ML20134Q172

Insp Repts 50-327/96-13 & 50-328/96-13 on 960919-1102. Violations Noted.Major Areas Inspected:Events Associated W/Reactor Shutdown & Subsequent Manual Tripping of Unit 2 on 961011

ML20134Q172
Person / Time
Site:	Sequoyah
Issue date:	11/25/1996
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II)
To:
Shared Package
ML20134Q121	List: ML20134Q119 ML20134Q172
References
50-327-96-13, 50-328-96-13, NUDOCS 9612020167
Download: ML20134Q172 (30)

See also: IR 05000327/1996013

Text

.. . - -.- . .-. - - . - . . . . ..

'

.

4

.

. .

I

l

'

U.S. NUCLEAR REGULATORY COMISSION

REGION II

Docket Nos: 50-327, 50 328

License Nos: DPR-77. DPR 79

Report Nos: 50 327/96 13, 50-328/96 13

Licensee: Tennessee Valley Authority-(TVA)

Facility: Sequoyah Nuclear Plant, Unit 1 & 2

Location: Sequoyah Access Road

Hamilton County TN 37379

Dates: September 19 through November 2, 1996 l

Inspectors: M. Shannon, Senior Resident Inspector

D. Starkey, Resident Inspector

P. Kellogg, Reactor Inspector, RII

!

Approved by: M. Lesser. Chief I

Projects Branch 6

'

Division of Reactor Projects  ;

!

l

,

j

!

Enclosure 1

9612O20167 961125

PDR ADOCK 05000327  !

G PDR

.. -. - - . ~ . . . - _ - _ _ - . - - . - _ . . . .

.

$. -

j

1 i

EXECUTIVE SUMMARY -

'

Sequoyah Nuclear Plant, Units 1 & 2 i

-

NRC Inspection Report 50 327, 328/96 13  ;

. l

f ,

This special inspection was conducted to review the events associated with the i

reactor shutdown and subsequent manual tripping of Unit 2 on October.11,1996.  ;

Equipment failures and/or complications included excessive reactor coolant

pump seal leakage which caused the need for an immediate reactor shutdown; a -

, turbine runback due to failed turbine impulse pressure switches, which caused

i the need for a manual reactor trip; a failed main feedwater isolation valve to

I close: inadequate auxiliary feedwater control; and a water hammer in the steam

dump system which caused damage to piping and hangers.

'

-

In addition, this special inspection was conducted to review issues associated

with inadequate maintenance on a reactor trip breaker (RTB) and the subsequent

'

replacement of the Unit 2 RTB "B" with the spare breaker. The P 4 function

was found to have been inoperable greater than allowed by Technical i

i Specifications.

The following apparent violations and findings are associated with the  ;

October 11 reactor trip event

j

.

e An apparent violation was identified for the failure to identify the I

cause of the main feedwater isolation valve (MFIV) motor brake failures 1

and to take adequate corrective actions for the water intrusion into the )

brake assembly. A weakness was identified in the licensee's repeat i

failure tracking / trending programs associated with Work Requests (WR)

and Problem Evaluation Reports (PER) to identify repeat MFIV equipment

failures.

.

e An apparent violation was identified for the failure to take adequate

corrective actions to prevent further flexible conduit damage on the

MFIVs.

,

e An apparent violation was identified for % lure to implement corrective

i actions related to previously identifies A ficiencies related to ASCO

solenoid valves. I

• An apparent violation was identified for the failure to implement

adequate corrective actions associated with the fire system actuation in

June 1996.

< e A positive observation was made in that the shift manager provided good

oversight for the unit 2 downpower and appropriately ordered the

tripping of the unit when the unanticipated turbine runback occurred. 1

0)erator performance was good in controlling the event and responding to I

,

.

t1e abnormal plant conditions during the event.

l e A positive observation was identified in that the operators  ;

'

4 appropriately isolated the auxiliary feedwater (AFW) system to prevent  !

!

j  !

- . . . .-- . - - - - . - - - - -.. . - . --- _.

.

.' l

,

-

..

2 <

an uncontrolled cooldown of the reactor coolant system (RCS). This

required timely management approval due to lacking procedural guidance

in the emergency operating procedures. i

e A weakness was identified following a water hammer event that severely

damaged the piping su) ports and cracked the steam dump to main steam

line weld in the disc 1arge line for SD 111. There have been previous

piping support damage events associated with the steam dump system and i

the licensee had not identified the root cause.

e A weakness was identified in that the licensee failed to identify the 'l

malfunctioning steam dump drain tank level switch, causing the steam

dump lines to not drain properly. The operator rounds sheet lacked '

adequate guidance regarding the steam dump drain tank level controls. l

e- A weakness was identified in that the assistant unit operators failed to 1

identify the damaged piping supports following the reactor trip (8.5 i

hours), although required to monitor the steam dump valves once per '

shift, in addition to normal roving tours of the building.  ;

e A negative observation was made concerning the water intrusion into a

single zone actuation fire detector, which resulted in the July 1996,

deluge actuation.

e A weakness in the licensee's training program was identified in that the

operators lacked knowledge in the functioning of the turbine impulse

pressure switch circuitry,

e A negative observation was identified concerning the failure of two non-

safety related and non independent switches, which resulted in the

inability of operators to reset an AFW actuation signal.

e A weakness was identified for the maintenance practice of using RTV

sealant, which could result in acetic acid intrusion into the brake

assembly, which in turn could cause damage to the MFIV brake assembly.

• A negative observation was made in that the motor to brake assembly

gasket was missing.

e A negative observation was noted regarding a poor maintenance practice

which permitted a dust cover to be left in the exhaust port of a

solenoid valve followirg maintenance activities.

o A negative observation was made due to the improper setting of the air

supply regulator for the reactor coolant pump (RCP) seal leakoff

isolation valve.

e A negative observation was made concerning the wrong instruments being

referenced in an abnormal procedure.

I

.

4

.

..

3

The following apparent violations and findings are associated with the

inoperable P 4 function due to reactor trip breaker maintenance.

e' An a> parent violation was identified when an inoperable reactor trip

brea(er was in service for greater than the time allowed in the

Technical Specification (TS) Limiting Condition for Operation (LCO).

e An apparent violation was identified when reactor trip breaker

maintenance )rocedure sections were performed out of secuence. A second

example of t1is apparent violation was identified regarcing the

maintenance procedure which did not provide cautions or adequate

instructions regarding the reassembly of the reactor trip breaker

auxiliary contact linkage assembly following lubrication.

e An ap)arent violation was identified for failure to perform an

opera)ility/reportability determination as required by SSP-3.4. The

lack of action by the event critique team and technical su) port

personnel to report the inoperability of the reactor trip areaker led to

this problems.

e A weakness was identified in the thoroughness of the root cause

determination process regarding the reactor trip breaker event critique.

e A positive observation was identified when o)erations stressed the need

to remove a potentially faulty reactor trip areaker (RTB) from service

and in not allowing troubleshooting of the breaker while still in ,

service. 2

e A negative observation was noted when maintenance failed to ensure that

Quality Control (QC) personnel would be available as necessary during a I

reactor trip breaker refurbishment. l

e A negative observation was identified when engineering " dummied" a

signal to a computer alarm circuit prior to determining the cause for

the signal.

!

l

!

,

.

~

.

.

l

..

,

t

Report Details j

I. Beactor Trio of October 11. 1996

l

A. Ooerational Asoects

1. Insoection Scoce (71707)

On October 11, 1996 at 8:27 a.m., due to a turbine runback, Unit 2 was

manually tripped. Several problems were encountered prior to and during

recovery efforts. The inspector observed the unit shutdown, reactor i

trip, unit cooldown, and placing of RCS on shutdown cooling.

'

2. Observations and Findinas

On October 11, 1996, at 3:12 a.m., Unit 2 experienced a higher than

norm 61 seal leakoff on the #4 RCP seal #2 of approximately 1.5 gpm. The

seal leakoff for the #1 seal drop)ed to .6 gpm (normally 3.0 gpm).

Plant shutdown is required, per a) normal operating procedure, within 8

hours when #2 seal leakoff exceeds .5 gpm. A controlled plant shutdown

was initiated at 5:22 a.m. At 8:24 a.m., the ICS computers both failed:

however, this appeared to only affect computer data points and recorder

inputs. Power was reduced to approximately 50% and one operating

feedpump was stopped. At this point, a main turbine runback

automatically initiated at 200% per minute, all unisolated main steam

dum)s went open as designed, and rod control began inserting rods at a

hig1 rate. The Shift Manager directed that the reactor be manually

tripped.

Following the trip, operators had some difficulty controlling cooldown.

The RCS reached the low Tave setpoint (550 degrees F) and the feedwater

isolation signal was actuated. The #3 feedwater regulating valve

indicated in the mid position (limit switch problem only) and the #4

feedwater isolation valve failed "open" and its MCR indication was lost.

During the unit trip recovery procedure steps, the operators attempted

to take manual control of the AFW pump flow control valves, but were

unable to reset the AFW actuation signal. A decision, by the Operations

Manager, Operations Superintendent, Shift Manager and Unit Supervisor,

was made to place the motor driven AFW pumps in pull-to lock and to

close the isolation valves on the turbine driven AFW pump. Tave dropped

to approximately 538 degrees F and the low-low Tave setpoint (540

.

