ML20154A796

Power Reactor EVENTS.July-August 1987

ML20154A796
Person / Time
Issue date:	08/31/1988
From:	NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
References
NUREG-BR-0051, NUREG-BR-0051-V09-N4, NUREG-BR-51, NUREG-BR-51-V9-N4, NUDOCS 8809130097
Download: ML20154A796 (61)

Text

_

NUREG/BR-0051 Vol. 9, No. 4

f. -..s, fg4/ POWER REACTOR EVEhTS

• %,e..e e United States Nuclear Regulatory Commission Date Published: AUGUST 1988 Pcwer Reamer Eveats is a bi monthly neAs!etter that compdes operating esper.ence information about commercial nuc! ear poAer pl ants. This meludes summaries of noteAorthy events and listings and or abstrac's of UsNRC and other documents that d,scuss sa'ety.related or possible generic issues. It is intended to food back some of the lessons learred from operatonal esperience to the varcus p' ant personnel, te.,, managers. bconsed reactor operators, training coord.nators, and support personnel. Ref erenced doeurrents are ava. lab'e in the UsNRC Pub!'c Document Room at 1717 H street, Wash;ngton, D.C. 20555 for pub'c inspection and'or copyicg.

Subscriptioris of Pewer ResetetM mcy be requested from the Superin'ondent of Documents, P.O. Box 37032 U.S. Government j Print ng 0+f ce, Wash.ngton, D.C. 20402, or by calhng (202) 783 3238.

1 l

Table of Contents

} Page 10 SUkfkfAR:ES OF EVENTS . . .. . .. . . . 1 1.1 Steam Generator Tube R4ture at North Anna Umt 1. . . 1 1.2 Fau.ty S00KV Corev1 Breakor Leads to Loss o!Non Emegency AC Poser at Cakert Cl,ffs Un.1s 1 and 2 . . . 2 1.3 Startup Transformer Fa:Iure Causes Loss of Ct' site Poser at Palsades . 4 l

1.4 Rea: tor Scra'n Due to Fa:!are of Ata:n Generator kfJnual Votape Regalator Boa'd Trans'stors at Brunssuk Un.11 . 7 1.5 \ Vater Intrusion into Inst'ument A;r System at Ft. Ca houn . t0 1.6 kla:n Steam iso!aton Vahes Open \Ythout Trp Poset Ava;:3b!e at Point Bea:h Unn 2 . . . . . 12

1. 7 Incperab:e Sen ce \ Vater Sp stem at Ca"as ay . . . . . 16 1.8 Polarences . . . . . 20 20 EX CERPTS OF SELEC(ED LICENSEE EVENT REPORTS . . 21 30 ABS TRAC TS LIS TINGS OF O THER NRC OPER A TING EXPER:ENCE DOCUkfENTS , 47 31 AbnormalO:currence Reports (NUREG 0030) 47 32 Bat'etts andInformaten Not:ces . . . 49 33 Case Stad:es and Eng:neering Evahvat.ons . . $1 34 Genen'c L enon . . . .. $$

3$ NRC Document Comp ations $9 Published by:

j Office for Analysis and Evaluation of Operational Data U.S. Nuclear Regulatory Commission I Washington, D.C. 20555 Pened Covered: July-August 1987 t

8009130097 000831 PDR NUHEQ DR-OOS1 R PDR L

I l

The mitaittad marmecript has been authorest by a contractor of the U.S.

Government urder cartract No. IE 840R21400. Accordingly, the U.S.Governnant utains a nonaxclusive, royalty-free license to publish or reproduce the published form of this contribution, or allow @tw to do so, for U.S.Goveniment purposes.

l l

l

)

l The events iJcitdal in this twort were selectal by the NRC Office for Amlysis ant Evaltativn of Cparatiani Ihta (AI:00). The report was pregured for AIDD, tuder contact PD1 R451, by:

G. A.M.lghy and W.E.Fehn Nuclear Operations Aralysis Center l CEtk Rid)e Natioral Iaboratory '

GJ: Ridge, TN 37831

l 1.0 SU!NARIES OF EVE 2 TIS 1.1 Stem Gererator 7\io Runture at North Anm 1 At apptrximtcly 6:30 a.m. on July 15, 1987, North Anm Unit 1* was at 100%

pcstr ard Unit 2 at 81% pcher in an end of cycle po.tr coastdcun. A high radiation alam kus rccoivcd on the Unit I stem gemrator C min steam lino.

At the care tiro, pressurizer level and pressuru ttgan to dccrease rapidly.

At 6:35 a.m. , with pressurizer level at aFproximtoly 45t (norm 1 level is 65%) and pressure at 2100 poig (norml cperatin] pressure is 2235 poig), Unit 1 kus mnually trippod. Arproximtely 20 scoonds later, an autcratic actuation of the rafety injection syston occurrcd due to lcu-Icv pressurizer pressure (less than 1765 poig on 2 cut of 3 channels) . Iry 6:48 a.m. , the C j steam generator kun identificd as having pooltive inlication of tuto rupture.

A 13ctification of Unustal Event kus doclartd at 6:39 a.m. ard notifications to l stato ard 1ccal gcrecITrents wero ccrpleted by 6:51 a.m. '1ho event was )

upgradcd to an Alert at 6:54 a.m. and the notifications to all off-site agercies and the !?acicar Regulatory Ctruission (lmc) kuro ctrpletcd by 7'02 ,

I a.m. An orderly cccidcun ard depressurization of the reactor coolant system

)

to cold shutdcun corditions sus initiatni at 7:18 a.m. and the e crycncy was temimttd at 1:36 p.m.

1 Prior to the event, the condenser air ejcctor radiatien renitor, R!-RS-121 was dcelarcd incterable due to crratic cycration. This radiation nonitor I stuld have prwidcd a sigm1 to divert the condensor air ejector fic% fim the atnrrhere to the contain:ent tuilding had it toen coerable and M itJ highest notpoint had toen excocdcd. lio other safety-relatcd cqaipTnt kus cut of service at the tire of the event. All other rafety-relatcd cqair- ,

perfomxi as exroctcd.

Several radiolcgical release pTths to the enviretrent were present durin3 this event. The cordcnser air ejcctor discharycd to atnxThere until it was mnually divertal to the contairrent tuildin3 at 7:56 a.m. The steam driven auxiliary fcManter prp,1-IV-P-2, startal on the safety injcction sigml ard j its steam supply f tm tho C. stcan generator was isolatcd frm the turWne driven auxiliary prp at approximtely 6:48 a.m. A ninor rtleaco path existed h when two relief valves, em on the B min fcManter pu p six. tion and cne on the tube side of the 2A fced.nter heater, liftod and did not rescat when prersare had retumcd to nom 11. An cperator mntully adjustal the reli3f valve retroints to allcv then to c1cco, which was ctrpletcd etcut 30 ninutes into the event.

Amlysis of *;ho radiolcgical chta indicatcd that a total of 1.59 X 10-1 curies kus relcared, primrily in the fem of gas. There sus na dotcctable ircreare in nomil bTck7rcuni levels of Indicactivity at the sito toun1117

• !;crth Anm Unit 1 is a 907 !Ne (net) !O2 Westin3 cure h pWR Iccatcd 40 miles northwest of Rich crd, Virginia, ani is creratcd by Virginia Elcctric and Itur.

1 l

(

After the omrycncy kan temimttd at 1:36 p.m. , the recovery phase of the encrycncy plan was initiatcd. An ircyrction of Unit I stcan gemrator tubes kus rcrformd to detomim the lccation ard root cause of the n:pturcd tubo, ard to prwido the informtion nealcd to take necessary corrective action.

An evaluation of this event has shcun that the conscquences of the stcan gemrator tube rupture event were boun3cd by tho amlysis contairni in the '

Fiml Safety Amlysis Report. In tema of public health concoquences, the event had rc cf fcet. Coro therm 1 mrgins ard shutdcun mryins kero not tal fuel integrity sus rot ccrprmiscd.

l Subocquent investigation revealed that tubo nu: tor ID-C51 of stcan generator l C rupturcd. Amlysis detemincd that the failuro sus the tr. cult of fics j injuced vibration. A total of 253 tubes in all throo steam generatern kero I p1trncd during the crc. in) plant cutago, Idiitiomi reasures to detcct j failin] stcan generator tutes were irplemnted. Them ircluded imtallation of U-1C ronitors on the socordry side, cetimtin] primry-to-reconiuy leakago every four hours, ard treJding Icakago rates. Plant shutdesn sus set at conservativo limits tolcv that rrquirul by the Tcchnical Spccifications, i Fbro detailoj infomitien is available in Refercrces 2 thrm3h 5.

i 1.2 Faulty 500FN Cirnlit Preabr Icain to Iron of Non-emmonW AC I\ser at '

Calvert Cilf fs Units 1 anij l

l On July 23, 1937, Ca) vert Cliffs Unit 1 ard Unit 2 were cycrating at 100%

pcstr. At 3:25 p.n. a rhTse-toground fault develcpcd on rhvo C on one of two 500FN trancaission lines conncctirn Calvert Clif fs to the Iultimre cas &

Elcctric (IC&E) tulk Fuer distritution grid at Waugh Ourel Station. The fault devolcral when a trm ca o in contact with the trarmission lino.

Circuit breakers for the line at Kau3h Curel ani Cnivert Cliffs trirrai cycn to isolate the fault. At arcut the care tim the cirruit brcakern at Calycrt Cliffs for the other 500)N trarcmincion lino inxrrcctly trirral upon sensin3 the fault. A defcetivo Icgic cirulit cant in the primry static protcctivo relay cirruit allcstd the primry relays to trip the cirruit breakers at Calvert Cliffs decpite the abocam of a remiusivo sigml to trip frm asscciate:1 relays at Wau3h Ourel . The cirulit brmkers at Waugh Ourcl rmiirni c'cm3, as dcsigral, af ter sensinj that the fault was on another i trarmissicm iine, d

The c$cninj of cittuit breakers on loth 500)N traredssico lires isolatcd Calvert Cliffs frm the rest of tho $mr grid. Ibth Unit 1 ani Unit 2 tri rai f on lees of Icud follcsui irmliately by a 1ccs of all non-crcryeny ac Fscr. All thrco emnjcncy diccol gemratorn (ED3) sta-tcd autcmtically on ITecipt of an un-lcrvoltaJo sigml on the enjincerut cafety features 4)N tums. 1 II1311 anj 21 autcmtically cmryi:cd 4)N tunes 11 and 24 recFetively, while 1 ED3 12 kus solcetai by the crerators to encryizo 4}N bus 14. ib alyrrpriate ereryercy creratin) prtentures sure initiatcd on teth units to place the plants in a stable condition. Natural circulatien kus cicervcd on toth reactors.

At 3:30 p.m., an Alert coniition kus dcelarcd to assist in the recovery frm Ices of all off-site elcctrical Fstr. The alert conlition sus dxnJradcd at 2

f

i l

l l

5:00 p.m. to an Unusual Event after ocrpletion of a chcck of the 500hV switchyard. At 5:23 p.n., altermte off-sito cloctrical pcAcr was catablichcd to en)incercd rafcty fcatures 4hv bus 21 frun the Southem Ku'y1and Eloctric Cocperativo (SPICD) 13hv line. Establich-ent of this pcAcr sourco kan delaycd due to a trip of the SFICD circuit breaker at their 69KV/13hv subotation while the cocrators were initially crorgizin) the unicadcd 13hV/4hv transformer.

AlthcuJh the exact cause of the brt.aker trip is unkrom, cycrators failcd to cpen the kurchcmo breaker off of the SFICO lino, as requircd in the croratiny instructiom. 7ho varchcuso breaker kns rnbccquently cpencd and the EMECD lino was reemrgizcd and power was brcuJht to the 4hv tus without incident. A review of the cperation and design of the SMECD lino kus initiattd. ,

1 I I At 7:10 p.m., norml off-sito electrical pAer was roescablished to the 500hV/13hv cervice transf amcrs. Cycrators then restorcd the norml olcctrical lineup for both units. At 10:10 p.m., the Unustal 't. vent kus tcrnimttd khen forocd circulation in both reactors bus restorcd at about 8:45 p.m.

Unit 2 kus retumcd to service and pirallolcd to the pcAur grid at 8:55 a.m.

the rat day. Restoration of Unit I was delayed because the 11A reactor coolant prp (RCP) rotor failcd af ter atterptcd restart after the trip. Cause j of the RCP failuro kan an intermi fault in the rotor windin3 Af ter the 11A i RCP retor kun ciunJcd out, Unit 1 kas restored to cperation cn At>Just 5.

Cycrators c)Terienccd scro dif ficulty durirq this event khile startin] the stcm-driven auxiliar,y featutor Frps in order to nininize ED3 clectrical leadinJ. Tkn initial attcrpts to statt AW prp 11 failcd dao to high vibration levels which cauccd the prp trip latch mchanism to trip. AW prp 11 kus successfully startcd by rcdtrin] steam ficw to the govemor control valvo ard mntully brinJ in] the steam ficv up. Sutccquent trutbleshootin]

revealcd thTt the overspnl trip lirdago sus cut of adjustrent. The lirJago kan adjusted and the Frp kus testcd ratisfactoril/.

The licensco deteminxi thit this rient did not constitute a mjor rafety issue twause lecs of all non-cretacrcy ac TcArr is evaltuttd in the Fimi Safety Amlysis Peport (IGR) . 7his event kus amly cd for cocurren e at 1001 paur an1 it kus deteminxi tJut it could mt have tcen rero revere unter arry crcdible altemativo cirurutarres. 7ho piramter trends koro not as covero l in this event as thcco assu rd in the imR amlysis.

e 1.3 Startun Transforrer Failure Cwes Ims of Offsite Ptsyr at Palk-WD Cr) July 14, 1987, at 1:22 p.m. , the Palimdes !?uJ1 ear Plant

• cxporlenen! a locs of offsite pcA'er khile at Slt p ur. '1ho loas of offsito pcAcr resultcd in the locs of cooliny tower ptrps anj fans. 'Iho Shift Supervicor directcd the reactor to to mnually trinni due to tho forthcenin] loca of condenner va<xum, 'Iho two plant ercrycrcy dicsc1 gemrators prtnided Ixser until offsito pcNer sns restortd at 8:04 p.m. 7ho plant sus mintaincd in hot i shutdcun usin] mtural cirullation until forud cirullation sus restond at 10:21 p.n. An Unustal Event sns dcclami at 1:30 p.m. m1 was tetTdmtcd at 8:49 p.m.

Plant tu hnicians were working to correct an alarm prrblen on the min transfemcr delugo system. The air pressure system for the min transforrer an1 the startup transforrer doltrjo syste:m arn crras conncetni. After calibration of the min transferrer prrcsure switch, the systen air ptrssure sus ircrrancd and then dccrearai to bilance the system. '1ho deltryo systen actintes on difforential pressuro acrocs a diaphragm. Ono sido of the diarhragm hss systen air pressure, the other sido has air pressure frm a heat acttuted device (IMD). Unfor nomil cirurntarecs the air pressure is cqtul on teth sidos of the diarhrap, with a ccrpwatin] vent mintainin7 this cquilibrium, licurver, when the inD secs a rapid rico in torperature, the air expands. This ircreams tha air pressure faster thsn the acrper.mtiny vent can release it, thus pmhin7 the diaphragm in ard releasing a suight latchin) rrxhsnira, allts'ing the deltrjo valvo to cocn. In this event, air supply prrasure sus rtducrd tco gaickly. 'Ihis resultcd in the air pr-scure on the 1%D side of the diarhrop to to greater anl therefore, the diarh. sp revcd ard releasal the svight latch.

Shortly af ter the delu]o systen actintcd, an arr jugrd frm 'ho Y Ihtne irculator buchin] cap to the transf:rmr case of the 1-2 startup transforrer.

The arc emital a grwn! fault en the Y Jhase. The grwni f ault sna senral by the primry anj hickup tus dif fcrcatial relays which in turn initiatcd trips on the 345W switchyarti tus R air blast breakers ani the startup rcser breakors for the ecoliny tcser systen. The nomil fast transfer to startup reser af ter a reacter trip sus bicckcd due to the fault sencal frm the art.

The diccol gemrators 1cudal cr.to their rerpnctive tuws via the roms 1 shutd An raquenm as desigrrd.

Practor trip ard encryercy pircatures for lcus of forud cirrulation ani initial mfoty fun tion chccks surr ctrpletal anl mtural cirrulation f1cs' sus verificd by 1: 30 p.n. Kijer plant nrai lnmt rrcionicd as c>pettd daring the plant trip 'ith the excrption of tho gaick-g en featurr for the atmqheric steam dxp valves an1 the tutt)im bypics valve. 'Iheco valves did rot cien until tetsten 18 an! 31 raxnis af ter the plant trip. The plant ,

remincd in hot shutdxn on mtural cirullatien until 10:21 p.m. when a primry crolant prp was starttd.

• Palicades !.'uclear Plant is a 805 Mio (not) PDC Ccchution D))incerin] IUR Iceatcd 5 niles scuth of South lbven, Michigan ard is cTeratcd by Ccastrers Itser.

4 i

Activitics to cloctrically backfocd the plant through the min transforrer were ocrrenxd at 3:50 p.m. and ocrpletod at 7:50 p.n. Theco activitics precocdcd in a deliterato mnner to allow the talarco of switchyard breakcru to be chocktd, to verify status of the train transforrer (uscd for tackfecd),

and to assure all relayin] had prqcrly functiomd. Plant mmgenent intent at this tire was to prcocod with the recovery thsso cauticusly sirco the plant was cycrating very well unior mtural ciru11ation and no risks for disruptirn mtural cirullation kure forescen. At 7:50 p.m. , tuscs 1E, 1A and 1B kere restored to servico via backfcn11n] thru)3h the min transferrer. Hcurver, on the first atterpt to hickfood tus IC, a load shcd sigm1 was roccivcd and the 1C tus was relcadcd onto the 1-1 diccol generator via the nomil shutdcu'n sogacn:cr. Subcoqacnt investigation revealcd tMt two startup transforTer auxiliaIy relays sure not reset per the creratirn pmxdure. Theco relays were reset and tuscs 1C and ID sure then fod frun of fsito rcser at 8:48 p.9.

