the loss of remote control of the affected valves from the control room.

In addition, the main feedwater pump turbines slowed l

to minimurr, speed and the auxiliary feedwater (AFW) pumps started.

The immediate result was a reactor coolant system (RCS) undercooling condition that resulted in the reactor tripping on high pressure.

The reactor trip was followed by an overcooling condition that resulted in safety features actuation and excessive RCS cooldown.

Rancho Seco is an 873 MWe (net) MDC Babcock & Wilcox PWR located 25 miles southeast of Sacramento, California, and is operated by Sacramento Municipal Utility District.

2

The operators were not immediately able to restore dc power within the ICS.

As a result, nonlicensed operators were sent to isolate the affected steam and feedwater valves locally with handwheels.

During the first 7 minutes of the incident, the excessive steam and feedwater flows resulted in a rapid RCS cooldown of over 100 F.

The pressurizer emptied and a small bubble formed in the reactor vessel head.

The RCS cooldown continued and the RCS depressurized to about 1064 psig and then began to repressurize.

This repressurization resulted in the RCS entering the pressurized thermal shock region designated by Babcock & Wilcox (the nuclear steam system supplier).

The atmospheric dump valves and turbine bypass valves were isolated within 9 minutes after the reactor trip.

However, the operators experienced difficulty closing the ICS-controlled AFW flow control valves. One of the AFW flow control valves was finally shut; however, the second AFW flow control valve was damaged and failed open.

The associated AFW manual isolation valve was found to be stuck open.

Therefore, both AFW pumps continued to feed and overfill one steam generator. Water began to overflow into the main steam lines.

About 26 minutes after the reactor trip, the operators restored power within the ICS by closing two switches in an ICS cabinet.

The operators were then able to close the open AFW flow control valve from the control room, which stopped the RCS cooldown, and started stabilizing the plant.

The RCS had cooled down a total of 180 F in this 26-minute period.

While changing a valve lineup in the suction of the pump used to supply RCS makeup (makeup pump), the last suction valve to the makeup pump was inadver-tently shut.

This resulted in the overheating and destruction of the makeup pump. About 450 gallons of containment water were spilled on the floor.

This failure did not directly affect the incident since a high pressure injection pump was available to supply RCS makeup.

In addition, the spilled water did not result in any significant onsite or offsite radioactivity release or per-sonnel dose.

Operators later stabilized the plant and brought it to cold shutdown without a significant release of radioactivity to the environment and without additional damage to plant equipment.

Because of the potential significance of the event, an NRC Incident Investiga-tion Team was sent to the site on December 27 and started their investigation of the incident on December 28.

The five member team was selected on the basis of their knowledge and experience in the fields of control systems.

The team I

vas directed to:

(a) determine the facts of what happened; (b) identify the probable cause as to why it happened; and (c) make appropriate findings and conclusions which would form the basis for any necessary follow on actions.

The scope of their fact-finding effort was limited to the circumstances sur-rounding the December 26, 1985, incident, including operator and NRC actions, equipment damage and malfunctions, equipment maintenance and testing history, and regulatory involvement.

A specific focus was on the design and response of the ICS, and operator performance and training as they related to the loss of ICS during the incident.

The resulting comprehensive report issued by the Incident Investigation Team is referenced below, in addition to other documents that discuss NRC and industry investigations and corrective actions taken by the licensee.

3

r 1

NRC's incident investigation report, Loss of Integrated Control System Power and Overcooling Transient at Rancho Seco on December 26, 1985 (NUREG-1195), issued February 19, 1986.

Sacramento Municipal Utility District's Description and Resolution of Issues Regarding the December 26, 1985 Reactor Trip, issued February 19, 1986.

The February 25, 1986 memorandum from W. A. Paulson, NRC, to members of the Babcock & Wilcox Owners Group (B&WOG), forwarding a summary of the January 8, 1986 NRC/B&WOG Regulatory Response Group meeting to review the December 26, 1985 Rancho Seco Transient.

These reports are available in the NRC Public Document Room at 1717 H Street, N.W., Washington, D.C. 20555, for inspection or copying for a fee; copies of NUREG series reports may be ordered from the National Technical Information Service, Springfield, VA 22161.

1.3 Inadvertent Engineered Safety Features Actuation and Subsequent Reactor Trip at Palo Verde Unit 1 On December 16, 1985, at about 6:12 p.m., a ventilation fan in the Palo Verde Unit 1* A train balance of plant engineered safety features actuation system (BOP ESFAS) auxiliary relay cabinet tripped off and caused the cabinet to overheat. This resulted in the 80P ESFAS logic cards malfunctioning, and activated the A B0P ESFAS systems.

This included the loss-of power sequencer which tripped open the normal feeder breaker to the Class 1E 4160 V bus, deenergizing the bus and shedding its electrical loads.

The A diesel generator started; however, the output breaker did not close and reenergize the bus.

Manual attempts to reenergize the loads on the bus were unsuccessful until the loss-of power load shed signal was removed by pulling fuses in the B0P ESFAS cabinet. During this event, the B essential chiller tripped on low refrigerant temperature. With the A diesel generator and the B essential chiller declared inoperable, a reactor shutdown was begun from about 50% power in accordance i

with technical specifications.

At about 11:30 p.m., with reactor power at about 2%, the Control Room Operator was unable to maintain feedvater flow to both steam generators with the running main feedwater pump.

The main feed pump was manually tripped, and the nonessential auxiliary feedwater (AFW) pump was started.

Malfunctioning control room indications on motor amperage and pump flow caused the operator to trip the nonessential AFW pump and start the essential B AFW pump.

Steam generator wide range le;/e1 was approximately 50% when the B AFW pump was started; however, when the steam generators were fed with cold feedwater it apparently caused the water level to shrink below i

the 44% wide range reactor trip setpoint, and the reactor tripped on low level in steam generator No. 1.

These events are detailed below.

At 6:12 p.m., on December 16, 1985, Palo Verde was operating at 52% reactor power when failure of an electronic component in the sequencer module for the train A ESF cabinet resulted in several spurious ESF actuations, an inadvertent operation of the ESF load sequencer, and an automatic start of the train A

Palo Verde Unit 1 is a 1270 MWe (net) MDC Combustion Engineering PWR located 36 miles west of Phoenix, Arizona, and is operated by Arizona Public Service.

The unit was in startup testing at the time of the event.

4

emergency diesel generator.

The ESF load sequencer, which experienced the failure of the electronic component, was supplied by General Atomics (Model No. 0342-5200).

The event occurred following the scheduled daily performance of automatic l

tests on the circuitry in the train A B0P ESFAS cabinet.

A popping noise was heard, and the smell of burning electronic components was detected by a Control Room Operator.

The source of the burning was determined to be the train A B0P ESFAS cabinet.

It was also noted that all of the lights in the ESF load sequencer module were illuminated, and that the cooling fan for the ESF load sequencer module was not operating.

Since all of these conditions were l

abnormal, Instrument and Control Technicians immediately began investigating.

l During the investigation, the ESF load sequencer spuriously caused the train A l

emergency diesel generator to start in the " test" mode, and initiated an

(

invalid load shed and loss of power condition for the Class 1E loads supplied from the train A 4160 V ac bus.

The normal and alternate bus supply breakers opened and all bus loads were stripped from the train A bus.

As a result of the failure in the B0P ESFAS cabinet, a spurious B0P ESFAS actuation of the following ESF signals also occurred:

fuel building essential ventiliation actuation signal (FBVAS), containment purge initiation actuation signal (CPIAS), and control room essential filtration actuation signal (CREFAS).

Following the stripping of the bus loads, the diesel generator supply breaker did not automatically close, and the stripped loads were not automatically loaded onto the emergency diesel generator.

In an effort to restore power to the train A electrical loads, an operator (licensed) unsuccessfully attempted to manually close the normal supply breaker.

The normal supply breaker and ESF service transformer connect the 4160 V ac, Class 1E bus to the 13.8 kV, Class 1E bus, and the offsite power sources.

The failure of the diesel generator output breaker to automatically close and load the train A electrical loads occurred as a result of the component failure in the 80P ESFAS cabinet.

More specifically, the BOP ESFAS component failure prevented the diesel generator from operating as designed and transferring to the " emergency" mode from the " test" mode following the train A load shed.

Automatic closure of the diesel generator output breaker on a loss of power signal is expected only when the diesel generator is operating in the

" emergency" mode.

Because the load shed signal was initiated by a failure of the BOP ESFAS cir-cuitry, and not initiated as a result of an actual loss of offsite power, the load shed signal which was actuated did not clear after the electrical loads had been shed.

Usually, the load shed signal duration is approximately 1 second.

An active load shed will not allow the closure of breakers onto the bus.

As a result, the presence of the active load shed signal prevented manual closure of the normal supply breaker.

Following the attempt to align the normal supply breaker to the bus, an attempt to manually align the diesel generator supply breaker was made.

This attempt ultimately resulted in a trip of the diesel generator and opening of the diesel generator output breaker at 6:18 p.m.

The indicated cause of the diesel genera-tor trip was reverse power.

5

The diesel generator trip on reverse power that resulted when the operator attempted to close the diesel generator supply breaker remains unexplained, since neither of the predicted initiating causes for a reverse power trip appear to have initiated the diesel generator trip.

These predicted initiating causes are:

bus voltage greater than the diesel generator output voltage and/or a manual trip of the diesel generator with the output breaker aligned to parallel the diesel generator with an offsite source.

A work request was written to check the calibration of the reverse power trip relay. Although the calibration check found some foreign material within the reverse power trip relay, the licensee did not believe that it could have caused q

the diesel generator trip.

Additionally, the diesel generator was functionally tested following the trip to demonstrate that it would not trip on reverse power when operating in the " emergency" mode.

This test was performed by cimulating a loss-of power signal and simultaneously actuating the reverse power trip relay manually.

The diesel generator continued to run following this test, as designed.

Following the emergency diesel generator trip on reverse power, the diesel genera-tor continued to run on starting air, at low speed, until it tripped on low lube oil pressure.

Continued operation of the diesel generator at low speed on starting air is not an expected mode of operation, and can only occur when the diesel generator is started and subsequently tripped from the diesel generator start signal module portion of 80P ESFAS, which is also an unexpected mode of operation.

This occurrence is attributable to the failure of the diesel genera-tor test circuitry in the B0P ESFAS cabinet.

Another attempt was made to restore power to the shed train A loads.

By removing the control power fuses to the normal supply breaker, it was possible to close the breaker.

However, the load center feeder breakers which connect the Class 1E, 4160 V ac bus to the Class 1E, 480 V ac motor control centers could not be closed because of the still active load shed signal.

In order to clear the load shed signal and restore power to the shed train A loads, the train A B0P ESFAS cabinet was down powered.

The load center feeder breakers automatically closed after the load shed signal was cleared.

Down-powering the B0P ESFAS cabinet allowed the load center feeder breakers to close, and reenergizing the BOP ESFAS panel resulted in a train A loss-of power signal and load shed signal.

As a result, the normal supply breaker reopened, as designed.

The B0P ESFAS panel was down powered again, and power was successfully returned to the bus by manually reclosing the normal supply breaker.

To prevent another loss-of power signal and load shed actuation, the train A undervoltage relays were jumpered, and the leads on the load shed relay were lifted.

The 80P ESFAS functions were reset, and the system was returned to normal operating status.

The ESF load sequencer was placed in the manual mode.

To prevent the ESF load sequencer from automatically starting the train A high pressure safety injection (HPSI) pump, low pressure safety injection (LPSI) pump and containment spray pumps upon restoration of power to the bus, the control power fuses to these pumps were iamoved prior to down powering the B0P ESFAS cabinet.

Removal of these control power fuses rendered the equip-ment inoperable.

Concurrently, the train B essential chiller tripped at 6:12 p.m., and rendered the corresponding train B equipment inoperable as well.

6

It was recognized by the Control Room Operators that the loss of both trains of HPSI, LPSI, and containment spray required entry into Technical Specifica-tion 3.0.3.

However, because of the amount of activity which required the attention of licensed shift personnel during this event, actions could not be initiated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to bring the plant to hot shutdown, as required.

Required actions were initiated at 7:50 p.m., 38 minutes late.

All train A equipment which was designed to start following the restoration of power to the bus performed as designed, with satisfactory results.

Safety-related equipment which failed to perform as expected included the failed B0P ESFAS cabinet, the diesel generator reverse power trip relay, and the train B essential chiller, which tripped on low refrigerant level, as noted previously.

Testing of the ESF load sequencer on the following day, after it had been allowed to cool, revealed proper operation of all sequencer functions, with the exception of the auto-test function test point for the emergency diesel generator.

The load sequencer locked up when an attempt was mate to perform the auto-test.

