NUREG-0995, Safety Evaluation Re Restart of Facilities.Licensee Acceptably Revised & Expanded Surveillance Testing Programs to Address Reactor Trip Issue
| ML18087A909 | |
| Person / Time | |
|---|---|
| Site: | Salem  |
| Issue date: | 04/28/1983 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML18087A907 | List: |
| References | |
| RTR-NUREG-0995, RTR-NUREG-995 DD-83-06, DD-83-6, NUDOCS 8305170095 | |
| Download: ML18087A909 (46) | |
Text
.,
~. ;
8305170095 830429 PDR ADOCK 05000272
' S PDR NRC SAFETY EVALUATION RELATED TO PLANT RESTART PUBLIC SERVICE ELECTRIC & GAS COMPANY SALEM NUCLEAR GENERATION STATION UNIT NOS. 1 AND 2 DOCKET NOS. 50-272 AND 50-311
~-
ATT.~CH~!ENT l NL'REG-0995 Date:
April 28, 1983
Salem Restart Report I.
Introduction II.
Evalua:ion A.
Eauioment EvaluatioA
- l.
Safety Classification of Breakers
- 2.
Identification of Cause of Failure
- 3.
Verification Testing l
Maintenance and Surveillance Procedures
~-
O:erating Procedures, Operator Training, and Operator Response Evaluation Operating Procedures
- 2.
Operator Training
- 3.
Operator Response C.
Manaaernent Evaluation
- l.
Master Equipment List
- 2.
Procurement Procedures
- 3.
Work-Order Procedures
- 4.
Post-Trip Review
- 5.
Timeline~s of Event Notification
- 6.
Updating Vendor-Supplied Information
- 7.
Involvement of QA Personnel with Other Station Departments
- 8.
Post Maintenance Operability Testing
- 9.
Overall Management Capability and Performance III. Overall Conclusions Appendix A - Description of.Reactor Trip Circuit Breaker Appendix B - Franklin Research Center Interim Technical Evaluation Report Appendix C - Westinghouse Corre~pondence Salem Restart SER
--~*~ ~ :'....
I.
Introduction SAFETY EVALUATION RELATED TO PLANT RESTART PUBLIC SERVICE ELECTRIC AND GAS COMPANY SALEM NUCLEAR GENERATING STATION UNIT NOS. 1 AND 2 DOCKET NOS. 50-272 AND 50-311 On February 25, 1983 an event occurred at Unit 1 of the Salem Nuclear Generat-ing Station when the reactor-trip circuit breakers failed to automatically open following receipt of a valid trip signal from the Reactor Protection *system (RPS).
The manual trip system was used to shut down the reactor. Subsequently, it was concluded by the licensee that the failure to trip was caused by a mal-function of the undervoltage (UV) trip attachments ih both reactor-trip circuit breakers.
These UV trip attachments translate the electrical signal from the RPS to a mechanical action that opens the circuit breaker.
On February 26, 1983, an NRC team was onsite to conduct initial followup and to collect preliminary information.
As a result of NRC inquiries, the licensee determined that both reactor-trip circuit breakers had similarly failed to open upon receipt of a valid trip signal on February 22, 1983.
The failure to a1Jto-matically trip on February 22 was not recognized by the licensee until the.
- computer printout of the sequence of events was reexamined in more detail on February 26.
Further evaluation of these even.ts and the circumstances leading up to them revealed a number of issues that require resolution by the licensee and/or the NRC.
This safety evaluation report briefly describes the NRC and licensee actions to address and resolve equipment, operator procedures, training and response, and management issues identified by the NRC evaluation of the two events at Salem Unit 1.
An NRC Task Force has been established to conduct a separate generic study of the broader implications of the Salem events which is scheduled for completion by April 18, 1983.
All actions identified herein are applicable to Saiem but may have generic implications.
Any generic actions developed by the Task Force will also be required of the Salem facility, as appropriate.
- Actions for Salem as identified in this report fall in two groups:
(1) actions that are required to be satisfactorily resolved before plant startup; and (2) actions that could be completed after restart bu~ which were required to complement the pre-startup items.
The actions required prior to the restart of Unit 1 will also b~ implemented on Unit 2 prior to its restart. Salem Uhit 2 is presently shut down for refueling and is not presently scheduled to resume operation before Unit 1.
- The licensee has met with NRC staff on several occassions to present the results of initial evaluations related to the events.
Based on licensee submittals of March 1, 8, 14, 15, 18, 23 and April 7 and 8, 1983 and on the findings of the NRC evaluation of the Salem events, issues were identified and categorized as Salem Restart SER 1
- .* L,.... *.****
(A) Equipment evaluation, (B) Operating Procedures, Operator Training, and Operator Response Evaluation, and (C) Management Evaluation.
A II.
Evaluation A.
Equipment Evaluation
- 1.
Safety Classification of Breakers During the initial NRC evaluation of the February 25 event, it was determined that maintenance was condutt~d on the Salem Unit 1 reactor-trip circuit breakers in January 1983, following a failure of one reactor-trip circuit breaker to trip upon receipt of an RPS signal at Salem Unit 2 on Januar.y 6, 1983.
The work orders authorizing the January 1983 maintenance identified the maintenance as not associated with safety related equipment and not requiring quality assurance review.
As a result, it was not clear on February 26, 1983 what portion, if any, of the reactor-trip circuit breakers was considered safety related by the 1icensee.
The reactor-trip circuit breakers contain both a UV trip attachment and a shunt trip attachment, but only the UV trip attachment is operated by an automatic RPS trip signal.
The shunt trip attachment provides for. a manual trip of the breaker.
Section 7.2.1.1 of the Salem Updated Final Safety Analysis Report (UFSAR),
Revision 0, indicates that the Reactor Trip System includes the reactor-trip circuit breakers and the UV trip attachment.
The Westinghouse Solid State Logic Protection System Description (WCAP-7488L) also defines the scope of the system as including the reactor-trip circuit breakers and the UV trip attachments.
The UV trip attachment and the reactor-trip circuit breaker are safety-related equipment in that they are essential features of the Reactor Trip System, which is necessary to prevent or mitigate the consequences of a design-basis event that could result in exceeding the offsite exposure guidelines set forth in 10 CFR Part 100.
The shunt trip attachment of the reactor-trip circuit breakers in the Westinghouse design is not required by present NRC regulations to be safety grade and, although it is provided to perform the manual trip function, no credit is taken for this design feature in the safety analysis (a manual reactor trip also actuates the UV trip attachment).
The licensee in a March 1, 1983 letter to NRC concurred in this understanding.
==
Conclusion:==
- Based on the above findings, we believe there. is no dispute regard-ing the safety classification of the reactor-trip circuit breakers and the issue is therefore considered resolved.
- 2.
- Identification of Cause of *Failure The licensee's determination of the cause of the failure of the reactor-trip breakers, as stated in their March 1, 1983 letter, was that there was binding and excessive friction of the vertical latch lever of the UV trip attachment due to a lack of proper lubrication.
The basis for this statement, as docu-mented by the licensee, was that immediately following the February 25, 1983 event, tests were ~onducted which identified that the problem was not in the*
Reactor Protection System logic, but isolated to the under voltage trip attach-ment on the breakers.
Salem Restart SER 2
By le:ter dated March 22, 1983, (Appendix C) Westinghouse provided to NRC the results of an investigation they performed in order to establish the potentia*l scenarios that might have produced the malfunction of the ~al em Unit 1 circuit breakers.
Westinghouse performed an inspection of a UVT attachment provided to them by the licensee, and represented by the licensee as the UVT attachment that ma1functioned on reactor-trip breaker B of Salem Unit 1 on February 25, 1983.
Findings during the examination included (1) failure of the as-received UVT attachment to latch traced to a bent and deformed leaf spring which, accord-ing to Westinghouse, could not have been caused by normal'operation or wear, (2) a. missing lock washer on the drop-out volt~ge adjustment screw mechanism and an excessively 11turned-in" condition of the: adjustment screw, (3) a deter-mination that the as-received UVT attachment was lubricated (the licensee advised Westinghouse that a lubricant was added to the device after the February 25, 1983 event), (4) no excessive wear on the latch and latch interface and no evidence of burns, however excessive frictional force could not be ruled out as a potential malfunction since post-incident handling (manually exerci"sing the device and lubrication) prior to receipt by Westinghouse would have masked a fricti~n force malfunction scenario, (5) no visible evidence of corrosion, or broken or missing parts, other than the lock washer, and no obvious signs of improp~r manufacture, and (6) a determination that the UVT attachment was capa-ble of providing sufficient force, with margin, to trip a properly maintained circui: breaker.
Based on the results. of this examination, Westinghouse con-cluded that malfunction of the UVT attachment was not attributable to design or manufa:turing.
The postulated malfunction scenarios which could not be elimi-nated by Westinghouse or which were present during the examination were fric-tional area anomalies, dirt/contamination, bent or deformed parts, and/or misadjustment.
Westinghouse considers these scenarios to fall under one broad category of maintenance related causes.
The NR: and its consultant, Franklin Research Center (FRC) conducted an indepedent post-event evaluation to determine the cause of the failures.
The FRC has completed their Interim Report and a copy is included as Appendix 8.
Their ~valuation consisted of a failure analysis of the UV trip attachment from Salem Unit 2 and was based on interviews with cognizant maintenance personnel to des:ribe the maintenance history of the devices.
Evaluation of the failure of the reactor trip circuit breakers included review of the operating, maintenance, and survei 11 ance testing hi story for the DB-SO breakers us.ed at the Salem plant. Since the trip lever of the UV trip attachment must lift the circuit breaker trip bar for opening of the circuit breaker to occur, the evaluation also included the interaction*of the UV trip attachment with the
. circuit breaker trip bar.
FRC has now completed a failure analysis of the
.two UV trip attachments stated by the licensee as.the devices that failed on Sal em Uni t 1.
The staff and its consultant, FRC, have identified two possible failure modes for the Salem Unit 1 UV Trip attachments.
Possible contributors to these modes are (1) dust and dirt; (2) lack of lubrication; (3) wear; (4) more frequent operation than intended by design; and (5) nicking of latch surfaces caused by repeated operation of the breaker.
The contributors appear to be cumulative,
- with no one main cause.
One f~ilure mode can occur when latch-to-latch pin binding' prevents unlatching of the UV Trip attachment, thereby preventing,the trip lever from moving when the device is de-energized.
Salem Restart SER 3
The second possible failure mode concerns the increased frictional forces between the latch spring and latch.
The latch spring on \\his device exerts enough force on the latch to reduce the output force from the trip lever resulting from friction.
This reduced force could be significant if the force required to lift the circuit breaker trip bar is higher than normally expected.
The increased friction results from age related wear and lack of lubrication.
As stated previously Westinghouse representatives stated that the expected force required to lift the circuit breaker trip bar at time of manufacture would have a maximum of 31 ounces.
The licensee by letter of April 7, 1983 has stated that the force required to trip the breaker using the breaker trip bar has been measured on all fo~r Unit 1 circuit breakers, and that all breakers met the Westinghouse criteria.
Further FRC evaluation concluded that the latch surfaces of the original UV trip attachments appear not to have been honed.
Roughness was noted on the latch-to-latch pin face and on the latch-to-latch spring face causing a groove to be worn into the spring.
During testing, hesitation during unlatching was observed when voltage was gradually reduced to the coil of the device, further indicating inadequate lubrication causing increased friction in the latch-to-latch pin surface.
Corrective actions to preclude the problems of roughness in the mating surfaces of the UV trip attachments have already been implemented.
Westinghouse had changed the manufacturing procedure for the latch in 1973 to include hand honing of the latch surfaces that mate with other components.
The licensee by letter of April 7, 1983, has confirmed that the new UV trip attach-ments now installed in Salem Unit 1, and those to be installed in Salem Unit 2 have incorporated all up to date design changes made to these devices.
During the FRC evaluation, manufacturing deviations were noted when comparing the original UV attachments supplied to Salem.
These deviations may affect the forces available within the attachments.
Discussions with the Licensee indicated that similar deviations had been noted on other attachments not*
currently available for inspection.
These deviations were not identified in the causes of the failures of the attachments, and qualified components have been installed.
The results of the evaluation indicated that while there were possibly multiple contributing and cumulative causes of failure, the failure of the UV trip attachment was accelerated due to improper lubrication and maintenance through-out the life of the device..
Conclusion The staff has concluded that while the Salem Unit 1 breaker failures occurred from several possible contributors such as dust and dirt, lack of lubrication, more frequent operation than intended by design, and nicking of latch surfaces from frequent operation of the circuit breakers, the predominant cause was excessive wear accelerated "by lack of lubrication and improper main-tenance.
To confirm this conclusion, and to provide assurance that degradation of the trip breakers is not occurring, the staff will require additional sur-veillance testing, and improved maintenance programs which will be implemented after re-start. These programs are addressed in the following sections of tQiS report.
With the maintenance and testing of the new UV trip attachments and the verification testing as discussed in the following section of this Evaluation, Salem Restart SER 4
- .-II
the staff has reasonable assuance that the properly maintained breakers and UV trip attachments will perform their intended function whil~ the following addi-tional a~tions are completed and evaluated.
Because one of the contributors may be more frequent operation than intended by design, the NRC is requiring the licensee to determine the allowable number of operations of the circuit breakers and establish a replacement interval for the entire unit or components of the unit.
