ML20248B403

Special Study Rept,Significant Events Involving Procedures

ML20248B403
Person / Time
Issue date:	03/31/1988
From:	Trager E NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
Shared Package
ML20247J861	List: ML20247J857 ML20248B403
References
TASK-AE, TASK-S801 AEOD-S801, NUDOCS 8906090032
Download: ML20248B403 (88)

Text

- - - _ - - _ - - - _,

h i $ ',

L i

AE0D/S801 c

SPECIAL STUDY REPORT SIGNIFICANT EVENTS INVOLVING PROCEDURES by the Office for Analysis and Evaluation of Operational Data Division of Safety Programs Nonreactor Assessment Staff March 1988 Prepared by:

Eugene A. Trager, Jr.

This report documents the results of a study completed by the Office for Analysis and Evaluation of Operational Data (AE00) with regard to particular operating events. The findings and conclusions do not necessarily represent the finci position or requirements of the responsible program Office nor the Nuclear Regulatory Conwission.

7 89 abo 9 co3Q ><&

E8 g -

t 7

TABLE OF CONTENTS Page 1

EXECUTIVE

SUMMARY

I 1.

INTRODUCTION.....................................................

3 2.

CHARACTERISTICS OF EVENTS THAT INVOLVED PROCEDURES...............

6

/

3.

REGULATORY REQUIREMENTS REGARDING PROCEDURES....................

12 4.

REVIEW OF EVENTS AT SELECTED SITES..............................

14 5.

FINDINGS........................................................

16 6.

CONCLUSIONS.....................................................

17 APPENDIX A - Characteristics of Significant Events.............. A-1 APPENDIX B - Significant Events Involving Procedures............ B-1 APPENDIX C - Review of Selected Significant Events T

Involving Procedures............................. C-1 m>,

p EXECUTIVE SLM1ARY The study reviews the procedure problems that contributed to significant operating events in 1984 and 1985. The events were identified in Licensee Event Reports (LEFs) that had been found to have safety significance using AEOD screening criteria. Of 291 such events in 1984 and 1985, 119 involved human performance.

i Procedures were a contributing factor in 101 events or about 85% of the events f

that involved human performance. The study includes a brief review of current regulatory requirements regarding procedures.

During the time period of the study, significant events involving procedures occurred more frequently at new plants than at more nature plants.

This finding is consistent with the more general observe. tion that plants with little operating experience frequently report more events than plants with longer operating histories.

Of 95 reactors that were operating during the time period of the study, about half of the plants had one or more events that involved procedures.

The study found that reportable events associated with procedures were experienced in all modes of operation, during operations, maintenance, testing, and other activities. The problems associated with procedures appear to be generic.

Based on a review of the current requirements regarding procedures, visits to five sites, and an analysis of events involving procedures, we concluded that:

The events involving procedures point to a generic problem that needs to j

be resolved systematically.

Training and accreditation programs should be reviewed to ensure that the programs adequately stress how procedure problems can arise and how the problems can be avoided.

)

l

\\

l l

l 1

l I

c t

Although there is wide acceptance of the need to perform certain types of activities in accordance with procedures, current requirements and guidance regarding procedures may not be adequate to. ensure quality procedures are used. A recent contractor study

• indicates that operating procedures in use are often vague and may not conform to good human factors principles; and many plants have untimely procedure change processes. do not coordinate procedure preparation with training, and do not adequately validate and verify new and, revised procedures.

Current requirements for the review of procedures may not be adequate.

f Because of the lack of standards for procedures, needed improvements in a licensee's procedures may not become apparent until.an event occurs that can be clearly traced to a procedure problem.

j i

l

• " Study of Operating Procedures in Nuclear Power Plants: Practices and Problems,"

l-NUREG/CR-3968, February 1987.

l i

l 2

b

1

1.0 INTRODUCTION

l

{

Several of the significant operating reactor events recently investigated by the,

)

NRC involved procedures to some degree.

In the June 9,1985 loss of feedwater event at Davis-Besse, for instance, the shift supervisor did not initiate make-up/high pressure injection (MU/HPI) cooling at the point required by the emergency operating procedure (E0P), because the E0P was not explicit enough.

In the loss of power end water hammer event at San Onofre 1 on November 21, 1985, the surveillance procedure for testing check valves was incomplete and emergency procedures lacked guidance on loss of ac power.

In the loss of integrated control system power and overcooling transient event at Rancho Seco on December 26,1985, the E0Ps did not address the loss of integrated control system (ICS) power, and the annunciator procedure manual was not used.

During the 1986 MIT Sumer Session on Nuclear Power Reactor Safety, a presentation rade of an analysis of root causes in 1985 INPO Significant Event Reports indi-cated that human performance problems were the root causes in 46% of the 1985 significant events and that the majority of human performance problems were related to procedures (47% were due to deficient procedures and 11% to e failure to follow procedures). The presentation concluded that incomplete procedures were the principal problem, and called for improvements in the area of procedures to improve human performance.

The purpose of this AE00 study is to determine the extent to which procedure problems contributed to human performance problems that led to significant events; i.e., whether procedures were the primary cause or a contributing factor, a secondary contributing factor, or merely a corrective action. The study was aimed at detemining whether procedures / procedure changes were sometimes being used inappropriately as a solution to problems; that is, changing a procedure rather than taking the more appropriate, if more difficult and/or time-consuming, corrective action (s), such as a design change. To achieve this, we have:

Compared the frequency of occurrence between single and multi-unit sites and between new plants and more mature plants; 3

r-__

y Determined the operating status of the plants when these problems occurred and whether this influenced the significance of the events-1 Reviewed the problems that made these events reportable to determine the consequences of deficiencies in procedures; Determined whether certain types of procedures (operating, maintenance, etc.)

are more likely than others to be involved in significant events;

)

Determined the most frequently occurring procedural deficiencies; Determined the types of personnel most frequently associated with events

)

involving procedures; and Reviewed current regulatory requirements regarding procedures.

This study covers the period from January 1984 through December 19P5. The focus was on events described in 1984 and 1985 Licensee Event Reports (LERs) that had been found to be safety significant using AEOD selection criteria.* The 180 such reports from 1984 and the 111 reports from 1985 were classified as indicated in Table 1.

During this time period a total of 101 significant events were reported (54 in 1984 and 47 in 1985 as shown in Table 1) that resulted from human performance problems and that involved procedures.

(Data from earlier years were not comparable because the LER reporting requirements changed on January 1, 1984 when 10 CFR 50.73 became effective and more recent data were incomplete.)

In each of the years, licensees reported that procedures were a contributing factor in about 85" of the significant events that involved human performance.

• The AEOD selection criteria used to identify significant events, that is, events that appear to have an influence on the overall risk to the public health and safety, include: (1) A previously unanalyzed accident sequence with the potential for serious consequences to the public health and safety; (2) An event that could

-have been significant under other credible conditions, for example, at a dif-ferent mode or power level; (3) A licensing criterion, such as a technical specification or licerse condition, was deficient to the extent that it con-tributed to a challenge of a safety system; (4) A previously unrecognized inter-dependence between systems or components that could lead to a significant event; (5) Personnel actions or design features that either have led to repeated failures or had the potential for connon mode failures in systems important to safety; (6) An unanticipated weakness or inoperability of the core heat removal, emergency core cooling, pressure relief, and feedwater systems, or failures that occurred in support systems and equipment essential to the operation of those systems.

4

TABLE 1 Classification of AEOD Category I and 2 LERs 1984 1985 LERs of Events Involving Human Performance Involving Procedures 54 47 Not Involving Procedures 10 55 8

64 LERs of Events Resulting from Equipment Failure, or of an Observed Condition, e.g., IGSCC 116 56 i

Total Events (AE00 Category 1-2) 180 111 For the purpose of this review, events involving procedures were those events that were at least partially the result of a lack of, deviation from, or deficiencies in operating, maintenance, or administrative control procedures. An event was deemed to be the result of a defective procedure if the LER stated that a procedural deficiency or deviation from a procedure was a contributing factor, or that a procedure chanoe(s) had been or would be trade to prevent recurrence.

A review was also made of the 1984 and 1985 NRC enforcement actions described in NUREG-0940, " Enforcement Actions: Significant Actions Resolved." The review indicates that civil penalties and orders for reactor licensees in 1984 and 1985 were proposed most frequently because of problems that included deficiencies in licensee's procedures (see Table 2).

TABLE 2 Factors Leading to Enforcement Actions NUREG-0940 Vol.

No.

Period Procedures HF/NP*

Safeguards Total 3

1 Jan-Mar 84 4

2 1

7 3

2 Apr-Jun 84 8

0 0

8 3

3 Jul-Sep 84 7

0 1

8 3

4 Oct-Dec 84 6

0 1

7 1984 Total 25 2

4 30 4

1 Jan Mar 85 7

3 1

11 4

2 Apr-Jun 85 7

0 3

10 4

3 Jul-Sep 85 4

2 2

8 4

4 Oct-Dec 85 4

1 2

7 1985 Total 22 6

8 36

• HF/NP - Factors that contributed to performance problems but did not involve procedures 5

L_______---___---------__-

I

1 Section 2 of this report discusses the characteristics of the significant events reviewed (see Appendices A.1 and A.2 for a brief description of the individual events). Section 3 discusses requirements regarding procedures, and Section 4 describes the results of a detailed review of events at a few selecteo sites. Sections 5 and 6 include the findings and conclusions of this study.

2.0 CHARACTERISTICS OF EVENTS THAT INYOLVED PROCEDURES The 54 events in 1984 and the 47 events in 1985 that involved procedures were examined to determine the characteristics of the events. Additional data on the 1984 and 1985 events that involved procedures are given in Appendices B.1 through B.A.

These data indicate that problems with procedures were the primary causes or contributing factors in most significant events (97 of ;01) that involved procedures.

(In the remainino even;s procedure problems were a secondary cause or contributing factor.)

2.1 Event Frequency The overall frequency distribution for events in 1984-1985 at plants and at sites is given in Table 3.

TABLE 3 Event Frequency Distribution Number of Events 0

1 2

3 4

5 6

7 Reactor Plant Sites That Experienced Events 24 13 10 10 2

2 1

Reactor Plants That Experienced Given Number of Events 44 21 18 7

3 1

1 0

Total Events 101 Total Sites that Experienced Events 40 i

Total Plants that Experienced Events 51 Total Plants that Did Not Experience Events 44 Significant events involving procedures were reported more frequently at some plants than at others.

For example, 23 of the 101 total events took place et 6

1l:

five plants (87 units were operatireg in 1984 and 95 units were operating in 1985). and 44 of the 101 events took place at 12 plants.

Similarly, events were reported more frequently at some sites than at others.

For example,-

although 40 sites experienced 101 events over the 1984-1985 period, five of these sites experienced 30 events, and 17 sites experienced 78 of the 101 events -(23 multi-unit sites cperated in 1984 r.nd 25 fra 1985).

' Tsble 4' gives the distribution of plants by type of plant along with the numbers of events involving procedures for all of 1984 and-1985 that occurred at those plants.

In 1985 there V:are 43 plants at single-unit sites (45% of the total) and 52 plants at multi-unit sites (55%).

In 1984 and 1985, reactors at single-unit sites experienced approximately 0.60 events / plant-year (i.e.,

significant events involving procedures) and units at multi-unit sites experienced 0.51 events / plant-year. - [As noted in Table 4, a number of plants were classified as sir,gle unit because of differences (from other similarly named units) in management or NSSS type, while others were classified as a' single unit for a particular year because other plants at the site were not in operation.l' It appears therefore that these events were slightly more likely to be reported at single unit sites. This may indicate that plants at multi-unit sites benefit from the expesience of other plants at' that site, t

1 i

l i

7

TABLE 4 Numbers of Reactors and Events at Single and Multi-Unit Sites, 1984-85 Single Unit Sites

• Multi-Unit Sites Total l

4 Reactors 1984 40 48 88 Reacters 1985 43 52 95 1984-1985 Events 50 51 301 Events / Reactor-Year 0.60 0.52 0.55 New Plants 1984**

11 8

19 New Plants 1985**

12 7

19 1984-1985 Events for New Plants 14 11 25 Events / Reactor-Year 0.61 0.73 0.66 Mature Plants 1984 29 40 69 Mature Plants 1985 31 45 76 1984-1985 Events for Mature Plants 36 40 76 Events /Reacto<-Year 0.60 0.47 0.52

• A number of plants have been classified as single unit because of differences (from other similarly named units) in managemant or NSSS type. The plants are:

ANO 1 and 2 Indian Point 2 and 3 Millstone 1 and 2 San Onofre 1 and 2 (and 3)

Others were classified as single unit for a particular year because other plants at the site were not in operation; e.g., Catawba 1 Limerick 1, and Palo Verde 1.

• • By definition, new plants in 1984 and 1985 were those licensed after January 1 of 1982 and 1983, respectively.

In 1984, the new plants at single-unit sites were Byron 1. Callaway, Catawba 1, Diablo Canyon 1. Grand Gulf 1, Limerick 1 Palo Verde 1, Shoreham, Sumner, Waterford 3, and WNP-2, and the new plants at multi-unit sites were LaSalle 1 and 2, McGuire 2 San Onofre 2 and 3, St. Lucie 2, and Susquehanna 1 and 2.

In 1985, the new plants at single unit sites were Byron 1, Callaway Catawba 1, Fermi 2. Limerick 1. Millstone 3 Palo Verde 1, River Bend 1, Shoram, Waterford 3. WNP-2, and Wolf Creek, and the new plants at multi-unit sites were Diablo Canyon 1 and 2 LaSalle 2, McGuire 2 Palo Verde 2, St. Lucie 2, and Susquehanna 2.

8

v..

s.

New plants reported slightly higher rates of procedure-related events: 0.61 events / plant-year at single-unit sites and 0.73 events / plant-year at multi-unit sites, while reactors with more than 2 years experience reported rates of 0.60 events / plant-year at single-unit sites and 0.47 events / plant-year at multi-unit

. sites.- However, these averages are not very meaningful because they are so strongly influenced by the events reported during_ this time period by a relatively small number of individual plants.

2.2 Power Level and Event Type The power level at the time of the events is indicated in Table 5.

Roughly half of the 1984-1985 events occurred at the 0% power level. This shows the importance of quality procedures at all times in the operating cycle. -

TABLE 5 Category I or 2 Events Involving Procedures Number at Power Level Power level 1984 1985 Total 0% (non-critical) 30 18 48 0 <P <15% (critical) 2 4

6 15iP3100%(critical) 22 25 47 Total 54 47 101 Seven of the 30 1984 events and six of the 18 1985 events at 0% power involved loss of the residual heat remeval system in the decay heat removal mode.

The 1924 and 1985 events were reviewed to deterwine whether the events resulted in any common types of problems. Two categories of problems were chosen:

I inoperable system and reactor trip. All others were aggregated into a miscellaneous category. Table 6 shows that, in the ag;regate, approximately I

equal numbers of events resulted in system inoperability or miscellaneous, and about'18 procedural problems resulted in reactor trips (while the reactor was critical). One-third (34%) of the significant events involving procedure problems at power resulted in a reactor trip.

9

TABLE 6 Problem Type Critical Non-Critical 1984-P5 1984 1985 Total 1984 1985 Total Total System Inop*

13 7

20 19 6

25

~~45-~

Rx Trip 4

14 18 N/A N/A N/A 18 Miscellaneous 7

8 15 11 12 23 38 Total 24 29 53 30 18 48 101

• Broad'y defined as loss of safety system function, loss, failure, or inoperability of a system or component, etc.

2.3. Characteristics Related to Procedures Table 7 gives the distribution of the types of procedures that were involved in the avents.

It should be noted that administrative / management procedures can influence all the other categories of procedures. Similar numbers of maintenance, operations, and testing procedures were involved in the 1984 and 1985 events. Ten of the 18 events involving reactor trips in 1984-85 were the result of deficiencies in maintenance procedures.

TABLE 7 Procedure Type 1984 1985 Total Operations 17 11 28 Maintenance 12 10 22 Testing 10 11 21 Administrative / Management

• 8 9

17 Modifications / Installation 3

4 7

Other(HP, Sample,etc.)

4 2

6 Total 54 47 101

• Administrative / management procedures include a broad spectrum of activities, such as:

Verification l

Shift turnover Guidelines for verbal communication Identification / Labeling Control of contractor activities Control of procedures and procedure changes.

10

l.

Table 8 lists the types of. deficiencies that were present in the procedures involved in the events. In most events, procedures were available, and licensees reported the procedcres were incomplete rather. than incorrect.* In only three instances (3% of the events) did licensees report that significant events. occurred because a procedure was not followed.

TABLE 8 Deficiency Type i

1984 1985 Incomplete 44 31

. Missing 4

6 Incorrect 4

9 Not-Followed 2

I Total 54 47 Information in the LERs indicated that poor human performance was a significant contribtiting factor in less than half of the events (22 of the 541984 events and 14 of the 47 1985 events). Table 9 is a breakdown by personnel type of the events in which it appeared that poor human performance was a contributing factor.

TABLE 9 Personnel Type in Events Where Poor Performance was a Factor 1984 1985 Total LO (licensed operator)

'12 5

17 NLO (non-licensed operator) 3 5

8 Maintenance (Electrical / Mechanical) 4 2

6 i

Other*

3 2

5 Total 22 14 36

• Construction, chemistry, health physics, etc.

j t

• Data in Appendices B.3 and B.4 derived from these LERs indicate that most procedure problers (52 of 541984 events and 42 of 47 1985 events) arose because of deficiencies in procedure content (omitted, inaccurate or incorrect material) rather than deficiencies in presentation (confusing, complex, or inconsistent forma ^).

11

I

c 3.0 REGULATORY REQUIREMENTS REGARDING PROCEDURES Detailed regulatory requirements and/or guidance have not been developed for procedures other than emergency operating procedures. A problem resulting from this lack of guidance is that licensees may not see the benefits of procedure upgrade programs or, if they do, they may overestimate the efforts necessary to implement such programs. However, many sites have made connitments with either the NRC and/or INPO to upgrade procedures. Licensees somet'aes committed to procedure improvement programs as part of regulatory

' improvement programs, i.e.. only after they had experienced serious problems with procedures. Another problem resulting from the lack'of guidance on pro-cedures is that licensees may not question the suitability of their procedure programs until they experience en event (s) that was clearly the result of.

procedure problems.

It shouldLbe noted that merely having guidance for emergency operating pro-cedures (EOPs) does not ensure the E0Ps that are produced will be of an acceptable quality. An August 14, 1986, Information Notice 86-64, " Deficiencies in 'Jpgrade Programs for Plant Errergency Operating Procedures," described audits and reviews in which the E0Ps at certain facilities were found to be deficient. The April 20, 1987, Supplement I to the information notice restated the importance of developing, implementing and maintaining high quality, upgraded E0Ps.

Some sites may appear to have no need for procedure improvement programs because few significant events were experienced that were attributed to deficie,.cies in procedures.

It is possible that the potertial for problems in this area may not have been recognized.

The administrative controls section of Standard Technical Specifications includes general requirements regarding procedu ms (in Subsection 6.8).

For example, there is a requirement that written procedures be established, imple-mented, and maintained covering activities such as surveillance and testing activities of safety related equipment. There is a requirement that the procedures be reviewed prior to implementation, and periodically thereafter as set forth in administrative procedures, e.g., once every 2 years.

(Itshould be noted that, in current practice, this requirement can be met indirectly by 12

_m_.

p ;.

performing a procedure successfully within the required time period, thereby -

establishing that the procedure is not unsuitable). However, there is some evidence that additional requirements and guidance in this area might be useful A recent report of the results of a study of operating procedures at nuclear power plants (NUREG/CR-3968*) includes findings that:

Operating procedures are often vague and ^ ;k specificity, and typically fail to conform to accepted human factors principles.

Licensee staffs have stated a belief that NRC requirements were leading to an unmanageably large number of procedures, although it appeared in some cases that licensees were writing procedures as the least costly and time-consuming way of perfor1ning corrective action.

Many plants have a system for reviewing uew and revised procedures that results in long delays in formal procedure changes.

There is' frequently little t.: ordination between the training department and the individuals responsible for vriting or revising operating procedures.

Plants generally do not validate and verify new or changed procedures to ensure they are usable.

Based on the findings, NUREG/CR-3968 recommends that the NRC, working with industry, identify those tasks at each plant that should be performed by procedure, and that i

f the NRC should require an upgrade program for the procedures that are so identified.**

q It also recommends that the NRC evaluate the desirability of requiring verbatim compliance with procedures, and that the NRC and industry determine when a high-level I

safety review (such as that performed by a plant review committee) is required. A report of a review of maintenance procedures *** described similar generic deficiencies I

for those p;ocedures and recommended the NRC require upgraded programs for the development, use, and control of maintenance procedures.

• " Study of Operating Procedures in Nuclear Power Plants: Practices and Problems,"

NUREG/CR-3968 February 1987.

• • The procedure upgrade program would include elements such as reouiring use of j

a procedure writers' guide, programs for procedure verification and validation, and training in the use of procedures.

• • • " Development, Use, and Control of Maintenance Procedures in Nuclear Power Plants: Problems and Recommendations," NUREG/CR-3817. January 1985.

l 13

4.0 REVIEW OF EVENTS AT SELECTED SITES During the November 1986 to January 1987 time period, a series of site visits and discussions with Resident Inspectors and licensee staffs was made to review events that occurred and the role that procedures played in those events. The five sites visited had reported 26 significant events that involved procedures (of the 101 total of such events that had occurred over the time period of this study). Two of the sites (Brunswick and Turkey Point) had :nade fonnal comitments to the NRC to implement procedures upgrade programs and three of the sites had not (Catawba, McGuire, and Zion). A comparison was also made of the perceptions at these sites of the role of procedures in events.

Appendix C includes the results of the site visits.

The 26 events at the five sites were categorized by the way in which the pro-cedure was involved in the event.

The results are sumarized as follows:

Number nf Category Events Programmatic Problem 31 Procedure Defect 9

Failure to Use/ Follow Procedure 2

Procedure was Interim Measure 2

Condition Observed 2

Total 26 The greatest number of events (11 of 26; roughly 400 involved a programmatic problem, that is, a procedure change (si was one of a number of actions necessary to prevent recurrence. This finding is important because it indicates that a deficiency in a procedure may be symptomatic of other existing problems or of deficiencies in similar tyocs of procedures.

Approximately ore-third of the events (9 of 26) were categorized as being the i

result of a defect (s) in a specific procedure. There was no evidence found in these events that the definition of the problem had been limited to enable a quick resolution of the problem. This finding was evidence that even small deficiencies in procedures can lead to significant events, l

1 14 I

The remaining six events fell into three categories.

In two events, personnel failed to follow a procedure.

In two other events, procedure changes were implemented until equipment changes were made.

In the remaining two events, defects in procedures were detected primarily as a result of a procedures upgrade program.

These results appear to indicate that significant events ascribed to human performance problems should always be considered as potential programmatic problems. That is, possible causes and contributing factors should be analyzed.

During the review of events and procedure programs at the sites, a number of observations were made regarding the role of procedures. Perceptions and attitudes about human performance varied from site to site and were largely characteristic of the particular management at a sita.

For example, while personnel at all sites seemed to agree on the importance of procedure cuality, there was a wide viriation in the level of effort that shr.'d Se maintained to achieve this goal.

The sites with established procedure

. m ment programs were enthusiastic about the continuing benefits of the programs and stated that there were plans to expand the programs (from surveillance procedures to maintenance procedures, for example). Those sites had initially adopted programs in respotse to some adverse regulatory action.

Sor,a plants may develop inaccurate perceptions of human performance problems.

This may be due to (1) an unawareness of the complexity of the underlying factors (due to lack of thorough event investigation); (2) an unwillingness to acknow-ledge personnel performance problems due to deficiencies in personnel cualifi-cations, training or environment; or (3) a desire to quickly "close out" an LER, when the complete action to prevent recurrence is far-reaching. These inaccurate perceptions may then lead licensee personnel into taking inappro-priate or incomplete action when responding to operating events.

For example, one site experienced a loss of decay heat removal capability while shut down and developed emergency response procedures as the corrective action. Another site experienced a loss of decay heat removal capability, but determined that 4

in addition to procedure deficiencies, there were also potential problems with the level indication systen (an equipment design deficiency). The lessons of 15

4 -

operating experience cannot be learned nor passed on to others if there is a failure to investigate and analyze operating events thoroughly.

5.0 FINDINGS Based on a review of LERs of significant events during 1984 and 1985 that involved proedures, several observations can be made:

1.

The overwhelming majority of significant operating events in 1984 and 1985 that involved human performance problems were at least partially due to licensees' procedures.

In each year, licensees reported that procedures were a contributing factor in about 85% of the significant events that ir.volved human performance.

2.

During 1984 and 1985, significant events involving procedures occurred more frequently at plants with little operating experience than at more mature plants. Twenty-five of the 101 total events occurred at plants within 2 years of initial licensing, or at a rate approximately 27% higher than that for more mature plants. The average rate of occurrence for plants at single unit sites was slightly higher than that for plants at multi-unit sites, ino1 citing that plants at multi-unit sites benefit from the experience of other.sants at the site.

