ML20237E032

Power Reactor EVENTS.March-April 1987

ML20237E032
Person / Time
Issue date:	12/31/1987
From:	NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
References
NUREG-BR-0051, NUREG-BR-0051-V09-N2, NUREG-BR-51, NUREG-BR-51-V9-N2, NUDOCS 8712280101
Download: ML20237E032 (44)

Text

{{#Wiki_filter:_ _ _ _ _ _ _ _ _ _ _ ,iv, NUREC/BR-0051 'v Vol. 9, No. 2 Ly f. / United States Nuclear Regulatory Co REACTO1 EVE NTS , s ( s., Date Published: December 1987 Power Reactor Events is a bi-monthly newsletter that compiles operating experience information about commercial nuclear power plants. This includes summaries of noteworthy events and listings and!or abstracts of USNRC and other documents that discuss safety-related or possible generic issues. It is intended to feed back some of the lessons learned from operational experience to the various plant personnel, i e, managers. licensed reactor operators, training coor. dinators, and support personnel. Referenced documents are available from the USNRC Public Document Room at1717 H Street. Washington, D C. 2055s for a copying fee. Subscriptions of Power Reactor Events may be requested from the Supenntendent of Documents. U.S. Covernment Printing Office, Washington, D C. 20402. or on (202) 783-3238. Table of Contents Page 1.0 SUMMARIES OF E VENTS.... I 1.1 Instrumentation Pdrt Column Assembly Leakage at Turkey Point Unit 4.. 1 1.2 Emergency Diesel Generator Wiring Problems Resulting from Error in Plant Change Modification at Turkey Point Units 3 and 4.. 5 1.3 Loss of Main Condenser Vacuum Due to Steam Line Break at Perry Unit 1.. 9 1.4 Update. Feedwater Line Break Due to Severe Pipe Wall Thinning Causes Fatalities at Surry Unit 1.. 10 1.5 References... 12 2.0 EXCERPTS OF SELECTED LICENSEE EVENT REPOR TS... 13 3.0 ABSTRACTS / LISTINGS OF OTHER NRC OPERA TING EXPERIENCE DOCUMENTS 25 3.1 Abnormal Occurrence Reports (NUREG-0090).. 25 3.2 Bulletins and Information Notices... 27 3.3 Case Studies and Engineering Evaluations.... 29 3.4 Generic Letters..... 41 3.5 Operating Rextor Event Memoranda.. 42 3.6 NRC Document Compilations......... 43 8712280101 871231 QR-OO PDR Office for Analysis and Evaluation of Operational Data Period Covered: March-April 1987 U.S. Nuclear Regulatory Commission Washington, D.C. 20555

1. 0 SUMMARIES OF EVENTS 1.1 Instrumentation Port Column Assembly Leakage at Turkey Point Unit 4 On Mart.h 13, 1987, during an inspection of the Turkey Point Unit 4* reactor pressure vessel (RPV) head area, the licensee found that a significant amount of boric acid crystals had been deposited on the reactor vessel head due to a leak in the lower seal (conoseal) of a thermocouple instrumentation port column assembly.

(See Figure 1.) Two comprehensive reports have been issued concern-ing this finding. One is the licensee's " Report on Instrumentation Port Column Assembly Leakage" (Ref. 1), issued April 27, 1987. The other is the May 15, 1987 NRC report (Ref. 2) compiled by the Augmented Inspection Team sent from the NRC's Region II Office to review circumstances associated with the problem. Both reports identify the components which have been affected by the conoseal leak and the potential leakage mechanisms, and discuss the licensee's correc-tive actions. The reports are summarized below. The affected lower conoseal joint consists of a stainless steel conoseal gasket between stainless steel male and female flanges. The flanges are held in place by a carbon-steel clamp. This design has been used at Turkey Point since it first began operation and has also been used on other Westinghouse nuclear plants. The leak in the conoseal was first identified in August 1986 as a result of a pre-critical containment walkdown by maintenance personnel. The maintenance superintendent subsequently described the leak as a " wisp of steam." Engineer-ing evaluated the leak and determined that operation with the leak would be acceptable based upon factors such as the small amount of the leak, a low potential for an increase in the leak, the predicted rate of corrosion of the clamp, daily monitoring of the reactor coolant leak rate during operation, and performance of another inspection of the conoseal leak within 6 months. Accord-ingly, Unit 4 was restarted in August 1986. In October 1986, another inspection of the conoseal leak was performed during a short outage. The leak rate did not appear to be greater than observed in August, and no significant corrosion or pitting of the clamp was found. How-ever, a relatively small amount of boric acid crystals was found at the cono-seal and adjacent areas. Based upon the results of this inspection and the August 1986 evaluation, licensee Engineering determined in February 1987 that Unit 4 could be operated until April 1987 without another inspection of the conoseal leakage. During another outage, on March 13, 1987 the licensee learned that the actual corrosion rates may be greater than those used in the August 1986 evaluation. The licensee brought the unit to cold shutdown and per-formed another inspection of the conoseal leak and found a significant amount

• Turkey Point Unit 4 is a 666 MWe (net maximum dependable capacity) Westinghouse PWR located 25 miles south of Miami, Florida, and is operated by Florida Power and Light.

1

I i q.i t t t i t l t: 6 t 3e 3 4 1 l \\ k5 1 a s 1,e fy 8 u t _It 4(

g r.

c, a II 'r h ze 8 ' jj ag 1 a j Ia j Mg i 8 j (i[) \\ a tw' E 4 i;o 6 's p =s 3 1 g,n g g j 1 :$ g sg {x ti ,s g i g 9 \\ \\ u l t

3 ,q ~ ~ l' i 4 (about 500 lbs) of boric acid crystals on ths reactor vessel head area. w.nty-eight of the 58 reactor vesuj,hmd studs were affected by thd ' boric acid uak; eight of the studs were' encrouted,'with "three ' showing thread damage. After discovery of the boric acid crpdals on' the reactor head area in March 1987, the licensee performed extensive inspections to identify the extent of the items which were in contact gith boric acid deposits. These included'in-i spections of items in the area of the reactor vessel head, walkdowns and-analy-sis of equipnant in containment which was environmentally qualified urdr,, l 10 CFR 50.49, and a more general walkdown of ehuipme.nt in the containmed to' > ,9 identify any other items whick may have been affected by the conoseal leakhDe. Following these walkdowns and inspections the licensee took several actions for those items which had evidence of boric acid depositon. In general, these. actions consisted of notiAq the conditions of items; cleaning the items which had boric acid deposits;_ performing visual inspections and non-destructive examinations (NDE), as appropriate for the cleaned items, evaluating the re 3 dults of the inspection and NDE; and repairing or replacing items as warrant.ed. The equipment addressed during these walkdowns and inspections included: Reactor vessel head come, flange and' penetrations 'i Reactorvesselheadstuds, nuts <Ndwashers Reactor vessel flange, flange side and stud holes Acnulus region, ractor vessel shell, insulation, nozzles and nozzle supports Thermocouple column assembly and conoses) Control rod drive mechanisms (CRDMs) and' rod position indicators (RPIs), electrical ccnnectors, cables and instrument / control equipment in locality of leak CRDM coolers 1 CRDM vent shroud support assembly ) i Reactor vessel head insulation l Equipment qualified under 10 CFR 50.49 Other equipment in containment 1 In summary, the licensee perforwi an extensive inspection to identify compo-nents which could have been affected by the boric acid from the conoseal leak-age, and either replaced the affected omponents or determined that they are acceptable for use. The licensee, aided by technical consultants including the original reactor vessel manufacturer, nuclear steam system supplier, and plant architect engi-neer, evaluated the as-found con?ition of the plant to determine whether either the reactor coolant system pressure boundary or the operability of equipment 3

---

J

and components required for safe shutdown had been degraded beyond their design bases as a result of the leakage from the conoseal. It. was concluded that at no time was the unit in an unsafe condition because of the conoseal leakage. The licensee also analyzed the potential safety consequences if the leak had not been detected and had continued until the next Unit 4 refueling outage in March 1988. This analysis concluded that the limiting component failure due to corrosion is the conoseal carbon steel clamp (specifically, the closure bolt on the clamp). Such a failure would cause leakage in excess of technical speci-fication limits, which thereby would require operator corrective action before significant wastage could occur on the vessel head or adjacent components. Thus, operation of the unit until March 1988 would not have resulted in a condi-l tion beyond the design basis of the unit. The licensee also performed an investigation to identify the potential leakage I mechanisms associated with the conoseal leakage. As a result of these inspec-tions, it was determined that the clamp shim and the conoseal gasket had signi-ficant damage and may have been associated with the conoseal leak mechanism. i Based upon this information, it was determined that the two most likely poten-tial leakage mechanisms were corrosion of the shim due to unidentified leakage from an external source and debris or imperfections in the conoseal; however, the existence of either or both of these potential leakage mechanisms could not be confirmed. In any case, once the lower conoseal leak initiated, it was probably exacerbated by corrosion wastage of the clamp and shim. The licensee is taking actions to address these and other mechanisms, including (1) changing procedures and training of maintenance and inspection personnel; and (2) modi-fying the thermocouple column assembly to provide for, among other things, the use of iron based superalloy clamps which do not use shims and which are not subject to any significant corrosion by boric acid. These steps will help prevent recurrence of leakage of the conoseal. NRC investigation (Ref. 2) into the event determined that the failure of the conoseal appears to have been the result of a series of problems, dating back to 1972, which were unchallenged until the cumulative effect resulted in the problem discovered in March 1987. The series of problems can be summarized as follows: (1) 1972 - The original conoseal clamps were found to be in nonconformance. Westinghouse (the nuclear steam system supplier) authorized installation with stainless steel shims until new clamps could be received. (2) 1972 to 1985 - Nonconforming conoseal clamps apparently continue to be installed without controls on the shims; in fact, the installation proce-dure does not mention shims. (3) 1984 - A carbon steal shim was fabricated by licensee Maintenance Personnel without instructions and was re-used in March 1986, which was the last assembly before the conoseal leak in question. (4) March 1985 - The nonconforming conoseal clamps were still in use, but their i installation procedure was revised to include a step for installing the i shim. 4

(5) November 1985 - The Unit 4 procedure was revised to change the installation sequence so that the conoseal clamp is torqued after release of the 6000 psi preload used to seat the lower seal. (6) August 1986 - A Safety Evaluation for the conoseal did not account for the fact that a shim of unknown material was a part of the clamping arrangement, and that corrosion (wastage) of this shim could further relax the flanged joint and increase the leak rate. The problems described above occurred because of a flawed program that allowed weaknesses in the preparation of and adherence to procedures. This conclusion is supported by the following facts: (1) The conoseal clamps were installed from 1972 to 1985 without any indication that licensee personnel thought it abnormal to have an extra part and an extra step in the assembly that were not described in the procedure. (2) In March 1985, the procedure was revised to include a step for installing the shim on the top of the male flange prior to installing the conoseal clamp, but there is no indication that any personnel in the entire review cycle asked why there was a part that did not appear on the parts list, did not' appear on any drawing, and did not appear in earlier revisions of the-procedure. J (3) In November 1985, the procedure sequence was changed to allow torquing of the conoseal clamp after relaxation of the installation preload in order j i to make it easier for mechanics to reach the clamp bolts with a torque 1 wrench and to reduce radiation exposure by eliminating one trip onto the head area for QC inspectors. There does not appear to have been any tech-nical review of the reduction in safety margin that the change would have 1 on the installation. (4) The carbon steel shim fabricated in 1984 by Maintenance Personnel without instructions, and re-used in March 1986, was the last assembly before.the conoseal leak in question. The licensee is taking steps to strengthen the detection and technical review processes associated with leaks. These steps will provide the added emphasis to leak detection, repair, and evaluations necessary to prevent recurrence of the type of problem which developed with the conoseal leakage. 1.2 Emergency Diesel Generator Wiring Problems Resulting From Error in Plant Change Modification at Turkey Point Units 3 and 4 On March 27, 1987, while Turkey Point Unit 3 was shut down for refueling and Unit 4*'was shut down due to the conoseal leak problem discussed in Section 1.1 j above, personnel from the Relay' Department were performing periodic testing to l verify the operability and correct calibration of' several of the B emergency i diesel generator (EDG) protective relays. The loss-of-field excitation relay-140

• Turkey Point Units 3 and 4 are each 666 MWe (net maximum dependable capacity) l Westinghouse PWRs located 25 miles south of Miami, Florida, and are operated by Florida Power and Light.

