ML20082S937

Trip Rept:Onsite Analysis of Human Factors of Event at Waterford 3 on 910624 (Manual Reactor Trip W/Excess Steam Demand)

ML20082S937
Person / Time
Site:	Waterford
Issue date:	09/30/1991
From:	Michael Jones, Meyer O EG&G IDAHO, INC., IDAHO NATIONAL ENGINEERING & ENVIRONMENTAL LABORATORY
To:	Novack T, Spence R, Trager E NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
Shared Package
ML20082S924	List: ML20082S937
References
EGG-HFRU-9823, NUDOCS 9109180027
Download: ML20082S937 (23)

Text

.

LGG lif RU 9823 t

r 1 RIP REPORT:

ONS11E ANALYSIS OF illE IlUMAN FACTORS OF AN EVENT AT WATERf0RD 3 ON JUNE 24. 1991 t

(MANUAL REACTOR 1 RIP Wlill EXCESS STEAM DEMAND)

Orville Meyer Onsite Team:

Thomas Novak, NRC/AE00 Robert Spence, NRC/AE00 Eugene Trager *, NRC/AE00 Mark Jones, INEL Orville Meyer, INEL

• Team Leader i

Published September 1991 Idaho National Engineering Laboratory EG&G Idaho, Inc.

P. O. Box 1625 Idaho Falls, 10 83415 Prepared for the Office for the Analysis and Evaluation of Operational Data U.S. Nuclear Regulatory Commission Washir.gton, D.C.

20553 Under 00E Contract No. DE AC07-761D01570 9109100027 910911 PDR AI4lCK ObOOO* ag J

S f*DH

EXECUilVE

SUMMARY

The Office for the Analysis and Evaluation of Operational Data (AE00) of the U.S. Nuclear Regulatory Commission has initiated a program to study the human factors of operating events. As part of this program AE00 formed a team j

to conduct an onsite analysis of an event at the Waterford 3 nuclear j

generating station.

A lightning stiike at 11:19 a.m., June 24, 1991, on transmission lines near the station resulted in a trip of the main turbine and a reactor power cutback to approximately 35%, which is a design feature of the Combustion Engineering PWR at Waterford 3.

The operators stabilized the plant l

and were reducing power in order to stand by for inspection of the main f

switchyard when a startup feedwater regulating valve that was failed open caused an excessiva and increasing level in steam generator 2.

The operators j

manually scrammed the reactor and initiated a main steam isolation signal trip to prevent an excessive cooldown from a failed open steam bypass control valve f

(SBCV).

The onsite analysis focused on the activities of the control room and auxiliary operators during this event.

1he analysis was based on data from j

control room recorders and logs, plant computer data, interviews with the control room operators who were on duty during the event, the licensee's event analysis, and discussions with other station staff.

In addition, the training simulator was made available for a walk through/ talk-through review of the event with senior training staff members.

Idaho National Engineering Laboratory provided assistance as part of the AE00 program.

This event was characterized by two equipment failures after the reactor.

power cutback. One of six SBCVs failed open and the No. 2 startup feedwater regulating valve also failed open.

Both failures were caused by electronic control circuit failures that were probably caused by the lightning strike.

The failed open SBCV was detected by the crew since its fully open position l

was abnormal for operation at 20 35% power.

The failed open No. 2 startup feedwater regulating valve failure was not detected since its normal position

[

11

is fully open above ~22% power.

1he crew was manually closing the 5BCV, a slow process, and it was still nearly open when the reactor was scrammed.

As reactor power was reduced to ~20% steam flow from steam generator 2 becan.e greater than feed flow through the open startup feedwater regulating valve.

Steam flow /feedflow mismatch alarms occurred intermittently.

The operators attempted to close the valve with the manual control switch but it did not respond due to the control circuit failure.

The operators manually scrammed the reactor in anticipation of an automatic scram from high level in steam generator 2.

The open SBCV was causing a rapid cooldown of the reactor coolant system and the crew initiated a main steam isolation signal trip to overcome this. The crew stabilized the plant using the atmospheric dump valves and emergency feedwater to remove decay heat.

Good teamwork by the control room and auxiliary operators resulted in effer.tive and timely response during this event.

The control room crew credited a recent 4-day refresher training session that they had just completed.