3.

Significant events involving procedures were reported more frequently at some plants than at others. For example, 23 of the 101 total events took pisce at five plants (87 units were operating in 1984 and 95 units were operating in 1985), and 44 of the 101 events took place at 12 plants.

Similarly, events were reported more frequently at some sites than at others.

For example, although 40' sites experienced 101 events over the 1984-1985 period, 30 of these events occurred at only five sites, and 78 of the 101

)

events occurred at 17 sites (23 multi-unit sites operated in 1984 and 25 in1985).

I 4.

Significant events involving procedures occurred as frequently while operating as while shutdown, indicating that procedure quality is 16

)

i required _for all phases of plant operations. The residual heat removal (RHR) j system (decay heat removal mode) was the system most frequently involved in~

significant events that involved procedures (7 of 30 events in 1984 and 6 of I

20 events in 1985)'while shutdown.

(Loss of PWR RHR events was the topic of Case Study AEOD/C503, dated December 1985).

i

)

5.

Significant events in 1984 and 1985 that involved procedure deficiencies occurred in equal numbers due to problems with administrative / management l

control, operations, maintenance, and testing procedures. Maintenance procedure deficiencies contributed to 10 of the 18 of the events that also involved a reactor trip.

6.

In the majority of the events (75 of the 101 significant events that involved procedures) procedures were characterized as incomplete rather than incorrect or unavailable. Because it was stated thet a person failed to follow a procedure in only three events, personnel usually follow procedures in situations that could result in significant events. Problems arose because of deficiencies in procedure content or in the way information was presented.

7.

All types of personnel were involved in the events involving procedures.

8.

Procedures upgrade / improvement programs helped identify problems that might not otherwise have been detected in a timely manner.

6.0 CONCLl;SIONS Based on a review of LERs of recent (1984-1985) significant events, and of current requirements regarding procedures, the following are concluded:

1.

Problems associated with proceduree have been a major contributing factor in a high percentage of significant events. The problems were experienced 17 i

'4r

~

in all modes of operation, by cperations, maintenance, and test personnel performing a variety of activities. That_is, the problem is a generic one and a1 systematic approach must be taken in resolving it.

2.

Training and' accreditation programs should be reviewed to ensure that the programs adequately stress the ways in which procedure problems can arise and how these can best be avoided.

3.

Current requirements and guidance regarding procedures may not be adequate to ensure quality procedures are always used. A recent study'(NUREG/CR-3968) found that (1) some licensee staffs believe they are being forced by growing regulatory requirements to maintain an unmanageable number of. procedures; (2)_ operating procedures in use are often vague and lack specificity, and fail to conform to good human factors principles; and (3) many plants have untimely' procedure change processes, do not coordinate with training activities the preparation of procedures, and do not adequately validate and verify new and revised procedures.

4.

Because of-the lack of standards for procedures, low procedure cuality is not evident until it can clearly be shown that procedure deficiencies were a factor contributing to an event (s) or poor perforinance (with respect to regulatory requirements). That is, the quality of a-licensee's procedures currently has no influence on the indicators of a licensee's performance until an event occurs that can be clearly traced to procedure problems.

l l

18

pl4 ll b

'Page No.

g 08/27/67 APPEN0!! A.!

CHARACTERISTICS OF $16NIFICANT EVENTS PONER EVENT LER NO.

Pluf SYSTEM (1) MODE TYFE PROBLEM CCMMENTS 02964013 TANKEE RONE 480V POWER 100 1 EQ FAILS, COMP 15584001 816 ROCK POINT RDS 03 E9 INOP, VALVES 20684012 SAN CNDFRE 1 CCN 05 FRDC LDSS OF RHR NRONG TRAIN EVENT: CCW NAS AllGNE! 10 HI IFAT OID NOT HAVE SALINATER FL0N. ADMIN CONTROL PROGRM CHANGES INCLUDD,

--lNTRO 0F FLANT STATUS CONTROL PR06

-UP6RADED SHIFT CHANGE 0VER PROCEDURES

-SALINATER LINEUP PROC CH MBES-213B4013 CONNECTICUT YMK REFUELING 06 FROC RI CAV DRAIN KEFUELING SEAL FAILED AND 200,000 SAL CF BDFATED WATER DRAINED FROM RI CAVITV. EEFUELING AND EMER6ENCY FROCEDURES CHM GED MD ED DES CN CHANE D 21!540!? CONNECTICUT fut RI C0hiROL 06 ED DE6 PAID. EQ NHILE FERFORMlW6 ROUTINE S'JRV AND CALIBM.ilth.

CBSERVED R1 CONTROL CABLINE INS"LATION %AS DEGRADE 0 DUE TO AGING

.4384020 CONNEti! CUT iANK SG 0$

PROC RAD DVEREIP MECH Mit REC'D EICESSIVE RAD DDSE DURINS SS NCRK 9ECAUSE UNGUAL'ED HP TECH HAD BEEN AS!!BNED.

PROCEDURES CHANSD 10 tiETTER CONTRDL Ff& Elf.

21364023 CONNECTICUT YANK EDS 06 PROC FAILS, ED3 EDB OUTPUT BREAFER FAILED TO CLOSE AUTOMATICALLY ON A NUMBER OF DCCAS!DMS CUE 10 C Fif RELMS.

CLEM!NS OF RELAfS INCORPDF AID INTO PM FROSPM.

219940!! DYSTER CREEL SB6TS 05 E9 LDSS. SBIS BOTH TRAINS OF SBGTS INOP FOR 9 MIN DUR!kB PM DN circuli BREAKER DUE TO DESIGN CEFICIENCY 21968015 DYSfER CREEK RFS 0$

C0 RELAY FOSING HF A RELAYS IN RPS FOUND 10 PE F0GGINS. CAL'SE UNK.

SUPPLEMENTMV REPORT 10 BE SUBMITTD 21984017 OYSTER CPEEF ELECTRICAL 05 FR0C INDP,SYS CONT ISOL VALVES REPOSITIONED FECAUSE OF LIFTED LEAD. STATION ADMIN FROCEDUFES TO BE MODIFIED TO INCORP PRECAUTIONS ABOUT LIFTEC LEAIS 2:584023 OtSIER CREEK CONT ISCL 0$

EQ CSGN DEFECT CCNT ISOL VALVES DID NCr FAIL CLOSED UPON LOSS OF INST AIR DUE TO DESIGN CEFICTENCY 21994028 OfSTER CREEL ADS 12 2 PROC FA!L. VALVES DURING STARTUP Suhv!!LLANCE TESilN6 2 0F 5 ELECROMATit RELIEF VALVES FAILED 10 DPEN.

MAINTENANCE PROC REVISED 10 INCL BENCH TEST.

22004004 NINE MILE PCINI 1 CORE SFRAY 05 00 ISSCC TRANS6EAKULARSTRES$CORROSIONCRACK!N6DUEla EXPOSURE OF COPE SPAAY PIPING TO CHLORlDES 23764003 DRESDEN 2 CORE SFRAY 98 1 EQ INDP. VALVE CORE SPRAY VALVE (IN DNE OF TN0 LOOPS) FA! LED TO OPEN DURING OPERGILITY TEST DUE TO P00R DES!6N.

23784007 DRESDEN 2 LPCI 32 EQ LOSS. SYSTEM DURING STARTUP MAINTENANCE OPERATICNS, IT WAS NOTED THAT LPC1/CCSN WAS SUBJECT TO SINGLE FAILURE 23704010 CRESDEN 2 LPCI 52 HFNP LOSS, LPCI EA SENT TO NRONG BREADER DUE 10 DEFECTIVE LABELING. S!NSLE FAILURE (CONTROL POWER LOST TD BOTH LPCI INJECTION VALVES) 16D4 23764020 DRESDEN 2 FIRE SUPPR 04 PROC VLV NISPOS FRDCDURES NERE KVISED TO ADD HOSE STATICWS.

BUT SURVE!LLANCE PROCS WEEE NOT REVISED TO INCLUDE THE CH M6ES 24464001 GINNA S1 9B 1 EQ INOP. COMF S!NSLE FAILURE Dr N2 SYS COULD DISABLE ALL S!

ACCUMULATORS. CLEM!k6 AhD CALIBRMICN NAS PERFORMED

1l :4-

/

Page No.

2 08/27/B7 APPENDl! A.1 CHARACIF,.RlSilCS OF SIGNIFICANT EVENTS 1

l POWER EVEhi l

LER NO.

PLANT SrSTEM (U MODE TyFE PROBLEM COMMENTS AND PM FOR SIMILAR OTHER SVS VLVS TO BE REVIEWED 24484005 GlHA RHR 03 EQ LDSS OF RHR RHR SUtil0N VLV FAILED 10 STROKE OPEN FROM THE CDNTRDL ROOM. CAUSE NOT STATED 24504008 MILLSTONE 1 CORE SPRAY 05 CD

!GSCC 24764011 INDIAN POINT 2 CCW 06 ED LDSS,CCW CCW LOSS EECA'JSE SERVICE WATER LEAKASE FLODDED THE CCW COMPARTMENT IStSTEMS INTERACTION)-

24764012 INDIAN POINT 2 AFW 06 EQ LOSS,AFW MDAFW PUMPS FAILED TO START DUE 10 FAILED RELAYS.

RELAYS FAILED BECAUSE OF ENVIRONMENTAL FACTORS.

24764022 !CIAN POINT 2 AFW 100 1 PRDC !O. "ALVES fi! RING MODIFICAi!DN DURING SUMMER Oc 1984. WIRES NERE DISCOMED EUI NOT RECDMED, AND 'HIS WAS NCT !H M Bf DCSI-MODIFICATION TESiitS. -(THESE TURB RE DRIVEN AFW PUMF ?SDLAilDN t'ALVEE NUST ISDLA!E MDAFW PUMPS IN THE EVENT OF A Sin ERrl 24784025 INDIAN POINI 2 31 107 1 PFCC LOSS. S1 1NC3FRECT FLUS 4 PROCEDL'RE 24784026 INDIAN POINT 2 51 04 EC LSSS. S1 FAILURE CF !! ON DEMAND. EVALUA1E N CDNJUNCi!CN WITH 24784025 25084007 TUR*EY POINT 3 4100V ELEC 100 1 HFNP TRIP. DUAL R1 hCCLEAR TURB!NE OPERATOR WAS OPENIP DOOR TD BR*R CU3ICLE WHEN CONTACT OF DDDR WITH SOLT CAUSED VIPRAi!DNS THAT ACTUATED PELAY AND TRIPPED UW11 4.

UNii 3 iRIPPED WHEN VC0R WAS CLDSED.

25084018 IURKEf POINT 3 RHR 100 1 CD INCP, VALVES 10CFR21

'25064032 TURKEY P0lWT 3 AFW 100 1 FRDC iS VICLATION TECH SPEC UNCLEAR 25084038 TURtEY POINT 3 ED6 05 EQ INDP,ED6

'B'ED6 CECLARED CUT OF EERVICE 10 REPLACE 12 SECTION DF VENT LINi (LEARINS) WHILE THE 'A' ED6 WAS O'JS. THE VENT LINE WAS PEPLACED IN 3 MIN AND THE 'B' ED6 WAS BACK INSERVICE IL 1:12.

25184005 TURKE POINT 4

$6 0$

CO CPACK. M I!LE LPT REVEALE: 270 OESSEE CRACK IN S6 N0ZILES 25164017 TURKEY P01h1 4 RPS 100 1 FR3C IRIP.AUiD P! INSTRUMENT AIR PR0!LEM 25484005 CUAD ClilES 1 RECIRC 02 CD IGSCC 25484012 GUAD C!ilES 1

$6TS 05 HFNP LDSS, SBIS SECAUSE OF AN INCORFECT ELECTRICAL FM NT,

,10MPERS WERE INSTALLED ON THE WRDNS TERMINALS CAUSING BOTH SESTS TRAINS TD ikiP.

25484014 GUAD CITIES 1 LFCI ISDC) 02 ED LCSS LPCI LPCI UNAVAILABLE FOR SDC MODE OF RHR BECAUSE OF A WIKING DIABRAM ERROR PADE FOR A 1990 MOD.

(ND PROBLEMS WERE EXPERIENCED AFTER THE 1980 MCD tECAUSE THE MOTOR DPERAIDPS ON THE "LVS ti THAT

?!ME WERE EDU!PPED WITH BRAKES) 25584021 FALISADES RCP 60 1 E0 FAILURE.RCP RCP fEALS FAILURE.

LER SUPPLEMENT WHEN THE INVESil6AilCN IS CDMP 25984012 BR3m S FERRY 1 RHR (SDC) 03 EG LCES OF RHR 25984013 BRO MS FERRY 1 EECW/RHR$W 97 1 C0 DSSN DEFECT 25964018 BROWNS TERRt 1 MSIV 96 1 E9 FAILS. MSIV AEDD/i420 25984021 BROM S FERRY 1 ADS 100 1 CD DEGREED FIRE SEFARATIDW DESRACE0: 10CFF;1 25904022 BROMS FERRY 1 E RM COOL 96 1 CD CSBN DEFECT 25964070 BRDWNSFERRY1 BLDS STRU 99 1 CD DSGNLEFECT 25964032 BRO M S FERRY 1 CORE SPRAY 100 1 PROC I W, VALVE AEu0/C501. PCSi MAINi, TEST INADE2" ATE 25984037 BROWNS FERRY 1 RPS 100 1 CD CS6M DEFECT R5S NIK!NB NDI DUN IN C0hDUlf AS EE3 1.

.e Page No..

3 09/27/97 APPENDir A,1 CHARACTERISTICS OF SIGNIFICANT EVENTS POWER EVENT LER NO.

PLANT SYSTEM m MODE TYPE PROBLEM COMMENTS 26084000 BROMS FERRY 2 RECIRC 05 CD IBSCC 26384007 MONTICELLO RECIRC 05 PROC FAILS, ERKR RECIRC M6 l'RrR FAILED 10 CPEN FEMOTELY.

PM PROCS ARE TD DE FEVISED TO INCL LUBRICAi!0N PROCEDURES BURING circuli BRKR DVEPHAUL '

263840!! NDNTICELLO RECIRCERNR 05 CD 16 SCC 27094001 DCONEE 2 RB SPRAY.

100 1 FROC LOSS, RB SPR WRDNS TRAIN EVO T; DURIN6 PERFORMANCE OF VALVE LIEUP FOR TEST, OPLRATOR ISDLATED THE RB SPRAY TRAIN NOT l'NDER TEST (BOTH WERE INDP) OPERATOR FAILED 10 OBTAIN A NORKING CDPf 0F THE PROC AND FAILED 10 FOLLON THE PROCEDUEE. ALSD SUPERVISOR GAVE INSUFFICIENT INSTRUCTIONS TO PERSONNEL.

27164019 VERMONT YANKEE VAR 0$

EQ INCF. COMP 10CFR21 27124022 VERMONT YANKEE ED6 100 1 ED INDP ED6'S TND ED6"S NDP FDR 16 HOURL. FEDELEM UNIOUE TO VY RELAYS.

272840:0 SALEM 1 RC 06 EQ FAIL, VALVES FLON RESTRiti!DN IN RC LOOP RIO BfFASS LINES DUE 10 STEM-TO-DIEK EEPARAi!0n DF ISOLA 1 GN VALVES. SEE 311-84-001 27284012 SALEM 1 SI 06 ED FAIL. VALVES STEM-TO-D!SK SESARATION FR0REN FREVIOL' SLY DOCUMENTED !N 272-04-010. IE IN 83-65354-48 27284014 SALE 9 1 EI6 06 FROC LOSS. EDS DUE 10 LESS OF ALL SEFl!CE NATER. D!ESEL 1A RAN WITHOUT 100 LINS NATER. THIS NAS EE 10 LACK OF PROC AND/0R A/M CONTROLS 10 EkSLFE ELECTRICAL SYSTEMS REMAINED DPERABLE 27284015 SALEM 1 PCP 06 CD iS ERROR DISCREFANCf BETWEEN TE AND SAFEiY N LfSIS RESARDINE T4 NUM5ER 08 FC LDGPS EEQ'r !0 EE DPERABLE IN MODE 3.

27284017 SALEM 1 HHSI O6 E2 FA!LS. CCP CENT CHARSI G PLM 541 LED # iErr 10 EEC 0F SURV TEST 4SE!!EDI DUE TO META 4 ANDRESINPART!CLES.

POSSIBLE COMMON MCIE FA!LUFE 27584006 D1:BLD CANYON 1 4.lotVELE D5 EQ FAIL. CCMPS FDUR 4.16 FV CIRCULI BRtR$ FFILED TO STAf CLCSED DUE TO EICESSIVE WEAR OF TEFLOW C0ATED FlBER6LAS SLEEVE BEAR!N65 27584013 DIABLO CANf0N I ECCS 03 FROC INOF.ECCS WHILE IN MDDE 3. LD'S PREVENTED OPENING OF BIT INLET AND OUTLET VALVES IN ORIER TO FERMIT FILLING WITH 121 PORIC ACID $0LN, ALTHOUGH TE REQ'O THE ECCS FLONFATH FROM THE CHAE'61NG FUMPS THRU THE Bli TO THE RCS. OPERAi!NG PROC FEVISED 27784000 PEACH BOTTOM 2 SB6TS B01 EG FAILS,$6TS 27784010 PEACHB0110M'2 RECIRC 05 C0 16Stt 27704016 PEACH B0iiOM 2 RECIRC 05 CO 16 SCC 27864003 PEACH BOTTDM 3 CORE SPRAf 100 1 EB INCP,CS 27884005 PEACH B0iiDM 3 RECIRC 04 CD 16 SCC 27884009 PEACH BOTTOM 3 HPCI 100 1 EQ INDP, DECLPD HPCI DECLARED INDP KCAl!EE A 2ND FAILED HANGER WAS IDENTIFIED ON THE STEA9 SUPPLY LINE 281840!! SURRf 2 EDS B5 1 CD DSGN DEFECT 28584000 FORT CALHOUN

$6 03 CD 16 SCC 28694010 INDIAN POINT 3 BATTERY 100 1 CD DSSN DEFECT 10CFR21

' 4 '.

Fage No.

4 08/27/B7-APPENDl!A.!

CHARACTER!STICS OF S!EN!rlCANT EVENTS POWER EVENT LER NO.

PLANT SYSTEM m MODE TYPE PROBLEM COMMENTS 28684015 !NDIAN PDINT 3 0FFS!TE P.

05 ED LOOP PIECE OF METAL WAS BLOWN SY HI6H WINDS INTO THE A AND B PHASE BUSNORK OF THE STATION AU1 TRANSFORMER CAUSING A PHASE-TO-PHASE FAULitLOOPl 29784006 0CONEE 3 SB 100 1 EQ LEAK,56 TUBE MULTIPLE TUK LEAKS 29384005 PIL6 RIM SRV 05 EG FAIL, VALVES LAB FOUND SRV'S DID M T RELIEVE AT CORRECT PRESSURE BECAUSE CF CORROSION ETWEEN SEAT AND DISC 0F i! LOT VALVE.

293B4009 PILGRIM PCIS 0$

EQ FAILS, RELAf HFA RELAY (GE PROBLEM PREV 10USli IDENT!sIED! FOUC HDT AND SM0 KINS 29388019 5!LERIM PCIS 12 EQ DSSN DEFECT FALDE PCIS BECAUSE OF DES!6N CEFECT 295E4031 ZION 1 RHR 3$

FRD; L;SS OF FHR TOPREVENTSECURRENE.

-WILL MODIFt PCS :2AIN00E FR00

-CONSIDER HARIPIPD LVL 10 sis

-EMER FRDCEDUPIS WILL BE DEVELOPED FOR LOSS OF PHE EVENTS AEOD/C503 29694001 BROWNS FERRY 3 EDG 05 E2 DG CVERHEATD CG DVERHEATED DUE TO CLAM SHELLS ELOCKING THE EMER EDU!P C00 LINS (EEC) SYS WATER INLE!

29684004 BRCWNS FERRY 3 F;HR 90 :

E9 FAILS, VALVE 29684006 PRDWNS FERRY 3 REClRC 05 CD ISSCC 29664013 BROWNS FEERY 3 HPCI 05 PROC IN0F,HPC! DURING STARTUP AFTER REFUEL!NS DUiAGE. HPCI OtfTBOARD STM ISOL VLV WAS FOUND TO BE INDP DUE TO POTOR FIN!0N GEAR EE!NG INSTALL D BACKWARDS AFTER MAINTENANCE 29884007 COOPER SBGTS 70 1 PROC LSSF. S6TS CONSTRUCTION BULLD0?ER SHEARED FIRE HYDRANT A C REDUCED FIRE FROT SYS PRESSURE. STARTINS THE FIRE PUFFS TO RESTORE PfESSURE CAUSED WA*ER HAMMER THAT CAUSED FLODDINS OF BOTH SBBTS TRAIN CHARC0AL FILTERS RENDERING THEM INDP l0:54012 CRYSikt RIVER 3 ABES 99 1 EQ LSSF. ALES INST AIR SUPFLY LINE WAS BSDi'.EN 13 THE LAMFESS FOR THE AUX BLD6 E!HAUST STS (ABES) FANS REG U INS BOTH PA!RS OF FANS INOP 30284013 CRYSTAL RIVER 3 HP!

100 1 PROC TS VIOLATION FAIL D 10 DOCUMENT TESTING OF HPI FUPPS AND DIVERSE CONT ISOL 304B4013 !!DN 2 CONT. FAN C 06 CD DEGRADO EDDY CURRENT TESTING REVEALED PITTINS IN THE CONTAINMENT FAN C00LER CDILS 30464015 Il0N 2 MS!V 100 1 EQ FAILS, COMP 20564018 KEWAUNEE FCU 100 1 PR3C DESR*.DED FAN C0!L UN!iS (FCU'51 F0F ESF ECUI5OT CDOLIN6 FOUND UNMRS!!D AC TO HAVE FLOW REDUCED FROM FOULED FINS. SERVICE WATER SIDE CLOS 6ED E!1H SILT. PM PR06 RAM INSTITUTID.

30584021 KEWAUNEE SI 200 1 PROC INCP. S!

ERRORS IN PONTHLY SURV PPOCESPE FESULTED IN THE

' BORIC ACID TANX SELECTOR' SW KI G ALlGNED TO THE WRONS BORIC ACID TANK BECAUSE (T607).

-SURV PROC IID WOT HAVE SISN0FF 0F STEDS CD INDEPECENT VERIFICATION OF STEPS

-SHIFT TUREVER CFECKLIST CID WOT RE9U!FE THE e _ _- - _ _ _ _ _

c

[.

Pap No..

9 L D

08/27/87 APPEGli A.1 CHARACTERISTICS OF $16MIFICAuf EVENTS POWER EVENT LIR NO.

PLANT SYSTER

(%) EDE TYFE PROBLEM

'COMENTS I

TAR SELECTCR !W LE IN TFE CORRECT POSSIi!0M

-P00R COM PETWEEN THE ILC MAN AND CR OPERATORS 30984011 MAINE YANKEE RPS 100 1 EQ FAILS, BRtR RTB PADDLE FOUND TO IE CRACFED DUE TO INCOMFATIFLE MATERIAL PROPERTIES 31194001 SALE 9 2 RCS/RTD 05 EQ FAIL, VALVES RfD BYPASS LINE BLOCKAGE DUE TO STEM-TD-DISK BEPARAT!DN IN ISOL VALVE 31194016 SALEM 2 HPI -

100 1 E9 LEAK,ECCS 31194018 SALEM 2 POPS 66 1-EG TRIP. All10 FI 3:194019 SALEN 2 CONT.SPFAY 04 HFNP INDP. SYS-DURINS C00Lt3NN 10 NDDE 5. 150LA'E3 FOTH CS PU*PS WHILE IN MODE 4 ACTUALLY A REFORT 0F TWEEE EVENTS INVOLVING H2 SEAL DIL. CC2 TAR E9FiiED.

& SRV LIFTED WI PAETIAL WI LDEE.

31CB4015 RA G O SECO.

H2 SEAL 0.

55 i PROC ! RIP. AUTO RI INAD MAN LVL CONTRCL C E ED F2 SEAL DIL rRESSURE TO DECREASE ALLOWING H2 TD ESCAPE, REST lLT!N6 IN '

EIPLCSION AND FIRE. TURE!NE!BENERAIDR WAS MACALLY TRIPPED HD RI TR:F'ED tM ANT:CIPATDRV TRIP FM TURBINES. CHAN6ES INCLUDED,

-CASUALTY PROCS FOR H2 SEAL CIL SYS

-NN! MD ICS POWER SUPPLY TRIP SET'CIN!S T2 f,E SET !AW MANUFACTURER RECCM9E G ilCSS

-H2 SEAL DIL PM FR06 RAM DETE5MINAi!DN

-CONSIDER CHANSES TO PM PROC 449 TO FOR NNI '

POWER SL'PPLIES AND OUTSIDE 460 circuli BROS 31284024 RANCHO SECD.