5 i l

was determined to be inoperable in that its activation did not cause the actua-tion of the generator lockout relay-86. Troubleshooting determined that a con-nection wiring diagram did not reflect the exact wiring of B EDG control panel 4C12. Missing from the drawing was a wire that should have connected relay-127/ 159 stud 11 to relay-151-A stud 1. The absence of the wire created an open cir-cuit and prevented operation of the loss-of-field excitation relay input to the B EDG lockout relay-86. Additionally, undervoltage relay-127 and overvoltage relay-159 were not operable. These two relays provided inputs to a control room annunciator designed to alert operators to abnormal voltage conditions. The loss-of-field excitation relay became disconnected in EDG panel 4C12 be-cause the actual routing of wires from point to point inside the panel did not I match connection diagram 5610-M-16-73/83-155, sheet 1 of 4. This drawing was used to develop Plant Change Modification (PCM) 83-155 which was implemented on May 7, 1986. The purpose of the PCM was to install isolation switches necessary to meet 10 CFR 50, Appendix R (fire protection alternate shutdown) requirements. Consequently, PCM 83-155 was developed incorrectly and the discrepancy could not be identified from the diagram. The error in the PCM caused the loss of field relay, the undervoltage relay, and the overvoltage relay to be disabled. Since the implementation of PCM 83-155 should not have affected these relays, a functional check of the relays had not been included in post modification testing and went unnoticed until the periodic relay test was next due. To determine whether the implementation of PCM 83-155 had inadvertently affected other relays, and since the PCM included work on wiring of the 3B electrical load sequencer, a 3B sequencer inspection was performed by the licensee. The inspection revealed two wiring problems affecting: (1) the operation of the 3B containment spray (CS) pump during a Unit 3 design basis accident (DBA); and (2) the automatic start of the Unit 4B and 4C intake cooling water (ICW) pumps and the 48 component cooling water (CCW) pump during a Unit 3 DBA. The DBA for Unit 3 or 4 assumes a loss-of-coolant accident (LOCA) on one unit in conjunction with a dual unit loss of offsite power (LOOP). The redundant de-sign of the engineered safety features (ESF) precludes loss of system function for the CS, CCW, and ICW systems due to any single failure such as the failure of a pump or the loss of either EDG. The wiring problems noted above are discussed in detail below: (1) Given a large break LOCA in conjunction with a LOOP, normal safeguards operation results in the 3A and 3B sequencers starting their respective CS pumps between 17 and 23 seconds after the start of the A and B EDGs. If the LOCA results from a smaller break, then elevated containment pressure may not exist when the sequencer reaches the 17-to 23-second period. Consequently, by design, the start of the CS pumps is enabled and will occur automatically when elevated containment pressure is detected. The wiring error affecting the operation of the 3B CS pump affected only the smaller break LOCA/ LOOP scenario. It altered the start logic of the 3B CS pump such that automatic start on elevated containment pressure achieved subsequent to the 23-second time period was precluded. The l remote manual start capability of the pump from the control room remained operable. No PCM has been identified affecting the circuit of concern. 6 1 1

The licensee continues to review maintenance records to determine when the wire was inadvertently disconnected. No maintenance, which would by design alter the CS wiring in the 3B sequencer, has been recently performed. This discrepancy resulted in a loss of redundancy in the CS system. If, during the accident of concern, the 3A CS pump failed or the A EDG failed, then all system function would be lost until a Control Room Oper-ator diagnosed the failure and manually started the 3B pump as required by the Emergency Operating Procedures. Previous ESF actuation testing did not identify the wiring discrepancy. The ESF testing performed by the licensee simulated a large break LOCA in conjunction with an immediate LOOP. Test signals provided an instantan-eous, simulated elevated containment pressure such that the 3B CS pump automatically started during the 17-to 23-second time period. Testing has not been performed to simulate the smaller break LOCA scenario. Thus, the automatic start circuitry subsequent to the sequencer complet-ing its timed start sequence has not been tested. (2) The additional wiring discrepancy, consisting of two jumpers which should not have remained in the circuitry, resulted in the 48 CCW pump, the 4B ICW pump and the 4C ICW pump being incapable of starting during a Unit 3 i DBA. Both automatic and manual remote (control room) start capability were disabled. The ICW and CCW wiring error occurred during the implementation of PCM 79-145 which was completed on May 13, 1984. This PCM modified the auto-matic power transfer circuit for motor control center D. The root cause of the error was that Process Sheet 84-019, which gave detailed instruc-tions to the craftsman making wiring changes, did not instruct the crafts-man to remove the two wires. Electrical Wiring Diagrams, from which the Process Sheets are developed, clearly indicated that the wires needed to be removed to provide proper circuit operation. This discrepancy resulted in a loss of redundancy in the ICW and CCW sys-tems. If, during a Unit 3 DBA (LOCA and dual unit LOOP), the 4A CCW pump and the 4C CCW pump, or the 4A ICW pump, or the A EDG failed, then all l Unit 4 ICW or CCW system function would be lost. l l Post-modification testing and periodic surveillance testing, although implemented as required, did not reveal the ICW and CCW wiring deficien-cies because, although testing duplicated a Unit 3 DBA, it did not simu-late a simultaneous LOOP on Unit 4. During testing, offsite power remained available and, as per design, the Unit 4 ICW and CCW pumps were not stripped and did not load on the EDGs. Consequently, no opportunity existed to test the 38 sequencer's ability to trip and reload the Unit 4 pumps. The licensee developed a dual unit LOOP test of the circuitry discussed in (2) above. On May 27, 1987, the first part of the test was conducted, with Unit 4 as the accident unit. Upon initiating a LOOP by opening switchyard breakers, the 4160 V busses stripped and the EDGs started as designed. The safety-related equipment was then sequenced on by the load sequencers. A discrepancy was noted 7

in that the 38 and 3D load centers did not sequence on after being stripped from the bus. The operators manually loaded them and continued with the test. After all the safety-related loads were verified to be energized, the operators man-ually initiated a safety injection using the Safety Injection Manual Pushbutton on Unit 4. Upon receiving a Safety Injection Actuation Signal (SIAS), the Units 3 and 4 component cooling water (CCW) and intake cooling water (ICW) pumps are designed to strip from the 4160 V bus. The operators noted a dis-crepancy in that the 48 CCW and 4B ICW pumps did not strip from the bus after the SIAS. The next step in the procedure is to verify that the following equipment loads onto the bus: safety injection pumps (3A, 3B, 4A, 4B); 4A and 4B residual heat removal (RHR) pumps; 4A and 4B CCW pumps; 4A and 4B ICW pumps; 4B and 4C emergency containment cooler fans; 4B and 4C emergency containment filters. The operators noted the following discrepancies: the 3B SI pump, the 4B SI pump, and the 4B RHR pump did not start; the 4C emergency containment cooler fan did not start (the 4A fan started instead); and the 3B and 48 battery chargers were locked out and could not be manually loaded onto the EDGs. The next step in the procedure directed the operators to verify that the non-accident unit (Unit 3 in this instance) CCW and ICW pumps sequenced back onto the bus. Another discrepancy was identified in that the 3B CCW pump and the 3B ICW pump did not sequence on after the SIAS. The test personnel decided to continue with the test and initiated a Hi and Hi-Hi containment pressure signal to verify that the containment spray pumps started and that the asso-ciated valves realigned to the emergency mode. This test of the containment i spray circuitry was successful. Test personnel decided to return Units 3 and I 4 to pre-test conditions and determine the root cause and corrective actions l for the discrepancies noted while performing the test. On May 28, 1987, the licensee's troubleshooting revealed that two separate wiring problems in the sequencers caused the discrepancies in the test. The first problem identified was in 4B sequencer located in Unit 4 4160 V B switch-gear room. Agastat relay 2ZI-4A was'found to have two leads rolled. The leads that are required to be connected to contact 2 were landed on contact 5 and the leads that go to contact 5 were landed at contact 2. The leads were deter-mined to have been wrongly connected while personnel were performing Agastat timer testing and maintenance on May 22, 1987. A second problem identified was in the 3B sequencer located in the Unit 3 4160 V B switchgear room. On Agastat relay 2ZI-3A, it was found that an uninsulated metal connector on a spare lug was touching a wire in the adjoining contact, which caused a short. As a result, the following components did not respond properly: The sequencing action on 3B did not restart after the SI on Unit 4, which caused the 3B CCW and ICW pumps to not restart. Battery chargers 3B and 4B were locked out and could not be manually loaded onto the emergency buses. Load centers 3B and 3D did not load onto the bus. The spare lug was turned so that it did not touch the wire on the adjoining contact. Licensee personnel stated that this wiring problem also occurred 8 _a

during the same time period as the 4B wiring problem discussed above (during performance of Agastat timer testing and maintenance). Licensee personnel stated that their initial review indicated that both wiring problems appeared to be personnel errors caused by contributing factors. Con-tributing to the 48 sequencer wiring problem was a similarity between permanent labeling on the wires and plant maintenance identification tags put on the wires, in that part of the permanent labeling may have been mistaken for the maintenance identification tag (which identifies the wire number). Contribut-ing to the 3B sequencer wiring problem was the "L" shape of the metal connector l on the spare lug, in that the wire on the adjoining. contact was connected such that it was allowed to touch the spare lug. Licensee personnel continued to-review the above wiring problems and current maintenance practices in order to develop appropriate corrective actions to reduce the likelihood of recurrence. (Refs. 3 and 4.) I 1.3 Loss of Main Condenser Vacuum Due to Steam Line Break at Perry Unit 1 On April 13, 1987, a manual fast reactor shutdown was conducted at Perry Unit 1* due to a loss of condenser vacuum and report of a steam leak in the 1 turbine building. The loss of condenser vacuum was due to a hole in a main steam drain manifold which feeds the high pressure condenser. The mani-fold fractured at the junction of a main turbine stop valve drain line header. The steam leak was from the drain line header which had dislodged from the manifold. The cause of the break is believed to be high frequency vibration due to extensive steam flashing and water particle impingement in the drain line header. The event is detailed below. i On April 13, at 6:15 p.m., the plant was in startup operation at.approximately 9% of rated thermal power. Control room operators noted a loss of condenser vacuum, and that condenser off gas flowrate was offscale high. Operators were sent to the turbine building to investigate the cause of the condenser vacuum 3 loss. Reactor power was reduced to 3% of rated, and both mechanical vacuum pumps were started. At 6:17 p.m., control room operators received a report of a steam leak in the turbine building and conducted a fast reactor shutdown by depressing the reactor protection system manual scram pushbuttons. The Main Steam Isolation Valves then were manually closed. At 6:50 p.m., Health Physics declared the turbine building an Airborne Activity Area. Operators reported the steam leak had been from a main steam drain line header at its junction - with a drain m6nifold, and that the steam leak had stopped. By 8:35 p.m., the turbine building radiation levels had returned to normal. The loss of condenser vacuum was due to a hole in a 24-inch main steam drain manifold which feeds the high pressure condenser. The manifold fractured at 1 the toe of the weld at the junction of a 3-inch main turbine stop valve "before seat" drain line header..The steam leak was from the drain line

• Perry Unit 1 is a 1205 MWe (design electrical rating) General Electric SWR located 7 miles northeast of Painesville, Ohio, and is operated by Cleveland Electric Illuminating.