This action should be completed within six months of plant startup.
In addition, the staff required and the licensee has ~stablished a procedure for measuring the force required to trip the breaker using the breaker trip bar and the.force output from the UV trip lever.
These tests will be performed every six months and are included in the licensee 1 s maintenance procedures.
By letter of April 7, 1983, the licensee has committed to these requirements.
Based on these actions and commitments by the licensee, we have concluded that the cause of failure of the original trip breakers have been sufficiently identified for restart.
- 3.
Verification Testing Testing following reactor-trip circuit breaker maintenance or initial installa-*
tion should be suff;ciently comprehensive to provide reasonable assurance that the circuit breaker will function as needed.
Verification testing on the installed breaker provides added assurance that the breaker continues to function properly.
On August 20, 1982, one reactor-trip circuit breaker on Unit 2 failed to operate during surveillance testing.
A UV trip attachment was reinstalled on this circuit breaker after replacing the coil.
The circuit breaker was re-installed and subsequent post maintenance testing was performed to establish operability.
Similarly, on January 6, 1983, a reactor trip occurred at Salem Unit 2 due to a low-low steam generator level, but one reactor-trip circuit breaker failed to open.
The licensee concluded that the circuit breaker failure was due to binding from dirt and corrosion in the UV trip attachment.
On February 20, both breakers performed satisfactorily during reactor* trip events. Since the circuit breakers again failed on February 22 and 25, adequacy of the testing to ensure circuit breaker operability is an issue.
The licensee has stated that the Salem Unit 1 lA and 18 reactor trip circuit breakers were cleaned, lubricated and readjusted under the technical direction of a Westinghouse technical representative.
The licensee has conducted a program to verify proper operation of the reactor-trip circuit breakers prior to returning them to service.
The program involved pre-installation testing of UV trip attachments 25 times by the vendor.
After installation on the trip breakers, the UV trip attachment and trip breakers were tested ten more times.
All tests were completed without failure of the UV trip attachment to trip the breaker.
Following this testing, a time response test of the breaker actuated through the RPS was performed.
This.test data is available at the site for the review and will be used as a baseline in all future testing.
Salem Restart SER 5
~
By letter dated March 14, 1983, the licensee stated that he has completed the above program and committed to submit a longer term operational verification
- program for the reactor trip breakers for NRC review by May, 1983.
The licensee has committed to develop and provide the NRC with a detailed test procedure, acceptance criteria and a schedule by May 1983.
The intent of the testing is to verify the adequacy of the licensee's maintenance and surveillance program and will also be used in conjunction with surveillance testing results as a basis for determining the replacement intervals for the entire circuit breaker and/or its components.
The licensee expects that the test program will be completed by October, 1983.
If the licensee proposes a bench test of less than 2000 cycles, the staff w'ill require the detailed justification concerning the acceptability of the number of test cycles.
==
Conclusion:==
Based on the successful results of the testing performed on the installed breaker assemblies and on the above commitment from the licensee, the staff concludes that this issue has been satisfactorily resolved.to permit restart of the plant.
- 4.
Maintenance and Surveillance Procedures Maintenance Dur1ng the staff review, it was determined that no specific maintenance proce-dure existed at the Salem facility to conduct preventive or corrective mainte-nance on the reactor-trip circuit breakers.
In addition, the maintenance conducted in January 1983 was not performed in accordance with the latest Westinghouse recommendations, as contained in Westinghouse Technical Bulletin NSD-74-1, amended by technical data letter NSD-74-2.
No program of preventive maintenance had been conducted on these circuit breakers since their original installation.
The licensee has now developed maintenance procedures and preoperational verification programs for use on the reactor-trip circuit breakers (including the UV trip attachment), bas~d on all applicable vendor maintenance recommenda-tions, appropriate quality assurance (QA) requirements, and post maintenance testing.
The initial NRC staff review of these newly developed procedures and programs identified certain deficiencies.
By letters dated March 14, 1983 and April 7, 1983, the licensee submitted Revision 2 to Salem Generating Station Maintenance Department Manual Maintenance Procedure M3Q-2,* and other informa-tion, that addressed these deficiencies.
Each of the deficiencies identified by the staff for the new recently developed procedures are presented below along with the licensee's resolution.
- i.
The maintenance procedure originally specified cleaning and vacuuming the equipment.
Since dirt in the breaker assembly was believed to be one of the causes of the failures, the staff required that the cabi.nets and circuit breaker room also be cleaned as part of the maintenance procedure.
The licensee, by letter dated April 7, 1983, has stated that the circuit breaker cabinets are cleaned each refueling outage and that the circuit breaker rooms are cleaned on work days, and has modified the procedure to include the requirement to clean the cabinets.
The issue is resolved.
Salem Restart SER 6
ii. Our review of the maintenance procedure indicated that the new replacement UV attachments that were installed during this outag~ were not required to undergo cyclic testing that was to have been performed by the supplier (Westinghouse).
In response to NRC questions, the licensee's Specifica-tion 83-8248 was revised and now requires all replacement UV attachments to have been tested without a failure.
For startup the licensee has stated that the new UV attachments currently installed have now completed this testing.
This resolves part of our concern and is acceptable.
The maintenance procedure was also revised for the new UV trip attachments to specify a 30-minute time interval between eac~ of ten cycles of testing required.
This test interval. is in accordance with the staff's recommenda-tion.
However, the maintenance procedure had not been revised to specify appropriate acceptance criteria. These criteria, allowing no failures, have now been incorporated into the maintenance procedure.
The licensee has stated that the new UV attachments have been successfully*tested ten times, utilizing the 30-minute time interval.
We find the revised proce-dures and testing results acceptable.
iii. The maintenance procedure addresses circuit breaker response times when tripped by the undervoltage trip attachment.
The staff required that three timing tests be performed with a high speed recorder and the average response would then be compared to previous test times.
A timing test has been performed on the circuit breakers to establish a base line for future comparisons.
Revision 2 of the maintenance procedure has been revised to require three timing tests be performed.
This satisfies the staff's concern.
iv.
Diagrams included with the maintenance procedure incorrectly showed attachments such as an overcurrent trip device, that are not used in the Salem reactor trip circuit breakers, instead of the shunt trip and under-voltage trip attachment which are used.
This has now been corrected to include the applicable diagrams and is now acceptable.
- v.
The maintenance procedure contained a caution concerning a self-locking sc~ew in the moving core of the UV attachment.
The maintenance procedure has been revised to require, and licensee Specification 83-8248 now requires, that a sealant be applied to the two cover bolts on the movable core cover and the reset lever spring adjustment screw such that field adjustments are not possible without breaking these seals.
The licensee has verbally informed the NRC that these seals are in place.
The staff will verify this prior to restart.
This resolves this issue and is vi.
acceptable.
The maintenance procedure did not specify UV trip attachment coil dropout voltage.
did not address the action to take if the the specified limits.
These deficiencies licensee and are acceptable.
the acceptance tolerance on the The maintenance procedure also coil dropout voltage falls below have been corrected by the vii. The staff required that the procedure be revised to include notification of the NRC, prior to taking corrective action, if any acceptance criteria is found to be out of specification.
The maintenance procedure has been Salem Restart SER 7
.. * -~> ::_~.
revised and the licensee has committed to propose Technical Specification changes within 30 days of plant startup, that requir~ such notification to be made prior to any corrective actions being taken.
The above action and commitment is acceptable to the staff.
viii.The staff required the maintenance procedure be revised to include a trip force measurement be made on the trip bar of each of the four reactor trip breakers and the output force of all four UV trip attachments be measured each time maintenance is performed on the breakers and following installa-tion of a new UV trip attachment.
If the measured trip force on any trip bar exceeds the *ma*nufacturer 1 s recommended upper limit, or the output force of any UV trip attachment is less than twice the measured trip force the
. licensee shall declare the breaker inoperable and should immediately notify the NRC prior to any corrective action.
These measurements were required to be performed on presently installed bre~kers prior to plant startup.
These measurements have been performed, and the trip force on all trip bars were less then the manufacturer's recommended upper limit.
The 1icensee has verbally informed the NRC that the output force of all UV trip attachments is more than twice the measured trip force. The staff
'i:{ill verify this prior to startup. Technical Specificati,on changes will be proposed by the licensee within 30 days of plant startup to assure NRC notification prior to any corrective action.
This resolves this issue.
ix.
The maintenance procedure was not explicit relative to the frequency of UV attachment lubrication. It is the staff's positidn that the procedure require lubrication each time maintenance is performed.
The procedure also specified cleaning the UV attachment with Stoddard solvent.
While the staff has no concerns at this time relative to the adequacy of the lubricant, we will continue our investigation to determine any potential.
adverse effects *from the use.of Stoddard solvent.
The lubrication points in the breaker were also inconclusive in that all friction points were not identified for lubrication.
In a March 22, 1983 letter to the NRC (Appen-dix C), Westinghouse stated that a new Technical Bulletin clarifying the circuit breaker and UV trip attachment lubricants and lubrication points will be issued to the licensee by March. 24, 1983.
The licensee verified by letter dated April 7, 1983, that the circuit breakers and UV trip attachments have been l~bricated in accordance with the recently*issued Westinghouse Technical Bulletin.
The Technical Bulletin specifies a lubrication frequency of every si.x months, specifies the lubrication points, and has been incorporate4 into the maintenance procedure.
This resolves this issue for restart.
- x.
Regarding the NRC recommendation that testing of the UV trip attachment of the bypass breakers be performed every refueling outage, the licensee has modified his maintenance proc'edure so that all bypass breakers have their UV trip and shunt trip attachments tested every six months. *This satisfies the staff's concern.
Surveillance Prior to the February events, the licensee conducted a functional surveillance test on one of the two i nsta 11 ed reactor-trip circuit breakers every month, so that each circ~it breaker was tested once every two months.
The surveillance Salem Restart SER 8
- ~. ~...
.* - -~
test involved tripping a circuit breaker by use of the UV trip attachment.
The licensee also operated the circuit breakers weekly by exe~cising the shunt trip attachment.
In view of the number of reactor-trip circuit breaker failures at Salem, the staff determined that this surveilance testing program was ineffec-tive for assuring reliability of the reactor-trip circuit breakers.
The licensee initially proposed to revise monthly testing of the main reactor-trip circuit breakers by use of the UV trip attachment and weekly testing of the reactor-trip circuit breakers by use of the shunt trfp attachment.
The
- Staff did not agree with the weekly testjng interval of the shunt trip attach-
- ment because of the potential for additional wear.
Further, the staff indicated that the associated bypass breakers be tested.
The licensee proposed in his letter of April 7, 1983 a new single test procedure to independently test the UV trip, shunt trip, and manual scram feature, to be performed within 7 days of each reactor startup.
After discussion with the staff on this procedure the licensee has revised his proposal to provide three separate tests in lieu of the proposed single test procedure.
These tests do not require lifted leads or jumpers; are previously existing tests which have been checked-out and used sucessfully in actual plant conditions; and satisfy the staff requ.irement.
The tests are:
(1) functional test of the UV trip of each main breaker, using the abbreviated monthly func-tional test procedure #18.1.010(11); (2) functional test of the shunt trip of each main breaker, using the manual breaker controls on the main reactor control board; and (3) functional test of the manual scram switches.
The staff has determined that these three tests are acceptable for plant restart.
The licensee has further revised his proposal such that these three tests will performed immediately prior to each reactor startup, unless the tests have been comoleted in the last 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
We find this schedule more desirable and acceptable.
The licensee has committed to these rev1s1ons in his letter dated April 8, 1983, and has further agreed to propose appropriate changes to the Technical Specifications to fully document this testing requirement.
The staff required that reactor trip breaker timing tests be performed once each month.
The staff also recommended a permanent test panel be designed and used when* these tests are performed.
However, the licensee has proposed to utilize the events recorder to perform these tests.
We have found this to be
- acceptable.
In combination with response time measurements with a high speed recorder every six months, we find use of the event recorder on a monthly basis to be acceptable.
The licensee will submit proposed Technical Specification changes that incorporate all the above surveillance requirements.
These proposed Technical Specification changes are to be submitted within 30 days of plant startup.
==
Conclusions:==
The licensee has revised his maintenance procedures to address all NRC staff concerns necessary for the restart of Salem Unit 1.
Further the licensee has acceptably revised and expanded his surveillance testing programs to provide assurance that adequate functional testing of the reactor trip Salem Restart SER 9
- .. --~ :
breaker will be provided, including testing of the bypass breakers.
- Finally, the licensee will submit, within 30 days of plant startup proposed Technical Specification changes for incorporating:
(a)
NRC notification requirements for maintenance testing results exceeding any acceptance criteria, (b)
NRC notification requirements for measured breaker trip forces exceeding the recommended upper limit, and (c) the additional surveillance requirements identified by the staff, as identified herein and in Table 1, for the reactor trip and bypass breaker.
The above actions provide reasonable assurance, regarding maintenance and surveillance, for restart of the facility.
Salem Restart SER 10
. ***~-.*.*
- : '.~ *. ::.
- .. *:.. r;
,.';' ;;*,... ;\\. ~*
TABLE 1 PERIODIC SURVEILLANCE/MAINTENANCE OF REACTOR TRIP BRE~KERS PRE-STARTUP
< 24 hrsL rta n Tr p Breakers)
- 1. functional test of UV-(via SSPS)
- 2.
functional test of*Shunt (manual controls)
J *.
functional manual scram switch (voltmeters)
/
- 1.