The procedure for 1cca of oc pcser was corrected to imludo restoration of theco two relays khen backfcaliry the 1C and 1D hm.

The root cause of the fault was contanimtion in the transforrer delule systen water crrbited with wird gusts khich causcd water spray to reach the tcp of the transferrer bushings. Centmimnts in the water cpray providcd a path to grouni (i.e., the transferrer case) for an electric arc. There was in indication tMt the arc traveled alony the tushin) surface or that the arcin]

was interml to the bushing or traruf otrcr. The cent.vtimtion occurrcd bccauco water was not pericdically flushcd frun the pipin7 The proxirate cause of the event was the imdvertent actuation of deltrja spray on the startup transforrer. Tochnicians sure perfoming mintemnce on the delugo alam systen and had detemincd tMt a pressure switch rcqaircd calibration. After calibration, the rysten air pressure for the min transferrer was repressuri:cd for system cycration, while raising the systen air pressure for the min transferrer dolo]o cysten, the regulator kns adjusted such that the startup transferrer delujo eten precsure tecxe tco high. The two systens are ticd together through a cu un air supply ani pressure regulator. 7ho cysten air pressure for the startup transferrer was ,

1cstrcd by cycnin] an air blc(dof f valvo. Just as the pressure reachcd the I nomil cycratin) range, the startup transforrer delugo systen activattd. l l

1ho delaycd creration of the tuttire bypass valvo and the atrecrhoric steam dxp valves was detemind to te a failure of tuttim trip Icckcut relay 386/AST. An insfrction of the relay revealcd tMt a sincer totseen the l contacts Md bIrken. As a result of the spacer failure the contacts Md i 1 shif tcd so as to prevent contact when the can rutattd. This disabicd the gaick-qcn feature of the turtim bypass valvo ard the atrecrheric stean diep valves.

The contanimtion in the delugo water lims sus causcd by corTccico due to the stagmnt kuter in the pipin). This contxtimtion is n:w rcdaccd by gaarterly flushin) of the deluge systen. The flushin] Ms teen in orTeratcd into the rcricdic fire systen chccklist. The deluge cpray rc::les kere tested to detemim if they chculd te adjustcd. The test shcsni none of the m::les spraycd dircctly onto the tushinJ an$ that no adjustrents sure romuy. In

)

addition, an engincerin] review of the delt.Jo system sus conductcd to dotemino pocsible actiom khich stuld minimizo imdvertent actuation of the delujo system.

The tuttino trip lockout relay (386/AST) sus replaccd prior to plant startup.

In addition, a revicv for sinilar relays in the plant was conductcd. Eleven relays woro locatcd and irLW. 13cno of theco 11 relays c>hibitcd a similar spicer failure or any other aramlies. 1ho 386#st relay also

)

prwides logic to fcur control echcrest l

1) fcotater ru p crooi rarp dck'n,

2) clocuro of turbim gemrator roisture ocparatcr reheater valves,

3) focd'.nter regulator valvo controls ani, i

4) turbino bypus and atr.xT heric steam du p valves.

The relay failuro sus evaltnted to detemino if it my hivo contritutoi to the anxulics obccrved earlier on June 20, 1987. '1hoco anralics are describcd in Licensco Evgnt Report 255-87-018, "Irprcycr Valvo Orcration Results in Reactor critical At Ircs Thin 525 *F".

, The Licensco detemincd that the locs of offsito pcAur with a reactor trip is I an amlyzcd tramient with no adverso rafety consequences. The plant rw w 1

to the reactor and tuttino trip was consistent with its designed cicration I with the exception of the atrecrheric steam dtep valvo ard the turbine bypus valvo .hich toth failcd to quick rien. The review of the primly crolant system pirarcters irdicated that the p} ant recron3cd as designcd even thoo3h the quick-cycn feature did not activato.  !!atural cirrulation was establishcd ard verificd with no probices, turing the transient, the rnonisry cysten kus exrecod to hitiraulic distuttanxs. Ixpcction of coconiuy systcn o3uiprnt revealcd no signs of dm3go other thsn minor denting of insulaticri. Imprtions sure p2rfornce durin3 startup to 1cok for ailiticm1 dmv3e which my not hwo arrearcd until after startup.

As a precaution, the disdungo piping of the fco}.nter ru ps an1 the conlencato prTo sus non-destructively testad for passible dmigo. 1ho test results chcAnd no damgo, offsite pcsur was 1 cut for cuer seven hours af ter the trip. 'ho plant sus rm3y to tackfcal after alcut four hours, but nuw3erent connetvatively decidot to further investigate the FAur systcn for any unictceted drage toform tuckfcoding of fsite Fmur thrcugh the min tramforTer.

6

1.4 Reactor Scran tue to railure of Msin Generator Ksnual Voltaae Pan 11ator Board Transistors at Brunswick Unit 1 At 10:35 a.m. , on July 1, 1987, a tuttine power at Brunswick Steam Electric Plant (BSEP) Unit 1*/ load unbelance relay tritped, causirq a ard a reactor scram shile at 100% power.

Voltage regulation for the min tuttine was in the mvual inode shile trvubleshootirn the autcatic voltage tvplator. 'Ihe regulator had exhibital unstable cporation above 80% power. 'Ihe narual voltage regulator had been placed in service ard verified to be contro11irg prrparly prior to the event.  !

1 Earlier, on June 27, it was notad that the automtic voltage regulator was exhibitirn unstable cperation abwe 80% power. Haminal generator field voltage at 100% power is about 250 volta det howsver, fluctuations of as much as 80 volta dc were ehwwed. ninctional testing performed at that time detemined that the problera was isolated to the autcutic voltage replator.

Cn June 29, the verdor (Concral Electric) was callei in to hve systs behavior ard to assist in develesrent of a troubleshootirryrepoir plan. A spa:ial procedure was devolepod for transferrirq the voltage regulation to nvaal, veri *yirg proper operation, ard then reavirn the autcutic regulator

. for troubleshootirn ard repair. Ircitded in the plan was guidance to verify autexatic regulator behavior prior to rerswal in an atterpt to detemine possible causes of erratic cperation.

On July 1, mintemnoe personnel ard the verdor representative briefed the cperaticas personnel on the interded course of action. Prger operation of the nvual voltage regulator was verified prior to transferrirn to the mnual rode, at snich tim the nvual ard autcmtic replators were balanced am control was shifted to nvual. Cperation in the mnun rnie was renitored for 10 ninutes to verify prger cperation prior to pruosodirn. With stable cperation verified with the nvud regulator, trtubleshootify began on the auttmtic replator.

'Ih3 cutpit of the autcmtic voltage replator was fcurd to be unstable. 'Ihe General Ela:tric representative reported that the cause of erratic output was

'ccee temimis ard pcor solder connections. No 1cose temimi cr.nnections were fcurd en the ramlator circuit boardt however, while u.wections sere teira checkcd on cabimt-rounted potenticrwters, an azu vas heard ard the outpit of the nvual voltage replator was Icst shen a wire to potenticreter A10P was runod. 'Iho loss of the rarnal voltage ruplator causal a generator overexcitation cordition which causal the tuttino to trip cm pcser/lcod irbslarce. A rmeter scram folicstd due to a tuztine contzt1 valve fast c1ccuzw sigm1 at 10:35 a.m.

• Brursuich Unit 1 is a 821 MM (net) EC Gercral Electric IER Iccatoi 3 miles rerth of Southrert, ! brth Carolim ard is cperatai by Carolim RAur & Light.

\

\

I _

)

As a result of the turbino trip and reactor scram, the follcuinJ actions comrred:

dicsol generators 1 thmrA 4 auto-startal tut did not load to their respoctive buses (per design).

reactor safety relief valve (SRV) A auto-opencd cn high pressuro (per design).

Prinw/ contaiment isolation systm croup 1, 2, 3 (outtoani valvo only), and 6 and 8 auto-isolated en icw vessel level (per design).

A rmeter recirculation pu:P tripped on low vessel level (per design).

standby gas treatront systan auto-started and the reacter tu vm ventilation systm isolatal on low vessel (pr design).

SRVs A, B, and E were nvmily liftal to control tracter prc::alre \

(per prt:oxiure); tut SW J failed to cpen.

high pressure coolant injcetion (}UCI) system was mnually startcd for pressure control; the systera trilTod on overcpcod durin7 tho startin] syperce tut autmatically reset ani ran seatully.

reactor core isolation coolin) (RCIC) systm was nvually startal for vessel level contztl.

turin7 this event, reactor pressure reachal a zuconicd high of 1105 poig ard vessel level reachcd a 104 of 117 intes.

Fo11rving the scram recxwczy ard as rtrpiral by procedures, an investigation was conbetal into the cause of the scra:s and any subsequent mli entions. As (

roted prrviously, the sound of an electrical arc was heant then a temimi en (

cabinet-rcuntal potenticreter A10P (put of the autmstic voltage regulatcr) was toucted. Irr/cstigation detemincd tMt the temimi could not to mdo to taxh its rountiny bracket withcut a;plyin7 excessive force tut maid te roecd cl:ee encugh to cause arrinJ. Arcin) of this temimi caused n. electrical disctunJo of -141 volts 60 to ground for the auttratic and numi rtgulators.

This ptential caused the D1Q ard D3Q transisters on the mntal rcnulator bcant to fail, resultin] in loss of voltage regulatien and cr.Trexcitation et the gercrator and tri piny i on p:x.ur/lcad unbalarce.

Investigation of the initial prrbicn with the autcratic tw]ulator follcuin) the r. ra:s deteminod that potenticreter A4P (one of nino rountal cn the auttratic cirtuit tomi) was dirty. These nino ptenticrutezu are unsealce ard are usal for gain ani linit circuits. Adjustrents to these ptenticreters are not roocrrcrded by the venior after initial cirruit setup.

8 1

SW J failcd to oren khen given an open sigm1 for pressure control during the scram reco m y. An investigation into the failure at Wylio Iaboratory dotomincd tMt the solenoid plunJor lud stuck fn the bnnnot tuto. This failuro mactanism affected the mntal and the autcmtic depressurization system (AtG) rodo of eterationt hcwever, the safety relief function (cuerpressure protection) sus still cycrabic.

Durin] tno ocurw) of tN ceram rcocNery, tN }ECI sus placn1 into service for pressure contrvl. khile startin; the systen, the IECI turbino tri} Tai on ,

cuempocd due to the startin] scrperce in uso. Tho systm auto-reset and l cycluted as rupired. In initiatin; the startin] ncrpence of IECI, the auxiliary oil pu p was startad prior to initiatinJ an cron sigm1 to steam inlet valve TOO1. As a result of this action, an overcpocd trip emwro$

shen oil prtusure crerod the tuttino stcp valve (VB) and the gcuerrer valvo (V9) allcwin] the startup ra.p sigm1 (which is initiated by the V8 limit switch) to ccrpleto its rarp cycle prior to th admission of steam pressuru.

The prcycr rethcd is to give an cron sigm1 to the F001 valvo prior to starting the auxiliary oil prp. The IECI system respcnicd as designed, autcmtically reset, and was used in pressure control.

As a result of this event, the follcuin] correctivo actions scro taken:

(

t 1. The cli:uit tmrds for the mntal and autcmtic voltago regulatoru sero replaced.

2. A review of tM Alterex excitation system was dono in an effort to eptimizo reliability of this systm.

3. SW J rolenoid kus replaced and the valvo sus restor:d to service.

4. Cycrator trainin) hsd toen centactal prior to the scram cn the correct r^Tactre for IECI mntal initiation doo to recognition of the cncrgecd pcesibility. 1ho cycrator who startcd }ECI tad rot ccrpletcd the trainin), which hu n:w twn crrplettd. In addition, an "crerator aid" ins bcen establichcd on the crutrul taud to prtvido prtier guidvre to the crerator.

The Licensce detemincd tMt this event sculd rut hwo Locn rom revero under other reascmbio an$ credible altenutive ctniitions.

I 9

I 1.5 Water Intrusion into Instnrnent Air System at Fort Calhoun At about 10:45 a.m. on July 6, 1987, at the Fort Calhoun Station

• during a surveillance test of the diesel generator rom dry pipe sprinkler system, river water entered the instrument air systen frun the fire prutection system.

Evaluation of this event has shown that it <vv,irred as a result of two factors:

1. Instrument air check valves IA-575 and IA-576 were prevented ' frcan closing by foreign m terial.

2. We operator perfoming the test failed to properly reset the dry pipe valve as a result of inadequate procedures and inadequate training on the unique dry pipe system. We air mintenance device was bypas.ti, thus renoving another check valve and orifice that could have prevented or restricted flow of water into the air system.

In 1985, the fire protection deluge system for the diesel generator roczns at Fort Calhcun was converted frun a wet-pipe to a dry-pipe system in order to eliminate freezing problems during winter operation of the diesels.

Instruut air was supplied to the dry pipe valve, FP-513, through two check valves (IA-575 and IA-576) and an air maintenanco device in order to hold the valve clapper in the closed position, khen the system is activated, (for either fire protection or testing) the air pressure is rapidly depleted and the clapper opens, supplying fire protection water to the deluge headers.

FollowinJ actuation of the dry pipe valve, it nust be mnually reset by removing an access cover and relatchinJ the clapper in the closed position. ,

DurinJ the reset process, as performcd, a flow path existed through FP-514, FP-513, IA-576, IA-575 and IA-569. We fire protection system pressure is about 30 poi greater than instrument air pressure. Rus, water flowcd into the instrument air system.

We cperator noted that the air-side and water-side pressure gauges (PI-6515 ard PI-6516) both indicated pressure in the fire rain. He know that this was not possible if the clapper valve was properly reset. He then cloced FP-514, isolating the water flow, and informed the shift supervisor. It is estimtod that about 10 to 50 gallons of river water were intrcducoi into the instrument air system during the few minutes this flow path existed.

• Fort Calhcun is a 478 MWe (ne';) MDC Ocstustion Enginocring RR locatcd 19 miles north of Omha, Nebraska a;d is cperatcd by the Qnha Rblic Dwer District.

10

l Several equipnent problens occurred over a next hour as a result of the water intrusion:

1. W e bubbler-based level indicator for the diesel generator fuel oil storage ta*.k failed high. An alternate means of level indication was initiated.

2. HCV-485, the closed cooling water outlet valve frm shutdown cooling heat excharger AC-4B cpened.

3. Water was observed at the danineralized water makeup flow controller to the boric acid system.

Several actions were capleted to return both the instrument air ard the fire protection systems to full functional status:

1. Check valves IA-575 and IA-576 were cleaned, tested, and returnM to service.

2. W e dry pipe valve was properly reset.

/ 3. Plant personnel conducted blowdowns to remove water frun the instrument air system.

4. Personnel were assigned to evaluate ard define khat further actions were required.

We immediate blowdown program demonstrated that the water was confined to the lower two levels of the auxiliary building, below elevation 1025 feet. No water was found in the turbine building or the intake structure. No water was introduced into the containment building, since the instrument air penetration is above elevation 1025 feet. By the end of the work day (July 6), it was believed that substantially all water had been removed frun the instrunent air system.

As a result of Item 4. above, a detailed and documented blowdown of the systems was initiated on July 9. 515 individual cocponents were included in the scope of the blowdown, and all safety-related air accumulators below elevation 1025 feet were drained, (except for the diesel generator radiator exhaust daqmr accumulators, as discusscd later) . Water was fourd in less than lot of the mmponents. As ruch as possible, valves ard other ccoponents were cycled follow:ng blowdown to verify their cperability. We blowdcun program was repeatcd in August 1937 for ocmponents which exhibited water intrusion during the July blowdown. Eight caponents on four risers along with the post accident sarpling system (PASS) showed moisture during this secord blowdown, and were scheduled to be checked again in Septenber.

Diesel generator No. 2 tripped on high ecolant terporature during a surveillance test on September 23, 1987. We mcat probable cause kus the failure of the radiator exhaust darpers to open fully. We pilot valve orifice was fourd to be restricted by foreign ratorial, mcst likely resultirg

) 11

from the interaction of water, C>-ring lubricant, and other materials, '

me mmilator was 50% full of water.

he Licensee placed heavy enth asis on removing the water frta the instrument air system. In retrospect, the potential safety significance of the eveat was not sufficiently evaluated at the time of its occurrence. Further evaluation was performed in order to assess the potential safety-significanoe of the event. %e event should have been reported as required by 10 CFR 50.72 and 50.73 and plant shutdown initiated per technical specifications.

In addition, it was concluded that a Notification of Unusual Event should have been declared in accordance with the anertpacy plan. Se licensee review concluded that critical safety functions would have been mintained if a design basis accident had emtrred coincidentally with the water $ntrusion event. One of the corrective actions was to ensure that operational events are pra:ptly evaluated for safety significancs.

As a result of this event, a fine of $175,000 was icvied against the licensoo for:

1. Providing an imdequate prtccdure for testing of the check valves and for loss of the instrument air system.

2. Providirg an imdequate 10 CFR 50.59 evaluation for testing of the fire system delugo valve.

3. Failing to mke a Notification of Unusual Event ard to report tne event in accordance with 10 CIR 50.72 ard 50.73.

4. Failure of the diesel generator #2 ocolirq system exhaust danpers resulting in the shutdown of the ED3.

1.6 Main Steam Isolation Valves Open Without Trio PcAur Available at Point Beach Unit 2 During a startup of Point Beach Unit 2* on August 18, 1987, both mi') steam isolation valves (MSIVs) were discovered to be without dc control pcAur needed to trip (cloco) the valves. 20 reactor was at 2% power for about fivo hours before the cordition was discmcrod. Upon discxwory, the operator innodiately restored control pcAur to the valves thereby retumirg the trip circuitry to an operable cordition. No other safety syntros are fod frcn this puer supply. We cause of the MSIVs being out of service was per.cnnel error. 2e psur to the solenoid valves was not restored correctly after mintenance.