The unit was in startup testing at the time of this event. 9

header which had dislodged from the manifold. The cause of this break is be-lieved to be high frequency vibration due to extensive steam flashing and high velocity water particle impingement in the drain line header. Vibration and cracking of the drain manifold at the junction of this and other drain lines had been experienced in the past. Previous corrective maintenance on this piping had also revealed erosion in the drain manifold. Each main turbine stop valve at Perry has a before seat drain line. This line provides drainage for the valve body and piping immediately upstream of the valve. Each drain 'line joins a drain line header which empties into a drain manifold on the high pressure condenser. Magnetic particle testing of at least six similar drain lines leading to the manifold revealed cracks in at least four other lines. To prevent recurrence, the high pressure drain manifold has been replaced with { a heavier wall manifold, and additional pipe restraints have been added to the manifold and drain lines. The 3-inch main turbine stop valve before seat i drain header was replaced with a 6-inch line downstream of a throttle valve to assure low velocity steam flow into the manifold. Additionally, an existing 1 6-inch drain line was reconfigure 180 degrees on the manifold to more evenly 4 distribute drain line flow forces. (Refs. 5 and 6.) c 1.4 Update - Feedwater Line Break Due to Severe Pipe Wall Thinning Causes Fatalities at Surry Unit 1 The following writeup has been excerpted from NRC Bulletin 87-01, " Thinning of Pipe Walls in Nuclear Power Plants," issued July 9, 1987. Although this bulle-tin does not provide findings that differ from those in the summary included 4 in Power Reactor Events, Vol. 9, No. 1, pp. 1-4, issued August 1987, it does i provide a completa listing of publicly available documents related to the December 1986 event at Surry. On December 9, 1986, Unit 2 at the Surry Power Station

• experienced a cata-strophic failure of a main feedwater pipe, which resulted in fatal injuries to four workers.

This event was reported in IE Information Notice (IN) 86-106, "Feedwater Line Break," on December 16, 1986; IN 86-106, Supplement 1, on 4 February 13, 1987; and IN 86-106, Supplement 2, on March 18, 1987. 'The licensee (Virginia Power) submitted Licensee Event Report (LER) 86-020-00 fcr Docket 50-281 on January 8, 1987; Revision 1, LER 86-020-01, on January 14, 1987; and Revision 2, LER 86-020-02, on March 31, 1987. A comprehensive report ~ entitled "Surry Unit 2 Reactor Trip and Feedwater Pipe Failure Report," was attached to the updated LER, Revisions 1 and 2. The findings of NRC's Augmented Inspection Team were issued on February 10, 1987, in IE Inspection Report Nos. 50-280/ 86-52 and 50-281/86-42. Also of interest may be NRC Information Notice 87-36, q "Significant Unexpected Erosion of Feedwater Lines," which describes problems discovered at the Trojan Plant. l )

• Surry Units 1 and 2 are each 781 MWe (net maximum dependable capacity)

Westinghouse PWRs located 17 miles northwest of Newport News, Virginia, and are operated by Virginia Power.

• • Trojan is a 1050 MWe (net maximum dependable capacity) Westinghouse PWR located 32 miles north of Portland, Oregon, and is operated by Portland General Electric.

10

Investigation of the accident and examination of data by the licensee, the NRC, and others led to the conclusion that failure of the piping was caused by erosion / corrosion of the carbon steel pipe wall. Although erosion / corrosion pipe failures have occurred in other carbon steel systems, particularly in small diameter piping in two phase systems and in water systems containing suspended solids, there have been few previously reported failures in large diameter systems containing high purity water. Consistent with general indus-try practice, the licensee did not have in place an inspection program for examining the thickness of the walls of feedwater and condensate piping. l Main feedwater systems, as well as other power conversion systems, are important I to safe operation. Failures of active components.in thest r.ystems (for l example, valves or pumps), or of passive components such as piping, can result in undesirable challenges to plant safety systems required for safe shutdown and accident mitigation. Failure of high-energy piping, such as feedwater l system piping, can result in complex challenges to operating staff and the I plant because of potential systems interactions of high-energy steam and water with other systems, such as electrical distribution, fire protection, and security systems. All licensees have either explicitly or implicitly com-mitted to maintain the functional capability of high-energy piping systems that are a part of the licensing basis for the facility. An important part of this commitment is that piping be maintained within allowable thickness values. l i 11

1.5 Reforences (1.1) 1. NRC Region II, Report on Instrumentation Port Column Assembly Leakage - Florida Power & Light Company, Turkey Point Unit 4, April 27,1987. 2. Florida Power and Light, Docket 50-521 " Report on Instrumentation j Port Column Assembly Leakage," April 27, 1987. (1,2) 3. NRC, Region II Inspection Report 50-250/87-14 and 50-251/87-14, May 20, 1987. i l 4. NRC, Region II-Inspection Report 50-250/87-26 and 50-251/87-26, June 30, 1987. j (1.3) 5. Cleveland flectric. Illuminating, Docket 50-440,. Licensee Event Report 87-27, May 8, 1987. i 6. NRC, Office of Nuclear Reactor Regulation, " Items of Interest"f for Weeks Ending April 24, 1967 and May 1, 1987. d These referenced documents are available in the NRC Public Document' Room'at 1717 H Street, N.W.,. Washington, DC 20555, for inspection and/or copying for a fee. (AE00 reports also may be obtained by contacting AE00 directly.at j 301-492-4484 or by letter to USNRC, AE00, EWS-263, Washington, DC 20555.) CORRECTIONS TO PREVIOUS ISSUE OF POWER REACTOR EVENTS l The corrections below apply to Vol. 9, No.1, Section 1.3, " Defective Steam -Generator Tubes Not Repaired Prior to Startup Due to Incorrect Final Review 1 Decision at Millstone Unit 2," p. 9. These' corrections are necessary because l of a recently noted discrepancy in the reference documents used to develop the writeup. The text that is hyphened through should be deleted,'and the. i text that is underlined should be added: Additionally, the hydrostatic testing of SG No.1 during the unit shutdown identified a leaking tube:at Line 25, Row 19. 1 Eddy current examination found a large volume indication' at i the top of the tubesheet, circumferential1y oriented and ex-tending about 2250 around the tube. -A-through-wa44-epen4ng-wa s - a ppr ox ima te ly-490- ef-t h 45 -e 4 pew mf e rense i-w 4 th - an -e s t 4 ma te d l 9,952-4neh-spen 4ng, Further licensee review found that the 1985 and 1986 outage eddy current examination program identified a 31% through-wall degradation of this tube. The licensee believes that stress corrosion has-been-4 dent 4F4ed-as-the-most j 44he4y is a potential cause of this failure, and that flow-induced vibration is another possible cause. l ) 1:4eensee-strwetural-analys4s-4 dent 4f 4ed-that-th4s-tube-4s-4n-a h4gh-stress-area 3-and-near-a-44e-red-support,--Th4s-tube The .i tube at Line 25, Row 19 was plugged, and-the five adjacent i tubes.were staked, and six adjacent tubes were plugged to ) prevent multi-tube failure from fretting and wear. 12 1

2.0 EXCERPTS OF SELECTED LICENSEE EVENT REPORTS On January 1, 1984, 10 CFR 50.73, " Licensee Event Report System," became effec-tive. This new rule, which made significant changes to the requirements for-licensee event reports (LERs), requires more detailed narrative descriptions of the reportable events. Many of these descriptions are well written, frank, and informative, and should be of interest to others involved with the feed-back of operational experience. This section of Power Reactor Events includes direct excepts from LERs. In general, the information describes conditions or events that are somewhat l unusual or complex, or that demonstrate a problem or condition that may not be I obvious. The plant name and docket number, the LER number, type of reactor, and nuclear steam supply system vendor are provided for each event. Further information may be obtained by contacting the Editor at 301-492-4493, or at ) U.S. Nuclear Regulatory Commission, EWS-263A, Washington, DC 20555. Excerpt Page 2.1 Non-Isolable Leak in the Reactor Coolant System Due to Construction Error Resulting from Misinterpretation of Modified Di ag ram a t Oconee Uni t 2......................................... 13 l 2.2 Improper Valve Lineup Results in Spraying of Borated Water in Containment Building at Calvert Cliffs Unit 1..................... 16 2.3 Apparent loss of Redundant Low Pressure Safety Injection Pumps Due to Breaker Problems at St. Lucie Unit 1....................... 17 2.4 Loss of Offsi w: Power Due to Procedural Inadequacy in a Modifi-cation, Which Caused the Isolation of the Normal and Reserve i Station Service Transformers at Shoreham Unit 1................... 18 l 2.5 Inadvertent Bumping of Power Supply Breaker Results in Backup Hydrogen Purge Isolation at Perry Unit 1.......................... 21 2.6 Manual Scram of Reactor Following Automatic Closure of Instrument Air Valves Due to Operator Error at Clinton....................... 22 2.1 Non-Isolable Leak in the Reactor Coolant System Due to Construction Error Resulting from Misinterpretation of Modified Diagram Oconee Unit 2; Docket 50-270; LER 87-03; Babcock & Wilcox PWR 13 a____________________-

On April 6, 1987, Oconee Unit 2 was taken off-line and brought to 240 degrees F and 170 psig to determine the efficiency of the decay heat coolers.* While at 240 degrees F and 170 psig, maintenance personnel entered the reactor building to measure for a pipe support. On April 8, 1987, personnel observed water j coming from a welded connection on the reactor vessel level instrumentation i system (RVLIS). Control room personnel were immediately notified of the situ-ation. It was concluded that this section of pipe could not be isolated, and an unusual event was declared. On April 9, 1987, the weld was successfully re-paired, and the unusual event was closed out. The RVLIS was installed on Unit 2 during its latest refueling outage. It is used by the operators to determine the level of water covering the core during accident conditions. One of the level transmitter taps is welded to the 12-inch decay heat system suction line where it comes off of the reactor coolant system (RCS). There are no isolation valves between the RCS and where this crack developed. The Oconee Pipe Specification, which references the ASME Pipe Specification, j Section XI IWA 7400, requires only visual inspection for welding done to pipes less than 1 inch outside diameter. In addition to the pipe specification, the reactor building is toured at operating system pressure to look for an. leaks prior to unit startup after an outage. l 1 In early 1986, the type drawings used for piping installations were changed i from piping drawings that showed full pipe diameters to one line drawings of l computerized isometrics showing only the centerline of the piping. No training concerning this change was given to any personnel associated with implementa-tion of modifications. l To expedite the RVLIS installation and reduce exposure to workers, part of the modification was prefabricated in the construction area. The pipe that cracked was welded to the coupling and an isolation valve for a level transmitter per the isometric drawing. The piping section was cut 6 inches longer than the isometric drawing had called for due to misinterpretation of the drawing dimen-sions by the pipe fitter. This piping section was welded to the decay heat system suction piping on September 11, 1986. The Quality Assurance Inspectors met all Section XI requirements by inspecting before and after weld.