- 2.
MONTllLY SURVEILLANCE (Main--Trlp Breakers)
- a.
SSPS functional of UV.
- b.
response time testing of UV /breakers (event recorders) functional test of Shunt (ma~ual controls) 6-MOS.
SURVEILLANCEL__MAINTENANCE TMa In& Bypass-Breakers)
- 1.
response time testing (3 tfmes)
(visfcorder) trend data
- 2.
trip bar lift force measurements
- 3.
UV output force measurement
- 4. drop-out voltage.check
- 5.
servicfng/lubrtcation/adjustments
- 6.
repeat testing steps 1-4
B.
Ooerating Procedures, Operator Training, and Ooerator Response Evaluation Examination of the circumstances associated with the event~ of February 22 and 25 identified certain issues relative to plant operations.
Our discussion of plant operations is divided into operating procedures, operator training, and operator response.
The events at Salem were anticipated transients without scram (ATWS) of the reactor as a r~sult of failures in the reactor protection system (RPS).
The adequacy of the RPS to indicate an ATWS is discussed in this report.
The operator's role, in responding to an ATWS is to take action to manually shut down the reactor and stabilize all systems upon receiving "positive indication of a reactor trip demand.
11 Emergency Operating Procedures specifically direct actions to be taken in response to such positive indication. Operator training is required to recognize the positive indication and understand the objective of each procedure step.
With proper operating procedures and adequate training, the operator's response to an ATWS event should be proper and timely.*
1..
Operating Procedures NRC staff personnel conducted interviews with control room operators and reviewed the emergency operating procedure for reactor trip which was used by control personnel during the February 22, and 25events. This procedure, which included the ATWS procedure steps, is identified as EI-I-4.3, Revision 7.
The procedure required a manual trip if an automatic trip did not occur as indicated by reactor power level remaining high or control rods failing to insert. *(This
- situation does not mean that a trip should have occured, only that one has not occured.) In addition, the procedure required a manual trip of the turbine..
However~ due to a lack of understanding of the procedure steps and/or a lack of adequate training, one operator questioned the appropriateness of the ATWS step to trip the turbine.
The evaluation of plant operations is divided into two sections.
The first deals with "positive indication" of a 11 reactor trip demand."
The second addresses the licensee's revised procedures relative to the requirement to manually trip the reactor upon receipt of a positive indication of a reactor trip demand.
These procedures are identified as EI-I-4.3, Revision 10, Reactor Trip, and EI-I-4.0, Revision 6, Safety Injection Initiation, both dated April 6, 1983 for both Units 1 and 2.
The ATWS portion of the licensee's revised pro-cedures relative to the Westinghouse Owners Group guidelines is also evaluated.
a, Positive Indication of Reactor Trip Demand The staff's evaluation is based on the following definitions of "reactor trip demand" and 11positive indicati.on 11 of that demand.
A 11reactor trip demand" is the condition of the final output of the logic portion of the reactor protec-tion system calling for an automatic reactor trip.
Confidence in the validity of this trip demand is based on the redundancy and reliability of. the reactor protection system logic.
A reactor trip demand will effect an automatic reactor trip if either reactor protection circuit breaker opens.
"Positive indication 11 of a reactor trip demand is defined as the information from control room indicators that alerts the operator to the present existence Salem Restart SER 11
.. *.:~ *...
of a reactor trip demand.
The licensee's proposed positive indications of a reactor trip demand are presence of an alarm on the reactor trip portion of the first-out annunciator panel and concurrent sensor bistable trip indications (sufficient to require a reactor trip) on the solid state protection system (SSPS) status panel.
Information from the first-out annunciator panel alone provides a more conservative positive indication because it indicates either that a trip demand currently exists or that such a demand existed in the past.
It is possible for the first-out panel to indicate a reactor trip demand after the trip condition has cleared because the annunciator "locks in. 11 The SSPS status panel bistable indications, on the other hand, automatically reset when the associated trip condition clears.. Thus, although the first-out panel alone provides the conservative positive indication of a reactor trip demand, the first-out annunciator concurrent with *the bi stables on the SSPS status panel is required for positive indication that the need for a reactor trip presently exists.
Staff review of the first-out annunciator panel operating sequence showed that a first out signal provides two coding methods to direct the operator*s attention to a specific annunciator tile. The first is the auditory signal wi.th a specific pulse rate and frequency variation unique to the first-out panel.
The sound draws the operator's attention to the fact that an annunciator is active while the specific pulse rate and frequency is meant to identify the first-out panel.
Identification by auditory coding is useful only 1f a limited number of different signals must be distinguished by the operator.
The recommended limit is nine for all auditory signals located in the control room, including plant evacuation, fire, security, computer alarms, annunicators, etc. Since there are more than twelve different auditory alarms in the Salem controi room, the significance of the first-out panel unique auditory alarm is diminished.
The separate first~out panel with red demarcation is an adequate reference such that a flashing tile within its bounds provides positive indication that a reactor or turbine trip demand signal has been generated.
However, a drawback to the overall annunciator alarm system at Salem, which could cause operators to lose information, is that the silence, acknowledge, and reset (except first out tile) functions are accomplished by use of a single control (knee switch).
The second method of coding is intended to identify a specific first-out tile within the first-out panel. This is done by illuminating two red bu.lbs along.
with the two white bulbs illuminated on all activated tiles. The net result is a first-out indication that appears pink when viewed under normal ambient control room illumination. This color is not easily discriminated from that of
- illuminated white tiles on the same panel.
Further, NRC color vision testing requirements for operators may not be sufficiently discriminating or uniformly applied to detect a color vision deficiency, thus exacerbating the potential problem of quick first-out tile identification.
The licensee's procedure, EI-I-4.3 11Reactor Trip, 11 dated April 6, 1983, does not depend on identification of a specific annunciator tile on the first-out panel~ only on detection of any reactor trip annunciator on the panel.
- Thus, the deficiencies in auditory and visual coding for identification should not significantly affect operator performance of the emergency procedure.
These deficiencies may affect post-event operator actions.
The licensee stated in its letter to D. Eisenhut from R. Uderitz, dated April 7, 1983 that modifica-tions are under, consideration and that changes will be completed by May 1, 1983.
Salem Restart SER 12
- ..;t;,,,.~.
- b.
Revised Procedures Subsequent to the February 25 event, the licensee revised the procedures for reactor trip and safety injection.
The procedure revisions upon which this safety evaluation is based are EI-I-4.3 11 Reactor Trip, 11 and EI-I-4.0, 11Safety Injection Initiat~on, 11 both dated April 6, 1983 for Units 1 and 2.
The staff review of the revised procedures addressed several areas:
(1) The operators must be able to carry out the instructions quickly enough to respond success-fully to a plant transient; (2) Indicators upon which the operator acts must be sufficiently reliable to evoke proper action when necessary and not lead to improper operator action which may affect safe operation of the plant; (3) Instructions must have an adequate technical basis to provide confidence in their.appropriateness; (4) Procedures must be written clearly so that the opera-tor can understand and implement them in a high stress environment.
This includes immediate actions that must be committed to memory so that they can be performed before time is available to actually reference the proc~du~~.
(1) Timeliness of Response To address the issue of how much time is available for operator action, the staff reviewed the analysis of the limiting ATWS event.
The limiting concern for this event is reactor coolant system pressure.
Results show that if the turbine is tripped within about one and a half minutes after the loss of feed-water, even if the reactor is not tripped, the pressure transient does not exceed design limits.
The staff reviewed the reactor trip procedure and visited the Salem Unit 1 control room to look at the indications and controls used in the procedure and to walk through the initial steps of the procedure.
Staff review indicated that the Solid State Protection System (SSPS) status panel in the control room is located and arranged in a manner that should require only a few seconds to recognize a reactor trip demand.
The staff walk-through of the Unit 1 control room demonstrated that the operator could perform all the necessary control room actions in less than half a minute.
Therefore, based on the small size of the Salem control rooms and the relation-ship of the main control board and SSPS status panel, the* staff has determined that operator scanning of displays necessary for this event and operation of all required controls can be performed adequately.
(2)
Reliability of SSPS Status Panel Indications
.Based on discussions with Salem personnel, and observations made during the control room walk-through, several issues about status indicator lights were identified.
Both the first-out panel and the SSPS status panel are powered from vital power supplies.
Each status panel indicator consists of a light fixture which can contain up.to four miniature bulbs.
Each indicator appeared to be vertically partitioned so that two bulbs may be placed on each side of the partition. According to operations personnel only two bulbs.are used in each indicator, to reduce the heat generated within the indicator fixture.
Control room observation from a hu~an factors standpoint indicated that one.
bulb was sufficient to provide a visible indication of status.
Salem Restart SER 13
The bulbs in the indicators are tested once each shift, and both trains of the status panel are functionally tested each month when performing surveillance tests on the reactor protection system.
A burned out bulb is detected by observing a dark side on the indicator face.
Concern about reliance on SSPS status panel indication originated in the Unit 1 control room with the staff 1 s observation that a number (at least 10) of the status panel indicators appeared to have burned out bulbs.
An additional con-cern was the placement of bulbs in the indicators.
With one bulb on each side of the light fixture, it was apparent when a bulb was burned out.
However, with both bulbs on the same side of the p*artition, it could be difficult to determine that a bulb had failed.
In view of the reliance on status lights for positive indication of a trip demand at Salem, and issues for reliable status indication based on staff observations, the licensee was required to provide the staff with~ d~tailed description of the procedures which will be used to ensure the operability of SSPS status panel indicators.
The licensee 1s April 8 supplement to its April 7 letter provided a description of the power supply for the SSPS status panel and a description of its procedures for ensuring operability of the SSPS status panel indicator bulbs.
(3)
Technical Basis of ATWS Procedure The technical basis of the ATWS procedure is provided by the Westinghouse Owners Group procedure guideline ECA-1, 11Anticipated Transient Without Scram, 11 dated September 1, 1981.
The licensee 1 s procedure EI-I-4.3, 11 Reactor Trip, 11 and EI-I-4.0, 11 Safety Injection Initiation 11 each dated April 6, 1983 were reviewed using the Westinghouse Owners Group guideline ECA-1 as a basis.
Although there are plant-specific differences, no technical deficiencies were noted in the procedure.
The licensee 1s two procedures contain plant-specific, detailed steps to provide operators with more methods of tripping the reactor and the turbine than are identified in the generic guidelines and are therefore more comprehensive than the current owners* group generic guidelines.
(4)
Human Factors Review of Procedur~
A human factors and technical review was conducted of the ATWS portion of the licensee 1 s 11 Reactor Trip 11 1:i"rocedure, and_o~ the immediate actions of the licensee 1 s 11Safety Injection Initiation 11 procedure.
A number of human factors discrepancies were identified, including lack of internal consistency, logical
- ordering of steps, and conventio_n used for emphasis.
None of the discrepancies warranted revision prior to restart.
However, many of these discrepancies were corrected in the April 6 revisions to the procedures.
The licensee agreed to consider the remainder of the discrepancies in the program for upgrading emer-gency operating procedures (EOPs) in accordance with Supplement 1, NUREG-0737.
This upgrade program will revise existing EOPs, using the Westinghouse Owners Group Guidelines, as part of the ongoing Three Mile Island Action Plan to upgrade all plants* EOPs.
All plants 1 schedules for the EOP upgrade are due to the NRC by April 15, 1983, in accordance with Generic Letter 82-33.
Sal em Re s*ta rt SER 14
". ~...
~ -
-. ~..
, -.. * **.,.,,,,:*,*:M.*'.*
==
Conclusion:==
Staff review covered operating procedures, including positive indication of reactor trip demand and revised procedures.
Review of the proce-dures included timeliness of operator response, reliability of the indications, technical basis of the procedures, and the human factors of the procedures. *As a result of our review, the licensee was required to identify the control room indicators that provide positive.indication, without operator analysis or verification, that an automatic reactor trip demand is present.
In addition, the licensee was required to revise procedures to direct the operators to insert a manual trip whenever positive indication of an automatic reactor trip demand is present, without delaying to evaluate the overall plant status.
Our review of the April 6 revision of the procedures determined that the necess.ary revisions have been made.
Based upon our review, the staff concludes that the revised procedures have been completed and are acceptable and that the reliability of the indications relied upon for manual trip is acceptable for restart.
- 2.
Operator Training Interviews conducted by the NRC with the licensed operators who were onshift during the two events of February 22 and 25 indicate a lack of fam1liarity with the functions of the annunciators and indicators associated with the Reactor Protection System (RPS) and control panel.
The interviews also revealed that the operators who were on shift during the February 25 event did not recognize that the failure of the RPS (specifically the failure to scram) had occurred.
until approximately 30 minutes after the event.
Specifically, the operators interviewed were not able to state whether the reactor-trip-indicator light (red) on the RPS mimic status panel indicated a demand for, or confirmation of, a breaker trip action.
Interviews also indicated that at least some operators questioned the validity of annunicators until they could be confirmed by independent indication. This perceived need for confirmation of annunciators caused the operators not to take immediate action to manually trip the reactor based on annunciator indication and verification of reactor power level remain-ing high and/or multiple control rods failing to insert on February 25, 1983.