.

,

l

2 I

f

degreesF)wasreachedwhichlockedoutthe3+eamdumps. In addition,

the operators were required by procedure to' hitiate emergency boration

due to being below 540 degrees F. Steamgentatorlevelswere

maintained as required and approximately 450V gallons of borated water

'

was injected into the RCS during the eveat. L

A controlled cooldown of the RCS commenced at'epproximately 4:15 p.m. on

October 11. Initially, operators had trouble controlling the cooldown

rate due to s)oradic operation of steam dump valve SD 111. Steam dump

valve 50-111 lad to be isolated and cooldown of the RCS was successfully

continued. Mode 4 was entered at 8:58 p.m., and RHR was placed in the

shutdown cooling mode at approximately 12:16 a.m., on October 12.

The inspectors observed operator actions during the controlled shutdown,

the trip, the cooldown and while placing RHR in service. The operators

performed well with appropriate supervisory oversight by shift

management and site management. Routine status briefings were held,

which the inspectors considered to be beneficial to the control room

staff and for the control of the event and the event related activities.

The various equipment problems resulted in challenges to the operators.

These individual equipment problems are discussed in the following

sections of this report.

3. Conclusions

0)erator performance was good in controlling the event and responding to

tie abnormal plant conditions. The Shift Manager provided good

oversight for the Unit 2 downpower and appropriately ordered the

tri) ping of the unit (within 10 seconds) when the unantici)ated turbine

runaack occurred. These are considered to be a positive o)servations.

There were several equipment failures that complicated operator recovery

actions which indicate continued plant equipment reliability problems, ,

for both safety related and non-safety related equipment.

B. Steam Dumo Water Hammer Damaae

1. Insoection Scooe (71707. 62707. and 37551)

When operators attempted to start the RCS cooldown, operation of the

steam dump valve was erratic and resulted in a higher than desired

cooldown rate or no cooldown rate at all. The affected steam dump valve

was isolated and cooldown proceeded with no further problems. The

inspector reviewed the operation of the steam dump valves during the

event and walked down the steam dump system.

2. Observations and Findinas

During the turbine runback, the inspector observed that all of the steam

dump valves opened (indicator lights in MCR). There were no indications

in the control room or reports from the turbine building to indicate

. . . .. ._ . . __ _ , .

.

!

'. .

3

that the steam dumps were not operating properly. Later in the day,

when the operators went to the " pressure mode" of steam dump operation,

steam dump 50 111 exhibited erratic operation and after a couple of

attempts, the operators stopped using the affected steam dump. Cooldown

of the RCS was then continued by using two other steam dumps in the

" pressure mode." Following plant cooldown, 50-111 was found to have a >

broken feedback arm, which apparently caused the erratic action during

the initial cooldown. It could not be determined how the feedback arm

became broken.

Reports from the turbine building indicated piping damage and support

damage associated with SD 111. The inspector walked down the steam dump

system and noted significant misalignment of the SD 111 piping and

severe damage to the piping supports. During the walkdown, the

inspector also noted minor water hammer (noise with no pipe movement)

occurring on three isolated steam dump lines, which indicated that the

lines were partially full of water. Additional inspections by the

licensee noted crack indications on the outside diameter of the main

steam line weld to the steam dump transition pi)ing. The crack

indications were at the 12 o' clock and 6 o'cloc( positions and measured

approximately 17/8 inch long by 1/2 deep and 7/8 inch long by 1/2 inch

deep respectively. The main steam line piping thickness is nominally 1- ,

'

1/4 inches thick and did not have any reported through wall leakage.

During subsequent review, the licensee identified a failed level switch

on the steam dump drain tank. The failed switch prevented the tank from

draining and due to the common SD drain piping system arrangement,

potentially all of the steam dump exhaust lines to the condenser were

partially full of water prior to the event. There had been leakage

past four of the steam dump valves, SD 103, 50104, 50-105 and SD 109,

since the last outage and two valves had been isolated (SD 103 and SD-

104) due to more significant leakage. These conditions would have

provided a sufficient amount of water to partially fill all of the steam

dump exhaust lines.

Further review noted a history of prior system structural and component i

problems. The piping supports for 50-107 were damaged during a previous j

event in 1993. During a recent walkdown of the steam dump system, the '

inspectors had noted that 50-103 had a broken support strut. A work i

request had been written. In addition, following disassembly of SD 103,

the licensee found that the valve had a broken valve stem and the stem

shield plate was cracked and a piece of the shield plate was missing.

The 50 107 support damage, the 50-103 broken strut, and the damage SD-

103 valve internals and stem, appeared to be indicators of system

operational problems and/or previous water hammer events.

The operator rounds sheet directed the operator to inspect various steam

lines and moisture traps associated with the steam dump system but did

not require the assistant unit operators to take routine readings on the

steam dump drain tank level. Routine readings on this tank could have

identified the failure of the level switch. i

.'

". .

4

The inspector also noted that the damaged SD 111 su) ports were not

identified until 5:00 p.m., on October 11. The run)ack and subsequent

reactor trip took place at 8:30 a.m. at which time the rapid opening of

the steam dumps took place and the damage to the piping supports was

thought to have occurred. However, the roving assistant unit operators

did not identify the damaged system, although required to verify

operability of the steam dump valves once per shift.

Following the event the licensee repaired the cracked main steam line,

replaced the damaged steam dump piping and supports, repaired the

leaking steam dump valves and repaired the faulted steam dump tank level

switch. In addition, the licensee performed inspections of the unit 1

and Unit 2 steam dump lines and the Unit 1 steam dump drain tank and its

operation and did not identify any additional problems. The licensee

has also inspected the main condenser internals for damage with no

problems identified.

1

In addition to the apparent water hammer damage to the steam dump

)iping, during the event, the plant manager observed secondary water j

lammer indications, with various reliefs lifting and directed that the <

turbine building be evacuated of non essential personnel.

3. Conclusions

The licensee failed to identify the malfunctioning steam dump drain tank

level switch, which resulted in the steam dump lines not draining

properly. The operator rounds sheet lacked adequate guidance regarding

the steam dump drain tank level controls and is considered to be a

.

'

weakness.

Assistant unit operators failed to identify the damaged piping supports i

following the reactor trip (8.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />), although required to monitor the

steam dump valves once per shift, in addition to normal roving tours of

the building. This is considered to be a weakness.

A water hammer event, in the discharge line for 50 111. severely damaged

the pi)ing supports and cracked the steam dump to main steam line weld.

There lave been previous piping support damage events associated with

the steam dump system. The failure to identify and correct the cause is

considered to be a weakness.

C. tiain Feedwater Isolation Valve Failure

1. Insoection Scooe (62707. 40500. and 37551)

Following the reactor trip, the low Tave (550 degrees F) setpoint was

reached and a feedwater isolation signal was generated. Following the

actuation, the operators noted that the main feedwater isolation valve

(2-MV0P-003-0100-B) for steam generator 4 had lost position indication.

The inspector reviewed the equipment problems related to the failure of

the main feedwater isolation valve to close.

- . _ . _ _

.

.

.

I

,

5

2. Observations and Findinas j

t

The feedwater isolation signal automatically initiated as expected on a

normal reactor trip. The remaining feedwater pump was tripped, the

feedwater regulating valves automatically closed and three of the four

main feedwater isolation valves closed. The number three main

.

feedwater regulating valve experienced a limit switch problem and

, indicated mid position: however, it was verified in the closed position.

The number four main feedwater isolation valve, however,-did not close

. and was found to be full open. The breaker for the valve was found

tripped on overcurrent. However, the line was isolated by the

feedwater regulating valve, and also, the feedwater pump had been

,

tripped by the feedwater isolation signal.

During the subsequent investigation, the licensee identified that the

motor brake was partially full of water. The water had caused the motor

brake to rust and prevented operation of the motor operator, however,

the valve could be operated manually. The motor was disassembled and

found to have a melted rotor and damaged windings, due to sustained

locked rotor conditions. Thermal overloads are not available for motor

protection during a main feedwater isolation actuation signal, which, in  !

this example, resulted in motor destruction.

The valve and operator are located in a high temperature environmer.t

(>120 degrees F) and discussions indicated that the valve was

periodically being wetted down during operation of the steam generator

wet layup system due to system leaks. ' None of the other MFIVs on either q

unit were located such that this condition was a problem and the area  !

temperature should not have affected valve reliability. However, the

licensee discovered that the brake was not designed to be waterproof and

therefore this model of brake was susceptible to this mode of failure if

used in an environment that could cause moisture intrusion. The

licensee also noted that the brakes are used in areas where incidental

moisture intrusion was possible. l

A review of the equipment history found previous failures of 2 HV0P 003-

0100 B.

o On January 20, 1989, a PER was written to address the action plan

associated with the motor failure of 2 MV0P 003 0100 B. It noted

that the brake assembly was found to be rusted and locked in

)osition and the motor had failed. It also noted that the valve

) rakes were not qualified or required to be waterproof, indicating

that the licensee understood the failure mechanism / root cause at

that time.

e On September 8,1990, the valve failed to close on a feedwater

isolation signal and the breaker was found tripped. Inspection of

the brake assembly noted a collapse of the air gap adjustment and

rust obscuring the physical location of the air gap match point.