This training had included four hours per day of simulator exercises among which were reactor power cutbacks and excess steam demand scenarios.

The setting of the steam generator high level clarm at 87.6% allows almost no time for operators to respond since the steam generator higb level scram setpoint is 87.7%.

Since the normal steam generator levels are 60 70%,

a lower setpoint for the alarm could provide more time for operator actions in lieu of a manual scram.

Some data channels from the plant computer appeared to be invalid.

However, these d.d not include the data supplied to the Safety Parameter Data

System, iii

... _ ~ _ _ _ _. _ _ _. _ _ _ _... - -. _..___._. _.

l t

ACLNOWl.lDGlMLHIS We express appreciation to the Waterford 3 staff for providing the Information necessary to analyze the human factors of this operating event.

We particularly thank the operators who were on duty during the event for their cooperation during the interviews.

j l

b I

t

?

i i

i

[

k

'6 i

k f

F k

i t

?

6 i

iv i

i I

.,-_,:_.,._~,,.--.,-,.,,.-_-.-.,,.,,,,.,,,,

_.,,.,_.n.--,-.--,_,.,,.,,,,,--

CONTENTS EXECU11VE SUKMARY...................................................

11 ACKNOWLEDGEMENTS....................................................

iv ACRONYMS............................................................

Vi 1.

INTRODUCTION...................................................

I 1.1 Purpose...................................................

I 1.2 Scope.....................................................

I 1.3 Onsite Analysis...........................................

I 2.

DESCRIPil0N OF THE EVENT ANALYSIS..............................

3 2.1 Background................................................

3 2.2 Time Line of the Event....................................

7 2.3 Analysis..................................................

13 i

2.3.1 Teamwork (Command, Control,andCommunication).....

13 2.3.2 Training...........................................

14 2.3.3 Man machine Interface..............................

15 2.3.1 Plant Computer Data................................

15 2.3.5 Event Reports from Operators.......................

16 3.

SUKKARY OF THE HUKAN FACTORS OF THE EVENT.......................

17 FIGURES 1.

Waterford 3 control room crew structure........................

4 2.

Steam generator parameters......................................

6 v

-m,-----_---,-,---_-----

---

m ACRONYMS ADV atmospheric dump valve A[0D Office for the Analysis and Evaluation of Operational Data COLSS Core Operating Limiting Supervisory System EFAS emergency feedwater actuation system EfW emergency feedwater FW feedwater INCL Idaho National Engineering Labaratory HFWP main feedwater pump HSIS main steam isolation signal NR narrow rr ge NRC Nuclear Regulatory Commission PWR pressurized water reactor l

RAB reactor auxiliary building RCS reactor coolant system RPCS reactor power cutback system

)

SBCS steam bypass control system SBCV steam bypass control valve SG steam generator SGLC steam generator level control SI safety injection SPDS Safety Parameter Data System l

SUFWRV-startuo feedwater regulating valve Tavg average RCS temperature TB turbine building WR wide range vi

l.

IN1RODUC110N 1.1 htrMit The Office for the Analysis and Evaluation of Operational Data ME00) of the U.S. Nuclear Regulatory Commission (NRC) has initiated a program to study the human factors of operating events. As part of this program AE00 formed a team to conduct an onsite analysis of an event at the Waterford 3 nuclear generating station.

A lightning strike at 11:19 a.m., June 24, 1991, on transmission lines near the station resulted in a trip of the main turbine and a reactor power cutback to approximately 35%.

The operators stabilized the plant and were reducing power in order to standby for inspection of the main switchyard when a startup feedwater regulating valve (SUFWRV) failed open, causing an excessive and increasing level in steam generator (SG) 2.

The operators manually scrammed the reactor and initiated a main steam isolation signal (MSIS) trip to prevent an excessive cooldown from a failed open steam bypass control valve (SBCV).

1.2 Sun The onsite analysis focused on the activities of the control room operators during this event.

The analysis was based on data from control room recorders and logs, plant computer data, interviews with the control room and auxiliary operators who were on duty during the event, the licensee's event Feport, and discussions with other station staff.

In addition, the training simulator was made available for a walk through/ talk-through review of the event with senior training staff members.

Idaho National Engineering Laboratory (INEL) provided assistance as part of the AE00 progrnm.