However, they also misinterpreted the pipe length from the drawings.

During Unit 2 heatup on October 15, 1986, an inspection was made in the reactor building per procedures at normal operating pressure to ensure that any welds done during the recent refueling outage were not leaking. No leaks were visible. The root cause of the leak discovered on April 8, 1987, was determined to be a construction deficiency. The leak was due to a crack in the heat affected zone of the pipe to coupling weld of one of the RVLIS level transmitters. The

• At Oconee, these also serve as the low pressure injection coolers used for post loss-of-coolant accident (LOCA) decay heat removal.

The unit was shut down due to staff concerns regarding their efficiency (they were plugged with mud) in post-LOCA application. The same problem was identified at Unit 3. 14

pipe was approximately 1 inch in diameter with a minimum of.219 inch thick wall (Schedule 160). The crack propagated circumferential1y about 180 degrees around the pipe. The exact mode of failure of the level instrument pipe cannot be determined without removal and examination of the affected pipe section. However, it is likely that the failure of this pipe was due to a weakening of the pipe wall due to stress induced by natural frequency vibration. Vibration was induced because the extra length of pipe put the pipe section outside the seismic stress design basis. In addition, there were three contributing factors to this event. (1) Appropriate personnel were not given adequate training in determining pipe dimensions from the newly issued computerized isometric drawings. The personnel involved in this event had been trained on the job and were deemed qualified by management from prior performance. It is the respon-l sibility of Management to ensure that adequate training is given to all appropriate personnel when a program change goes into effect. l (2) The pipe fitter who measured and cut the pipe per the isometric drawing did not account for the radius of the connecting pipe, thereby making the l pipe section too long. I j (3) The possibility of a misinterpretation in the new computerized isometric drawings was created due to an effort to provide easy to read installation drawings and a lack of specific training. The coupling is shown on the ) isometric in such a way that if the centerline designation is overlooked, a wrong measurement could result. l After the reactor was brought to cold shutdown on April 8, 1987, the following corrective actions were taken: A weld overlay was placed on the section of pipe that was cracked. A stiffener was designed and attached to the section of pipe for added restraint. Vibration data was taken prior to installation of the restraint to l analyze the possible cause of the failure. 1 Similar taps in Unit 2 and the accessible tap in Unit I were inspected. l A dye penetrant test was performed on the repaired line. In addition, a Task Force was formed to resolve possible discrepancies following the change to computerized isometric drawings. Further planned corrective actions are for the Task Force to: Develop training for craft personnel, management, and all other parso.nnel who install modifications to interpret the correct dimensions of piping installation from isometric drawings. Incpect all modifications that were installed with isometric drawings that have the possibility of similar consequences. 15

Perform safety analyses and initiate changes to mo, deifications where appropriate. 2.2 Improper Valve Lineup Results in Spraying of Borated Water In Containment Building Calvert Cliffs Unit 1; Docket 50-317; LER 87-08; Combustion Engineering PWR On the morning of April 14, 1987, while Calvert Cliffs Unit 1 was in cold shut-down, the Control Room Operator instructed the Auxiliary Building Operator to line up the safety injection system to fill the safety injection tanks using the

1. 11 containment spray pump.

After partially completing the lineup.the Auxiliary Building Operator was relieved and the next watchstander completed the lineup. At 1:25 p.m., after being informed the lineup was completed, the Control Room Operator started the #11 containment spray pump to begin filling the tanks. After starting the pump the Control Roam Operator responded to'a telephone call, and immediately upon completion of that call received another call informing him that water was spraying into the containment building. The Control Rcom Operator immediately stopped the containment spray pump and sent the Auxiliary Building Operator to verify-the valve lineup. It was estimated that approximately 4,000 gallons of water from the radwaste tank was sprayed I into the containment building..The Auxiliary Building Operator' reported find the containment spray header manual isolation valve open, instead of shut as required by the procedure. The valve lineup was reverified and the tanks were filled without further incident. Investigation into this event revealed the following contributing factors: + The Auxiliary Building Operator performing the first portion of the valve lineup reported finding the containment spray header manual isolation valve tagged in the shut position. The fact that the header isolation was tagged shut was not questioned by the Control Room Operator because the containment spray header control valve was out of service for maintenance and he believed the manual isolation valve was tagged for this reason. The Containment Spray header control valve was tagged'dbenergized (fails open) but the manual isolation was not, in fact, tagged shut. The Auxiliary Building Operator mistakenly verified the, manual isolation valve for Unit 2, which was tagged shut, instead of Unit 1. The Auxiliary Building Operator performing the valve lineup was assigned to Unit 2 from 4:00 a.m. to 8:00 a.m. and reassigned to Unit'1 from 8:00 a.m. to 12:00 p.m., thus the resulting confusion between units. The water sprayed into the containment was drained.to, and processed by, the miscellaneous waste processing system. Containment building' equipment was assessed for any possible damage. In an effort to prevent recurrence of this event the follow 1,ng actions are being taken: 16

(1) Procedural changes have been implemented to require an independent verifi-cation of the Containment Spray header manual isolation valve position. (2) A Performance Improvement Report was written and issued as required read-ing for all operators. (3) The General Supervisor - Operations has issued instructions that operators should not be assigned to the same watchstation on opposite units during the same shift. (4) All operators are being made aware of this event. (5) An evaluation is being performed to detennine if color coding the buildings (e.g., painting the floors different colors) is feasible. (This event also was discussed in NRC Information Notice 87-25, "Potentially Significant Problems Resulting from Human Error Involving Wrong Unit, Wrong Train, or Wrong Component Events.") 2.3 Apparent. Loss of Redundant Low Pressure Safety Injection Pumps Due to Breaker Problems St. Lucie Unit 1; Docket 50-335; LER 87-08; Combustion Engineering PWR On April 1, 1987, St. Lucie Unit I was preparing to enter hot shutdown from hot standby (400 psia and 400"F). The reactor coolant system was being cooled down in preparation for repairs of the reactor vessel head inner "0" ring seal. At 2:11 a.m., the 1A low pressure safety injection (LPSI) pump was started to warm up the shutdown cooling piping prior to entry into hot shutdown. An attempt was made to start the 1B LPSI pump, but the pump failed to start. At 2:14 a.m., a report was received that the 1B LPSI pump suction side relief valve had lifted. The 1A LPSI pump was secured as a precautionary measure to prevent any possible damage to the pump. When the 1A LPSI pump was stopped, the pump breaker trip capability indication was lost so a restart was not attempted. A failure analy-sis completed several days later revealed that the breaker would have closed if a restart attempt had actually been made. An immediate investigation was performed by on-shift utility maintenance and licensed operator personnel. Both sets of control fuses on the 1A LPSI pump breaker were pulled and the holders were tightened. The breaker was racked out and back in again and the pump breaker trip capability indication returned in the control room. The 1A LPSI pump was restarted at 2:50 a.m., and was returned to service. The same sequence of operations were performed on the IB LPSI pump, and it was restarted and returned to service at 2:54 a.m. The plant proceeded to cold shutdown to perform the above mentioned maintenance. The probable root' cause of the event has been determined to be poor breaker auxiliary stab contact. If the breaker auxiliary stabs do not make proper con-tact, the pump may not start or proper control room indications may be lacking. Further investigation into the event is ongoing to verify that this was the actual root cause of the problem. Corrective actions included the following: 17

(1) 1he LPSI pump breaker control fuse holders were tightened and reinstalled. (The fuse holders are Westinghouse Model No. 347A062H03; the feeder breakers are Westinghouse Model No. 50DHP250.) Also, the breakers were racked out and back in to assure proper breaker auxiliary stab contact. (2) An investigation was performed on all fuse holders of non-running safety equipment, and visual verification was made of indicating lights on running safety equipment. Safety-related pumps on Unit 2 were demonstrated operable by starting. (3) Until the breaker evaluation is completed, an inspection will be made each shift to assure that proper indicating lights are observed. (4) A Quality Team was assigned to resolve the problem associated with the LPSI pump breakers. Guidelines for troubleshooting future problems of this type breaker are being established. A review of preventive maintenance for breakers is being performed with vendor support. In April 1987, these licensee actions were found acceptable by the NRC. 2.4 Loss of Offsite Power Due to Procedural Inadequacy in a Modification,, Which Caused the Isolation of the Normal and Reserve Station Service Transformers Shoreham Unit 1; Docket 50-322; LER 87-03; General Electric BWR On March 18,1987, at 1:46 a.m., a loss of offsite power (LOOP) was experienced coincident with the starting (bumping) of a condensate pump (1N21-P-007A). The plant was in the refueling mode at the time. Starting this pump resulted in the isolation of the normal station service transformer (NSST) due to the Phase C differential protection relay activation of the NSST primary protection lockout relay (86T3P). The subsequent fast transfer of NSST loads to the re-serve station service transformer (RSST) resulted in the isolation of the RSST due to Phase A, B, and C differential protection relays' activation of the RSST primary protection lockout relay (86T4P). The emergency diesel generators (EDGs 101 and 102) auto-started in response to the undervoltage condition and energized their associated buses (EDG loads were less than 1600 kW each). EDG 102 was in lockout for a maintenance and bus outage and therefore did not respond. As a result of the loss of power, a full reactor trip occurred, along with a nuclear steam supply shutoff system (NSSSS) isolation and the initiation and isolation of the following safety systems: reactor building standby ventilation system (RBSVS) initiation, control room air conditioning (CRAC) system initia-tion, reactor water cleanup (RWCU) isolation, reactor building closed loop cool-ing water (RBCLCW) system split and a reactor building service water (RBSW) split. There were no emergency core cooling system actuations. Control Room Operators carried out the steps of the Emergency Shutdown Procedure (SP 29.010.01) and the loss of offsite power emergency procedure (SP 29.015.01). Operators performed a field inspection of inplant switchgear and equipment to verify proper response to the event and to identify any damage or unusual condi-tions. No physical damage or unusual conditions were found.~ Following discus-sions with the Electric System Operator, the conclusion was that the incident 18