The cause of this event was traced to failure of a fan in the ESF cabinet.

Failure of the fan allowed the ESF load sequencer module to overheat and malfunction.

As a corrective action, the ESF load sequencer was replaced, the ESF cabinet door was temporarily removed, and the failed fan was replaced with two larger capacity fans.

Hourly verification of fan operation was performed until a control room alarm, which annunciates on high cabinet exit air temperature, was installed.

At 11:31 p.m., on December 16, with the unit operating at 2% power while being brought to hot shutdown in accordance with Technical Specification 3.0.3, an automatic actuation of the plant protection system (PPS) resulted in a reactor trip on low level in steam generator No.1.

At the time of the reactor trip, the main generator had been taken off-line and tripped.

Heat removal was being controlled in the automatic mode by the steam bypass control system.

Feedwater flow to the steam generators had been placed in manual control prior to the reactor trip in an effort to increase steam generator level, which was low and decreasing.

Feedwater was being supplied by the B main feedwater pump, as directed per procedure.

An attempt to increase feedwater flow and steam generator level by isolating steam generator blowdown and increasing pump speed was made, but steam generator levels could not be maintained in either steam generator by the main feedwater pump.

Despite the attempts to increase feedwater flow, no downcomer flow was indicated for either steam generator.

Subsequently, in another effort to increase steam generator levels, the main feedwater pump was tripped and the non-essential AFW pump was started at 11:25 p.m.

Upon starting the non-essential AFW pump it erroneously appeared that flow was not being provided.

No downcomer flow or pump discharge pressure was indicated, and a high pump motor running current was indicated.

Based on these indications, the non-essential AFW pump was tripped at 11:26 p.m.

and the essential AFW pump was started.

Although the essential AFW pump did provide flow to the steam generators, the combination of the " shrink" 7

caused by the introduction of cold AFW to the steam generators and the already low levels which existed in the steam generator resulted in an actuation of the PPS on low level in steam generator No. 1, and in a reactor trip.

Concerns regarding the status of the non-essential AFW pump during the event, based upon the lack of flow indication for the pump, were resolved by the successful completion of surveillance testing on the pump.

Also, trouble-shooting revealed that the pump's observed high running current was the result of the ammeter failing high after the meter needle pegged itself at the high end of the scale.

The lack of indicated non-essential AFW f1w during the event has been attributed to the small amount of feedwater required at low power levels, relative to the range of the downcomer flow instrumentation.

Since the essential feedwater pumps have dedicated flow instrumentation of a smaller range, this condition does not exist for the essential feedwater pumps.

No discharge pressure was indicated for the non-essential AFW pump because the usual pressure instrument had been valved out to allow temporary installa-tion of a more accurate instrument for use in the performance of scheduled surveillance testing activities. As a corrective action, the need to install alternate pressure instrumentation during surveillance testing has been reviewed.

This review has determined that the more accurate instrument is not required.

As a result, the practice of installing the more accurate pressure instrumentation on the non-essential AFW pump during surveillance testing has been discontinued.

The cause of the reactor trip has been attributed to a feedwater anomaly which prevented the B main feedwater pump from providing sufficient feedwater fl.ow to the steam generators at a low power level.

During normal operations, two main feedwater pumps are used to feed the steam generators.

However, during low power operation only one main feedwater pump is used.

It appears that while the 20 psi differential pressure which existed between the main feedwater pump discharge and the steam generators is an adequate differential pressure for feeding the steam generators at high power levels when two main feedwater pumps are running, it is insufficient to maintain steam gene ator levels when only one main feedwater pump is running and the plant is aligned for low power operation.

Since this phenomenon had not been previously observed or expected, operator actions to increase the feedwater flow and the main feedwater pump pressure to steam generator differential pressure by increasirg pump speed came too late and were not of sufficient magnitude to compensate for the decreasing steam generator levels.

As a corrective action, operating procedures were revised to provide precautionary and/or procedural guidance on the operation of the main feedwater pumps and steam generator level control at low power levels.

(Refs. 1-3.)

1.4 Reactor Scram on Loss of Instrument Air at Nine Mile Point Unit 1 During normal operation at 98% power on November 1, 1985, the No. 12 feedwater flow control valve (FCV) at Nine Mile Point Unit 1* malfunctioned, causing a

Nine Mile Point Unit 1 is a 610 MWe (Net) MDC General Electric BWR located 8 miles northeast of Oswego, New York, and is operated by Niagara Mohawk Power Corporation.

8

95-inch high reactor water level condition which tripped the turbine and sub-sequently caused the reactor to scram. The event was caused by a problem with the instrument air system.

Instrument air pressure dropped substantially, causing the feedwater FCV lockup circuits to activate as designed.

The No. 12 l

feedwater FCV did not lock in position upon loss of air, however, because the I

valve's positioner malfunctioned, causing the valve to drift open.

High pressure coolant injection (HPCI) was initiated upon turbine trip, but was unable to manually reset because contacts on the emergency trip (limit) switch 1

failed to change state as designed.

To control reactor water level, the No. 12 feedwater pump was locked out and restarted several times, but then failed to l

restart.

The No. 11 feedwater pump remained operable.

Transient analysis j

indicated that all six electromatic relief valves (EMOVs) should have been opened by the pressure spike which resulted from the turbine stop valve closure on the turbine trip.

However, EMOV No. 113 failed to open due to a wear-related failure of the solenoid actuator.

Inspection of the solenoid actuators for the other five EMOVs revealed similar, less severe wear in the actuators for valves Nos. 112 and 121. The actuator assemblies EMOV Nos. 113, 112, and 121 were replaced; the remaining three were replaced during the spring 1986 refueling outage. The event is detailed below.

At about 5:00 a.m., on November 1, 1985, preparations were being made to tag out instrument air compressor No.13, the normal source of instrument air, for troubleshooting activities on the next shift.

When it was taken out of service, the backup instrument air system, compressors Nos. 11 and 12, were placed into service. The backup compressors were run unloaded, but not long enough for the moisture content of the air to be reduced adequately.

Subse-quently, the filters in instrument air dryer No.11 became clogged with water and within a very short time the. instrument air pressure dropped to a level which activated the feedwater FCV loss of air lockup circuits as designed.

The No. 12 air-operated feedwater FCV failed to lock in its position as designed, however, because an 0 ring in the valve positioner leaked, causing the valve to drift open.

This increased feedwater flow to the reactor, causing a high reactor water level turbine trip at the 95-inch setpoint.

With reactor power greater than 45% of rated power, the automatic turbine trip i

initiated a reactor scram, and feedwater flow shifted to the HPCI mode as I

designed.

The HPCI mode of feedwater was unable to be manually reset by operator action, because a plunger assembly on the turbine's emergency governor unit stuck, preventing the emergency trip (limit) switch from resetting.

This kept the HPCI relays energized in the turbine control circuitry.

Reactor water level was manually controlled by locking out and restarting feedwater pump No. 12 several times.

This action resulted in the failure of a timer in the auxiliary (bearing and gear drive) oil pump start circuit, which prevented the No. 12 feedwater pump from being restarted.

Feedwater pump No.

11 was used to maintain reactor water level throughout the remainder of the scram recovery until shutdown cooling was initiated.

Upon turbine trip and turbine stop valve closure, a high reactor pressure spike caused the EMOVs to dump excess steam to the suppression chamber to control pressure.

Based upon transient analysis from available data including that from the last turbine trip, it appears that all six EMOVs should have automatically opened.

The post scram review revealed that one of the six EMOVs, No. 113, had failed to open during the event.

Investigation revealed 9

l that the reset springs were jammed along the plunger guide rods of its solenoid actuator, causing the valve to remain in the closed position.

This failure was attributed to wear of the rod guides. Two other solenoid actuator assemblies, for EMOVs Nos. 112 and 121 on the same main steam line, were found to have similar wear characteristics, but not as severe.

The following corrective actions were taken:

(1) Instrument air dryer No.11 was cleaned, new filter elements were installed, and the unit was functionally tested.

Also, a bypass valve was repositioned to facilitate drainage.

The filter elements are inspected semiannually, per preventive maintenance procedures.

In addition, instrument air compressor No. 13 was completely overhauled.

(2) The two lockup valves in the No. 12 feedwater FCV positioner had their 0-rings replaced, and the unit was functionally tested satisfactorily.

Also, a section of tubing to the lockup valves was replaced.

The redundant No.11 feedwater FCV lockup valves also were checked and found to be satisfactory. A preventive maintenance procedure is being i

developed to preclude recurrence of this type of event.

(3) The turbine emergency governor plunger assembly was lubricated and cycled several times, and operated satisfactorily.

(4) The timer for the auxiliary oil pump to the No. 12 feedwater pump was found to be burned out due to repeated starts of the pump.

The timer was replaced, and the pump was satisfactorily returned to service.

(5) The actuator assembly for the No. 113 solenoid actuated EMOV was replaced.

l The other five EMOVs were inspected, and it was found that No. 112 tended to stick in the energized (open) position and that No. 121 displayed evidence of unacceptable wear. These two actuator assemblies also were replaced.

The other three EMOVs exhibited an acceptable amount of wear, but, as a preventive maintenance measure, the actuator assemblies were replaced during the spring 1986 refueling outage.

All six EMOVs were recalibrated and satisfactorily tested, and returned to service.

(Refs. 4-5.)

1.5 Inadequate Service Water Building Ventilation at Davis-Besse At Davis-Besse* on December 12, 1985, during review of the service water (SW) system conducted as part of the System Review and Test Program (SRTP) committed to the NRC, it was determined that the configuration of the SW pump ventilation system had, since a design modification in 1983, been inadequate to provide the required ventilation design flows during post loss-of-coolant accident conditions.

The unit was in cold shutdown at the time of the discovery. The event is detailed below.

In December 1985, during review of high temperature problems experienced on the SW pump motors, as part of the SRTP, the licensee determined that (1) the as-built configuration of the SW pump room ventilation system would not provide

Davis Besse is an 860 MWe (net) MDC Babcock & Wilcox PWR located 21 miles east of Toledo, Ohio, and is operated by Toledo Edison.

10

the required ventilation design flows during post loss-of-coolant accident conditions; and (2) Technical Specification 3.7.4.1, which requires two inde--

pendent SW trains to be operable had been violated inadvertently since 1983.

The SW pump room ventilation system consists of four propeller fans used to exhaust the pump-induced heat loads from the room.

The fans were expected to create flows of 24,000 cfm each.

Testing in December 1985, however, showed that the fans drew far below their rated flows, with the maximum flow for one fan running 12,000 cfm, and the minimum 1000 cfm.

l The SW pump room ventilation system had been modified in 1983 as part of a de-sign change that upgraded the dilution pump to function as a backup SW pump to meet 10 CFR 50, Appendix R dedicated shutdown criteria.

The east wall between the SW pump room and the dilution pump had to be upgraded to a 3-hour fire wall, which resulted in the closing of the original air inlet to the SW pump room.

The exhaust fans were installed external to the SW pump room within a missile i

shield on the west side of the pump room.

However, shrouding to separate.the fan suction from the exhaust and backdraft dampers was not called for in the design, nor installed, thereby allowing the operating exhaust fans to recircu-I late flow through the idle fans.

This resulted in only a small amount of air i

being drawn through the pump room, and limited the cooling capabilities of the i

ventilation system.

Had the design post loss-of-coolant accident heat-loads been produced coincident with an outside temperature of 95 degrees or greater it is unlikely that the fans could have adequately removed this heat from the SW pump room.

This could have caused overheating of one or more SW pumps, which may have resulted in inadequate SW supply to other safety-related systems.

The root cause of this condition was the lack of an adequate technical review l

of the modification to the ventilation system, including the lack of adequate i

post modification testing to prove that design flows could be achieved.

Modifications to the ventilation system are now being developed which will improve the cooling and air flow characteristics within the SW pump room.

l These modifications will ensure that the required design air flows necessary to remove the maximum heat load generation within the SW pump room are i

achieved.

Under the SRTP, a detailed technical review and associated testing of systems are being performed, and should disclose any other deficiencies.

In l

addition, a systems engineering group is being formed to develop detailed i

knowledge of each system.

These individuals will review all future changes to a system to ensure continued system operability.

(Refs. 6-7.)

l 1.6 Failure of Diesel Generator Exciter Regulator at Summer i

l At Summer

on December 17, 1985, the 24 V de motor associated with the voltage regulator for the Colt Industries emergency diesel generators (DGs) failed due i

to a cracked delron pinion gear within the motor housing.

The licensee determined that a substantial safety hazard existed as a result of the failure, since DG output voltage could exceed tolerance requirements.