RCS 03 PROC IEBDRAT!DN FLANT HEATUP hAS BE60N WHILE A EEBORAi!0N WAS IN PR06RESS BEC E E OF F002 EH1Fi G R0"ER MD OTHEt (E.S..CCMONICATIOUS) It0CEDU5EE 1304006 AND-1 H2 FUCBE 96 C3 DS6N !EFECT

!!5dAQja D.C. COOK 1 ECCS(SI) 100 FRDC LSSF DURING SCHEDULED PPV 14 ECCi. SLD IS?L THE NORTF LSHI PUMP RATNER THM THE SOUTH PU** (THE SOUTH PUM8 HAD ALREADY PEEN TAFEN OUT F SERVICE). THIS ERROR WAS FOUND DURING THE VERI 5'CATICN. THE PROC WILL PE S!MPLIFIED BY TESTINS EACH TRAIN SEPARATELY. AE0D-C503/C504 31t,84014 D.C. COOK 2 RHR 0 *.

PROC LDSS OF RHR RHR OPERATING PROC DID NOT GIVE SPECIFIC INSTRS 10 STOP THE OPERATINS PUMP PRIOR TO STARi!N6 THE THE SECOND PURP WHILE Ai HALF LOOP (10 PREVENT AIR $1 E IN6) 31694035 D.C. COOK 2 RCS 03 E2 LEAKAGE,RCS 31761005 CALVERT CLIFFS 1 (CW 100 1 EC CORROSION SIGNIFICANT AMOUNIS CF CORRDE!DN N0!ED CN THE CCW AND SN HEAT EICHMBERS. EXPACED PM PROG FOR CAST IRON COMPS IS EEINS DE" ELOPED 32084014iMI-2 RCS 05 PROC NONREP SAMPL NON-REPRESENTATIVE RCS SAMPLES WERE OBTAINED BT CHEM TECH BECAUSE,

-CR OPERATORS FAILED TO FROFERY Al!6N AE VERIFY THE PDS!i10M OF A VALVE (EVEN AFTER PEINS TOLD BY THE TECH THAT THF FLONRATE WAS NOT CORRECT)

-FAILURE BY CHEM TECH TO PELIEVE FL3NRATE 1%3

p Pap No.

6 08/27/67-APPENDl! A.1 CHARACTERISTICS OF SIGNIFICANT EVENTS POWER EVENT LE'4 NO.

PLANT SYSTEM m MODE ifPE PROBLEM COMMENTS 32184014 HATCH 1 RCS 05 CD ISSCC 32184019 HATCH 1 RHREW D5 CO CONSTR, INAD MAINT PERSONNEL NOTED THE OUTER CLAMP ON THE SEISM C RESTRAINT FOR THE 'B' RHR SERVICE WATER PUMP WAS MISSINS; PROBABLY SINCE IT WAS LAST REMOVED ON 9/lB/E:

32184'.C5 HATCH 1 PCIS 05 CD CRACK. WELD 131 MP INSP 32484011 EPUN5 NICK 2 RHR 0$

FRDC ACT, AUTO RPS tMILE ATTEMPilNS TO LOWER THE SUPPREES10N POOL.

THE OPERAIDR MISCONCEIVED THAT THE B LOOP SUE-SYSTEM 0F THE RHR SYSTEM NAS IN USE F09 SUPPRESSION POOL C00 LINS. HE OPENED THE RHR SYS CISCHARSE VLVS TO THE UNIT 1 ? 2 C0904 PAD WASTE SYS. CREA11NS A FLOWPATH FECM ?HE RV TO TO THE RAD WASTE SYS. ERR 0NEDUS EUPP ESSICN ERR 0NECUS SUP P00'. LVL !ND WAS DL'E 70 INCOMP PROCEDURES FOR CILLl45 AND VENTINS.

32584001 F UNSW CK 1 RHPSW 100 1 EQ DEEN tEFECT DURINS ATTEMP! 10 INITIATE SL'PPPESSION P00L C00 LINS BOTH RHREW PUMPS TRIPPED WHEM !!ARTE:

DUE TO AIR IN SUCTION P! PINS (DES 1E1 PROBLEM) 32584009 BRUNSWICK 1 CORE SPRAY 100 1 E2 DSSN DEFECT AECDIE!!!. MINIMUM FLOW BYPASS.

32584017 ERUNSWICK 1 RWCU1FECRC 04 CD ISSCC 3258 025 BRUNSWICK 1 ELECTRICAL 99 1 E9 IRIP, AUTO RI LISHTING STRIKE.

32724030 SEQUDYAH 1 INCCRI dei 30 1 FROC LOCA HISH PRESSURE CC1NEC110N CW THE THI?BLE TUBE AT THE SEAL TABLE FAILED DURINS CLEANINS OF THE INCCRE CETECTCR THlMBLE TUBEE WHILE AT D ER 27840!2 SEQUDYAH :

RPS 10 i CD DSSN DEFECT 33194028 ARNDLD hPCI 02 ED TRIP,AUID RI HPCI !%3AED SIM EUPPLY CONit.IN1ENT IE0L VLV CLOSU;E NE 10 DESIGN LEFICIENCf !N IFE HPCI STEM LEAK CETECi!DN SYSTEM 4

33124029 AROLD SLCS 100 1 PROC INCP, SBLCS CHEM TECH MANIPULATED WRONS VALVE 10/11 DURINS SURVEILLANCE AC !$0L THE EBLCS UNT!L THE ERFOR WS DETECTED 5 HOURS LATER. NUMEROUS DEFICIENCIES CONTRIBUTED TO TH!B ERROR 33364021 FliZPATRICK RECIRC 05 CD ISSCC 334 N 14 BEAVER VALLFY 1 SNUBBERS 05 EG INDP,COMF CIL DRAINED FRCM PEEERVOIR CF HYDRAULI: 51UBPERS 33624003 MILLSTONE 2 SI 03 HFNP TK LVL INCOR NOT CLEAR FROM THE LER EIACTLY WHAT iPE PRCBLEM WAS HERE.

339S4010 NORTH ANNA 1 VhlHCV'S) 05 PROC MOV SETFDINT IqRQUE SW SETilNSS USED IN ELEC PA!NT CN r0V'S WERE INCLRRECT. 00E 10 INCORRECT PRDC AND TO 1NA0 EQUATE LABELINS OF SWITCHES 33984008 CRIH ANNA 2 RHR 05 F4P LOSS Dr RPR COMPLETE LOSS OF RHR BECAUSE CF INTRO 05 AIR

]NTO PUMPS DUE TO ERPONE0"S LVL INDICATION.

ISOL YLV 10 N4ICH LVL STANDP!PE WAS ATTACHED

{

BECAME CLOBBED. STAUFIPE CONN MS 90VED.

)

122 MINUTE LCSS

!;9840!! NORTH ANNA 2 EDS 100 1 EQ EDG TRIP 339E40:3 NORTH ANNA 2 EDS 100 1 EQ ED3 TFJPf 2) 34464005 T OJAN AFW 100 1 PROC !C P. Stk FDP A FERIOD Dr 90 MIN AFW NAS !WP EECAUSE 1

I b

=...

Pap No.-

7' 08/27/87 APFENDIX A.1 CHARACTERISTICS OF S!6N!FICAPT EVENTS POWER EVENT LER NO...

PLANT SYSTER (2) MODE TYPE PROBLEM COMPENTE THE 'A' TRAIN NAS DISABLED NHILE THE 'B' TRAIN NAS DOS FDR MAINT 34494006 TROJAN P.S 78 1 EO TRIP,AUTC R1 344B4010 TF0JAN RHR 05 PROC LDES OF FMR AEDD-C503/504 FALSE PCS LVL IND BECAUSE OF CRUD PLOCKABE AND LACK OF REDUNDANCY IN LVL INDICAi!DN SYS. PROC NAS REVISED TD PREVENT THIS FM PECURRINS 34484014 TROJAN SEAL TABLE 03 PROC LOCA

!&C PERSONNEL ATTEMPTED TO STOP A LEAK FROM FROM FITTINGS AT THE !EORE INST SEAL TABLE, BUT CAUSED THE FAILURE OF A FliTINS (AND A LOCA).

THIS HAFPENED PECAUSE THE PROCED'JE FAILED TD

'CAUi!0N ABOUT NORK DN PEESSURl!ED AND/0R HOT SYSTEMS. THIS NAS ALSD A FAILURE TS IEDRPCRATE OPERATINS EIFEP!ENCE, BECAUSE THE SAME EVENT ~

HAD DCCUPPED EARLIER AT EECUOYAH 34484016 TROJAN EDGtAFW 15 1 PROC TRIF, AUTO RI PGE LETTER TO REGION V ON R001 CAUSES IS DATED 10/01/94.

34484017 IRCJAN MSSV 50 1 FROC TRIP, AUTO RI DURINS PANUAL POWER REDUCTION AN MSSV OPDeED BUT FAILED TO EESEAT. RI P0NER NAS PANUALLY REDUCED BY INSERTINS RDDS TO ABOUT 1.21 WWEN AN AUTO RI TRIP OCCURFED. THE PSSV PESEATED AT 890 PSIS. NUMEROUS PROCEDURAL CHANGES MDE AS THE RESULT OF THIS EVENT 34484021 TROJAN SVS NATER 97 1 EQ DEGRcIED SW EERVICE NATER FLCW IN BOTH TRAINS kAS PEDUCED BECAUSE 0F CLD6 BED STRAlWERS 34694003 CAVIS-BESSE MS!V 99 1 ED FAILED. MSIV 34BB4005 FARLEY I FN 06 CD WELD !ND.S DT EIAF Ce FW 10 f5 N0!!LE FELIS REVEALED INDS 36184058 SAN DN0FRE 2 PIR 98 1 EQ PELEASE. LL POTENTIAL COMMON MODE FAILURE THAT COULD LEAD TO SMALL LOCA.

36194070 SAN DNCFFE 2 RV CAV SL 0e EQ FAILS.RVSEAL 36184072 SAN DN0FFE 2 CE!!

06 E9 LDSE. CEIS DESIBN !@NSE 9ADE 36294009 SAM DN0rRE 3 CONT EPRAY 100 1 PROC INOF. CONT S CONT CPRAv ISOLAi!0N VAL'.Es N07 f.lSNED CORRECTLY BECAUSE OF DEFICIENCIES IN ADMIN FRDCEDURES, SUCH AS CHECKLISTS, VERIFICATION. ETC. (C504) 36C84011 SAN DNOFRE 3 RFS 04 PROC DESRADED SVS DURIN6 INVEST! BAT!CN f/ ETD PROBLEM. CISC00ED THAT AUTO SHUNT TRIP FUNCTION Ha, NOT EEEN RESTORED FOLLONIN6 EARLIER 19-M0 SURVEILLANCE (VERIFICA110N PROBLEM) 7628401B SAN ONOFRE 3, RPS 100 1 ED DE6RADEDRTB 36284035 SAN DN0FRE 3 HPSI 100 1 HFNP IN0P,HFS1 LD'S FERMITTED TRAIN A HPSI SUBBROUP FELAY TESTING 10 BE CONDUCTED CONCURRENT NITH THE DRAININS OF THE SALTNATER SIDE OF THE TRAIN 9 CCN HEATEICHANSER 36684001 HATCH 2 P SUPPRESS 05 CD CRACK IN HDR CRACK CBSERVED IN VENT HEADER 36684005 HATCH 2 SBLCS 04 EO BlWCHTEST SBLCS PRV LIFTED AT A LOWER THAN E!FECTED FRESSURE WHEN BENCH TESTED 36694022 HATCH 2 RHRSN 75 1 HFNP DESRADED PHR NRON6 UNIT EVENT DURING AN ATTEMPT TO FERFORM 'AINTENANCE ON THE

e

~Page No.

0' 08/27/B7 APPENDl! 4.1 CHARACTERISTICS OF $16NIFICANT EVENTS POWER EVENT LER NO.

f1AN1 SYSTEM m MODE TfPE PROBLEM CONMENTS UNIT SERVICE NATER PUMP, PERSONNEL M!STAKENLY DISCONNECTED THE PDTOR LEADS FOR TFE !! NIT 2 PHR SERVICE NATER PUMPS

-36694027 WATCH 2 RPS/ECCS 04 HFNP M6RADED SYS HATCH !&C TECHNICIANS AND CONTRACTOR PERS0 EEL MISPDSITIONED RPS AND ECCS INSTRUMENT VALVES 36684031 HATCH 2 RNCU 100 1 EQ RNCUISOL RCNU !$0LAT10N DUE 10 HISH RDOM TEMPERATURE CUE TO LEAKABE FROM PUP.P SHAFT SEAL AND VENT VLVS.

36B84023 AND-2 RHR 05 PROC LDSS OF RHR BECAUSE OF ERR 0NEDUS RCS LVL INDICATIOM, SDC NAS LDET FOR A PERIOD OF ABOUT CNE RDUR (TEMP INCREASED FM 180 TO 205 M6REEn F.) LEVEL.

IND SYS MODIFIED AND NDRMAL AND EMER PPGCS CHANSED. (AEOD-C503)

.36964019 MC6 DIRE 1 CA VENT

00 1 5 ROC INOP. SYSTEM CCNTFDL AREA VENTILATION LOST BECAUSE C:5CUIT CARIS FAILED DUE 70 CVERHEATIN6. 8FOCECURE CHANSED TO REQUIRE HEAT SINES ON CIRCU!T CARIS.

36984019 MCSUIRE 1 VAR 100 1 E3 INSTL,1NCORK INSD REVEALED EEVERAL VALVES INSTALLED N!TH LIMITORQUE OPERATORS INSTALLED N!D T-DRAINS.

!6984025 MC631RE I CONT SttAY :90 1

• • CC SP!LL. RAD CONT SPRAY SYS VENT VALVE FOUND OFE4 (ABOUT 35 6ALLONS HAD DRAINEL). INDEPENDENT '.'ERU! CATION FEQ'T TO E ACDED TO PROCEDURES 36994029 MCSUIRE 1 UH!

100 1 EQ INSTL.INCDER 36984030 MC6UIRE I UH1 03 FRDC INSTL,lMCORR NHILE DRAININS ACCUMULATORS TO INVEST!6A?E THE HISH N2 CONTENT PROBLEM (NOTED IN LER 36994029) li NAS FOUND THE LEVEL TRANSPITTEFS HAD IEEN INSTALLED INCORRECTLY. (CONTRIBUTING FACTOR NAS INCORRECT LAPEL!N6 0F PORTS NEAR INSTALLAT 0NI

!7064001 MC6UIRE 2 RHR 05 FRDC LOSS OF RHR AE00-C503/C504 INAMOUATE BUIDANCE CN THE MAINTAIN]NS RCS LVL 37084002 MC6UIRE 2 RHR.

0$

PROC LOSS OF RHR AECD-C503/C504 37004004 MCSUIRE 2 CVCS 05 HFNP LSSF, RHR AE00/C504 PliMP CESTROYED BECAUSE CF FAILURE TO VER?FY FLONPATH.

37084014 MC60!RE 2 CCN 100 1 CD INSTL,1NC0RR ENVIR0M ENTALLY UNQUALIFIED LIMITORQUE ACTUATORS INSTALLED 37084017 MC60!RE 2 RHR 05 EQ LOCA RUPTURE IN LETDDR LINE (RHR) TO CVCS.

LOCA DUTEIDE CONTA! EENT.

37084025 MC60!RE 2 AFN 100 1 EQ DVERPREESURI BECAUSE OF LEAK!N6 SalNG CHECr VLV. TDAFN PUMD EXPERIENCED REVERSE ROTA110N AM SUCTION PIPIN6 NAS DVERPRESSURIZED 37064029 MCSulRE 2 UH1 100 1 PROC DSGN MFEFT PROCEDLRE FOR CALIBRATION OF UH] ALARM CHANGE 0 TO DISABLE CURINE CAL DR MAINT ACTIVITIES 37064031 RC6UIRE 2 PCS 100 1 EQ TRIP, AUTO RI TRIP CAUSED EV FAILUPE OF CARD 14 FRDCESS CONTROL SYSTEM (PCS) 37084032 MCSUIRE 2 CRDM 55 1 CD FAB ERROR 373B4029 LASALLE I RCIC 100 1 EQ TRIP OF RCIC SPURIDUS it!P 37364059 LASALLE 1 HPCS 04 EG FAILS. COMP HECS SISCHAREE REll!F VALVE LELLONS FAILS.

37484018 LASALLE 2 HPCS 30 1 EQ SW PALFUNCf" 37484030 LASALLE 2 HPCS

$1 1 EQ RLF VLV fsIL INT. BELLONS SEAL FAILS 374B406B LASELLE 2 HPCS 03 E9 RLF VLV FAIL :WT. EELLCNS SEAL FAILE

[e Page'No.

9

)

08/27/57 I

APPECit A.1 CHARACTERISTICS OF SIGNIFICANT EVENTS i

i P0WER EVENT LER NO.

PLANT SYSTEM t!! MODE TYPE PROBLEM COMMENTS 1

38784031 SUSQUEKAh4 1 HPCI 03 PROC 1 0P HPCI AFTER THE HPCI SYSTEM TRIPPED UPON RESTORAT10N DF RPV LEVEL. OPERATDR NOTICED THE HPCI PUMP SUCTION RELIEF VLV WAS OPEN (AND DISCHARGING TO THE PUMP ROOM). THIS HAPFEWED BECAUSE THE l

PUMP DISCHARGE CHECK VLV HAD N0i SEATED PROPERLY BECAUSE DF INSUFFICIENT DELTA P ACD05S DISK.

PROCEDUPE CHANSES WE E EVALUATED TD ADDRESS I

VALVE SEATIN3 DURING SYSTEM SHUTDOWN.

387B4040 SUEQUEHM NA 1 EDS 100 1 EQ TRIP 0F ED6

'D' EDS TRIPFED BECAUSE OF HISH TUFB0 CHARSER VIBRAi!DN, DURINS MONTHLV SURVEILLANCE TEST.

THE 'B' DS LATER DEVELOPED A STARilNG FR0BLEM.

MAINTENANCE PROGRAM CHAN6ES WIFE PADE.

1 3ES84012 SUE 2VEHA W 2 CORE SFRAY 20 1

' ROC LOSS, CS FUSE WAS REMOVED AS A BLOCKING PD!vi FOR GELSONNEL PROCTECT!DN. HOWEVER, POWER TC.CTHEE SAFETY ECUIP WAS ALSO IFTERUFiED (!MPRDPER FEMOVAL FM SERVICEI TRNS NAS CONDUCTED TO PDEVEWT TrECL'RRENCE 38884013 SUSDUEHMNA 2 4.16KV EL.

30 1 PROC STATION B.O. A0; STAi!0N BLACKDUT AE00-C506; kU/T 397B4026 HP-2 SBSTS 1A E2 INDP, SYSTEM IONIZATION DETECTOP ACTIVATED AND TFIPFEC PREACTICu SPRINKLER SYS. FRESSURE SURGE TRIPPED ANOTHER PREACT]DN SYS MD LIFTED DELU6E VLVS FOR SBSTS TRAINS A & B

!9784027 hhp-2 MSRV 04 C0 RAIL VALVES MAIN STEAM RELIEF VALVE SOLEh01DS FAIL 39784031 HP-2 VAR ELECT.

95 2 CD INSTL,1NCDRR #P. R REVIEN FOUND CERTAlW CABLES TD FE UNPRSTECTEDFROMFlkE 39784071 WND-2 RPS 04 HFI;P 1/2 BOP ISOL. SHOR!!NG IN PPS BRANCH CIRCUlf G USES /2 B0F CONTAINMENT ]SDLAT10N

'9794103kNP-2 ROOM CODL.

45 1 EQ LOSS. FMC00L 2UE TO P010R FAILURE, 000LINd kAS LOST TO RPS RM 41, DIV. I BATTERY AND BATIERY CHARBER P00E!

AND DIV. I EPER BUS 59-7 REQUIDING TFE ENCLCSED EQUID TD EE DECLARED INDP.

39784106 WNP-2 RV 42 ED INSTL,1NCORR RV FUEL 20NE LVL INDS WRON6 409B4010 LACROSEE CR0 81 EQ INOP, C F") DURINS RX SHUTDOWN ROC 29 N7JLD NOT INSEAT.

CRDM MALFUNCT10NED BECAUSE 11 hAD BEEN LODSELY ASSEMBLED AND ONE BALL EEARIWS FELL FROM A ROLLER ASS'Y 409B4011 LACROSSE EDS 03 EQ LOOP 40904012 LACROSSE ED6 95 1 EC FAILS,EDB JB F16H PRESSURE SEiWICE WATER DIESEL SUWE!LLMCE TEST FA! LURE (1 0F 2 PUMPS IN THE ALTERNATE CORE SPRAY SYS (ACS)lBECAUSE AIR WAD ENTERED FUEL LINE (WOT LSSF--SYSTEMS INTERACT!DNI 41384014 CATAWBA 1 CCW 05 CD DSSN DEFECT THE CCW COULD POTENTIALLY l'ECOME OVERPPESSUPl!ED SHOULD A TUBINB FAILURE OCCUR IN THE EEACTOR C00LMT PUMP THERMAL BARRIER HEAT EXCHM6ER 10CFR21 41384022 CATf.NBA 1 ECCS 04 PROC DESRADED SYS CLEANING PERSDNNEL OFENED BOTH CONTAIN'ENI SUMP INTAKE SCREEN B00R$ 10 FACILITATE ACCEES TO DE RB FIPE CHASE. AG DEPels WOULD ':0? HAVE FEEN

Page No.

10

-08/37/87 AFPENDl! A.1 CHARACTERISTICSOFSISNICICHTEVENTS POWER EVENT LER NO.

PLANT EYSTEM (I) MODE TYPE PROBLEM COMP.ENTS PREVENTED FROM ENTERING THE ECCS OR CONTA! WENT SPRAY SYS DURING THE RECIRC PHASE DF M ECCS OR CONTA! EENT SPRAY ACTUAfl0N. ADMINISTRATIVELY CONTROLLED LOCKS INSTALLED ON SCREEN f00PS 41394024 CATMBA1 TN G?

PRDC LEAK TO AFW WRITTEN INSTRS WERE NOT USED DURING ALISNMEN OF AFW TO VERIFY NO BACKFLOW TSU CHECKVALVE TO AFW FM S/S 1C. BACKLEAKAGE OCCURRED MD THE S/6 SAN LOW-LOW LEVEL. A/M PROC REVIEWED / REVISED TO CLARIFY WHEN WRITTEN PROCEDURES ARE RED'D.

(PDTENTIAL FOR STEAM $1NDING OF AFh FUMPS AhD WATER HAMMER TO AFW AND S/6. AE00/C404) 41384029 CAT MBA 1 CRD 03 C0 DSGN DEFECT CRDM DESIM DEFECTIVE 41385002 CAT M BA 1 1CE COND.

04 FROC INDP,1CECOND ENTERED NT SHUTDOM WITH ICE CONDEN!ER IDDRS BLOCKED SHUT (DISCO'/EPED WHEN IN ST4 TUP MODE 2).

MECH MAINT REP BELIEVED M D S!6NED CFF THAT 1HE ICE COND LOWER 'NLET DOOR BLOCKING DEV!CES HAD BEEN FEMOVED.

416E4002 SRAND SULF 1 RH9 (SDCI O4 EQ LCSS OF RHR FPS FUS BREArER TRIPS RESULT IN LOSS 05 SHUTDOW C00 LINS. (DES 16N IS SUCH THAT LDSS OF EITER REDUND MT RPS BUS CAUSES A TOTAL MSS Oc SDC.

BECA'iSE FEDUNDANT TRAINS ARE SUPPLIED THRU A COMON 11tLET CONTAINING TWO MOV'S IN SERIES).

41684024 BRANI SULF

• CONTSPRAY 42 ED INDP,RH9 RPR LOOPS A & E INCLL' DING CCNTAIMENT SPRAY, LPCI, SUPPRESS!0N P00 LINS MD SHUTDON C00L!bS MODES NERE DECLARED INDP BECAUSE OF P! PINS SUPPORT DU.S 416B4028 BR MD SULF 1 RWCU 02 ED ISCL,RWCU LISHTNINS CAUSES ARCING IN SWITCHYARD ERKR.

41654031 GRAND BULF 1

$3W 42 CD DSSN IEFECT ET M DBY SERVICE WATER (S$W) WOULD N0! FROVIDE THE ULTIMATE HEAT S:NK DESCRIBE 0 IN TFE FSAR (PDST-LOCA) UNDER CERTAIN CONDITIONS 48364015 CALLMAY INST. AIR 05 ED TRIP, M M RI PRESSURE TRANS!ENT IN RCS RESULTING FM A LDSS OF INSTRUMENT AIR 48384016 CALLMAY RCS 05 PRCC DAMAGE, RCP FRIMARY SEAL DMA6E ON RCo RESULTING FM PRESSURE TRANSIENT DUE TO INCORRECT TEST PROCEDURE 48384021 CALLAWAY SSPS 05 PROC INDP,SSPS TRAIN 'A' Dr SSPS IN INHIBIT MDDE WITH tHE 'B' TRAININTEST. VABUE TS LED TO INCORR TEST FROC.