did not result from or affect offsite distribution. The condensate pump (N21-P-007A) breaker was locked out and the NSST and RSST primary protection lockout i l relays were reset. At 2:04 a.m., the RSST and NSST were reenergized and the 4.16 kV switchgears were powered from the RSST. Restoration of the NSST and RSST to their normal lineup occurred while the shorting pins that effectively altered the differential protection circuits were still in place. A repeat of the incident did not occur because the bus loads were shed during the event and only essential loads were placed on the buses after the transfer from EDG supply to normal power. At approximately 2:15 a.m., the Watch Engineer declared an Unusual Event and assumed the role of Emergency Director. The restoration of plant operating systems to their normal configuration (s) was performed. The root cause of the event was an inadequate description of a step that was required to be performed as part of a station modification. The following describes the investigation which took place that led to the determination of the root cause of the event. At about 5:30 a.m. on March 18, an investigation of the conditions which trig-gered the incident was initiated. This effort included meggering of the con-r densate pump motor, a functional checkout of the condensate pump trip circuit, ( and a checkout of the NSST and RSST differential circuits and associated re-lays. The condensate pump motor megger was satisfactory and its associated trip circuitry functioned correctly. By about 9:30 a.m., readings of the in-put signals to the NSST and RSST differential protection relays (BDD type re-lays) led to the identification of conditions that influenced the activation of the transformer differential protection circuits. These readings revealed r that the protective relaying differential circuits on the NSST and RSST trans-( formers had been biased as a result of jumpers installed on Bus 103 current transformers (cts) as a prerequisite for a modification (SM 86-064) which was in progress on the 4.16kV emergency switchgear bus 1R22*SWG-103. On February 24,1987, SM 86-064 had been initiated to modify the 4.16kV emer-gency switchgear bus 103 in preparation for the Colt Diesel Generator tie-in (1R43*G-903). On February 25, 1987, SM 86-064, prerequisite step 8.0.5 was completed. This prerequisite step installed shorting pins across all cubicle cts includir.g the differential circuit cts in switchgear 103 cubicles 103-1 (NSST feeder) and 103-2 (RSST feeder), circuits 1R62N01 and 1R62N04 respec-tively. This condition effectively short-circuited the CT output in 4.16kV switchgear cubicles 101-1,103-1,11-11, and 12-1 on the NSST dif ferential cir-cuit, and cubicles 101-2, 102-2, 11-1, 12-11 on the RSST differential circuit. With the cts in bus 11 short circuited, the bumping of the condensate pump (being powered from the NSST via 4.16kV bus #11), caused the NSST differential relays (circuit 1R62N07) to sense a differential current increase on the trans-former due to a current increase on the primary side without a corresponding change on the secondary side. This triggered an isolation of the NSST from its supply and loads by the activation of the NSST primary protection lockout relay 86T3P. The tripping of the NSST feeder breakers in switchgears 101, 102, 11 and 1A activated the fast transfer scheme to the RSST feeder breakers in the same switchgears. Since the RSST differential circuit was similarly affected by y this modification, the same result was experienced. The RSST differential relays, circuit 1R62N09, sensed a differential current increase on the 19

transformer, resulting from the additional load in switchgears 101, 102, 11 and 1A. The primary protection lockout relay 86T4P was activated, isolating the RSST from its supply and loads, resulting in a loss of offsite power. As a result of implementing this modification, both the NSST differential circuit 1R62N01 and the RSST differential circuit 1R62N04 had their secondary side cts shorted out from February 5, 1987 until March 18, 1987. The station load profile during this period apparently remained below the level required to activate the differential circuit relays on the NSST or RSST. I l Plant Management was notified that the cause of the loss of offsite power was a result of jumpers installed across the NSST and RSST differential circuit cts on Bus 103 per SM 86-064. The Colt Project Manager (CPM) and the Cogni-zant Site Engineer (CSE) stated that the condition resulted from the inclusion of a prerequisite step (8.0.5) in SM 86-064 that did not adequately describe the actions to be taken to short out the cts, or the interrelation between these cts and the affected electrical protection circuits. DOP (Design Output Package) 85-112, Section 8, called for a post work HIP 0T F test of the bus and also called for shorting CT secondaries as a prerequisite ( to the HIP 0T test. Neither the Station Modification nor the 00P made any cautionary mention of the effects of shorting the cts on the transformer dif-ferential circuits. It is also common practice, for personnel safety reasons when doing wiring within a cubicle (as was called for in this modification), to short the CT secondaries via the shorting blocks. G.E. drawing #0126D5170 (SWEC 1.41-75B-85113-091A) was referenced in the D0P and included in the Station Modification (SM) package. This drawing identifies the cts utilized for the transformer differential circuits. However, without required searching further the referenced circuit number on the drawing, it could not be known that the cts for the differential relays were paralleled with the cts on buses 101, 102, 11 and 12. The specific elementary diagram that shows this configuration of cts was neither referenced in the DOP nor the SM. The CSE stated that he was unaware that the bus 103 cts were paralleled with cts on the other buses. It was nis impression that Engineering's review ade-quately assured that bus 103 had been fully deenergized and isolated from the plant. Only the cts for the NSST and RSST differential circuits are configured to interact with the other buses. Subsequent evaluation revealed that since these cts are on the supply side of the incoming breakers (103-1, 103-2) they need not have been shorted as part of the HIP 0T prerequisite. Only Bus 103 was included in the HIP 0T boundary. This was not identified in either the D0P or the SM. The CSE indicated that he had thought these cts were on the bus side of the incoming breaker, within the HIPOT boundary, and therefore, did not question the direction given in the DOP. The following corrective actions were or will be taken as a result of the event: 20

(1) Jumpers were removed from differential circuit cts in cub. 103-1 and 103-2. (2) NSST and RSST differential circuits and relays were checked and setpoints verified to be in accordance with permanent plant configurations. (3) Condensate pump (IN21-P-007A) was meggered and tested satisfactory. Also, its supply breaker protective relaying was checked and the setpoint was verified to be in accordance with permanent plant configurations. (4) The importance of properly considering and identifying plant interfaces and configurations required by both Engineering and Modifications during the implementation of station modifications was emphasized to all Engi-neering personnel. In addition, it was noted that if specific plant con-figurations are called for by Engineering during implementation, the effects of this configuration on plant operation shall be included in Sec-tion 8.0 of the D0P. (5) " Station Modification Package Guidelines," Appendix 12.5 of SP 12.010.02 is utilized to provide the originator with guidelines concerning the pre-paration'of the Station Modification Implementation Package. This Appen-dix shall be revised into a formal technical review sheet including speci-fic signoffs for various attributes of the Station Modification Implemen-tation Package. (6) The incident report, which describes this event in detail, will become re-quired reading for all Modification, Colt Diesel Project, Maintenance, In-strument and Controls, Health Physics, Radiochemistry, Systems Engineer-ing, Operations and Relay, Meter, and Test personnel. 2.5 Inadvertent Bumping of Power Supply Breaker Results in Backup Hydrogen Purge Isolation Perry Unit 1; Docket 50-440; LER 87-20; General Electric BWR On March 16, 1987, at 9:14 p.m., the backup hydrogen purge inside contain-ment isolation valve unexpectedly isolated due to loss of power to de bus D-1-A. Additionally, at 9:20 p.m., the Shift Supervisor declared an ALERT per EPI-Al " Emergency Action Levels" due to the loss of power to Control Room panel annunciators (powered from D-1-A). At the time of the event, the plant was in power operation with reactor thermal power approximately 29% of rated. Reactor vessel pressure was about 930 psig and reactor cool-ant temperature was about 510 degrees F. A plant operator, qualified in the operation of electrical switchgear, was in the process of removing a tag-out from the D-1-A Bus. The operator dropped a racking tool impacting breaker DIA03 (main breaker to D-1-A). This resulted in breaker DIA03 opening and deenergizing D-1-A, at 9:14 p.m. All loads from this bus were lost. The control room was promptly notified that DIA03 was inadvertently opened. At 9:19 p.m., the Unit Supervisor directed the operator to close DIA03 to restore power to bus D-1-A. This returned power to the control room annunciator system. 21

When power was lost, two significant events occurred. First, power was lost to the protective relay logic components for the main generator trip. With this loss, 13.8kV nonsafety buses L11 and L12 automatically trans-ferred from the unit auxiliary transformer to the startup transformer. This auto bus transfer is a " fast" bus transfer (performed in less than nine cycles) and its actuation is expected for loss of the de power supply. During the transfer, the gaseous radiation level inside drywell monitor generated a short duration isolation signal for the backup hydrogen purge system. The signal duration was on the threshold of detection for valve logic. Therefore, only the inside containment isolation valve closed in response to the isolation signal. Operations personnel determined that the backup hydrogen purge system was no longer needed to support plant operations. Early on March 17, this system was verified secured via plant instructions. The second significant event on March 16 involved a loss of power to the control room annunciator system, resulting in the Shift Super-visor declaring an ALERT. All appropriate actions were taken by shift per-sonnel and the ALERT was terminated, at 9:54 p.m. Other nonsafety-related systems were affected due to the loss of the D-1-A bus and the subsequent transfer of L11 and L12 to the startup transformer. These included: the isolation of the off gas system, loss of reactor feed pump turbine "A" automatic control, trip of the reactor recirculation pump "A," loss of the turbine building chilled water chiller, containment ves-sel chilled water chiller, and the off gas hydrogen analyzer. Component and system response to the loss of power was per design. By 10:50 p.m. on March 16, all the affected nonsafety-related systems had been returned to operation per appropriate plant procedures. This resulted in restoring the plant to the conditions that existed prior to this event. To prevent recurrence of this event, the individual involved has been coun-seled regarding the need to exercise caution when working in the vicinity of energized switchgear to prevent personnel injury or 'nadvertent deener-gization. Additionally, an Engineering Design Change is being evaluated to provide a redundant power supply for the control room annunciator sys-tem. Investigation continues into the 01A03 breaker and M51 isolation logic operation. 2.6 Manual Scram of Reactor Following Automatic Closure of Instrument Air Valves Due to Operator Error Clinton; Docket 50-461; LER 87-17; General Electric BWR On March 22,1987, at 3:15 a.m. with the plant in startup operations (less than 1% reactor power, 450 psig), the Operations Department began perform-ing Surveillance Procedure 9030.010016, " Emergency Core Cooling System (ECCS) Reactor Water Level 1821-N691A(E,B,F) Channel Functional Checklist," for Division I. The Maintenance Control and Instrumentation (C&I) Depart-ment was supporting the surveillance by lifting the electrical leads as raquired by the surveillance procedure to preclude closure of the associ-ated instrument air (IA) isolation valves. The appropriate leads were lifted and verified for Division I. During performance of the surveil-lance, the Operator verified that valves IIA 005 and IIA 008 correctly re-mained open following insertion of the manual trip signal. 22