. - - . , _ - .

.

,

6

The mechanics identified the root cause of the failure as

incorrect assembly of the air gap adjusting nuts and stop nuts on

the brake adjustment plate. In addition, the documentation noted ,

that, "The brake mechanism was of a type which we do not normally

have to deal" and with foreman and general foreman approval

"further information from vendors manuals would be needed prior to

disassembly of brake unit for inspection and/or repairs." l

e In September 1994, a work request was initiated to re) air a.

damaged brake flexible conduit. Water was found in tie brake

compartment and the motor. brake was found to be highly corroded.

The brake assembly was replaced.

,

e On April 6,1995, the valve failed to close and the work request

noted that the valve thermaled out when given a closed signal.

The mechanics noted that the motor amps went high during the valve >

stroke and smoke came out of the motor casing.

The mechanics identified the root cause of the failure as  !

intermittently grounded motor brake leads and the motor brake was

replaced. Discussions with the mechanics indicated that the old

brake was full of rust, however, this was not identified in the

work package.

1

Various work packages identified occurrences of flexible conduit damage

since 1989. There were approximately 20 instances of flexible conduit

damage on Unit 2 main feedwater isolation valves, with 8 instances of

damage on 2-MV0P-003 0100 B.

On October 15, 1996, the inspector observed the testing of the Dings  ;

Motor Brake in its as found condition. Initial observation of the air  !

gap, which was to be set at .035 inches,-indicated that no gap existed. 1

The brake was energized and no apparent movement of the pressure plate

was observed. A torque wrench was then used to attempt to rotate the

brake, however, the brake would not rotate with 250 ft.lbs of torque

applied. The brake air gap was adjusted to .035 inches and when power

was then applied to the brake, the pressure plate moved and the brake

rotated freely. Power was then removed from the brake and it was turned

at 50 ft-lbs as required. With the brake in a condition where it

released at 50 ft lbs, even if the brake failed to release, the motor

would be able to overcome the brake friction and to operate the valve as

required.

Based on the rust lines within the brake assembly, it appeared that the

water was leaking into the brake assembly through the damaged flexible

conduit. The manufacturer's technical representative assisted in the

disassembly of the motor brake. He noted that no rust should be present

in the brake assembly and that the rust had caused the loss of air gap

and resulted in brake failure. He also noted that a gasket on the brake

housing was missing: however, the gasket had not been recuired by

Limitorc ue. He also noted that the brake had been sealec using RTV and

informec the licensee that acetate from the RTV curing process could

._. . . _ _. _ ~

'

.

I.. -

,

7

cause damage to the brake assembly. The licensee was not aware that a

motor gasket was needed and that RTV (acetate) could cause a problem.  ;

However, neither of these conditions appeared to contribute to the

previous brake failures.

The previous root cause determinations for the brake failures were  !

inadequate. -In 1989,1990, and 1994 there was a significant amount of

rust in the brake' assembly: however, the cause and overall effect of the

rust were not addressed. In 1995, the grounded leads were identified as i

the failure mechanism; however, the ins)ector concluded that this could

not be the root cause because even if t1e brake failed to release it'

still should have o>erated. The motor is rated with 250 ft lbs of

starting capacity w111e the brake is set for 50 ft-lbs.

Grounded / shorted leads would have caused a loss of the power source

fuses, in order to make the brake inoperable: however, the fuses did not

fail. The failure to develop an adecuate root cause, led to the failure

to identify and correct the water incuced failure of the brake assembly.

The failure to identify and correct the root cause of the brake failure.

is considered to be an apparent violation of the licensee's corrective i

action program as required by 10 CFR 50. Appendix B, Criterion XVI.

'

Corrective Action, and as required by SSP 3.4 (EEI 50 327, 328/96-13-

01).

Following the October 11 failure, the licensee determined that the root  !

cause for the failures of the brake assembly was an inadequate

specification of design requirements for this component. The feedwater

isolation investigation team documented that "A component that could J

withstand incidental moisture intrusion would have prevented this-

condition."

The equipment work history noted repeated occurrences of flexible

conduit damage in Unit 2. This led to the multiple water intrusions

into the brake assembly and the subsequent failures. After repeated

repairs of the flexible conduit for MFIV MV0P-003 0100-B in 1990, the

work history noted " suspect that it makes a good stepping place for

climbing in the area." In addition to the water intrusion, in 1995 the

a

wiring was found grounded which affected the environmental qualification

of the assembly. The failure to take adequate corrective actions to

prevent continued damage to the flexible conduits, is considered to be

an apparent violation of the licensee's corrective action program as

required by 10 CFR 50. Appendix B. Criterion XVI. Corrective Action, and

as required by SSP-3.4 (EEI 50 327, 328/96 13 02).

The licensee and the inspectors noted that the work history and the

previous PER history had identified the repeat failures of the MFIV

brake and flexible conduits. However, the licensee's trending programs,

for repeat failures of WRs and/or PERs, did not identify the repeat

failures of the MFIV brake or the MFIV flexible conduits. This was a

missed opportunity to identify and correct a repeating adverse

condition.

- .- _, . .-

l

'

. ,

-

8

3. Conclusions

The failure to identify the cause of the brake failures and to take l

adequate corrective actions for the water intrusion is considered to be '

an apparent violation.

1

The failure to take adequate corrective actions to prevent further

flexible conduit damage is considered to be an apparent violation.

The use of RTV could result in acetic acid intrusion into the brake

assembly, which in turn could cause damage to the brake assembly. The

previous use of RTV to seal up the brake assembly is considered to be a

weakness.

The manufacturer's technical representative noted that the motor to

brake assembly gasket was missing and should be installed. The missing

gasket is considered to be a negative observation.

The failure of the licensee's repeat failure tracking / trending programs,

associated with WRs and PERs. to identify repeating equipment failures I

on the NFIVs is considered to be a weakness. l

l

D. Failure of RCP Seal Leakoff Isolation Valve '

1. Insoection Scooe (62707 and 37551)

The initial abnormal plant indication which resulted in the shutdown of

Unit 2 was RCP low seal leakoff flow. The inspector reviewed the root

causes which led to the low seal leakoff flow indication.

2. Observations and Findinas

On October 11. Unit 2 received indications of # 4 RCP # 1 seal low

leakoff flow. # 2 seal high leakoff flow and seal return line standpipe - ,

alarms. Based on these indications, operators concluded that the # 2 j

seal had failed (excessive leakoff) and they commenced a shutdown of the  ;

unit as required by A0P-R.04. Reactor Coolant Pump Malfunctions, i

'

Revision 5. Subsequent licensee investigation revealed that, rather

than a failure of # 2 seal, the # 1 seal leakoff isolation valve. 2-FCV-

62-48, had failed closed and blocked leakoff flow.

Valve 2 FCV 62 48, is a pneumatic air to close, spring-to open valve and

is normally open during plant operation. It was not classified as an EQ

valve or as a safety related valve. however, it was classified as

Quality Related, which places it in the licensee's Appendix B program.

The inspectors reviewed the piping diagrams associated with the RCP seal

leakoff lines and isolation valves. The diagrams noted that the

downstream side of the # 1 seal leakoff isolation valve has a system  !

design rating of 200 psig. The low pressure design rating of the

downstream piping would dictate that this valve would be important to

safety and would be required to close on a RCP seal failure event to

prevent an unisolatable RCS leak inside containment.

- _ _ _ _ _ _ _ _ .

.

', .

9

The licensee's investigation noted that the ASCO solenoid valve

contained Buna-N rubt.er o ring seals which failed due to temperature age

hardening and thus permitted air to escape past the seals and to be

vented to the diaphragm of the pneumatic valve. Additionally, other

problems that contributed to the failure of the valve were noted:

e Upon removal of the exhaust port tubing, a piece of foreign

material was found in the port which caused partial blockage of

the exhaust ] ort. The material was determined to be a plastic

dust cover w1ich had apparently been left in the exhaust port

following previous maintenance.

e The as found regulator output pressure was 76 psig (the required

value was 50 psig). While this increased pressure was not

believed to have caused the failure of the solenoid (120 psig

design rating), it did exceed the pressure rating of the air

operated isolation valve. 2-FCV-62-48.

It appeared that the higher pressure provided additional air to leak

past the failed "0" rings and the vent plug did not allow the air to

leak out of the exhaust port. This apparently caused a pressure buildup

in the ASCO valve which caused the seal leakoff isolation valve to go

closed. The failure to remove the dust cover from the ASCO prior to

installation and the failure to properly set the supply air regulator

are considered to be poor maintenance practices and are identified as a

negative observation.