Summer is an 885 MWe (net) MDC Westinghomie PWR located 26 miles northwest of Columbia, South Carolina, and is operated by South Carolina Electric and Gas, 11

The failed exciter voltage regulator / motor-operated potentiometer (M0P) assembly contained a 24 V dc motor and pinion gear drive assembly manufactured by Barber Coleman, and potentiometer manufactured by Basler Electric.

The motor, Barber Coleman model CYQM23610-13, part of the M0P used by Basler Electric in their static exciter regulator, was supplied by Colt Industries as a component part of the DG.

The M0P is designed to automatically maintain its center position throughout l

" emergency start" modes of operation and maintain the correct DG output I

voltage.

It establishes the correct voltage by automatically maintaining the l

output voltage at 7200 volts + 10% during operation; by returning to its pre-set position after shutdown, It positions itself for the next " emergency start mode." Failure of the M0P in a position other than center could cause the DG output voltage to be out of tolerance for the next emergency start operation.

The licensee's evaluation revealed that the gear failure could possibly be attributed to an incompatability between the motor gear plastic material (delron) and the gear lubricant. Colt Industries indicated that this was recognized as a synergistic effect in their qualification testing (thermal aging) to IEEE 323-1974.

There are four M0P assemblies installed at Summer, two assemblies on DG A and two on DG B.

Immediate corrective action was taken to verify that the DG's

" steady state no load voltages" were within required voltage tolerances.

This provides assurance that the " Auto Adjust Control" is at the preset position and will not adversely affect output voltage on an emergency start.

This action also verifies that the M0P has performed its safety function prior to the next DG start.

Final corrective action is being taken by procuring and replacing the model CYQM23610-19 delron gear motors with qualified model CYQC23600-19 steel gear motors.

(Ref. 8.)

1.7 Loss of Essential Buses Due to Altered Electrical Distribution System Lineup at Fort Calhoun On December 14, 1985, while Fort Calhoun* was in a refueling outage, all essential 480 V ac buses, two ac instrument buses, and one dc bus were lost.

The loss of power initiated the following safeguards signals:

pressurizer pres-sure low signal (PPLS), safety injection actuation signal, containment isolation actuation signal, and ventilation isolation actuation sianal.

Also lost due to the power failure were shutdown cooling, compressed air, turbine planc cool-ing water, and some control room indications.

The power failure occurred due to personnel error and an altered electrical distribution system lineup due to testing, maintenance, and modification work.

Immediate corrective action in-cluded restoring power to the 480 V buses within approximately 15 minutes, and holding a meeting with the individuals involved before allowing them to return to their testing.

The event is detailed below.

At 10:10 a.m., on December 14, 1985, all essential 480 V buses, one de bus, and two ac instrument buses were lost due to personnel error, several ongoing i

l

Fort Calhoun is a 502 Mwe (net) MDC Combustion Engineering PWR located 19 miles north of Omaha, Nebraska, and is operated by Omaha Public Power District.

12

modifications, and an altered electrical distribution system lineup as a result of maintenance testing and modification work.

Normally, Fort Calhoun's 480 V buses derive their power from two 4160 V safeguards buses.

To accommodate trans-former replacement modifications, all 480 V buses normally powered frcm safe-guards bus 1A3 were cross-tied to 480 V buses being powered from safeguards bus 1A4.

Thus, all essential 480 V buses, including the battery chargers which each power a dc bus, were receiving their power from the 4160 V 1A4 safeguards bus, which was receiving its power from a 161 kV offsite line.

The second possible source of power normally available for the safeguard buses during outages, 345 kV backfed through the station output transformer, was not available at the time of the event.

The System Protection group had tagged out breakers (for relay testing) that could provide power to the safeguard buses.

Both emergency diesels had been tagged out to prevent automatic initiation dur-ing the relay testing.

Battery No. 2, which supplies dc power to dc bus No. 2 when its battery charger fails, was tagged out for battery cell replacement.

Battery charger No. 3, an installed spare which is capable of powering either buses Nos. 1 or 2, was tagged out due to a modification.

The relay testing procedure called for tripping the relay controlling the breaker that could provide 345 kV power to the 4160 V 1A4 safeguards bus.

But, the technician inadvertently tripped the relay controlling the breaker that was providing the 161 kV power to the 4160 V 1A4 bus including the battery chargers.

With the loss of the battery chargers, dc bus No. 1 was being maintained by battery No. 1, but dc bus No. 2 was inoperable since battery No. 2 was disconnected for maintenance.

Also, ac instrument buses B and D were inoperable since they are powered from dc bus No. 2.

This resulted in a partial loss of control room indications.

Power to the 4160 V 1A4 safeguards bus could not be returned immediately, since the control power to the breaker switch that was accidentally tripped came from dc bus No. 2.

In the switchgear room, Operations personnel then manually switched the control power to the breaker switch from its normal power source to its emergency power source, dc bus No. 1.

This permitted the switch to close the breaker, providing power again to the 4160 V safeguards bus 1A4 and all 480 V buses, including battery charger No. 2, which then reenergized dc bus No. 2 and its associated instrument buses.

Within approximately 30 minutes, Control Room Operations personnel restored shutdown cooling, turbine plant cooling water and compressed air.

The initiation signal for half of the engineered safeguards, noted previously, resulted from the deenergization of half of the pressurizer pressure low signal block, and the reactor coolant system being depressurized.

Safety i

injection, containment isolation and ventilation isolation engineered safe-guards are initiated by a pressurizer pressure low signal, but only the ventilation isolation actuation signal actuated any equipment.

Actuation for safety injection and containment isolation was prevented, since the loading i

sequencers were turned off and the diesel generators and containment isolation process were tagged "Off Auto."

l l

13

l By 2:00 p.m. on December 16, 1985, the plant's electrical distribution system was properly aligned to ensure safe performance of tests, maintenance, and modifications to its electrical system.

Although the electrical distribution system had been significantly degraded, plant communications, fire protection, plant lighting and security systems had been maintained.

Immediately after the event, a meeting was held with the individuals involved before allowing them to return to their testing.

(Ref. 9.)

1.8 Reactor Trip on Loss of Main Feedwater Pump Due to Design Deficiency at Catawba On November 20, 1985, the reactor at Catawba

tripped automatically from 62%

power on 10-10 steam generator (SG) level after the loss of main feedwater (MFW).

One MFW pump was in operation at the time. While attempting to place the non-operating pump into service, an operator manually opened the MFW suction valve for the non operating pump, satisfying the third requirement for the windmill protection logic which tripped the condensate booster pump and the hotwell pumps.

The operating MFW pump subsequently tripped due to the loss of suction. This resulted in lo-lo level in SG C.

Investigation found that toe MFW system header pressure indicator wiring was reversed on the instrumentation drawing, falsely satisfying one of the three windmill protection interlocks. A temporary station modification was written and implemented to rewire the MFW pump header pre.sure switch and correct the windmill protection logic.

The event is detailed below.

At Catawba, the windmill protection logic for the MFW pumps exists to eliminate the possibility of the suction pressure on the pumps from driving the pumps due to low discharge header pressure. The system prevents overspeed and overheat-ing of the pump shaft bearings. Three conditions must be met prior to initia-tion of the protection logic.

First, the MFW pump suction valve header pressure must be less than 900 psig.

Second, the bearing lube oil pressure must be in-adequate (the pressure is considered to be inadequate for pump operation when it falls below 5.5 psig).

Third, the MWF pump suction valve must be open. The MFW windmill protection is a nonsafety-related component, therefore no pre-operational inspection is required for the wiring of the MFW header pressure indicator for the windmill protection logic.

Prior to this incident, work was being done on MFW pump 1A per a temporary sta-tion modification.

The bearing lube oil pressure was lowered by throttling valve ICF11 (thrust journal drive bearing, lube oil inlet), which in turn lowered the bearing temperature. The lube oil pressure gauge was used as a guide to lower the bearing lube oil pressure to a maximum pressure of 9.5 psig on MFW pump 1A. The previous maximum pressure was 12 psig.

Since an error of 1.5 psig existed on the pressure gauge, the maximum pressure that the lube oil could actually achieve on MFW pump 1A was 8.0 psig.

The alarm cannot be reset until the pressure reaches 8.2 psig.

An interlock exists between the lube oil pressure status and the MFW pump suction valves.

If the lube oil pressure drops below 5.5 psig and the low lube oil pressure alarm is actuated, the suction valves cannot be opened from the control room.

Catawba is a 1145 MWe (net) MOC Westinghouse PWR located 6 miles northwest of Rock Hill, South Carolina, and is operated by Duke Power.

14

I I

On November 19, 1985, the MFW pump 1A low oil pressure trip annunciator was actuated due to the lube oil pump being shut down.

The interlock between MFW pump 1A suction valve 1CM137 and the low lube oil pressure trip annunciator was activated through the windmill protection logic.

At about 11:30 p.m., the procedure was begun in order to start MFW pump 1A.

The operator at the controls (0ATC) attempted to open valve 1CM137. When the valve would not respond, a Nuclear Equipment Operator (NE0) was dispatched to manually unseat the valve.

After the NEO returned, the 0ATC once again attempted to open valve 1CM137.

Again the windmill protection logic prevented the opening of the valve.

The NE0 was sent back to manually open the valve in order to start MFW pump 1A.

The 0ATC did not realize at this point that the low lube oil pressure trip annunicator was activated and that this was the reason ICM137 could not be opened from the control room.

At about 12:30 a.m. on November 20, 1985, the NE0 opened valve ICM137.

This satisfied the third condition for the pump windmill protection logic.

The condition of low MFW pump discharge header pressure was met due to the wiring on the indicator being reversed when the component was installed per design drawings.

The windmill protection logic then tripped hotwell pumps 1B and 1C au~.omatically.

Condensate booster pumps 1A and IB tripped automatically, and hotwell pump 1A tripped automatically.

This eliminated sufficient suction flow to MFW pump 1B, which tripped automatically on emergency low suction pressure.

The main turbine then tripped automatically due to the loss of all MFW pumps.

Motor-driven auxiliary feedwater (AFW) pump 1A started automatically due to the loss of all MFW pumps.

Motor-driven AFW pump 1B started automatically, and main steam bypass to condenser valves 15B012 and ISB003 opened.

Attempts were made to restore MFW pump 18 to service per the loss of Steam Generator Feedwater procedure.

Reactor coolant system (RCS) average temperature (Tave) increased to approximately 593 F, thereby decreasing reactor power from 61% to 53% full power due to negative moderator temperature feedback.

Pressurizer power-operated relief valve (PORV) INC34A lifted.

Steam generator (SG) C and D PORVs and an SG B ASME code safety valve lifted, followed by the SG B PORV.

Another SG B ASME code safety valve lifted.

The pressurizer PORV lifted and reseated a second time.

At 12:31 a.m. on November 20, 1985, the reactor tripped on SG C 10-10 level.

Prior to the reactor trip, the loss of the condensate booster pumps and the hotwell pumps caused a sharp decrease in MFW pump 1B suction pressure, from 800 psig to the low suction pressure trip setpoint of 275 psig.

Steam generator feedwater was restored within the required time by the automatic start of the motor-driven AFW pumps.

The turbine-driven AFW pump automatically started simultaneously with the reactor trip, due to a false start signal from the wide range SG instrumentation.

Steam generator levels decreased as feeduater flow was momentarily lost, and continued to decrease after the start of the AFW pumps.

Level reached the lo-lo level reactor trip setpoint (approximately 29%) in SGs A and C.

The other levels were following very closely.

Post-trip feeding of the SGs then caused slight overfilling of B and C, reaching close to 55%, creating an excessive cooldown rate.

15 t

Steam pressure control began following the main turbine trip (on loss of the MFW pumps) with the actuation of the condenser dumps.

Three condenser dump valves did not actuate, which presumably caused the SG PORVs and two code safeties to open.

The PORVs of the B, C, and D steam lines actuated 40 to 50 psig above the setpoint value but within their setpoint tolerance.

Banks 1 and 2 of the B steam line code safeties actuated within their setpoint tolerances.

Steam line C experienced the highest pressure of the SG at a value of 1194 psig.

The steam generator A PORV did not actuate even though steam pressure reached 1185 psig, 60 psig above the setpoint.

Averaging SGs, pressure increased approximately 135 psig before the reactor trip.

Upon loss of feedwater flow, Tave increased sharply from 578 F to 593 F just prior to the reactor trip.

The increase in Tave caused a corresponding reduction in reactor power from 61% to 53% full power.

Following the reactor trip, Tave rapidly dropped to about 563 F and then continued to decrease.

This rapid cooldown was due to overfilling of the SGs.

Tave reached a minimum of 520 F and began increasing as AFW flow was reduced by securing the turbine-driven pump.