The surveillance was successfully completed on channel E and the self test system indicated the test signal cleared at 3:55 a.m. Between 3:55 a.m. and 4:10 a.m., the "8 Prime" operator walked from the backrow panels to the horseshoe area of the control room (CR) and instructed the "B" operator to depress and hold the Division 1 Level 1 isolation reset pushbutton. The "B Prime" operator then returned to the backrow panel and instructed the maintenance technician to reland the lifted lead for Division 1 Channel E. Once the lead was relanded, the "B Prime" operator returned to the horse-shoe area and told the "B" operator to release the reset pushbutton because the lead was relanded. Although not required, the "B Prime" operator then looked across the control room and observed that the posi-tion lights for valves IIA 005 and IIA 008 appeared to be red (open). This reset sequence is important because depressing the reset pushbutton re-moves a seal-in that would cause the valves to go shut. If the lifted lead contacts its terminal prior to the reset pushbutton being depressed, the valves would receive a signal to close. The operator began the same surveillance for Division 'II at 4:10 a.m. Ap-propriate leads had been lifted and a trip signal inserted when an opera-tor realized that rods were drifting inward. The operator placed the mode switch in SHUTDOWN, which manually scrammed the reactor at 4:15 a.m. Rods drifted because Division I valves 11A005 and IIA 008 had closed, cutting off instrument air to the scram pilot valve air header. When IA pressure is lost to the scram pilot valve air header, the scram valves begin to drift open as the IA pressure decreases. As the scram valves drift open, the rods begin drifting into the core. The scram pilot valve air header low pressure annunciator was lit at the beginning of this event and therefore did not warn the operator of the low IA pressure condition. The annunciator was lit because the normal IA sys-tem air pressure was insufficient to reset the annunciator due to setpoint dri f t. Subsequent review determined that the last time this surveillance was per-formed, the plant was in hot shutdown; however, there were no differences between performance of this surveillance in hot shutdown and startup oper-ation that should have contributed to actuation of the valves. Addition-ally, it was noted that the procedure had been revised since the last time the surveillance was performed, but the revision did not contribute to the event. The isolation of the IA system, which directly led to the initiation of a manual scram signal by placing the mode switch in SHUTDOWN, could be attrib-uted to one of two reasons. Either (1) the hardware failed to perform as designed; or (2) the operators failed to successfully reset the isolation signal, resulting in closure of the valves. The possible failure of the hardware was resolved by performing the sur-veillance again, which was successfully completed. The electronic switch, or load driver card, which controls closure of the IA valves was evaluated and tested. The licensee determined that the load driver card functioned as designed and therefore concluded that hardware failure was not a proba-ble cause of the event. 23

It is believed that the probable cause of this event was failure to suc-cessfully reset the isolation signal which was sealed into the trip logic by the surveillance test. This conclusion is supported by the fact that coordination of the reset activities was performed by the "B Prime" oper-ator who walked back and forth between the "B" operator and the mainte-nance technician who were not in visual contact, and the fact that there was no formal verification that the valves remained open following resetting of the sealed-in trip signal. Performance of this verification would have allowed sufficient time to reopen the IA valves, which would have prevented the control rods from drifting into the core. It was noted that this event could have also resulted during relanding of the electrical lead, if the lead inadvertently came in contact with a vol-tage source within the panel. The investigation of this-event did not identify any evidence to confirm this as the cause of this event. As corrective action Surveillance Procedure CPS 9030.01 will be revised to require verification that the IA isolation valves remain open following the reset of the isolation signal and relanding of the lifted leads.

Also, the Nuclear Station Engineering Department is evaluating the problem associated with the low instrument air pressure annunciator (reset) set-point, and will designate appropriate corrective action to resolve this matter.

I i 24

3. 0 ABSTRACTS / LISTINGS OF OTHER NRC OPERATING EXPERIF.NCE DOCUMENTS 3.1 Abnormal Occurrence Reports (NUREG-0090) Issued in March-April 1987 An abnormal occurrence is defined in Section 208 of the Energy Reorganization Act of 1974 as an unscheduled incident or event which the NRC determines is significant from the standpoint of public health or safety.

Under the provi-sions of Section 208, the Office for Analysis and Evaluation of Operational Data reports abnormal occurrences to the public by publishing notices in the Federal Register, and issues quarterly reports of these occurrences to Congress in the NUREG-0090 series of documents. Also included in the quarterly reports are updates of some previously reported abnormal occurrences, and summaries of certain events that may be perceived by the public as significant but do not meet the Section 208 abnormal occurrence criteria. Date Issued Report 4/87 REPORT TO CONGRESS ON ABNORMAL OCCURRENCES, JULY-SEPTEMBER 1986, VOL. 9, N0. 3 There were six abnormal occurrences during the period. Four occurred at NRC-licensed nuclear power plants, one occurred at other NRC licensees (industrial radiographer, medical institu- -{ tions, industrial users, etc.), and one occurred at an Agreement State licensee. The occurrences at the plante involved: (1) a differential pressure switch problem in safety systems at LaSalle, (2) an abnormal cooldown and depressurization transient at Catawba Unit 2, (3) significant safeguards deficiencies at Wolf Creek and Fort St. Vrain, and (4) significant deficiencies in access controls at River Bend. The other NRC licensee occurrence involved a therapeutic medi-cal misadministration at the University of Cincinnati Medical Center, Cincinnati, Ohio. The occurrence at the Agreement State licensee involved a ther-apeutic medical misadministration at the University of Iowa Hospitals and Clinics, Iowa City, Iowa. Also, the report updated information on: (1) the nuclear acci-dent at Three Mile Island (79-3), first reported in Vol. 2 No.1 (January-March 1979); (2) loss of main and auxiliary feedwater systems at Davis-Besse (85-7), first reported in Vol. 8, No. 2, April-June 1985; (3) management deficiencies at Tennessee Valley Authority (85-14), first reported in Vol. 8, No. 3, July-September 1985; (4) management deficiencies at Fermi (85-20), first reported in Vol. 8, No. 4, October-25

December 1985; (5) loss of integrated control system power and overcooling transient at Rancho Seco (86-2), first reported in Vol. 9, No. 1, January-March 1986; (6) emergency core cooling system mini-flow design deficiency (86-9), first reported in Vol. 9, No. 2, April-June 1986; (7) rupture of uranium hexa-fluoride cylinder and release of gases (86-3), first reported in Vol. 9, No.1, January-March 1986; (8) unlawful possession of radioactive material (85-4), first reported in Vol. 8, No. 1, January-March 1985; and (9) tritium overexposure and laboratory contamination (86-7), first reported in Vol. 9, No. 1, January-March 1986. In addition, items of interest that did not meet abnormal occur-rence criteria but may be considered significant by the public involved: (1) BWR scram solenoid pilot valve. refurbishment kit problems at Vermont Yankee, (2) reactor fuel failures at McGuire Unit 1, (3) uncontrolled withdrawal of a single control rod at Grand Gulf Unit. 1, and (4) management deficiencies at Turkey Point. I 26 l

3. 2 Bulletins and Information Notices Issued in March-April 1987 The Office of Nuclear Reactor Regulation periodically issues bulletins and information notices to licensees and holders of construction permits.

During I the period, seven information notices and four information notice supplements were issued. Bulletins are used primarily to communicate with the industry on matters of generic Importance or serious safety significance (i.e., if an event at one reactor raises the possibility of a serious generic problem, an NRC bulletin may be issued requesting licensees to take specific actions, and requiring them to submit a written report describing actions taken and other information NRC should have to assess the need for further actions). A prompt response by af-fected licensees is required, and failure to respond appropriately may result in an enforcement action. When appropriate, prior to issuing a bulletin, the NRC may seek comments on the matter from the industry (Atomic Industrial Forum, Institute of Nuclear Power Operations, nuclear steam suppliers, vendors, etc.), a technique which has proven effective in bringing faster and better responses from licensees. Bulletins generally require one-time action and reporting. They are not intended as substitutes for revised license conditions or new requirements. Information Notices are rapid transmittals of information which may not have been completely analyzed by the NRC, but which licensees should know. They require no acknowledgement or response, but recipients are advised to consider the applicability of the information to their facility. Information Date Notice Issued Title 86-61 4/15/87 MISADMINISTRATION TO PATIENTS UNDERG0ING THYROID Sup. 1 SCANS (Issued to all licensees authorized to use byproduct material) 86-64 4/20/87 DEFICIENCIES IN UPGRADE PROGRAMS FOR PLANT EMER-Sup. 1 GENCY OPERATING PROCEDURES (Issued to all nuclear power facilities holding an operating license or construction permit) 86-106 3/18/87 FEEDWATER LINE BREAK (Issued to all power reactor Sup. 2 facilities holding an operating license or con-struction permit) 86-108 4/20/87 DEGRADATION OF REACTOR COOLANT SYSTEM PRESSURE Sup. 1 B0UNDARY RESULTING FROM BORIC ACID CORR 0SION (Issued to all PWR facilities holding an operating license or construction permit) 87-14 3/23/87 ACTUATION OF FIRE SUPPRESSION SYSTEM CAUSING INOPERABILITY OF SAFETY-RELATED VENTILATION EQUIPMENT (Issued to all power reactor facilities holding an operating license or construction permit) 27

87-15 3/25/87 COMPLIANCE WITH THE POSTING REQUIREMENTS OF SUB-SECTION 223b 0F THE ATOMIC ENERGY ACT OF 1954, AS AMENDED (Issued to all power reactor facilities holding a construction permit and all firms supplying components or services to such facilities) 87-16 4/2/87 DEGRADATION OF STATIC "0" RING PRESSURE SWITCHES (Issued to all LWR facilities holding an operating license or construction permit) 87-17 4/7/87 RESPONSE TIME OF SCRAM INSTRUMENT VOLUME LEVEL A DETECTORS (Issued to all GE BWR facilities holding an operating license or construction permit) 87-18 4/8/87 UNAUTHORIZED SERVICE ON TELETHERAPY UNITS.BY NON-LICENSED MAINTENANCE PERSONNEL (Issued to all NRC licensees authorized to use radioactive material in teletherapy units) 87-19 4/9/87 PERFORATION AND CRACKING OF R0D CLUSTER CONTROL ASSEMBLIES (Issued to all Westinghouse power PWR facilities holding an operating license or construction permit) 87-20 4/20/87 HYDR 0 GEN LEAK IN AUXILIARY BUILDING (Issued to all power reactor facilities holding an operating license or construction permit) 28

3. 3 Case Studies and Engineering Evaluations Issued in March-April 1987 The Office for Analysis and Evaluation of Operational Data (AE00) has as a pri-mary responsibility the~ task of reviewing the operational experience reported by NRC nuclear power plant licensees.

As part of fulfilling this task, it selects events of apparent safety interest for further review as either an engineering evaluation or a case study. An engineering evaluation is usually I an immediate, general assessment to determine whether or not a more detailed protracted case study is needed. The results are generally short reports, and the effort involved usually is a few staff weeks of investigative time. Case studies are in-depth investigations of apparently significant events or situations. They involve several staff months of engineering effort, and re-sult in a formal report identifying the specific safety problems (actual or potential) illustrated by the event and recommending actions to improve safety and prevent recurrence of the event. Before issuance, this report is sent for peer review and comment to at least the applicable utility and appropriate NRC offices. These AE0D reports are made available for information purposes and do not im-pose any requirements on licensees. The findings and recommendations contained in these reports are provided in support of other ongoing NRC activities con-cerning the operational event (s) discussed, and do not represent the position or requirements of the responsible NRC program office. Case Date Study Issued Subject C701 3/87 AIR SYSTEM PROBLEMS AT U.S. LIGHT WATER REACTORS This study provides a comprehensive review and evaluation of the potential safety implications associated with air system problems at U.S. light water reactors (LWRs). The report analyzes operat-ing data, focusing upon degraded air systems, and the vulnerability of safety-related equipment to common mode failures associated with air systems. The report analyzes this data from the perspectives of trends and patterns, risk assessments, and cost / benefit studies. Several recommendations are pre-sented to reduce risk, enhance safety, and improve plant performance. Air systems are not safety grade systems at most operating plants. As a result, plant accident analyses assume that safety-related equipment de-pendent upon air systems will either " fail safe" upon loss of air or perform its intended function with the assistance of backup accumulators. This report highlights 29 failures of safety-related systems that resulted from degraded or malfunction-ing air systems. These failures contradict the 29

h i~ j f Case Date Study Issued Subject i C701 (Cont'd) assumption that safety-related equipment dependent epon air systems will either " fail safe" upon loss s of air or perform its intended function with the assistance of backup accumulators. Some of the systems which were significantly degraded or failed were decay heat removal, auxiliary feed-water, BWR scram, pain steam isolation, salt water cooling, emergency diesel generator, containment isolation, and the fuel pool seal system. The root causes of most of those failures were traceable to design and/or management deficiencies. The design and operating problems found appear to reflect a lack of sufficient regulatory require-ments and review, and the view by many applicants and licensees that air systems are not highly im-portant to assuring plant safety. AEOD views the events in which safety systems have been adversely affected by degraded or malfunction-ing air systems as important precursor events. They indicate that further industry or regulatory actions are necessary to assure that air systems are maintained and operated at levels which will enable plant equipment to function as designed and are not subject to unanalyzed failure modes possibly resulting in serious consequences. Up to now, such failures have not occurred in connection i with a limiting transient or accident and, there-fore, no serious consequences resulted. The report addresses specific deficiencies which were found in the following areas: (1) mismatched equipment - the air quality capability of the in-strument air system filters and dryers do not t always match the design requirements of the equip-ment using the air; (2) maintenance of instrument air systems is not always performed in accordance with manufacturer's recommendations; (3) air qual-ity is not usually monitored periodically; (4) plant personnel frequently do not understand the potential consequences of degraded air systems; (5) operators are not well trained to respond to losses of instrument air, and the emergency opera-ting procedures for such events are frequently inadequate; (t) at meny plants the response of key equipment to a loss of instrument air has not been verified to be consist et with the FSAR; (7) safety-related backup accumulators do not necessarily 3 ,m 30 q f f.