1.3 Onsite Analysis The onsite analysis team consisted of Thomas Novak, NRC/AE00 Robert Spence, NRC/AE00 1

is ii s ui mi Eugene Trager, NRC/AEOD (team leader)

Mark Jones, INEL Orville Meyer, INEL.

The team was at the Waterford 3 site on July 1 and 2, 1991, 2

2.

OLSCRIP110N OF THE LVLlil Af4ALYSIS 2.1 ILHhSEDMd The Waterford 3 nuclear generating station is on the Mississippi River l

about 30 miles upstrnm from New Orleans, Louisiana, and is operated by the

[

Energy Corporation.

The nuclear steam supply system is a Combustion Engineering, Inc., 2 loop pressurized water reactor (PWR) with a nominal rating of 1100 MWe, The station entered commercial operation in September 1985.

The control room crew structure is illustrated in figure 1.

The operators had changed to 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> shifts after the end of the last refueling several weeks before this event.

The crew on duty during this event had been on a 4-day, 10 hour1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> per day training assignment, and this was their first day back on control room duty.

On the morning of June 24, 1991, the Waterford 3 station was online with the reactor at 100% power and 560 equivalent full power hours since the last t GJeling outage.

A thunderstorm was taking place a few miles from the station, as is conmon in the area during summer.

At 11:19 a.m., a lighting strike on the transmission lines caused a trip of the main generator breakers and of the main turbine stop valves.

As designed, this resulted in a reactor power cutback, which is a design feature unique to some of the Combustion Engineering reactors.

The reactor power cutback system (RPCS) dropped control rod groups 5 and 6 into the core to reduce power rapidly and the steam bypass control system (SBCS) opened all six of the SBCVs to limit the SG pressure rise.

Reactor power was reduced to ~35% when the operators inserted control l

rod group 4 to stabilize the plant.

L i

+

3 L

f f

figure 1.

Waterford 3 control room crew structure.

l V~l Shifttechgical Shift supervisor advisor Emergency i

C communicator i

b Control room supervisor i

L_. _

I l

Primarynuclea8 plant operator 'e Secondarynucigg plant-operator

(

i Nuclear auxiliary operator (NAO) complement:

j Turbine building (1B)

Reactor auxiliary building (RAB)-(2)C Outside Unassigned NA0

}

a.

Each STA is assigned to a control room shift crew and receives the l

same training b.

Senior reactor operator c.

Upon declaration of an unusual' event one RAB NA0 goes to the control l

room to assist the SS in notifications to outside authorities j

d.

Reactor operator.

l e.

NP0s alternate astignments on successive days.

5 I

4 l

i g

+

+-e9-

.w r-9

--.g-p.

_m p,

L.4

-.,9 y

ipp..-=p,..yy...p pg,,

7.gwp.,em,.97p

,,,m.-4mp,.,.-em p

g..y--..--,

,c.g

lhe shif t supervisor directed the operators to reduce power to about 7S*.

and standby to put the main generator back online af ter electricians completed an inspection of the high voltage switchyard.

About two hours later the reactor power was -25% and decreasing very slowly due to xenon buildup.

The control room operators had just received confirmation from the turbine building (18) nuclear auxiliary operator that one of the six SBCVs was failed open.

The secondary nuclear plant operator noted that the level in SG 2 was abnormally high (77%) and rising rapidly.

The No. 2 SUfWRV was fully open and would not respond to attempts to close it using the manual control switen.

The shift supervisor directed that the reactor be manually tripped in anticipation of an automatic trip from the high level in SG 2.

The SG pressure dropped rapidly af ter the reactor trip due to the f ailed open SBCV and the continued feedwater flow from the failed open No. 2 SUfWRV.

The shif t supervisor ordered a manual initiation of the main steam isolation signal.

The No. 2 TW isolation valve closed because of a high level trip at 96% on SG 2 wide range (WR) level instrument.

These two actions terminated the cooldown and the level rise in SG 2.

The data in figure 2 indicate that the No. 1 SUfWRV was closed prior to the reactor trip for reasons that could not be determined.

The operators did not recall closing it.

The operatirs limited the heatup of the reactor coolant system and rer-decay heat Lv venting steam from the SGs through the atmospheric d' aves (ADVs) and by supplyirg FW from the condensate storage tank thr e emergency feedwater (EfW) systems.