The licensee concluded that the root cause of the ASCO solenoid failure

was temperature age hardening of the Buna-N 0-rings in the solenoid

which allowed air to leak past the 0-rings and )ressurize the valve I

diaphragm. This solenoid was .1 stalled in Octo)er 1990 and had been in I

service for six years and it was also installed in an area where

temperatures could be as high as 150 degrees F. Buna-N elastomers

installed in solenoids in this environment (approximately 150 160

degrees F) have a service life of less than one year. The solenoid

vendor indicated*

that the Buna N upper temperature limit is 125

degrees F. ,

NRC IE Bulletin 78-14. Deterioration of Buna N Components in ASCO

Solenoids and Generic Letter (GL) 91-15. Operating Experience Feedback

Report, Solenoid-0perated Valve Problems at United States Reactors,

characterized the industry problems associated with the solenoid valves.  !

The GL addressed many failure modes including thermal aging and the need

'

for replacement or refurbishment of resilient parts. The GL did not

require a written response, however, the NRC expectation was that

utilities would review the report and apply the information as

appropriate to avoid similar problems. In late 1993. TVA developed an

l action plan to address the issues identified in Generic Letter (GL) 91-

i 15 and the NRC recommendation. The licensee could find no evidence to

!

indicate that the action plan was ever implemented. The licensee noted

,

that implementation of the action plan that was developed in response to

j GL 9115 could have prevented the solenoid valve failure. l

i

!

. i

e

i

10

In addition, the licensee noted that a previous PER had been initiated i

to address repeat failures of solenoid valves due to the elastomer i

material (Buna N) becoming hard and brittle due to being in an area with '

elevated temperature (>140 degrees F). However, the scope of condition-

-for resolution was narrowly focused in that only secondary side systems ,

were evaluated for a thermal degradation issue which was also applicable

to primary and safety related systems. The failure to implement

corrective actions for previously identified deficiencies related to

ASCO solenoid valves is considered to be an apparent violation of the

licensee's corrective action program as required by 10 CFR 50, Ap)endix

B. Criterion XVI, Corrective Action, and as required by SSP-3.4 (EEI 50-

327, 328/96 13 03).

,

During the review, it was noted that the seal leakoff valve fails open i

on a loss of power or a loss of containment control system air pressure.

For a RCP seal failure, this valve must remain closed or the downstream

seal leakoff low pressure piping could be damaged. It was not clear  ;

whether the accident analysis considered the open condition of the seal <

leakoff valve following a seal failure event. This is considered to be  !

an unresolved item (URI-327, 328/96-13 04).  ;

3. Conclusions f

1

The inspectors concluded that the ASCO solenoid failed due to l

temperature aging of the Buna N seals. An apparent violation was

identified for failure to implement corrective actions for ASCO solenoid

failures.

.,

A negative observation was noted regarding a poor maintenance practice

which permitted a dust cover to be left in the exhaust port of a

solenoid valve following maintenance activities and the failure to

properly set the air supply regulator to the proper setting.

E. Turbine Runback and Enaineerina Sucoort

1

1. Insoection Scoce (37551) I

When the operator stopped one of the two operating feedwater pumps, the

plant experienced a turbine runback. The plant was below the runback

setpoint of 80% turbine load and a runback should not have occurred.

The inspector reviewed the equipment problems related to the turbine

runback.

2. Observations and Findinas

The plant shutdown proceeded to approximately 50%, at which point one of

two operating feedwater pumps was procedurally required to be removed

from service. When the operator tripped the feedwater pump, the plant

experienced a main turbine runback, all of the. steam dumas opened and

the bank D control rods were automatically driven into t1e core. I

!

1

i

_ _ _ .

a

.

.

11

A turbine runback signal is initiated on a main feedwater pump trip with

l turbine power above 80%. Main turbine power was approximately 50% and

l the turbine runback was not expected. There is a total of nine pressure

,

instruments. located in the turbine building, associated with turbine

! impulse pressure. Two were safety related pressure transmitters (PT 1-

l 72 and PT 173) that supply signals to reactor control and interlock

circuits. One pressure transmitter (PT 47 13) supplies a signal for

turbine impulse control. Two pressure switches (PS 1-81 and PS 1 82)

provide a pressure setpoint actuation for AMSAC. Two pressure switches

(PS 47 13A and PS47-13D) provide inputs to the heater drain tank

'

turbine runback circuit. The last two pressure switches (PS 47 13B and

PS 4713E) provide inputs to the loss of main feedwater pump turbine

runback and AFW actuation circuits.

After the event, the associated pressure switches were inspected by the

licensee. Pressure switches (PS47-13B and PS47-13E). which develop

the two out of two actuation signal for the turbine runback, were

partially filled with water. In addition, one of the pressure switches

used in the heater drain tank turbine runback circuit, was also found

partially filled with water. The water had corroded the switches,  ;

causing them to become stuck and they erroneously indicated power above i

80%. This sealed in the turbine runback signal as well as an AFW

actuation signal. The licensee determined that the water had leaked ,

into a common junction panel above the pressure switches and then leaked l

into the individual pressure switch enclosures. The source of the water l

appeared to be from a fire system deluge actuation, caused by a failed

fire detector in July 1996. The water from the actuation entered the

top of various junction boxes and then drained down the wiring into the

switch enclosures. During further investigation of the water intrusion,

the licensee identified 18 additional instruments affected by the fire

system actuation. Ten instruments, that provide secondary plant control

functions, were repaired prior to plant startup.

Following the fire system actuation in July 1996, the licensee did not l

adequately evaluate the consequences of the deluge actuation and soaking

down of plant equipment. This led to the subsequent failure of the  ;

impulse pressure switches. The failed switches caused a turbine runback 1

and sealed in an AFW actuation signal. In addition, the switches could

have failed in a position that would have prevented a turbine runback i

and blocked the associated AFW actuation signal. The licensee's

corrective action process, as implemented by station procedure SSP-3.4,

Corrective Action. Appendix H. requires an extent of condition review in :

order to bound the problem. However, following the deluge actuation,

the PER corrective actions did not adequately bound the adverse

conditions, in that they did not identify the adverse condition of the

turbine impulse switches. This is considered to be an apparent

violation (EEI 50-327, 328/96 13-05).

l All of the associated impulse pressure switches, on both units, were

'

inspected and the three sticking pressure switches were replaced (to

date, one awaiting parts). The licensee had previous problems with the

operation of these pressure switches resulting in a turbine runback:

__ . _ . _ _ _.. . _ _ _ _

'

• '

.

.

.

17

Engineering " dummied" a signal to a computer alarm circuit prior to

. determining the cause for the signal. This is considered to be a

negative observation. ,

B. Unit 2 Reactor Trio Breaker Maintenance

1. Insoection Scooe (62707)

The inspectors reviewed the activities related to refurbishing the spare

RTB and the subsequent replacement of the Unit 2 RTB "B" with the spare

refurbished RTB.

2. Findinas and Observations

i

On September 19. 1996, with Unit 2 at 130% power RTB "B" was replaced

with a refurbished spare RTB. Due to a malfunction of auxiliary

contacts and subsequent insistence of Operations management. the rebuilt i

RTB was removed and the original breaker was reinstalled. Upon i

'

inspection of the removed refurbished RTB it was determined that linkage

control to the auxiliary contacts had not been reconnected during the

breaker refurbishment activities.

The following is the sequence of events related to the refurbishment of

the spare RTB.

e On Seatember 13, 1996 (Friday), maintenance personnel began

refuraishment of the spare RTB in accordance with Maintenance

Instruction (MI) 10.9.1, Reactor Trip Breaker Type DB50 Inspection

Associated with System 99, Revision 16. Procedure Section 6.2.6. '

Breaker Auxiliary Switch Inspection and Test, was completed on

this date. j

e On September 14, 1996 (Saturday), maintenance personnel requested i

QC support in order to complete the remaining lubrication i

activities in Section 6.4. Since it was the weekend and no QC '

inspectors were on site, maintenance requested that a QC inspector

be called in: however, the request was denied.

Maintenance supervision determined that it was acceptable to

proceed with the steps of MI-10.9.1. which did not require QC

su) port. They determined that activities involved with

lu)rication would not affect those maintenance activities already '

completed on the breaker and they made a decision to proceed with

Section 7.0. Post' Performance Activities, and to perform the

lubrication activities of Section 6 when QC was available on

Monday.

e On September 15, 1996 (Sunday), work continued on the post

performance activities of Section 7.

e On September 16, 1996 (Monday), with QC support, maintenance

personnel began performance of the remaining steps in MI 10.9.1,

. - ._. .- . _ -. .

.

'. .

E 18

l

! Sections 6.4 through 6.7. These activities included inspection

j and lubrication of the inertia latch which required removal of one

!

end of a link to the auxiliary contact linkage assembly. During

the reassembly of the linkage assembly, neither the QC inspector

nor maintenance personnel noticed that a portion of the linkage

had not been reconnected. Following the lubrication of the

inertia latch, subsequent steps of Section 6 required that the

breaker be opened / closed several times during which maintenance

personr.el did not notice the disconnected linkage. MI-10.9.1 was ,

completed with the linkage still. disconnected.

e On September 19, 1996 (Thursday), the refurbished RTB was  !

installed in Unit 2.

The inspector reviewed MI-10.9.1 and the RTB refurbishment activities.

and had the following observations,

o MI-10.9.1. Section 6. contained a " NOTE" which permitted steps

within Section 6 to be performed out of sequence. This " NOTE" l

only applied to Section 6 and did not intend that Section 7 be '

completed prior to Section 6. If Section 6 had been completed l

prior to Section 7. the Post Maintenance Test (PMT) of Section 7 '

may have identified the linkage reassembly errors made in

Section 6.