Case Date Study Issued Subject C701 (Cont'd) undergo surveillance testing or monitoring to con-firm their readiness; and (8) the size and the seismic capability of safety-related backup accumu-lators at several plants have been found to be inadequate. The recommendations from this study address: (1) ensuring that air system quality meets the re-quirements specified by the manufacturers of the plants' air-operated equipment; (2) ensuring ade-quate operator response by formulating and imple-menting anticipated transient and system recovery procedures for loss-of-air events; (3) improving training to ensure that plant operations and main-tenance personnel are sensitized to the importance of air systems and the vulnerability of safety-related equipment served by the air systems to common mode failures; (4) confirming the adequacy and reliability of safety-related backup accumula-tors; and (5) verifying equipment response to gradual losses of air to ensure that such losses do not result in events which fall outside FSAR analyses. Engineering Date Evaluation Issued Subject E702 3/19/87 MOTOR OPERATED VALVE FAILURE DUE TO HYDRAULIC LOCK-UP FROM EXCESSIVE GREASE IN SPRING PACK This study investigated the phenomenon referred to as " hydraulic lockup" together with its effect on motor operated valve operation. The study was ini-tiated as the result of a 1986 event at Vermont Yankee. The evidence confirms that hydraulic lock-up can occur with Limitorque SMB motor operators. The phenomenon appears related to the use of EXXON NEBULA EP-0 grease which is one of two environmen-tally qualified greases and seems to be the pre-ferred choice. The safety concern is that hydraulic lockup is a common mode failure mechanism for safety-related MOVs. In addition, the failure may tend to occur in a manner that could not be detected by plant operators because an apparently successful closure could render the MOV inoperable for the next demand (e.g., motor burnout, component damage due to over-loading, or inability to open due to over-tightening during closing). i Although hydraulic lockup appears to be associated win the use of EXXON NEBULA EP-0 grease, it also seems that the industry does not have an adequate ' I. l I

Engineering Date Evaluation Issued Subject E702 (Cont'd) understanding of the combination of parameters or conditions that cause the phenomenon. The situ-ation can be' separated into broad groups involving motor operators that were manufactured prior to l approximately 1975 that need a modification kit ? installed to provide a grease relief path; motor operators manufa tured subsequent to 1975 that have a design change to provide an internal grease re-lief path to prevent lockup, but that change may a not be adequate; and misinformation or lack of awareness throughout the industry about the need for the modification kit or that hydraulic lockup has occurred in motor operators that have the de-1 sign change intended to prevent such response. Further, current emphasis on the use of environ-mentally qualified grease may expose licensees to a greater risk of occurrence of hydraulic lockup if they are not aware of appropriate precautions. Based on the fact that hydraulic lockup has occurred and that. industry guidance may be inaccurate, the I report recommended that the NRC's Office of Nuclear Reactor Regulation issue an information notice to alert licensees about the coluplex situation. The report also recommended that immediate industry i I effort is needed to (1) identify conditions, se-quences, or procedures that result in hydraulic lockup; (2) develop solutions for all motor opera-tors currently in use (modification kits, design changes, etc.); and (3) disseminate the corrective action to all users. This effort should be coordi-nated through NUMAC as part of the overall program for industry action on motor operated valves. l E703 3/23/87 LOSS OF 0FFSITE POWER DUE TO UNNEEDED ACTIVATION OF STARTUP TRANSFORMER PROTECTIVE DIFFERENTIAL RELAY This study was performed to review and assess infor-mation concerning' losses of offsite power for aux-iliary power system designs which transfer emergency buses from a unit auxiliary transformer to a startup or reserve transformer following a turbine generator trip. The review was initiated due to the loss of offsite power event which occurred in such an aux-iliary power system design at H. B. Robinson Unit 2 on January 28, 1986. The related safety concern is that in these auxiliary power system designs the preferred power source (offsite power) to the 32 -._--______.---_--____-___._---___a

Engineering Date Evaluation Issued Subject E703 (Cont'd) emergenty bases may be lost at a time when needed to operate iafety-related electrical equipment. As illustrated by the Robinson event, loss of emer-gency bus power may be due to direct current (dc)- saturation of a current transformer (CT) associated with a startup or reserve transformer protective differential relay. Although the review did not identify any other similar reported event, suscep-tibility of such cts to de saturation could poten-tially exist at other plants. This conclusion is supported in part by the fact that CT saturation, to the extent necessary to actuate a startup trans-former protective differential relay, had not pre-viously occurred in the 15 year operating history of Robinson Unit 2. In addition, the Robinson event demonstrates that' grid system conditions at the time during the transfer of auxiliary loads, along with a higher than usual auxiliary load in-rush current, are influencing factors. Since the NRC had issued an information notice j (IN 86-87) addressing the Robinson event and dc i saturation of cts associated with power transformer I protective differential relays, the report suggested that the Office of Nuclear Reactor Regulation con-sider this event as' appropriate in ongoing licensing reviews. Further, it suggested that consideration be given to incorporating the lessons learned from this event into the next revision of Standard Re-view Plan Section 8.2. The report also suggested that the focus of these activities be directed at the potential occurrence of de saturation of cts associated with startup or reserve power transformer protective differential relays. E704 3/26/87 DISCHARGE OF PRIMARY COOLANT OUTSIDE OF CONTAINMENT AT PWRs WHILE ON RESIDUAL HEAT REMOVAL COOLING In 1985, AE0D issued a case study report on the loss of decay (residual) heat removal (RHR) systems at pressurized water reactors (PWRs). (See Power Reactor Events, Vol. 7, No. 5, p. 31, for brief summary.) That case study report evaluated the causes of operating events involving the loss of 74R cooling, and evaluated the human factor aspects of precluding that type of event from progressing 1 into a severe core damage accident in the 1-to 2-hour time frame available for recovery. A simi-lar AE00 engineering evaluation on operating experi-ence involving the inadvertent draining of a boiling 33 ] i i ___________-_Q

Engineering Date Evaluation Issued Subject E704 (Cont'd) water reactor during shutdown cooling was issued in 1985.' (See Power Reactor Events, Vol. 8, No. 4, pp. 52-53, for a brief summary. ) That latter report evaluated the RHR system configuration and the human factor elements that contributed to draining the l pressure vessel. Those studies prompted a review of inadvertent discharge of primary coolant outside of containment at PWRs while on RHR cooling to assess j the causes of these events and their significance. ] A total of seven operating events which occurred at i different PWRs_in the last 9 years were identified and evaluated. i The major causes of these operating events, involv-ing the discharge of primary coolant outside of con - 1 tainment, are problems associated with deficiencies j in operating procedures and personnel errors. The RHR system is a multi-function system that is capa-ble of moving coolant in and out of the primary sys-tem by. changing valve positions in the RHR suction and discharge lines. During shutdown, while on RHR cooling, maintenance, test and other activities can create _a busy working environment that is conducive' to personnel errors if procedures are not carefully written or followed to preclude inappropriate sequen-tial valve operations, or if the operators are not attentive to the'various evolutions in progress. If l not terminated', these operating events, involving the inadvertent discharge of primary coolant outside of containment, could progress into loss of'RHR-cooling events. These operating events were judged to have a low-core damage likelihood, but have the potential for offsite. releases if the event and/or.the pathway outside.of containment is not-isolated in a timely fashion. Consequently, this engineering' evaluation suggested.that an information notice be issued'by the Office of Nuclear Reactor Regulation to alert licensees.to the occurrences of these events and to highlight the'significant operational aspects that i can: reduce the likelihood and severity of these events. The;important areas are: (1) an unambiguous sequence of valve" manipulations in RHR testing, maintenance, and operation procedures regardless. 'of the plant configuration; (2) avoiding RHR main-tenance arid testing evolutions while the primary H system is drained _down for' steam generator repair- - or other' activities; and (3) adequate recovery pro-cedures which address isolation of the coolant. l pathway outside of containment. 1 34 I

Engineering Date Evaluation Issued Subject E705 3/31/87 SURVEILLANCE TESTING REQUIREMENTS FOR REACTOR WATER CLEANUP SYSTEM AUTOMATIC ISOLATION LEAKAGE DETECTION SYSTEMS On July 23, 1986, Millstone Unit 1 experienced a complete severance of a one-inch pipe to a reactor water cleanup (RWCU) system regenerative heat ex-changer relief valve resulting in a 2200 gallon dis-charge of reactor coolant to the heat exchanger room sump. Other RWCU system integrity failures have occurred at Quad Cities Unit 2, Vermont Yankee, and Dresden Unit 2, with the most serious event at Dresden Unit 2. Between August 1 and August 4, 1986, the Dresden Unit 2 RWCU system developed a low-energy fluid leak of approximately 50 gallons per-minute (gpm), from a filter-demineralized unit train valve. The leak resulted in the accumulation of approxi-mately 140,000 gallons of reactor coolant in the reactor building basement torus room sump. As a consequence of these events and numerous other events reported in Licensee Event Reports (LERs) involv_ing primary containment isolation system (PCIS) initiation, which automatically iso-lated the RWCU system, an engineering evaluation was conducted to: i Analyze the causes and actual consequences of the reported events; Determine the corrective actions which already have been and might yet be taken to reduce the frequency of these events; Determine the causes and safety consequences of the actual leaks that have occurred in the RWCU system; and Review the RWCU leak detection and isolation capabilities in light of the safety significance evaluation of the RWCU system leaks. A data base of RWCU system isolation operating experience was prepared from LERs and Daily Reports covering the period from January 1984 through Sep-tember 1986. The data were analyzed in detail for the 10 units showing the highest incidence of RWCU system isolations. The analysis showed that although approximately 15% of all LERs reported RWCU system events, only 26% of the isolations were due to actual 35