Cooldown limits on the reactor coo. ant system were not exceeded and the pressurizer pressure did not decrease enough to initiate safety injection (SI).

The maintenance that followed determined that failures occurred in the control circuit for the No. 2 SVfWRV and in the control circuit for the recirculation flow control valve for main feedwater pump (HfWP) A.

This had caused the recirculation flow control valve to repeatedly open and slam shut, which vibrated the nearby SBCV sufficiently to disconnect the position feedback linkage on the SBCV.

Both circuit failures were attributed to the lightning strike.

5 l

e 6

4 I

10' SG #2 level (NR) 8 l

\\

+*

60'

\\

t

/,

\\

\\

l f'

1

\\,.

y l

v t

3 10<

i i

f h

i i

lict, time of reactor trip 1090-1040' 6;

10f0<

.1060 V

10$0<

iO40<

SG pressures t

I030<

--~'~~~~w,,,,

iot0 1010'

~

1000' 990<

- we, i-U 910' 960<

990' l 940' 930<

tre.

$ til-tot <

090' 000' 910<

660<

'\\

M gg.

940<

030<

16 61 f(to

$6 et rtt0

$6 #1 st(M

$6 et situ l

6.r.

/,/,.'. SG #2 feed l

- j..

/

3, n

^,,'y

..........******.?

+..,..,=

e s

.. ),, 'l

,e l;

4A M~..SG#2 steam si

.$*,(~~

y L_

SG #1 feed i,

l l

1

• h,h 300! 210 140 210 180 150 120 090 060 030 +000 *010 +060 +090 ello *150 *190 Iln(t%CC)

Figure 2, Steam generator parameters a

2.2 11t1LU.0L91.1hLLini 2.2.1 6/l431 11:19 a.m.

Reactor was at 100% power with main generator online.

The shift supervisor was in his office.

The control room supervisor, the primary nuclear plant operator, and the secondary nuclear plant operator were at their stations in the control room.

A thunderstorm was in progress near the plant but the control room crew was not aware of this (thunderstorms are a typical daily event in summer).

The control room crew and the shift supervisor heard a loud " thump" (from closure of turbine stop valves) and noted that the control room lights dimmed momentarily.

The shift supervisor entered the control room.

The control room crew noted that groups 5 and 6 control rods had inserted and that two SBCVs were open and the remaining four were partially opened and modulati.g.

The open position of the main generator breaker confirmed the crew's diagnosis that the main turbine had tripped, which had initiated a reactor power cutback.

Trip flags were observed on two high pressure protection relays for the main transformer.

Reactor power had been reduced to

~35%.

11:25 a.m.

The primary nuclear plant operator expected to see rod group 4 automatically inserted but then remembered that normal plant policy-is to leave _ the control in manual.

Therefore, he inserted rod group 4 approximately 15 in, to reduce reactor coolant system (RCS) average temperature (Tavg) to the programmed value and to stabilize reactor power at -35% and switched to automatic sequence control 7

h e

of the regulating rods.

The SBCVs were left on automatic l

control to maintain SG pressure at the control setpoint of f

-1020 psig.

i i

The shift technical advisor pulled out off normal l

e procedure OP 901 003, " Reactor Power Cutback," and gave it to the control room supervisor.

i The control room supervisor checked the Technical Specifications and found that the rod groups 5 and 6, which had been inserted by the reactor power cutback, were-l required to be withdrawn to their programmed position

.within two hours.

i (Control room activities 'during this 1% hour period are

-l

-11:38 a.m. -

1:08 p.m.

categorized below as to the type of task since the exact i

sequences are not critical for an understanding of the j

human factors.

Task loading for control room operators I

was moderately heavy durir.g-this time interval.)

1 Regulating. rod groups 4, 5, and 6 were withdrawn to_their j

normal programmed position with Tavg _ held nearly consttnt by boric acid addition. The action statement in the j

Technical Specifications was-exited. Reactor power was i

stabilized at ~35%.

-Information was received'from Southern Control of_ Entergy-Corporation-(electrical network control) that the j

generator trip had been caused by a lightning strike on j

transmission lines near the Waterford 3 high voltage-

' switchyard.

Southern Control 1 stated that an: inspection of the Waterford.3. switchyard and transmission line would l

require two or three hours and requested that Waterford.3 j

remain at low power and b'e prepared to place the main j

i 8

i I

l

l t

t t

generator back online after the inspection.