Following the event, the Salem Nuclear Training Center Staff developed an ATWS Training Program which was conducted for all 56 licensed personnel.
Each operator attended one of six training sessions, each approximately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> in duration, conducted on March 10, 11, and 15, 1983.
At the conclusion of each session, trainees were evaluated by a written examination.
A grade of 80% was required for passing.
In addition, 12 operators undergoing their normal re-qual ification training were required to take an 11 upgrade 11 exam which included the new training on ATWS concerns.
The evaluation of this training is addressed below.
As part of this program, the trainees were "talked through 11 the revised steps of Emergency Instruction EI-I-4.3 (Revisions 8 and 9).
The trainees were also given a refresher on the RPS and associated indications and alarm*s.
Definitions of "demand" and 11confirmatory11 signals were introduced and discussed.
ATWS events and the analysis upon which the procedures are based were discussed and the February 22 and 25 events were thoroughly reviewed.
Salem Restart SER 15 r"
... * *.. ;=*
- .. ~.'(.
~.. -
This evaluation is divided into three sections:
training on the revised proce-dures, training on the RPS and associated indications and alarms, and on the administration of this training.
- a.
Training on Revised Procedures The trainees were asked to list the 7 steps that an operator is required to do in order to manually trip the reactor if an automatic reactor trip has not occurred.
While this is a valid question (operators are required to have these steps memorized), a random sampling of 5 test results showed that only 1 trainee listed these steps without error.
For the remaining 4 trainees, as well as other trainees, no retesting of this test item was required, and no remedial assistance was provided.
The trai.nees, while they may be able to list the 7 steps of this revised procedure, were not given any opportunity for practice or required to undergo performance testing.
The staff considers that the trainees should walk through the procedures in the control room until successful perfor-mance is exhibited.
Further, this may be done on an individual or a*team basis.
In its letter to D. Eisenhut from R. Uderitz dated April 7, 1983, the licensee stated that each licensed operator will be required to perform the steps in the procedure (Procedure EI-I-4.3, Revision 10, effective April 6, 1983) in the correct sequence in a control room or simulator exercise prior to April 12, 1983, which is prior to restart of the units.
A review of the actions identified in the Salem Restart.Evaluation, conducted by NRC personnel, April 19-20, 1983, confirmed that all operators successfully completed this walk through of the Revision 10 procedures.
In addition, eight randomly selected operators successfully completed an additional walk through of the procedures conducted by NRC personnel.
Our review of operating practices at the Salem station indicates that auxiliary (equipment) operators will perform trip functions contained in the last two steps of the ATWS sequence, on direction from the control room.
The steps include manual trip of the reactor trip breakers and manual trip of the rod drive MG sets. Training of the equipment operators for these tasks is not evident.
PSE&G has committed in its letter of April 7 to have each equipment operator identify and operate these devices prior to April 12, 1983.
The April 19-20 review of attendance sheets and schedules confirmed that each equipment operator successfully completed a walk through of breaker location, type and operation.
In addition,* seven randomly selected equipment operators successfully completed an additional walk through conducted by NRC personnel.
- b.
Training on RPS and Associated Indications and Alarms While the trainees were given refresher training on the RPS and 11demand 11 and 11confirmatory11 trip signals, they were not tested on the source of these signals, nor were they required to list the 5 "confirmatory" signals (as stated in the training objectives). Only one of the tests, the 11 upgrade 11 test given to only 12 trainees, required the trainee to explain the difference between these two signals.
To measure the operators' understanding and retention of this subject matter, all trainees should have been required to (1) identify the location of these annunciators, (2) explain the difference between the types of signals, and (3) list the 5 "confirmatory" signals.
PSE&G stated in its April 7 letter that the trainees have been examined on the location of annunciators, alarms, etc:, and the types of signals exhibited.
Salem Restart SER 16
-. ~....
The staff 1s April 19-20 review of attendance sheets and schedules confirmed that all operators successful.ly compelted a walk through on the location of alarms and RPS indicators and types of signals.
In addit\\on, the eight randomly selected operators successfully completed an additional walk through conducted by NRC personnel.
- c.
Administration of Training For the overall training evaluation, one of two versions of the final examina-tion was given to each trainee. These two versions were distributed in an alternate fas,h.ion.
Upon review, it is apparent that these two versions do not test the same subject matter. While some questions are the same,, certain areas, e.g., alarms, are tested on one version but not on the other.
Basic educational principles require that if separate tests are to be given, they must be equiva-lent.
All students should be tested on the same subject matter.
As previously stated, the 12 trainees undergoing requalification training were given an additional 11 upgrade 11 exam.
The scores received on these two different tests were then averaged for a final score (a score of 80% was the criterion for passing).
However, in one case, a trainee received a 93% on the first test and 73% on the 11 upgrade 11 test for an 83% final score.
Thus, the student passed.
Two different tests should not be averaged to make one final score.
Averaging in this manner does.not ensure understanding of all the subject matter.
The licensee stated in its April 7, 1983 letter that individuals requiring remedial training have been retrained and have successfully completed a comprehensive exam.
The staff's April 19-20 review confirmed that those individuals requiring remedial training were individually counseled regarding* all items missed on their exam, received remedial training on the revised procedures (Revision 10),
successfully passed a newly created exam and successfully completed a walk through on these procedures.
There were 18 learning objectives given to the trainee at the beginning of the training program; however, the trainees were not evaluated on all of these objectives.
To ensure successful achievement of the subject matter, the trainees* performance should have been evaluated against all established objectives.
In its April 7, 1983 letter, the licensee stated that they reviewed the course material and determined that all the objectives were covered.
Since the training covered all learning objectives and testing was conducted on the most important objectives, we find this acceptable for restart.
During the staff's audit of the_ATWS training program, the licensee was informed that the examinations should be returned to trainees for them to assess their strengths and weaknesses..
The licensee reported in its April 7, 1983 letter, that the individual graded exams with answer keys will be returned to the trainees by April 7, 1983.
The April 19-20 review of records and interviews with the eight randomly sel~cted operators confirmed that each operator received his graded exam and.
answer key.
In addition, each operator was individually counseled on all test items missed regarding training on the revised procedures.
A test item analysis, a method used to identify test weaknesses, was performed by Salem training Salem Restart SER 17*
~
~-; '
., *. ~.
consultants.
Records plus interviews with the eight randomly selected operators confirmed that each operator received a letter describing these identified test weaknesses.
Our review of the training material and objectives indicated the instructor lesson plan and student handout materials were not referenced or indexed.
The licensee stated in its April 7, 1983 letter that student handouts and lesson plans have been cross-referenced to the objectives and the revised handouts will be sent to each operator by April 12, 1983.
A review of records and the revised handouts confirmed that the handouts are now properly cross-referenced and in~exed and have been distributed to each operator.
==
Conclusion:==
Based upon this review, the staff concludes that the ATWS training program for the licensed operators and equipment operators presented J:>y the Salem Nuclear Training Center has properly addressed all concerns previously discussed and fully complies with all actions required in the Salem Restart Evaluation, April 11, 1983, and is acceptable for restart.
- 3.
Operator Response Interviews were conducted with the operators involved in the two events that occurred at Salem on February 22 and February 25, 1983, to evaluate the reasonableness of their response to the events.
The first event was caused by the loss of a 4160 kva electrical distribution bus (and associated buses) during transfer of bus supply from off-site to on-site power.
The loss of the bus caused a loss of the feedwater control system, with a resultant reactor trip demand caused by low-low steam generator (SG) level.
The second event was caused by reaching the low-low SG level setpoint while in manual control.
The following facts were determined based on interviews with the licensed operators who were in the control room at the time of the two events.
- i.
In both events, the operators took 20 to 30 seconds to evaluate overall plant status, and determine the need for and then initiate a manual reactor trip.
For the first event, 20 seconds elapsed from the loss of the electrical distribution bus to a condition requiring a reactor trip,.and thus the determination of plant status coincided with the reactor trip demand caused by the low-low SG level.
For the second event, evaluation of the plant status commenced with receiving the reactor trip demand caused by low-low SG level.
ii. The operators do not routinely*take action based on the first-out panel indication (low-low SG level) and SSPS status panel indication.
- Instead, the operators evaluated the alarms received by verifying control room indications of the affected parameters.
iii. The operators did not fully understand the relationship between the RPS and the first-out annunicator input signals, nor did they fully understand the operation of the SSPS.
iv.
The operators questioned the reliability of the first-out panel based on generalized problems experienced with adjacent panels and based on a Salem Restart SER 18
previously experienced problem with a non-RPS-related annunciator on the first-out panel.
- v.
In the first event, when the shift supervisor ordered a manual trip, the operator inadvertantly pulled the J-handle off the manual reactor trip switch.
The operator then had to reinstall the switch handle to perform a manual trip.
vi.
In the second event, the operators did not recognize that a failure to trip on demand (AlWS) had occured until the control room instrumentation had been checked and a determination made that the trip points were set correctly and the breakers did not operate properly.
Based on the operator interviews, the staff determined that:
- i.
In the February 22 event, the operators' response was prompt and fully satisfactory from the time the transient started until the time the reactor was manually tripped.
However, the control room operators did clear the first out panel without noting the cause of the reactor trip demand, thus eliminating the first out information.
In the February 25 event, the operators 1 response time was reasonable, considering the deficiencies in training that resulted in (1) the operators failing to recognize a reactor trip demand, and (2) the operators failing to understand the control room indications, and considering the procedural deficiencies identified in section B.l of this report.
ii. The improper operation of the J-handle switch was caused by the operator 1 s lack of familiarity with the switch, and due to a poor design of the switch for this application in that it was not firmly secured to the switch body.
iii. In the February 25 event, a manual reactor trip might have occurred earlier if the operators had recognized that a reactor trip demand existed.
The operators manually tripped the reactor in response to their evaluation of the plant status and control room indications and not due to recognition of the failure of the reactor protection system to provide the required trip.
==
Conclusion:==
The training the operators received prior to the two events was deficient in that they were given insufficient criteria for determining the need for a manual reactor trip, and the operators did not fully und~rstand the RPS or annunciator systems.
The J-handle switch is of poor design for this application, and at least some operators were not properly instructed on the use of the handle in its current design.
Procedural and training actions to correct the items noted in the interviews are discussed in sections B.1 and 8.2.
Additional correction act.ions are discussed below.
- i.
Prior to startup, the staff required the operators to be trained on the proper operation of the current design of the J-handle switch.
The
.Salem Restart SER 19
.. :..* *-*.r*_:.:.
- i.
I.
I I
licensee has satisfactorily conducted this training, and the staff con-siders this item acceptable for plant restart.
(Training for operations personnel on post trip review procedures is covered in Section D.S.)
ii.
In the long term (after restart), the licensee is required to permanently secure the J-handle switch.
In its April 7, 1983 letter, the licensee stated that these switches will be replaced with new switches having permanently attached handles during the next outage of sufficient length to complete the work.
We find this acceptable.
iii. As part of the Detailed Control Room Design Review (DCRDR) required by NUREG-0737 Supplement 1, the licensee is required to reevaluate and address in the DCRDR summary report the design of the first-out panel system to improve the reliability of the information presented to the operators.
Resolution of this item is discussed in Section B.l.
iv.
As part of the DCRDR the licensee is required to evaluate the design and operation of its overall annunciator alarm systems (e.g., number of auditory codes used, color coding of annunciator tiles, use of single action switches to perform both the silence and acknowledge functions and the use of knee switches in the control room).
Overall
Conclusion:
In summary, the licensee's corrective actions addressing operating procedures, operator training, and operator response that have already been accomplished, and the commitments in the April 7, 1983 and April 8, 1983 letters are accepta-ble for restart.
Salem Restart SER 20
- -~**...
~*:,.
C.
Management Evaluation The deficiencies identified during the review of circumstances surrounding the' February 22 and 25, 1983 events raise the general question of the responsive-ness, practices, and capability of licensee management both at the nuclear plants and at the corporate level of the utility. Additionally, a number of specific management issues related to the failure of the reactor trip breaker events were also identified.
The issues discussed in this section are:
- 1.
Master Equipment List
- 2.
P.rocurement Procedures
- 3.
Work Order Procedures
- 4.
Post Trip Review
- 5.
Timeliness of Event Notification
- 6.
Updating Vendor Supplied Information
- 7.
Involvement of QA Personnel with other Station Departments
- 8.
Post Maintenance Operability Testing
- 9.
Overall Management Capability and Performance Based on NRC review of information provided by the licensee in letters dated March 14, March 15, March 18, March 23, April 4, and April 7, 1983 and inspec-tions and meetings both at the Salem site and.in the NRC Regional and Head-quarters offices, all issues are considered resolved for restart.
Evaluations addressing each issue are included in the report.
Longer term (i.e., those to be completed following restart), actions remain to be completed and licensee commitment dates for completing these actions are identified under each issue in this r~port.
- 1.
Master Equipment List The licen5ee maintains a Q list that identifies activities, structures, and systems to which the Operational Quality Assurance (QA) Program applies.
A Master Equipment List (MEL) is used by the licensee as the reference document for determining the safety classification of individual equipment.
The MEL is intended to be a comp"ehensive list of all station equipment and identifies each item as nonsafety related or safety related. When preparing maintenance work orders, the MEL is consulted to determine if QA coverage of the work is necessary.