• Point Deach Unit 2 is a 497 Mio (net) MDC Westin3houso WR located 15 miles north of Manitcsoc, Wisconsin and is operated by Wisconsin Electric Pthur.

12

)

On the prwious day, August 17, Unit 2 was in hot shutdown following a trip which <mrred on August 16. We main steam isolation valves were manually shut after the trip to facilitate repairs to three low pressure turbine rupture discs which ruptured during the transient following the trip.

Followiry repairs to the rupture discs and verification of valve operability, the E IVs were left open. Iater in the mornirg of August 17, it was decided to inspect the internals of the turbine and a moisture separator reheater.

( For reasons of personnel safety, the MSIVs were closed and safety tacfged. We j tags were placed on the instrument air isolation valve to each !GIV and on the de control poWur breakers (in the mntrol recn) which supply po.ur to the instrument air isolation valve supply and vent solenoids.

After the work was empleted, the reactor was released for criticality. By about 9:38 p.m., the reactor was critical with the MSIVs closod. Between 9:38 p.m. and 10:30 p.m., it was intendM that the MSIVs be retumed to service by clearing the safety tags. 'IWo of the tags were inadvertently not removed.

%cco tags called for the cirutit breakers which sumly de control power to the hSIV trip solenoid valves to be in the open p:sition. Without de control ptsur, the MSIVs can be opened but can not be closed with either an autcmatic or m nual signal.

At about 10:30 p.m., procedures for low power operation were started. We first step required that the applicable portions of OP-13A, "Secondary System Startup and Shutdown" be cxrpleted. OP-13A has a step that requires the MSIVs to be opened and cycled, thereby verifying the valve cpration. Since the MSIVs had toen cycled earlier prior to the maintenance inspection, operations personnel decided that the OP-13A requirement to cycle the MSIVs had already been met. We cycling was therefore not performed and the failure to clear

, all the safety tags was not identifiM at that time. At abcut 11:05 p.m. ,

when the MSIVs wre opened, it was not known that the trip ciru:its for the MSIVs were inoperable because the control power breakers w re open.

Some time between 3:30 a.m. and 4:00 a.m. on August 18, Operations personnel discovered the red tags on the de control powr supply circuit breakers for the MSIV trip solenoid valves. After determining that the red tags should have toen reroved, the tags were lifted and the breakers were closed, mking the MSIV trip circuits operable.

After such an incident, the normal course of action kuuld have been to call a superintendent to perfom a 10 CPR 50.72 reportability evaluation. 10 CFR 50.72 repouability was not considered by the operator who discovered the condition, so he did not mke a call. He did assume a License Event Report (IFR) wuld to requircd and he initiated a nonconformance report (!G) on the event. We IG was issued the afternoon of Atgust 18.

( We operator who found the breakers y betwen 3:30 a.m. and 4:00 a.m. (on j August 18) sent a written note to the operator responsible for clearirn the cafety tags. But he was not scheduled to wrk until 3:00 p.m. that day.

Betwen 3:00 p.m. and 11:00 p.m., the operator kho mde the taggirg error received the note and generated an IG. W o I G was sent to a staff revicaer in the nomal plant mail. We !G was received by the reviewer the afternoon 13

1 of August 19. N NCR did not clearly state that the MSIVs were inoperable for the period of time that they were open with red tags on the breakers. A review of procedure OP-13A led the reviewer, who thought that the breakers may have been closed instead of open, to mistakenly conclude that the valves had been cycled and were, in fact, operable at the time the red tag problem was fourd. The staff reviewer determined it was &cary to talk directly with the person who identified the situation. The operator was still assigned to the 11:00 p.m. to 7:00 a.m. shift so the staff reviewer decided to talk with him the norning of August 20.

On August 20, the operators involved in the incident were interviewod and it was deteminud that, in fact, the breaken for the control power were open and that the MSIVs kure inoperable with the reactor at two percent power. We decision sus then made to notify the NRC duty officer of a probable one hour 10 CFR 50.72 report. Subsequent calculations verified that for the conditions of the plant at the time, the plant was bouMed by the design basis.

Initially the "rtd phone" call was conservatively made as a one hour notification. It was assumed that the unit war in a condition that kus outside the design basis of the plant, but sNwv]uent analysis detemined this assunption to be overly conservative.

l This incident was a rtsult of personnel errors. First, safety tagginJ kas imdequato in that the tag location sheet did not clearly indicate the location of all tags which had been placed. Second, the tags were cleartd in an inapprcpriate ranner. h duty cperating supervisor (DOS) asked the auxiliary kuilding auxiliary operator (AO) to clear the tags on the MSIVs.

20 Ao cicared two tags frczn the MSIV instrument air supply, reset the solenoids and told the EXJS he had cleared the tags but did not specify which ,

ones or how rany, h Dos, with pomission fran the AD, signed the danger tag location shoot indicating clearance for all fcur tags, includinJ the two on the de control power breakers. He thought the tags kure located near the MSIVs and that the A0 had cleared them (tho tag locations were not clear on the ta7 Jing shect) . %c ta731ng was then revierd ard cleartd by the DSS.

Third because the MSIVs had been cycled the same day, the supervisors on the next shift detomined that it was not r-mry to ocrpletely perfom the proceduro step khich cpened ami cycled the MSIVs.

W cauco of the delaycd 10 CFR 50.72 reportin] kun the failure of tho operator to mko propor notifications to plant ranagement when the cordition was discoveral.

A safety amlysis was performcd to evaluate the effect of the unavailability of the MSIVs on plant safety analysco. The transients of concem are min steam lino break (MSG) ard steam generator tubo rupture (SGIR) .

The main cn com in the MSIB accident amlysis is the reactivity excursion caused by excessivo ocoldown of the prinny coolant. The Fimi Safety Amlysis Report (FEAR) assunes that the MSIVs will cloco within 5 scoonds to limit the 1cca of cocondary coolant frun the "intact" steam generator. h plant design is such that a break anywhere in the steam lino can bo isolatcd 14

by cperation of either MSIV or the non-return check valves located downstream of the MSIVs. Between the steam generator aM its associated MSIV is a flow restricting orifice which also limits flow during a steam line break m e ring downstream of the orifico. We worst case break that is analyzcd in the FSAR I is the MSIB upstream of the flow restrictor.

Based upon the actual plant corditions durim the event, it was comluded that l the unavailability of the MSIVs during an MSIB was boundcd by the worst case ISAR analysis with respect to an overcooling transient and itL associated possible reactivity excursion. It should also be noted that experience with the MSIVs at Point Beach indicates that, with the high steam flow that occurs with a steam line break, it is likely that the MSIV would "wipo in" ard close of its own accord.

W e steam generator tube rupture (SGIR) accident analysis involves the leakage of reactor coolant through a steam generator tube to the secondary side of the steam generator. Radioactivity could then be released to the environment through the condenser downstream of the MSIVs, through the atmospheric steam dunp valves, or through the steam generator safety valves upstream of the MSIVs. Although the FSAR analysis assumes that the operator will attenpt to isolato the steam generator by closiry the MSIVs or the turbino stop valves, failure of an MSIV is assumed under these conditions.

It should also be noted that failure of both MSIVs to fulfill their design function can be mitigatcd by the use of emenjency operatim proccduro ECA-2.1, "Uncontrolled Depressurization of Both Steam Generators".

20 Licensco therefore concluded that the condition of Point Beach during this event did not pcco a health or safety hazani to plant perranol or the general public.

20 intnediate corrective action to restore the functional operation of the MSIVs was to properly clear the safety tags ard close the breakers for de control power to the MSIV isolation and vent solenoid valves.

A modification was initiatcd to alarm the Icos of de control pcher to the MSIVs in the cor. trol room. h is modification should reduce the probability of this coMition occurring in the future.

20 personnel involvcd in tho event woro counsellcd on the noccasity of adherence to appropriato work practices, the proper uso of procedures, and the need to contact appropriato pensonnel in situations havirg a potential for reportability.

Were woro savoral personnel errors identified durirn investigation of the event. We ptrioscd correctivo actions were to address the areas of concem.

Weso includcd rod tag proccduro changes, charges in philoccthy of proccduro use (includirn signoff) aM resultant trainirn.

A fine of $25,000 was irrcccd on Wisconsin Electric Ihrt Ctrpany duo to their failuro to have any mothcd of steam lino isolation cporable aM tho failuru to report the event to the NRC within fcur hours.

15 t _ - - _ - - - -

g f

i 1.7 Inocerable Essential Servio? Water System at Callaway on Atgust 8,1987, at 5:10 a.m. at the Callaway* nuclear power plant, during a

• containment coolig fan test at 100% power, utility operators discovered [

ecsential service water (ESW) train B isolation valve, EF-V-0117, partially f shut. Train B was declarcd inoperable, the valve was opened, aM train B was i again operable at about 2:30 p.m. An evaluation concluded that total train B l flow with this restriction was less than specified by design. mis coMition had existed since May, 1984. Conflicting valve position indicators had were noted on a Work Request (hB) dated May 14, 1984. Whenever train A was removed frm service for testing, both EEW trains were technically incperable.

his event was due to failure of utility pc.ml to recognize the effect of false valve indication on EEW operability. mis resulted in low work priority placed on repairig the problem. Se cause of the delay in discovering the flow problem was failure of utility personnel to ocmpare total flow to prtoperational test flows when baselinig the purps in 1984 and again in February 1987.

On my 11, 1984, prior to receipt of the plhnt operating licenso, utility personnel replaced the mnual actuator on EEW train B valve EF-V-0117 because the housing was crackcd. Upon ccepletion of the work, the actuator sus tested for proper operation.

on my 14, 1984, it was observed that the valve pcGition indicators conflicted and a second kR was written, but it was voidcd on September 9, 1986, apparently due to a duplication of work with a third kB. We third hR (originated June 10, 1986) arrangcd for an inspection of EF-V-0117 to assist in deteminirq the root cause of an acttator shaft failure in a similar valve.

Ocupletion of the inspection would require a retest involving verification of i

position iMication, nus it was concluded that performnce of the third kR {

i would also correct the problem identified in the secoM hR. 20 kerk I description in the third hR had not been rcdificd to include checking the position indication. 20 third hR was voided on September 10, 1986 when a later decision was made not to inspect EF-V-0117 due to vendor involycrent in root cause evaluation of a similar valve actuator shaft failure. We review by planning aM engineering personnel failcd to note the revised kerk ccopo, consequently, the problem notcd on the sca3M hR went unresolvcd.

)

• Callaway is a 1171 !Eo (not) Im Westinghouso IkR locatcd 10 miles coutheast of Fulton, Missouri, and is operated by Union Electric.

16

On Atgust 15, 1987, utility personnel were verifying ESW valve lineups in order to determine the cause of a lcw differential pressure reading on the annubar ficw element on the train B containment coolers. Se lcw differential pressure was r*vmrod during performance of a surveillance test required by plant technical specifications which state:

"Each gIcup of containment cooling fans shall be demonstrated OPERABIE:

At least once per 31 days by verifying a cooliry water flcw rate of greater than or equal to 2200 gpn to each cooler group."

During this verification, it was discxwered that EF-V-0117 was partially shut.

After further troubleshootirg, IEW train B was declared inoperable at 10:15 a.m. We valve was opened aM verified open by stem position and ficw indication. ESW train B was declared operable again at abcut 2:30 p.m.

Utility personnel did not recognize the restricted ficw condition on train D before August 15, 1987, because the existing ESW prp surveillance test provided no irdication of a problem with pmp performance. %e surveillance procedure for the pu:rp did not require ESW ficw verification. We utility locked valve program was intended to assure adequate ficw when pu::p output was acceptable. to locked valve program verification was performed as required but did not identify errors in position indication for this valvo.

On August 20, n engineering evaluation concluded that ESW train B k'as inoperable on August 15, with EF-V-0117 partially closed. We resultant total ESW train D flcw was about 11,000 gpn - khich does not meet the Final Safety Analysis Report (FS R) design value of 13,594 gpn for train B.

In streary, ESW train B ficw had been less than specified by the FSAR since 1984. Train A had been routinely renovcd frun service for surveillance testiry and maintenance since 1984. W erefore, both ESW trains were simultaneously rendered inoperable.

We root cause of this event was the failure of utility personnel to recognize the effect of faulty valve indication on ESW system operability and the resultant Icw priority placed on repair. khen the plant technical specifications were apprened and issved later in June 1984, a revicw of cren Ws failcd to identify the condition as an operability restraint. Eis resulted fran a failure to ensure that kerk requests wore was performed in a timely manner.

to follcuiry addresses the root cause of this prob 1cm being undetected until August 1987. Since the ASME Section XI* baseline was establichod cloce to the ccepletion of the system preop 2 rational tast, results of the baselino total ficw value for the ASME prp and valve tests were not ocupared to total flcu establichcd during the procporational test. Although methods used to establish this baseline were correct per the ASME codo, a ccuparison would

• American Society of Mechanical Engineers (ASME) Doller ard Pressure Vescal Ccdo,Section XI, Rules for Incervice Insprtion of Nuclear Pcwr Plant Ccrponents.

17

I have discovered this deviation. When the EEW punp was re-baselined in February 1987 (to evaluate apparent punp degradation per ASME Section XI),

only punp perfon noe was evaluated and no punp degradation was detected. If total system perfomance had been evaluated and ocmpared to system design, the deviation would have been discovered.

Corrective actions included:

1. The valve actuator was repaired during the second refueling cutago.

2. The failure of utility personnel to initially place pn:per priority on valvo indicator work was considered an isolated caso. To provido additional assurance, a ruview of voided and open hrs on selected systans was perfomed. This ruview ensured operability concems had been pn:perly identified and prioritized. In addition, the review ensured that WRs had not been voided without work caplotion or appropriate follow-up action. /

3. The hR control procedure now requirus the reason for voiding the WR and the nuno of the person voiding the hR. As an additional enhancement, the proceduro was revised to require that the entire scopo of work be transferrcd frun a voided hR to any current hR which inplements previcusly unocmpleted kurk.

4. Engineering personnel involved in voidity the bRs wuro counsolod.

It was re-crrhasized that thorough rescarth rust be dono prior to authorizing the voiding of any hR. Engineers involycd with ASME Section XI ovaluations were reminded to omsider the offoct on the total system khen re-establishing punp baselines.

5. Methods for verification of valvo position wuro considercd appropdato and no further action was decmtd necessary. However, proper assignment of priority of hrs should assure valvo position indicators are more rollable.

Dochtel Corporation corductcd an analysis to dotomino if 11,000 gp is an acceptablo ESW train b ficy rato. They perforred threo evaluations to dotomino if, during a loss of coolant accident (IOCA) %hilo EF-V-Oll7 was prtially clocod and ESW train A out of cervico, thoro would h.wo been sufficient safety mut3 ns 1 to mitigato the cenacquences of the IDCA, 1ho three evaluations and conclusions are as follows:

1. Cooling tower performnco was ovaluated usirg tho IDCA heat load ani the critical reteorological conditions establishcd in the plant )

design. A ficurato of 5,500 gallons Mr minuto por coll (11,000 gp total) was assunod. It. was concluded that tho muirum tcrporaturo at the EW pmp intako kuuld be less than 90 'F. This value is 5 'F boltu the design intake taperature of 95 'T khich is the nuinum pord outlet tcrporaturo allcawd duriny tho 30-day mininen heat transfer pericd.

18

l t

2. 'Ihe performance of each cuiporent cooled by ESW was evaluated at 80%

design flow and reduced inlet water taperature. Pond performance

\ that predicts a maximum 90 'F ESW taperature was considered. It was concluded that each ESW-serviced cuiprsent would be capable of performing its design function with the given conditions.

3. 'Ihe effect on the containment was evaluated for the cuivorent corx11tions analyzed under item 2 above. '1he results indicated that the peak IDCA pressure would increase frun 47.3 psig to 47.8 psig and peak main steam line break pressure would increase frun 48.1 psig to 49.4 psig. Although slightly higher, these values are well below 60 poig, which is the design pressure of the containment.

Based on these evaluatioru, the Licensee determined that this event posed no threat to the health and safety of the public or to plant openutors.

l A fine of $25,000 was irpose on the utility for failure to pruptly identify a l condition adverse to quality. ,

l t

)

\

19

1.8 References (1.1) 1. Virginia Electric & Power, Docket 50-338, Licensee Event Report 87-017, July 15, 1987.

2. NRC Augmented Inspection Team Aports !.0-338/87-24 and 50-339/87-24, August 28, 1987.

3. NRC Safety Evaluation Accepting Utility Responses to Steam Generator 'Ibbe Rupture on July 15, 1987, C+:8-4er 11, 1987.

4. Virginia Electric Power, "North Anna 1 July 15, 1987, Steam Generator 'Ibbe Rupture Event Report", Rev. 2, February 12, 1988.

5. NRC Infomation Notice No. 87-60, "Depressurization of Reactor Coolant Systems in Pressurized Water Reactors", Doorstber 4,1987.

(1.2) 6. Baltimore Gas & Electric, Docket 50-317, Licensoo Event Report 87-012, July 23, 1987.

(1.3) 7. Cbnsuners Ibwer, Ebcket 50-255; Licensoo Event Report 87-024, a'bly 14, 1987.

(1.4) 8. Carolina Ibwer & Light, Docket 50-325; Licensee Event Report 87-019, July % 1987.