PDTENTIAL BORON DILUTION EVENTtAEDDIT-5011 4PJG4029 CALLAhAf CONT SPRAY 04 PROC INDP, CONT SP VERIFICAT!0N 483B4059 CALLAWAY AIR SYS 45 1 ED TRIP AU10 Rt PECA"SE OF IMPPDPER 9ATERIAL AIR LINES TO $6 FEED RE6 VALVES FAILED RESULTINS IN ESF'S AND REACTOR TRIPS w__n

1 b ge No.

1 s

C7127187 ~

APPE WII A.2 i

CHARACTERISTICS OF SIGNIFICMT EVENTS I

PwER EVENT LER NO.

PLMT SY$ TEM W MOR TYPE PROBLEM COMMENTS 20685004 SM ONOFRE 1 PJUP 02 PROC FA!LS, PUMP PUMP DPERATING P20C REVIED TO PRECLUDE DIL CONT.

1 POTENTIAL COMON CAUSE FAILURE.

I 20685014 SM OWFK 1 AFU 93 1 PROC TRIP, AUTO RI INFOMAL PROC FOR N2 CMRGIN6 0F AUI TRMSFORERS l

2H85017 SM OWFRE 1 4160VELEC 60 1 PROC PONER LOSS ITT PRE: TIE 4:51 M I

LOSS OF AC PONER MD FM SYS NATERNAMER EV0li.

DID WT F18 ROOT CAUSE OF FN SYS CHECK VLV FAILURE 1

21385005 COMECTICUTYANK AFN 03 EQ FAIL, VRVES $6 FN BYPASS VLVS IN LOOPS 1 & 4 FAILED TO OPENAUTOMATICALLY 21385025 CONNECTICUT YMK 'NASTE 6AS 100 1 NFNP RELEASE, RAD AMBI600VS VALVE TA6 NUMBERS 21985003 OYSTER CREEK CDRE SPM Y 95 1 C0 DSSN DEFECT 21985012 OYSTER CREEK EPR 100 1 EG TRIP. AUTO RI PRE; THERE WERE A NUMBER OF HF CONTRIBUTORS TO THIS.

21985018 OYSTERCREEK ESN 78,1 ED INOP,ESN HI FA! LURE RESULTED BECAUSE OF ACCUMULAT!ts 0F P!PE CDATING MATERIAL AND MARINE DEBRIS 21985023 DYSTERCREEK ESN 05 CD DS6N MFECT 22085021 NINE MILE POINT 1 INST AIR 98 1 PROC TRIP, AUTO RI PRE. AIR SYSTEM STUDY. MULTIPLE lHDEPENKkT FAILURES DUE TO MAINT PRO 6RAN PROBLEMS 23785034 DRESDD 2 PONER 70 1 EQ TRIP, AUTO RI 23785044 DRESDEN 2 EDG 100 1 HFNP DAMAGE, ED6 IT IS BELIEVED THAT FLE!!BLE CABLE CONDuli M6 UED AS A SUPPORT WHEN CLIMBING NEARBY LADER.

THIS NORE CABLE THRU INSULAT10N 44 CAUSED SHORT.

CABLE TO BE MDE OF RISID MATERIAL.

24585022 MILLSTONE i

!$0L. COR 05 CD ISSCC 24585028 MILLSTONE 1 RECIRC 05 CD 165CC 24585033 MILLSTONE 1 LPCI 05 EO FAILD SN 24985005 DRESMN 3 ED6 99 1 PROC LSSF CAUTION CARDS INADVERTENTLY NUNG ON UNIT 3 D6 KNIFE SNITCHES RATER THM UNIT 2, KCAUSE OF PROCEDURE PROBLLM (SME PROCDUE NAS USED FOR BOTH UNITS A G MISCOMMUNICATION DCCURRD) 24985018 DRESDEN 3 RPS 83 1 PROC TRIP, AUTO RI 25085020 TURKEY PolNT 3 MSIV 04 CD DSSN KFECT 10CFR21 25085021 TURKEY POINT 3 AFN 03 PROC ACT, AUTO AFU PRE 25085036 TURKEY POINT.

RHR 05 EO LOSS OF RHR 25085042 TURKEY POINT :

ED6 100 i CD DSBN EFECT I!SCOVERED PDTENTIAL FOR OVERLOADING ED6 UNM R CERTAIN ENER CONDITIONS.

25185002 TURKEY PDINT 4 ED6 04 E9 TRIP, AUTO RI EDS EMER$ENCY POER UhAVA!LABLE 25185012 TURKEY PtnNT 4 120VACPON 100 1 PROC TRIP, AUTO RI 25185017 TURKEY POINT 4 120VACPN 100 1 PROC TRIP, AUTO RI FAILURE TO FOLLON 2598500Y BRO WS FER Y 1 PCIS 04 C0 DSGN KFECT 25985014 SROWNS FERRY !

BATTERIES 04 CD DSGN DEFECT SE!SMIC 25985031 BRO WS FERRY 1 RECIRC 04 C0 DSGN KFECT SEISMIC 26085002 BRomS FERRY 2 MSRV 05 CD DEGRADED SYS 26585008 OUAD CITIES 2 RECIRC e2 CD 10BCC 26785N 2 FT. ST. YRU N HE CIRC 0&

CD STRESSCC 267850M FT. ST. VRAIN RPS 06 EG RPSAS

Page No.

3 09/27/97 APPENDl! A.2 CHARACTERISTICS OF SI6NIFICANT EVENTS POWER EVENT LERNO. PLANT SYSTEM d) MODE TYPE PROBLEM COMENTS 27285001 SALEM 1 AFW 100 1 CD DSGN ERROR 27205004 SALEM 1 CCW 100 1 PROC BURNT DIL LACK OF M IPERATIONS PROC FOR THE CONTROL OF LUBE DIL 27895013 PEACH BOTTOM 3 RECIRC 05 CD IBSCC 27885014 PEACH BOTTOM 3 CORE SPNAY 05 CD 16 SCC 2B285017 *RARIE ISLAND 1 CONT. ISOL 22 EG FA!LS EQUIP 285850!! FT. CALHUUN 480VAC EL.

0$

HFNP LDSS, 480V TECHNICM TRIPPED RELAY CONTROLLING BREAKER THAT WAS PROVIDING 161KV P0WER TO THE 4.16KV 1A4 SAFIGUMDS BUS RATHER THAN THE BREAKER THAT COULD PROVIDE 345KV POWER TO THE 4.16 SAFEGUARDS BUS.

'WRON6 COMPONENT

• EVENT (WSP2) 2B7B5003 OCONEE 3 RCR (DHR) 04 PROC INOP. VLV DHR COULD NOT BE INITIATED AUTOMATICALLY BECAUSE MOV DID NOT HAVE CORR TORGUE SETTIN6(NOT IN PRDC) 29385001 ?!L6 RIM SLCS 22 2 HFNP FAILED, VLV SLCS RELIEF VLV LIFTED LOW BICAUSE OF DEBRIS IN TANK (LACK OF CLEANLINESS) 29585003 !!0N 1 DB 99 1 PRDC FA!LtD, E06 D6 TRIPPED DURING TEST BECAUSE OF MISAll6NED SHAFT IN LUBE 01L PUlF. D6 MAINT PROC REVISED 295W5004 210N 1 RHRILPSD 67 1 PROC FAILED, VLV DURAi!DN 2 MIN.

LPS! FUNCT10N LOST BECAL;SE RHR SUCT10% ISOL VLV ON RWST WOULD WOT OPEN (iEST SHOULD BE RUN WHILE CSD). SUPPLEMENTARY REPORT CUE.

295B5008 Il0N 1 CCW 05 PROC LEMABE, CCW RCP BEARIN6 OIL COMPONENT CODLIN6 REllEF VLV FAILED TO RESEAT DUE 10 1MPROPER SEfilN6S 29685006 ERDWNS FERRV 3 LVL IND.

04 PROC LEVEL INCDRR ERRDNEDUS WATER LEVEL INDICAT!DN EECAUSE OF LOW PRESSURE DURING STARTUP. TRAINING WAS PRIMARY.

29BB5002 C00PER SSTS 05 CD 0564 DEFECT 29885008 COOPER HPCI 62 PROC HPCITURBIRIP POST MOD TEST 29885016 COOPER VAR 04 PROC UNSAT PR06RM PROGRAM FOR INSP OF SAFETY 6RADE SNUBBERS WAS INADEBUATE (PROCEDURES MD TPAININ6),

302B5023 CRYSTAL RIVER 3 120VAC POW 95 1 PROC TRIP,TUPD/RI INVERTER FA! LURE LED it) ERRDNEDUS INDICATIONS.

OPERATORS RESPONDED TO IISICATIONS SV TRIPPING PLMI. CRD CURRENT LIMITINS POWER SUPPLIES TO BE INCLUKD IN PM PROGRAM, 302B5024 CRYSTAL RIVER 3 SWHE 96 1 CD DSGN ERROR 30485002 !!DN 2 DG 99 1 ED INDP,2/3 06 CRACKED C0FfER D6 LUBE DIL TUBIN6 304B5003 Il0N 2 DS 99 1 EG IN0P,2/3 D6 FAILURE OF D6 RASTER TRIP VALVE.

30585001 KEWAUEE CONT SPRAY 100 1 EQ ACTUAT!DN,CS DURING SI M EILLANCE TESTING, ' CROSSTALK

• K TWEEN CONTAINMENT P' ESSURE LD61C DEVICES CAUSED R

ACTIVATION OF CS MASTER RELAY (RLY).

30$85006 KEWAUNEE

$6 TUPES 06 HFNP INSTL,1NCORR WRON6 SG TUBE PLU66ED. TO PREVENT RECURRENCE, THE TEMPLATE, VS THE TUK SIEET, WILL PE MARKEB TO ID THE TUKS TO BE PLU66ED 30585019 KEWAUNEE RPS 100 1 C9 FAIL, COMPS TWO RI TRIP BREAKERS DID NOT PASS FORCE MARGIN TEST 30YB5006 MAINE YANKEE ED6 C00LIN 98 1 to CD CCW TEMP. CONTROL VLYS TO EACH ED6 HAVE COMON AIR SUPPLY VLVS. SINGLE FAILURE OF AIR SUPPLY COULD LAUSE LDSS OF CCW TO TD6'S.

a Page No.

3 08/27/B7 APPENDil A.2 CHARACTERISTICS OF SIGNIFIC MT EVENTS PONER EVENT LER NO.

PLANT SYSTEM (1) MODE TYPE PROBLEM COMMENTS 30985009 NAINE YMKEE RPS 78 1 PROC IMOP, SYS A0 B85-9. PRE. DURATION 13.5 NO.

COND NOTED B/7/B5, BUT COND PRESENT SINCE 6/20/B4.

3118501B SALEM 2 CCHI 100 1 EG FAILED, COMP 31285009 2.WCriO SECD DG 05 EG DSGN DEFECT 312B5025 RMCHO SECD

!CS 76 1 EO TRIP, AUTO RI !!T INVESilGATION 31(,85005 D.C. COOK 2 DC BATTERY 100 1 E0 INOP, BATTRY 'B' TRAIN BATTERY DECLAFED INOP: DE CELL OF BATTERY S T CIFIC BRAVITY OUT OF SPEC.

316B5035 D.C. COOK 2 RPS 79 1 PROC TRIP, AUTO RI RTB 'A' FAILED TO OPEN ON TRIP SIGNAL, KCAUSE OF FAILED UNDERVOLTAGE TRIP Cl Kuli.

31885006 CALVERT CLIFFS 2 ED6 100 1 CD IN0P,EDGS PRE ED6*S DECLARED INOP DUE TO CRACKS IN N!NDINGS.

31885009 CALVERT CLIFFS 2 SERVICE N.

100 1 PRDC DE6AADED SYS SERVICE NATER SUBSYSTEM DECLAREB IN0P BECAUSE OF PARTIAL BLOCKING OF SALT NATER C00LIN6 BY MARINE GRONTH 32185017 HATCH 1 ELECTRICAL 100 1 CD DSN6 ERROR 10CFR21 3218501B HATCH I HPCI 100 1 PROC TRIP, MAN. RI PPI! APP. C, 4TH GTR A0 REPORT HPCI INOP FOR 15 MIN. CONTRACTOR PERS0HEL MOVED CRME NHICH RUPTURED A PIPE COMECTED TO FILTER TRAIN 'A' DELUBE SYS. TH1$ ACTIVATED THE FIRE KLU6E SYS, FLOOKD TE FILTER TRAIN (CLO66ED DRAINS KCAUSE OF INAD MINT). NETTED THE ATTS PANEL, MD THIS (11 CAUSED $RV TO LIFT, AND (2) FA! LURE OF ATTS POER SUPPLY.

32285046 SHDREHAM LPCI 12 ED INOP,LPCI

'B' LOOP OF LPCI SYS OF RHR INOP NHILE HPCI INDP FOR TESTING. FAT! SUE FAILURE OF MOUNTIN6 BOLTS OF VLV OPERATOR.

32585003 LRUNSN!CK 1 EMER ELECT BB 1 PROC TS V!DLATION RURVE!LLANCE PROC DID NOT EXIST TO TEST THE UNITS 1 li 2 COMMON EMERSENCY AC SYSTEM.

325EM 26 BRUNSN!CK 1 RECIRC 05 CD 16 SCC 32585028 BRUNSNICK !

SB6T 05 CD DSBNERRDR 32585058 BRUNSNICK 1 RHR (LPCI) 05 PROC INOP, LPCI PREI AS A RESULT OF A REVIS10R, PERIODIC TEST (PT) MDE BOTH LOOPS OF LPSI (MODE OF RHR) INDP DURIN6 TEST.

32785040 SEQUOYAH !

RHR 05 PROC LDSS OF RHR LDSS OF RHR DUE TO AIR INJECTION INTO SUtil0N DURING SNAP K TNEER LOOPS *n' 45 'B' 32885002SEQUOYAH2 RPS 100 1 PROC AUTO RI TRIP SECONDMY SIDE VALVE (HDil FAILUR CAUSES TRIP!

FAILIRE OF RTB 'A' 10 OPEN 33185010 DUANE ARNDLD RECIRC 05 CD NELD IND'S UT REVEALFD NELD INDIC.iTIONS 33185031 DUANE ARNDLD RCIC 93 1 ED PONER FAILS 33185036 DUANE ARNDLD ED6 BB 1 CD IN0P, KCLRD ED6'S DECLARED INOP PER TECH SPEC BECAUSE PLANT KTERMIED ED6*S M16HT FAIL TO ASSUME LDADS UNDER CERTAIN ACCIDENT CONDITIONS.

33385009 FIT! PATRICK MS 05 CD KGRADED SETPOINT DRIFT IN TARGET ROCK SRV'S.

333B5017 FIT! PATRICK MSIV 29 1 HFNP TRIP, AUTO RI DPS PERSOMEL DID NOT F'ERFORM A CORRECT VALVE LIEUP PRIOR TO TURNING INS 1RUMENTATION DVER 10 CONTRACT MAINTENANCE PERSONNEL 33485001 BEAVER VALLEY I CONTAINMT 04 PROC INTEGRITY CONTAINMENT INTE6R!iY NAS VIOLATED DURINS CHANGE

2 Pap CD.

4 08/37/87 APPEND!I A.2 CHARACTERISTICS OF $16MIFICMT EVENTS PCNER EVENT LER NO.

PLANT SYSTEM W MODE TYPE PROBLEM COMMENTS FROM M0K 5 TO 4, DECAUSE A VALVE BAS MIRPOS*D.

33485015 BEAVER VALLEY l INST AIR 100 1 PROC TRIP, AUTO RI INADEBUATE AIR SYS OPERATING AND MAINT PROC.S 33885002 NORTH AMA 1 N2 REMOV'l 1001 PROC TS VIOLAT10N NO PROCEDURES FOR SURVEILLANCE OF THE POST ACCIENT il2 EMOVAL SYS 33085011 NORTH A W A 1 ED6 100 1 ED ED6 TRIP D6 CRACKED CYLINER LINER 34185047 FERMI 2 ECCS 04 PROC INOP, COMP SHIFT TURNOVER PROBLEM 34485009 TROJM AUI TRANSF 100 1 E0 TRIP. AUTO RI PREI EOUIPMENT KSIGN DEFICIENCIES & FAILURES

- 346B5006 DAVIS-DESSE CRDM 05 EQ FOREIGN MAT.

346B5007 DAVIS-DESSE AFN 05 PROC INSTL INCORR POST MOD TEST 34685013 DAVIS-BESSE AFN 90 1 PROC TRIP, AUTO RI PRE !!TEVENTINVEST!OATION 34685015 DAVIS-SESSE AFN 05 FROC SN SET INCOR 10CFR21. INCORRECT LIMITOROUE SETTINE DUE TO ERROR IN VENBOR MAINTENANCE PROCDURE.

35285044 LIMERICK 1 HALON 32 PRDC RM FAN TRIP 35285060 LIMERICK 1 EDS 04 EQ TS V!DLATION INDPERABLE SECURITY DEVICE (CARD REAMR) PREVENTED ACCESS TO A VITAL AREA (D6 BAY 'B')

362B5036 SAN ONOFRE 3 RHR 05 PROC HI RCS C00LD SHUTDOWN.C00 LING SYS HI ISOLAT!DN VALVES SAVE PREMATURE INDICATION OF BEING CLOSD, MD THl$

NAS NOT K COUNTD FOR ADEGUATELY.

36485005 FARLEY 2 CONT 05 EG FAILS, TENDON CONTAINMENT VERTICAL TENDON DEFORMD 36085001 AND-2 RECIRC AS 100 1 PROC SPILL, RWT SPURIOUS RECIRC AC1UAT10N SYSTEM S!6NAL DURING SURVE!LLMCE TESTlWG CAUSED MAI.NINS OF ABOUT 50,000 BALLONS FROM RWT TO PB SUMP.

36895002 ANO-2 RECIRC AS 100 1 EQ IN0P, RAS RNT LEVEL TRMSMITTERS FA!L BECAUSC DF COLD AAD N!ND 37085017 MCSUlRE 2 NCC 100 1 PRBC TRIP,AlITORISEEAPPENDl!C 37385000 LASALLE 1 RB VENT 96 1 EQ INOP, COMP RB VENTILATION EINAUST SEC06ARY CONTA! MENT TSDL MMPER 50LEN0!DS MALFUNCTIONED. MAINTENANCE PR06 MAY NOT HAVE BEEN ADE00 ATE 37385037 LASALLE 1 ADS 97 1 PROC INCORR MODIF MODIFICATION (ADS N!RIN6) PROC INCORR DECAUSE BETWEEN THE N! RING AND SCHEMATIC DIA6 RAMS. TH!$

NAS NOT DETECTD, MCAUSE POST-MAINTENMCE TESTIN6 MS NOT PERFORMED CORRECTLY.

37385053 LASALLE I RHR 04 PROC INCORR MDDIF INSTALLAT!0N PROCEDURE NOT CORRECT BECAUSE SYSTEM DNSB NOT CHM 60 TO REFLECT EMLIER SYSTEM MODIFICATIONS (SAME AS 1374-85-0291 374B5029 LASALLE 2 ECCS 04 PROC INCORR MODIF !E IN 095-75 (SME AS LERt373-B5-053) 37485031 LASALLE 2 RHR (SDC) 04 PROC INCORR MODIF INSUFFICIENT INSTRUCTION TO VEk!FV CORRECT INSTRUMENT LINE ROUTING 39585003 SUMMER RPS 62 PROC TRIP,AUTC RI HISN FLUX POSITIVE RATE RI TRIP. INSUFFICIENT SUID4hCE ON USING NON-EDUIL DR*JM REFERINCE CRITICAL DATA (RCD) IN CALCULATING THE ESTIMATO CRITICAL CONDITIDNS (ECC) 39585016 SUMER FN ISOL 100 1 CD DSN6 ERROR DEFECTIVE CONDITION CORRECTED 39585032 SUMER D6 20 1 EQ FAILS, COMP 10CFR21. VOLT 46E RESULATOR FOR COLT INDUSTRIES ED6'S FAILD 39785008 HP-2 D6 100 1 PROC TRIP, AUTO R1 IE IN 985-28 INSUFFICIENT INFO FOR STARTUP TESTING OF D6'S 41385011 CATANBA 1

$1 02 HFNP INOP,S1 PRE: IMPROPER REMOVAL FRCM SERVICE

3 Page No.

5

.)

C/27/87

+

APPEGII A.2 i

CHARACTERISTICS OF SINIFICMT EVENTS PONER EVENT LER NO.

PLANT STSTEM (U MODE TYPE PROBLEM COMMENTS l

41385028 CATAWBA 1 RHR 05 PROC LOSS OF R R LOSS OF SBC N DRAINING PRIMARY SYSTEN; INSUFFICIENT INSTR. ESULTS IN VIOLATIN OF TECH SPECS 413B5053 CATM9A 1 ED6 5j PROC INDP, COMP EIG BATTERY CHAROER FOUND TO E INOPERAILE.

CMSED BY NSION (IT llD NOT EIVE MY lelCATION THAT IT NAS INOP) PERS0m EL ERROR (OPER 91D NOT ACTIN TO CLEAR M ALARM $19NALINS TR03LE WITH THE CHARGER),AND K F. PROC (Bil W T SIVE OPERATOR-AID TW INNTIFYINE CAUSE OF CHARSER TROU8LE ALARM) 41385066 CATAWBA 1 H2 SKIMMER 62 1 PROC IN0P, COMF SHIFT TU WDVER PROBLEM 41385067 CATAMBA 1 MFN 62 1 HFNP TRIP, AUTO RI LDN DIL PRESSURE TRIP ALARM FOR Mh!N FEEDNATER MEIN 6 LUBE DIL NOT CIECKED OUT 21 HR$ EARLIER 41385068 CATAWBA 1 NSN 45 1 E9 IN0P. NSN

$1MULTANDUS IN0PERABILITY OF BOTH TRAINS OF NSN.

45485027 BYRDN 1 MS 03 EO ACT, AUTO S1 IA AND 19 HEIV'S (2 0F 4) FAILD TO CLOSE ON

$1 AND STEMLINE ISOLATION. INST. 41R SUPPLY CHECK VALVE PROBLEM '

45085049 RIVER BEND RCIC B2 ED ESFAS 52BB5020 PALD VERDE.1 RPS 05 PROC ESFAS ESFAS 2 0F 4 LOGIC ACTUATED Duk!NG StIW TEST KCAUSE BATTERT CHAR 6ER$ HAD NOT KEN PROPERLY RETURNED 'TO SERVICE

l Page No.

1 o

08/27/67

)

APPE E !! B.1 i

$16NIFICANT EVENTS INVDLVING PROCEDURES EVENT PCNER CONT. PROC.

DEFECT CORR. PERSDNNEL INPD 4

LER NO.

PLANT DATE SYSTEM (Il MODE FACTOR TYPE TYPE ACTICS TYPE PROBLEM SER NO.

4 20684012 SAN D EFRE i 10/R /64 CCN 05 A/M DPS INCOMP PRDC LD LDSS Dr RHR 21384013 CONNECTICUT YANK 06/21/B4 REFUELING 06 ED REFUELINGINCOMP PROC R1 CAV DRAIN 72-B4 21384020 CONNECTICUT YANK 10/13/84 $6 05 HP(A/M)

IKOMP PRDC RAD DVEkEIP 21364023 CDNNECT! CUT YANK 10/31/64 EDS 06 PM(A/M) MISSING PROC FAILS. ED6 21984017 DYSTER CREEK 06/27/64 ELECTRICAL 05 EQ MOD INCOMP PROC INDP,SYS 21984029 OYSTER CREEK

!!/04/04 ADS 12 2 EQ MAINT IEDMP PRDC FAIL, VALVES 237B4020 DRESDEN 2 10/10/04 FIRE SUPPR 04 A/M DPS INCORR PRDC VLV MISPOS 24784022 INDIAN P0]NT 2

!!/27/84 AFW 100 1 MOD IEDMP PROC INDP, VALVES 24764025 ICIAN POINT 2 12/19/84 SI 100 1 OPS IEDMP PROC NA LDSS,51 20-25 25064032 TURKEY PulNT 3 12/03/84 AFW 100 1 A/M DPS INCORP PRDC LD TS V10LAT10N 251B4017 TURKEY P0lNT 4 08/07/84 RFS 100 1 PM INCOMP PROC TRIP. AUTO R1 25984032 BROWNSFERRYl 08/14/84 CORE SFP M

'C01 PER MAINTMECH INCOMP PROC LD INDP, VALVE 26384007 MONTICELLO 02/06/84 RECIRC 05 PM(A/M) INCOMP PROC FAILS,BRKR 4B-84 27084001 DCONEE 2

!!/27/84 kB SPRAY 100 1 PER TEST NOT FDL TRW6 NLO LOSS, RB SPR 27204014 SALEM i 06/05/B4 ED6 06 A/M DPS IE0MP PRDC R0 LDSS,ED6 27584013 DIABLO CANYDN 1 04/07/84 ECCS 03 A/M OPS INCOMP PROC LD lEP,ECCS 295B4031 Z10N 1 09/14/84 RHR 05 DSBN EMER PRDC MIS $1NG PRDC LO LOSS OF RHR 296B4013 BRDNNS FERRt 3

!!/22/B4 HPCI 05 TRN6 PM INCOMP PRDC MAINT MECH INDP, IFCI 29884007 C00PER 04/19/84 SB6TS 70 1 EQ DPS(A/M) INCOMP PROC CONSTRUCTN LSSF, SGTS 57-84 302B4013 CRYSTAL RIVER 3 06/13/B4 HPI l001 TEST,SURV MISSih6 PROC TS VIOLAT!DN 30564018 KEWAUNEE 09/2B!B4 FCU

!00 1 PM MISSING PRDC DEGRADED 305B4 21 LENAUNEE 12/18/84 SI 100 1 COMM TEST,SURV IEDMP PROC LD

!EP,SI 15-B5 312840!$ RANCHO SECO 03/19/B4 H2 SEAL 0.