Technical Specification 6.8.1.a requires, in part, that procedures i

shall be established, implemented, and maintained covering the l

activities recommended in Regulatory Guide 1.33. Revision 2. '

Appendix A. including procedures for performing maintenance.-

'

Procedure MI-10.9.1. did not authorize personnel to perform

procedure " sections" out of sequence. The failure to follow

procedure MI-10.9.1 is considered to be example one of an apparent

violation of TS 6.8.1.a (EEI 50-328/96 13-08).

e MI-10.9.1 was written such that the auxiliary contacts were tested

in Section 6.2.6. Later, in Section 6.4.1 of the procedure, the

auxiliary contact linkage assembly was disconnected from the

i

inertia latch to allow lubrication of the inertia latch. After

the performance of Section 6.4.1 there was no further check or l

test of the auxiliary contacts to ensure the linkage was intact i

prior to returning the RTB to service. Additionally. there was no  !

guidance in the procedure to caution that the linkage could become ,

disconnected during the inertia latch disassembly process. l

The inspector also reviewed MI 10.9.1 to determine if there had

! been any recent procedure revisions which had changed the method i

i of inertia latch lubrication. The inspector noted that Revision

l 13. dated July 29, 1994, was changed such that the inertia latch

was removed for inspection and lubrication. Prior to Revision 13,

!

the latch had been lubricated without removal of the latch.

,

Revisions 14 and 15 also required removal of the inertia latch as

did Revision 16 under which this most recent RTB inspection was ,

,

i

.- - . - - - .

'

.

-

j

19 ,

1

l

performed. The inspector concluded that Revision 13 to procedure

! MI-10.9.1 did not adequately address the evolution of removing the

inertia latch in that it did not consider ap)ropriate precautions

'

!

'

regarding reinstallation of the inertia latc1 to ensure proper

reassembly.

Procedure MI-10.9.1 was inadequate in that it did not provide

precautions or adequate instructions regarding the

disassembly / reassembly of the reactor trip breaker auxiliary

contacts linkage assembly during lubrication. The failure to

provide an adequate MI 10.9.1 procedure is considered to be an

additional example of an apparent violation of TS 6.8.1.a (EEI 50-

328/96-13 08).

e The licensee did not adequately plan the refurbishment of the RTB

to recognize the need for weekend QC support. The absence of QC

support started a chain of events which led maintenance

supervision to make an inappropriate decision to perform the Post

Performance Activities, Section 7 of MI-10.9.1. without first

completing Section 6.  !

e Neither the maintenance person performing the reassembly of the

linkage nor the person performing the "2nd check" noticed that the ,

linkage was disconnected. After several strokes of the breaker  :

during bench testing and with the breaker mechanism apparently l

functioning normally. maintenance personnel did not notice the i

disconnected linkage. J

e The inspector reviewed the licensee's corrective action plans and

concluded that the licensee had completed corrective actions to

revise MI 10.9.1. The procedure revision included moving the

auxiliary contact check and test to the end of the 3rocedure to a

place where all partial disassembly of the breaker las been

completed. Additionally, a caution note was added to the step

requiring removal of the inertia latch to ensure that the

auxiliary contact linkage was connected following lubrication of

the inertia latch. The 3rocedure revision contained clarification '

as to the meaning of wor (ing steps out of sequence and to which

sections this applied. The licensee visually verified that the

remaining RTBs contained correctly assembled linkages. Management

expectations were also ex)ressed to personnel that, to the extent

practical, extra effort siould be extended to ensure components

are properly reassembled and will perform their required function.

3. Conclusions

'

The inspector concluded that the MI-10.9.1 procedural " NOTE" permitting

steps to be performed out of sequence did not permit the " performance"

section and the " testing" section to be performed out of sequence. The

failure to follow a procedure guidance is considered to be an apparent

violation.

i

.

.

20

The inspector concluded that procedure MI-10.9.1 was inadequate in that

it did not 3rovide cautions regarding the reassembly of the auxiliary

contact lincage assembly following lubrication. The use of an

inadequate procedure is considered to be an apparent violation.

The inspector concluded that, during the planning for the RTB

refurbishment. Maintenance failed to ensure that QC personnel would be

available when required by the procedure. This issue is considered to

be a negative observation.

C. Licensee Self Assessment Activities (40500)

1. Inspection Scope (40500)

The licensee performed a root cause investigation to determine

corrective actions associated with the reactor trip breaker event. The

inspectors reviewed the Event Critique Report and its associated

corrective actions.

2. Observations and Findings

The inspectors reviewed the licensee's Event Critique Report which

addressed the problems identified in PER No. SQ962451PER related to

failure of the auxiliary contacts in the refurbished RTB breaker. The

licensee concluded that "...the root cause of this event was inadequate

skills and knowledge resulting from inadequate training. Specifically.

the training associated with the DB 50 breakers did not adequately

address the mechanical linkage between the inertia latch and the

auxiliary contacts. Further. the procedure (MI 10.9.1) did not identify

the )ossibility of linkage disengagement while removing the inertia

latc1. Additionally. the Westinghouse vendor manual does not adequately

address this mechanical linkage...."

The inspectors concluded that the licensee's event critique accurately

described the lack of training and knowledge which were most probably

due to vendor manual deficiencies regarding inertia latch lubrication.

However. the inspectors concluded that the event critique was not

thorough in that it (1) did not address operability of the refurbished

'

RTB (2) did not address the functions of the auxiliary contacts which

were disabled, and (3) did not address the effect of a revision to MI-

10.9.1 (July 29.1994) which changed the method of lubricating the

inertia latch.

3. Conclusions

The inspectors concluded that the failure of the RTB Event Critique to

discuss (1) RTB operability. (2) the function of the auxiliary contacts.

and (3) the revision to the maintenance procedure, represented a

weakness in the thoroughness of the root cause determination process.

.

', .

21

D. Failure to Perform an Ooerability/Recortability Determinatiorl

1. Insoection Scooe (40500)

Following removal of the refurbished reactor trip breaker on

September 19, 1996, the licensee identified that the linkage for the

auxiliary contacts had not been reconnected properly. The operations

Shift Manager and the PER event critique team questioned the function of

the contacts due to concerns with the operability of the reactor trip

breaker. In addition, the Management Review Committee (MRC) reviewed

the PER and noted that the reactor trip breaker issue potentially

affected reportability. The inspectors followed up on the function of

the disconnected contacts.

2. Observations and Findinas

Following identification of problems identified with the reactor trip

breaker, the Shift Manager expressed concerns regarding the proper

functioning of other RTB auxiliary contacts. His concerns led to an

addendum to the initial PER and he also expressed to the operation's

representative on the RTB event critique team the need to evaluate the

disconnected contacts.

The MRC met on September 20, 1996 and determined that the PER condition

could potentially affect re)ortability and appro)riately checked the

potentially reportable bloc ( on the PER form. T11s action required that

the PER be hand carried to Operations so that Appendix E of SSP- 3.4,

Corrective Actions, could be implemented. Appendix E details the

requirements for performing an operability /reportability determination.

As of approximately two weeks later the PER was not returned to

Operations and the subsequent operability /reportability determination

was not performed until questioned by the inspectors. The failure to

perform the operability /reportability determination is an apparent

violation of NRC requirements (EEI 50 328/96-13-09).

In addition, as follow up on the Shift Manager's concerns, the review

team questioned the function of the disconnected auxiliary contacts in

order to determine if the contacts affected the operability of the

reactor trip breaker. During the week following the RTB malfunction,

technical support completed its review of the function of the

disconnected auxiliary contacts and supplied a memo to the event

critique team. The memo noted that the disconnected auxiliary contacts

affected the turbine trip and feedwater isolation outputs from the

reactor trip breaker.

NRC discussions with an event critique team member indicated that the

team understood that the disconnected auxiliary contacts affected P-4:

and therefore, affected the operability of the reactor trip breaker.

This information was thought to be common knowledge, however, neither

technical support or the event critique team formally reported the

inoperability of the RTB to appropriate levels of management. The lack

. - - - .. .-

_.

-

.

'.. -

12  !

however, the previous event was not due to water intrusion into the

pressure switch enclosures.

The licensee's review also noted that the fire system detector had

failed (in July) due to water intrusion into the detector. The water

had leaked into the detector, possibly due to overflow from the gland t

sealing steam system.

During a review of control diagrams and alarm response procedures

associated with the turbiae runback, the inspector noted that alarm

response procedure 2 AR M2 A-B-1. Turbine Runback, did not identify the

same instruments for the alarm inputs as depicted on control diagram CCD

No.1, 2 47 W610 47-2. Although inconsistent, this error would not 1

affect operator actions associated with the turbine runback alarm.

3. Conclusions

The failure to implement adequate corrective actions associated with the  !

fire system actuation is considered to be an apparent violation.