(1.5) 9. Omaha Public Power District, Docket 50-285; Licensee Event Report 87-033, July 6, 1987.

10. NRC Region IV Inspection Report, 50-285/87-30, WMr 3,198's.

(1.6) 11. Wisconsin Electric Power, Docket 50-301; Licenceo Event Report 87-003, August 8, 1987.

12. NRC Rogion III Inspcction Report, 50-301/87-16, Septaber 16, 1987.

(1.7) 13. Union Electric, Docket 50-483; Licensee Event Report 87-018, August 15, 1987.

14. NRC Rcgion III Inspection Report, 50-483/87-28, Septabor 25, 1987. '

'Ihese referenced docments are available in the imC lublic Ibcument Rom at 1717 H. Strcot, N.W., Washington, [C 20555, fx p1blic inspectict) and/or copying.

20

t 2.0 EXCERPIS OF SEI.ECIED LICDISEE 5VENI' REIORIS On January 1, 1984, 20 CFR 50.73, ' Licensee Event Report System," became effective. This new is, which made significant changes to the requirements for licensee event reports (IIRs) , requires more detailed narrative hiptions of the reportable events. Many of these descriptions are well written, frar.k, and infomative, and should be of interest to others involved with the f=hck of operational experience.

This section of Pcwer Reactor Events incitr$es direct exce2 pts frun IERs. In generrd , the information describes conditions or events that are senewhat unusual or ccxtplex, or that demonstrate a problem or condition that may not be obvious. The plant' name and docket number, the IIR nurrber, type of reactor, arxi nuclear steam supply system vendor are provided for each event. nirther

information may be ciotained by antacting the U.S. Nuclear Regulatory m=imilon, DIS-263A, Washirgton, DC 20555.

Excerot 2D99 2.1 Ice Buildup in the Ice Corric.ser due to Sublimation aF. D. C. Ceok Unit 1. . . . . ...................... .. ... 22 2.2 Reactor Trip Breaker Failuru to Open Due to Mechanical Failure at itcuiro Unit 2 ........................... 23 2.3 Unisolable Reactor Cbolant Pressure Bounitry I.cak Caused 3y Failure to Iden ify Defective Seal Weld Made During Pressurizer Repairs at Arkansas Nuclear one Unit 2 . . ................... 29 2.4 ESP Actuation Prcn Main Turbine Trip and Foodwater Isolation Diablo Canyon Unit 2 . ........................... 34 2.5 Irproper Torque Switch Settings for Containment Spray Valvo at Oconoe Unit 2 . .......... ................. 34 2.6 Potential for Inadequate Containment Cboling After A ik:n-ICCA Event at Sequoyah Unit 1 ......................... 38 2.7 Inadequate Ccrminication Detween Design Organizations Results in Ummlyzed Orditions at Sequoyah Unit 1. . . . . . . . . . . . . . . 39 2.8 Reactor Sc ram DJo to Air Imk Frcn Inwrrect Mounting Cap Screw in Air Test Pilot Valvo at Oyster Crock ................ 40 2.9 Reactor Trip Due to Lightning Strike at Point Beach Unit 2. . .. .. 42 2.10 Icss of Nomal Rmur During Shutdown Dao to Pmting All Offsite Power Scurces Thrwgh One Dreaker at Vemont Yankoe . . . . . . . . . 43 2.11 Incterability of Nuclear Servico Water System Illo to Incorrect Design Roccrnerdation at Catawba Unit 1. . . . . . . . . . . . . . . 44 21

2.1 I R111 dun in the Ice Cordenser due to Sublination D. C. Cook Unit 1; !bcket 50-315; IER 87-013; Westin3 ouse h WR On July 1 and 2, 1987, khile D. C. Cook Unit 1 was in cold shutdwn, flow passage inspection of the ice cordenser revealed frost and ice buildup greater s than 3/8 inch on the lattico frames in 124 flow passages in seven of the 24 I ice condenser bays. 2cre are a total of 3072 flow passages in the ice condenser. Subsequent inspection irdicated that thero was also frost and ice formtion betwen the walls and ice baskets adjacent to the walls.

W e plant technical specifications limit frost or ice buildup in flow passages to a rminal thickness of 3/8 inch. R111 dup exceeding this limit in two or more flow passages per bay is evidence of abnormal degradation. Bough the evaluation concluded that the degradation was not serious, a voluntalf Licensee Event Report (IER) was considered al'ptroriate since scre degradation was identified.

Actions taken incitded defrostisq the ice coMenser and an investigation of the cause. 2e investigation, aided by a previous Westin3 ouse h evaluation, indicated that thero was no safety concern. We ice co.h zumined in a configuraticsn in which it could have perfomed its intended safety function.

We plant technical specifications require that the ice condenser be detemined operable at least enco every nine months via visual inspection of at least tw flow passages per bay. Ammnation of frost or ice on flow Pmges betwen ice baskets, past lattice frames, thIrugh the intemodiato ard tcp deck floor gratirg, or past the 1cher inlet plenum sigott structure ard turning vanes is restrictcd to a ncninal thickness of 3/8 irdi. If one flow passage per bay is found to have an acumulation of frost or ico greater than this thickness, a representative sanple of 20 additional flow passages frcn the same bay must be visually inspectcd. If these additional flow passages are found accepta'olo, the surveillance program my proceed, considerirg the sin 3 1o deficiency as unique and acceptablo.

A subsequent partial inspection also revealed that ico had fomed in the area betwen the containnent wall and the rw 1 baskets. It was also believcd that thoro was additiomi ico formation in the area betwoon the crano wall and row nino ice condensor baskets. 21s is similar to event described in IER 50-316/87-002.

20 ico mdo it nero difficult to extract the required number of baskots for wighirn. lksnr, an earlier Westin3 oura h evaluation of the condition at Unit 2 indicated that such ico is not unexpected and is not significant with respect to safety.

Durirn the prior surveillanco interval, soveral of the 60 air handling units j (NUs) used to mintain ice condenser tenperature had been intemittently incperable for mintemnce or retnir. licAuver, it was corcitdod that the incperability of the NUs did not significantly contribute to the frost ard 100 formtion.

22

It is believed that sublimation of ice or high humidity in the containment could have contributed to the prtblem. The Westinghouse evaluation indicated that lattice frost and ice fomation of up to 20% of the total flow passage ama could be present without peak containment pressure eye =Hng design limits during a postulated accident. Since the fmst aM ice buildup identified in Bays 1, 4, 13, 18, 19, 22 and 24 constitutcs a total flow blockage area less than the 20% limit, the Licensee detemined that the situation is bounded by the Westinghouse evaluation.

{

The Licensees evaluation indicated that the amount of flow blockage due to

{

frost and ice buildup noted in the ice condenser can be tolerated without adversely affecting the ice cordenser function durim a loss of coolant accident.

Based on the above infomation and the Westirghouse evaluation, it was concluded that the abnomal dcgradation event did not constituto an untyviewed f safety question as defincd in lOCTR50.59(a)(2), nor did it adversely i@act health and safety.

The correctivo action was to defrost the ice cordenser, including manual scraping of the ice.

1 1 l 2.2 Reac' c or Trio Breaker Failed to Ooen Due to Whanical Pailure McGuire Unit 2; Docket 50-370; IER 87-009; Nestinghouse IHR j

On July 2,1987, during the performnce of the control rod drop timiq tests, plant personnel detected smoko in the area of the reactor trip switchgear.

The control rocn was notified and operators manually tripped the reactor trip breakers (RrBs) . Control rocn status lights indicated that both breaken had cpened, thcogh investigation revealcd RrB 2 to be closed. The breaker cculd not to opencd locally until an attc@t was mado to manually tension the breaker clocure spring. The crorators w re not holdim the fecdwater isolation reset button khen the breaker did cpen, so a train B fecdwater isolation occurred, but it did not cause ony adverso offects.

Upon investigation of the cause of the smoke, it was detemincd that the Westinghouso EG-416 RTB, installcd in the 2 RIB cubicle, was in the cicocd rcoition. Operators mado several unm="ful attc@ts to trip the breaker. {

hhon an attc@t was mdo to mnually tension the breaker clocuro springs, tho  ;

breaker opened. The breaker was removcd frcn its cubicle for testirq to l A bypass RIB was unavod frcn Unit 1 detemine the reason it did not cpan.

1DYB cubicle ard temporarily installed in the vacant Unit 2 2 RIB cubicle to ocuplete the rod drcp timing test. 1ho contml rocn irdicatirn lights for 2Rr8 cubicle have functioned prcperly durirg all subocquent tests.

The failure of the breaker was classified as a manufacturim defcct which caused failure of a wold insido the breaker. Tho investigation revealcd that the breaker failed to autcmatically cpen duo to mochanical bindim. A failed wold and wom crrponents in the breaker clocure moc:hanism were suspectcd of causirg the birdirg, but nothirn conclusivo ns found durim the investigation 23 x

to pinpoint the causo. The breaker underwent further inspection and testing at Westinghcuse to detemino the cause of the binding.

An investigation into the cause of the apparent erruncous breaker position irdicator revealed all ciruuits functionin] prtperly. No abnormlitics were discovered which could have caused an cpen irx11 cation when the breaker was still in the closed position.

There are four identical RIDS for cach Ird control system. 'Iho norml l alignnent usca two min breakers while two bypass breakcru are used to support testing ard allcw contiruous operation of the system durinJ per 611c mintemnce. Cubicles whica hcuse the breakers are labeled as RTA, RIB, BYA, ard BYB. 7ho fcur breakers are arran;cd in a scrics-parallel network, which allows a min breaker and the opresito train bypass breaker to be deactivatcd ard isolated for testiny or mintenmco. 'Ibeso breakers my be movcd frun cubiclo to cubicle as requircd. 'Iho RTBs connect the pcer frun the mtor/ generator sets to ".ho reactor control rod drive mechanism.

hhen either of (no two operable breakers open, (which are aligned in series) the pcwr S cut off to the control rod drives thereby releasiny the rods and the trippiny the reactor.

7ho McGuiro Unit 2 Operating Licenso specifies *. hat all four reactor trip breakers must be tested seven clays prior to unit startup ard underijo similar testing plus tim resporce testing cvorf 31 days. Every 6 months, the bruakers are testcd and serviced according to Westinghouso sWifications.

Raintenarco of this type is alco perfomod en all Unit i reactor trip breakers, though not required by the Unit 1 licenso.

7he WestinJ h ouse DG-416 air cirulit breaker proccduro provides for imWion ard mintemnce of the RTB anl the connection hardware insido the breaker cubiclo. Tests are perforrcd on the urdcIvoltago (UV) trip solenoid and the shunt trip solenoid to verify proper operation. Also, a force test is perfonned on the trip bar. 'Iho trip bar is rotatcd when the breaker is tripped by the W trip solenoid, by the shunt trip solenoid, or by the mnual trip lever.

The breaker impcdion prcodure is performd ever/ 6 months on cach breaker.

Duriny theco irepections, the breaker is nomilly cyclcd alcut 50 times to parfom the inspection acconting to the Westm3houso K31ntemnce ProJtum

KTnual for EG-416 RTBs. "Ibis proccdure was last parfon'ed for the traf n B 2RTB breaker (hcreafter called breaPnr D-4) on Decerber 18 1986, ard ro problems woro fcuni prior to placinJ tbo breaktu Pch in service.

On the night vf July 2 the c:entrt.1 red c4 tents were boing perfor cd.

'Ibstiny had teen ccrpletal for snutdcun hvka A through C. Testiny sus bein]

concludcd on shutdeun Ihnk D anj the RITis wro trquired to bo open as directcd by the test proccduro. Operators cps 3 the brea)etu an3, khilo holdinJ the fecdanter isolation reset. outtons as dircr;ted by proccduro, cbcorved the breaker position lights in the motru' roon clungo 1 cn clocod to cron. '1ho events rccorder inlicatcd that the trein A breaker hid cpencd, but un)mrun to the contruA race crerator, it did not inaicato a ;!anJo frce clocod to cren 24

for the train B 2 RIB breaker. HowcVer, operators in the control rocn did observe the illtninated open status iniicator light for breaker B-4.

Operators closed the RTBs to allow continuation of the test with shutlown (S/D) bank E control rods. Operators nh=ved the breaker position lights change frcn open to closed and shortly thereafter, began to withdraw S/D bank E rods. The events recorder again did not show a change of breaker position for breaker B-4. As operators here withdrawing S/D bank E, they noticed the demaM counter for this bank was not counting up frun zero. The operators notified pc sonnel who were workiN with them on this test in an adjacent re- which containcd the RTBs. At the same time, test personnel detected sac canirg frun the RrB cabinets. They informed the cperators who INately opened the RTBs and, khile holding the feedvater isolation reset buttons, observed the status lights chame frun closed to open. Unknown to the control roczn operators, the events recorder again did not indicate that breaker B-4 had opened.

Plant personnel investigatcd aM found that the bmaker in 2Rr8 (B-4) had not i titipped and was the source of the smoke. A local (manual) trip of the breaker I was then attenpted khile the foedanter isolation reset tutton was held down.

Since the breaker was smoking, a brocn stick handle sus enployed to push the l mnual trip lever, but the lever would not move. These mnipulations of the

) local mnual trip lever did not open the breahr. In an attenpt to cycle the l breaker, they bogan to mnually charge the close spring. As the close sprim i kus boiry tensioncd, the breaker opened. Due to the diffio11 tics and a long delay (about 12 minutes) in cycnirg the breaker, operators kuro not holding l the train B feodanter isolation reset button when the breaker fimlly opencd.

This resulted in a train B focd nter isolation sigml that was generated by the solid state protection system (SS M). Closure of the condensate foodwater l

valves uMer the direction of the foodwater isolation sigml did not cause adverse affects. Operators then declared 2 RIB incperable.

i Breaker B-4 kus renovcd from the 2 RIB cubicle. Operators notificd the Shift l Technical Advisor (STA) and the Unit 2 Shift Coordimtor of the situation.

The Shift Coordimtor advised cperators to contact Generation Station Support l

j (CSS) personnel to detemino if the Unit 1 bypass breaker frcn 1BYB cubicle

, could to uscd in the 2RrB cubicle to replace the failed breaker B-4.

\

A work roquest %ns* Written to investigate ard repair the problem with RTB B-4.

Operators also irplenentcd the liRC Imnarliate 110tification Requirements proccduro, ard infomed the liRC of tho breaker failure ard the fccdanter isolation (an eminecrcd safety featuro actuation) at 1:12 a.n. The Station ihmgor instructcd operators not to withdraw any control rcds without his ponnission.

Plant mmgement discussed the situation with 11RC porconnel and at 2:10 p.n.

on July 3, apprcpriate pomission kun given to resuno red drop timirn tests with the use of a Unit 1 bypass RTB. At 5:30 p.n. that sano day, rcd drcp timing tests weru ccrplotcd.

GSS tcgan an initial assessment to dotemino the cause of the failuro. Tho breaker was cyc1cd three times durim their incroction. The breaker was 25

l i

j cloccd electrically, and continuity checks of the auxiliary switch contacts in the shunt trip circuit indicated that they were cloccd. 1ho breaker was then trippcd by use of the UV trip attachment ard the breaker cpened. The breaker i

was then cloccd electrically a somnd time aM a trip force tect was perforud on the trip shaft, but rotation of the shaft did not trip the breaker. This

constituted the cocoM failure of the bruaker. Repeating what cperators had previously done to open the breaker, they bogan to mnually tension the cloco spring. As soon as the crank shaft (ard cloco cam) began to rotate, the breaker jarrcd open. 1ho breaker was cloccd electrically a third timo and a

) second attcmpt was mde to perform a trip force test. On this attcept, the breaker opened successfully. Testing was stq pod, aM the breaker was quarantined until all porrennel concerncd with the failuru oculd be present.

On July 7, an NRC Inspection Team arrived on site. Utility, Westin3 houso, ard NRC personnel met to detemino a plannod courto of action to inspect arri test breaker B-4 Meetiny attention focuscd on attcepting to preservo any evidemo which would show why the breaker failcd to cpen.

Inspection of the breaker rochanism revealcd that the kold khich connects the center polo 1cver to the polo shaft had failcd. This wold had crackcd alcoy its entiro length. Only one sido of the center polo lever was suldcd to the polo shaft and was only welded about half way around the polo shaft.

IrSFoction of other polo shaft levers revealcd that wcld 1cnJths weru on the order of 3/8 to 3/4 the cirurtforence of the adjoininy polo shaft.

Corresponding abnorral wear mrks kuro fouM at two different locations in the breaker. An irdentation approximtoly 3/32 inches long was found on the notch of the trip shaft which mted with a smil svar mrk on the trip latch.

Subcequent testiny deternincd that the forco required to rotato the trip shaft, allowirrJ the trip latch to pass through the notch on the trip shaft, was within acceptable limits.

1ho second area of excessive wear was the far left sido stcol lamimte of the four-picco lamimtcd clociny can surface, which contacts the rollor on the min drivo link. Wear was also fcund on the right most stcol plato of the closing can, but was not en excessivo as the left mcct plato.

l In an atterpt to recreate the birdin] khich had twice preventcd the breaker frcn cronitrJ, 31 tripo of the breaker woro perforred. Soveral attcrpts vero I

I mdo to artificially prcduce sini'.ar bin 31ny of the breaker rochanism, but cach tire the breaker was directtd to trip, the breaker ciencd auxrnsfully.

khenever the breaker was cloccd, inspcction revealcd that the min drivo link tcp pin, min drivo link, ruller constrainirry link, trip latch, anj eentor polo Icver (with the broken wold), kuro able to twist anj subocquently bird.

All other trip cy ten ecxTonents did not reveal any abnormi cr*ditions. 1ho collective insprtion anj testiny of the breaker was concludcd on 1hurniay, July 9.