Pressurizer level responded as expected by increasing during the Tave increase due to reactor coolant swell. The maximum level reached was 62.7%, just prior to the reactor trip.

Level then decreased rapidly to approximately 37%.

The rate of decrease slowed down but continued; 17% was reached, resulting in letdown isolation and the trip of all pressurizer heaters.

This occurred about 6 minutes after the trip.

Pressurizer level continued to decrease to a minimum of 13.8%.

The feedwater storage tank was manually aligned to the charging pump suction in order to restore pressurizer level.

Letdown flow was established when level reached 30%, 24 minutes after the trip.

The cause of this event was classified as a design deficiency, since the MFW pump header pressure indicator wiring was reversed on the design drawings, and thus was reversed when the instrumentation was installed.

This caused the indicator to incorrectly provide a low header pressure signal and satisfy one of the three requirements for the MFW pump windmill protection logic.

A contributing cause was personnel error.

The low oil pressure trip alarm for MFW pump 1A bearing lube oil was actuated approximately 21 hours2.430556e-4 days 0.00583 hours 3.472222e-5 weeks 7.9905e-6 months prior to the start of this event, due to the lube oil pump being shut down, and there is no indication that the alarm was cleared during the 21 hours2.430556e-4 days 0.00583 hours 3.472222e-5 weeks 7.9905e-6 months prior to the event.

Investigation showed that it would have been impossible to clear the alarm due to the inability of the oil pressure to reach a level of 8.2 psig even with the lube oil pump running.

Also, the interlock between the low lube oil pressure trip and valve 1CM137 was activated, and was prohibiting operation from the control room.

Therefore, when the 0ATC tried to electrically open the valve after unseating it and it would not open, an investigation should have been conducted to find out why the valve would not open.

An additional contributing cause was that the pressure gauge used as a guide for setting the lube oil pressure had an error of 1.5 psig.

When the value of the maximum pressure was apparently lowered to 9.5 psig by throttling valve ICFll, the actual pressure was 8.0 psig.

This prevented the low lube oil pressure trip alarm from resetting once pressure in the bearings was obtained.

Following the event, the MFW pump 1A lube oil switch malfunction was investigated.

The maximum lube oil pressure was raised to allow resetting of 16

the low lube oil pressure trip annunciator.

The wiring on the MFW pump header pressure indicator was corrected. Work requests were completed to investigate and repair the overtemperature delta T trip setpoint for the RCS D loop, and to recalibrate the MFW pump 1A lube oil pressure gauges.

Other corrective actions have included the following:

Work requests were completed to investigate and repair the failure of three main steam bypass to condenser valves to open during this transient.

The wiring deficiency on the MFW pump header pressure windmill protection I

logic current switch was corrected.

The atmospheric dump valve arming was changed from 65% load to less than or equal to 50% load.

The necessary action on the pressure changes experienced during the transient on the suction side of the MFW pumps were identified.

An update was provided to all operators, reminding them of the need to review the annunciators prior to the startup of unit equipment.

(Ref. 10.)

1.9 Flooding of Safety-Related Areas at Hatch Unit 1 On December 21, 1985, an emergency core cooling system (ECCS) pump room at Hatch Unit 1* was flooded to a level of about 14 feet when an air-operated maintenance isolation valve on a residual heat removal (RHR) pump suction line opened. When power to the solenoid control valve was removed, as a result of performing a loss of offsite power (LOSP) test, the maintenance isolation valve returned to the open position. Water flowed from the torus, through the open valve, into the pump room from a disassembled RHR motor-operated pump suction valve.

The details of this event are described below.

The plant was in a refueling mode and all fuel was removed from the reactor vessel.

An RHR loop pump suction valve 1E11-F004A was disassembled for repair after failing a local leak rate test (LLRT).

Maintenance isolation valve i

1 Ell-F065A, which is located between IE11-F004A and the torus, was shut, and its control switch was " red tagged" (an administrative control which prohibits switch operation) in the control room.

Valve 1E11-F056A is an air-operated butterfly valve which opens on loss of power to its solenoid valve.

At 12:54 a.m. on December 21, a scheduled LOSP test was started per plant pro-cedures.

A loss of coolant accident (LOCA) signal was simulated for diesel generator (DG) 1A. That diesel started as required.

Plant personnel then de-energized 4160 V bus 1E to simulate a loss of offsite power.

The DG 1A output breaker then immediately closed automaticallj, which reenergized bus 1E.

At approximately 1:10 a.m., DG 1A was tripped locally, as required by the test procedure, to demonstrate proper DG logic function.

Power had been lost to the control solenoid for isolation valve 1E11-F065 during the time that the bus was doenergized. As a result of the deenergization of this solenoid, the isolation valve opened, allowing water to flow from the torus into the southeast ECCS

Hatch Unit 1 is a 768 MWe (net) MOC General Electric BWR located 11 miles north of Baxley, Georgia, and is operated by Georgia Power.

17

pump room via the disassembled lEll-F004A valve.

Following the planned deenergization of 4160 V bus lE due to the DG trip, the plant communication systems werb lost.

During this period of time the licensed operators in the main centrol room

)

were unable to communicate with plant personnel in the DG building until approximately 1:20 a.m. when, following reset of the trip, the diesel generator automatically restarted, reenergizing 4160 V bus 1E.

Following reenergization of bus lE, valve lEll-F065A reclosed.

By this time, the water level in the southeast ECCS pump room had already equalized (at a level of 14 feet in that room) with the torus water level.

When power was returned to bus lE, resulting in page system restoration, two calls to the main control room were promptly made reporting floodina in the southeast ECCS pump room.

A hi-hi sump level alarm had also been received and the sump isolation valves had automatically isolated.

The isolation signal was then overriden manually and the sump isolation valves were opened to allow the water to drain to the northeast ECCS pump room sump where it could be pumped to radwaste.

After the water level in the southeast ECCS pump room was sufficiently lowered, the source of the flood water was identified.

Water was pumped out of the rooms, which then were decontaminated.

The major items which were flooded consisted of three large 4160 V motors, seven motor operators for valves, and various small motors, junction boxes and solenoids.

The licensee has identified 16 instruments with obvious damage and 20 additional instruments that will require evaluation prior to restoration.

After taking the immediate actions necessary to prevent further damage, the licensee contacted the applicable vendors to establish the necessary work to correct and restore the equipment, and to assure that environmental qualifica-tions are maintained.

Testing of the restored equipment was performed prior to return to service. (Refs. 11-13.)

s 18

1.10 References (1.3)

1. Arizona Public Service, Docket 50-528, Licensee Event Report 85-83, January 15, 1986.

2. Arizona Public Service, Docket 50-528, Licensee Event Report 85-90, January 15, 1986.

3. NRC, Region V Inspection Report 50-528/85-43 and 50-529/85-44, January 21, 1986.

(1.4)

4. NRC, Region I Inspection Report 50-220/85-24, January 14, 1986.

5. Niagara Mohawk Power Corporation, Docket 50-220, Licensee Event Report 85-21, January 27, 1986.

(1.5)

6. Toledo Edison, Docket 60-346, Licensee Event Report 86-01, January 6, 1986.

7. NRC, Region III Inspectic Report 50-346/85-39, March 13, 1986.

(1.6)

8. South Carolina Electric and Gas, Docket 50-395, Licensee Event Report 85-32-01, January 9, L986.

(1.7)

9. Omaha Public Power District, Docket 50-285, Licensee Event Report 85-11, January 13, 1986.

(1.8)

10. Duke Power, Docket 50-413, Licensee Event Report 85-67, December 20, 1985.

(1.9)

11. NRC, Preliminary Notification PNO-II-85-121, December 23, 1985.

12. NRC, Region II Inspection Reports 50-321/85-37 (January 15,1986) and 50-321/85-39 (February 11, 1986.)

13. Letter from L. Gucwa, Georgia Power, to the NRC Document Control Desk, January 10, 1986.

i These referenced documents are available in the NRC Public Document Room at 1717 H Street, Washington, DC 20555, for inspection and/or copying for a fee.

(AE00 reports may also be obtained by contacting AE00 directly at 301-492-4484 or by letter to USNRC, AE00, EWS-263A, Washington, DC 20555.)

19

2.0 EXCERPTS OF SELECTED LICENSEE EVENT REPORTS On January 1, 1984, 10 CFR 50.73, " Licensee Event Report System" became effec-tive.

This new rule, which made significant changes to the requirements for licensee event reports (LERs), requires more detailed narrative descriptions of the reportable events.

Many of these descriptions are well written, frank, and informative, and should be of interest to others involved with the feedback of operational experience.

This section of Power Reactor Events includes direct excerpts from LERs.

In general, the information describes conditions or events that are somewhat un-usual or complex, or that demonstrate a problem or condition that may not be obvious.

The plant name and docket number, the LER number, type of reactor, and nuclear steam supply system vendor are provided for each event.

Further information may be obtained by contacting the Editor at 301-492-9752, or at U.S. Nuclear Regulatory Commission, EWS-263A, Washington, DC 20555.

Excerpt P_ age 2.1 Defective Procedure Leads to Lift Rig Failure at St. Lucie Unit 1........................................................

21 2.2 Mode Changes Made with Inoperable Equipment Due to Mishandling Work Request at Catawba Unit 1....

22 2.3 Inoperable Snubbers Due to Inadequate Inspection Procedures at Cooper......

24 2.4 Reactor Core Isolation Cooling Isolation During Testing of Safety Relief Valves at River Bend Uni t 1......................

25 2.5 Inoperability of Unit 2 and 2/3 Diesel Generators Due to Damaged Cooling Water Pump Power Cable and Subsequent Failure of Turbo-charger During Testing at Dresden Units 2 and 3.................

25 2.6 Loss of Decay Heat Removal on Cavitation of Residual Heat Removal Pump Due to Inadequate Procedures at Zion Unit 2........

26 2.7 Changed Modes with Containment Spray Pump Inoperable Due to Disconnected Reach Rod at Waterford Unit 3......................

28 2.8 Both Trains of Nuclear Service Water Inoperable Due to Designated Low Torque Settings on Valves at Catawba Unit 1......

29 2.9 Unanalyzed Fire Areas Due to Engineering Oversight at Palo Verde Unit 1...............................................

30 n

n n

n 2.1 Defective Procedure Leads to Lift Rig Failure at St. Lucie Unit 1 St. Lucie Unit 1; Docket 50-335; LER 85-09; Combustion Engineering PWR On November 6, 1985, St.Lucie Unit 1 was in a scheduled refueling outage.

At 0600 hours0.00694 days 0.167 hours 9.920635e-4 weeks 2.283e-4 months , maintenanc.e personnel commenced lifting the upper guide structure (UGS) out of the reactor vessel.

By 0620 hours0.00718 days 0.172 hours 0.00103 weeks 2.3591e-4 months , the UGS had been raised 21

approximately 6 to 8 feet above the reactor core when it was noticed that the l

UGS was cocked approximately 15 degrees.

All operations were secured for further evaluation.

Shortly after 0700 hours0.0081 days 0.194 hours 0.00116 weeks 2.6635e-4 months , an underwater camera inspection revealed that one of the lifting rig's three lift bolts had failed.

The immediate cause of the fail-ure was insufficient thread engagement and subsequent thread stripping.

The other two lift bolts showed adequate thread engagement and were holding.

The resident NRC representative was notified of the event at 0725 hours0.00839 days 0.201 hours 0.0012 weeks 2.758625e-4 months .

At 1045 hours0.0121 days 0.29 hours 0.00173 weeks 3.976225e-4 months , an unusual event was declared per NRC request.

At 0735 hours0.00851 days 0.204 hours 0.00122 weeks 2.796675e-4 months , technical assistance was requested in uprighting and removing the UGS from the reactor vessel.

The design of an auxiliary lift rig (ALR) and associated procedures continued until early on November 7.

The final design of the ALR consisted of three separate legs, each having a pair of "J-hooks" connected by steel cables to a hydraulic jack assembly.

The hydraulic jack assembly was to be secured to the lifting rig's work platform and the "J-hooks" l

were to grab the UGS top plate.

On November 8, fabrication of the ALR was complete and ready for load testing.

Each leg was load tested separately.

The first load test began at 1700 hours0.0197 days 0.472 hours 0.00281 weeks 6.4685e-4 months and was satisfactorily completed at 1808 hours0.0209 days 0.502 hours 0.00299 weeks 6.87944e-4 months .

The other two load tests were completed by early morning, November 9.

The ALR was installed on the UGS lifting rig by 0845 hours0.00978 days 0.235 hours 0.0014 weeks 3.215225e-4 months .

At 1345 hours0.0156 days 0.374 hours 0.00222 weeks 5.117725e-4 months , alternate tensioning of the two ALR legs which straddled the two good lift bolts was commenced.