Licensee and NRC review identified three concerns associated with the MEL.
These concerns are:
(a) the accuracy and completeness of the docu-ment, (b) issuance as a noncontrolled document, and (c) lack of understanding*
by plant personnel of its proper use.
The MEL was derived from engineering source documents and a construction program document called Project Directive 7 (PD-7) and was provided to station personnel Salem Restart SER 21
by the Engineering Department as a reference document in July 1981.
Prior to issuance of the MEL, the PD-7 was used as the reference d~cument. The MEL, how-ever, was not issued as a controlled document, therefore verification of its accuracy and completeness on issuance was not assured, and it was not updated in the plant as necessary.
Perhaps more significantly, the reactor-trip circuit breakers were not included in the MEL.
In addition, some personnel were not familiar with how to use the M~L for determining the classification of a par-ticular piece of equipment that was present on the MEL.
Maintenance personnel acknowledged that reference was made to PD-7 on occasion.during the January -
February 1983 period.
In response to this issue, the licensee reissued the existing MEL on March 12, 1983, under engineering Field Directive S-C-A900-NFD-077 which describes the MEL and its use, cancels PD-7, and issues a new Systems List as a part of the MEL.
The following excerpt from this Field Directive describes the utilization of the MEL:
For use in classifying work orders as to safety-related status and QA Program applicability; personnel shall consult the systems list of the M=L, not the component listing. All work on any of the listed systems shallt)e performed based on the classification of the system as a whole, net the individual component in question.
For use in classifying items on procurement documents, both the MEL systems listing and the MEL component listing shall be consulted.
Use of this information shall be as follows:
if the item is on the MEL component listing and its system is on the system list, the classification on the component list may be used on an MO/IC.
if the item is not on the component listing and its system is not on the systems listing, the item may be regarded as non-safety related with no QA program requirements.
if the item is not on the component listing.but its system is on the system listing, the Nuclear Engineering Department should be consulted regarding its true classification.
if an item is found on the MEL component listing as Q-Program appli-cability 11yes 11 but its system is not on the systems listing, Nuclear Engineering should be consulted for resolution and to effect MEL.
revision, if necessary....
Although the MEL is not broken down into sub-components, classification of sub-components shall be assumed to be the same as its associated component unless written direction is requested and received from the Nuclear Engineering Department.
Any question concerning a component classification in MEL shall be directed to the Nuclear Engineering Department.
Requests for classification of components not in MEL shall be directed to the Nuclear Engineering Depart-ment.
Licensee Administrative Procedure, AP-9, 11Control of Station Salem Re~tart SER 22
-~ *=-r,* '~.**-*~- - * --~ **c *;****.:* *
.. -.:,--..... -: ~*: **
Maintenance 11, has also been revised to reflect the new requirements for the classification of Work Orders.
As part of the action necessary to resolve this issue, the NRC required the licensee to verify prior to restart that the MEL is complete and accurate with respect to emergency core cooling (ECCS) including actuation systems, RPS, auxiliary feedwater a.nd containment isolation systems.
The licensee has conducted a verification/updating of the MEL for the above systems by starting with the latest plant piping and instrument drawings and electrical/controls schematic~ *(which included all completed plant modifications and design changes) and verifying that the components shown were included in the MEL and appropriately classified in the categories of Safety Related, Seismic Class, Nuclear/Non-Nuclear, and QA Required.
This updating was completed and the revised MEL issued on March 24, 1983, under Field Directive S-C-A900-NFD-080.
This Field Directive required that all previous editions of the MEL be discardeq..
A staff review of the revised MEL was performed to verify that the Systems List adequately addressed the systems/components in the QA Manual 11Q 11-List. Staff review identified some discrepancies in the new systems list which the licensee corrected in a revision to the MEL issued on April 5, 1983.
Additionally, a sampling review of the component section of the MEL was conducted to ensure that the emergency core cooling systems, RPS, auxiliary feedwater system, and containment isolation system components were listed and correctly classified as 11Safety-Related/QA Required 11
- This sampling review revealed no.discrepancies.
In addition the staff reviewed the training records for the training conducted by the licensee on March 10 and 11, 1983 and concurs that appropriate personnel have been adequately trained in the use of the MEL.
By letter dated April 7, 1983, the licensee committed to verify that the component listing includes all equipment of the remaining Q-list systems.
This verification will include an independent review of each data entry on th MEL to verify the proper classification.
Additionally a formal procedure for the use, review and periodic update of the MEL will be issued.
The above actions will be completed by May 1983.
The staff considers these actions acceptable to resolve all concerns with the MEL and the staff will verify their completion.
==
Conclusion:==
Based on a review of the licensee's commitment to revise the Field Directive, the staff concludes that the actions required prior to restart concerning the MEL are sati~factorily resolved.
The staff will require the licensee's stated actions concerning updating of the MEL for the remaining systems/components and its reissuance as a controlled document and will verify satisfactory resolution of these actions when complete.
- 2.
Procurement Procedures A review of safety and quality classifications for the reactor trip breakers indicates that the licensee's established management and administrative con-trols may have allowed the procurement of replacement components for a safety system with a quality less than that of the original design.
This is evidenced by procurement activities concerning the purchase of reactor trip breakers and replacement components conducted during the period from June 1, 1981 to March 1, 1983.
One example involved the issuance of a purchase order for a spare reactor Salem Restart SER 23
~. -..
~~-----
trip breaker on June 1, 1981.
Contrary to the established administrative con-trols, the breaker was classified incorrectiy, the properAreview and approval was not conducted, and no QA requirements were imposed as required for the original equipment.
Subsequently, on September 15, 1982, the classification for the same order was changed to an even more inappropriate classification without the required review and approval process.
As a result of these activ-ities, the purchased breaker was received and placed into storage, without further use, and without appropriate documentation that would demonstrate suitability for its use had it been required.
All subsequent purchases fo~ reactor trip breaker components consistently utilized the initial incorrect cla~sification. A spare coil for a UV trip attachment purchased in this manner may have been utilized on August 20, 1982.
Though the procurement review focused on the reactor trip breaker, the licensee's activities in the area for other safety related components could have resulted in similar circumstances existing for plant safety systems.
In his March 14, 1983 letter, the licensee responded io this issue indicating that the procurement system has been reviewed to assess the effectiveness and adequacy of the procurement procedures and their implementation.
Additionally, although not identified as a requirement to be completed prior to restart, the 11censee conducted a sampling review of previously issued procurement documents for Westinghouse and other m,jor vendors.
Staff evaluation of licensee's response to this issue addresses procurement procedures and licensee's review of procurement documents separately below.
i.
Procurement Procedures Discussions with the licensee ~nd subsequent review and evaluation of this area*by NRC ha$ disclosed that part of the perceived issue in pro-curement was due to a misunderstanding of PSE&G's program (procedures) for procurement of parts or components defined as Commercial Catalog Items (CCI).
After further review, NRC has determined that the licensee's definition of CCI and procedures for procuring certain items as CCI are acceptable, if rigorously implemented.
Specifically, CCI is defined as an item which complies with all the following requirements:
(1)
The item is n'ot unique to facilities or activities licensed by the NRC.
(2)
(3)
(4)
(5)
The item is manufactured in quantity to published manufacturer's fixed design and quality requirements.
The item part number 'is listed in the supplier's catalog as opposed to a manufacturer's bulletin or circular.
The item requires no supplier documentation.
The i tern is i denti fi able by phys i ca 1 marking, tagging or container--
i zat ion and is maintained throughout storage.
This definition is only acceptable to NRC when combined with all of the following requirements which are included in the PSE&G program:
Salem Restart SER 24
. *- : ~ *... _;.*
- ,~:..
.... ~-*.
~* -
ii..
(1)
For replacement (CCI) items, a document must exist which identifies the item to be ordered as an authorized replacement-in-kind for the original or existing item.
Such documents must include the manu-facturer's part list, bill of material, repair, maintenance or instruction manual or a PSE&G engineering list of replacement or interchangeable parts.
(2)
Any proposed substitution for authorized parts requires written engineering approval.
(3)
The classification as CCI for an item used in a safety related application is a procurement item classification only.
The receipt inspection, installation and subsequent testing must be subject to the same controls as for any other safety related item.
Thus, procurement of a 08-50 circuit breaker as a CCI could be ~ermisiable since it is listed in the Spare Parts Report of recommended spare parts for the Nuclear Steam Supply System furnished by the Westinghouse Water Reactor Division.
This report identifies it as an authorized replacement-in-kind.
Although-the procurement procedures have been found to be acceptable after further detailed review, a series of problems with implementation of the existing procedures were identified by the NRC fact find.ing Task Force, as documented in NUREG-0977 dated March 1983, during their review of the procurement actions for reactor trip breakers at Salem since June 1981.
These included examples with improper seismic classification, lack of required review by QA and Engineering personnel, circumventing of the normal receipt inspection process, and incorrect classification of under-voltage trip attachments as CCI without any existing documentation to support them as authorized replacement-in-kind.
Thus, procurement imple-mentation (practices) rather than procurement procedures (program) is a more correct description of the procurement management issue.
The staff has reviewed various PSE&G recent i'nternal memoranda on procure-ment practices.
These documents emphasize the need to follow ex1stfng procurement procedures and in addition, establish interim measures to assure procedure adherence, provide additional assurance that future Purchase Orders will be properly classified and require completion of approval cycle prior to purchase of materials.
Additionally, the resolu-tion of the issue associated with the MEL (Section C.2) provides for proper use of an approved master classification listing in the procurement process.
Appropriate portions of these interim measures will be the basis for a new Qua.lity Assurance instruction to be issued by July 1983.
Review of Procurement Documents The PSE&G review consisted of:
a selection of 73 major vendors who nor-mally supply most safety related materials and a review for proper clas~i fication of all Purchase Orders (POs) which had been initially classified as non-safety related and CCI for these vendors since initial issuance of the MEL.
Approximately 325 POs out of a total of 2,707 reviewed had some Salem Restart SER 25
. ~~:... *...... **.
_* ~--
\\
type of discrepancy or needed further clarification by the Engineering Department.
This secondary review resulted in 14 Deficiency Reports (DRs).
The NRC staff reviewed all of these DRs including their disposition and sampled the other POs sent to Engineering for clarification. The DRs appeared to have appropriate actions necessary to correct the deficiency stated and the deficiencies did not appear to affect redundant components or have more than minor potential safety significance.
The DRs were easily resolved by the licensee and they concluded that none of the misclassifications resulted in actual adverse impact on safety.
Of the other POs reviewed, ~o additional misclassifications were noted.
==
Conclusion:==
Based on the staff 1 s further review and concurrence that the pro-curement issue was an implementation problem rather than inherent deficiencies in the program, the licensee 1 s review of past procurement actions whjch demon-strated a low incidence of misclassifications, the relatively min~r potential safety significance of such misclassifications, the successful dispositioning of all procurement related DRs, and increased emphasis and training on proper classification of future procurement actions, the licensee has concluded that the procurement issue has been resolved for restart.
As a result of the staff's review and sampling of such actions, the staff agrees that this issue is satisfactorily resolved.
- 3.
Work Order Procedures NRC review of the February 22 and 25 events identified that the personnel preparing maintenance work orders were not complying with instructions contained in the station administrative procedure. Specifically, for the work performed on the reactor-trip circuit breaker in January 1983, the engineering department was not consulted to verify safety classification, and an erroneous nonsafety determination was made.
Such consultation is required if equipment is not listed in the MEL as was the case with the reactor trip breakers.
In add~tion, there was, therefore, no independent review within the maintenance organization, and the Quality Assurance Department was not involved in the work.
It should be noted, however, that all other work orders for maintenance or services on the reactor trip breakers were found to be properly de~ignated safety7related.
In his March 14 and March 15, 1983 submittals, the licensee committed to review, prior to restart, all nonsafety related work orders that have been written since issuance of the MEL in order to ensure proper classification.
A similar effort will be conducted on Unit 2 prior to Unit 2 restart.
Addi-
. tionally, the licensee developed a revised Administrative Procedure AP-9 and Quality Assurance Instruction QAI 10-6.
AP-9 is the administrative procedure for controlling station maintenance and has been revised to ensure work orders will be properly classified in the future.
QAI 10-6 has been prepared to provide guidance for QA review of Station work orders.
The licensee has reviewed approximately 15,670 work orders which were classified nonsafety related.
This review was conducted by quality assurance (QA) person-nel.
Of the 15,670, approximately 11,550 were determined to be properly clas-sified nonsafety related without further review.
Approximately 4,100 work orders were sent to Engineering for further clarification by the Sponsor Engineer and of these, all but approximately 873 were determined by Engineering Salem Re~tart SER 26
to be properly designated norrsafety related.
Deficiency reports (DR) were written on the remaining 873 work orders.
Subsequently, dbcumentation of proper classification was found for a number of work orders, which reduced the number of DRs to 689.
The list of DRs was examined by the NRC staff and from that list approximately 300 DRs and work orders were selected and reviewed to determine the safety significance of the misciassified work orders and to determine whether the DRs were properly dispositioned.
The staff review emphasis was on work performed on ECCS. systems, RPS, containment systems and emergency power supply systems.
Our review determined that the vast majority of the DRs involved components of systems with minor safety signficance or relatively minor components of more important systems.