25 1 A/M PM INCOMP PROC TRIP. AUTO RX 41-84 31254024 RANCHD SECO 11/08/B4 RCS 03 COMM DPS(A/M) INCOMP PROC LO DEBDRAT!DN 31586014 D.C. C00K 1 07/16/84 ECCSISil 100 1 COMM TEST,SURV IEDMP PRDC NLO LSSF 31684014 9.C. C00K 2 05/21/B4 RHR 0$

DPS INCOMP PPDC LD LDSS OF RHR 32064014 TM!-2 08/17/B4 RCS 05 PER CHEM INCOMP PRDC LO6 CHEM.T. ENREP SAMPL 32464011 BRUNSN!CK 2 09/24/04 RHR 05 PER OPS ET FDL PRDC LD ACT.AUiG RPS 32784030 SEEUDYAH 1 04/19/B4 INCORE DET 30 1 MAINT INCORR PRDC MAINT, MECH LOCA 43-84 33164029 ARNDLD 07/lB/84 SLCS 100 1 CHEN INCOMP PROC CHEM TECH INDP,SBLCS 33B84010 NDRTl! ANNA 1 07/22/64 VAR (MOV'S) 05 MAINT C01FUS PROC MAINT,ELEC MOV SETPOIKT 34484005 TROJAN 03/20/B4 AFN 100 1 MA!KT lEOMP PRDC IEP,AFN 34484010 TROJAN 05/04/64 RHR 05 DSSN OPS (A/M) INCOMP PRDC LOSS OF RHR '/9-64 34484014 TROJM 09/13/84 SEAL iABLE O3 A/M MAINT IEDMP PROC !&C LOCA B1-B4 344B4:16 TROJM 09/02/64 EDBLAFN 15 1 DPS INCOMP PRDC TRIP, AUTO R1 344B4017 TROJAN 09/26/B4 MSSV 50 1 OPS (A/M) INCOMP PRDC TRIP,AUTCRI 36264009 SAN ONDFRE 3 03/17/94 CONT SPRnY 100 1 A/M INCOMP PRDC IEP CCNT S 362B4011 SAN DNDFRE 3 02/27/B4 CPS 04 A/M TEST,5URV IEDMP PRDC DESRADED SYS 36B84023 AND-2 OB/29/B4 RHR 0$

DSGN OP3 INCOMP PROC LOSS OF RHR 79 B4 3a98401B MC60!RE 1 06/04/64 CA VENT 100 1

$$6N OPS lEDMP PRDC

!EP, SYSTEM 36994025 RCSUIRE 1 06/27/B4 CONT SPRAY 100 1 A/M INCOMP PRDC SPILL, RAD 36964030 MC6UIRE 1

!!/01/B4 UH1 03 INSTL INCOMP PROC INSTL,1EDRR 12-25 370B4001 MCSUIRE 2 01/09/64 RHR 05 DSGN OPS INCDMP PRDC LD6S OF RHR 37064002 EBU!RE 2 01/15/B4 RHR 05 DSBN OPS INCORP PROC LDSS DF RHR 3700402B MC6UIRE 2

!!/13/84 UH1 100 1 CALIB INCOMP PRDC DSSN DEFECT 38784031 SUSDUEHANNA 1 07/03/54 HPCI O3 DPS INCDMP PRDC IEP,HPCI 38864012 SUSQUEHANNA 2 07/09/B4 CORE SPRAY 20 1 MAINTELECINC0MP TRN6 LDSS. CS

r h

..Page No.

3 06/27/87.

APPENDI! B.!

SIGNIFICANT EVENTS INVOLVING PROCEDURES EVENT PONER CONT. PROC.

DEFECT CORR. PERSONNEL INPD LER NO.

PLANT

'DATE SYSTEM (2) MODE FACTOR TVPE TYPE ACTILA TYPE PROPLEM SER NO.

j 1

38884013 SUSOUEHAHA 2 07/26/944.16KVEL.'

30 i LABL TEST INCOMP PROC N!.0 STATION B.C. 65-B4 4138402? CATANDA I II/15/M ECCS 04 A/M MAINT lEDMP PROC CLEANING DEBRADED SYS 41384024 CATANBA 1 il/24/M AFh 03 A/M TEST INC0lr PROC LD LEAK TO AFW 41385002 CATANBA i 12/31/94 1CE COND.

04 AIM GPS INCOMP PROC MECH MAINT INDP,1CECOND 48384016 CALLANAY

?7187!94RCS 05 TEST,SURV INCORR PROC NA DAMA6E,RCP B0-84 4844021 CALLANAY 07/19/84s.'PS 05 TEST,50RV INCORR PROC INDP,$$PS 4R384029 CALLANAY 08/14/84 C01T SPRAY 04 DPS INCOMP PROC

'!NDP, CONT SP l

1

[,1 j

Page No.

1 08/37/87 APPENDII B.2 SIGNIFICM T EVENTS !Y/DLVINS PROCDURES I

l EVENT PWER CONT. PROC.

DEFECT CORR. 8'ERSDEL ThPO LER NO.

PLMT DATE SYSTEM (1) MODE FACTOR TYPE TYPE ACTION TYPE PROBLEM SER NO.

20685004 SAN ONOFRE 1 02/11/B5 W P 02 OPS INCOMP PROC NA FAILS, PUMP 20605014 SM DNOFRE 1 09/19/85 AFW 93 1 MINT MISSING PROC TRIP,AUTORI 206B5017 SM DNOFRE 1 11/21/95 4160V EJC 60 1 E9 A/M INCOMP PROC POWERLOSS 52-85 22005021 NINE MILE PolNT 1 !!/01/95 INST AIR 9B 1 E0 PM MIS $1N6 PROC NA TRIP,AUTD RI 24985005 DRESDEN 3 02/16/B5 D G 99 1 COMM TEST INCOMP PROC NLO LSSF 24995018 DRESDEN 3 09/19/B5RPS B31 TEST IEDNP PROC INST MECH TRIP, AUTO RI 01-86 25085021 TURKEY POINT 3 07/22/85 AFW 03 MINT (A/M INCOMP PROC ACT,AUTD AFW 25185012 TURKEY POINT 4 05/30/85 120VA POW 100 1 EQ PM MISSING PROC NA TRIP AUTO RI 25185017 TURKEY POINT 4 06/20/85 120VAC POW 100 1 PER OPS NOT FDL CNSL NLD TRIP. AUTO RI 27285004 SALEM 1 02/26/85 CCW 100 1 OPS MISSINGPROC NA BURNT DIL 28785003 OCONEE 3 10/15/B5 RCR (DHR) 04 MA!NTMECH INCOMP PROC NA IMDP,VLV 29585003 Il0N 1 01/15/B5 D6 99 1 MAINT INCOMP PROC NA FAILD,ED6 29585004 !!DN 1 01/24/85 RHR(LPSI) 67 1 TEST,$URV INCOMP PROC NA FAILD,VLV 29585006 Il0N 1 02/16/85 CCW 05 TEST (A/M) IEDMP PROC #A LEAKASE,CCN 29685006 BROWNS FERRY 3 02/13/85 LVL IND.

04 TRN6 OPS ICOMP TRN6 LO LEVEL INCORR 29885009 CDOPER OB/24/B$ HPCI 62 MOD INCOMP PROC NA HPCITURSTRIP 29895016 COOPER 11/19/B5 VAR 04 A/M INSP INCORR PRDC NA UNSAT PR06RM 302B5023 CRYSTAL RIVER 3 10/26/B5 120VAC POW 95 1 ED PM INCOMP PRDC NA TRIP,TURB/RI 30985009 MAINE Y2KEE 08/07/B5 RPS 78 1 A/M IKOMP PROC NA INDP,SYS 31685035 D.C. C00K 2 10/29/85 RPS 79 1 TEST I COMP PROC NA TRIP, AUTO RI 318B5009 CALVERT CLIFFS 2 10/15/B5 SERVICE W.

100 1 PM IE OMP PROC NA DEGRADED SYS 32185018 HATCH I 05/15/B5 HPCI 100 i LABL %!NT IEDRR PROC NA TRIP,MM. RI 32585003 BRUNSWICK 1 01/08/B5 EMER ELECT BB 1 TEST (AIM) MISSING PROC NA TS VIOLATION 32585058 BRUNSWICK.

10/29/B5 PHR ILPCI) 05 TEST (A/M) INCORR Pu0C NA INDP,LPCI 327B5040 SEGUDYAH !

10/09/B5 RHR 05 DPS ICORR PROC NA LDSS OF RHR 32885002SEGUDYAH2 01/12/95 kPS 100 1 A/M MINT lEDMP PROC INST MAINT AUTO RI TRIP 10-B5 33485001 BEAVER VALLEY l 01/07/B5 CONTA! M NT 04 7EST INCEMP PROC NA INTE6RITY 33485C15 BEAVER VALLEY I 08/29/Bi INST AIR 1001 opt &MA!NT INCOMP PROC NLO TRIP, AUTO RI 33B85002 NORTH ANNA 1 01/28/85 H2 REMOV'L 100 1 TEST (A/M) HIS$1NG PROC NA TS V10LAT10M 34185047 FERMI 2 07/29/85 ECCS 04 OPSIA/H) IEDNP PROC NLO INDP, COMP 346B5007 DAVIS-BESSE 03/23/85 AFW D5 EQ TEST,SURV INCORR PROC M INSTL IEORR 34685013 DAVIS-BESSE 06/09/B5 AFW G1 EMER INCOMP PROC NA TRIP, AUTO RI 29-85 34685015 DAVIS-JESSE 07/24/85 L/W 05 TEST IEDAR PROC M SW set ! EOR 35285044 LIMERICK 1 04/10/05 HALDW 32 TEST INCOMP PROC NA NM FAN TRIP 36285036 SAN ONOFRE 3 12/23/85 RHR 05 DPS INCOMP PROC MA HI RCS C00LD 12-B6 36885001 AND-2 01/02/05 RECIRC AS 100 1 TEST,$URV]NCOMP PROC NA SPILL,RWT 37085017 NC5UIRE 2 06/01/85 E C 100 1 PM INCOMP PROC IAE TRIP, AUTO RI 37385037 LASALLE 1 04/17/85 ADS 97 1 PER MINT IEDRR CNSL INST MAINT IEORR MODIF 37385053 LASALLE l' 07/17/B5 RHR 04 MOD INCORR PROC M4 INCORR MODIF 37485029 LASALLE 2 06/10/85 ECCS 04 MOD IEDRR PROC NA INCORR MODIF 37485031 LASALLE 2 06/22/B5 RHR (SDC) 04 MOD INCOMP PROC NA INCORR M00!F 395B5003 SU E R 02/28/B5 RPS 62 DPER IEDMP PROC LO TRIP, AUTO RI 33-B5 397B5006 WNP-2 01/31/B5 D 6 100 1 TEST,SURV INCOMP PROC LO TRIP, AUTO RI 14-85 41385028 CATAWBA 1 04/22'M A 't 05 EB OPS INCDMP PROC LO LDSS OF RHR 41385053 CATAWBA 1 07/bif* ED6 5*

DSGN OPS INCOMP PROC LD IN0P, COMP 41385066 CATAWBA 1

!!/d,.5 H2 Srl M R 62 1 MINT (A/M INC0F PROC NA INDP, C0F 5288502B PALD VERDE 1 04/17/B5 RPS 05 TEST,SUPV INC0F PROC NLO ESFAS

I[

APPENDIX B.3

. Extent to.Which Procedure was a Contributing Factor in 1984 Significant Events i

Procedure Other LER No.

Plant Rc,1e Type-Factor 206-84-012 San Onofre 1 B

OPS A/M 213-84-013 Conn Yankee B

Refuelin Design HP(A/M)g 213-84-020 Conn Yankee A

213-84-023 Conn Yankee A

PM(A/M) 219-84-017 Oyster Creek B

MOD Design 219-84-028 Oyster Creek B

MAINT Design E

237-84-020 Dresden 2 A

TEST, SURV 247-84-022 Indian Pt 2 A

MD0 247-84-C25 Indian Pt 2 A

OPS.

250-84-032 Turkey Pt 3.

'B OPS A/M 251-84-017-Turkey Pt 4 A

PM 259-84-032-Browns Ferry 1 B-MAINT Pers Error 263-84-007-Monticello A

PM(A/M) 270-84-001 Oconee 2 B

TEST Miscoasn 272-84-014 Salem 1 8

OPS A/M 275-84-013 Diablo Canyon 1 8 OPS A/M 295-84-031 Zion 1 B

A0P Design 296-84-013 Browns Ferry 3 B

PM Training 296-84-007 Cooper B

OPS (A/M)

Design 302-84-013 Crystal River 3 A TEST, SURV 305-84-018 Kewaunee A

PM 305-84-021 Kewaunee A

TEST 312-84-015 Rancho Seco B

OPS A/M 1

312-84-024 Rancho Seco A

OPS (A/M) 315-84-014.

D. C. Cook 1 A

TEST, SURV 316-84-014 D. C. Cook 2 A

OPS 320-84-014 TMI-2 C

CHEN A/M 324-84-011 Br.cnswick 2 B

OPS Pers Error 327-84-030 Sequoyah 1 A

MAINT 331-84-029 Arnold A

CHEM 338-84-010 North Anna 1 B

MAINT Labeling 344-84-005 Trojan A

MAINT 344-84-010 Trojan B

OPS (A/M)

, Design 344-8a n14 Trojan A

MAINT A/M 344-84 016 Trojan A

OPS 344-84-017 Trojan A

OPS (A/M)

Notes:

TI""liole

• A - Primary Cause (28 of 54)

=

8 - Primary Contributing Factor (25 of 54)

C - Secondary Cause/ Contributing Factor (1 of 54) 2).ProcedureType: OPS - Operations; MAINT - Maintenance; PM - Preventive M61ntenance; A/M - Administrative / Management; MOD - Modification; CHEM -

Chemistry; HP - Health Physics.

3)' Other Factor celumn contains ottar contributing factors such as deficiencies in equipment design, administrative / management practices (A/M),etc.

e APPENDIX B.3 Extent to Which Procedure was a Contributing Factor in 1984 Significant Events Procedure Other LER No._

Plant Role Type Factor 362-84-009 San Onofre 3 A

A/M 362-84-011 San Onofre 3 A

TEST, SURV 368-84-023 ANO-2 B

OPS Design 369-84-018 McGuire 1 B

OPS Design 396-84 025 McGuire 1-A A/M 369-84-030 McGuire 1 B

/NSTL Labeling 370-84-001 McGuire 2 B

OPS Design i

370-84-002 McGuire 2 B

OPS Pers Error 370-84-028 McGuire 2 A

CALI6 387-84-031 Susquehanna 1 A

OPS 388-84-012 Susquehanna 2 A

MAINT 388-84-013 Susquehanna 2 B

TEST Labeling; Training 413-84-022 Catawba 1 B

M4 INT A/M 413-84-024 Latawba 1 B

TEST A/M 413-85-002 Catawba 1 B

OPS A/M 483-84-016 Callaway A

TEST 483-84-021 Callaway A

TEST, SURV 483-84-029 Callaway A

OPS

.-m Notes:

1) The type of procedure deficiency was almost always (52 of 54) in procedure content rather than presentation. Deficiencies in presentation were part of the Oconee 2 and 0.C. Cook I events described in LERs ??0-84-001 and 315-84-014, respectively.

2) Corrective Action for these events usualiy included proc Jare changes (s).

A procedure change (s) was not part of the corrective action in the Oconee 2. Cooper, and Brunswick 2 events described in LERs 270-84-001, 298-84-007, and 324-84-011, respectively.

O

q gr

,l

~)

APPENDIX B.4

. Extent to Which Procedure was a Contributing Factor in 1985 Significant _ Events i

Procedure Other L_ER No.

Plant Role Type Factor

)

206-85-004 San Onofm 1 A

OPS l

206-85-014 San Onofre 1 A

MAINT a

206-85-017 San Onofre 1 B

A/M Equip Fails

'{

220-85-021 Nine Mile Pt 1 B

PM Equip 249-85-005 Dresden 3 8

TEST Labeling Cosaunication 249-85-018 Dresden 3 A

TEST 250-85-021 Turkey-Pt 3 A

MAINT(A/M) 251-85-012 Turkey Pt 4 B

A/M Design 251-85-017 Turkey Pt 4 8

OPS Pers Error 272-85-004 Salem 1 A

OPS 287-85-003 Oconee 3 A

MAINT 295-85-003 Zion 1 A

MAINT 295-85-004 Zion 1 A

TEST 295-85 '008. Zion 1 A

TEST (A/N) 296-85-006 Browns Ferry 1 C

OPS Training 298-85-008 Cooper A

MOD 298-85-016 Cooper A

INSP 302-85-023 Crystal River 3 B PM

' Equip Fails 309-85-009 Maine Yankee A

A/M 316-85-035 D.C. Cook 2 A

TEST 318-85-009 Calvert Cliffs 2 8 PM Design 321-85-018 Hatch 1 8

MAINT Labeling 325-85-003 Brunswick 1 A

TEST (A/M) 325-85-058 Brunswick 1 A

TEST (A/M) 327-85-040 Sequoyah 1 A

OPS 328-85-002 Sequoyah 2 8

MAINT A/M 334-85-001 Beaver Valley 1 A TEST Notes:

T Role A-PrimaryCause(32of47)

=

B - Primary Contributing Factor (12 of 47)

C - Secondary cause/ Contributing Factor (3 of 47)

2) Procedure Type: OPS - Operations; MAINT - Maintenance; PM - Preventive Maintenance; A/M - Administrative / Management; MOD - Modification; CHEM - Chemistry; HP - Health Physics; INSP - Inspection.

3) Other Factor column contains other contributing factors such as deficiencies in equipm6nt design, administrative / management practices (A/M), etc.

APPENDIX 8.4 Extent to Which Procedure was a Contributing Factor in 1985 Significant Events Procedure Other LER No.

Plant Role Type Factor 334-85-015 -Beaver Valley 1 C OPS & MAINT Design 338-85-002 North Anna 1 A

TEST (A/M) 341-85-047 Fenni 2 A

OPS (A/M) 346-85-007 Davis-Besse C

TEST, SURV Equip 346-85-013-Davis-Besse A

EMERE 346-85-015 Davis-Besse A

TEST 352-85-044 Limerick 1 A

TEST 362-85-036 San Onofre 3 A

OPS 368-85-001 ANO-2 A

TEST 370-85-017 McGuire 2 A

PM 373-85-037 LaSalle 1 A

TEST 373-85-053 LaSalle 1 A

MOD 374-85-029-LaSalle 2 A

MOD 374-85-031 LaSalle 2 A

MOD 395-85-003 Sunner A

OPS 397-85-008 WNP-2 8

OPS Design 413-85-028 Catawba 1 8

OPS Design 413-85-053 Catawba 1 8

OPS Design;Pers 413-85-066 Catawba 1 A

MAINT 528-85-028 Palo Verde 1 A

TEST, SilRV Notes:

7 The type of procedure deficiency was almost always (42 of 47) in procedure content rather than presentation. Deficiencies in presentation were part of the Dresden 3, Zion 1, Maine Yankee, D.C. Cook 2 and Sequoyah 2 events described in LERs 249-85-005, 295-85-008, 309-85-009, 316-85-035, and 328-85-022, respectively.

2)

Corrective Action for these events included procedure change (s) in every 1985 event.

l l

r

jt-n:

APPENDIT. C Review of Selected Significant Events involving Procedures

1.0 INTRODUCTION

Of the significant operating reactor events recently investigated by the NRC, a large fraction involved procedures to some degree. As a result, AF0D began a study of events in 1984 and 1985 that involved procedures that were significant from a safety standpoint. The initial study focused on 1984 and 1985 LERs that

{

hr.d a high level of safety significance (events that had been assigned a u

significance level of "1" or "2" by AEOD). Of the 179 such reports from 1984 and the 110 reports from 1985, totals of 54 and 47 reports, respectively, were found to involve' procedures.* The 54 events in 1984 and the 47 events in 1985 4

.that involved procedures were then examined to determine the characteristics of 1

the events.

j The initial review of the characteristics of the events indicated that problems associated with procedures were contributing factors in a high percentage of j

recent, significant events, and that some licensees are more prone to these

{

problems. The data suogested that some plants may tend to overemphasize the role of procedures in events due to (1) an unawareness of the complexity of the underlying factors (due to a lack of thorough event investigation), (2) an unwillingness to acknowledge personnel performance problems due to deficiencies in personnel qualifications, training, or environment, and/or (3) a desire to document that necessary action was completed on an LER, even when the complete action to prevent recurrence was extensive.

Because the study was initially limited to a review of the LERs, there was considerable uncertainty in the preliminary results. Therefore, a plan of action was developed that centered around a series of site visits and discus-sions with Resident Inspectors and Licensee's staff (including the personnel who were actually involved in the event) to review events that occurred and the role that procedures played in those events.

)

i

• For the purpose of this review, events resulting from defective procedures were those events that were at least partially the result of a lack of, J

deviation from, or deficiencies in, operating, maintenance or administrative control procedures. An event was deemed to be the result of a defective procedure if the LER stated that a procedural deficiency or deviation froa

)

a procedure was a contributing factor or that a procedure change (s) had or i

l would be made to prevent recurrence.

I l

i I

4 l

L_ _ _ -------- _-

- _ = _ _ _ _ _ _ _ _ _ _ _ - -

-4.

51te visits were made_to' Brunswick, Catawba, McGuire, Turkey Point, and Zion.

_These sites were selected because:

1 3

The McGuire, Catawba Turkey Point, and Brunswick. sites experienced seven, six, five, and four events, respectively (among the highest for multi-unit sites). Catawba 1 -Zion 1,.

- and McGuire-2 experienced six, four, and four events, respectively (among.the highest for single units).

L Brunswick and Turkey Point had made formal commitments to procedure' improvement / upgrade programs and'had relatively

. lengthy experience in-carrying out the programs.

The' sites are operated by utilities

• that have more than one site, i.e., similarities-in behavior at the sites operated by a single utility would probably be indicative of standard utility practice.

' Catawba and McGuire were selected because the events occurred while the plants had little experience.

2.0 OBSERVATIONS AT SELECTED SITES This section contains information on the events involving procedures that occurred at selected sites and a brief description of procedure control programs in place at those sites. Appendices C.1 through C.5 include more detailed information'on the events discussed.

2.1 Turkey Point Site In the sumer of 1983 Region II began to stress the importance of verbatim compliance with procedures. Turkey Point was cited on a number of occasions

, hen inspections showed procedures were not being followed in the control w

room,.particularly when transients resulted from failing to follow a procedure.

In an attempt to find the root cause of the problem,- the licensee stationed quality control _ people in the L ' tral room around the clock to observe -

compliance with procedures. They noted that the procedures could not be-folic.ad in a verbatim manner. When Turkey Point became aware ;f this problem,

(

action was taken to develop a procedure upgrade program (PUP). When the j

Performance Enhancement Program was proposed in February 1984, the PUP was j

part of the proposal.

I A site visit to Turkey Point was made on November 20-21, 1986, to review five.(5) significant events that occurred during 1984-1985 and that involved procedures.

')

• Carolina Power and Light (CP&L), Commonwealth Edison (Comed), Duke, and Florida Power and Light (FP&L).

l I

\\

LER 250-84-032 described an event in which an auxiliary feedwater pump was unavailable for a period of time greater than that permitted by technical specifications. Licensee personnel stated that many factors contributed to this event, but that the central problem was failure of management control systems to ensure correct technical specification (TS) requirements were incorporated in plant procedures. Thus, the LER really did not address the root cause; i.e., failure by management to ensure TS requirements were clearly interpreted and to ensure procedures were issued to meet the requirements. The completed corrective actions included procedure changes, reliability improvement changes in the AFW system (e g., added a motor driven auxillary feedwater pump for startups), and training (pump operator training on equipment operation and shift advisor training on AFW system TS limitations).