The ALR leg which straddled the failed lift bolt was then ten-l sioned and at 1400 hours0.0162 days 0.389 hours 0.00231 weeks 5.327e-4 months the UGS was level.

After verifying that the "J-hooks" were properly engaged, maintenance personnel proceeded to raise the UGS, The UGS was clear of the reactor vessel flange at 1526 hours0.0177 days 0.424 hours 0.00252 weeks 5.80643e-4 months and the unusual event was secured at 1620 hours0.0188 days 0.45 hours 0.00268 weeks 6.1641e-4 months on November 9.

The root cause of the insufficient lifting bolt thread engagement and subse-quent stripping was due to a deficiency in maintenance procedure M-0015,

" Reactor Vessel Maintenance - Sequence of Operations." Contrary to the nuclear steam system supply vendor's guidance, the procedure had no precautions nor any steps which checked the UGS lift rig bolts for full thread engagement.

The procedure only required that the lif t bolts be torqued to 50 f t-lbs.

So when the lift bolt seized after approximately three turns, the personnel torqued it to 50 ft-lbs. and assumed that the lift bolt was properly engaged.

2.2 Mode Changes Made with Inoperable Equipment Due to Mishandling Work Request at Catawba Unit 1 Catawba Unit 1; Docket 50-413; LER 85-66; Westinghouse PWR On November 5, 1985, it was discovered that the control damper 1 ARF-D-4, Train B of the containment air return and hydrogen skimmer (VX) system would not open electrically.

A work request was written to investigate the reason the damper would not open and to make the necessary repairs.

The unit was in an outage at the time.

Since VX was not required to be operable in the existing mode, cold shutdown, the work.2 quest was not stamped as a technical speci-fication item, nor was it logged in the technical specification action item logbook (TSAIL).

It was, however, noted on the work request that it would need to be worked prior to the unit entering hot shutdown.

An out-of-service sticker was placed on the control board, referencing the work request.

22

On November 13, 1985, unit startup was begun, hot shutdown was entered at 0913 hours0.0106 days 0.254 hours 0.00151 weeks 3.473965e-4 months , and power was increased beginning on November 17.

The work request had gone to Planning on November 5, and the responsible i

Planner noticed the " required for hot shutdown" note on the work request and i

called shift personnel to inquire about the need for the request.

He was in-structed to route the work request to the Unit Scheduling Engineer for evalu-ation.

l On November 19, a Shift Technical Advisor (STA) began investigating a 1.47 bypass panel indication associated with the VX system.

The STA reviewed the i

VX controls on 1MC4, which was located outside the control room horseshoe area, l

and found that the out of service sticker had been placed and that the work request had been originated.

The sticker had a note indicating that there were no indicating lights on the controls.

The STA began investigating the problem

{

and realized that the work request should have been worked prior to the unit

{

entering hot shutdown.

He called the responsible Planner to inquire as to why

{

the work had not been parformed.

The Planner was not in, but another Planner found the work request on the Planner's desk with no comments attached.

The Scheduling Engineer did not remember reviewing the work request, and no record of reviewed work requests were kept.

I At approximately 1500 hours0.0174 days 0.417 hours 0.00248 weeks 5.7075e-4 months , Operations personnel began reviewing drawing in-formation to determine if the damper would fail to the technical specification required safe position.

At approximately 1515 hours0.0175 days 0.421 hours 0.0025 weeks 5.764575e-4 months , the determination was made that the damper would not have opened on an SP signal if required.

At 1610 hours0.0186 days 0.447 hours 0.00266 weeks 6.12605e-4 months on November 19, the work request was upgraded and logged into the TSAIL. Also at this time, Operations began to reduce power as required by Technical Specification 3.4.5.6.

The work request was completed at 1700 hours0.0197 days 0.472 hours 0.00281 weeks 6.4685e-4 months on November 19, and the itera was cleared from the TSAIL.

Technicians found that a blown fuse was the reason the damper would not open electrically.

When a work request is written by the Operations group for a technical speci-fication item required for the existing mode of operation, it is stamped with a red TECH SPEC ITEM stamp and logged into the TSAIL.

This keys personnel to complete the work in a specified time frame.

The work request was not stamped as a TECH SPEC ITEM when written because the VX system was not required to be operable in the existing mode.

If the work request had been stamped as TECH SPEC ITEM, required for hot shutdown, before it was sent to Planning it would have been flagged appropriately to be included on the outage worklist.

For this reason, this incident is classified as a management deficiency, because of a breakdown in administrative controls.

Maintenance Management Procedure 1.0 specifies the use of Priority 5 for outage related work.

There are several types of Priority 5's, among these is Priority 5F.

This priority is described as " emergency work which must be completed to prevent extension of the outage."

If this work request had been prioritized as 5F, it would have been routed to the Unit Scheduling Engineer and included on this outage's worklist.

Personnel have not become accustomed to this priority due to the limited number of outages that the station has experienced to date.

The licensee immediately began to investigate and repair the cause of the VX damper not functioning.

Also, Operations personnel began decreasing power at 10% per hour, as required by technical specifications.

Subsequent to the event, 23

review of the 1.47 bypass panel has been included in operations mode checklists.

Planned corrective actions include the following:

(1) TECH SPEC ITEM stamps will be given to each group which initiates work requests in order to identify work required to be operable by technical specifications in any mode.

(2) Discussions will be held on the need for control room personnel and supervision to perform a more thorough review of heating, ventilating, ard air conditioning panels at shift turnover.

(3) Correspondence will be provided to all station groups about the proper use of Priority 5 work requests, including the selection of identifiers.

2.3 Inoperable Snubbers Due to Inadequate Inspection Procedures at Cooper Cooper; Docket 50-298; LER 85-16; General Electric BWR On October 22, 1985, while on tour of Cooper's primary containment, resident and regional NRC personnel noted a mechanical snubber being restricted in move-ment by floor grating.

After the problem was brought to the attention of sta-tion management, the subject seismic support was declared inoperable and a re-pair program was initiated.

Other selected snubbers were visually inspected l

for external interference in accordance with station technical specification l

visual inspection criteria.

The inspection was later expanded to cover all safety related snubbers in the primary containment.

As a result of this in-spection, three additional snubbers were found with interfererce problems and were subsequently declared inoperable.

Modifications were performed on the seismic supports to return them to operable status.

On November 19, 1985, a follow-up meeting was held between station management and the NRC inspectors to discuss the corrective actions taken for the October 22, 1985 event.

Attendees felt that adequate attention was given to snubbers inside primary containment, but possibly not enough attention had been given to safety-related snubbers outside primary containment.

Therefore, ten snubbers were randomly selected outside containment for visual inspection.

During the course of this inspection, several additional seismic supports were found to have discrepancies.

The inspection results indicated a significant weakness in the snubber inspection program, specifically procedural and training deficiencies related to visual inspection of the snubber " system." The " system" refers to the snubber and associated attachments such as pipe clamps, paddle-clevis arrangements and external interferences.

Additional visual inspections were initiated using existing station inspection procedures which were supplemented to include additional inspection criteria in the areas of proper snubber alignment, correct installation and proper clearances.

These additional visual inspections included all safety-related snubbers outside primary containment and 10% of safety-related snubbers inside containment (100%

of snubbers inside containment had been previously inspected for external inter-ferences only). The 10% inspection of snubbers inside containment was later ex-panded to cover all safety-telated snubbers inside containment.

A total of 25 out of 292 seismic supports were found with discrepancies.

The major discrepancy found on these supports involved rotation of the pipe clamp; other discrepan-cies were misalignment of the rear bracket, loosened anchor bolts and pipe clamps, and bent pipe clamps and snubber paddles.

24

No generic failure is attributed to the type, model, size or manufacture of any snubber, but rather a deficiency in the visual inspection procedures and train-ing relating to the snubber inspection program.

The 21 inoperable seismic supports were repaired and returned to operable status prior to reactor startup.

2.4 Reactor Core Isolation Cooling Isolation During Testing of Safety Relief Valves at River Bend Unit 1 River Bend Unit 1; Docket 50-458; LER 85-49; General Electric BWR At 1102 on December 6,1985, with River Bend Unit 1 in startup operations, an l

unplanned Engineered Safety Feature actuation was observed to have taken place.

Main Steam Safety Relief Valve (SRV) IB21-F041A was opened per Startup Test i

ST-26, "SRV Testing." At 1103, the SRV was closed and a reactor core isolation j

cooling (RCIC) Division II containment isolation occurred.

The isolation was reset, RCIC returned to standby condition, and SRV testing resumed.

At 1216, l

SRV 1821-F047A was opened.

At 1217, the SRV was closed and an RCIC Division II containment isolation occurred again.

The isolation was reset and RCIC re-turned to the standby condition.

i Steam for operation of the RCIC turbine is provided from the A main steam line between the reactor vessel and the two SRVs on the line.

Lifting either of the two SRVs, 1821-F041A and 1821-F047A, is thought to produce pressure / flow fluc-tuations in the RCIC/RHR (residual heat removal) steam line, causing the trip and isolation on RCIC/RHR steam flow instrumentation 1E31-PDTN084A and 1E31-PDTN084B.

Since the event, the damping potentiometers on these differen-tial pressure transmitters have been adjusted to increase the time constant.

Subsequent testing caused no isolation when either SRV 1821-F041A or 1821-F047A were opened.

2.5 Inoperability of Unit 2 and 2/3 Diesel Generators Due to Damaged Cooling Water Pump Power Cable and Subsequent Failure of Turbocharger During Testing at Dresden Units 2 and 3 Dresden Units 2 and 3; Dockets 50-237 and -249; LER 85-44; General Electric BWRs On December 13, 1985 at approximately 0330 hours0.00382 days 0.0917 hours 5.456349e-4 weeks 1.25565e-4 months , with Dresden Unit 2 operating at 100% power and Unit 3 in cold shutdown condition with all fuel removed from the vessel, the power cable to the 2/3 diesel generator cooling water pump (LB) was discovered damaged during normal operating routines.

Consequently, the 2/3 diesel generator was declared inoperable at 0330 hours0.00382 days 0.0917 hours 5.456349e-4 weeks 1.25565e-4 months .

Investigation into the power cable failure was initiated, and D'esden Operating Surveillance (005) 6600-1 was performed on the Unit 2 diesel generator for assurance of operability as required by Technical Specification Section 3.9.B.

While performing the surveillance test, the Equipment Operator heard surging noises at the diesel generator turbocharger as the diesel was being taken off-line.

At hpproximately the same time the noises occurred, the Control Room Operator observed a sudden 50 kw load decrease that gradually returned to its original position.

The Shift l

Engineer and Station Control Room Engineer were notified of the unusual sounds I

and meter indication discovered during the surveillance.

After discussing the event, it was decided to repeat the surveillance test to determine if an actual problem existed on the Unit 2 diesel generator.

25

At 559 hours0.00647 days 0.155 hours 9.242725e-4 weeks 2.126995e-4 months , the full load of 2500 kW was applied to the diesel generator and, after approximately 8 minutes into the surveillance test, the surging noises recurred and the generator load decreased twice by 500 kw before dropping to 0 kw.

In addition, it was observed that the diesel generator output breaker had tripped open.

The diesel generator trouble alarm and low water pressure alarm had illuminated on the 902-8 control room panel and the local diesel generator control panel, respectively.

Since the 2 and 2/3 diesel generators were both inoperable at approximately 0610 hours0.00706 days 0.169 hours 0.00101 weeks 2.32105e-4 months , an unusual event was declared, and a Unit 2 shutdown was initiated as required by technical specifications.

Investigation results of the power cable failure on the 2/3 diesel generator cooling water pump revealed that one of the three conductors was partially burned and its insulation was partially worn.

The area of the cable that was found damaged is normally enclosed in a metal connector that links the cable to the cooling water pump motor.

It is believed that station personnel used the cable conduit as a support when climbing a permanent ladder installed near the cable, thus creating a rubbing action among the cable and the metal connec-tor. This rubbing eventually caused the conductor's insulation to wear, which resulted in the conductor burning upon contacting the grounded metal connector.

Repairs were made on the damaged power cable and surveillance tests were per-formed successfully on the 2/3 diesel generator and its cooling water pump.

As a corrective measure in preventing future occurrences of this type, the station plans to replace the flexible cable conduit with rigid conduit and install an additional brace for more support.

After successful completion of the surveillance tests on the 2/3 diesel genera-tor and its cooling water pump, the station declared the 2/3 diesel generator operable and terminated the unusual event (approximately 1400 hours0.0162 days 0.389 hours 0.00231 weeks 5.327e-4 months ) and Unit 2 shutdown. The Unit 2 diesel generator remained inoperable and the station Maintenance personnel continued to inspect the diesel.