Many work orders for which DRs were written involved work on components of a safety related system although the components themselves were not necessarily safety related.
For example, mi nor work was.per.formed on control room strip chart recorders which are part of the safety related control room console, yet the recorders themselves do not perform a safety related function since other safety related instrumentation exists which monitors the same parameters.
Most DRs were dispositioned by finding the proper documentation or by verifying that a system or component test conducted after maintenance demonstrated operability of the affected component.
Based on the staff's review of work orders and DRs, there appears to have been no significant impact on safety from misclassifying work orders (other than the reactor trip breakers).
Recently, the licensee examined all work orders which required DRs (873) to determine how many were actually misclassified based on the previous work practice.
As noted in section C.1, MEL, the licensee's criteria for classi-fying work orders has been modified since the February 22 and 25 events and DRs were written for all work orders which were misclassified under the new classification system.
In his April 7, 1983 let~er, the licensee has indicated that 35 work orders were erroneously classified under previous work practices,.
although 132 items lacked documentation.
Hence, it is apparent that only a small fraction of the total number of work orders involved actual administra-tive errors in classification.
With respect to the licensee's revised procedures, the staff reviewed the revised AP-9 and QAI 10-6 to determine if they provide the necessary admini-strative controls to ensure ~roper work order classificati6n.
AP-9 has been revised to require an independent review of all non-safety related work orders by the Quality Assurance Department to verify the classification.
If the QA inspector concurs in the classification, he shall affix a Quality Control Inspection stamp to the non-safety related work orders prior to work order issuance.
In additioni AP-9 requires the supervisor or planner to contact the sponsor engineer when any clarification of the classification is required.
As noted in the Section C.1 of this report, the MEL now includes a Systems Li st and for the purpose of cl assi fyi ng work orders, only the Systems Li st is to be used.
AP-9 has been revised to reflect this method of classification.
- The staff review of QAI-10-6 revealed no discrepancies.
==
Conclusion:==
Based on the results of licensee and NRC review of work orders, except for the reactor trip breakers, there has been no apparent significant Salem Restart SER 27
.. ~
impact on safety from misclassifying work orders.
this issue resolved for restart.
Hence, the staff considers
- 4.
Post-Trip Review The licensee did not determine that there had been a failure to trip automa-tically on February 22 until the computer printout of the sequence of events was reevaluated on February 26, as a result of NRC inquiries.
Following previous trips in which one of the reactor trip breakers.malfunctioned (August 20, 1982 and January 6, 1983), the plant was restarted without deter-mining the cause of the* breaker malfunction (the failed breakers were replaced with others) or considering the generic implications of potential similar failures in the remaining trip breakers in both units.
Although the licensee conducted a review of each trip, there was no formal procedure for conducting a systematic review.
By letter dated March 1, 1983, the licensee made.a commit-ment to develop a post-trip and post-safety injection review proc~dur~. The pr.ocedure is to specify the review and documentation necessary to determine the cause of the event and whether equipment functioned as designed. Furthermore, the affected individuals who will be required, by procedure, to review the sequence of events computer printout and other event records will need to receive necessary training in the proper interpretation, understanding and evaluation of these records.
In his March 14, 1983 letter, the licensee provided Administrative Directive (AD) - 16, Revision 1 dated March 13, 1983 entitled 11 Post Reactor Trip/Safety Injection Review and Startup Approval Requirements".
AD-16 provides for a formal post trip and/or post safety injection review to be performed by the Senior Shift Supervisor and the STA qualified shift supervisor.
Specific areas to be reviewed and documented include:
(1) condition of the unit prior to the event, (2) personnel assignments, (3) evolutions in progress which could have contributed to the event, (4) major equipment, protection and control systems out of service or inoperable at the time of the event, (5) mode of event initiation (i.e., manual or automatic),
(6) sequence of events (SOE) computer printout and other alarm printouts, (7) control room recorder charts, (8) alarms received which were unusual for the event or other expected alarms which were not received, and (9) required corrective actions to be completed prior to startup.
The above information, as well as a narrative of the event, will be documented on Form AD-16-A,.and the SOE printout, recorder charts and other event records will be included with the report.
The procedure also requires the reviewer to document whether the first out annunciator agrees with the sequence of events.
Salem Restart SER 28
--~~-~-- - ----------
... :' ;. "-~ ~. \\-. -..
~
AD-16 also requires that if the cause of the event has not been clearly deter-mined or there is a question concerning the proper performance of equipment or systems during the event, an investigation will be.conducted and the results reviewed by the Station Operations Review Committee, whicn shall make recom-mendations to the General Manager - Salem Operations on reactor startup. This review should identify issues potentially generic to other safety equipment.
The staff has reviewed the licensee's post trip and post safety injection review procedure to determine that certain key elements have been adequately addressed.
The key elements reviewed include:
(1): that sufficient event review will be conducted to determine the cause of the event and whether equipment functioned as designed; (2) that necessary management authorization for restart is specified; (3) that debriefing of appropriate personnel is required to be conducted; (4) that reporting requirements are required to be completed; (5) that a followup review by safety committees is required to be. conducted; (6) that personnel conducting the review understand information provided by the event records.
Based on the information required to be provided on Form AD-16-A; the fact that two SRO licensed operations personnel (i.e. the senior shift supervisor and the STA qualified shift supervisor) are involved with the review, and the requirement for specific review and attachment of applicable event records (i.e. the SOE printout, control room recorder printouts, and the auxiliary alarm printout), the staff is satisified that AD-16 specifies a sufficently detailed review of an event to determine its cause and whether equipment functioned as designed.
With respect to management authorization for restart, the procedure specifies that the Operations Manager (OM) may authorize restart following a reactor trip or safety injection provided that (1) the post trip review* has been com-pleted, evaluated and reviewed with the OM, and (2) the evaluation clearly indicates the cause of the event and that all equipment and systems functioned as designed.
If the cause of the event has not been clearly determined or there is a question concerning the proper performance of equipment or systems, the procedure specifies.that an investigation be conducted and reviewed by the Station Operations Review Committee (SORC) prior to startup.
Restart following these more complex events will be decided by the General Manager - Salem Opera-tions only after receipt of SORC recommendations and after a determination that the unit can be restarted safely.
The staff questioned why restart determinations were not always e_levated to the \\
General Manager - Salem Operations since he is the individual who is responsible per Technical Specification 6.1.1) for overall facility operation.
The staff was informed that in all cases, the General Manager or Assistant General Manager will be kept informed of the circumstances of an event and would be able to redirect the Operations Manager's actions, if necessary.
Hence, although
- ~
- ~ -:v:........... *:*: :*.~.....
events, upper level management oversight will exist for all reactor trip and safety injection events.
~
The staff also noted that the procedure specifies that individuals authorized to assume the OM 1 s responsibilities may authorize startup if the OM is not available.
The staff was informed that the Operations Engineer (OE) period-ically assumes the OM 1 s duties when the OM is in training.
The staff has verified that the qualification requirements for the OE are the same as for the OM per Administrative Procedure -2, which references.ANSI-18.1, 1971.
Based on the above, the staff is satisified that the procedure specifies the appropriate management. authorization for restart following a reactor trip or safety injection.
With respect to debr{efing of appropriate personnel, the procedure specifies that fact finding sessions are conducted with appropriat~ personn~l to determine the cause of the event, actions taken and observed sequence of events.
The fa:t finding sessions will be conducted as part of the review, prior to restart.
The staff is satisfied that this element is adequately addressed.
With respect to reporting requirements, the procedure specifies that a deter-mination be made that the event was properly classified and that with respect to fo1iowup review by safety committees, provision is addressed in the procedure to have the onsite safety committee (SORC) review all reactor trips and safety*
injections.
As noted above, for those events where the cause is not clearly indicated or there is any question of the proper functioning of equipment, the SORC will review the event prior to restart.
For other events, the SORC will review the event but not necessarily before restart. Additionally, the Nuclear Support Department will also perform an independent review of each reactor trip/safety injection event for the purpose of determining corrective actions to prevent the type of event from reoccurring.
Also, the procedure specifies that the original event review report will be maintained on file for future reference.
Based on the above, the staff is satisifed that sufficient followup review of these events will be conducted.
\\*/ith respect to the review personnel understanding the information provided by the event records, the staff notes that the reviews ar.e conducted by SRO licensed personnel who are familiar with the various control room recorders and alarm printouts.
However, as evidenced by the recent ATWS events, these personnel were not as familiar with the information provided on the SOE printout (such as interpretation of the timing of the line entries).
The licensee has car.ducted training for Operations personnel on the SOE printouts for the February 22 and 25 events.
In the opinion of the staff, the training conducted is not sufficient to ensure that these individuals have a satisfactory understanding of other SOE printouts.
Additionally, operating personnel may not have a detailed understanding of expected response times of equipment.
The licensee has indicated his intention to reevaluate the format and information provided on the SOE printout to make it easier to understand and evaluate, and a~ other SOE printouts for reactor trips/ safety injections become available, to provide additional training for Operations personnel.
The staff agrees these additional measures are useful, but until they are implemented, the staff has requested and the licensee has committed to have an instrument and controls (I&C) supervisor who is knowledge-
, able on the SOE computer and understands expected equipment response times, Salem R~start SER 30
pers:~ally review SOE printoJts for for all reactor trips/safety injections pric~ :o restarting the plan:s.
Subsequently AD-16 was revised to reflect this com~':~ent and hence, the staff is satisifed that personnel conducting the revi~~s have a sufficient understanding of the event records.
Conc*usion:
Based on the staff 1 s review of the elements of licensee's post trir:; a:"ld post safety injecti:rn review procedures and for the reasons identified above, the staff concludes that the post trip review issue is resolved to perm't restart.
In addition, the staff will require that an I&C supervisor revie~ SOE printouts as discussed above.
- 5.
Tjmeliness of Event Notification On t~ree occasions between January 30 and February 25, 1983, the licensee noti~ied NRC of significant events belatedly.
In each case, the notificati~n was ~J~rcximately 30 minutes late.
Two of these reports were for the February 22 2nd :s ever.ts.
Furthermore, in the February 22 event, the first notification did ~~t contain knowri significant information regarding actuation of engineered safe:y features and opening of the power operated relief valves.
This addi-t~or.~l irfcrmation was provided approximately 40 minutes later.
The notifica-tion Jrocedures used by the :icensee warrant further evaluation as to the prio~ity assigned for NRC nc:ifi:ation.
The *;car.see in his March 14, 2933 letter, indicated that the importance of adhe~i:.g to the reporting requirements of 10 CFR 50.72 has been emphasized to all :~erating personnel.
The 1i:ensee 1 s emergency plan procedure EP-I-1, Atta:~~er.t 4, has been revised to rearrange the priority of notification to the.
NRC.
hdditionally, the emergency plan procedures have been revised to require
- desi;1ated personnel to immeciately start making the required notifications and read'~~ the initial co~tact ~essages upon classification cf the event.
The lice~see has also indicated that training on the revisions to the Emergency Plan Jroce~ures was conducted for personnel involved in implementation of.the Er.ier;2;.cy Plan.
Conc-jsion:
The NRC staff cons1cers the licensee's actions noted above to be suff':tent to ensure that the notification requirements of 10 CFR 50.72 will be met 'n t~e future.
The staf7 has also verified completion of the above noted trai~ing. This issue is considered resolved.
- 6.
J~dating Vendor Supplied Information As a result of the February 25.
- 1983 event and NRC IE Bull et in 83-01, the licersee indicated not being aware of the existence of two Westinghouse tech-nica*. service* bulletins that provided preventive maintenance recommendations for :1e reactor-trip circuit breakers.
The two documents in question were publ'shed by Westinghouse in 1974.
The licensee has requested and obtained docu;-er.tation for all Westinghcuse equipment and where necessary,*station docu;-ents will be revised to incorporate this information by July 1, 1983.
While we are not aware of any problems with other vendor documentation, an NRC staf: concern is whether a similar situation exists with respect to documentation for ether vendor-supplied in7crmation.
The *~censee in his March 14, March 23, and April 7, 1983 submittals committed to a ~Llltiphased program ~or vendor documentation consisting of a short term Sale-R~start SER 31
- .. *:. ~*.. *.
- .-~* ~.,
review for critical components in major safety related systems, issuance of procedures which will provide methods for controlling thii information, and a longer term program to identify and obtain documents for all equipment listed in the Q list.
The licensee has agreed to complete ali phases of this program by December 1983.
The short term program consists of identifying applicable vendor manuals for critical components in major safety systems including Auxiliary Feedwater, Control Air, Safety* Injection, Reactor Coolant, Containment Spray, Reactor Protection, Diesel Generator, Containment Isolation, Service Water, and others.
The scope of this program included critical valves, motors, pumps, instruments and control devices for these systems.
Licensee completed the audit phase of this program on March 24, 1983 and will ensure that latest known revisions are obtained from the vendor and indexed into the document control system by May 1, 1983.
Two hundred and thirty three components were reviewed for the appli-cable vendor manual and only three manuals were found missing.
The three manuals which could not be located were as follows:
(1) The manual for the Service Water Centrifugal Charging Pump Hydraulic Oil Cooler.
Discus-sion with licensee representatives identifies that no repair is normally per-formed on these coolers but rather, if a problem is identified, they are replaced; (2) Emergency Air Compressor Motor.