A plant

(

-management conference convened in the shift supervisors office and in the rear of the control room.

it was decided to remain at reduced power and be prepared to f

return to full power online.

The shift supervisor directed the control room supervisor to reduce power to i

~25% but stay on automatic feedwater regulating valve l

control.

This would conserve reactor core life and reduce erosion of the condenser tubes by steam dumping.

l 5

TheTBandreactorauxiliarybuilding(RAB) nuclear y

auxiliary operators had heard the main turbine valves close: and began their rounds of local surveillance and f

control _as for a reactor trip but discontinued this when j

they noted it the SBCVs were modulating, which indicated

'f that the reactor was still at power.

(No announcement was made from the control rcom to the local-operators concerning the reactor power cutback).

[

i The contiol room operators-noted that condensate header pressure and MfWP A flow was_ somewhat unstable and that SBCV MS 320A had remained wide open while the other five I

SBCVs were modulating; The TB nuclear auxiliary operator j

was directed to investigate MfWP A conditions. He_

l reported to the control _ room supervisor that the recirculation flow control _ valve was cycling (slamming) i from full open to full closed.

He also reported the control air copper tubing to_ SBCV MS 320A had a loose -

1 fitting and was leaking - At 1:08 p.m., the shift _

f supervisor directed the control room supervisor-to have--

'I the SBCV MS-320A manually closed and to secure MFWP A.

f (Manual closure of SBCV MS-320A is a strenuous operatinn with a wrench and takes ~ 20 min).

9 h

A failed electronic control card was later found to have e-caused the cycling of the MFW pump A recirculation control valve.

The mechanical position feedback linhge to the pneumatic positioner for SBCV MS 320A failed and became completely disconnected.

it was postulated that the control card had been damaged by the lightning strike and that the slamming of the recirculation flow control valve had caused sufficient vibration through shared foundations to fail the linkage on SBCV MS 320A.

Per direction of the shift supervisor and the control room supervisor the primary nuclear plant operator slowly reduced power by boration.

(ThistendstoreduceTavgand SG-pressure.

The automatic control of the SBCVs responds 1

to. hold SG pressure constant by reducing the degree of

-openingoftheSBCVs.) At 1:08 p.m. the reactor power was

~25%, but tending to decrease from the buildup of xenon caused by the reduction in reactor power from 100% to s

~25%.

The operators were aware that power should be kept above 15% to avoid calibration errors in the Co n Operating Limits Supervisory System (COLSS) a 6 that at

~20% the auto steam generator level controls (SGLCs) would close the MFW regulating valves and start closing the startup valves.

The secondary nuclear plant operator had noticed an

- apparent swell in water -level of SG 2 from ~68% to ~80%

with no-apparent cause. After SBCV MS 320A was'found to have failed open, he postulated that this may have been the cause.

(It may have been caused by control rod withdrawal. )

10

SG 2 steam flow / feed flow mismatch intermittent alarms 1:04 -

+

1:08 received.

Alarm was on for 1 to 4 seconds, cleared, and then repeated at 10. to 60 second intervals. The steam flow /feedflow mismatch alarms were valid but attributed by the operators to calibration tolerances since steam and feed flow instrument errors become relatively larger as power level is reduced.

+

- The primary nuclear plaat operator temporarily turned over 1:08 -

1:15 his duties to the secondary nuclear plant operator to go to the control room operators restroom (the restroom door opens directly into the control room). The secondary

- nuclear plant operator made entries in the control room log to bring it up to date.

The_ strip char _t recordings indicatea the level in SG 2 rose from 72% at 1:10 p.m. to -86% at.:15 p.m.

Intermittent SG 2 steam flow / feed flow mismatch alarms continued..The secondary nuclear _ plant operator discontinued log entries at the' desk and walked to the control panel to check secondary plant conditions and noted that the SG 2-level was at 77% and increasing at a very abnormal _ rate and that the-No. 2 SUfWRV was fully open. He reported this to the shift supervisor. The shift supervisor called for the primary nuclear plant operator to return to the control room-at once and directed that the No. 2 SUFWRV be closed. The No. 2 main FW regulating' valve was indicating closed.