During the inspection, pieces of the turbocharger (Electro-Motive model #8377586) main bearings were found in the diesel oil pan, and the turbocharger main shaft was found bent.

The turbocharger failure caused a reduction in the diesel engine speed, which decreased the shaft-driven cooling water pump speed, thus producing a low cooling water pressure that tripped the diesel generator.

Evidence of the engine speed reduction was indicated by the observation of the sudden load changes that occurred during the surveillance test. With reference to the diesel generator repairs, station Maintenance personnel replaced the damaged turbocharger and, for preventive maintenance measures, replaced the circulating lube oil pump and filter.

As a result of station analysis, it is believed that the turbocharger failure was caused by damaged main bearings which allowed the main shaft to bend.

Further analysis will be conducted by the manufacturer, General Motors Electro-Motive Division, to determine the cause of the bearing failure.

2.6 Loss of Decay Heat Removal on Cavitation of Residual Heat Removal Pump Due to Inadequate Procedures at Zion Unit 2 Zion Unit 2; Docket 50-304; LER 85-28; Westinghouse PWR On December 10, 1985 at 2000, Unit 2 reactor coolant system (RCS) level was decreased from an indicated 588 ft 6 in to 585 ft to facilitate repair of re-sidual heat removal (RHR) system cold leg injection test line isolation valve.

RCS level was being monitored via a recorder mounted on the reactor control section of the main control board, fed by transmitter RC228.

Between that time 26

and December 14, 1985 at 0300, level had dropped 5 inches to 584 ft 7 in, which represents a total of 1797 gallons.

Of that total, 1065 gallons was diverted to the holdup tanks due to work being performed on a volume control tank level control valve.

The balance, 732 gallons, was lost due to minor systek leakage.

Unit 2 was in cold shutdown with the reactor head installed but not tensioned, and the RCS vented to atmosphere.

The 2B RHR pump had been in operation pro-viding decay heat removal with RHR letdown in progress and the 2B charging pump providing makeup flow to the RCS.

On December 14 at 0325, the 2B RHR pump became airbound as a result of vortexing.

The Unit 2 Nuclear Station Operator (NS0) observed zero flow and low amps and immediately secured the 2B RHR pump.

After tripping the 2B RHR pump, the RCS level indication went er-ratic and then pegged high; the 2B charging pump was tripped immediately.

The operator then dispatched personnel to check out the 2B RHR pump.

Station per-sonnel believed the RHR pump or motor had failed, since indications were zero flow and low amp readings.

Therefore the 2A RHR pump was started and subse-quently deenergized because of abnormal current and flow indications.

An

" alert" was declared due to the loss of RHR.

At 0330 it was realized that RCS level was inadequate for RHR pump suction requirements and the indicated high level was actually an instrumentation spike.

The 28 charging pump was restarted and RCS make up was established.

At this time, an equipment operator was sent into containment to verify RCS level by tygon standpipe.

At 0355 with a level increase of approximately 10 inches to 585 ft 5 in and after the Shift Foreman reported the 2A RHR pump vented via the mechanical seals, the 2A RHR pump was restarted and then deenergized because of identical flow and current indica-tions as previously experienced.

During this time, abnormal operating procedure (A0P) No. 20, " Loss of RHR Shutdown Cooling," was in use for the recovery.

To obtain adequate suction quickly it was decided to transfer RHR suction from the RCS to the refueling water storage tank (RWST).

At 0420 suction was shifted to the RWST and then restored at 0425 to the RCS a.;er level had increased to an indicated level of 588 ft (via recorder).

At 0430 the RCS level was reported to be indicating 587 ft 2 in via the tygon standpipe.

The 2B RHR pump was restarted and operated for about 60 or 90 seconds before normal current and flow were indicated.

The 2B RHR pump was declared operational.

At 0440, the 2A RHR pump was started; it operated normally and was then deenergized.

At this time the " alert" was terminated, and recovery was considered complete.

The sensing line for the loop B bypass flowmeter 2FIC-448B is also used as the sensing line for the refueling level transmitter LT-RC228.

The 2FIC-448B sen-sing line is the sensing for the refueling level transmitter LT-RC22B.

The sensing line is attached at the loop centerline right below the RHR discharge line.

This has the potential to cause inaccurate and erratic level indication due to the dynamic flow effects when the RCS loop piping is not full.

At the time of the event, the level indication was erratic but believed to be accurate, therefore this was only a contributing factor.

The location of the centerline of the loop piping was believed to be 584 ft 6 in.

Procedures were not indicative of the actual value, which was verified through measurements and per the drawings to be 584 ft 0 in.

Initially, it was thought that the RCS level recorder would only indicate down to 584 ft 6 in.

The modi-fication package which installed the level measurement system documented 584 ft 5 in.

Station personnel did a water column measurement from the loop center-line to the level transmitters and verified that 584 ft is the centerline.

It i

is believed that the RHR pumps cavitate above the loop centerline at approxi-mately 5 ft 6 in at a flowrate of 3000 gpm.

The top of the RHR suction piping 27

is 5-5/8 inches below centerline. With such a flowrate it is believed a large vortex is created, thus entraining air causing the pump to become airbound.

The size of the vortex flow is dependent.

If the actual loop centerline eleva-tion and the elevation at which the RHR pumps cavitate had been known, proce-dures would have reflected this information and this event would have been avoided.

Immediate corrective actions included writing Station Standing Order 280 to inform operating personnel of a minimal RCS level to maintain.

The order also put a tolerance on variations between the tygon standpipe and the level re-corder, on what actions should be taken if the variance is excessive, and when a continuous tygon watch shall be established.

An Operating Engineer's permission will be required to decrease level. Warning labels were installed on the level recorder in the control room indicating minimum level.

The RCS level instrumentation was vented and found to be in perfect calibration, and the RHR system was walked down to inspect for discrepancies.

Long-term corrective actions include initiating a modification to provide accurate RCS level indication during refueling.

The modification will be split into two segments.

The first segment will address the tygon level system.

The system will be hard piped from the loop drain to the top of the pressurizer with a small section employing tygon as a sight glass.

Also, procedure changes will be implemented to insure adequate monitoring of the tygon level system based on plant conditions.

The second segment will consist of removing the existing level transmitters and designing of a system that will give reliable remote level indication during all plant refueling configurations.

This system will have a low level alarm.

A modification will be initiated to install an RHR pump suction pressure transmitter with indication in the control room and annunciation upon low pressure.

A procedure review of the maintenance instruc-tions and abnormal operating procedure will be conducted, and procedure changes to these, reflecting the lessons learned will be implemented.

Testing may be done during the outage to determine the actual level at which the RHR pumps lose suction.

Training will be conducted on RCS level measurement and loss of RHR avents.

2.7 Changed Modes with Containment Spray Pump Inoperable Due to Disconnected Reach Rod at Waterford Unit 3 Waterford Unit 3; Docket 50-382; LER 85-55-01; Combustion Engineering PWR At 0425 hours0.00492 days 0.118 hours 7.027116e-4 weeks 1.617125e-4 months on December 17, 1985 Waterford Unit 3 was in hot standby when operations personnel observed that the containment spray (CS) pump B discharge valve (CS-1118) was closed.

Therefore, contrary to Technical Specification 3.0.4, the B CS pump was inoperable when the plant had entered hot standby at 2042 hours0.0236 days 0.567 hours 0.00338 weeks 7.76981e-4 months on December 16, 1985.

Over a period of several hours on December 16, operations personnel had tried to determine why the " Containment Spray Header B Discharge Valve Closed" annunciator was illuminated.

During this investigation, the local operator discovered that the reach rod operator was disconnected.

A discussion with the operator responsible for performing the valve lineup revealed that he used the reach rod to open the valve after securing shutdown cooling.

Also, as part of an independent verifi-cation of the valve lineup, a second operator used the reach rod operator to verify valve position.

The valve was opened and the annunciator cleared.

28

Upon discovery of the disconnected reach rod, the Operations Superintendent added an instruction in the night orders cautioning Operations personnel on the shortcomings associated with reach rods and their use for independent verifica-tion of valve lineups.

This is a temporary corrective action.

Presently, operations personnel are compiling a list of manual valves which are operated by reach rods. This list will be included in the appropriate _ operations proce-dure along with a statement of caution in procedure 01-10-000, "Waterford 3 Operations Department Good Operating Practices," concerning independent verifi-cations.

2.8 Both Trains of Nuclear Service Water Inoperable Due to Designated Low Torque Settings on Valves at Catawba Unit 1 Catawba Unit 1; Docket 50-413; LER 85-68; Westinghouse PWR At approximately 1030 hours0.0119 days 0.286 hours 0.0017 weeks 3.91915e-4 months on November 25, 1985 at Catawba, the. inservice test on nuclear service water (NSW) header 1B supply isolation valve (1RN698) was started. The inservice test is performed quarterly to verify stroke time.

At 1045 hours0.0121 days 0.29 hours 0.00173 weeks 3.976225e-4 months , while stroking the valve from the CLOSE to OPEN position, it stopped-in the intermediate position.

At that time, Train B of.NSW was declared inoper-able, and Train A was to be placed in service.

Upon starting NSW Pump 1A, its-discharge isolation valve (1RN28A) also stopped in the intermediate position at 1100 hours0.0127 days 0.306 hours 0.00182 weeks 4.1855e-4 months .

Train A of NSW was declared inoperable and Technical Specifica-tion 3.0.3 was entered due to simultaneous inoperability of both trains of NSW.

Technical Specification 3.0.3 states that the inoperability must be corrected within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or initiate action to place the unit in cold shutdown, within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

At 1143 hours0.0132 days 0.318 hours 0.00189 weeks 4.349115e-4 months , valve 1RN698 was manually opened with power removed from the valve motor.

This placed the valve in the required position.

The action state-ment of Technical Specification 3.0.3 was suspended,' and Train B of NSW was declared operable.

Work Requests were initiated to investigate and repair valves 1RN28A and 1RN698.

When personnel investigated the two valves, they found the valves cycling properly.

The functional verification on the valves was,successfully com-pleted and the work requests were signed off.

Another work request was ini-tiated to verify and set the torque settings to the maximum allowable value on valves 1RN698 and 1RN28A.

The torque settings for both valves were found to be set at 1-1/2, which is the low end of the allowab'le range specified by the manufacturer.

The torque settings for the valves were readjusted to the maximum setting of 2-3/4, and the functional verification was successfully completed.

The torque settings for valves 1RN698 and 1RN28A being at the low end of the allowable range caused inconsistent operation of the valves; i.e., failure to completely cycle at times.

The lower torque setting may not be sufficient to fully cycle the valves under all system alignments due to backpressure across the valves.

The torque settings were pre-set by the manufacturer at the low end of the allowable range as specified by the manufacturer, and were verified correct during initial setup of the valves.

There was a failure to evaluate the total application of the valves to ensure that the torque settings were sufficient.

Therefore, the incident is classified as design deficiency.

29

a - - - - -

- +-.

~x.-

n

.-,n

..-n

- ~ ~

~

Immediate corrective actions included manually opening valve 1RN69B with power removed from the valve motor.

Later, the torque settings on valves 1RN.69B and 1RN28B were readjusted to the maximum allowable setting.

Licensee design personnel have recommended that for these valves and all similar valves (i.e., a quarter-turn gearhead design), torque switches be reset to the maximum allowable, and that the control wiring be revised to locate the open torque switch bypass on rotor 3 of the limit switch, not currently being used, and set the bypass switch to be made for the first 10% of open stroke.

2.9 Unanalyzed Fire Areas Due to Engineering Oversight at Palo Verde Unit 1 Palo Verde Unit 1; Docket 50-528; LER 85-96; Combustion Engineering PWR On December 27, 1985 at 1054, with Palo Verde operating at 96% power and Unit 2 in refueling, a fire protection engineer (non-licensed utility employee) was evaluating an engineering evaluation request (EER) associated with the seismic gap area between the diesel generator (DG) building and the control building.

The EER had been written to address the fact that the two doorway openings through this seismic gap area were enclosed with metal flashing on Unit 2, but were not enclosed on Unit 1.

The evaluation of this EER determined that these seismic gap areas were not identified and analyzed during the fire hazard anal-ysis.

Since for each unit, Train A and Train B safe shutdown cables transverse this gap area through conduit expansion / deflection fittings and open cable trays with no vertical fire rated barrier separation, and since there is no fire detection and suppression equipment within the gap area, the potential exists for a fire in this area to cause a loss of both DGs in the affected unit.

As immediate corrective action, a continuous fire watch was established at each seismic gap area and will be pr6vided until a final design change is implemented to reduce the probability of a significant fire in this area.