Inspection Logan on the reminin) thrce Unit 2 RITb on July 13. Curin) the incpcction of the breaker frxn cubiclo 2RTA (breaker B-1), rettontul fcon3 a questiomble kuld on the role rJuf t lever which crerates the auxiliar'/ cwitch linkago. The inspxtor rcrforroj a liquid dyo renetrant test on the weld anj 26 1

_ _ . _ _ _ _ _ _ _ _ . _ . I h

discovered what appeared to be a hairline crack in the weld. A force test was perfomed on the lever am using a safety factor greater than six. We lever satisfactorily passed the test, aM the breaker was cleared for retum to servloe.

Visual inspection of breaker 2RTB (breaker B-2) revealed heavy wear on the left side of the closing cam. W e main drive link appeared to be tilted about 30 degrees to the left frun the lateral plane. Clearance of the rrxhanism appeared to be adequate aM wlds were good. We same type of wur was hWed on breaker B-3, where all welds were detemined to be acceptable.

f Electrical testing perfomed on the B-4 breaker iMicated that all switch aM internal wiring were satisfactory except for the burned out shunt trip coll.

We shunt trip coil burned out about 2 to 5 minutes after the ooil was energized but did not docnergize because the breaker failed to open. his coil is not rated for continuous duty aM is nomally dooncrgized by another auxiliary switch as the main breaker contacts open.

%e shunt clearing contact opens well before the green (open) light and the events recorder contacts. his indicates that the shunt trip coil could ret have burned out if the auxiliary switch contacts for the green light had mado contact. Since both the grocn light and the events recorder operate sinultaneously, this muld prwide recorder data that the breder did not open. Likewise, the auxiliary switch contacts for the green light could not I have n3de contact to illuminato the groen light unicas an extemal witing prtblem existed. So exterml wirirg was checkcd for cirulit polarity and dotemined to be correct in all cases.

Ground circuits on the 125 volt dc battery power system were investigated. A ground was fourd on the positivo sido of the de system but was not insido the breder ccrpartrent. After failed breaker B-4 was replaccd with an operable a breaker, the replaccrent breaker was cycled five tires in cubicle 2RrB.

During this test, all breaker position indicatirg lights and the brehar itrelf cperatcd correctly.

20 failcd RIB D-4 had Leon thoroughly irepoctcd ard testcd in Docerter 1986.

Wat incpection found no prcblera. Sinco then, breder B-4 has toen cycled suceossfully. Each tire, the breaker perfomed as requircd. 20 device pasccd the tire responco , tests rcquired overy 31 days without exceedirn the mximum 150 millicocord cycning tiro limit.

Proliminary investigation did not datomino a reason for the breaker to stick clocod and fail to cpen. %rce factors which may have contritutcd to failuro of tho breaker to cpen are

- kold failuro,

- ntnufacturirn tolerances of tho bredar ccrpcmnts ard,

- the cunulativo effoct of the high rebor of cycles on the breaker.

Wo actual reber of breaker cycles could not to datominod to any dcgrco of accuracy since the breaker was retrofitttd with a counter after initial installation. Dest estimtes placo the number of cycles abovo 3000. Clocuro 27

(

\ ________-

)

mechani mrts, particularly the closing cam, showed signs of abmrmal and excessiw wear, but the exact point of binding, which resultod in the breaker failing ' - open, has not been determinal.

, Investiga ,lon of the shunt trip coil determined that it failcd scuctine after breaker B-4 was cycled at the conclusion of control ,wi drg) timirq tests on shutdchn bank D; but before rtd ditp testing was =0 artes m shuth BanV E.

%e events recorder indicated that 'Le breaker did not own cturirn theco atterpted breaker cycles ard that. 'he shunt trip mil ma: nod cont'mously d

energized. We shunt trip ( qi- burned up and shar*e,t to ground anf the resultant smoke alerted personnel to the breaker gulmo, Investigation into Westinghouse breaker tailures, witt th3 tsJistamo of the )

Nuclear Plant Rollability Data System (NEDS), revealed r ? failures of DS-416 breakers used in various applicati,J m Pr.ast if, they involved failure to closo due to electrical problems in auxiliary switches Ltd exterrni control circuits. Hchever, ' hree failures were asscciatcd with brohn wolds.

'Ivo occurrences at other utili ics involved wald failures associated with the pole shaft. %e third occurrenco kus associated with the secondary disconnect support bracket.

Unit 2 kus in hot stardby, and had not been critical for 63 days duo to a refuelirg cutage. Control rod drop timirn tests were being performod khich allowcd only one bank of control rods to be withdrawn frm the core at any given time. To verify that the rods of the bank being tested have all drtsped, both RIBa are opened to ensure that all reds are at the hottcn of the core prior to withdrawiry another bank. In this incident, one of the RIBc failal to open, but the second (redundant) breaker did cren.

20 failure of this breaker was discovered due to the smoko which resultcd khen the shunt trip coil overheatcd as a result of not boiry reset after energizing. If the shunt trip coil had not overheated, or if the smoko had not been detectcd, the timo at which the stuck-closed breaker sculd have boca discovercd is not certain, assunirg the condition which provided the erronecus indication in the control recn continued to exist. It should bo noted that the mximum timo pericd a breaker could be in an unknckn failed condition is 31 days under the swvoillanco requirencnts. %is cordition of eno breaker continuously stuck cloccd wculd not have affectcd the timing tests being perforncd sinco the redun11nt cporatirn breaker would have perforTned tho openirn function.

Had this incident occurrcd at 100% pcser, the rodurdant RITI would have perforncd the openirn action required to cut pcAur to the control rod drives ard trirpcd the reactor.

In a rootulatcd incident where the stuck c1ccod breaker condition previously existcd, a failuro of the occord breaker wculd involvo both RIBa fallirn to shut dchn the reactor. his scemrio of failure to shut dcAn the reactor is addrecccd by emnzgency proocdures. If a reactor trip has not occurrcd, throo cporator actions stuld havo to be carrial out to incert the control rcds. First, cporabru wculd havo to mrually insort the control ruis. Another cycrator stuld havo to go to the adjacent rocn which contains the rotor / generator (!VG) sets ard cpen tho output breakers that surply pcser to tho rotors of the !VG cots. Wis action eculd be cceplottd in 28

)

_ _ - - - - - - - - - - l

, less than 1 minute. It should be noted that durirg an actual reactor trip l

event, operators in the omtrol reca will usually first look at the digital rod position indicator lights for confination that the rods have dropped after openirg the ICBs. Berefore, sufficient capability to trip the reactor would exist at all times.

i 2.3 Unic:olable Reactor Coolant Pressure Boundary Isak Chsed BV Failure to Identify Defective Seal Weld Made Durim Pressurizer Romirs Arkansas Nuclear One, Unit 2; Docket 50-368; IIR 87-006; Ocubustion Ergineerim WR At about 10 a.m. on July 6, 1987, khile ANO-2 was at 100% power, health physics and cperations personnel entered the Ato-2 contaiment building to perform surveys and inspections in preparation for maintenance on a steam generator level trmsnitter which had been exhibiting abnomal indications.

While in containnent, they perfomed a ger*.ral inspection of the building and identified a small leak which appeared to be originating frm the bottm of the pressurizer. Due to time limitations, they left the contalment and informcd plant managenent of their findims.

At 2:09 p.m. another containnert entry was mde by health physics, operations, and engineerim personnel to identify the specific location of the leak.

Durity this entry it was determined that a small leak ms originatirg frm the sleeve collar area on pressurizer heater sloove Y4. W e Icak rate, estimated to be about tw to three drogo per minuto, was determned to be an RCS unisolable pressure boundary leak.

An Unusual Event was declared at 3:06 p.m. , and unit cooldown was ccnnonced per technical specifications. 20 unit reached hot standby at 8:00 p.m. ard cold shutdown was achievcd at 3:43 a.m. the next day. 'Iho Unusual Event was temimted upon reachirq cold shutdcAn.

I Earlier, on April 24, 1987, plant personnel discovered an unisolablo RCS pressure bcurdary leak originatiry frcn a damagcd pressurizer heater sloovo on the pressurizer (reported in IIR 368-87-003). Subcoquent investigation revealed tw coverely damgod heaters. We design and mnufacturing process of Watlow heaters was the root cause of the heater failures. '1W.nty-throo

, Watlow heaters wro renovcd frcn the preizer as a precaution against futuro failures. Duo to umvailability of a sufficient rarber of replacement heaters, 15 crpty heater alcoves wro fitted with torporary heater plup widcd to the alcoves. his kerk was perforncd in accortlanco with an approved design charm package.

Ctrbustion Ergineerim (CE) was contracttd to perfom the design ani installation of the pitys, includirn all weldiry by qualified widers and non-i destructivo exanimtion (UDE) of wlds by certificd inspectors. Work was perfomcd under the CE quality assurance program. Six new replaconent heators mnufactured by Cencral Electric (GE) were also installod in the NO-2 pressurizer by CE at the rMo tiro. Wis mdo a total of twenty-ono coal wlds perfomcd by CE on the pressurizer heater slooves in Riy 1987.

29 l

After all repairs to the pressurizer had been ocmpleted and while electrically re-connecting the heaters, two wre found to be electrically shorted. One of

)

these heaters was a new G unit which had just been installed. We other was an original heater installed durim plant construction. Both heaters were removal and tenporary heater p1txJs selded in the heater sleeves. Since a personnel had already left the site, these repairs were capletal by utility personnel. Welding on these plugs was performed by mechanical maintenance j personnel and IE on fiml welds perfomed by an on-site contractor qualified /

to perform }E .

Upon discovery that the Y4 torporary plug seal weld was leaking, a detailed <

review of the plant design chango package used to perfom the welding was initiated. All aspects of plug and heater installation were reviewed - wid recortis, mtcrials, personnel qualifications aM results of lE performed after fiml wlds were cxrpleto. We results of this review generated concerns with respect to the quality of the seal welds perfomed by G. A decision was mde to inspect additioml welds associated with the installation of the plugs and heaters.

IE of 14 wlds done by C, including the five heater seal wlds, was ccmpleted on July 8. Weso tests showd that about 50% of the wlds had scne type of umoceptable irdications. 20 defects included both rounded (portsity) ard linear (crack) indications. Visual inspection of the wlds revealed several instances of wld roughness, sharp edges, and apparent discontinuitics in the wld ratorial. In addition, measurencnts of wld mterial dotemined that tw of the wlds had unacceptable goccetrics, i.e.,

less than minirum 1/8-inch fillet wid size.

Inspection of tw Wlds acrploted in May 1987 by utility personnel identified no apparent problem. After a thorcugh review of the installation of these plugs it was decidad that theco seal selds were acceptable.

%c plant technical specifications state that pressure boundary leakago of any m gnitudo is umcceptable since it my to iMicativo of ir  !

failure of the pressure tourdary. At the tiro of discovery, poMing gross the dofoctivo scal sold for the Y4 torporary heater plug was leaking at a rato of tw to three drcro per minuto. min all leak creatcd no operatiomi prob 1cnn. In acklition, ovaluation of laboratory testirn perforral on the wld after renoval concludcd that the leak was caused by a lack of kuld retal fusion. %is was probably produccd at a lccation where woldirn sus stcyped aM then restarted. #

It was concitried that the probability for grecs failure of the keld was extrorely low.

Another significant factor is the design of the pressurizer heaters. We heaters (in this caso the terTurary plugs) wro insertal into the slooves aM W1dcd to the slooves. A 1cckin7 collar cocured to a threadcd portion of the sloovo covers the heater aM scal wldal area. Even if catastrtphic failure (

of the wld cocurs, ojection of the p1trJ frm the sloovo is provental by the locking collar. Subccquent 1cakago would to limital by the c1cco tolerances botwen the plug aM collar. Ihsod on theco factorn, it %ns concitricd that the cafety significanco of this event was minimi.

30 l

1 l

l l l

'Ihe length of time that the leak existed prior to detection is not known. As a asult of the repairs to the pressurizer, ruutine monthly inspection of the contalment building, including the lower head ama of the pressurizer, have been initiated.

Se Y4 and C2 temorary heater plugs installed by G in May wem removed frun i their sleeves by cuttirq off above the seal weld takiM care not to damage the l weld during removal. We plugs, with the intact welds, were visually  !

inspected by utility personnel aM then shispri to G in Windsor, Cbnnecticut for laboratory testing aM failure analysis.

l We examinations coMucted at G used visual, sterecnicroscopic and scannim electron micr:soope techniques. %ese inspections tevealed a brown stain emmtirq frua abwt the center or a "grouM-out" region of the weld. A dyn penetrant test confirmed that this location was the leaking defect. %e next i

approach was to carefully grind into the defect and m&m cbservations on an ,

i etched plane perpendicular to the hak path. After grindirg, a detailed examination of the surface ruvealed a "oold shut" type of void in tha weld 4

metal apparently at a weld stop/ start location. Additional griming was performed and the leak path was examined in a sterecnicr='ma. Depth was hwed to be significant and the botten of the void could not be visually y detected. At this point the sanple was sectioned in the axial direction just to one side of the leak path. Careful grindig tcuazt1 the leak path expceed l

. the entire defect for examimtion. his view revealed an absence of weld metal fusion. %is was detemined to be the cause of the leak.

l Faview of the plant design change package used to install the plugs and heaters during the May 1987 outage revealed that 11 of the 15 terporary heater plug wolds perfomed by G had umeceptable test results after final welds

! era ccrpleted. Further dccu:rentation indicated that all of the unacceptable i hvilcations had been recoved by grirdirg the wided areas followed by satisfactory examimtions. Repair of wolds or renmal of wid surface in11 cations by grirdirn is acceptablo per ASME Cbde,Section III, class I requirenents provided the minimum wld sizo is maintained. Final visual impoction perforred by G pcIsonnel irdicated that the wlds wro

) satisfactory. l t

{

At this time the root cause of this event appears to te related to the failuro '

1 to identify ard corruct the discrepancies associated with the wlds in their -

I l fiml as-left ccMition durirg tho M1.y 1987 outage.

j Followiry plant shutdcun aM cooldown in July, imediate action was directed .

toward detorninity the specific location of the leak on the Y4 heater plug.  !

i 14cn discovery that the leakago was frun a taporary heater plug seal wold, l actions were initiated to identify the root cause of the defs:t. G was

' contacted aM a G Wldirn ergineer who was involved in the May 1987 pressurizer repair was brco3 h t on site. Essed on the results of extensivo i reviews of weldim reconis aM visual examimtions of the leaking seal wld  ;

after reroval frun the vessel, it was conclMed that the exact cause of tho l defect could not be dotomined withcut further laboratory tootirn of tho l

actual wld. Additicmily, the investigntion created concems that tho Y4

! 31 1

3 .

1 l

3 weld failure may not have been an isolatal case and that the integrity of all taporary plug welds and heater welds perfor: nod during the May 198" outage was mapact.

After verification of the welding records, and NDE of the two welds which utility personnel had parfomad during the outage, the scope of future actions was limited to those welds khich had been perfcmod by G personnel. Actions wre initiated to renovo and raio all seal welds cxrpleted by 2 during May 1987.

A total of 20 welds were cut out and runovcd. Wis incitxkx1 15 welds aawlated with taporary heater plugs and five wlds used to install new hmters. turim rauval of the heaters, the heater sheaths were damged slightly and the heaters could not be reused, me 20 pressurizer heater sleeves were incpected arri new plugs were inserted ard welded in place.

Utility personnel performed all renoval and reinstallation. i 7b insure acceptable fim1 wld quality, soveral aspects of the repair process were modified frun thoco uscd by a during the Pay repairs. Sono of those wre: ,

a. Weld 'Ibchniques

1. A different wid filler .4ro size was utilized. 'Illis was done to allow ' cotter pxkilo a .a bead control by tho wider.

2. During the Pay repair esfort, pcIsonnel used a variablo a:prago/ current control device to control wlder cutput. Wis device had to be controlled locally by the person actually doing the wldirrJ. Sus accurato control was mde difficult due to physical spaco limitations in the area. Variable wider control was not used on future jobo.

b. Repairs / Grinding Considerations

1. If grirding operations W10 now-try to rcravo surface defects irdicated by NDE or to irprove tho visual acceptability of kulds, theco operations w re limited to light inffing or )

polishim whero prmcible. mis rothod minimized the p:csibility of "crearirry" the s.uld mterial over a defect which could precitxio dotcction of tho defect during subcogaent examimtion.

2. If "hart!" grindirry of a wid was nccessary to ruovo a defect, all areas subjcct to this process wrc ground to the base mterial . Werefore, no wld filler mterial rmiinal in the defect area. Any "ha::t!" grunt areas wre w idcd after grirdirrJ arti then reinspcctal.

l 32 a

s

/

)

2.4 ESP Actuation Prm Kiin Turbine Trio ard Footsater Isolation Diablo Canyon Unit 2; [bcket 50-323; IIR 87-015; Westin3 hcuse WR {

At 4:41 a.m. on July 14, 1987, with the unit in power cperation during a startup, a main turbine trip, a min feedsater prp trip, a' a fcoisater isolation valve closure occurrai due to steam generator 2 reachin7 its high-high level setpoint.

%e high steam generator level was caused by foodsater control difficulties resultirg frm nochanical problens with two steam dep valves, nose difficulties were further aggravated by a positive moderator tcqmrature coefficient (MIC). Operators prorptly reduced reactor power and stabilizcd the plant.

We irmediate corrective actions to prevent recurrence were to repair, adjust and test the steam dep systen and to contact other facilities with recitive MIC experience for inferration on operatirn stratcgies. mese strategies were reviewed with all operators.

Iorg-term corrective actions includcd:

revision of startup proccdures to provide more detail for fecdsater control on startup, identification of systems requircd to be fully cperable, provide methcds for startirn up with a positive MIC ard, revision of the sinulator prtgram to adequately redel the characteristics of the core after a core reload if there is a significant difference betwoon the reactor core ard the simulator f core nodel.