LER 250-85-021 described an ovent on July 22, 1985, in which an AFW actuation occurred beca6e of problems with instrument air quality. As a result of the event Turkey Point developed a program of maintenance and surveillance procedures to ensure instrument air quality. The LER accurately described the root cause.

LER 251-84-017 described an event on August 7,1984, in which nuclear Units 3 and 4 tripped as the result of a switching order executed from the fossil Units 1 and 2 control room. Licensee personnel stated this problem had not been anticipated. They also observed that until recently tripping the plant (s) was considered an acceptable way of concluding an event. Action to prevent recurrence consisted primarily of changes to administrative / management controls.

LER 251-85-012 described an event in which Unit 4 tripped because of a failed inverter. Licensee personnel stated the inverters had been unreliable but they had not determined why, and a preventive maintenance program was instituted on an interim basis to prevent inverter fr ilure. The problem has not recurred since the inverters were replaced, indicating an aging problem and/or deficiencies in the previous maintenance program.

LER 251-85-017 described an event on June 20, 1985, in which Unit 4 tripped because of an inverter failure. The problem was primarily due to a failure to follow a procedure.

In the review of the Turkey Point events it was found that the LERs usually gave a reasonably complete description of the events, causes, and corrective actions. However, it was found during this more detailed review that a cause of an event different from the one given in the LER was as plausible as the one in the LER. For example, LER 250-84-032 implied that a personnel error was the primary cause of the event, while it might have been more accurate to state that a failure in management control systems to incorporate clear TS requirements into plant procedures was the cause.

Four of the five events that were reviewed were really the result of broad progrannatic problems or deficiencies or equipment problems (failuie to incorporate TS requirements into a procedure (s); failure to maintain adequate instrument air quality; failure to insulate nuclear operations from non-nuclear; and inverter failures) rather than problems with specific procedure details.

3

Only the event resulting from failing to follow the procedure may have been due entirely to a procedure defect.

A brief review was also made of results of the Turkey Point PUP. The procedure qualify control program at Turkey Point seems to be a good one. There are procedure writer's guides for administrative, normal operating and off-normal operating procedures similar to those for the emergency operating procedures (EOPs).

-There are also writer's guides for maintenance procedures and health physics procedures. An administrative procedure directs the usage of and compliance with procedures. The procedure specifies a policy of verbatim coupliance'with procedures, i.e., operating procedures shall be followed exactly, word for word, and in a step-by-step manner (with certain specified exceptions).

2.2 Brunswick Site

On September 4,1983 Brunswick 1 experienced an event in which both HPCI and

. RCIC were isolated primarily as a result of a defective procedure (see LER 325-83-040). As a result of this and earlier problems with procedures

• CP&L determined that Brunswick would undertake-a Maintenance Surveillance Test.

(MST) procedure upgrade program to ensure the quality of procedures for certain tests required-by technical specifications. This formal commitment was made part of the Brunswick Improvement Program. When the Brunswick Improve-ment Program was initiated, the responsibility for preparing MSTs in accordance with a writer's guide was given to the maintenance department. The procedures upgrade program was to apply to all MST procedures that concerned tech spec mandated actions.

.By November 1986 Brunswick had completed a review and upgrade of essentially all MST procedures. Because the procram was considered successful, CP&L decided to apply essentially the same program to a review and upgrade of all maintenanceinstructions(Mis).

Two of the four events reported in LERs during 1984-1985 involved conditions that were discovered during the procedure review / upgrade process.

A site visit to Brunswick was made on November 18-19, 1986, to review four events in 1984-1985 that were significant and that involved procedures.

LER 325-84-011 described a Brunswick 2 event on September 24, 1984, in which a control. room operator (CRO) set up a flow path from the reactor coolant system.to the rad waste control system until the reactor tripped automatically on low water level. There were two independent problems in this event. The first was that' fill and vent procedures were incomplete (did not allow for sufficient venting of sensing lines). The second was that the CR0 failed to obtain and use the appropriate procedure. The CR0 apparently had some unwarranted sense of urgency and momentarily was confused about the identity of the unit.

LER 325-85-003 described an event in which certain equipment was not being tested in accordance with TS requirements. The event occurred because surveillance procedures had not been revised to account for equipment changes.

This was identified in the procedure review process.

• Abnormal Occurrence #83-2, " Deficiencies in Management and Procedural Controls" describes problems at Brunswick.

4

O-LER 325-85-008 described a Brunswick 1 avent in which the standby gas treatment system would not reset for automatic o snual initiation following a temporary loss of powerc Administrative control.

.re used until a design change could be made, LER 324-85-058 described an event in which the LPC7 mode of RHR was made inoperable during testing because of an error made.during earlier procedure revisions. This was discovered as part of the procedure review / upgrade process.

During the review of.the Brunswick events it was found that the i.ERs usually-included a complete description of the events, causes, and corrective action::.

Two of the four Brunswick events were clearly conditions that were the results of procedure defects;. however, they were conditions (relay not being tested in accordance with TS requirements, and LPCI mode of RHR made inoperable during.

testir.g) that were identified as part of the procedures review / upgrade precess.

.as intended. There were two independent problem in one of the remaining two events. One problem was that the fill and vent procedure was not complete, but the other problem (system design) had nothird to do with procedures. The fourth event was the result of an equipment design problem.

Although it appeared from LER descriptions that four events were the result of defective procedures, only one actually was (fill and. vent maintenance procedure). Overall, the events at Brunswick indicate the MST procedures upgrade program has been producing the desired results.

2.3 Zion Site Zion has not formally connitted to any procedure improvement program. However, certain st is have been taken to systematically upgrade procedures. The Zion.0perations Department has awarded a contract to' develop a procedure

. writer's guide (the guide has been completed) and to revise all general operating. procedures (GOPs) and tech spec surveillance procedures (Pis) by July 1987. Zion plans to revise other procedures such as system operating instructions (501s). The Maintenance Department has just awarded a contract to have diesel generator maintenance procedures written or rewritten by October 1987 (this was driven primarily by the October-24,1986, loss of the "1D" EDG, described below).

A site visit to Zion was made on December 3-4, 1986, to review four significant events that occurred during 1984-1985 and that involved procedures.

LER 295-84-031 described a Unit 1 event on September 14, 1984, in which decay heat removal was lost while draining down the RCS. As a result of this event the dratadown procedure was modified to help ensure RHR would not be lost, and an emergency procedure was developed for responding to this type of event.

In additfoi hardaare changes were to be cons 1(ered to improve RCS level indica-tion. Howevcr. it was a subwguent loss of OHR event at Unit 2 on December 14, 1985, that convinced Zion pe:sonnel of the value of hardware / design changes (improvements in the level sedication system) in order to best preclude this type of event. Therefore, although deficiencies with procedures was a significant contributing factor in the September 14, 1984 event, it seems that improvements in the level ~ 1ndication design could be considered a necessary corrective action. Procedures represented a temporary fix.

5

t #

6:

I!

1.,

LER 295-85-003 describes an event on January 15, 1985, in which a diesel

_ generator tripped because a lube oil pump snaft had n;t been realigned Lfollowing maintenance. The overhaul inspection chedlit t was revised to l include alignment of the engine driven lube cil pump. This problem was j

the result' of an incomplete _ procedure.

In a. sic.ilar, more recent event at Zion on October 24,1986, the "1B" diesel generator was ~ damaged during post maintenance testing. The damage resulted-because work had been done to a work order / instruction (rather than a detailed

' procedure) that did not specify the precise order of disassembly and reassembly-and values for torquing an articulating rod. It seems this event would not-

'have occurred had the maintenance work bera done to a detailed instruction. The licensee did not consider the event repor'able by LER, because the diesel was being tested and had not yet been declared operable;;a full report on this event is included in Inspection Reports 50-295/304-86-026, dated '18 February 1987 (two violations were identified during the review of this event). The diesel was repa* red by February 1987'(i.e., it was out of service for four months).

LER 295-85-004 described a Unit 1 event on January 25, 1985, in which the suction flowpath was lost from the refueling water stcrage tanks to the residual heat remuval (RHR) pumps because a motor operated valve failed to reopen after being stroked closed during a test. This was primarily an equipment failure, although a procedure specified that the test be perforwed

-while operating at power rather than under other conditions. The problem here is a generic one in that it concerns what testing should be done at power and is'not 1imited to one procedure.

LER 295-85-008 described an event in which an RCP bearing oil component cooling relief valve-lifted and failed to reseat. This occurred because the relief valve was incorrectly reset during an earlier inspection and reinstallation using a-general shop procedure. The procedure was deficient because it lacked sufficient.

i detail.

The review of the four Zion LERs indicated that procedure problems were an '

important factor in each of the events. However, two of the four events also involved equipment problems (the loss of RHR event also involved the level indication system, and the RHR. suction flowpath isolation event involved a MOV).

2.4 McGuire Site McGuire.has made no commitments to the NRC regarding a procedure improvement program. However, site personnel stated that comitments had been made to

-INPO to develop such a program. McGuire must meet Duke's requirements concerning procecures, including requirements for independent verification.

McGeire requires that procedures be reviewed and approved by " qualified reviewers" (i.e., personnel trained and qualified to check on procedure quality).

~

A site visit to McGuire was made on January 20-21, 1987, to review seven significant events that occurred in 1984-1985 and that involved procedures.

6

)

l 1

1 LER 370-84-001 described two loss of decay heat removal events that occurred at Unit 2 on December 31, 1983* and January 9, 1984 The events occurred because the operating procedure did not ensure sufficient RHR suction head.

This was primarily a management / administrative control system deficiency l

because the procedure was based on data transferred from Unit I without confirming the layouts (e.g., elevations) were the same. This fact was not clear from the LER. The LER also describes level indication system changes that were planned to prevent recurrence.

LER 370-84-002 described a loss of decay heat removal event that occurred on January 15, 1984. Discussions with licensee personnel indicated that decay heat removal was lost because of procedure problems (procedure was too long and l

complex and was performed infrequently), and personnel errors (Assistant Shift Supervisor and IAE Specialist did not comply with station administrative details regarding tagging). Therefore, this was the result of a pracedure problem (too complex) and personnel errors.

LER 369-84-018 described a loss of control area ventilation (VC) on June 4, 1984, due to a less than adequate design. The design problems are that (1) the VC chiller is not correctly sized for the control room area load and tends to trip on an increasing loss of lube oil, and (2) the computer circuit cards tend to fail under normal operating conditions. Procedure changes were made as an interim measure while the problem was evaluated, but the root problem was the design.

i LER 369-84-025 described an event on June 27, 1984, in which a containment spray valve was found open (35 gallon spill). The LER notes the procedure governing independent verification (IV) would be changed to require IV for all vent, drain, and test connection valves in the CSS tu RHRS headers end that the requirements for other systems would be reviewed. Changes to the Operations Management procedure indicate station personnel recognized this as a potentially generic problem.

i LER 369-84-030 described a UHI system failure on October 31, 1984, resulting

)

from incorrect installation of the UHI accumulator level transmitters. The 1

important problem was that installation and test procedures had not been adequate i

to show the equipment to be incorrectly installed. The actions to prevent recurrence included procedure reviews to determine appropriate testing require-j ments (administrative / management change).

LER 370-84-028 described UHI system damage on November 13, 1984, that resulted because of a pressure surge generated during performance of a calibration procedure. The calibration procedure did not consider the occurrence or consequences of a pressure surge. Therefore, the procedure was incomplete.

I LER 370-55-017 descrdbed a Unit 2 trip on June 1, 1985, due to grounding of l

level switches because of corrosion / moisture intrusion. The possibility for the corrosion / moisture intrusion had not been anticipated. Administrative /

management procedures were changed to prevent recurrence.

• Unit 2 schieved initial criticality on May 8, 1983.

7

'Of the seven significant events reviewed at McGuire, three 6ccurred at Unit I and four at Unit 2.

In the first McGuire I svent, design problems in the Control Area Ventilation system were the root cause, and procedure changes were an interim solution to the-problem.

In response to the second event (mispositioned containment spray v&lve), the licensee increased independent verification (IV) requirements and began a review of IV requirements for other systems. The third McGuire 1 event resulted because installation and test procedures had not shown these activities were performed correctly.

In summary, the first McGuire 1 problem was due to a design problem and the other two were due to problems with administrative / management programs, rather than details of procedures. All three McGuire 1 events occurred in 1984 (none in 1985).

Three of the four McGuire 2 events took place within 2 years of initial criticality. The first two events consisted of losses of shutdown cooling.

One was due to an incorrect design and the other to an incorrect procedure.

' Failures to follow the tagging procedure was a contributing factor in the second event. The two remaining McGuire 2 events involving procedures involved the UHI system and the feedwater system and equipment design deficiencies were a contributing factor in both.

Licensee personnel were confident that corrective actions to prevent recurrence would be acequate because Employee Training and Qualification System (ETQS)

Coordinators (and their staff) detenaine appropriate changes 'to training.

However, a potential problem with this is a possible tendency to rely too heavily on training as a solution.

2.5 Catawba Site Catawba has not formally committed to a procedure improvement program. Catawba must meet Duke's requirements concerning procedures.

A site visit to Catawba was made on January 22-23, 1987, tu review six significant events that occurred in 1984-1985 and that involved procedures.

LER 413-84-022 described two occasions in November 1984 on which contract cleaning personnel deliberately opened containment sump intake screen doors.

Locks were installed and administratively controlled to prevent recurrence.

Catawba 1 LER 413-84-024 described an automatic starting of the motor driven feedwater pumps on November 24, 1984, because a test was carried out incorrectly due primarily to a lack of written instructions. This was also considered to be an administrative / management procedure deficiency.

1.EP 413-85-002 described an event on Detteber 31, 1984 in which the Ice Condenser Lower Inlet Doors were found blocked closed. Administrative /

management procedure changes and improved labeling and identification were steps taken to prevent recurrence.

1 8

i

..e

?bi r

.LER 413-85-028 described an event on April 22, 1985, in which both trains of

'RHR were inoperable. The corrective actions included both equipment (level 1

-indicating systen) and. operating procedure changes.

LER 413-85-053 described an event on - August 19, 1985, in which the diesel generator IA battery charger was inoperable. -The corrective action included equipment design changes and procedure-improvements.

LER 413-85-066 described mode changes on November 19, 1985, that had been made with equipment inoperable. The corrective ~ action consisted of improvements in administrative / management controls.

. In discussions with licensee personnel it was agreed that all six events involved procedures. Four were primarily the result of deficiencies in administrative / management. control procedures. The remaining two also involved-design deficiencies and one of the two also involved a failure to use a procedure.

It is-important to note.that all six of the Catawba 1 events were experienced while the plant had less than one year of operating experience. Therefore,.

the large number of chances to administrative / management procedures is not necessarily indicative of a prchlem. The changes indicate that Catawbe recognized training and/or counseling are frequently not sufficient to ensure human performance problems do not recur.

Detailed Incident Investigation Reports (IIFs) were prepared by the Catawba-Safety Review Group (CSRG) for these events. The LERs prepared by licensee.

headquarters from the IIRs are less detailed. This might be a problem when the details concern corrective actions and actions to prevent recurrence, because when a number of actions are taken, it is not always clear which were effective.

3.0 REVIEW 0F THE OVERALL RESULTS During the. review of events it selected sites additional infomation was obtained on 26 of.101 significant events in 1984-85 that involved procedures.

This was a substantial if not necessarily representative sample.

In order to compare the results of the reviews at the five sites, all events were categorized using connon teminology. The results of the categorization are displayed in Table C.1, and are sunnarized as follows:

Number of Category Events Progrannatic Problem 11 Procedure Defect 9

Failure to Use/ Follow Procedure 2

Procedure was Interim Measure 2

Condition Observed 2

Total 26 9

W -----

x Table C.1 Categories of Selected Events Involving Procedures

• Site Event (LER()

Category Comments

. Turkey Point 250-84-032 Programmatic Problem Clear TS interpretation not in procedure.

250-85-021 Programmatic Problem No program to ensure instrument air quality.

251-84-017 Progrannatic Problem Inadequate insulation of nuclear from non-nuclear

. operations.

251-85-012 Programmatic Problem Inverter failures due to inadequate maintenance

],

program and/or equipment aging.

251-85-017 Failure to follow Did not perform step in Procedure procedure.

Brunswick 325-84-011 Failure to Use CR0 reacted too hastily Procedure (fillandventmaintenance procedure also inadequate).

325-85-003 Ccndition Observed Procedure not changed to reflect equipment change.

325-85-008 Procedure was Administrative controls Interim Measure instituted until SGTS design change could by made.

374-85-058 Condition Observed Error made during earlier procedure change.

Zion 295-84-031 Precedure Defect Lack of procedure for j

loss of RHR.

295-85-003 Procedure Defect No requirement to align

)

lube oil pump shaft.

295-85-004 Programmatic Problem Test at power rather than CSD(alsoequipment failure).

295-85-008 Procedure Defect General relief valve procedure had insufficient detail.

McGuire 370-84-001 Procedure Defect RHR operating procedure l

based on linit I layout.

j 370-84-002 Procedure Defect Procedure too long and complex and was performed infrequently.

369-84-018 Procedure was Control area ventilation Interim Measure design problem under study.

369-84-025 Programmatic Problem Independent. verification requirements reviewed.

• Categories are defined at end of table.

10

__ _ = - -

.x

a

-Table'C.1 (Continued):

Categories 'of. Selected Events Involving Procedures 1

Site' Event (LER#);

Category Coinnents McGuire 369-84-030

. Programmatic Problem Installation and-test procedures did not ensure:

equipment was correctly.

)

installed.

370-84-028 Procedure Defect.

Did'not consider pressure surge with equipment configuration.

370-85-017 Procedure Defect Design did not consider moisture int M ion /-

corrosion.

Catawba 413-84-022'

'Proceoure Defect

. Locks were installed as corrective action.

413-84-024-Procedure Defect Test was carried out incorrectly due.to a lack of written instructions.

413-85-002:

Programmatic Problem A/M changes and labeling to ensure correct configuration.

413-85-028'

. Progrannwtic Problem.

Equipment, procedure.'and training changes to prevent loss of RHR.

413-85-053 Programmatic Problem EDG battery charge equipment, procedure,

-and training problem..

413-85-066 Programmatic Problem Changes to prevent mode changes with equipment inoperable.

Notes:~

(1) Programmatic. Problem: A number of actions were taken to prevent recurrence. This was because (1) the problem was treated as a potentially generic one (e.g., independent verification requirements were less than adequate in one procedure and could therefore be inadequate in others), or (2) all possible contributing factors were addressed.

(2) Procedure Defect: A-specific procedure was not required or was incorrect or incomplete.

(3) Failure to Use/ Follow Procedure: Procedure V:as required and available but was not used or was used but not correctly.

(4).' Procedure was Interin Measure: Procedures were used in the interim until the actual problem could be identified and/or resolved.

(5) Condition Observed: Event consisted of condition.

b

,9 11 n

I i

Events were categorized as a programmatic problem, if the actions to prevent l

recurrence indicated the problem was being treated as a potentially generic one, or if many possible contributing factors were being addressed. Roughly 40% of the events (11 of 26) fell into this category indicating thorough action was frequently taken in response to significant events.

Roughly one-third of the events were categorized as a procedure defect i

indicating that events also frequently involve a single procedural problem.

There was no evidence in these cases that the problem was being restricted to permit a quick resolution.

The remaining six events were evenly distributed in three categories. In the j

two events where personnel failed to use or to follow a procedure, personnel

)

error was involved.

In two of the events procedures were used (administrative controls were implemented) to permit continued operation while equipment problems were being resolved.

In two events (both at Brunswick) significant procedure defects were detected as a result of the procedure upgrade program.

One may conclude from these results that significant events ascribed to human performance problems should always be viewed as potential programmatic problems.

That is, all possible causes and contributing factors of a significant event should be analyzed.

4.0 GENERAL OBSERVATIONS Although there may be a number of reasons why some sites have procedure upgrade programs and others do not, the single most comon factor seems to be prior performance problems, i.e., licensees comitted to procedure upgrade programs as part of regulatory improvement programs. Some sites may appear not to need a procedure upgrade program because events were not experienced that were attributed to procedures. In addition, strengths in programs like personnel qualification and training at sites may compensate for procedures. However, significant events have frequently been the result of deficiencies in procedures, and the NRC should strongly encourage formal commitments to programs to con-j tinuously monitor and upgrade proct. dure quality.

A comparison of actions taken in response to the events at the five sites demon-j strates the need to review and take action b4 sed on operating experience. The i

sites with less operating experience experienced a number of events that were a function of lack of experience (f.e., problems were experienced that had not been anticipated). This is expected.

It is, however, evidence of the value of j

analyzing the operating experience at other sites to anticipate and tc make changes that can preclude problems.

1. review of the loss of decay heat removal events provides an example of this. Losses of shutdown cooling occurred at Zion, McGuire, and Catawba, but the responses to the problems vary. McGuire responded to the loss of RHR events at Unit 2 of December 1983 and January 1984 by making changes to both equipment and procedures to prevent recurrence. The corrective action taken at Zion following the September 14, 1984, event emphasized develop-j ment of emergency response procedures.

(Such procedures were not available.)

However, it took a second event at Zion on December 14,1985(15 monthslater) i before strong action was taken to prevent recurrence. Catawba responded to the I

April 22, 1985, event with hardware changes to improve the level indication system. An improved level indication systet, together with better procedures and training in the use of these, are changes that are much more likely to 12

{

1

1, preclude' problems.* Plants that adequately review industry operating experience are in a position to anticipate problems and to develop changes to preclude those problems. Further, they are in better position to determine whether the most effective changes are to equipment, procedures, training, or administrative practices.

Improvement merely to procedures or training in operating a system ultimately increases the burden on the operator and may be substantially less effective than /4 change to equipment design. One of the lessons learned as a result of the three 1985 IIT investigations (Davis-Besse, San Onofre, and Rancho Seco events) was that operating events can impose a significant burden on the operating personnel on duty.

Notes:

• (1) The April 22, 1985, Catawba event and the December 14, 1985, Zion event are subjects of NRC Infonnation Notice 06-101. The most recent Information Notice 87-23, " Loss of Decay Heat Removal During Low Reactor Coolant Level Operation," dated May 27, 1987, includes a review of problems associated with recent loss of DHR events and actions that have been taken to preclude this type of problem.

(2) The differences in the responses of Iton, McGafre and Catawba can be put in better perspective by considering two factors. F1.rst, although Zion has experienced the loss of RHR on a number of occasions prior to the September 14, 1984 event, those events were not reportable prior to the changeinreportingrequirementsof10CFR50.73(effectiveJanuary1984),

i.e.. the potential problem was far less visible than at the other sites.

Second, the response by McGuire to the events at Unit 2 was influenced by other events that had been experienced earlier at Unit 1.

Similarly, the Catawba response appears to have been influenced by the previous occurrence of the McGuire event!.

i 13

.s c

i j'*

'l APPENDIX C.1 I

Ejents Involving Procedures Turkey Point Site 1.

LER250-84-032(Unit 3)

Technical Specification LCO Exceeded - AFW Pump Operability.

The following information on the event was included in the LER abstract:

]

o'

" Event:

On December 3, 1984, while Unit 3 was'at 100% power and Unit 4 was in a hot shutdown condition in the process of a unit

.j start-up, the Technical Specification 3.8.4.b limiting condition

.s for operation-(LCO), related to the auxiliary feedwater (AFW)

{

pump' availability, mas inadvertently exceeded. Although Technical i

Specification 3.8.4.b does not specifically address the remedial actions necessary when one AFW pump becomes inoperable and either reactor coolant system is heated to above 350'F but is at less than i

2% of full powsr an interpretation of this technical ' specification would require an imediate cooldown of one unit to less than 350*F.

During periodic functional testing of the "A" AFW pump, this pump I

was.taken out of service for two hours and 16 minutes without initiating a Unit 4 cooldown.

J Cause of Events: The root cause of the occurrence was the failure by plant personnel to properly apply two recent interpretations of Technical Specification 3.8.4 which would require the immediate initiation of a reactor system cooldown of one unit to-less than j

350*F, provided that this unit is maintaining a reactor coolant temperature above 350'F but is at less than 2% power.

Interim Corrective Actions: Two interim corrective measures already 1

taken are identified in the text portion of this LER.

Long Term Corrective Actions: Long term corrective measures will include:

(1) a further revision of. the Technical Specification 3.8 to allow an action time period, upon entering the LCO, before l

cooldown of a unit to below 350'F; (2) the completion of a significant effort to evaluate and enhance the performance and reliability of 'the AFW system;'(3) training for operators on the manual speed adjustment and mechanical / electronic overspeed protection features of the AFW pumps, which will be included as a stahdard subject in all subsequent annual operator requalification training and other operator training programs; (4) initiation of hands-on training for AFW pump operators on the AFW pump operation and protective equipment; and (5) documented l

l

. training by Shift Advisors on the requirements of technical specifications as they relate to the AFW system operation, equipment l

trips, and' operating limitations. The health and safety of the public L

were not' affected. Similar occurrences: 250-80-006, 250-83-009, 250-83-012, 250-84-008."