An evaluation of the seismic gap area between the DG and control buildings was subsequently performed.

Each seismic gap is 6 inches wide, 60 feet long and 53 feet high, and creates a closed space which adjoins the Train A and Train B fire areas of the DG building with thou of the control building.

The sides of the gap are enclosed by vertical metal expansion joint closures, and the top is enclosed by a neoprene expansion joint.

The DG and control buildings' walls are independent 3-hour rated fire walls.

The only probable entry points for transient combustibles are two doorway openings in each gap area.

The fixed combustible load within each seismic gap is minimal, and consists of the neo-prene boot material around the conduit fitting, the neoprene roof seal, and the cable insulation. The cables are IEEE-383 qualified and meet an additional criterion of resisting 210,000 BTU / hour of heat for the flame test.

The neoprene material has a high chloride content which makes it naturally flame resistant.

The closest dimension between Train A and B safe shutdown cables which transverse-this gap is approximately 10 feet 9 inches; however, these cables are enclosed inside flexible neoprene boot material which offers a degree of fire resistance.

The closest dimension between exposed (i.e., routed in open cable. trays) Train A and B safe shutdown cables in this gap is approximately 28 feet.

All circuits which pass through these seismic areas were verified to have proper fuse / breaker circuit protection to protect against auto ignition of the cables due to over-current conditions.

The major safety implication of this event is that a fire in this seismic gap area may result in a loss of both DGs for the respective unit.

The existing fixed combustible loads in the gap areas are minimal and no credible ignition 30

sources exist.

Prior to discovery of this event, a fire in the seismic gap area of sufficient magnitude to cause a loss of both DGs would require the admission of transient combustibles and an ignition source through the doorway openings.

The feasibility of this type of fire was minimal due to an existing administrative control procedure governing transient combustibles.

In addition, the utility fire protection staff continuously reviews the Units for transient ccmbustibles.

As permanent corrective action,1-hour fire rated seismic gap seals will be installed around each of the doorway openings through these areas.

These seals will provide an effective fire barrier against exposure hazards associated with transient fire loads.

Based on this corrective action and on the evaluation of the gap areas, the potential for a fire in these seismic gap g

areas is not credible due to the low fixed combustible loads, the inaccessibility of the areas to transient combustibles, and the absence of credible ignition sources.

Therefore, a safety analysis change will be prepared and will outline the justification for deviation from 10 CFR 50, Appendix R, Section III.G for these seismic gap areas.

There are no credible alternate circumstances that would have resulted in this event being more severe.

The root cause of this event was engineering oversight.

During performance of the Fire Hazard Analysis, this seismic gap area for each Unit was not identified and, therefore, not evaluated.

Subsequent to this event, a review of the Units has verified that all other seismic gap areas meet Appendix R commitments.

i 31

3,0 ABSTRACTS / LISTINGS OF OTHER NRC OPERATING EXPERIENCE DOCUMENTS 3.1 Abnormal Occurrence Reports (NUREG-0090) Issued in November-December 1985 An abnormal occurrence is defined in Section 208 of the Energy Reorganization Act of 1974 as an unscheduled incident or event which the NRC determines is significant from the standpoint of public health or safety.

Under the provi-sions of Section 208, the Office for Analysis and Evaluation of Operational Data reports abnormal occurrences to the public by publishing notices in the Federal Register, and issues quarterly reports of these occurrences to Congress in the NUREG-0090 series of documents.

Also included in the quarterly reports

{

are updates of some previously reported abnormal occurrences, and summaries of certain events that may be perceived by the public as significant but do not meet the Section 208 abnormal occurrence criteria.

Date Issued Report E

11/85 REPORT TO CONGRESS ON ABNORMAL OCCURRENCES, APRIL-JUNE 1985, VOL. 8, N0. 2 There were eight abnormal occurrences during the report period.

Three occurred at licensed nuclear power plants, four occurred at other licensees (industrial radiographers, medical institutions, g

industrial users, etc.), and one occurred at an Agreement State licensed facility.

The occurrences at the plants involved (1) inoperable safety in-jection pumps at Indian Point Unit 2, (2) significant deficiencies in reactor operator training and material false statements at Grand Gulf, and (3) loss of main and auxiliary feedwater systems at Davis-Besse.

The occurrences at other licensees involved (1) diagnostic medical misadministration at the Hospital of St. Raphael in New Haven, Con-necticut; (2) diagnostic medical misadministration at Mercy Hospital in Pittsburgh, Pennsylvania; (3) breakdown in management controls at Pittsburgh Testing Laboratory in Pittsburgh, Pennsylvania; and (4) therapeutic medical misadministration at Christ Hospital in Cincinnati, Ohio.

The occurrence at the Agreement State licensed facility involved overexposure of a radiographer and an assistant radiographer employed by World Technical Services in Deer Park, Texas.

Also, the report provided update information on (1) steam generator problems (76-11), first reported in NUREG-0900-5, July-September 1976, under the title " Steam Generator Tube Integrity"; (2) environmental qualification of safety-related electrical equipment inside contain-ment (77-9),, a generic item first reported in NUREG-0090-10, October-December 1977; (3) the nuclear accident at Three Mile Island (79-3),

first reported in NUREG-0900, Vol. 2, No.1, January-March 1979; (4) uncontrolled leakage of reactor coolant outside primary contain-ment (83-6), first reported in NUREG-0090, Vol. 6, No. 3, July-September 1983; (5) degraded isolation valves in emergency core L

33

Date Issued Report cooling systems (84-8), first reportad in NUREG-0090, Vol. 7, No. 3, July-September 1984; and (6) degraded shutdown systems (84-9), first reported in NUREG-0090, Vol. 7, No. 3, July-September 1984.

In addition, an item of interest that did not meet abnormal occurrence criteria but may be considered significant by the public involved deficiencies in the quality assurance program during construction at Waterford Unit 3.

34

3.2 Bulletins and Information Notices Issued in November-December 1985 The Office of Inspection and Enforcement periodically issues bulletins and information notices to licensees and holders of construction permits.

During the period, two bulletins and 16 information notices and 1 information notice supplement were issued.

Bulletins are used primarily to communicate with industry on matters of generic importance or serious safety significance (i.e., if an event at one reactor raises the possibility of a serious generic problem, an NRC bulletin may be issued requesting licensees to take specific actions, and requiring them to

(

submit a written report describing actions taken and other information NRC should have to assess the need for further actions).

A prompt response by affected licensees is required and failure to respond appropriately may result in an enforcement action. When appropriate, prior to issuing a bulletin, the NRC may seek comments on the matter from the industry (Atomic Industrial Forum, Institute of Nuclear Power Operations, nuclear steam suppliers, vendors, etc.),

[

a technique which has proved effective in bringing faster and better responses from licensees.

Bulletins generally require one-time action and reporting.

They are not intended as substitutes for revised license conditions or new requirements.

Information Notices are rapid transmittals of information which may not have been completely analyzed by the NRC, but which licensees should know.

They require no acknowledgement or response, but recipients are advised to consider the applicability of the information to their facility.

Date Bulletin Issued Title 85-02 11/5/85 UNDERV0LTAGE TRIP ATTACHMENTS OF WESTINGHOUSE DB-50 TYPE REACTOR TRIP BREAKERS (Issued to all power reactor licensees and applicants) 85-03 11/15/85 MOTOR-0PERATED VALVE COMMON MODE FAILURES DURING PLANT TRANSIENTS DUE TO IMPROPER SWITCH SETTINGS (Issued to all holders of nuclear power reactor operating licenses or construction permits)

Information Date Notice Issued Title 85-86 11/5/85 LIGHTNING STRIKES AT NUCLEAR POWER GENERATING STATIONS (Issued to all nuclear power reactor facilities holding an operating license or construction permit) 85-87 11/18/85 HAZARDS OF INERTING ATMOSPHERES (Issued to all nuclear power reactor facilities holding an operating license or construction permit, and fuel facilities) 85-88 11/18/85 LICENSEE CONTROL OF CONTRACTED SERVICES PROVIDING TRAINING (Issued to all nuclear power facilities holding an operating license or construction permit) 35

^

o

Information Date Notice Issued Title 85-89 11/19/85 POTENTIAL LOSS OF SOLID-STATE INSTRUMENTATION FOLLOWING FAILURE OF CONTROL ROOM COOLING (Issued to all nuclear power reactor facilities holding an operating license or ct,nstruction permit) 85-90 11/19/85 USE OF SEALING COMP 0UNDS IN AN OPERATING SYSTEM (Issued to all nuclear power reactor facilities holding an operating license or construction permit) 85-58 11/19/85 FAILURES OF GENERAL ELECTRIC TYPE AK-2-25 REACTOR TRIP Suppl. 1 BREAKER (Issued to all reactor facilities designed by Babcock & Wilcox and Combustion Engineering, holding an operating license or construction permit) 85-91 11/27/85 LOAD SEQUENCERS FOR EMERGENCY DIESEL GENERATORS (Issued to all nuclear power reactor facilities holding an operating license or construction permit) 85-92 12/2/85 SURVEYS OF WASTES BEFORE DISPOSAL FROM NUCLEAR REACTOR FACILITIES (Issued to all production and utilization facilities, including nuclear power reactors and research and test reactors, holding an operating license or construction permit) 85-93 12/6/85 WESTINGHOUSE TYPE DS CIRCUIT BREAKERS, P0TENTIAL FAILURE OF ELECTRIC CLOSING FEATURE BECAUSE OF BROKEN SPRING RELEASE LATCH LEVER (Issued to all nuclear power reactor facilities holding an operating license or construction permit) 85-94 12/13/85 POTENTIAL FOR LOSS OF MINIMUM FLOW PATHS LEADING TO ECCS PUMP DAMAGE DURING A LOCA (Issued to all nuclear power reactor facilities holding an operating license or construction permit) 85-95 12/23/85 LEAK 0F REACTOR WATER TO REACTOR BUILDING CAUSED BY SCRAM SOLEN 0ID VALVE PROBLEMS (Issued to all boiling water reactor facilities holding an operating license or construction permit) 85-96 12/23/85 TEMPORARY STRAINERS LEFT INSTALLED IN PUMP SUCTION PIPING (Issued to all nuclear power reactor facilities holding an operating license or construction permit) 85-97 12/26/85 JAIL TERM FOR FORMER CONTRACTOR EMPLOYEE WHO INTENTIONALLY FALSIFIED WELDING INSPECTION RECORDS (Issued to all nuclear power reactor facilities holding an operating license or construction permit) 36 o

_s.

Information Date Netice Issued Title 85-98 12/26/85 MISSING JUMPERS FROM WESTINGHOUSE REACTOR PROTECTION SYSTEM CARDS FOR THE OVER-POWER DELTA TEMPERATURE TRIP FUNCTION (Issued to all Westinghouse-designed i

pressurized water reactor facilities holding an operating license or construction permit) 85-99 12/31/85 CRACKING IN BOILING WATER REACTOR MARK I AND HARK II CONTAINMENTS CAUSED BY FAILURE OF THE INERTING SYSTEM (Issued to all boiling water reactor facilities having a Mark I or Mark II containment)85-100 12/31/85 ROSEM0UNT DIFFERENTIAL PRESSURE TRANSMITTER ZERO POINT SHIFT (Issued to all nuclear power reactor facilities holding an operating license or r

construction permit)

L 85-101 12/31/85 APPLICABILITY OF 10 CFR 21 TO CONSULTING FIRMS PROVIDING TRAINING (Issued to all nuclear power facilities holding an operating license or construction permit) b 37 o

u

3.3 Case Studies and Engineering Evaluations Issued in November-December 1985 The Office for Analysis and Evaluation of Operational Data (AE00) has as a primary responsibility the task of reviewing the operational experience reported by NRC nuclear power plant licensees.

As part of fulfilling this task, it selects events of apparent safety interest for further review as either an engineering evaluation or a case study.

An engineering evaluation is usually an immediate, general assessment to determine whether or not a more detailed protracted case study is needed.

The results are generally short reports, and the effort involved usually is a few staffweeks of investigative time.

Case studies are in-depth investigations of apparently significant events or situations.

They involve several staffmonths of engineering effort, and result in a formal report identifying the specific safety problems (actual or potential) illustrated by the event and recommending actions to improve safety and prevent recurrence of the event.

Before issuance, this report is sent for peer review and comment to at least the applicable utility and appropriate NRC offices.

These AE0D reports are made available for information purposes and do not impose any requirements on licensees.

The findings and recommendations contained in these reports are provided in support of other ongoing NRC activities concerning the operational events (s) discussed, and do not represent the position or require-ments of the responsible NRC program office.