2.5 Irottoer 'Ibmue Switch Settirns, for containment Sorav Valve Oconee Unit 2; Docket 50-270; IIR 87-006; thWk & Wilcox WR On July 17, 1987, the plant was at 87% pcur. Reactor building spray valvo 2BS-2 was declared to have boon inoperable frm September 20, 1986, until July 17, 1987. On that day, enginocring calculations first detemined that the valve was technically inoperable. 'Ibrque switch settinJs on the valve operator were set too low.

%e roactor tuilding spray (PBS) system is designed for long tem heat runoval following an accident. We system sprays borated water frcn nozzles at the top of the reactor building. We RDS system consists of two indeperdent trains, each with its own pmp, nozzles, and associated valves and piping.

Valves 2BS-1 and 2BS-2 serve as throttle valves for the RDS purps, h

34 i

1 l

l

c. Inspections of Wold Pmooss and Fiml Wolds Several difforent levels of inspection wre utilized to renitor the wldirn pr-a and to verify acceptability of the fimi wlds.

20s0 incitx5ed extensivo utility quality contml involvement in tho

actual wlding and subsequent NDE; the use of an outsido ner. tractor I to perfom fiml wid examimtions; an1 irdepen3cnt verification checks by qualified utility welding ergincom and plant enjinocrinJ.

As a result of the Y4 heater plug seal wid leak and other discremmics, a decision was mde to review other repairs nyje durinj the Ny 1987 outago in the location of tho X1 and T4 pressurizer heaters. Soso Irpsim had wisted of emplete renoval of the heater slooves and wldiny of pitys in che lower pressurizer head. 20 design ctwoo packago uscd for these mpairu was reviewcd in detail. DThasis was placed on identification of the extent of quality contml involvcenent ard ver:.fication during the mpair, incitxling acceptability of the results of NDE. Evaluation of the results of this review concludod that there were no potential pmblona related to the repairs of the l

XI and T4 areas. Acklitiomily, the review confimod extensive involvement by utility quality assurance and quality control personnel in these repaim.

After the repairs to X1 aM T4 areas were occpleted during the my outago, ultrusonic examimtion (UTE) was performod on both areas to collect baselino data for futuro examimtions. Since the unit was shut dcun to repair the Y4 seal weld ard plant conditions were similar to thoac established for the UrEs

( in my, it was decided to repeat the UTE on the X1 arri T4 areas durirg this I outago. 20 UTE of the areas was carpleted on July 13 and the results irdicated no significant differences frcra those cbtainod in my.

Followiny plant heatup on July 16, 1987, a leak test at clovated reactor I

coolant system (RCS) pressure was conductal as required by the ASME codo for f repairs of this type. Visual examimtions were conducted in the area of the l lower pmssurizer head with specific inspection of the sleevo collars and I areas of seal wolds. No leakage was noted as a result of these inspections.

1 Actions planncd as a result of this event imitxiod:

1. NDE perfomed on the seal wlds of the terporary heater pitys and heaters after plant shutdawn on July 7 established the as-fourxl conditions of these welds. Evaluation of the Irsults of the cumimtion ini8cated a significant difference betwen the as-found cordition and the fim1 as-left condition of the welds perfonncd by CE in my 1987 as documented in the plant design change package used for the repairs.

)

, 2. We monthly containment inspection implemented after the pressurizar

( repairs in May 1987 will be continued. Such inspections will l

provido a high confidence 1cvol that RCS leakage frun the ANO-2 l pressurizer or other scuras can be identified arri nuw =y correctivo action taken, t

33

l

)

l l

The system initially takes suction frcra the borated water storage tank (BWST) thrcugh an intert:ennection with the low pressure injection (IPI) systen. As the IEST level is depleted, the RBS suction switches to the containment hiildirg emorqcncy surp as the 1PI systen switches to recirculation.

In 1986, Duke Power Ccepany began a program to verify operability of motor cperated valves (!OVs) in response to imC ailletin 85-03. Part of the program utilizes the Motor Operated Valve Analysis and 7bsting Systan (! OVA 75) for testirs valvo operation. Prior to this, icVs were generally set up based on calculations by the valve cperator manufacturer - Limitorque Corporat. x1.

Limitorque in turn perfomed the calculations hunt on the particular valve boirq used. khen the utility program began, it was a ocmbined effort of Design Engineerity ard !?uclear !bintenance personnel.

7ho selection of a valvo operator for a particular valve is based on the calculated thrust required to open aM close the valve. In order to protect the valve aM the operator frun boirry overstressed and damged, torque switches are adjusted on the op2rator to stop it shan a prodotemincd torquo is encxsuntorxl by the valve or operator during opening and closirg. 7ho torque switches are set at some mrgin above the normal operating torque requirtd to crerate the valvo. Since greater torque is required to unscat a valvo, a switch is provided to electrically bypass the torque switch durirn initial valvo opening travel. Both the torque and bypass switches my be adjusted in the field.

The first stop in the crerability program was to obtain thrust calculations frcn Limitorquo. Limitorquo was first contacted in March of 1986 to provido thrust data for safety-related !OVs. Informtion for specific valves was requestcd by the origimi order nurbor under which the valves wre purchased.

Valves 3DS-1, 3M-2 and 2M-2 for the RBS system wre purchased under one order nudor. Valvo 1BS-1, 1M-2 and 2B5-1 wre purthased urder a separate 8 order nudor.

On ~1y 2, 1986, Limitorque requestcd rore informtion regardirg several di.. ucnt valves incitxlity the RBS valves. At this tiro, it was noted that the Rm valves wre listed as gate valves. Limitorque requested that Dako j Design Engineerity insuro that the data was accurato. On July 8,1986, Design Drjincerity tent to Limitorquo a Duke drawirn origimlly obtaincd frcn the reactor supplier - nihwk & Wilcox - khich listed the valvo an a gate valvo.

In August 1986, Limitorquo sent valvo crerator data shoots to D2 sign Ergineerity for the threo RM valves plus other valves. In a cover lotter acccrTonyiry the data chcots, Limitorque roccrrondcd that the informtion on the valves to verificd with the valve mnufacturor. Design Ergineerirn subocquently roquestcd data frun the valvo mnufacturer on AtrJust 22, 1986.

7brquo calculations for the pm valves wro bacal on factors for gato valves, but Design ngineerirn detomincd tMt the valves wro gicbo valves. This mdo the thrust calculations imcx:urato. Design Engincerirn had tho irpression that tho Limitoryuo data was to be uccd only for referenco; and only for ccrrarirn the thrust calculations used for origimi field cotup to insure that the valves woro cporablo. Design Ergineerirn ocnt the data chcota 35

i for the RBS valves to PA2 clear Maintenance and did not infom them of the mislabelled valves or the incoract calculations.

When liuclear Msintenanct received the data, it was a==vi correct. Upon review, based on the thrust calculations, it was noted that the valve operators appeared to be oversized. However, this was not investigated further. Later in August, th2 clear Maini. canoe sent work sheets showing the required thrust settings to te used with the PD/AIS prugram to the Instrument ard Electrical (I&E) group. %e work sheets listed the valves as gate valves.

On Septaber 19, the M/ATS procedure for testing valve 2BS-2 was performed.

%e procedure requires that the "W/AIS Tbst Data Sheet" be filled out as mxh as possible prior to actually testing the valve. Section 1 of the procMurs requires inforration whether the valve is a globe or gate valve. One step was signed off as o:rplete, when in fact, the individual had not ocrpleted it -

the valve type was left blank. %e irdividual involved stated that he had been using Section 1.0 as a neans of verifying his rwords by lettiry the M/ATS crew fill in the blanks with "as fouM" data. At this time, the individual sus unaware of how the required thrust for a valve was calculated ard did not know that the valve type affected thrust calculations.

M/AIS amlysis on 2BS-2 was perfomai September 20. %e torque switches kure set based on the calculated thrust and field measurements. 7We settings wczu 1 css than the minirum sottings later detemined in July, 1987. Thus 2BS-2 was considercd inoparable frtn September 20, 1986, until July 17, 1987.

While perfomiry the analysis on 3BS-2, the I&E crew did not fully ccrplete Section 1.0 of the M/ATS proccduro. Khon this proccdure kus reviestd, Section 1.0 kus then cxrpleted. At this time it was deteminal that 2BS-2 kus a globo valvo, based on plant flow diagrans. Valves 3BS-1 ard 3BS-2 kuro M/ATS tested in a similar fashion on Jarrlary 23 ard lurch 5, 1987, recrectively.  ;

Cn March 4, Design Ergineerirg received infomation that had been requested frcn the valvo manufacturer (Aloyco) and forwarded it to Limitorque. Durity this timo, a valve group had bocn fomed in the Design Ergineering organization. On May 14, Limitorque sont the corrected thrust calculations using factoru for gleto valves. At no time, sus liuclear }hintemnoe aware (

that the data for 2BS-2, 3BS-1 ard 3BS-2 were in enur. As part of an ongol19 study of va'ivo cperability, Design Engineerirq requested that !?oclear (

lbintommo chtain actual field data on motor crorattd valves.

On July 14, while reviewirn the valvo data, !?aclear !bintenmce mted that the thrust calculations for valves 2m-2 and 2m-1 were significantly different even thatqh they woro the cam typo valve. R2rther investigation revealed that 2B3-2 kus misidentificd as a gate valvo. %e next day, Ituclear K11ntemnco infcmed Design Erginocrirn that valves 2BS-2, 35-1 ard 3!E-2 were all misidentificd and requented an amlysis to dotemino crerability, 36 i

on July 17, Design Engineerim determined that valve 2BS-2 was technically i incperable while valves 3BS-1 aM 3BS-2 oculd be considered operable. The Unit 3 valves were 6wM operable because, based on !OVATS data, ths torque bypass switch would bypass the torque switch until the valve was ccepletely off its seat.

Valve 2BS-2 had the sam bypass however it disengaged four milliseconds after ths valve was off its seat. Design Engineerim determinM that four millisecoMs was insufficient to assure operability. The 3BS valve tim S

intervals were about 10 tims higher. Design Engineering had detemincd how high the torque switch setting had to be for the valve to be operable. I&E personnel adjusted the 2BS-2 torque switch to the reewucMed settim on July 17f thereby makiry the valve operable.

The Licensee conclMod that the root cause of this incident was the failure of Design Ergineerirg to infom truclear niintenance of errors in the thrust calculations. Design Engincering had the impression that the Limitorque-suglied data was for reference only and was not to be used for valve setup.

This was in error, as !?uclear Maintenance forsurded the calculations to the plant after enly verifying the calculations. It kus also concluded that the vendor-supplicd data contributed to the incident tecause it was imocurato.

It kus noted during the incident investigation that three opportunities existed that could have prevented or mitigated the incident:

{ 1) The first occurred in 1972 when two approved B&W drawirgs errencously showcd that valves 3 M-1, 3BS-2 and 2iE-2 wre gate valves, one of the drawings showod the cutsido dimensions of the Limitorque cperator used on tho valve khile the other showed a wiring diagram for the cporator. On both drawirgs, a table of valvo data in the mrgin of the drawim listcd the valvo as a gate valvo.

Because tuke PtAur Ccrpany purchascd the operators ard valves frcn Limitorque through B&W, it was concludcd that the errors on the drawirns are relatcd to the errors in the Limitorque files. Ibd this discrepancy been recognizcd ard corrected on the drawirgs, the Linitorque files wuld have toen corrected.

2) The soccM chance occurrcd when iluclear Maintemnoo noted that the crorator for 2BS-2 appearcd to to ovoruizcd for the valvo. Ibd the armily been investigatcd, the calculation errors my have been discovered.  !!cwver, it was not considorcd significant at tho tire to warrant irrodiato investigation. 1ho investigation notcd other instances where Linitorque data initially appeared inconsistent (tut lator verificd correct) . Thus it cannot to concludcd that !?uclear M11ntemnco actcd in error by not perfomirn an imediato investigation.  ;

3) 1ho third cpportunity lay with the I&E Dyincer who reviewd the cbta ard corplottd the !OVATU proccduro. Ibd ho preterly otrplotM the procoduro, ho my Mvo noticcd tMt 2DG-2 was misidentificd as a gato valvo. !!cAuver, khen 283-2 was testcd in Septcrbor, ho had not ocen the cquations for calculatim thrust aM was umwaro that tho 37

calculations kuro deperdent on valvo classification, khon Nuclear [

M31ntemnce rocoivcd the data shoots for 3BS-1 aM 3BS-2, they I included the equations. The I&E engineer could have recognized the error if he had noticed the mislabelling of the valve while filling in the MNATS procedure and that thezu sure different calculation factors for globe and gate valves.

Cbrrectivo actions included:

Increasing toIquo switch ratting on 2B5-2 to 3.0.

Infoming LimRoIque that 2BS-2, 3BS-1 and 3EE-2 were globo valves.

Reviewirg bypass switch setting procedures on retor operated globe valves.

perfoming HNAIS test on valves 3IE-1 and 3BS-2 ani cinrge torque switches to a setting of 3.0.

For post accident long-tem cooling, the RBS system is designcd to cperata rcdundantly with the reactor building cooling units (RDCUs) . Either system is capable of supplying 100% of the required heat rcr:cval calculated in the Final Safety Amlysis Report (FSAR) .

Urder the rest severe pressurization accident, the FSAR states that if both RBS spray trains are out of service, ard all RDCUs are incperable, the i

pressure in the reactor tuilding stuld remin below design pressure. The /

cooling capacity of either train of RDS; the RDCUs; or a ccrbimtion of the two is required to protect contairrent cquirrent urder long tem accident ccrditions.

It should be noted that valvo 2BS-2 sus rurdercd inoperable by a cwitch setting shich was designed to prevent crverstressirn of the crrpcnent. At no tire was there a ocrponent failure wmiatcd with 2BS-2 incperability. 2BS-2 {

is locatcd outsido contairrent building in a penetration rocra. In case of an accident, the penetration roam could to entercd to adjust the torque switch.

The Liecnsee concludcd th3t the health and safety of the public sure rot affectcd by this event.

2.6 Poe,sible Imdernute Cbntairmnt Coolim After A Non-IDCA Event Sequoyah Unit 1; Ibcket 50-327; IIR 87-047; Westinghouse ER On July 22, 1987, with units 1 ard 2 in cold shutdcun, it was detemined that long-tem contain ent tcrperatures followirn a non-loss of ecolant accident (IDCA) sure devolepod without censiderity the reactor coolant system (RCS) as a rajor heat scurro.

For events insido contairent, a IDCA was assunod to be the bouniirq condition for develcpiry the long-tem urporature profile. This assurption was used to 38

_ _ _ _ _ _ _ _ _ _ _ _ _ I

develop the postaccident terperature profiles for envircrrental qualification (D2) of ocrponents located insido contalment. However, the IDCA amlysis assumes that the plant will be taken to cold shutdcun following an accident.

For all other events, the safe shutdcun coMition of the plant is hot staMby.

This is because a single failure of the residual heat ruoval system could j prevent entry into cooler operatirg redes. mus, with the plant in hot i stardby above 350 'F, the RCS will act as a heat scurro. This oculd cause the I lon3-tem containmnt terporatures to rise above the present D2 torperatures.

The plant is also designed to be mintained in hot staMby for events m,mring outsido containmnt. No amlysis had bcen perfomed to verify that

> terporatures insido containmnt remain within the present Da terpxature profile for events occurring outsido containnent. Previously, it was assunxi that norm 1 ccutaiment cooling wulld be available. Hcuuver, the cooling equipmnt that is assured to function is not safety-grado. Scrofore, it cannot be assumd to provido a safety-related fumtion.

The cause of this cordition was identified as a design deficiency in the developmnt of long-tem containmnt teqcratures following a non-IDCA event.

Previously, it was assuncd that a IDCA vas bourding for developing the lon3-tem tencraturo profile of the containment. However, for non-IOCA events, a f ocrputer ocdo detemincd that after several hours, the teqcrature could rico above that for the IOCA caso. Thus, the Da tenerature profiles for equipmnt insido contalment could be potentially nonmnservativo.

Scqacrfah was shut dcun in August 1985; therefore there has becn rn violation of environnental gaalification of equipmnt. If the plant had experienced a non-IDCA event at pcwcr, the postulated wnditions cn11d have resulted. Iho postaccident torporatures insido contaiment could rise abcrve the present D2 terpcrature profile. Hcuuver, the present mrm1 containnent coolin3 equipmnt is assunod not to function in the accident amlysis.

no 1cuer contaiment coolers were origimlly qualified as safety class 2B coolers. The quality of this equipmnt is such it oculd be up3radcd to safety-relattd requirenants. The prc&nbility exists that even thcugh the norml contaiment cooling ccrponents were rot relied upon for the accident amlysis, sufficient cooling sulld have been available to prevent tencratures h frtn risin3 above the present D2 toqerature profilo.

To resolve the potential problem, TVA decidcd to up3rade the 1cuer ocrpartrent coolers to mcet safety grado requiremnts. The lcuer carpartrent coolers invo sufficient heat rcraval captbility to remin within the present D2 teqcrature profiles for events both insido and outsido contaiment.

2.7 Imdete Corrunication Iwtswn Edsinn ormnizations Results in Ummlyzed Coniitions Scqacyah Unit 1; Docket 50-327; IIR 87-044; Westinghouse WR 39

7 Flooding effects of moderato line breaks (MEIB)* were not adequately analyzed due to imdoquate cation between the, pipe break analyst and the system engineers responsible for performing the analysis. 'Ibe requirement for an evaluation for floodirg effects was not specifically identified in the ,

pipe break analysis report. As a result, the lead civil design organization only evaluated jet and terporature affects of MEIBs. 'Ibe mission of MEIB I flooding analysis was not recognized until efforts involved with upgrading {

documentation a e lated with 10 CFR 50.49 (Enviremental Qualification) discovered the oversight.

l Accordingly, 'IVA contracted with Sargent and lundy to perfonn a study of MEIBs. Sargent aM lundy detemined that flooding aelated with MEtas could potentially surrorge ard impair cuyceents required for safe shutdown ard '

threaten integrity of certain structures due to increased loading.