The water intrusion into a single zone actuation fire detector, which

resulted in the deluge actuation, is considered to be a negative

observation. l

l

Inconsistencies in the control diagrams and the abnormal procedures is l

considered to be a negative observation. l

F. AFW Actuation Sianal Sealed In

1. Insoection Scoce

During recovery actions the operators could not reset the AFW actuation

signal and could not take manual control of the AFW system. This

contributed to reaching a low low Tave condition. The inspector

reviewed the circuitry associated with the AFW actuation and the

operator's response to the loss of AFW control.

2. Observations and Findinas

While performing the reactor trip recovery steps in the emergency

response procedures, the operators had difficulty in controlling the

cooldown of the RCS. This led to dropping below the low-low Tave

setpoint of 540 degrees F which resulted in a main feedwater isolation j

signal and also required the operators to emergency borate the RCS. 1

Because of the operators quick response to abnormal plant conditions. l

Tave only dropped to 538 degrees F. However., the operators had to

control the steam generator level by fully opening / closing the AFW

isolation valves (cannot be throttled).

The operators had difficulty in controlling RCS cooldown because the AFW

actuation signal was sealed in and they were unable to take manual

control of the motor driven AFW system flow control valves or to take

]

l

.

, .  :

)

13 1

manual speed control of the turbine driven AFW pump. Operators, with

management approval, disabled the AFW pumps by placing the motor driven

AFW motors in pull-to-lock and by closing the turbine driven AFW pump

discharge isolation valves. This resulted in all three AFW pumps being

technically inoperable with TS 3.7.1.2 LC0 actions preventing any mode

change and also requiring immediate initiation of corrective actions to

return one pump to operable status. Following the reactor trip, the l

operators maintained adequate steam generator water levels (>10% in all

four SGs) by operating the turbine driven AFW pump discharge isolation

valves and maintained acceptable RCS temperature conditions (approximate

545 degrees F). 1

The operators were unable to reset the AFW actuation signal because the

signal was sealed in by the failed im)ulse pressure switches. A review

of the wiring diagrams noted that wit 1 a main feedwater pump trip above i

80% turbine power, the AFW system receives an automatic actuation I

signal . Since the impulse pressure switches were stuck, the signal was

sealed in and could not be reset by the operators. During the event. I

the o)erators were unaware of the interlock between the turbine runback )

and tie locked in AFW actuation signal. At 10:44 a.m.. following

discovery by the licensee of the failed switches, a lead was lifted in

the impulse pressure switch circuitry and the operators were then able

to reset the AFW actuation signal, which allowed normal control of the

AFW system.

Further review noted that if the operators had reset the main feedwater  !

pump after it was manually tripped, then the turbine runback would have i

reset automatically and the AFW actuation could have been manually i

reset. However, this was not proceduralized and the operators did not I

understand the operation of the runback circuitry and did not reset the

main feedwater pump. Discussions indicated that a turbine runback, due

to impulse pressure switch problems, had occurred before and the

inspector concluded that knowledge of the circuitry should have been

available based on the previous event. The lack of knowledge appeared i

to be a deficiency in classroom training and in simulator scenarios.  !

l

The AFW actuation signal following a main feedwater pump trip 1s

designed to compensate for a loss of feedwater It is not safety

related and not subjected to any separation requirements. In this case

a common mode failure occurred due to a lack of separation. It does not

appear to provide a safety function but rather assists the unit in

maintaining steam generator levels and preventing a reactor trip

following a feedwater pump trip at high power levels. The licensee was

reviewing the continued need for the circuitry as designed and is

considering potential modifications to the circuitry which would allow

for manual resetting of the (main feedwater pump trip / turbine power

>80%) AFW actuation following a reactor trip.

Mitigating actions are required for a reactor trip, a steam line break

inside containment, a steamline break outside containment, and a SG tube

rupture. Operators are required to take manual control of the AFW

system (UFSAR assumption within 10 minutes) to ensure that the plant can

,

14

meet.the analysis for the above listed events. The UFSAR Section

10.4.7.2.3, Safety Evaluation, states, "The AFW system is automatically

initiated by redundant. coincident logic to preclude loss of function

due to a single failure." However, based on the system failure due to

water intrusion, it does not appear that the system was. properly

designed to preclude a loss of function with a single failure. This

issue is identified as an Unresolved Item pending further NRC review.

(URI 50 327, 328/96 13 06).

3. Conclusions

The operators lacked knowledge in the functioning of the turbine impulse

pressure switch circuitry and this lack of knowledge indicated a

weakness in the licensee's training program, considering the previous

problems with this circuit.

The operators appropriately isolated the AFW system to prevent an

uncontrolled cooldown of the RCS. This is considered to be a positive

observation.

The failure of two non safety related and non independent switches i

resulted in the inability of operators to reset an AFW actuation signal.

This could have led to an RCS overcooling event or could have affected

plant safety during one of several events discussed in the safety

analysis and its design is an unresolved item.

II. Inocerable Reactor Trio Breaker

A. Operational Aspects

1. Insoection Scope (71707)

On September 19, 1996, a refurbished RTB was placed in service. The

breaker had position indication problems that caused alarms in the

control room and the RTB was subsequently removed. A PER was initiated

and a root cause investigation was performed. Following completion of

the root cause investigation, the inspectors reviewed the facts

surrounding the event. The NRC review found that the breaker had been

inoperable and the licensee had exceeded an LC0 required shutdown.

l

2. Observations and Findinas

At 9:29 a.m., on September 19, 1996, the licensee entered TS 3.3.1,

Action 12 for installation of the refurbished breaker in the RTB "B"

cubicle. Testing was performed to ensure that the breaker functioned .

properly. The breaker opened and closed as required; however, when the l

bypass breaker was cycled, the " computer alarm rod deviation NIS power I

range tilts" annunciator went into alarm and cleared. This occurred '

several times during the testing process. At 10:48 a.m.. the testing

was complete, the refurbished reactor trip breaker was considered to be

operable, the bypass breaker was opened, and the rod deviation alarm l

came in and stayed in alarm. Discussions with operations indicated that l

ll

l

_ . _ . . . _ -_. . _ . _ _ _ _ _ . _ - _ _ . _ _ _

.. .

o, . ,i

.

15

the operators were concerned that the alarm was associated with the i

reactor trip breaker, .but were unable to confirm the relationship. .

At 11:30 a.m., engineering personnel confirmed that the computer rod-

~

'

deviation alarm was due to an input from RTB."B", which was erroneously

indicating that.RTB "B" was not closed. The operator -logs noted that

the most likely _cause for the alarm was due to a malfunction 'of an

auxiliary contact in RTB "B". Discussions with operations indicated  :

that the operators were concerned that if one contact was malfunctioning -

that other contacts in the breaker could also be malfunctioning and they  ;

wanted the breaker removed.

'

At-1:28 p.m., engineering " dummied" the computer signal to the

Integrated Computer System (ICS) computer so that the input-to the rod

bank deviation circuit would indicate a closed signal from RTB "B".

This cleared the " Tilt" alarm which reduced the surveillance frequency ,

requirements for operators-taking rod position readings. At this time,

the breaker was considered to be operable based on the com)leted breaker

operability surveillance: however. the surveillance only clecked the

operation of the breaker and did not verify the breaker position output

signals to the computer or to the P 4 circuits.

Discussions with o)erations noted that engineering and maintenance-

wanted to troubles 1oot RTB "B" in its closed position and.were reluctant

to remove RTB "B" and to replace it with the original breaker.

Operations insisted on not troubleshooting the breaker and asked for

removal of the potentially faulted breaker. The Operations' Manager was i

called to the site for a staff meeting _to discuss the various options. l

The Operations Manager agreed with the Shift Manager that the breaker I

needed to be replaced and that no troubleshooting would be performed  ;

while the breaker was in service. l

At 5:45 p.m., the breaker replacement was initiated and at 6:34 p.m.,

RTB "B" replacement was completed. When the faulted breaker was opened,

the licensee determined that a linkage that operated two of three sets

of breaker position contacts, was not connected. Following completion

of the licensee's root cause investigation, the inspectors noted that

the licensee still did not appear to know the function of the

-disconnected contacts. The inspectors reviewed the logic diagrams and '

believed that the contacts supplied the P 4 permissive function which

provides a turbine trip, feedwater isolation, and steam dump arming

signal following a reactor trip and was based on the position of the

reactor trip breaker.

Discussions with the licensee's compliance personnel noted that the

turbine trip associated with the RTB had been reviewed and evaluated for

operability. Compliance personnel stated that the turbine trip was not

taken credit for in the accident analysis: therefore, the RTB "B" was

considered to be operable. The inspector noted that the turbine trip '

function, following a reactor trip, provides protection for an

overcooling event on the RCS and, in addition, is part of the P-4

_ _ .

4

, .

16 .

1

circuit which is a TS required function with a 6-hour LC0 for shutdown  !