Case Date Study Issued Title C502 9/85 OVERPRESSURIZATION OF EMERGENCY CORE COOLING SYSTEMS IN BOILING WATER REACTORS This report presented the results of a generic re-view and evaluation of operational events involving actual and potential overpressurization of emergency core cooling systems in boiling water reactors.

Eight events; each entailing the failure of a test-able isolation check valve on the injection'line of an emergency core cooling system, were identified and evaluated.

Five of the eight events involved an additional failure of the second and final isolation barrier--the inadvertent opening of a normally closed motor-operated injection valve.

Four of these five events occurred during power operation, thus leading to an actual overpressurization of an emergency core cooling system.

Each of these opera',ional. events is considered a precursor to an interfacing loss-of-coolant accident between the reactor coolant system and an emergency core cooling system.

Such an acci-dent would involve the sudden discharge of reactor coolant at operating pressure and temperature out-side the primary containment, and would also likely disable one or more of the safety systems required to mitigate the accident.

Collectively, these 38 l

A

Case Date Study Issued Title C502 (cont'd) operating events indicate a trend which has serious safety implications--that the likelihood of an inter-facing loss-of-coolant accident is higher.

C503 12/85 DECAY HEAT REMOVAL PROBLEMS AT U.S. PRESSURIZED WATER REACTORS This report analyzed U.S. pressurized water reactor (PWR) experience involving loss of operating decay heat removal (DHR) systems.

Between 1976 and 1983, 130 loss-of-DHR events were reported to have occurred during approximately 500 reactor years of operation.

Total loss of the DHR systems under certain condi-tions could lead to core uncovery, and resultant.

fuel damage.

The results of scoping analyses of total loss-of-DHR scenarios presented in this study indicate that for,certain postulated events, unless timely corrective actions are taken, core uncovery could result in from 1 to 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months .

To date, no serious damage has resulted from the loss-of-DHR sys-tem events that have occurred at U.S. PWRs.

However,

-l many of the events which have occurred thus far may serve as important precursors to more serious events.

AE0D's analysis of operating data indicates that the underl ing or root causes of most of the loss-of-DHR system events are human factors deficiencies involv-ing procedural inadequacies and personnel error.

Most of the errors were committed during maintenance, testing, and repair operations.

The leading category o' loss-of-DHR events (37 of 130) was the automatic closure of the suction / isolation valves, most of which resulted from human errors.

This report makes several recommendations based upon the potential safety significance of loss-of-DHR events.

Implementation of those recommendations should significantly improve DHR system reliability and availability. The recommendations include:

im-proving human factors by upgrading coordination, planning, and administrative control of surveillance, maintenance, and testing operations which are per-formed during shutdown; providing operator aids to assist in determining time available for DHR recovery and to assist operators in trending parameters during loss-of-DHR events; upgrading the training and quali-fication requirements for operations and maintenance 39

Case Date Study Issued Title l

C503 (cont'd) staff; requiring the use of reliable, well-analyzed methods for measuring reactor vessel level during I

shutdown modes; modifying plant design to remove auto-closure interlocks and/or power to the DHR suction /

isolation valves during periods which do not require valve motion; and clarifying plant technical speci-fications to eliminate ambiguities associated with operating mode definitions.

The report acknowledges the NRC's ongoing efforts to address shutdown decay heat removal requirements (Unresolved Safety Issue A-45).

The AE00 recommen-dations are applicable to A-45, and should be con-sidered in the resolution of this generic issue.

C504 12/85 LOSS OF SAFETY SYSTEM FUNCTION EVENTS This study discusses events resulting in a total loss of safety system function (LSSF).

Although the study identifies 133 losses of safety system function in the 1981 to June 1984 time period, the major focus of the analysis is on 87 events (65% of the total) that were the result of human factors contributions (personnel errors).

The objectives of the study were to determine the frequency of this I

type of event, whether or not these events are occurring more at one plant than another, and the causes of such events.

Over the time period of the study, about 0.5 LSSF events were reported per year of reactor operation.

The study found that between 1981 and June 1984, no significant trends were observed in this rate of occurrence of LSSF events.

This indicates that improvement is not being made, on an industry-wide basis, in preventing loss of safety system events.

The study also found that licensed operators, non-licensed operators, and other personnel (technicians and maintenance personnel) were responsible for roughly equal numbers of errors leading to LSSF events.

This is evidence that it is necessary that licensees establish programs to ensure all types of personnel are well qualified and trained.

It was anticipated prior to the study that by exam-ining data on the length of time the system was not available and the method of discovery, it might be possible to determine the most effective methods to identify unavailable or degraded safety systems, to 40

I Case Date Study Issued Title C504 (cont'd) avoid total system losses, and to ensure quick re-covery in the event of a loss.

However, this was not possible because licensee event reports (LERs) fre-quently included no explicit statement of how an event or off-normal condition was discovered.

The report includes a number of recommendations

{

based on the results of the study, including feeding back the results of this study to industry; review-ing training and qualification programs to ensure that adequate attention is paid to the programs for personnel other than licensed operators; performing further technical evaluations of three particular types of LSSF events; monitoring the quality of g

human factors data in LERs to ensure licensees are 3

meeting the intent of 10 CFR 50.73 requirements regarding completeness; and collecting LSSF event data on a continuing basis and evaluate the data to determine whether LSSF events are a meaningful indicator of licensee performance.

C505 12/85 THERAPY MISADMINISTRATIONS REPORTED TO THE NRC As a result of a number of serious misadministrations involving radiation therapy in the 1970s, and to assure the complete and consistent reporting of such events, the NRC promulgated regulations effective November 10, 1980, requiring the reporting by its licensees of diagnostic and therapy misadministra-tions involving nuclear medicine studies or radia-tion therapy.

There are approximately 400 NRC licen-sees authorized to perform teletherapy treatment, 600 authorized to perform brachytherapy treatment, and 600 authorized to perform radiopharmaceutical therapy treatment.

The Commission's purpose in requiring the submittal of misadministration. reports to the NRC is to verify that their causes are properly identified and that licensees implement appropriate corrective actions to prevent recurrence.

If potential generic problems are identified, the Commission notifies other licen-sees of the generic problem or concerns and assesses the need for additional actions, e.g., changes in regulations to reduce the occurrence of similar and perhaps more serious events.

From November 1980 through July 1984, NRC licensees reported 27 therapy misadministrations, or about 41

Case Date Study Issued Title C505 (cont'd) eight per year.

Sixteen of the therapy misadministra-tions involved teletherapy treatment, five involved brachytherapy treatment, and six involved radiophar-maceutical therapy treatment.

This case study is a detailed review of the 16 teletherapy misadministrations and two brachytherapy misadministrations reported; the remaining nine events (three brachytherapy events and six radio-pharmaceutical events) involved procedural problems, equipment problems, or failure of licensees to follow NRC requirements.

Because of the specific nature of these nine misadministrations, they were not analyzed as part of this study and no recommenda-tions regarding them were provided.

All nine events are, however, discussed in Appendix B of the study.

Some findings of the study are:

- Of the 16 teletherapy misadministrations reviewed in this study, 12 could have been prevented by improved patient chart reviews or in most cases by independent verification of patient dose calculations.

- Adverse patient reactions were factors in prompting licensee personnel to review treatment plans in only three of the misad:ninistration cases, despite the fact that in at least six cases treat-ment fractions exceeded the prescribed fractions by over 50%.

- Many facilities may not have quality assurance programs that are consistent with recommendations of medical professional groups involved with radiation therapy.

The recommendations in this report included communicating the information in this report to the affected licensees, and establishing a comprehensive quality assurance program for radiotherapy facilities.

Engineering Date Evaluation Issued Title E515 12/11/85 INADVERTENT ACTUATION OF SAFETY SYSTEM DUE T0

" CROSS-TALK" In the screening of licensee event reports (LERs),

LER 50-305/85-001 was identified as a contributing event which required follow-up action.

The follow-up 42

Engineering Date Evaluation Issued Title E515 (cont'd) action recommended was to conduct a search for simi-lar events to see if the problem that caused the event is a generic problem.

The event occurred at the Kewaunee Nuclear Power Plant on January 22, 1985, and involved the inadvertent actuation of the unit's internal containment spray system (ICS).

The event occurred during normal full power operation while engineered safeguards (ES) surveillance testing was in progress.

The suspected cause of the event was the actuation of the high-high containment pressure bistable during testing of the high containment pres-sure logic.

This interaction between the high and high-high containment pressure bistables is referred to as " cross-talk."

A search of the Sequence Coding and Search System for events involving " cross-talk" did not find any event so identified. Therefore, a different strategy to identify events involving unintentional trips /

scrams and inadvertent safety system actuations during maintenance or testing while the reactor was operating at power was employed.

Eighty-nine LERs were obtained.

A review of the abstracts of these reports identified ten events which could be consid-ered to be due to cross-talk-like interaction.

Examples of such interaction events are those involv-ing voltage spikes, electromagnetic interference (EMI), and noise induced signals.

The failure mode experienced at Kewaunee was not seen in these ten reports.

Based on the review of the event at Kewaunee and the other events in the selected LERs, and on the corresponding corrective actions taken by the licensees, this report concluded that the problem of induced signals due to voltage spikes, EMI, noise, and other cross-talk caused by testing and maintenance activities is not a serious generic problem.

It is seen that, at those plants where j

such a problem has caused repeated inadvertent safety system actuations, the licensees have taken adequate corrective actions to reduce such incidents.

43

3.4 Generic Letters Issued in November-December 1985 Generic letters are issued by the Office of Nuclear Reactor Regulation, Division of Licensing.

They are similar to IE Bulletins (see Section 3.2) in that they transmit information to, and obtain information from, reactor licen-sees, applicants, and/or equipment suppliers regarding matters of safety, safe-guards, or environmental significance.

During November and December 1985, one letter was issued.

Generic letters'usually either (1) provide information thought to be important in assuring continued safe operation of facilities, or (2) request information on a specific schedule that would enable regulatory decisions to be made regarding the continued safe operation of facilities.

They have been a significant means of communicating with licensees on a number of important issues, the resolutions of which have contributed to improved quality of design and operation.

Generic Date Letter Issued Title 85-20 11/8/85 RESOLUTION OF GENERIC ISSUE 69:

HIGH PRESSURE INJECTION /MAKE-UP N0ZZLE CRACKING IN BABC0CK AND WILC0X PLANTS (Issued to all licensees with Babcock and Wilcox operating reactors) 44

3.5 Operating Reactor Event Memoranda Issued in November-December 1985 The Director, Division of Licensing, Office of Nuclear Reactor Regulation (NRR), disseminated information to the directors of the other divisions and program offices within NRR via the operating reactor event memorandum (OREM) system.

The OREM documents a statement of the problem, background information, the safety significance, and short and long term actions (taken and planned).

Copies of OREMs are also sent to the Offices for Analysis and Evaluation of Operational Data, and of Inspection and Enforcement for their information.

No OREMs were issued during November-December 1985.

=

L 45

3.6 NRC Document Compilations The Office of Administration issues two publications that list documents made publicly available.

The quarterly Regulatory and Technical Reports (NUREG-0304) compiles biblio-graphic data and abstracts for the formal regulatory and technical reports issued by the NRC Staff and its contractors.

The monthly Title List of Documents Made Publicly Available (NUREG-0540) contains descriptions of information received and generated by the NRC.

This information includes (1) docketed material associated with civilian nuclear power plants and other uses of radioactive materials, and (2) non-docketed material received and generated by NRC pertinent to its role as a regulatory agency.

This series of documents is indexed by Personal Author, Corporate Source, and Report Number.

The monthly Licensee Event Report (LER) Compilation (NUREG/CR-2000) might also be useful for those interested in operational experience.

This document con-tains Licensee Event Report (LER) operational information that was processed into the LER data file of the Nuclear Safety Information Center at Oak Ridge during the monthly period identified on the cover of the document.

The LER summaries in this report are arranged alphabetically by facility name and then chronologically by event date for each facility.

Component, system, keyword, and component vendor indexes follow the summaries.

Copies and subscriptions of these three documents are available from the Super-intendent of Documents, U.S. Government Printing Office, P.O. Box 37082, Washington, DC 20013-7982.

46

UNITED STATES

,,,,, eta,,,ag NUCLEAR REGULATORY COMMISSIOR5 posrace e reis emo WASHINGTON, D.C. 20555 wfs*w""* c.

PERMIT No. O 67 OFFICIAL BUSINESS PENALTY FOR PRIVATE USE. $300 120555078877 1 1 A F.1N411M11 s1 US f.R C ADM-DIV 0F TICC POLICY & FUB MGT bR-POR NUREG k-501 LASHINGTC-N DC 20555 l

l

_. _ _

ML20203B081

Text

Navigation menu

Search