'Ihe identified conocms resulting frun the MEIR flooding study have been addraanM by 'IVA. In order to cceply with 'IVA intemal design staMards, certain actions (such as scality building walls) were taken to minimize the inpact of potential MEIBs. Other actions (such as protecting cables frun water) kere to be irplemented before restart of either unit.

Additional actions have bocn taken to inprove acrrunication across the I enginocring disciplines. In addition, probabilistic risk acamanents (IRAs) '

typically yield estimtes of reactor oore damge frun intermi flooding events of 1E-05 to 1E-06 per year. Estimtes of interml flooding having an impact on public risk are approximtely 1E-08 or lower per year. 'Iho low prcbability for public health risk is because a floodin; event rust satisfy a fairly large j set of conditions in order to be significant.

2.8 Peactor Scran tuo to Air Imk Firm InconTct Mountirn Can Scirw in Air

'IMt Pilot Valvo Oyster Crock; Ibcket 50-219; IIR 87-029; General Electric IhR i f

On July 30, 1987, at abcut 4:45 a.m., operators were in the prma of perfominy the daily min steam isolation valve (mIV) five percent closure test. After cxxpleting the test on the inboard mIV (NS03A), the cperator procoodod to test the outboard MSIV ';04 A) . -

'Ibe cperator depresscd the test pushtutton ard noticed tMt the red (open) indicatirg larp ptreptly de-encryized. Within about three seconds, a half scram sigm1 duo to mIV closure (ono of four mIVs less than 90% cpen) was receivcd. 'Ihe cperator irrodiately released the test pushbutton. However, the valve did not recpen fully, but reminod in an intermcdiate position. 'Iho cperator then gave the valvo an open sigm1 but no chanyo was nheved. At

• FIIas aIt breaks in prmm pipirn khose operatirg tcTerature is below 200 'F 99% of p? ant operatirg time. Exa:ples of such systens are the high t pressure fire pro ection (HPFP) system, condenser circulatirn sater (CCW), and caTenent cooling qstem (Css).

40 '

l

i l

about the sa:no timo, a lcu control air prussure alarm was receivcd. The instru ent air pressure fell to about 75 poig. A socord air ccrpressor autcraatically startcd on Icu pressure ard the operators quickly started a third eir ocrpressor. .

The probicn was diagnoscd as an air leak which decreased the ability of FBIV IG04A to remin cpen. An attcnt was mde to reduce plant pcker to the point shore one steam header is sufficient to mintain tractor pressure ard steam ficv. The operators rapidly reduced plant load using a ocribimtion of recirt:ulation f1cw ard control rois.

The Group Shift Supervisor (GSS) concludcd that the valve was in an internadiate position bccause the difference in steam ficw botkren the two headers remincd constant. Ho then direc:ttd the operators to conthme doctrasirrJ plant lcad. After about 15 minutes, the cycrators had decreased pcArr to about 70%. Suddenly, the FEIV went fully cloccd. This causcd a rapid pressure increase which resultcd in a roactor scram. Ocak reactor pressure, as indicated by the plant ccrputer, reachcd abcut 1050 pcig - the high pressure scram sotpoint.

l An inspection of the MSIV follcuirrj the event revealcd that a '.hree-way air pilot valve had disicdgod from the min valvo block ard devolcpcd an air leak.

I This caused the EIV to clcco faster than norm 1 during the s1cv clccure test. khen the operator releascd the test button, cpening air pressure sus reapplicd, resultirrJ in the valvo remining at an interncdiato position.

(?GIVs use sir pressure to cpen; spring and air pressuru to clcco) . Iater, the pilot valve fully dislodgcd, all supply air was Icet, ard the FGIV went '

fully cloccd.

Subcoquent investigation revealed tMt there sus insufficient thrend engagement of the 1-inch reunting cap screws that securu the threc+ny pi'.ot valve to the min valve block. The valvo ranufacturer was contacted and specificd that the cap screw length shculd be 1-1/4 inches. The valvo vendor apptwcd the use of 1-1/2-inch cap scross. The root cause of this transient kus attributtd to insufficient thread engagerent of the thrce-kuy air pilot valvo rcunting cap screws on FGIV ?G04A.

The wrong len3th cap screws were uscd because the utility did not luvo a vendor ranual stich spccificd rountirrJ cap screw length for these air valves.

The plant drawin3s and proccdures used for imtallation of these valvea did not specify rountin) cap screw length. In 1982 all the FSIV air "alvo rounting cap rcress were replaccd with 1-irch scress to staniuxlizo rountiny cap screw length for these valves. It was the jud3 cnt of mintemnco personnel at that tina that 1-inch scross sure best for this application.

I All the air pilot valves on FEIVs sure examincd and fourd to have the saro irrorrect rountirrJ cap scrc%s. All !SIV air pilot valves were twountcd with vendor approvcd cap scrc%s. The FSIV clocure and inservice test was perforred on all FSIVs to assure prcper cycration of the newly rounted air pilot valves.

The utility reviscd the FSIV air pilot valve mintenure ptr.ccdure and specified the correct lenJth ricunting cap screws to avoid any misunderstanding in future mintenure. A verdor mnual shich specifies the proper cap scrcv 41 I

\

length was ottiered. Current work practices and procedures were reviewed to confim that changes to installed equipnent are not pemitted without a proper engineering review. t 2.9 Reactor Trio fue to Liahtnina Strike l Point Beach Unit 2; Docket 50-301; 12R 87-002; Westinghouse WR On Atqust 16,1987, at 6:55 p.m., a lightning strike near Point Beach Nuclear Plant Unit 2 caused a reactor trip frm 100% pcher. We reactor protection system (RPS) initiatal a turbine trip. We turbine alam sequence indicated a lockout on the 2X01 B ard C ytase transfomers. We ocmputer printout of the

• pequence of events showed a possible lightning strike prior to the trip sequence.

After the turbine trip, the autcutic bus transfer for non-vital 4160 volt failed to take p h ce. Hcuever, there was no loss of safeguartis power supplies durirg this event. Wo emergency diesels were not required to start. Docause non-vital power was interruptal, the reactor coolant pups, turbine auxiliaries, cirtnlatirn water prps, steam generator main feed purps, condensate prps, and heater dratn tank punps tri} pod. As a result, min condenser vacuun was lect.

Rupturu discs in the turbine blow out, inlicating positive pressure in the main coMenser after loss of vacuum. All primry system equirrent functioned as designed. %cre was no actuation of safety injection. Pressure, level an1 terperature in the steam generators, reactor coolant systm (RCS), and pressurizer remined within expected limits during the transient. Adoquate mtural cirt:ulation was irdicated by differential taTeratures batseen the hot I

and cold legs.

Enta tranmission frcn the 10-ncter level on the primry meteorological tcher was interrupted due to a lightnity strike. %e remainirn hrvcis on that tower and the other two towers on the systan runained operaticml.

Curity the recovery of the plant, a decision was mde to shut the min steam isolation valves (mIVs) to isolate steam fran turbine hall equipment. We A ,

mIV dosed fully. We B EIV closed to within one inch of its fully closed

penitlen. turirn a subsequent test, both valves closed normily. Past

! experience has shchn that thenever there is a small amount of steam flow l

through these alves, they will fully close if initially closed as far as tha

, B MSIV closed.

\

At about 7:15 p.m., the decision was mde to declare an tMusual Event accortilig to erergercy plan procedures. Notification sus initiatal at abcut 7:30 p.m. At 8:05 p.m. , after power had been restored an1 systems had stabilized, the Unusual Event was temimted.

We cause of this event appears to have been a lightnirg strike to a transmission line wiatai with 2X01 or to the ground near 2X01. We resultiin voltage transient caused the B thase ani possibly the C phase on 42

)

2X01 to arc to grouM. his created a fault resultiry in a generator breaker lockout. So lockout causcd a turbino trip followed by a reactor trip.

khen the are comrred, a fault was created on the 4.16 hv non-vital buses j (2A01 and 2A02). mis fault prevented the synchrechock relay frm allcuing a non-vital 4.16 hV automtic bus transfer to occur. 20 voltage on tho I

ron-vital buses (2A01 ard 2A02) decayed rapidly after the breaker cpenod. It l fell to 1 css than 80% of the mininum requircd for operation of the synchrocheck relay; thus the automtic tus transfer did not furrtion.

1 20 health ard safety of the utility c@loyees involved ard the general public

\ were not affected durity this event. 2e plant Fimi Safety Amlysis Report diroms a loss of extcIml electrical load as one of its amlyzed accidents.

In that amlysis the assunod initial powr level is 102% paur ard no crcdit i is taken for tho turbino trip of the reactor. 20 results of the amlysis '

shcw that in fuel would be damgod. All systers rerponded as expected ard no evidence of fuel damgo was fourd.

2.10 loss of florm1 Pcuer Durim Shutdcun Due to Routirn All Offsite Powr i Scurces tranh One Breaker I

Vermont Yankeo; Ibcket 50-271; IIR 87-008; General Electric IER j At about 2:00 pin. on August 17,1987, the plant suffered a loss of nomil pomr (UIP) . At that tino the facility was shut dcun for a refuelity cutage.

20 startup transforrers aM one of the two min cutpat breakers had been

, taken cut of service for testirg, mis action caused all sources of off-site l pcAcr to be routed through one set of breakers.

1 At that timo, a line fault, extermi to the plant, kus transmitted dcAn one of

the lines supplyirn plant pser. his fault, which also causcd trips at other facilitics in the area, causcd the socord min cutput breaker to cpen. So plant was ncu isolated frcn all sources of outsido paur.

khen the socord min breaker cpencd, a scram sigml ard all contairrent isolation sigmis wre generated, as expecttd. All ptrps stcypcd ard the energerg dicsc1 generators (EIns) receivcd a start sigml. 20 EICs started, ard within 13 seconis of the UfP, pcAur was available for autcmtic start of the follcuirn equirrent:

o a) W F2m pu pc ard the service water pmps (beiry uscd for shutdcun coolirg), ard b) the electric fire pep (which started due to Icv pressure in the service water and fare protection headers).

A torporary pipirg connection mde frcn 2" schcdulo 80 polyvinyl chloride j (PVC) pipiry connectirq the servir:e water system ard the fire protection system burst shortly after the EEns startcd. As a result of the break, abcut 2000 gallons of service water spillcd onto the refueliry floor of the reactor buildirg, me water entercd the floor drain system which contains several 43 l

lengths of contamimted pipe, khich in turn contamimtcd the scIvice water.

The flow rato excocdcd the capacity of the floor drain aystem, causing the floor drain sump on the lowest level of the reactor building to overflow. j Water also issued frcn several floor drains on two other floors of the buildirg. Water pooled on the refueling floor and secpcd thrugh the gap )'

between the reactor buildirn refueling f?oor p ncling aM the reactor 1x111dirg exterior valls.

The cnuco of the pipo break was believcd to be the result of near sirultanoous startirn of the scIvice water pums ard the electric firo pum.1ho servico water system was also partially drained at the timo.

The temorary pipirg had been desigacd for norn11 system operatirg pressure.

A ruview of the tcrporary pipirq for pressure sunJo sus not required; therefore, no such ruview was perfomod. The torporary pipirn was designed for about 150 p3ig, tut it was subjectcd to a larger thin nomil pressure surgo shen the prp2 restarted after the cmorgency diccol generators startcd.

A test of the soccnitry containnent was conductcd as prt of the cleanup and investigation after the event and the containnent was fcund intact. An inspection of the varicus levels of the reactor buildirn revealcd no danigo to equipnent as a result of the spill.

Operators were able to isolate the pipe break in about ten rtinutes. Cleanup of the spill octronecd about 30 minutes after the pipo break and was cocpleted in about 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br />.

If toth energency diccols tud failed to start, power would still have been available to cperato essential plant equiprnt thrugh a tio line to Vemo' thm. This FAur courua snild tuvo becn available to the plant within two minutes. ,

2.11 Increrability of IMelear Semice Water Systen rue to Incorrect Dmion PoctTrenhtion Catastu Unit it Docket 50-413; IIR 87-0361 Westirghouse WR

(

On Octr+n 12, 1987, tuke Pcher personnel dotemincd that a violation of Technical Specifications (TS) occurrcd frcn 10:30 p.m. Atquot 30, 1986, to 8:30 a.m. Septe:ter 4, 1986. On Atyyust 22, 1986, Unit 1 kus in cold shutdcAn '

in pregration for refuelirn. Unit 2 was at p u r. Diccol gencrutor (D/G) 1A kas re ovcd fzxn ocIvice for mintemrro. khile the D/G sus out of scIvice, nuclear ocIvice kuter (tSi) train A was entertd as irqcrable in the Tbchnical Spocification Action Iten Icgbcck for both unit 1 and unit 2. !G4 flow sus realigncd p2r pm,.odare to accmubte D/G 1A toirn out of scIvice. Ikkever, in onhr to drain the reactor coolant locrs in preparation for Unit I refuelirn, it was rm' to establish the cycrability of both trains of Mm on that unit. This required rocstablishirn !G4 flow to the two o:rponent occlity heat exchTngers, each of shich cools one train of Mm.

44

e- Fl Tb aco:rplish this, on August 29, Design Engineering providcd instructions for throttlirg 1G1 ficw to the ccrponent cooling heat exchanjer on the 15 lcop serving the inoperablo D/G. Wis throttlin3 establishod a configuration which allowed a sin l3 e !W prp to provide ficw for postulated IDCA heat loads on Unit 2 shilo continuing to provido rhutdcun cooling on Unit 1.

Ilowever, the instructions were in error. %cy directcd the crosswer supply valvo -iated with the cut-of-scrvice D/G to to closed, rather than the croccover supply valve which isolates the dcgradcd !W locp frm the non-

! cssential header (as the previous preceduro required). %crofore, only a sin 310 punp sus availablo to supply ficw to the non-essential heeder on the shutdown unit ard to tho essential headers. The !W cperating proccdure was ruviscd to incorporate tho (crronocus) Design Engineering instructions.

7ho proceduro sus irplemntcd ard crecsover valvo 1R!i48B was opencd at about 10:30 p.m. on August 30. At this tiro, !W train A bocare in porable with respect to Unit 2, since IW pu p 2A would have teen aligncd to supply the Unit 1 non-essential header, which .ulld have diminishod ficw to the 2A essential header. !G4 train a was fully cperabic aid capable of supplyirg post IDCA ard shutdwn croling for both units durirn the pericd that IW train A kus unknowin31y inoperable. We action statcrent associatcd with the 'Is applicd to this situation, but it kus not entered sinco station portonnel kuro unwure of !Gf train A incrcrability.

l On Au3ust 31,1986, at 1:30 a.m. , Unit 1 cntered refueliny trde. On Septenber l 1, at 8:20 a.m., Unit 2 ktnt to hot standby due to a failure of the min turbino generator. Ilowever, on Septenter 4, at 8:30 a.m., Unit 2 kus (unknowin31y) requircd to be in cold shutdcun due to the incperable !W Incp A. On Septenter 8, at 4:40 a.m., Unit 2 cntertd cold shutdckn. This satisticd the applicable TS requirenent, althco3h about 92 hours0.00106 days <br />0.0256 hours <br />1.521164e-4 weeks <br />3.5006e-5 months <br /> had clapccd.

This violatcd the TS rcquire ent to achievo cold shutdown within the apprcpriate tire interval. In cold shutdcun, the IS requires ono 1G4 Incp to to eterable for the unit (104 Locp B was cycrable) .

The Licensco reportcd that heat Iced amlysis and systcn testin3 have shown that the !W systen has adequate capacity to supply the IOCA demnis of one unit ard the shutdcAn crolirn demnds of the other unit. % cruforv, the !Gi

, system was toin3 cycratcd in a configuration telievcd to sunwrt the rafety amlysis for the station. Only one 1ccp of is was available frm August 30, 1986, to Septceter 8, 1986, to surply pcot-IDCA ficw requircrents on one unit and shutdwn ccoling requircrents on the other unit. The tire pericd excooded that allcuni by Technical Spccifications.

Pavisod heat load amlysis and cutcoquent 1G1 f1cu talance has shcun that a sin 31 o !G4 prp is ettficient to supply the past-IDCA loads on one unit and the shutdwn 1 cads the other unit withcut isolatiny or throttlin) of im flcus on the shutdxn dit.

Cycrations personnel revicked all !W associatcd pnrcdures to ensure aFprrpriate actions kuro in:ludcd in the event of an 15 mlfunction. 7ho crengen:y procedure for transferrin 3 to cold 1cq recirculation was revisoi to rcre clearly define the realign ent of !W.

7 45

Subsequent corrective action included:

1) 'Dschnical Specification dwiges were made which describe the shared aspects of the NSW systen and provide con +-ding actions to be taken when it is not fully operable.

2) Operations personnel reviewed all NSW a-lated prMw to ensure appropriata actions were included in the event of an NSW l malfunction.

3) 'Ihe operating prem for the NSW systen was revised to require an altamata cooling source when rescuiry a D/G frun service for an exterded period.

4) 'Ihe emergency precedures for the transfer to cold leg zweirculation were revised to better ensure adequate NSW flow to necess:ay equi m t.