- to hot shutdown, if the circuit is not functional. l

In response to questions by the inspectors, the licensee reviewed the

functions of the disconnected contacts and determined that the contacts

supplied signals for reactor trip alarm, high steam flow interrupt, a

computer point for the rod deviation program, turbine trio. feedwater )

isolation (which orovides feedwater isolation coincident with a low

Tave sianal. maintains a feedwater isolation. turbine trio. and trio of

main "eedwater cumos sianals after a steam aenerator hiah level trio).

and a' lows bloc (ina of the safety in.iection sianal after a SI so that

the SI sianal can be reset. The above underlined signals are part of

the P 4 circuitry required to be operable by TS. The inspectors noted

that the ino)erable P 4 circuitry exceeded the TS requirements for

shutdown (6 lours). The failure to follow TS 3.3.1.22.G. Action 14,

requirements is considered to be an apparent violation (EEI 50 327,

328/96 13 07). Due to the failure of the contacts, the breaker was

inoperable from the time it was installed (9:29 a.m.) until it was

removed (6:34 p.m.).

"

The inspectors noted that the "A" train RTB would have been able to

actuate the turbine trio and feedwater isolation signals. However,

blocking of the SI signai would have been prohibited by the faulty  ;

reactor trip breaker. Following an SI, due to the failure of the RTB i

'

P 4 contacts, the operators would have been required to manually isolate

all of the SI actuated components, which would have complicated recovery l

,

actions. I

On November 4,1996, licensee staff was still convinced that the turbine i

trip contacts from the reactor trip breaker were not part of the P 4

circuitry. However, following additional questions and review of the 18

month surveillance SI IFT 099 0P4.0, Periodic Verification of P 4

Interlock Function From Reactor Trip Breakers, Revision 1, the plant

staff agreed with the inspectors that the turbine trip in question was

<

part of the P 4 circuitry.

3. Conclusions

>

Operations did a good job in stressing the need to get the potentially

faulted RTB out of service and in not allowing troubleshooting of the

breaker while still in service. This is considered to be a positive

observation.

The inoperable RTB was in service for greater than the allowed TS LCO

time period and this is considered to be an apparent violation of NRC

requirements.

The plant staff did not realize that the turbine trip contacts on the

reactor trip breaker were part of the P 4 circuitry and this is

considered to be a weakness.

- .- . . - - -

- . - . .-

, .

, ,

22

of action by the critique team and technical support personnel to report  ;

, the inoperability of the RTB is considered to be a weakness.

3. Conclusions  !

The failure to perform an operability /reportability determination as

required by SSP-3.4 is considered to be an apparent violation.

' The lack of action by the event critique team and technical su) port I

personnel to report the inoperability of the reactor trip brea(er is i

considered to be a weakness.

III. Exit Meeting Summary.

The inspectors ) resented the inspection results to members of licensee

management at t1e conclusion of the inspection on November 5.1996. The

licensee acknowledged the findings presented.

The inspectors asked the licensee whether any materials would be

considered proprietary. No proprietary information was identified.

,

j

l

PARTIAL LIST OF_ PERSONS CONTACTED

Licensee

• Adney, R., Site Vice Presiderit

• Beasley, J., Acting Site Quality Manager

• Bryant. L., Outage Manager

• Burzynski, M., Engineering & Materials Manager

Driscoll. D., Training Manager

• Fecht M., Nuclear Assurance & Licensing Manager

Fink, F., Business and Work Performance Manager

• Flippo, T., Site Support Manager

• Harrington, W., Acting Maintenance Manager

• Herron, J., Plant Manager

Kent, C., Radcon/ Chemistry Manager ,

Lagergren. B., Operations Manager  !

Rausch, R. Maintenance and Modifications Manager

Reynolds. J..-Operations Superintendent

• Rupert, J., Engineering and Support Services Manager

• Shell, R., Manager of Licensing and Industry Affairs

Skarzinski, M., Technical Support Manager

• Smith, J., Licensing Supervisor

Summy, J., Assistant Plant Manager

Symonds, J. Modifications Manager

• Attended exit interview

l

1

,

.. - -. . .-.- - - - - - _ . .. . - _- -

4 .

-

i

.

.

l

23 l

1

,

INSPECTION PROCEDURES USED i

'IP 37551: Onsite Engineering i

'IP 40500: Effectiveness of Licensee Controls In Identifying. Resolving, & i

Preventing Problems

IP 62707: Maintenance Observations

IP 71707: Plant Operations

i

!

ITEMS OPENED. CLOSED. AlO DISC _USSEj

l

Opened l

50-327, 328/96 13-01 EEI Failure to correct re)etitive problems

(water intrusion) wit 1 the MFIV #4 MOV

brake assembly (Section I.C.2). I

l

50-327, 328/96-13 02 EEI Failure to implement adequate corrective l

actions to prevent repetitive damage to 1

the MFIV flexible conduits (Section

I.C.2).

50-327, 328/96-13-03 EEI Failure to implement adequate corrective

actions to address ASCO solenoid valve

elastomer aging (Section I.D.2).

50 327, 328/96 13 04 URI Evaluate the adequacy of the fail open j

design of the RCP seal leakoff isolation

valve, which is needed to mitigate the

consequences of a RCP seal failure

(Section I.D.2).

50-327. 328/96-13-05 EEI Failure to perform an adequate extent of

condition review required by SSP-3.4 for

deluge event which resulted in the impulse

pressure switch failures (Section I.E.2).

50 327, 328/96 13-06 URI Evaluate the adequacy of design of the

turbine impulse AFW actuation circuitry

which the UFSAR required to be independent

to prevent a common mode failure (Section

I.F.2).

50 327, 328/96-13 07 EEI Failure to follow TS 3.3.1.22.G. Action 14

(Section II.A.2).

)

,

. - . _ . _ _ . . . _. . . _ . . . . _ . _ . _ . _ _ . . _ _ _ . - . _ . _ . . _ _ _ - _ . . _ . _ . . .

,

. . . _ . _ _ _ . . _ . . _ . . .

F ,

'

!  :

2

.

. .

. ,

>

\ 24 i

i i

i

50 327, 328/96-13 08

~

2

EEI Failure to Follow Procedure mil 0.'9.1 and  !

j Failure to Provide an Adequate MI 10.9.1 .

!

1

Procedure (Section II.B.2). l

!

d

50 327. 328/ % 13-09 EEI Failure to Perform an l

Operability /Reportab111ty Determination  !

. (Section II.D.2).

i

;

,

q.

,

s

l'

i -

<  ;

i  !

i

>

r i

l \

j l

-

i

3

).

i

!

i

!

I

i

l

!

1

l

-

!

l

i

i

!

l

1

i

. _..

'34386 Federal Register / Vol 60, No.126 / Friday, June 30, 1995 / Notices

factors in arriving at the appropriate is not held, the licensee will normally is a matter of public reco ci, such as an

severity level will be dependent on the be requested to pr~4de a written adjudicatory decision trf the

circumstances of the violation. response to an inspan report,if Department of Labor. la addition, with  ;

However,if a licensee refuses to correct issued, as to the licensee's views on the the approval of the Exo:utive Director

a minor violation within a reasonable apparent violations and their root for Operations, conferences will not be

time such that it willfully continues, the causes and a description of planned or open to the public where good cause has

violation should be categorized at least implemented corrective action. been shown after balancing the benefit

at a Severity LevelIV. During the predecisional enforcement of the public observation against the

D. Violations ofReporting Requirements c nference, the licensee, vendor, or potentialimpact on the agency's

other persons will be given an enforcement action in a particular case.

The NRC expects licensees to provide opportunity to provide information As soon as it is determined that a

complete, accurate, and timely consistent with the purpose of the conference will be open to public

information and reports. Accordingly, conference, including an explanation to observation, the NRC will notify the

- unless otherwise categorized in the the NRC of the immediate corrective licensee that the conference will be

Supplements, the severity level of a actions (if any) that were taken open to public observation as part of the

violation involving the failure to make

a required report to the NRC will be following identification of the potential agency's trial program. Consistent with

violation or nonconformance and the the agency's policy on open meetings,

based upon the significance of and the long-term comprehensive actions that " Staff Meetings Open to Public "

circumstances surrounding the matter published September 20,1994 (59 FR

were taken or will be taken to prevent

that should have been reported. recurrence. Licensees, vendors, or other 48340), the NRCintends to announce

However, the severit y level of an persons will be told when a meeting is open conferences normally at least to

,

untimely report, in contrast to no report, a predecisional enforcement conference. working days in advance of conferences

may be reduced depending on the A predecisional enforcement through (1) notices posted in the Public

circumstances surrounding the matter. conference is a meeting between the Document Room,(2) a toll-free

A licensee will not normally be cited for NRC and the licensee. Conferences are telephone recording at 800-952-9674,

a failure to report a condition or event normally held in the regional offices and (3) a toll-free electronic bulletin

unless the licensee was actually aware board at 800-952-9676. In addition, the

and are not normally open to public

of the condition or event that it failed observation. However, a trial program is NRC will also issue a press release and

to report. A licensee will, on the other

hand. nermally be cited for a failure to being conducted to open approximately notify appropriate State liaison officers

,

25 percent of all eligible conferences for that a predecisional enforcement

i report a condition or event if the conference has been scheduled and that

public observation, i.e., every fourth

licensee knew of the information to be eligible conference involving one of it is open to public observation.

reported.,but did not recognize that it three categories of licensees (reactor, The public attending open

was reqmred to make a report. hospital, and other materials licensees) conferences under the trial program may

V, Predecisional Enforcement will be open to the public. Conferences observe but not participate in the