The LER states that this event was the result of a failure by personnel to correctly perform an action. Therefore, it implies that the event was mainly the result of some error by personnel. This is reinforced by the emphasis on training in the action to prevent recurrence.

14

During the site visit licensee personnel stated that although there were many factors contributing to this event, the central problem was failurs of management control systems to ensure correct TS interpretations were incorporated in plant procedures.

In fact, they implied the error was

+-

understandable. The complete corrective actions includeo procedure changes, reliability improvement changes in the AFW system (e.g., added a MDAFP for startups), and training (pump operator training on e shift advisor training on AFW system TS limitations)quipment operation and Thus, although the LER was not inaccurate, it did not bring out a potentially serious problem. That is, operators did not have clear procedures that would ensure TS requirements were met.

i 15

l APPENDIX C.1 Events Involving Procedures Turkey Point Site 2.

LER 250-85-021 (Unit 3) '- Engineeeed Safety Feature Actuation y-Auxiliary Feedwater System Initiation.

The following infomation on the event was contained in the LER abstract:

" Event: On July 22, 1985, while unit was in hot standby and Unit 4

(

at 100% power, two automatic initiadons of the auxiliary feedwater (AFW) system occurred. While recovering from a Unit 3 reactor trip (LER 250-85-019) the "B' steam generator (SG) bypass feedwater control valve (FCV-3-489) would not open. The "B" SG level decreased ur.til it reached the low-low SG' level setpoint (15%) which resulted in an automatic start of the AFW pumps. Later during the Unit recovery the "C" SG bypass feedwater control valve (FCV-3-499) would not close.

This resulted in the "C" SG level increasing until it reached the high-high level setpoint (80%). This tripped the "B" SG feedwater pump that was in operai;1on, thus comp % ting the SG protection logic and the AFW system automatically started.

In addition, it was discovered that the train 2 AFW flow control valve (CV-3-2833) wo~uld not close. The ~ valve was declared inoperable and a unit 3 cooldewn to hot shutdown ccaditions was commenced and completed.

Cause of Event: The reason for the malfunction o,f the valves described above was due to the quality of instrument air supplied to the valve actuators.

Corrective Actions: The following corrective actions were taken:

T)

The actuators for the AFW flow control valves on both units, FCV-3-489 and FCV-3-499 were inspected, cleaned, and verified to operate properly.

• )

A blowdown of low points in the instrument air system and flow control valve actuators was done to remove any traces of moisture from the instrument air system.

3)

The desiccant was replaced in both units instrument air dryers."

In the body of the LER there is a brief description of the operating and surveillance procedures to be instituted for the instrument air system.

During the site visit personnel confimed that they simply had not been aware that a maintenance and surveillance program was necessary to maintain air quality in this system. When the surveillance and operating procedures were put in place, problems did not recur.

16

'- i g,

)

APPENDIX C.1 4

Events Involving Procedures Turkey Point Site

.7 3.

LER251-84-017(Unit 4)- Reactor Protection System (RPS) - Reactor Trip.

- The following information on the event was included in the LER abstract:

"On August 7,1984, with.both Unit 3 and Unit 4 at 100% power, l

Unit 4 experienced a reactor trip coincident with a loss of the Unit 3 start-up transformer. The root Cause was detemined to l

stem from an incorrect switching order that, when executed from i

the Fossil Units 1 and 2 control room, caused the Unit 3C i

transfomer to be de-energized, thus, de-energizing the 4C 4KV

]

bus. The 48 steam generator feed pump and 4C condensate pump are j

powered by the 4C bus and each. therefore, tripped. The Unit 4 i

reactor trip occurred when the reactor protection logic of steam flow greater than feed flow, coincident with steam generator low level for A steam generator was made up, caused by the feedwater flow reduction. The' source of off-site power, that wo inadvertently disconnected, supplies power to the Unit 3C transformer (which powers Unit 4C bus) and the Unit 3 start-up transformer. Unit 4 was stabilized and power was restored to the Unit 3 start-up transformer, Unit 3C transformer and to the Unit 4C bus shortly i

after the reactor trip. All equipment. functioned as designed on initiation of the engineered safety feature actuation signal (ESFAS).

The health and safety of the public were not affected. Similar occurrences:

250-84-007.

During the site visit licensee personnel stated this problem had not been anticipated. They also observed that it was not many years ago that tripping the plant (s) was not considered an unacceptable way of concluding an event. Action to prevent recurrence consisted primarily of changes to administrative / management controls.

17 1

L

APPENDIX C.1-

' Events Involving Procedures Turkey Point Site 4

LER 251-85-012 Reactor Protection System (RPS) Actuation - Reactnr

-Trip.

The following information on the event was included in the LER abstract:

" Event: On May 30,1985, while Unit 4 was at 100% power, a reactor trip occurred due to the loss of power from the AS inverter to the 120 VAC vital instrument bus for the panel 4P07. The loss of. voltage on the vital bus msulted in the "B" steam generator level Channel II failing low, the steam generator' feedwater control station transferring to manual. While manually controlling feedwater flow, a reactor trip occurred when the mactor protection logic of steam generator Icw level coincident with steam flow greater than feedwater flow or the 48 steam generator was completed due to a feedwater flow transient caused by a turbine runback. The unit was stabilized in a hot shutdown condition. The health and safety of the public 'were not affected.

Similar occurrences: LERs 280-84-003, 250-84-014, 250-84-026, 251-84-011, 251-84-021, 251-84-022.

l l

Cause of Event: The loss of power to the vital instrument bus serving the 4P07 panel resulted from a blown fuse on the AS spare inverter.

Although a full set of tests were performed on the inverter which demonstrated that it met the manufacturer's specifications, the exact cause of the blown fuse could not be determined.

In the past, both plants have experienced similar events due to the loss of power from

(

these inverters.

Corrective Actions: The following corrective ections were taken after the event:

1) poer to the vital instrument bus for panel 4P07 was re-established at 6:52 p.m., following the reactor trip by manually transferring to the 4A inverter.

2)

The AS inverter was successfully tested in accordance with the manufacturer's maintenance manual.

3)

A post-trip myiew was performed and no abnormal operating conditions wem identified. Following the satisfactory testing of the inverter, the unit was returned to service at 3:51 a.m.

on May 31, 1985.

4)

The long term corrective action to enhance the reliability of vital AC instrument power supplies will be to replace the inverters with a nodel of a different rrufacturer. Replacement of the inverters for both Units 3 and 4 is arrently scheduled to begin in July 1985.

5)

As an interim measure, a comprehensive preventive maintenance task g

action plan ws developed to enhance the reliability of the inverters until they are replaced."

i 18 t

3 c.;

During-the site y,t' licensee personnel stated that the inverters were a ' unreliable but-they were unable to discover why. A preventive maintenance

' program was instituted as an interim measure to avoid inverter failure until the inverters could be replaced. Licensee personnel felt there may have been 1

a problem with equipment aging, because the problem has not recurred since the

' inverters were. replaced. It is possible that the inverters were operated sc long without an adequate maintenance program that replacement was the only 1

solution possible. The current inverter maintenance program is ir,accordance l

with the manufacturer's recommenda+46ns.

,/'

l i

1 L'

I

\\'

19 I

.e APPENDIX C.1 Events Involving Procedures Turkey Point Site 5.

LER 251-85-017 Engineered Safety Feature Actuation - Reactor Trip.

The following information on the event was included in the LER abstract:

Event: On June 20,1985, Unit 4 experienced a reactor trip from i

TO W full power. The 4C inverter that was in service supplying power to the 120 volt vital instrument panel 4P06, tripped. Loss of 4P06 de-energized level controller LC-460C and the pressurizer spray valve controllers (causing the spray valves to remain at their last deraand position). De-energizing of LC-460C generated e false indication of low pressurizer level (less than 14%) which de-energized the pressurizer heaters (control and backup) and initiated letdown isolation. Loss of 4P06 also resulted in the loss of automatic operation of power operated relief valve (PORV), PCV-4-455C. PORV PCV-4-456 was available with its associated block valve, MOV-4-535 closed due to slight leakage through PCV-4-456. These conditions, along with a turbine runback due to loss of power to nuclear instrumentation system channel N-41 resulted in the reactor coolant system pressure increasing until it reached the pressurizer high pressure reactor trip setpoint of 2370 psig resulting in a reactor trip.

Cause of Event: The loss of the 4C inverter occurred while attempting to energize the 3C inverter onto the 3B 120 volt DC bus.

The procedural requirements for this evolution require charging the 3C inverter's charging capacitors prior to energizing the inverter onto the bus. This step was not executed causing the lost of the 3C inverter which resulted in a DC bus transient which in turn caused a loss of the 4C inverter.

Corrective Actions: The following corrective actions were taken following the event:

1)

Power to the vital instrument bus for panel 4P06 was re-established and the affected equipment was returned to normal lineup.

2)

The 3C and 4C inverters were inspected and checked as per maintenance instMctions and no significant problems were found.

3)

A post-trip review was completed and no abnormal operating conditions were identified. Following completion of necessary repairs, inspections, and testing, the unit was returned to full power at 9:00 p.m., on June 23, 1985.

4)

The long term corrective action will be to replace the inverters with a model of a different manufacturer. Replacement of the inverters is currently scheduled to begin in July 1985."

20 J

~.:

l j

l p

During the site visit licensee personnel confirmed that this was the result of I

l

.a number of factors, as follows:

']

i Inverter unreliability (',ee LER 251-85-012,above). Deterioration possibly due to aging and/or lack of an adequate maintenance program.

Failure to follow procedure. 3C inverter's charging capacitors were not charged prior to energizing the inverter onto the 38120 j

volt DC bus for post maintenance no load check out.

(It is ironic j

that the inverter had been out of service as part of a preventive i

maintenance task action plan to enhance the overall reliability of the inverters.) The cause for this is unknown.

The logic for initiating a turbine runback was unnecessarily conservative (runback on one of four NIS channels experiencing "roddrop" signal).

21

APPENDIX C.2 Events Involving Procedures Brunswick Site 1.

LER 325-84-011 Reactor Low Level Due to Misoperation of the Residual I

Heat Removal System.

J 1

Information on the event was included in the LER abstract. as follows:

i i

"On 9/24/84, at 2134, an automatic trip of both Unit 2 Reactor i

Protection System (RPS) channels A and B with Primary Containment Isolation System (PCIS) groups 2, 6, and 8 isolations occurred due to a reactor low water level No.1. At the time Unit 2 was in a refuel / maintenance outage with a primary containment integrated leak rate test (ILRT) in progress. Reactor level was 177", reactor temperature was 95'F, reactor pressure was 42 psig, and reactor control rods were inserted.

The B loop subsystem of the Residual Heac Removal (RHR) System was in reactor shutdown cooling. The A loop subsystem of the Reactor Core Spray (CS) system was in standby, The A loop subsystem of the RHR system and the B loop subsystem of the CS system were oisabled for the ILRT.

While attempting to lower the suppression pool level, the duty Control Operator misconceived that the B loop subsystem of the RHR system was in use for suppression pool cooling. He opened the RHR system discharge valves, 2-E-F040 and F049, to the Units I and 2 commen Radiological Waste Control (RWC) System resulting in a flow path from the reactor vessel to the RWC system. Upon receiving the low level scram, the Control Operator realized his action and immediately closed the subject valves.

Reactor level was returr.ed to nomal within five minutes of the event by utilizing the Reactor Control Rod Drive System. The involved operator was appropriately counseled and disciplined.

Licensed plant operations personnel have completed real-time training concerning this event."

There were two aspects to this event, i.e., a maintenance procedure was deficient and a control operator failed to obtain and follow an appropriate procedure. The first was that the filling and venting procedures did not allow for sufficient venting of the suppression pool level sensing lines and this led to an erroneous level indication. The second aspect was the performance of the control operator. The control operator acted hastily to reduce the suppression pool level. The control operator had some sense of urgency and attempted to lower the pool level without first getting the appropriate procedure. The operator had been working on the operating unit and this was his first day on the unit in outage. (Although this operator was considered competent and had a good record, he quit within a month of this event.)

22

APPENDIX C.2 Events Involving Procedures Brunswick Site 2.

LER'325-85-003 -- Inadequate Logic System Functional Testing of the Units:I and 2 Common AC Emergency Buses' Degraded and Under-Voltage Relays ana Loss of Emergency Bus E-1.

Infonnation on the event is included in the LER abstract as follows:

"On.1/8/85 it was detemined that adequate surveillance testing pro:edures did nct exist to functionally verify operability of degraded voltage and loss of voltage actuation relay circuitry on Units 1 and 2 connon emergency ac electrical E-buses 1-4.

The applicable technical specification (T/S) to these relays is T/S 4.3.3.2.

Standing instructions to trip the master-slave feeder breakers of the subject E-buses on bus degraded voltage and to trip any operating unit Residual Heat Removal System or Core Spray System pump on loss of power to the subject E-buses were implemented. Also, special procedures were developed to functionally verify operability of the concerned logic.

On 1-10-85, at 1318, while preparing to perform the special procedure (6 logic system functional test) on the degraded voltage relays of E-bus E-1, the master-slave feeder breakers to the bus automatically opened. The emergency bus diesel generator reenergized E-1 within ten seconds. Unit I group 3 and 6 isolations occurred. Within 32 minutes, the master-slave feeder breakers to E-1 were recicsed, i

At the time of this procedural deficiency discovery and the loss of E-1, Units I and 2 were operating at respective power levels of 4

BB and 99 percent."

I It is important to note that this problem was identified during an On-site Nuclear Safety group review of logic system functional test procedures, i.e.,

the event was avoided.

This event illustrates the problems that can emerge if procedures are not reviewed to ensure that all equipment changes are accounted for.

Administrative control of procedure changes was not adequate to ensure required testing was done. A technical specifications requirements cross-reference list can prevent this type of problem.

The LER also includes the follow hg:

"A comprehensive program has been developed which will ensure the technical adequacy of existing and future procedures relative to logic system functional testing. This corrective action is embodfed with the Maintenance Surveillance Test (MST) procedure rewrite effort which addresses the following key elements:

i 23

-I 1.

The scope is defined to assess and rewrite logic system functional tests for instrument-related requirements identified with the technical specification.

2.

The MST program provides explicit instructions relative to the development, technical content, and comprehensiveness of -

the associated procedures.

3.

The MST program provides for the development of administrative hierarchy procedures which will sustain the quality of existing procedures and provide for the incorporation of new procedures associated with future plant modification.

The following scheduled c.ommitments are associated with this corrective action:

a.

The MST program is in progress with an expected completiori date of October 31, 1985 b.

The MST Writer's Guide relative to channel system testing is complete.

c.

The MST Writer's Guide relative to logic system functional tests is expected to be completed hy March 1,1985.

4.

Appropriate plant surveillance test procedures will be revised to include logic system functional testing of the subject logic circuits. This action is expected to be completed by June 7, 1985."

24

APPENDIX C.2 4

LventsinvolvingProcedures Brunswick Site a

3.

325-85-028 Design Inadequacy of Standby Gas Treatment System Not to Reset for Automatic or Manual Initiation Following a Temporary Loss of Power.

Infonnation on the event is included in the LER abstract as follows:

"On 5-14-85, it was determined a design error with the Standby Gas Treatment (SBGT) Systems of Units 1 and 2 would have prevented automatic initiation following a temporary loss of off-site power. Operator action would have been required to j

reset the systems, which conflicts with system design intent t

as described in the plant Final Safety Analysis Report recuiring autoinitiation. Control Room alann annunciations would have alerted control operators of both units that the systems were not reset. At the time of this detennination, unit I was in L

a refuel / maintenance outage and Unit 2 was at 100%.

Relay CRI, which trips or prevents starting of the SBGT's fans on high system temperature, was designec with seal-in contacts in its coil circuit to allow system restart either manually or automatically only after manual resetting. A loss of off-site power deenergizes CRI, producing the same effect as a system high temperature condition. This design deficiency would also prevent the Reactor Building supply and exhaust dampers from isolating on a high drywell pressure or low vessel level, as these isolation signals to these dampers are initiated through the SBGT logic. High Reactor Building radiation would initiate its design isolation.

On 5-14-85, administrative controls were implemented to have plant operators reset the SBGT System Ingic following a temporary loss of off-site power. A temporary repair to jumper out the seal-in contacts of CRI was completed on 5-19-85. Appropriate plant modifications, which produce an automatic reset of the SBGT System loss following a temporary loss of off-site power, will be implemented on both units by 7-8-85."

This was a design deficiency and the administrative controls were an interim measure taken until a modification could be made. This problem (design deficiency in SBGTS auto-start logic) is addressed in IEN 85-63. This problem was identified because personnel questioned an annunciator during a test, and requested that engineering investigate.

25

APPENDIX C.2 Events Involving Procedures Brunswick site 4.

LER 324-85-058 Inoperability of Reactor Core Spray and Residual Hest Rearaval Low Pressure Coolent Injection Systems During Periodic Testing.

Infor,tetion on the event is included in the LER abstract as follows:

"On 10/29/85, a determination was made that during performance of the Core Spray Simulated Automatic Actuation and Logic Functional Test, Periodic Test (PT) 07.1.9, both loops of the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR)

System were rendered incapable of reactor injection should receipt of an actual LPCI initiation signal occur. Tne PT is used to satisfy requirements of Technical Specification 4.3.3.2.

The procedural problem applied to Units I and 2 and was initially ciscovered during a technical review of the PT. Unit I was in a refuel / maintenance outage and Unit 2 was at 90 percent power.

The procedural problem resulted from o step in the procedure which deenergized relays in the reactor low pressure permissive logic to core spray initiation instrumentation.

It was not recognized this also prevented the RHR LPCI initiation logic from sensing reactor pressure. The cause of this oversight is attributed to inadequate technical review during prior revisions to the PT.

The PT procedure for Unit I was appropriately revised to ensure LPCI operability during performance of the testing. The respective Unit 2 procedure is currently being revised in a likewise nenner. By 1/31/06, a procedure developed by the ongoing Maintenance Surveillarice Test Rewrite program will be implemented to replace the PT on each unit with a procedure which only affects operability of the core spray loop under test."

This is another instance in which the procedure upgrade group review identified a deficiency that had been introduced during an earlier procedure revision (s).

It was not possible to determine how long this condition had existed.

l l

26

APPENDIX C.3 Events Involvino Procedures Zion Site 1.

LER 295-84-031 Loss of RHR Cooling Flow The following information on the event was included in the LER abstract:

"Whileincoldshutdown[9/14/84),drainingtheRCSinpreparation for steam oenerator primary-secondary leak testing the RCS level dropped below the suction line for the RHR pump es a result of an improper valve lineup which gave false indication of the RCS level.

The RHR pump was stopped when it was noticed that the motor amperage was fluctuating.. The valve lineup was checked and the lineup error corrected. RCS level was increased to ncrmel and the RHR pump was restarted. RCS temperature increased from 110*F to 147'F during the 45 minutes the pump was off."

The body of the LER included the following:

"To prevent reoccurrence the following actions will be taken. The drain' down procedure will specifically state that draining while purging is not allowed and that if any doubt exists about RCS level, all actions that could reduce RCS level will be stopped until proper level is verified. A modification will be considered for a completely hard piped system relieving to the PRT. A procedure for a loss of RHR will be written to provide guidance in the proper actions to be taken in the event of an indicated loss of RHR. Operating and Rac Chem personnel will be retrained in the proper procedures to be followed in valve lineups involving RCS drain down."

In discussions with licensee personnel concerning this event, it was clear that, although it was recoonized that certain corrective actions were called for, there was no great sense of urgency to do so. It was not until a loss of shutdown cooling event occurred at unit 2 on 12/14/85. That event is described in the abstract of LER 304-85-028, os follows:

"On December 14 at 3:25, 2B residual heat removal (RHR) pump became airbound as a result of vortexing. Unit 2 was in cold shutdown (mode 5) with the reactor head installed but not tensioned and the reactor coolant system (RCS) vented to atmosphere. 2B RHR pump had been in operation providing decay heat removal with RHR letdown in progress and 2B charging pump providing make-up flow to the RCS.

Decay heat removal was lost for 75 minutes with a RCS change in temperature of 15 degrees Fahrenheit. The unit had been shutdown for approximately 100 days therefore the safety significance was minimal.

The root cause of the event was identified to be inadequate procedures coupled with the lack of knowledge of the level at which the RHR pumps begin to cavitate. As a contributing factor, there were problems found with the level indication."

27

L The corrective actions were:

"Immediate Corrective Actions: Zion Station Standing Order 280 l

was written to inform operating personnel of a minimal RCS level to maintain. The order also put a tolerance on variations between the tygon standpipe and the level recorder, and what actions to be taken if the variance is excessive ced when a continuous tygon watch shall be established. An Operating Engineer's permission i

would be required to decrease level. Farning levels were installed on the level recorder in the control room indicating minimm level.

Th RCS level instrumentation was vented and found to be in perfect calibration and the RHR system was walked down to inspect for discrepancies.

Long Term Corrective Actions: A modification, M22-1(2)-84-13 to iirovide accurate RUS level indication during refueling has been initiateo. The modification will be split into 2 segments. The j

first segment will address the tygon level system.

The system will be hard piped from the loop drain to the top of the pressurizer with a small section employing tygon as a sight glass. This segment will be installed during the next unit I refueling outage.

Procedure changes will be implemented to insure adequate monitoring of the tygon level system based on plant conditions. The second segment will consist of removal of the existing level transmitters ind design of a system that will gfve reliable remote level indication during all plant refueling configurations. This system will have a low level alarm. A modification will be initiated to install an RHR pump suction pressure transmitter With indication in the control roor, and annunciation upon low pressure. A procedure review of the Maintenance Instructions and Abnormal Operating Procedure reflecting the lessus learned will be implemented prior to the 1986 unit I refueling outage. Testing may be done during the outage to determine the actual level at which the RHR pumps lose suction. Training will be conducted on RCS level measurement and loss of RHR events. These short and long term corrective actions will prevent recurrence."

Action to prevent recurrence following the first event was not thorough.

It was the second event that cor,vinced personnel of the importance of preventing loss of decay heat removal events. The final resolution of this problem consisted of design / hardware changes (in the level monitoring system) and I

upgraded training (on responding to loss of DHR) as well as procedure changes.

28

l APPENDIX C 3 Events Involving Procedures Z1_on 51te I

2.

LER 295-85-003 0 Diesel Generator Trip at Full Power.

The event was described in the LER abstract as follows:

"On January 15, 1985, O diesel generator tripped at full load.

The root cause of the failure was a broken shaft in the engine driven lube oil pump. The shaft failed due to a misalignment condition. The pump was replaced along with the lube oil pressure regulating v;1ve. The engine was tested successfully.

P/DG001/3-2R, " Diesel Generator Major Overhaul Inspection Checklist " will be revised to include verifying alignment of the engine driven lube oil pump and replacing all temperature fuse rods. A new procedure will be written, for first out annunciator maintenance, to increase its reliability.

Because IB diesel generator was out of service for maintenance at the time, a GSEP Unusual Event was declared following the failure of 0 diesel generator. Approximately 44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br /> later, diesel generator IB was returned to service and the GSEP was temina ted. "

Licensee personnel confirmed that the event occurred simply because the procedure did not specify that the lube oil pump be aligned. A pump alignment procedure and checklist were available bu'. were not required and were not used.

During a site visit to Zion discussion with licensee staff shifted to a similar, rr. ore recent event in which diesel generator damage resulted because of incomplete work instructions. On October 24, 1986, the "1B" diesel generator was damaged during post maintenance testing. An engineer who was present in the diesel generator room at the time of the incident indicated the damage resulted because certain bolts were not torqued sufficiently. This was because the maintenance work was performed to a work / order instruction (rather than a detailed procedure), that did not adequately specify the order of disassembly and reassembly and the correct torque values. As a result, insufficient torque was applied to an articulating rod bolt. Damage was limited because the diesel was tripped immediately after abnormal noise and vibration began. The personnel were exiting the diesel room just as " pieces began flying around." Although the event was not reportable by LER (the DG had not been declared operable), the results of the subsequent investigation were included in a February 6,1987, report to Region III.

29

p 4

APPENDIX C.3 Events Involving Procedures Zion Site a

3.

LER 295-85-004 Failure of IMOV-SI8812 A&B.

The event was described in the LER abstract as follows:

"While performing sump valve stroke test (PT-2B), IMOV-SI8812 l

A&B failed to reopen after being stroked closed. This occurred at 0455 on 1/2F/85, with unit I at 67% power.

The failure caused the loss of the suction flowpath from the refueling water stcrage tank (RWST) to the residual heat removal (RHR) pumps. The valves reopened after several attempts, and the flowpath was restored after approximately two minutes.

Maintenance on these valves has not yet been completed.

Therefore, the root cause of this failure is still unknown.

A supplemental report will provide further information.