Maintenance on this motor is governed by a generic maintenance procedure, a technical manual for similar motor is onsite, and the subject motor requires little maintenance; (3) Fire Protection valve FP 10K77.
The licensee contacted the vendor and was informed that no technical manual exists.
The licensee has the detail drawing identi-fied by the valve manufacturer.
Hence it appears that there is no impact on maintenance activities due to lack of manuals for these three components.
The long term portion of the program will cover all safety related equipment included in the Master Equipment List.
Files will be audited by June 1, 1983, to identify manual existence and ascertain revision levels.
New manuals will be ordered by August 1, 1983 and formal indexing of latest known revisions into the document control system will be completed by December 1, 1983.
Administrative procedures will be issued by May 1, 1983 to control the vendor manuals and the procedures will have the following cri~ical elements:.
- 1.
Requirements that all vendor manuals (Q and non-Q) be incorporated under the Vendor Document Control System (PSBP).
- 2.
Revision of current PSBP system to provide for controlled, numbered copy issue of vendor manuals.
- 3.
Identification of vendors for Q-equipment who have manual updating programs, and periodic contact with these vendors to assure receipt of most recent applicable information.
- 4.
Review of manual revisions and new manual issues by Station user departments to ensure incorporation of applicable new information into applicable procedures.
- 5.
Review of vendor manuals by Nuclear Engineering to determine applicability to installed equipment.
Salem Re~t~rt SER 32
- 6.
- 7.
- 8.
0 J.
Periodic audit of controlled copy holder files to ensure existence of latest issues.
A Procedures regarding control of vendor manuals.
Identification of manuals to Q-listed equipment.
Annual contact with vendors of safety-related equipment to asertain the availability of the most recent applicable information.
I~ addition, interim directives have been issued which provide guidance on the use of vendor information including instructions for those cases where the information cannot be located.
==
Conclusion:==
Based on the satisfactory completion of the short term review, which identified no significant equipment for which proper vendor-documentation is not available, and the licensee's commitment to a long term program which will identify and control vendor information for all safety related equipment, the staff considers this issue resolved for restart.
The staff will formalize the licensee commitments as requirements and will follow licensee progress and review portior.s of the long term program as they are completed.
- 7.
Involvement of OA Personnel with Other Station Departments The Quality Assurance Department did not review maintenance work orders asso-ciated with repair of the reactor-trip circuit breakers in January 1983 because the work was not designated safety related.
Further examination determined that the QA Department does not review for proper determination of classi-fication the work orders designated nonsafety related by other departments.
Discussion with the licensee indicate that the QA Department has been somewhat isolated from the activities of other departments.
Although no action was required on this issue prior to restart, the licensee in his March 14, 1983 letter responded, delineating actions to be taken over the next several months to improve QA department i-nvolvement.
As a result of prior decisions, the licensee had initiated steps in January 1983 to relocate the QA Department from the corporate offices in Newark, New Jersey to ~he site and is taking steps to increase QA Department involvement in other station activities.
The corp.orate nuclear QA effort was reorganized effectiv.e January 3, 1983 to place the Operational Quality Assurance Organization into the Nuclear Depart-ment.
Those personnel assigned to this organization who formally worked in the corporat.e offices in Newark, New Jersey are in the process of being re-located to the site.
Most of the existing personnel in the site QA/QC organ-ization were absorbed into this new organization.
The purpose of this change was to provide for increased involvement by QA personnel in the d~y-to-day functioning of the Nuclear Department.
Such integration of all QA functions into the Nuclear Department is expected to lead to better interface with other plant personnel for problem discussion and resolution.
It will enable auditors to be more knowledgeable about operations as compared to the past when QA auditors were more likely to be 11generalists 11
- Audit plans are being changed to place more emphasis on system effectiveness (i.e., how it-is working?).
In Salem Restart SER 33 1*.:.
describing the objectives of this reorganization to NRC Region I in a January 4, 1983 meeting, PSE&G indicated that increased daily monitoring and overview were being emphasized for Operations QA personnel as a part of this reorgan-ization.
To better prepare for such increased involvement, it was indicated that in the future, some QA personnel would receive operator type training up to and including simulator training.
Since the February 1983 ATWS events, PSE&G has taken further steps to place greater emphasis on QA program implementation through intreased ob~ervation and monitoring.
By policy directive dated March 11, 1983, QA personnel have been instructed to* p*lace emphasis on adherence to procedures and review of engineering activities such as design changes, procurement control and work orders.
An ongoing comprehensive review of QA Program implementing procedures and any necessary changes is expected to be completed by August, 1983.
To emphasize the existing QA program requirements and recent procedural changes as a result of the ATWS events, an indoctrination/training program was conducted by PSE&G for appropriate personnel.
NRC review of the lesson plan for that training shows that it included discussions of Classification, Work Orders and Procurement.
Specifically included was use of the MEL system, criteria to be used in the determination of safety classification for proper classification of work orders and procurement documents, and interfaces with Nuclear Engineer-ing to resolve any classification questions.
Numerous personnel from all major*
station departments attended such training sessions as shown in attendance records reviewed by NRC.
NRC staff has verified that procedures have been changed to require QA to review and stamp all non-safety related work orders (for concurrence that l~
was properly classified) prior to implementation.
Administrative Procedure AP-9 (3/10/83) and Quality Assurance Instruction QAI 10-6 (3/11/83) were found to provide for QA review of station work orders and involvement in station maintenance work.
The licensee has committed to provide additional detailed training on initiation, processing and closeout of work orders to reemphasize QA and test/retest requirements involving interdepartmental coordination by September 1, 1983.
Such training will be monitored by Region I as a part of continuing on-si~e inspection coverage.
The licensee has committed to have an outside consultant organization perform an independent assessment of PSE&G's QA program and new organization as dis-cussed further under management issue C.9.
This assessment is to consist of a review of (1) the QA organizational structure and staffing, (2) the QA program
- content and procedures, and (3) the effectiveness of implementatton of those programs and procedures.
This review will, by its nature, include QA depart-ment involvement and integration into other plant activities.
By letter dated April 7, 1983, PSE&G agreed to prepare an action plan for implementing any appropriate changes by July 1, 1983.
NRC Region I will review this proposed plan.
==
Conclusion:==
In summary, NRC review of this area has verified that the licensee is accelerating previous plans to more fully involve QA personnel in the day-to-da~ operation of Salem 1 and 2.
Integration of QA personnel into activities covered by work orders such as modifications and maintenance will be required by recently revised procedures.
Reemphasis and retraining of appropriate Salem Restart SER 34
- -~
personnei on proper use of existing procurement procedures should assure proper future QA involvement in all procurement actions.
The sta.ff has determined that the licensee has recently taken appropriate steps to more fully integrate QA activities into overall Nuclear Department activities.
This issue is considered resolved for restart.
The implementation of this QA integration program will continue to be monitored over the long term in the Region I continuing inspection program, including the review of the ongoing diagnostic evaluation being conducted by an independent consultant (refer to C.9).
. 8.
Post-Maintenance Operability Testing Past practice at Salem for post maintenance operability testing has varied.
Such t'esting may be specified by the preparer of the maintenance work order or left to the discretion of maintenance personnel.
For safety-related equip-ment, post-maintenance surveillance testing is done before returning the equipment to service.
Additional functional post-maintenance and repair testing of equipment, such as surveillance testing, may need to be performed to demonstrate operability as an integral part of the larger component or system in which it must function.
This point is exemplified by the history of post maintenance testing of the Reactor Trip Breakers (RTB).
Following the placement of the 2A Reactor Trip Bypass Breaker (BYB) into the 28 RTB position on August 20, *1982, only a functional test of the undervoltage trip attachment (UTA) via the Solid State Protection System (SSPS) was performed and documented by a comoleted surveillance test.
The breaker was not shunt trip tested.
Following the exchange of the lA RTB into the 2A RTB position on January 6, 1983, the licensee states that the RTB was independently shunt and UV trip tested, however, except for a notation on the Work Order no documentation of this testing exists.
Following substitution of the lB BYB into the lB RTB position on February 22, 1983, the licensee states that only a manual trip test was performed.
This test operates both the UV an d shunt trips, but does not discriminate as to which functioned to trip the breaker.
It was further noted that the UV trip function of bypass breakers.was never routi~ely tested.
To resolve this issue, the NRC required the licensee as a long term action to review and revise procedures and practices as necessary to ensure that functional testing of the overall components or system is performed to demonstrate opera-bility prior to returning the equipment to service following maintenance and repair. Additionally, NRC required that as a long term action, procedures be revised, as necessary, to assure that operations department personnel review the testing prior to returning such equipment to service.
Although no short term action was required for this issue, the licensee has responded in his March 14, and April 7, 1983 letters indicating that Operations, Maintenance and Technical Department (I&C) procedures have been revised to increase. e~phasis on quality assurance and interdepartmental communications in performing post maintenance operability testing.
Operations Directive OD-10, 11 Removal and Return of Safety Related Equipment to an Operable Status 11, has been revised to require conduct of Technical Specification requir~d surveillance testing, inservice testing or system functional testing as appropriate prior to declaring major safety related equipment operable.
The Maintenance Department has formalized a Maintenance Department Testing manual to enhance determination of test and retest requirements prior to issuance of a work order.
The manual provides cross reference listings of Salem Restart SER 35
safety related and other Q list systems and components with applicable main-tenance and surveillance procedures which specify test and retest requirements.
Procedure A-21 has been written to require maintenance supervisors.to consult th1s manual for test and retest requirements prior to work order issuance.
The testing manual appears to be comprehensive with respect to safety related valves and other major mechanical equipment and the licensee has indicated that an electrical equipment section will be incorporated as a long term action.
In the Technical Department, Instrument and Controls Procedure PD 14.1.001, which is a generil equipment troubleshooting and repair procedure, has been revised to ensur~ completion and documentation of test and retest requirements on safety related instrumentation.
NRC staff review of these procedures reveals some discrepancies which the licensee has agreed to evaluate and correct, as necessary.
The licensee will also revise AP-9, 11 Control of Station Maintenance 11 to ensure standardization of post maintenance operability testing throughout the station.
Licensee has committed to complete all procedural revisions associated with this issue by July 1, 1983.
These procedures appear to provide the necessary administrative controls to ensure proper verification of system operability following mainte-nance.
An examination of a few work orders showed that retest requirements were explicitly specified.
The licensee has committed to conduct a review of vendor and engineering recom-mendations and current testing procedures.
The licensee has indicated that this review will involve a comprehensive review of maintenance and testing procedures to ensure testing required by these procedures is in accordance with vendor and engineering recommendations.
Based on this review, changes will be incorporated into departmental documents by January 1, 1984.-
...... : ; _ '.*.-.:*.. ~ ~--. ~ *-~*.**.
==
Conclusion:==
Based on the staff's review, the licensee's short term effort of strengthening administrative controls over post maintenance operability testing, combined with the longer term program of updating the testing manual and conducting a comprehensive maintenance and testing procedure review, constitute acceptable actions in response to this issue.
Hence, this issue is considered resolved for restart.
The staff will formalize the requirements for completion of licensee's long term program.
On a periodic basis, the NRC staff will inspect the implementation of licensee's post maintenance operability testing to ensure component and system operability after maintenance is verified.
- c.9 Overall Management Capability and Performance The initial deficiencies identified during the review of circumstances sur-rounding these events raised questions about the responsiveness, practices and capability of licensee management at the corporate and station level.
As noted in the preceeding section (C.l through C.8), a number of specific manage-ment issues directly related to the failure of the reactor trip breaker event were identified and have been evaluated.
Although each of the specific pro-blems is understood and has been resolved, it is necessary to consider the overall management capability and performance in a broader context.
The staff has re-examined the performance of PSE&G over the last few years from a regula-tory prespective.
Salem Restart SER 36
.. '";'~.
On the one hand, there are several good aspects of the licensee's efforts that are beneficial and are indicative of a licensee that is st.riving to develop thoroughly satisfactory practices.
Some examples include:
a computerized tagging program, independent verification program for system lineups, miniaturized control room design, and a computer scheduling system for surveillance testing and maintenance.
Our examination generally concludes that the licensee has devoted resources and developed noteworthy programs to support operatio~ of the Salem facility.
Historically, however, PSE&G management has not displayed the expected aggressive effort to self evaluate and redirect efforts to correct internally identified problems.
However, the licensee has responded to the specific evaluations conducted by external organizations such as INPO, NRC and consultants.
The 1981 INPO evaluation identified opportunities for improvement *in ~umerous areas including staffing, personnel safety practices, adherence to procedures, control of documents and design changes, availability of technical support, operating practices with respect to inoperable alarms and tagouts, shift turnover procedures, and goals and objectives.
Based on continuing observa-tion, the licensee responded positively to selected findings by various actions, although the effectiveness of these actions has been iess than expected.
Four SALP assessments were conducted by the NRC during the period October 1980-0ctober 1982.
The earlier assessments identified weaknesses in the areas of: design change documentation, engineering support responsiveness, health physics, physical security and overall management followup in numerous areas.
The later SALP assessments acknowledge licensee management attention to, and improvements in the areas of design change tracking and documentation and health physics.
Physical security, despite several initiatives on the part of the licensee to improve the area, continued to be weak.