Conferences will not normally be open to the public conference. it is noted that the purpose

,

Whenever the NRC has learned of the if t e enforcement action being c " '

existence of a potential violation for

, al pr g a nttm Im ze

,

C "

(3)you,ld b'e taken against an public attendance, but rather to

which escalated enforcement action determine whether providing the public

individual, or if the action, though not

,

appears to be warranted, or recurring with opportunities to be informed of

nonconformance on the part of a taken against an individual, turns on

whether an individual has committed NRC activities is compatible with the

vendor, the NRC may provide an NRC's ability to exercise its regulatory

op ortunity fora predecisional doing.

wron$nvolves

(2) significant personnel and safety responsibilities. Therefore,

en orcement conference with the members of the public will be allowed

failures where the NRC has requested

i licensee, vendor, or other person before that the individual (s) involved be access to the NRC regional offices to

taking enforcement action. The purpose present at the conference: attend open enforcement conferences in

of the conference is to obtain (3)Is based on the findings of an NRC accordance with the " Standard

information that will assist the NRC in Office ofInvestigations report;or Operating Procedures For Providing

determining the appropriate (4) Involves safeguards information. Security Support For NRC Hearings And

enforcement action, such as:(1) A Privacy Act information, or information Meetings," published November 1,1991

common understanding of facts. root which could be considered proprietary; (56 FR 56251).These procedures

causes and missed opportunities In addftlon, conferences will not provide that visitors may be subject to

associated with the apparent violations, normally be open to the public if: personnel screening, that signs, banners,

(2) a common understanding of (5) The conference involves medical posters, etc., not larger than 18" be

corrective action taken or planned, and misadministrations or overexposures permitted, and that disruptive persons

'

(3)a common understanding of the and the conference cannot be conducted may be removed.

significance ofissues and the need for without disclosing the exposed Members of the public attending open

lasting comprehensive corrective action. Individual's name: or conferences will be reminded that (1)

If the NRC concludes that it has (6) The conference will be conducted the apparent violations d!scussed at

sufficient information to make an by telephone or the conference will be predecisional enforcement conferences

informed enforcement decision, a conducted at a relatively small are subject to further review and may be

conference will not normally be held licensee's facility. subject to change prior to any resulting

unless the licensee requests it. However, Notwithstandmg meeting any of these enforcement action and (2) the

an opportunity for a conference will criteria, a conference may still be open statements of views or expressions of

normally be pruvided before issuing an if the conference involves issues related opinion made by NRC employees at

order based on a violation of the rule on to an ongoing adjudicatory proceed %g predecisional enforcement conferences,

Deliberate Misconduct or a civil penalty with one or more intervenors or where or the lack thereof, are not intended to

to an unlicensed person. If a conference the evidentiary basis for the conference represent final determinations or beliefs.

NUREG-1600 8

Enclosure 2

____ ____.________-.m . . ~ . - __ _ __ _ _ _ -

___ ,

,

'

i -

. . .

.

. . -

Federal Register / Vol. 60, No.126 / Fridry, June 30, 1995 / N:tices 34387

<

) Persons attending open conferences will to be under oath. Normall , responses management involvement in licensed

j be provided an opportunity to submit under oath willbe required only in activities and a decrease in protection of

wntten comments concerning the trial connection with Severity Level l, II, or the public health and safety,

3 program anonymously to the regional - IIIviolations or orders.

, office.These comments will be The NRC uses the Notice of Violation 1. Base Civil Penalty

l subsequently forwarded to the Director as the usual method for fonnalizing the The NRC imposes different levels of

j of the Office of Enforcement for review existence of a violation. lssuance of a penalties for different severity level

{ and consideration. .

Notice of Violation is normally the only violations and different classes of

_ When needed to protect the public enforcement action taken, e~ xcept in ' licensees, vendorr, and other persons.

health and safety or common defense cases where the criteriefor issuance of Tables 1A and 1B show the base civil

and security, escalated enforcement civil penalties and orders, as set forth in penalties for various reactor, fuel cycle,

2

.

action, such as the issuance of an

Sections VI.B and VI.C. respectively, are materials, and vendor programs. (Civil

immedbtely.ffective order, willbe met. However, special circumstances penalties issued to individuals are

taken before tb conference.In these regarding the violation findings may determined on a case-by. case basis.) The

!

cases, a confer ace may be held aner the warrant discretion being exercised such structuiu of these tables generally takes

j escahted enforcement action is taken. that the NRC refrains from issuing a into account the gravity of the violation

Notice of Violation. (See Section VII.B,

VI.Enfamnt Actim Mitigation of Enforcement Sanctions.,,)

as a primary consideration and the

This section describes the in addition, licensees are not ordinarily ability to pay as a secondary

consideration. Generally, operations

.

enforcement sanctions available to the cited for violations resulting from

N 'C and specifies the conditions under matters not within their control, such as i""l'i"8 8 uct* ri 1

wlich each may be used. The basic d lal

i

equipment failures that were not [j c", to

i enforcement sanctions are Notices of -

p c : d licensee

Violation, civil penalties, and orders of avmdable

assurance by reasonable

measures or management licensee quality 'mPgf" recoghigher c

i.'

various types. As discussed further in

Section VI.D, related administrative

controls. Generally, however, licensus

are held responsible for the acts of their j' *

["* ' 8

• b I

8 '*

"'"*Y*****

actions such as Nctices of emplo . Accordingly,this policy

" " * ' nW nt t on

be construed to excuse

j Conf at Acti n s, tt f' per onne e 9g economic impact of a civil penalty be so

i

Reprimand, and Demands for severe that it puts a licensee out of

I

Information are used to supplement the B. Civil Penalty business (orders, rather than civil

! enforcement program. In selecting the A civil penalty is a monetary penalty Penalties, are used when the intent is to

j enforcement sanctions or administrative that may be imposed for violation of (1) activities)

t actions, the NRC will consider Su8 Pend or terminate licensed,s ab

certain specified licensing provisions of or adversely affects a licensee

enforcement actions taken by other the Atomic Energy Act or to safely conduct licensed activities.

Federal or State regulatory bodies supplementary NRC rules or orders: (2) The deterrent effect of civil penalties is

, having concurrent jurisdiction, such as any requirement for which a license best served when the amounts of the

e in transportation matters. Usually, may be revoked: or (3) reporting Penalties take into account a licensee's

-

whenever a violation of NRC requirements under section 206 of the ability to pay,in determining the

l requirements of more than a minor Energy Reorganization Act. Civil amount of civil penalties for licensees

for whom the tables do not reflect the

'

concern is identified, enforcement penalties are dosi ned to deter future

i action is taken. The nature and extent of violations both b the involved licensee ability to pay or the gravity of the

! the enforcement action is intended to as well as by oth r licensees conducting violation, the NRC will consider as

I reflect the seriousness of the violation similar activities and to em hasize the necessary an increase or decrease on a  ;

j involved. For the vast majority of case-by. case basis. Normally, if a

i violations, a Notice of Violation or a

need for licensees to identih violations licensee can demonstrate financial

j

and take prompt comprehensive ,

l

Notice of Nonconformance is the normal corrective action. hardship, the NRC will consider l

1 action. Civil penalties are considered for Payments over time, including interest,

i Severity Level III violations. In addition, ratbr than reducing the amount of the

A Notice of Violation

,

j civil penalties will normally be assessed civil penalty. However, where a licensee j

j A Notice of Violation is a written for Severity Level I and II violations and claims financial hardship, the licensee j

notice setting forth one or more knowing and conscious violations of the will normally be required to address i

i violations of a legally binding reporting requirements of section 206 of why it has sufficient resources to safely

requirement. The Notice of Violation the Energy Reorganization Act. conduct limnsed activities and pay

normally requires the recipient to Civil penalties are used to encourage license and inspection fees.

provide a written statement describing prompt identification and prompt and 2. Civil Penalty Assessment

(1) the reasons for the violation or, if l

.

' comprehensive correction of violations,

contested, the basis for disputing the to emphasize compliance in a manner In an effort to (1) emphasize the

violation

(2) corrective steps that have that deters future violations, and to importance of adherence to

i been taken and the results achieved: (3) serve to focus licensees' attention on requirements and (2) reinforce prompt

j corrective steps that will be taken to violations of significant regulatory - self-identification of problems and root

4 prevent recurrence; and (4) the date concern, causes and prompt and comprehensive

4 when full compliance will be achieved. Although management involvement, correction of violations, the NRC

The NRC may waive all or portions of direct or indirect,in a violation may reviews each proposed civil penalty on

! a written response to the extent relevant lead to an increase in the civil penalty, its own merits and, after considering all

information has already been provided the lack of management involvement relevant circumstances, may adjust the

i to the NRC in writing or documented in may not be used to mitigate a civil base civil penalties shown in Table 1A l

J

an NRC inspection report.The NRC may penalty. Allowing mitigation in the and 1B for Severity Level I, II, and III

require responses to Notices of Violation latter case could encourage the lack of violations as described below,

l

i

4

9 NUREG-1600

_ . . _ _ _ _ _ ._, ,__ _ _ _ - _ _ __ _, . _ .. _ .!