Engineering Date Evaluation Issued Subject E705 (Cont'd) RWCU system operational problems. These included system leaks through pump seals and valve bonnets and a few small-diameter pipe and valve failures; internal leakage past cc:nponent isolation valves, through resin strainer valves and other ball valves; high temperature conditions at the filter-deminer-alizer; and a number of high area temperature condi-tions due to ventilation system inadequacies. The large majority of isolations (i.e., 74%) were due to spurious actuations. These involved erroneous indications of high system flow and high area tem-i i perature, as well as operator error. The spurious high area temperature isolation events were gener-ally associated with surveillance testing of the leak detection system temperature detector modules. A number of licensees have implemented design and procedural improvements to overcome the operational problems which cause RWCU system isolations. Mea-sures taken to eliminate sensed spurious flow per-turbations include removal of air trapped in the system or sensing lines, relocation and resizing of flow measurement orifices, incorporation of =i time delay between an alarm condition and initiation of an isolation signal, and recalibration of flow mea-suring devices. The most beneficial change applied to reduce spurious isolations'due to the temperature sensors involves the addition of noise suppressors and/or short time-delays to filter spurious elec-tronic noise pulses. The LER data trends appear to support the conclusion that these design changes have been effective in reducing or eliminating the spuri-ous automatic isolation problems. An evaluation of the events shows that no significant safety problem is indicated by the operational data. However, because automatic isolation of the RWCU system involves actuation of an engineered safety feature, these are reportable events. Additionally, the investigation, repair, and cleanup activities associated with RWCU system problems (including spurious isolations) can result in increased person-nel exposure. Also, activities associated with the investigation and reporting of spurious events take resources away from other potentially more important activities. This investigation may be useful in ongoing reviews of maintenance programs and new plant operating' experience by industry organizations, such as INPO. For example, this report may help to character.ze 36

Engineering Date Evaluation Issued Subject E705 (Cont'd) the design improvements and procedural changes which can be implemented to reduce the frequency of spuri-ous isolation events associated with the RWCU system. Additionally, it was suggested that AEOD reevaluate the LER reporting requirements for spurious isolation events associated with the RWCU system. Finally, it was suggested that the Office of Nuclear Reactor Regu-lation reevaluate the need for daily testing of the RWCU system leak detection system temperature moni-tors in view of the relatively high frequency of spurious isolation events initiated by such testing and the relatively low incidence of significant leak-age events. E706 3/30/87 MECHANICAL BLOCKING OF VALVES An investigation of domestic LWR operating experi-ence involving inadequate or inadvertent blocking of valves by mechanical methods was initiated by an event that occurred at a foreign reactor. The foreign event occurred at a Westinghouse two-loop I PWR and resulted in a sustained, uncontrolled blow-down of high energy steam from an unanticipated oper,- ing of an upstream isolation valve that was not prop-erly blocked in the " closed" position. The root cause of the foreign reactor event was identified to be inadequate procedural controls for assuring that the valve was incapable of subsequent automatic movement. This study investigated 19 events at domestic reac-tors, involving mechanical blocking of automatic valves in a 5 year period from October 1981 to Feb-ruary 1986. Nine of the events involved the appli-cation of mechanical blocking devices to safety / relief valves. In each event, the gagging of the safety / relief valve led to a desirable safety cutcome. The remaining 10 events in this study involved the i misapplication of a mechanical blocking device to one motor operated and nine air-operated valves. i The study found that: (1) Six of the valves were inadvertently blocked l from automatic motion and were incapable of responding to a remote command. (2) There was one instance of a mechanical blocking device failing, and it was incapable of preventing undesired valve motion. 37 )

Engineering Date Evaluation Issued Subject E706 (Cont'd) (3) Two automatic valves should have been mechan-ically blocked in the " safe" position; they were not, and each valve subsequently cycled to a position that led to degradation of safety-related equipment at the plant. The study found that the misapplication of mechani-cal blocking devices to automatic valves was caused by human error deficiencies (i.e., personnel errors or inadequate procedures). The events were not repetitive at any individual plant so it would appear that the corrective actions taken at these specific plants were effective. Although this study found that the misapplication of mechanical blocking devices were infrequent, unrepetitive occurrences, a high proportion of the events could have and actually did result in signifi-cant compromises in safety. Accordingly, it is sug-gested that the Office of Nuclear Reactor Regulation consider issuing an information notice to describe { several of these events and their underlying cause and actions that could be taken to minimize the pos-sibility of these types of problems. E707 4/3/87 DESIGN AND CONSTRUCTION PROBLEMS AT OPERATING NUCLEAR PLisNTS l On June 9, 1986, Crystal River Unit 3 experienced an event involving deficiencies in design and con-struction that resulted.in a potential common mode failure of the nuclear service closed cycle cooling water (SCW) system. The deficiencies were not detected by the plant QA and QC program for design and construction, but'rather were detected following an indication of structural damage after the plant was in operation for some time. While the plant was operating at rated power, cracks were discovered on the concrete support pedestal for discharge piping from SCW system heat exchangers 1A and 18. Hairline cracking of the support pedestals for heat exchan-ger 1C and ID also was found. Investigation into the cause of the cracking revealed an error in the computer piping analysis. The expansion joints in this system piping had been modeled incorrectly. While the piping reanalysis was being performed, an additional problem was discovered. A rigid seismic d restraint used in the computer model for the system piping analysis was not included in construction documentation, and therefore was never installed. 38

Engineering Date Evalution Issued Subject E707 (Cont'd) The missing seismic restraint was the result of an omission during transfer of the computer design out-put to restraint fabrication documents. The piping analysis error could have led to a failure which would render both trains of the SCW system inoper-able. The missing seismic restraint could also have led to a similar failure during a seismic occurrence. These were significant deficiencies in the design and construction of the plant which could pose a poten-tial hazard to safe plant operation had these defi-ciencies remained uncorrected. The event prompted a search of similar identified design and construction problems at other operating plants over the time period from January 1984 to September 1986. There were a total of 55 reports of deficiency that involved 34 plants. Of these 34 plants, 21 started commercial operation in 1970 or earlier, and the remaining 13 plants had less than 2 years of operation. Based on the review, the designed construction defi-ciencies identified in these events could be attrib-uted to inadequate document controls, unreviewed safety and design condition or inadequate review during modification. Inadequate document controls appear to be the prob-lem associated with design change control, including undocumented design change and omis> ion of design or modification items in construction drawings. This could lead to questionable field installation. Unreviewed safety and design condition could cause changes to design in conflict with the technical specification, plant FSAR and the existing proce-dural requirements. Inadequate review during modi-fication often provide incorrect data for a modifi-cation and would result in errors in implementation. In some cases this also caused incomplete post modi-fication testing. Accordingly, it appears that the 55 reports represent a potential generic problem in that the design and construction deficiencies were not detected in the plant QA and QC verifications for compliance with the plant requirements. This suggests that the plant QA and QC programs may not have been adequate to identify all existing design and construction prob- { lems, with the likelihood that there may be other undetected, significant design and construction 4 39

Engineering Date Evalution Issued Subject E707-(Cont'd) deficiencies-in operating plants. In view of this safety concern, the following actions were suggested in the engineering evaluation: (1) The Office of Nuclear Reactor' Regulation.(NRR) should consider issuing an information. notice to address the findings of this study for feedback purpose. .(2) NRR and the Regions should review the adequacy of current QA and QC programs used in plant l modifications to verify that the plant is in -l conformance with design and construction-t requirements.- Also, the findings of this study 1 should be used as a reference for future inspec-tion and review of changesLin plant design and construction. i l l I I J i 40 i l 1

3.4 Generic Letters Issued in March-April 1987 Generic Letters are issued by the Office of Nuclear Reactor Regulation. They are similar to NRR Bulletins (see Section 3.2) in that they transmit information to, and obtain information from, reactor licensees, applicants,.'nd/or equipment suppliers regarding matters of safety, safeguards, or environmental significance. Generic letters usually either (1) provide information thought to be important in assuring continued safe operation of facilities, or (2) request information on a specific schedule that would enable regulatory decisions to be made regard-ing the continued safe operation of facilities. They have been a significant means of communicating with licensees on a number of important issues, the reso-lutions of which have contributed to improved quality of design and operation. Generic Date Letter Issued Title G7-04 3/6/87 TEMPORARY EXEMPTION FROM PROVISIONS OF THE FBI CRIMINAL HISTORY RULE FOR TEMPORARY WORKERS (Issued to all power reactor licensees) 87-05 3/12/87 REQUEST FOR ADDITIONAL INFORMATION - ASSESSMENT OF LICENSEE MEASURES TO MITIGATE AND/0R IDENTIFY POTEN-TIAL DEGRADATION MKI (Issued to licensees of operat-ing reactors, applicants for operating licenses, and holders of construction permits for BWR Mark I containments) 87-06 3/13/87 TESTING OF PRESSURE ISOLATION VALVES (Issued to all operating reactor licensees) 87-07 3/19/87 INFORMATION TRANSMITTAL OF FINAL RULEMAKING FOR REVISIONS TO OPERATOR LICENSING - 10 CFR 55 AND CONFORMING AMENDMENTS (Issued to all facility licensees) i 41

3.5 Operating Reactor Event Memoranda Issued in March-April 1987 The Office of Nuclear Reactor Regulation (NRR) disseminated information to the directors of the other divisions and program offices within NRR via the operat-ing reactor event memorandum (OREM) system. The OREM documented a statement of the problem, background information, the safety significance, and short and long term actions (taken and planned). These memoranda are no longer issued by the NRC. This section of Power Reactor Events will be deleted in future issues. 42

3.6 NRC Documentation Compilations The' Office of Administration issues two publications that list documents made publicly available. The quarterly Regulatory and Technical Reports (NUREG-0304) compiles bibliographic data and abstracts for the formal regulatory and tech-nical reports issued by the NRC Staff and its contractors. The monthly Title List of Documents Made Publicly Available (NUREG-0540) contains descriptions of.information received and gen-erated by the NRC. This information includes (1) docketed material associated with civilian nuclear power plants and other users of radio-active materials, and (2) non-docketed material recieved and generated by NRC pertinent to its role as a regulatory agency. This series of documents is indexed by Personal Author, Corporate Source, and Report Number. The monthly Licensee Event Report (LER) Complication (NUREG/CR-2000) might also be useful for those interested in operational experience. This document contains Licensee Event-Report (LER). operational information that was processed into the LER data file of the Nuclear Safety Information Center at Oak Ridge during the-monthly period identified on the cover of the document. The LER summaries in-this report are arranged alphabetically by facility name'and then chronologically. by event date for each facility. Component, system, keyword, and component ~ vendor indexes follow the summaries. Copies-and subscriptions of these three documents are available from the Superintendent of Documents, U.S. Government Printing Office, P.O. Box 37082, Washington, DC 20013-7982. 1 I ' I 1 1 f l 43

• W.S.C0VChhMhi PR14Tinc orFICC 19874 732-29?dD337

UNITED STATES po7,f,Nl,8,7,b i4UCLEAR REGULATORY COMMISSION ussac WASHINGTON, D.C. 20555 PERMIT ho G 87 OFFICIAL BUSSNESS PEN ALTY FOR PRIVATE USE. $300 120555078877 1 1A01N411M11S1 US NRC-0 ARM-ADM DIV 0F PUB SVCS POLICY & PUB MGT BR-PDR NUREG ^ W-537 WA0HINGTON OC 20555 1 l 1 l' 1 l l l l 1 1 L..,. .....m,.. ,,..... _...... _ _. _,.}}