The secondary nuclear plant operator put-the control mode for the No. 2 SVfWRV in manual and attempted to close the valve, but it did not respond..(During corrective maintenance after the scram a failed electronics card in 11

,,,y,y

.-c,.

_,4%-,,,v3.--y, o.--.

..,w 3.o,..,-r_.-e,_.,

e

-,~.-3-,~.m.,---._-+,

,.w-w,

--w-.m..e.--owe-cr,i ww.,,,ew-re.,-w,

the position control circuit for the valve was found to have failed.)

Data recorded by the plant computer showed that the No. 1 SUfWRV was closed at this time, but the operators did not recall closing it.

The shift supervisor observed that high level alarms were 1:15 -

+

1:16 p.m.

present on three of the four SG 2 narrow range (NR) level channels.

The shift supervisor directed that a manual i

reactor trip be initiated in anticipation of a reactor trip from the high SG 2 level.

(The high level alarm setpoint is a nominal 87.6% on SG level and high level reactor trip setpoint is a nominal 87.7%.)

,li The reactor trip is interlocked to initiate a closure of ll

+

the main FW regulating valves and to reduce flow through t;

the SUfWRVs to approximately 7%.

The main FW regulating lf valves were already shut before the trip. The No.1 SUfWRV responded correctly.

The No. 2 SUfWRV remained fully open.

SG 2 WR level reached 96%, which initiated an automatic

+

closure of the FW isolation valve for SG 2, and it ramped shut in ~30 seconds, stopping all FW to SG 2.

SG pressures were observed to be below 900 psig and 1:17 ;1.m.

+

decreasing rapidly.

The shift supervisor directed that MSIS be initiated manually.

The primary nuclear plant operator initiated the MSIS and the MSIVs closed.

(The reactor trip with one SBCV f ailed open and the SUfWRV for SG 2 failed open had created an excessive cooldown rate in the reactor coolant system.)

The control room supervisor entered Op-902-004, " Excess 1:20 p.m.

Steam Demand."

12

With both MSIVs shut and no fW flow to either SG, the RCS temperatures and SG pressures stabilized and began to rise at a moderate rate.

(The temperature increase was later controlled by the control room operators by dumping steam through the ADVs.)

The shift supervisor declared an Unusual Event.

1:24 p.m.

Emergency feedwater actuation system No.1 (EFAS 1) was 1:32 p.m.

manually initiated to supply EfW flow to SG 1.

The SG 2 level was still abnormally high but stable, i

EFAS-2 was manually initiated for EfW to SG 2.

2:24 p.m.

l 2.3 Analysis 2.3.1 Teamwork (Cp_mmand. Corttrol and Communications)

The response of the operators was effective and timely following the high level alanns on SG 2.

The control room operators responded to the rising level in SG 2 and took the appropriate action by manually tripping the reactor since there was insufficient time to take any other effective action.

(The No. 2 SUfWRV would not respond to the manual close switch and its motor operated isolation valve has a two-minute stroke time).

The control room operators responded to the rapid cooldown rate by manual initiating the HSIS.

This not only stopped the cooldown but prevented a possible further rise of level in SG 2 from causing water to enter the main steam lines.

Both manual initiations-anticipated automatic trips since high SG 2 level would trip the reactor and low SG orewures would initiate the HSIS.

Task sharing and communications among co trol room operators and among nuclear auxiliary operators took place in several instances, and communications from the nuclear auxiliary operators to the control room provided the control room with significant information.

However, it would have been appropriate to brief the nuclear auxiliary operators by loudspeaker 13 i

i

and radio on the fact that a main turbine trip had taken place with the reactor cutback reducing reactor power to 35% and that a return to full power within hours was expected.

Emergency and abnormal procedures were pulled by the shift technical advisor and given to the control room supervisor and entered and exited at the correct times. However, the timely response of the control room operators was based primarily upon their knowledge and training in procedures and operating principles.

It was noted that the abnormal procedures that were entered such as for abnormal SG water level control do not provide much direction for corrective action.

The symptoms of the failed open No. 2 SVfWRV became evident to the operators only when the level in SG 2 was already excessively high.

Since flow through the fully open valve is ~22% the open valve would be normal above ~22% reactor power. As reactor power and steam flow were slowly decreased, and the main fW regulating valve shut, the steam flow became less than the feed flow through the startup FW regulating valve.