A procedure change was made to test these valves at cold shutdown, when their operation would not affect plant safety."

i The event was the result of equipment failure. Zion had just begun a program to perform valve testing quarterly rather than annually when this event occerred. The procedure change required valve testing during cold shutdown.

LER295-85-004, Revision 1, dateo 5/22/85, reported the results of the investigation of the valve failure. The LER stated that during maintenance it a

was found that the bypass circuit time was too short and that the " bypass I

circuit times have been correctly reset on both valves and they have been t

tested."

J l

30 j

a

1 APPENDIX C.3 l-Events Involving Procedures Zion Site 4.

LER 295-85-008 Loss of Component Cooling.

The event wa's described in the LER abstract as follows:

" Unit I was at cold shutdown and Unit 2 was at full power.

Shortly after isolating IMOV-CC9414 on the unit I component cooling return line from the P.CP bearing oil coolers, a decrease in component cooling surge tank level was observed.

Leakage was stopped by isolating component cooling to RCP bearing oil coolers. The leak did not return when RCP bearing oil cooling was restored.

The cause of the leak was RCP bearing oil component cooling relief valve 1CC9427, which had lifted and failed to reseat.

A similar event occurred on February 3,1984 when a different relief valve in that system lifted and failed to reseat.

Both of these valves had been removed and inspected earlier.

In reinstallation, the norile rings had been improperly set, through misinterpretation of the zero reference. Analogous valves on Unit 2 were checked for this problem and have been evaluated as to their safety significance. Repairs are being done at the earliest date with regards to relief capacity and safety significance."

The CCW relief valve lifted and failed to reseat, because it had been incorrectly reset following maintenance. This problem occurred because a general procedure had been used to-test all types of safety / relief valves.

The solution was to replace the general procedure with four specific (more detailed)procedgres.

31 i

m-l a

l APPENDIX C.4 Events Involving Procedurel McGuire Site 1.

LER 370-84-001 (Unit 2) - Loss of Residual Heat Removal Trains.

Infonnation on the event was included in the LER abstract, as follows:

"On December 31, 1983 at approximately 1640, during draining operations of the Reactor Coolant (NC) System, Residual Heat Removal (ND) Pump B was observed to have zero discharge flow.

Pump B motor amperage was low, and the ND system pressure and Pump B discharge pressure were equal. Based on these factors, ND Pump B was tripped and ND Train B was declared inoperable at 1650. The FWST to ND Pump Isolation valve was twice cycled to provide core cooling and raise NC system level with water from the Fueling Water Storage Tank, while venting the ND suction line and Pump B.

The core temperature rate of rise decreased after the first water addition, and the second addition resulted in slightly decreased core temperatures. ND Pump B was restarted at 1720, and flow was restored.

On January 9, 1984 op rators were again decreasing level in the reactor coolant loops when a computer alarm for low ND Pump A discharge pressure was received. Fluctuations in ND Pump A motor amperage were noted and simultaneous fluctuations in discharge pressure and flow also occurred. After the " Low ND Flow" annunciator alarmed ND Pump A was tripped at 1246, and ND Train A was therefore inoperable. Operators manually opened the.ND System to FWST Isolation valve, raising the reactor coolant loop level with water from the FWST. The suction line and pump were vented, and the pump was restarted at 1348.

These incidents are attributed to Procedural Deficiencies, due to inadequate guidelines regarding the water level to be maintained in the reactor coolant loops during ND operation."

The operating procedure was defective (incorrect) because it was based on data transferred from unit I without confirming that the layout (e.g., elevations) were the same. The potential for loss of decay heat removal was addressed in a major RHR system upgrade program. The program included hardware changes (e.g., replace tygon level indication with a permanent sightglass) and procedure changes.

32

7 3;

L APPENDIX C.4 Events Involving Procedures McGuire Site 2.

LER'370-84-002 Inadvertent Closure of "C" Reactor Coolant' Loop to y

Residual Heat Removal Pumps Isolt. tion Valves.

l Infomation on the event was included in the LER abstract, as follows:

"During filling and venting operations for Unit 2 startup, operators closed the breakers for valves 2ND-1B and 2hD-2A

('C' Reactor Coolant [NC] Loop to Residual Heal Removal [ND3 Pump Isolation: Valves) on January 15, 1984 Fases for the A and B Train output relay cabinets of the Solid State Protection System (SSPS) had been removed on January 9 to l

pemit transmitter tiw response testing. Nomally-closed contacts in the CLOSE circuits of the valves are controlled by SIPS output relays. With SSPS outputs deenergized, the contacts completed the circuits, providing CLOSE signals for

.2ND-1B'and 2A. Thus, when the breakers for 2ND-1B and 2ND-2A were closed the valves immediately cicsed, isolating N3 suction.

Both ND trains were declared inoperable at 2207, pursuant to Technical Specification 3.4.1.4.2.

Unit 2 was in Mode.5 with the reactor coolant loops not filled at the time of the incident.

Operators responded by tripping ND Pump A and Chemical and Volume Control (NV) Pump A and reopening the breakers for 2ND-1B and 2A, The valves were then manually opened and ND pump A was restarted.

This incident is attributed to Personnel Error. Appropriate measures to ensure control over 2ND-1B and 2A were not taken on January 9,- 1984, when the SSPS output relay cabinets were deenergized. Procedures were revised, and appropriate personnel will be counseled."

Licensee personnel confirmed that a number of factors contributed to this

event, The procedure in use was too long and complex and was used infrequently (every 18 months). A human engineering deficiency (HED) review is currently planned for this procedure.

An Assistant Shift Supervisor failed to require valve tagging of the RHR suction isolation valves as required by a station administrative procedure (Station Directive 3.1.19) and an IAE specialist also failed to ensure the valves were tagged.

It should be noted that the procedure improvement program currently at McGuire requires that component identification information be given explicitly in procedures and be the same as labeling on the actual equipment.

33

APPENDIX C.4 Eventt Involving Procedures

~

McGuire Site 3.

LER 369-84-013 Control Area Ventilation Trains A and B Inoperable.

Information on the event was included in the LER abstract, as follows:

"OnJune4,1984at[ approximately the control area ventil6 tion (VC)y) 2000, the train B chiller of level and was declared inoperable (ystem tripped due to low oil s

2105). Train A of VC had been

. previously declared inoperable because of maintenance work.

The inoperability of both trains of VC, while a unit is on-line, is prohibited by Technical Specification 3.7.6.

Accordingly, at 2205 the control operators started to reduce power on units one and two as required by Technical Specification 3.0.3.

Units I and 2 were in Mode I at 100% power at the time of this event.

At approximately 2230, five gallons cf oil were added to the chiller and the chiller restarted. With VC Train B then operable, the control operators stopped reducing power with each unit having reached 97% power. Train 8 of VC was declared operable at 2255. The units were returned to 100% power at 2312.

This event is attributed to Unusual Service Conditions, due to the cooling load of the control room area being insufficient to fully load the train B chiller. Duke Power is continuing its review of this problem to determine any further corrective

actions, In addition, the failures of printed circuit cards in the Process Control System (PCS) cabinets, which have occurred in this and other events invc1ving overheating in the PCS cabinets, have been examined. Use of heat sinks and improved cooling in the PCS cabinets is expected to alleviate the problems."

The train B chiller tripped because of a design problem (with the present arrangement oil reservoir level decreases as train B is run; this is believed to be because train B is oversized for the heat load). Failure of the process control system (PCS) circuit cards was attributed to PCS cabinet overheating.

Changes in operating procedures were made to improve cooling.

34

i APPENDIX C.4 Events Involving Procedures McGuire Site Cor.tainment Spray Vent Valve Found Open.

4.;

LER 369-84-025 Inforinetion on the event was included in the LER abstract, as follows:

"On June 27, 1984, a 3/4 inch vent valve in the containment spray (NS) tystem was-found open during a valve stroke timing test. Approximately 35 gallons of water from the residual heat removal system drained onto the floor of the mechanical penetration room in the auxiliary building. The most recent previous documented operation of the valve occurred on April 17, 1984, during another test.

It cannot be verified if the valve wa,, left open at that time or opened by mistake at some time in the interim. The cause of this event is attributed to personnel error. The unit was' operating at 100% power when the incident was discovered.

-The radioactive spill was successfully cleaned up without any workers receiving a dose in excess of any regulatory or administrative limits. Corrective actions include the use of appropriate independent verification, and a re-emphasis to appropriate personnel of the importance of removal and restoration procedures. The health and safety of the public were unaffected by this incident."

The Operations Management procedure on independent verification (IV) was changed to require IV for all vent,' drain, and test connection valves for the containment spray system to RHRS headers. A review was also to be done to determine if IV would be applicable to other headers.

35

APPENDIX C.4 Events Involving Procedures McGuire Site 5.

LER 369-84-030 Upper Head Injection Accumulator Instruments Installed Incorrectly.

Information on the event was included in the LER abstract as follows:

"On October 31, 1984, four upper head injection (UHI) isolation valves failed to close automatically as the UHI water accumulator was drained. The cause of this failure was discovered on November 1 to be incorrect installation of the accumulator level transmitters, which are intended to provide a "close" signal to the valves at a water level of 76.25 inches. Additionally, when the installation errors were corrected, it was discovered that the level switches were incorrectly calibrated. The cause of this event is considered to be a personnel error. Contributing causes are an Administrative Deficiency, which resulted in inadequate testing of the installation modification; and a deficient transmitter calibration procedure, that contained incorrect setpoint data. Corrective actions which have been completed include reinstallation and recalibration of the level transmitters, recalibration and verification of unit 2 instruments, verification of correct installation of similar instruments throughout the station, and a review of modifications scheduled for the upcoming outage to ensure appropriate tcsting require-ments."

McGuire personnel consider this event to have the highest significance of those discussed in terms of actions taken to prevent recurrence. The event resulted from a combination of inadequate installation procedures and test requirements. An important change was adding the requirement that post modification testing must not only show that the component functions correctly but also that it functions correctly as part of overall system operation.

36

)

i l

l l

l APPENDIX C.4 Events Involving Procedures McGuire Site i

6.

LER 370-84-028 Upper Head Injection Train Inoperable Due to Pressure Surge.

Information on the event was included in the LER abstract as follows:

"On November 13, 1984 anUpperHeadInjection(UHI)[EIIS:BG]

Hydraulic System Alarm was received in the Control Room for Train "B" while Train "A" instruments were being calibrated.

As technicians valved train "A" into service, a pressure surge in the crossover line between the trains caused two UHI isolation valves to partially close. During attempts to reopen the valves, one failed completely closed and was declared inoperable. Unit 2 was at 100% power at the time.

Cause of the event is considered to be a design deficiency, because the crossover connection between the trains allows pressure surges in one train to be transmitted to the other.

A contributing cause is also considered to be a component malfunction, because a check valve did not operate properly.

Corrective action consists of a revision to the UHI accumulator level calibration procedure to disable UHI isolation valves in the open position prior to any maintenance or calibration activity. While this will not prevent pressure surges between trains, it will block the isolation valves in the open position to ensure a flow path for UHI."

This was initially considered to be a design deficiency. However, it was a procedure deficiency in the sense that the procedure did not take into account circumstances that could cause this damage.

McGuire staff noted that the McGuire TS for procedure review is different from what is standard in the industry. McGuire does not have a plant review comittee but rather a pool of qualified reviewers drawn from the different organizations involved in the work. This type of group was felt to ensure a 9ood technical review because the reviewers were closer to the job than management / staff people.

37

1.

1 l

APPENDIX C.4 Events Involving Procedures McGuire Site i

7.

LER 370-85-017 Feedwater Isolation / Unit Trip from Arparent Grounding on Doghouse Level Switches.

Information on the event was included in the LER abstract as follows:

"On June 1,1985 at 0919, the unit experienced a reactor trip from an actuation of the inner doghouse safety level switches.

The high doghouse level signal was initiated by an electrical ground in the control circuitry. This caused the relay actuation which tripped both feedwater pumps, which tripped the turbine 1

and the reactor.

During the investigation of this incident, station personnel discovered that an area termination cabinet was severely corroded and that some of the relays did not operate smoothly.

Three safety related relays were determined to be inoperable due to severe corrosion. Compensatory actions were initiated to allow unit operation until the corroded relays could be replaced during an outage.

This incident is attributed to component failure / malfunction.

i The exact location of the circuit grounds have not been located, but one ground must have existed inside the cover of 3

one of the doghouse level switches as the ground cleared after the level switch covers were removed to inspect the wiring.

I l

All relays in the affected cabinet have been or will be replaced j

and the cabinet will be sealed to prevent water entry.

1 McGuire personnel did not realize they had a potential problem, because they did not see where water might come from. To prevent recurrence of the problem the cabinet was sealed to prevent water entry (equipment change), PM work i

requests for cabinet inspections were broadened (procedure change), and the "MCC Panelboard Preventive Maintenance" procedure was changed to include inspections of cabinet sealing and corrosion (procedure change).

I l

l 38

APPENDIX C.5 Events Involving Procedures Catawba Site 1.

LER 413-84-022 Inoperable Emergency Core Cooling Flowpath.

Informatici on the event was included in the LER abstract, as fc110ws:

"On November 15, 1984, at approximately 1300 hours0.015 days <br />0.361 hours <br />0.00215 weeks <br />4.9465e-4 months <br />, the containment sump intake screen doors were opened by personnel working in the Unit 1 Reactor Building pipe chase. Since the screen doors wer? open when Unit I entered Mode 4 (hot shutdown) at 1658 hours0.0192 days <br />0.461 hours <br />0.00274 weeks <br />6.30869e-4 months <br />, Technical Specification 3.5.3.d and 3.6.2 were not satisfied. The screens were discovered open at 1749 hours0.0202 days <br />0.486 hours <br />0.00289 weeks <br />6.654945e-4 months <br />, reclosed, and declared operable at 1849 hours0.0214 days <br />0.514 hours <br />0.00306 weeks <br />7.035445e-4 months <br /> on November 15, 1984 On hovember 16,1984, at 0917 hours0.0106 days <br />0.255 hours <br />0.00152 weeks <br />3.489185e-4 months <br />, the containment sump intake screen doors were reopened by one of the same workers who had opened the screens the day before. A QA Inspector, who had just arrived in the pipe chase, saw the workers opening the screens. Since the QA Inspector knew that opening the screen doors would cause noncompliance with Technical Specifications, he immediately called the Shift Supervisor so that corrective action could be taken. The screen doors ware reclosed at 1020 hours0.0118 days <br />0.283 hours <br />0.00169 weeks <br />3.8811e-4 months <br /> on November 16, 1984.

This event is classified as a personnel error. The workers in question should not have operated equipment which they had no knowledge of."

An administrative / management type of control was found to be necessary to prevent contractor cleaning personnel from opening the screen doors. It is noted that at least one of those personnel had been instructed previously not to open the doors.

39

i q

j APPENDIX C.5 L

Events Involving Procedures i.

Cat 9wba Site 1

Automatic Starting of Motor Driven AuxiliaryL Feedwater l

2.

LER 413-84-024 Pumps.

Information on the event was-included in the LER abstract, as follows:

"On November 24, 1984, at 1339 hours0.0155 days <br />0.372 hours <br />0.00221 weeks <br />5.094895e-4 months <br />. Auxiliary Feedwater (CA)

Pumps IA and IB started due to a low-low level in Steam Generator l

(S/G)10.

l 4

Prior to pump start, CA piping had been aligned so that proper seating of the check valve which prevents backflow from S/G IC

.to the CA common header, could be verified. To verify that no

'3 back leakage was occurring, several valves were required to be opened and piping surface temperatures were to be taken. Writter instructions were not used for this checkout, and several

. deviations from the original plans occurred as a result.

This incident is classified an an Administrative / Procedural Deficiency. - If proper written instructions concerning the checkout had been issued, the low-low S/G IC level may have been avoided.

Unit I was in Mode 3 (hot standby) at the. time of the incident' and reactor coolant temperature was approximately 550"F."

The shift supervisor instructed a staff person to perform an activity. The staff person thought the same results.could be accomplished a different

("better") wa Since Operations Management Procedure 1-4, Use of Procedures, was revised (y.to clarify when written instructions are required) this problem has not recurred.

40

)

1 APPENDIX C.5 Events Involvino Procedures

~

Catawba Site 3.

LER 413-85-002 Ice Condenser Lower Inlet Doors Closed.

Ir. formation on the event was included in the LER abstract, as follows:

"On December 31, 1984, at 2226 hours0.0258 days <br />0.618 hours <br />0.00368 weeks <br />8.46993e-4 months <br />, Unit 1 entered Mode 4, Hot Shutdown, with the Ice Condenser Lower Inlet Doors blocked closed, thus rendering the doors inoperable. Technical Specification 3.6.5.3 requires the Lower Inlet Doors to be operable in modes 1, 2, 3 and 4.

This incident was not discovered until January 9,1985 at approximately 1900 hours0.022 days <br />0.528 hours <br />0.00314 weeks <br />7.2295e-4 months <br />.

Catawba Unit I was in MODE 2, start-up, when this incident was discovered. A Work Request was issued following the discovery of this incident, and the Lower Inlet Doors were unblocked at 2155 hours0.0249 days <br />0.599 hours <br />0.00356 weeks <br />8.199775e-4 months <br />. This incident is reportable pursuant to 10 CFR 50.73, section(a)(2)(v)and10CFR50.72,section(b)(2)(111).

This event is classified as a Personnel Error. The procedural step verifying that the Ice Condenser Lower Inlet Door Blocking Devices were removed was signed-off when in fact, the lower inlet door blocking devices were still installed."

The corrective actions taken as a result of this event included the following:

"4.

Training sessions were conducted to stress the significance of procedure sign-off's to the appropriate supervisory personnel.

5.

All Unit 1 Door Blocking Devices were painted fluorescent orange and will be sequentially numbered (1 through 24). All Unit 2 Door Blocking Devices will be painted fluorescent green and sequentially numbered (1 through 24). This is to ensure that the Blocking Devices will be accountable and highly visible when installed in the Ice Condenser.

6.

Mechanical Maintenance will develop a Maintenance Procedure to provide a method of documenting the status of Mechanical Maintenance's Technical Specification Requirements. This is to ensure that all Mode Requirements falling under the responsibility of Mechanical Maintenance have been satisfied prior to entering each Mode of Operation.

7.

Mechanical Maintenance will develop a Maintenance Procedure to provide guidelines for Installation and Removal of the Lower Inlet Door Blocking Devices. An independent verification will be required.

8.

Appropriate station personnel will review methods used to assure completion of required work pertaining to OP/1/A/6100/01, as requested by Station Manager."

41

i%

.4 As a result.of this event, Catawba instituted a requirement that each group (e.g., mechanical maintenance) would have a list of activities to be J

' accomplished prior to a mode change and would sign-off completion of the i,

. activities. Other changes resulting from this event included independent

. verification and improved labeling and identification.

L i-42

j i

l i

APPENDIX C.5 Events Involving Procedures Catawba Site 4

LER 413-85-028 Both Trains of Residual Heat Removal Inoperable.

Information on the event was included in the LER abstract, as follows:

"On April 22,1985, from 2039:21 to 2051:17 hours, both trains of Residual Heat Removal (ND) were inoperable. This was a result of ND Train A being declared inoperable on April 20, 1985, at 1600 hours0.0185 days <br />0.444 hours <br />0.00265 weeks <br />6.088e-4 months <br />, for the perfonnance of various ND Train A related work requests, and ND Pump B being secured on April 22, 1985, at 2039:21 hours due to Loss of Pump Suction. Also Technical Specification 3.4.1.4.2 was violated on April 22,1985, at 0522 hours0.00604 days <br />0.145 hours <br />8.630952e-4 weeks <br />1.98621e-4 months <br /> when Reactor Coolant (NC) System draining began when ND Train A inoperable. Catawba Unit I was in Mode 6 (Cold Shutoown) when these incidents occurred.

False NC System Level indication apparently contributed to the loss of ND Pump B suction. However, the cause of the false level i

indication is now known at this time.

With ND Train A inoperable, the Limiting Conditions for Operation of Technical Specification 3.4.1.4.2 were not met. However, prior to beginning NC System draining, a decision had been made to allow draining to begin with ND Train A inoperable. Therefore, this incident is also classified as a Personnel Error.

After ND Pump B was secured, Centrifugal Charging) Pump (CCP) A was aligned to the Refueling Water Storage Tank (FWST and started to restore NC System level. ND Pump B was then vented and restarted at 7051:17 hours. On April 24, 1985, at 1843 hours0.0213 days <br />0.512 hours <br />0.00305 weeks <br />7.012615e-4 months <br />, an operable NR Train A flowpath was established."

Corrective actions to be taken as a result of this event included:

{

"7) A charge to OP/1/A/6150/06 will be made such that draining will not proceed at 21% NC level unless at least two NC level indications are available and are in agreement. Also draining will not proceed at 12% NC level unless tygon tubing is installed and vente3 back to the NC system (or both vented to atmosphere).

8) A change to OP/1/A/6150/06 will be made to specify monitoring the total volume drained (by increase in l

Recycle Holdup Tank level) to key the operator when NC level is approaching loop nozzles.

Information on the appropriate volume to indicate draining to this level will be provided.

43 I

9) A correlation between NC System level and the Reactor q

Vessel Level Instrumentation System (RVLIS) will be

-I developed for Mode 5 operation with the loops drained.

i This information will be referenced in OP/1/A/6150/06.

10) A percanent sight glass of 3 to 6 feet vented to the NC system that can be valved in when NC level approaches the vicinity of the nozzles during draining will be installed.

j

11) Present NC level transmitters will be replaced with more reliable (less likely to drift) transmitters.

12) A change in OP/1/A/6150/06 and AP/1/A/5500/19 to specify monitoring incore thermocouple for NC temperature will be initiated."

The scope of this corrective action indicates a strong effort to prevent the prob' ems in RHR operation. The hardware / design and procedure changes go beyond the minimum that might have bf.en done, s

I i

44

4 APPENDIX C.5 Events Involving Procedures katawba Site 5.

LER 413-85-053 Diesel Generator IA Battery Charger Inoperable Due to Blown Fuses.

Inferir.ation on the event was included in the LER abstract, as follows:

"During an it.vestigation on August 19, 1985, into the cause of indicatin Charger (g light socket shortings on Diesel Generator 'A Battery IDGCA) and Diesel Engine (D/E) 1A Control Panel, it was discovered that IDGCA was inoperable from 1447 to 2030 hours0.0235 days <br />0.564 hours <br />0.00336 weeks <br />7.72415e-4 months <br /> on June 29, 1985. During this time period, it was not recognized thht the charger was inoperable, and therefore, the availability of alternate power sources was not verified as required by Technical Specification 3.8.1.1.

Unit I was in Mode 1 in the process of Reactor Power escalation at the time of the incicent.

This incident has been assigned three Event Cause Categories.

An Event Cause of Design Deficiency has been assigned as the main cause because the design of the charger did not allow the operator to recognize that the charger was inoperable. An Event Cause of Personnel Error has been assigned because personnel did not properly take action to clear an alarm signifying trouble with the charger. An Event Cause of Procedural Deficiency has been assigned because the annunciator response procedure did not adequately aid the operator in identifying the cause of the charger trouble alarm and did not direct the operator to begin verification of the availability of offsite power sources.

After the charger was discovered to be inoperable, an investigation revealed that two fuses in the charger had blown following an attempted indicating light replacement on IDGCA.

The fuses were subsequently replaced, end the charger was returned to service."

This information indicates a thoughtful analysis of factors contributing to the event and appropriate actions to help prevent recurrence.

45

I' l

APPENDIX C.5 Events Involving Prg[.edures Catawba Site l

6.

LER 413-85-066 Mode Changes Made with Inoperable Equipmuit Due to Mishandling Work Request.

Information en the event was included in the LER abstract, as fcilows:

"On November 19,1985, at 0915 hours0.0106 days <br />0.254 hours <br />0.00151 weeks <br />3.481575e-4 months <br />, personnel discovered that l

Train * ?f the Hydrogen Skimeer (VX) System (EIIS:BB) was inoperabie due to a problem with an electrically operated damper between upper and lower containment. The problem was tested back to a work request that had been written on November 5, 1985, to repair the damper during a unit outage. The VX system was not required to be operable during the outage and the work I

request was not processed. The unit entered a mode on November 13, 1985, at 0913 hours0.0106 days <br />0.254 hours <br />0.00151 weeks <br />3.473965e-4 months <br /> in which the VX system was required to be operable. This resulted in a violation of Technical Specificatiotes. Unit I was at 62% power at the time this event was discovered. When the damper was determined to be inoperable, personnel were dispatched immediately, and a reduction in unit power was begun.

This incident is classified as a Management Deffetency because of a breckdown in administrative centrols when the werk request was overlooked."

l The breakdown in administrative controls is similar to that rr sorted in LER l

413-85-002 (above). One change made was to give " TECH SPEC I.EM" stamps to l

each group that initiates work requests in order to identify work required to l

be operable by technical specifications in any mode.

l l

l l

l l

l 46 l