Very recently, the licensee has dedicated considerable resources to physical security which, if properly implemented, should facilitate a number of hardware improvements and add several managers to the organization to more e*ffectively monitor security activities on a day-to-day basis.
The most visible licensee initiatives are organizational.
During the licensing process for Salem Unit 2 in 1981, the licensee made a decision to place all activities, including engineering under a single vice president.
Commitments were made to relocate these activities from the corporate offices in Newark, New Jersey to the site located in southern New Jersey.
While the licensee was hopeful that such relocation of the engineering staff, including QA personnel, to the site would prove more effective, the process has moved much more slowly than hoped arid has resulted in the loss of certain personnel.
In January 1983, the QA department was placed in the Nuclear Department, and began moving to the site.
The organizational and location changes have been in transition for almost 18 months.
The maintenance, operations and technical departments are led by experienced middle managers.
Operational management controls have been progressively strengthened over the past few years and have addressed problems as they are identified. Similarly, maintenance department controls have improved and new Salem Restart SER 37
.... ',.. ~. -:
- ~-".". -.*:*::.
initiatives have been instituted for the conduct and planning of maintenance which recently has resulted in more comprehensive review ef proposed maintenance activities.
In addition, the licensee has reduced the bargaining unit employee to supervisor ratio to 10 to 1 in order to improve direct supervision of work in progress.
However, the support groups, in particular maintenance and engineering, tend to be too isolated from one another and, therefore, their collective efforts are not well integrated in overall station operation.
In the staff's view this has resulted in a degree of parochialism.
Consequently, the staff's perception is t~at poor communications among the various departments has hindered the development of a sensitivity within the station staff to identify and resolve problems that are outside their direct sphere of influence.
Over the past two years durng which Public SErvice Electric and Gas Company (PSE&G) has operated two nuclear plants at the Salem Generating Station, it has developed imoroved programs and procedures that are consistent with industry standards.
This observation is based on an overall review of NRC inspection reports and taking cognizance cf INPO evaluations.
Notwithstanding such progress, the staff has noted in its SALP reviews that the licensee needs to devote more effort to take steps to make such programs work.
A problem which had previously been addressed with the licensee during enforcement corferences and SALP results meetings and has been noted during this evalutaion, is one of high level station management and first line station supervision failing to adequately assess the performance of their subordinates, especially with respect to adherence to procedures.
Historically, improper performance or violation of station procedures did not result in any adverse actions to the involved individuals.
Generally, it has been observed that poor performance was mildly critized, then rationalized.
Also, first line supervisors appear to refrain from raising issues outside of their defined scope of responsibility and their effectiveness is seldom monitored.
As a result, department managers may not be cognizant of problems requiring their attention.
The licensee has now initiated a training program for first-line supervisors which will include supervisory skills, procedures, programs, quality assurance and systems training.
The program will include a discussion of corrective discipline actions available.
The trianing program will be completed for new supervisors prior to assignment and will be provided to all existing supervisors.
The program is expected to start in September 1983.
A similar training program for senior supervisors is to be developed by October 1983.
- When balancing the various aspects with the issues identified herein, it is clear that some problems remain.
One of the purposes of the staff examination was to ascertain wh~ther there were major flaws in the licensee 1 s approach.
During the fact-finding team review during the first week of March 1983 and concurrent analysis of the breaker failure events, licensee treatment of the reactor trip breakers and the circumstances surrounding their failure on February 22 and 25, provided the NRC staff with several indicators suggesting a major breakdown in management and quality assurance program implementation at the Salem Nuclear Generating Station.
Subsequent detailed reviews and evalua-tions by the licensee and the NRC staff have confirmed that the programs in place are basically sound.
Two aspects of these programs surfaced as the Salem Restart SER 38
""*?.,.
principal causes of the events discussed in this safety evaluation.
The first of these was a perceived lack of resolve on the part of ma~agers and supervisors in enforcing adherence to procedures by station personnel.
The second aspect relates to the safety perspective displayed by corporate management in pro-viding policy direction and priorities to the operating staff and the three existing review committees.
It is clear that the nume~ous initiatives undertaken by PSE&G during the last few years have not yet been fully implemented.
In order to assist PSE&G in making the transition successful and to further analyze their difficulties, an independent consultant firm, Management Analysis Company (MAC) has been retain.ed to perform a diagnostic evaluation of both the Quality Assurance Program and the licensee's overall nuclear management program.
The MAC approach relies on interviews and team evaluations to identify causes of management problems.
Its process has been observed at other facilities and has been found to be useful.
Rather than presume an understanding of the nature of a problem, the MAC diagnostic examines the many aspects of a utility, including the following:
organization, management controls, staffing levels and capabilities, training and retraining, intra and inter-departmental communi-cation, commitment controls, station generation, engineering configuration management, Q~list, nuclear operations support and organizational freedom in problem identification and resolution.
Based on such reviews, the MAC evalua-tion focuses on underlying problem areas and recommendati~ns are provided for resolving them.
PSE&G has committed to develop an action plan which addresses these recommendations.
NRC staff will monitor the MAC and PSE&G effort.
Meetings will be held with MAC and PSE&G to review the results of the evalua-tion, the development of an action plan and subsequent meetings with PSE&G will be held on a periodic basis to monitor implementation of the action plan.
The MAC assessment is expected to be completed by May 2, 1983.
In the interim, PSE&G has also retained the services of experienced and quali-fied individuals from the BETA Company to examine the steps taken to date in preparation for restart of Salem Unit 1.
This independent evaluation should provide an additional level of assurance to PSE&G as to the adequacy and completeness of the steps taken to resolve the problems associated with the two ATWS events.
The staff will review the results of this overview, along with resolution of any other identified issues, prior to allowing restart.
The licensee has also committed to establish on a one year trial basis an independent Nuclear Oversight Committee comprised of 3 to 5 members, including nuclear utility operations executives, college professors and former regulators.
This committee will meet at least quarterly and will provide reports to the Vice President Nuclear evaluating overall management attention to nuclear safety and reporting on progress in resolving open issues relating to NRC commitments and independent evaluations.
Consequently, the initiatives taken by the licensee will be monitored by an independent group to assure the safety-related problems are identified to the corporate managers.
The NRC will also review the quarterly reports of the Nuclear Oversignt Committee.
==
Conclusion:==
The management initiatives and improvements described should considerably strengthen exisiting programs, should add a number of additional Salem Restart SER
--~
39
- .*.,.. ". **- *. *--.:***--.:*\\'
.... ~ -~~.....
~-**:**_j
reviews of corporate and station management effectiveness, and will provide for independent assessments of management.
No evidence suggests that the organizational structure or programs currently defined contributed to the problems identified in this evaluation.
The source of the problems appears to be a lack of aggressive implementation of those programs.
The collective steps described above are expected to result in an increased awareness on the part of managers and supervisors as to the status of implementation of the many programs and allow more timely involvement to either provide redirection, priority or resources to resolve problems.
Accordingly, 'managemerit programs in place, as modified by the steps described above, are acceptable to support continued ope~ation of both Salem units.
III. Overall Conclusions Section A of this Safety Evaluation Report discussed and evaluated the NRC staff concerns in the areas of maintenance procedures, verification testing, and surveillance testing programs.
The licensee has acceptably revised his maintenance procedures, revised and expanded his surveillance testing programs, provided an adequate verification testing program, and will submit proposed Technica1 Specification changes for incorporating NRC notification requirements for maintenance testing results that exceed acceptance criteria and for measured trip forces that exceed recommended upper limit.
The licensee will also submit proposed Technical Specifications that incorporate the additional surveillance requirements identified by the staff, for the reactor trip and bypass breakers.
Section 8 addressed staff concerns in the areas of plant operations, operator procedures, training~ and operator response, the licensee has acceptably identified reliable control room indicators that provide positive indication of automatic reactor trip demand, without operator analysis or verification, and has revised procedures to direct the operators to insert a manual trip whenever positive indication of an automatic reactor trip demand is present, without delay to evaluate the plant status.
The licensee has also acceptably completed training actions and commitments in the areas of training on proce-dures, training utilizing the Reactor Protection System, and the administration of this training.
As such, the licensee 1s ATWS training program for licensed operators and for auxiliary operators is now acceptable.
Section C addressed staff concerns in various management areas.* These manage-ment areas were Master Equipment List, procurement procedures, work order pro-cedures post trip review, timeliness of event notification, updating vendor
- supplied information, involvement of QA personnel with other* station depart-ments, post maintenance operability testing, and overall management capability and performance.
~he licensee has acceptably revised his procedures and con-ducted acceptable training to ensure that work orders and procurement documents will be properly classified in the future.
The licensee has conducted an acceptable review of past procurement documents and work orders to verify that the misclassification problem associated with the reactor trip breakers was an isolated incident.
Additionally, the licensee has developed an acceptable post trip review procedure to ensure a systematic and comprehensive review of reactor-trips is conducted prior to returning to operation.
Finally, the licensee has instituted an acceptable program involving both outside consultants and addi-tional corporate safety committees to further evaluate and upgrade the effective-ness and safety of the licensee 1 s nuclear activities.
Salem Restart SER 40
- 1-:--**..
~- ~*.'*:*..........
..~-:
,,,,,~i,~
The above actions provide reasonable assurance regarding maintenance and surveillance, plant operations and operator actions, and new programs in various areas of the utilities management, for restart of the facility.
Salem Restart SER 41
,..,.--,------,,--,---,-,-..,---.~--~-----c---------- --
.-'-.~..
APPENDIX A Description of Reactor Trip Circuit Breaker The Reactor Trip System at the Salem p1ant consists of plant process instru-mentation (sensors, transmitters, and bistab1es) that moriitors various p1ant parameters.
Typica1ly, there are four redundant instrument channels per para-meter.
The outputs of these instrument channels are used as inputs to each of two redundant trains of logic circuitry (Solid State Protection System - SSPS, trains 11A 11 and 118 11 ).
The output of each SSPS train maintains two undervo1tage coils in an energized condition, one for its associated reactor trip breaker and one for the bypass breaker in parallel with the other reactor trip breaker.
When the logic of one SSPS train is satisfied, this typically requires that two out of the four instrument channels for a given parameter be in the tripped state (i.e., the parameter has exceeded its setpoint), power is automatica1ly interrupted to the two undervoltage coils associated with that train.
This automatically opens the two associated breakers.
The bypass breakers are normally open (racked-out) and are only closed during testing.
When either of the two series reactor trip breakers opens, power provided from the motor-generator (MG) sets to the control rod drive latching mechanisms is inter-rupted, causing all control rods to fall, by gravity, into the core.
Manual reactor trip capability is provided by two switches on the main control board in the control room.
Each switch, when actuated, will interrupt power to all undervoltage coi1s (for both reactor trip bre~kers and their associated bypass breakers), and simu1taneously energize all shunt trip devices for these breakers.
Thus, diverse means (undervoltage trip devices and shunt trip *devices) are used to open the reactor trip breakers on a manual reactor trip signal whereas only the undervoltage trip coils are actuated on an automatic reactor trip signal from the SSPS.
Circuit breakers (such as the types used in Reactor Trip Systems) are c1osed against a strong spring force and 111atched 11 in the closed position. Opening (or tripping) i*s accomplished by releasing the latch mechanism and allowing the springs to rapidly force the breaker contacts apart, thereby interrupting the current through the contacts.
The latch can be released by either a mechanical linkage or by one or more electro-mechanical devices.
The electro-mechanical trip device is actuated electrically.
The Reactor Trip Systems open (or trip)
- the circuit breakers used to supp1y power to the contro1 rods through e1ectro-mechanical circuit breaker trip devices.
Two particular types of electro-mechanical circuit breaker trip devices are of interest in relation to the Salem *events.
These a-re undervoltage trip devices and shunt trip devices.
A circuit breaker undervoltage trip device is energized during normal p1ant operations, when it is intended that the circuit breaker be closed or remain closed.
De-energizing the undervoltage trip device results in the circuit breaker opening or tripping.
The undervoltage trip device consists of an Salem Restart SER 1.
- . -... -*' '.~. :-*.
- ~ -.. * -.
electro-magnet which, when energized, attracts a metal rod, plunger, or lever against the force of a spring.
The ~etal rod, plunger, o~ lever is connected through a mechanical linkage to the circuit breaker latch mechanism (trip bar).
When the undervoltage trip device electro-magnet is de-energized, spring force releases the latch mechanism and the circuit breaker opens or trips.
A circuit breaker shunt trip device is de-energized during normal plant opera-tions, when it is intended that the circuit breaker be closed or remain closed.
Energizing the shunt trip device results in the circuit breaker opening or tripping.
The shunt trip device consists of an electromagnet which, when energized, attracts a metal rod, plunger, or lever and through a mechanical linkag releases the circuit breaker iatch mechanism.
Releasing the latch mechanism results in opening or trip~ing of the circuit breaker.
The shunt trip devices are somewhat simpler mechanically and have.more force margin for actuating circuit breaker trip than do undervoltage trip devices.
This is the case because undervo1tage trip devices are energized for lengthy periods of time and, therefore, heat dissipation considerations limit the design flexibility for obtaining hig~ device forces.
There is somewhat more flexibility in the design of the shuiit trip devices since they are energized for only the short period of time required to release the circuit breaker latch mechanism.
Heat dissipation considerations are less important in the design and operation of the shunt trip devices.
Salem Restart SER 2
.* :.*_:2