However, the shrink effect of the excess FW flow must have been significant because SG 2 level did not rise immediately and the recorded data shows it nearly constant four to five minutes before the reactor trip.

The excess FW flow was causing intermittent alarms on the SG 2 steam flow / feed flow mismatch; however these alarms are not uncommon at lower powers because of the decre*ased accuracies v steam flow and feed flow instruments at low powers.

The alarm printout showed that the SG 2 steam flow / feed flow mismatch alarm was actually cleared during the two minutes before the reactor trip. When the shrink effect on SG 2 level was overcome by the reactor heat, the rise in SG 2 level was rapid and it rose from 70% to 86% in four minutes.

2.3.2 Inlaing Waterford 3 is a single unit plant with a dedicated, plant specific simulator.

This control room crew had just completed 4 days of refresher training with four hours / day of simulator exercises.

This was their first day 14

l i

i i

back on control room duty.

The simulator exercises had included both reactor power cutback events and excess steam demand events.

All the operators I

expressed their opinions that the simulator training had directly benefitted and supported them during the event, j

i The simulator training instructors attempted to program the simulator to j

duplicate this event for purposes of this analysis.

It was not possible to do l'

this in detail in the limited time avaliable between scheduled training periods.

2.3.3 liandard)ine inigdats i

The indicators on the control panels in U.S. nuclear power reactors cannot be closely monitored for abnormal levels or trends by an operator who stays in one position.

The annunciators are intended to assist the operator by providing an alarm if a parameter is at a level that calls for diagnosis and probable action by the operator.

However, there should be time remaining for diagnosis and action af ter the alarm.

The SG high level alarms at Waterford 3 are set at a nominal 87.6% NR.

The reactor trips are set at a nominal 87.7% NR.

The normal levels for the SG are 60% NR in automatic and 60 to 70% NR in manual.

Reducing the alarm setpoints to 75 to 80% would provide the operators with additional time to take actions to prevent a manual reactor trip.

2.3.4 IWutL(mnsdat_1)111 i

The plant computer provided data on the major parameters involved in this event.

llowever, the validity of some of the data was questionable.

The data could not be reconciled with other data such as from the events recorder, the l

time base was not established, and the SG 1 NR level was straight lined.

Reactor power data was not available from the plant computer and the reactor power strip chart was of low resolution both for time and power level.

The i

plant computer provides data to the Safety Parameter Data System (SpDS);

however the data channels to the SPDS appeared valid.

The validity of plant computer data is also relevant to the Technical Support Center and the future 15

[

v' NRC Data link and these data users will be interested in more parameters than j

the minimum set of safety parameters supplied to the SPOS.

Resolution of the data validity from the Waterford 3 computer is planned to be worked during the next shutdown.

i 2.3.5 Event ReE2I13 from Oncrators i

The event reporting procedures at Waterford 3 provide for individual l

written statements from each operator and for a summation of the operators information on the event. Ilowever, the individual statements are optional and l

were not requested of the operators after this event. Although no significant information appeared to be overlooked by omitting the individual statements, there is this potential when only a joint statement from the crew is requested.

U.S. Air Force Guide to Mishan Investiaation AFP 1271, Vol.1, May

[

1987, strongly recommends that individual statements be taken first and conflicting observations resolved secondly. The consensus process of i

developing a group statement may submerge or omit observations by a single individual that are actually valid and relevant.

I I

i f

16 t

3 y,-

w-m--

m 7-

-c.-

--,t

-,w.,

4 m

~m-

---w-

p 3.

SUMMARY

Of THE HUMAN FACTORS OF THE EVENT Teamwork by the operators resulted in effective and timely response after the SG 2 high level alarm.

Task allocation and communication among control room operators and auxiliary operators was responsive and adaptive to tha event sequence.

Procedures were used by the operators as applicable, but the operators response was based pricarily on knowledge and training.

The operators credited the recent 4-day refresher training that the control room crew had just enmpleted.

In particular, the operators recalled simulator exercises involving reactor power cutback and excess steam demand during the event.

The SG high lovel alarm setpoint of 87.6% appeared to be unnecessarily close to the high level scram setpoint of 87.7%.

The normal operating level is 60 to 70%.

Some data from the plant computer appeared invalid but these data points did not involve the SPDS.

i 17 l

I l'