5) NSW flow balance was performed to confirm the ability of one NSW purp to supply adequate NSW flow to both units, i

/

46

~

f 1

l l

l j 3.0 AIEIWCIS/LIf7FDCS OF ODER 1RC OFERATDIG EXFTRIDiCS [OCUMDfIS 3.1 Abnormal Occumnce Rererts (tUREn-0090) Issn_wi in July-Atx2 1987_

l An al:nomal occurrence is definod in Section 208 of the Energy Reorganization

! Act of 1974 as an unschoduled incident or event which the NRC determines is significant frun the standpoint of public health or safety. Under the previsicra of Section 208, the Office for Analysis and Evaluation of Operatienal Data reports abnormal occurrences to the public by p2blishing Ictices in the Fo$cral Ratister, and issues quarterly reports of these I ocx:urrences to C4spss in the !UREG-0090 series of heents. Also included in the quarterly reports are updates of scane previously reported abnormal ocx:urrences, and strraries of certain events that may be perceived by the i public as significant but do not moet the Section 208 abnormal occurrence  ;

criteria. Copies and subscriptions of this h_ ment are available frta the  :

l Superintenient of Docunents, U.S. Gcrverment Printig Office, P.O. Box 37082, Washingtcc, DC 20013-7982. l l

Date Irsued Report  !

l 7/87 REFORT TO CotCRESS Ott AlfCRt%L OCCURRDiCEE, OCICBER-DECDiBER l 1986, VOL. 9,10. 4 There were nine abnorral emirrences durirn the period. Three i occurred at !EC-licensed nucicar power plants, six ocx:urred at  ;

other NRC licensees (infustrial radicgraphers, Inodical ,

institutions, industrial users, etc.), and none emtvrad at a .

Agreenent State licensee.  !

The ocx:urrences at the plants invo:ved (1) a loss of Icu I pressure cervice water at Coonoe, (2) degraded safety systerns due to incorrect tort]ue switch setcings on Rotork inoter Cycratorn at Catauba and itGuire Nuclear Stations, ani (3) a ,

occoniary systen pipe break at Surry Unit 2 resultirn in the death of four persons. l The other !EC licensee ocx:urrences involved: (1) a release of Anericiten-241 at Wright-Patterson Air Force Base, (2) a therapeutic modical misadatinistration at the Cleveland Clinic .

Founistion, Cleveland, Ohio, (3) a suspension of License for l Servicirn teletherapy and radiography units of Advarced thilcal l Systems, Geneva, Ohio, (4) a therapeutic medical ,

misadministratico at St. Inke's Hospital, Racine, Wisconsin, 1 (5) a therapeutic rodical misadministration at 7bledo Hospital, Tolado, Ohio, and (6) En irradiately effective order rolifyirn i License and Order to Shcw cause issual to an Industrial l Radiography Ccrpany, !tt-Chen Testirn Iaboratories of Utah, j Irc. , of Salt Iake City, Utah.

( l

< i l l l 47 i  !

i

Also, the report updated inforation en: f1) the erwircr1 mental I qualification of safety-related electrical equipment inside containment (77-9), first ruported in NURD3-0900-10 (October- I hr 1978); (2) the ruclear accident at 'Ihree Mile Island (79-3), first report 44 in Vol. 2, No.1 (January 44arth,1979);

(3) differential pressure switch problem in safety systass at Iasalle, first reported in Vol. 9, No. 3 (July-September, 1986); (4) rupturn of uranitus hexafluoride cylinder and release of gases (86-3), first reported in Vol. 9, No. 1 (January- i March, 1986) and (5) willful failure to report a diagnostic medical misadministration, first reported in Vol. 9, No. 2 (April-June, 1986) .

In a&iition, items of interest that did not meet atmormal occurrence criterla but may be considered significant by the public imolved (1) emergency diesel generator problers at various nuclear power plants, (2) NRC Atmynanted Inspection hun sent to Hope Creek, (3) oorwiction of Intemational Nutronics, Inc., and one employee in Federal District 0:urt, arid (4) NRC Augmented Inspection ham sent to Hatch facility.

e 48

l l

l l

3.2 Euller*_ns ard Informtion tiotices Issued in July-Atriust 1987 ftRC Eulletins are used primrily to ocrr.unicate with the inlustry co mtters {

of generic irporf.arce or serious safety significance (i.e., if an event at one reactor raises the possibility of a scricus generic problen, an lac bulletin i ray be issued requesting licensees to taka specific actions, ard requirirn j them to sulnit a written report describing actions taken ard other informtion lac should have to assess the nocd for further actions) . A prtrpt responso by affected licensocs is required ard failure to respord apprtpriately my result I in an enforcenent accion, khen appttpriate, prior to issuiry a bulletin, the g lac ray sak ocments on the nitter ftun the intistry (riuclear Knigament ard Rescurocs Courcil, Institute of liuclear Ptuer Operations, nuclear steam I suppliers, verdors, etc.), a to:hniquo khich has proven effective in bringiry faster ard better responses frun licensecs. Eulletins generally require one-tire action ard irrertin3 %cy are ret intcJded as sutetitutes for revised licenso conditions or now requircronts. We following Dulletin was

/ issucd durirn July-August 1987:

l l DT%

1 1

Billetin Issued Title 87-01 7/9/87 UID;!iDG OF PIPE K'ALIS Di 110CIEAR FCEER FINTIS (Ircucd to all pcuer reactor facilitics holding an operating licenso or construction pcmit) i Infomation 110tices are rapid traranittals of infomation khich nTy not have teen ctrpletely amlyzcd by the imC, but which licensees shculd knx. %ey rtquire no acknculcd3cnont or responso, but recipients are advised to consider the applicability of the informtion to their facility. We follcuin)

Informtion tiotices kuro issued during July-August 1987:

Inforn tion Date liotico Isswx1 Title 87-30 7/2/87 QWCEDG OF SLTCE RUG PPAOU'3 Di IAICE GD?Er.4

, ELECIRIC CDFNTY EIICIRIC !UIORS. (Issued te all guer reactor facilities holdin3 an cu ratin) licenso or construction pemit) 87 31 7/10/87 IIIrCKDG, ORACDG, N;D SECURDG OT FADICACTIVE FATTRIAIS PAG E'ES Di 'IFRISFORIATIJi (Issued to all imC licensocs)

I 87-32 7/10/87 DEFICID3CIES Di VIE TESTRU OF 110CITAR-GRADE ACTIVATED OIARCDAL. (Issucd to all po%cr reactor facilitics holdito an cperatin] licenso or construction pcmit) l l

k 49 '

f t - - - - - - - - - - - -

1 1

I Inforntion Date Notice Issue 4 Titig 87-33 7/24/87 APPLICABILITY OF 10 CFR PARP 21 'IO NCtiLICENSEEE (Issued to all NRC licensees) 87-34 7/24/87 SDCIE FAIIURIS IN AUXILIARY FI2 DOG 1R SYSIDt3 (Issued to all holders of an operatirg license or a construction permit for pressurized water , d reactor facilities) 1 87-35 7/30/87 RFACIVR IRIP IREAKER, WESTDGOUSE lODEL IE-416, FAIIID 'IO OPEN CN MANUAL INITIATICH FRM 'IHE CotfI1CL 30 3( (Issued to all nuclear power facilities holdirq an operatirq license or a construction permit employisq H DS-416 reactor trip breakers) 87-36 8/4/87 SIQiIFICAlfr UNEXPEC'ITD DOSICH OF IIEDR'IIR LINT 3 (Issued to all power reactor facilities holdify an operatirq license or construction permit) 87-37 8/10/87 GEPLINCE hTIN 'IHE taENIPAL LICINSE PRCVISICNS OF 10 CFR PART 31. (Issued to all persons specifically licensed to m nufacture or to initially transfer devices containing radioactive mterial to general licensees, as defined in 10 CFR Part 31) t 87-38 8/17/87 D RDDQUAIE OR DREWIRIDfr BIDCKDG OF VAI4E MWINDft (Issued to all power reactor facilities holdirg an operatirg license or construction pernit) 87-39 8/21/87 COffIFOL OF ICT PARTICII CCtfrAMDRTION AT NUCIEAR ICWIR PINTIS (Issued to all power reactor facili-ties ard spent fuel facilities holdirq an NRC license or construction permit) -

87-40 8/31/87 IRC13EATUG VALVES RX7tDiELY 'Io IREVDir PACKDG IIAKEE (Issued to all power reactor facilities -

holdirg an cperatirg license or construction pemit) 87-41 8/31/87 FAIIURES OF CERTAIN 150HN RWIRI EIECIRIC CIRCUIT BREAXI36 (Issued to all power reactor facilities holdirg an operatirg license or oorstruction g pomit) I l

50 t

}

1,

l

)

3.3 Care Studies ard Emineerim Evaluations Issued in Mw-June 1987

( The Offico for Analysis and Evaluation of Cporatiomi Data (AIDD) has as a primry responsibility the task of reviewiny the operational c>gericreo reported by lac nuclear pcNer plant licensocs. As part of fulfill:rg this task, it selects events of apparent safety interest for further review as i cither an ergineering evaluation or a caso stixty. An enginocrity evaluation l is usually an ineodiato, general "remt to detomino whether or not a core detailed protracttd caso sttxty is nooded. The results aru generally short reports, ard the effort involved usually is a few staff weeks of investigation tire.

Caso studies are in-depth investigations of apparently significant events or i sittutions. They involvo several staff conths of crginocriny effort, ard result in a formi report identifyiry the specific safety problems (actual et potential) illustratcd by the event ard reocrrending actions to irprove safety ard prevent recurren:o of the event. Before issuanoo, this report is cent for poor review ard cx.went to at least the applicablo utility and apprtpriate IRC

( offices.

There AFDD rerorts are ndo available for informtion rurroces ani do not irrcce any recuiremnts on licenra m The findirgs and trocrrendations containcd in these reports are provided in support of other ongoirn imC activitics concerning the operatiomi event (s) diroW, ard do not represent the position or requirements of the responsible IRC prtgram office.

L Ergincerin] Data i

Evaltntion Issued Subiect AIDD/ DOS 8/87 DEIEESSt. 'IZATICti OF REACTE CDOIRTP SYSTDE Di IhTS r

An imdvertent reactor trip at Salon Unit 2 on August l

26, 1986, resulttd in a loss of normal prcesurizer spray, loss of auxiliary spray, ard Icss of one of the paur crerated relief valves (IGNs) . Repeated TGN acttations kt re causai by cxr.tinxd cperation of high pressure safety injection. Quick cycrator action restored the plant to a stable condition.

htrapolation of this scquenm of events to a stan generator tubo rupture accident or a fortxd mtural circulation croldcun highlights areas of safety amlyses, plant cycration, ard emrtJercy preocdurcs that could be irprtucd. I e

51

Dyineerim [hte s

Evaltntion Insucd Subicct AD30/E708 to likelihocd of soveru core damgo frun steam (cont'd) generator tubo rupture accidents was previcusly estimtcd to be smil. Still actions to facilitate the operator's recmcry frun this event n3y be prudent because of the potential for bypassim containent durim this accident. 20 principal cx:nclusions ard fintims frua the attdy aros (1) Scre are several system available for primry systcra rm ocntrol. All plants have a norml reessurizer spray systan ard an auxiliary spray systan. Pest plants have IONS that can be used to depressurize the primry systan.

(2) Gercrally, none of the systas identified in Itan (1) abovo are contro11cd by limitim corditions for operation in the technical specifications. Experience has shchn that one or portions of all these equirrent/systas can to out of service for exten$od tires while the plant is cperatirq.

(3) Operatiry procedures for utiliziry the abwe rentiencd equi; rent /systers are rot consistent at WestirrJhouco plants. For all events, the proxdure gaidolines use the auxiliary spray as a backup to the rermi cpray, except for steam '

generator tute rupture accidents which use the FOTWs as a backup o the norml spray. ICINs have a terderry to stick cycn ard cause a sml1 loss of coolant accident which ocrplicates rocwcry frun a tubo rupture.

(4) Of primry corrern frun a pressure control stardpoint, is a stca:n generator tubo rupture

• accident because of the potential for bypissim the ocntaiment.

(5) In the past, systas evaluaticx1 criteria for mitigatiry a steam generator tuto rupture accident are rot as strirgent as thcoo utal for reviewing other design basin accidents.

Ikkuver, a recent staff evaltation of a Westimhcuse Owners Group tcpical report on Sa'IR indicates that simle failure ard cquigrent cperability will to considertd in future evaltations.

\

52

I ngineerirg Date Evaluation Issued Subiect AB00/E708 (6) The upper head taperature my adversely (Cont'd) influence plant response characteristi.cs in a '

tube rupture accidert. Many plants opirate with upper head tarporatures close to core exit terTeratures that ooii@cid to saturaticm

'. pressures above the setpoint on the steam generator safety valves. The typer head could j act as a praammizar ard maintain primary system u pressures above the pressum in the faulted

) steam generator and potentially challenge the

steam generator safety valves.

l (7) The likelihood of severs oors damage and offsite e doses from steam generato:, tube rupture accidents is proportioral to htran error prcbabilities a-iatai with recovery frun tM accident. Continuous operator attenticn is required to stabilize the plant after a tube rupture, in contrast to autmatic systat acttutions and sirple on/off manual actions used for tiltigating other design basis accidents (8) Several hours my be availstle to preclu$e a stca:n generator tube opturn accident from evolvirn into a severs ocree darage event due to depletion of the refueling water storage tank.

Howver,1cca of pressure control early in the cent r.ny recuit in prolonged discharge of ecolant into the faulted steam generator ard subcoquent failures in the secordary system (or the pressurizer TORV) that exacerbate the situatico aid significantly cxxplicate the crerator's ability to recxner.

D 53 l

DvJirw2rinJ Cuto Evaluation Issued Srbiect AIDD/ DOS (9) 1ho cirurstances of the Salm event, as they (Cont'd) relate to a potential tube ruptura event, are not uniquo. Multiple pieces of equipwnt out of scIvice are within allowablo practico. tilitiple coimidental failures tuvo bcon cboervod during other operaticm1 events. 7ho Salm event raises )

an issuot Do cirurstances that prevailed during the event facilitato a;prwriato cperator /

action or detract frun it? On one hand, there (

appears to be arple tim an! acceptablo om.2tjency procedures for the cporator to enmfully recpxd to a stea:n generator tube rupturn accident. On the other, control of the design, cperability, and availability of the mitigatin7 system anrara lackin7 1ho evidenco clearly indicates that prJrary pinssure contr71 capability oculd be entwxxd.

AIDD/D09 8/24/87 AUXILIARY IHDRITR ILMP TRIrs CAUSED BY IDf 54XTICti IEEssuPI On Jantury 27 an! 29, 1987, Millstone 3 c>pericmod an event in khich each of the unit's tvo rotor-driven auxiliary focd.nter (m\fW) prps A an! B trippcd imxiintely after bein; ctartal duriny qturterly surveillarco testirrys. nrp A tritpod throo tires khich prp B trinxd orce. All triro m,:nni coveral coconis after prp starts. The tripa kero detominod to be caused by sution pressure oscillations that resultai in spurious Icv stx:ticn pressure trip sigmis, this spiricus Icv pressure trip is a ommn nado failure for the t'.o mMW pros. Throo mMitieral events fcuni in this tuviev ,

hvi similar spiricus 1chwien prem trips that resulta$ in a tuttial Icss of the AIW systm.

\

54 i

)

Drjirrerirn Dato Evaltntion Issued SuliLC 2

MDD/D09 Tho additiomi events occuntd at TzVjan, D.C. Cook 1 (Cont'd) Zica 2. 1ho low pressure cordition causin3 the MW  ;

prp trips in those three events scru also generated I by ptrssure cocillation or fluctruticn in the suctico I lines durirn prp startup tra mient or in the middle of cperation. W prp fluc' ntion at Trujan and Zion 2 sus the result of exoossive strticn flow, shile tMt at D.C. Cook I was inducal by turbino n spxd oscillations due to a faulty ep,'emor.

Im suction prussure trips are ganarally prtnidcd for pruta: tion of the prps against loss of suction head ard cavitation. The events show that low suction pressure trips constituto a ocrron rrdo failuru that can patentially rerder the MW system incperable ard the plant sulld loco its rtduniury in core heat rencnal cambility. AlthcArjh the trips ray be rcnwable in a relatively short pericd ard the prp can be mnaally restartcd, the potential exists that system respreo tire rey increasa boycnd the tiro limit regnrcd by the technical cprifications, ard the reliability and capability of the M W system sudd be cxrprmised. Without scro sort of low suction pressure trip, either autmitic or nmual, pu p protection ray not be adcruite. The firdinys ard conclusions frm this study aret (1) Iru-suction pressure trips have errcd to the MW puqo of different systan configurations at four plants, even thou3h sufficient suction head sus available. The spirious icw pressure trips sure attributad to pressure oscillations or flucttutions in the suction lires, which creatal a rmentary pressuru dzrp. 1ho rrrentary low pressure sus sensed and acttated the pressure trips of the prps.

( (2) The prussure oscillation or fluctmtion sus a Ircult of hydraulic ha rerirn, excessive suction flow or turbino epocd cocillaticn.

I l

ss l 1

1 Ergineerirn [hte Evalu3 tion Ir>sual Subiect MDD/D09 (3) The ficw path aM prp aligment ombimtions, (cont'd) whJch appeared to contrib2te to the occurrence of pressure cocillation upon prp operation, were not the norml cperatiomi configuration for the systen and hvi not been fully specified or considered in the operatiomi ooMitions for the design of the prp 1cw pressure protectico system.

(4) Althou3h the precsure oscillation or fluctuation da pencd very rapidly, they were initially quite severe ard were of sufficient avJnitu$e that the prp suction pressure drespcd belcw the trip sotpoints for a brief period and actmttd the low pressure trips.

(5) The low pressure condition only existed rcrentarily. 7b prevent spurious Icw pressuru prp trips from occurrirn, the licensco of Zion his installed a tirn delay relay in the centrol cirulitry of the MDMW prps. The relay rcrentarily byPm the low suctico pressure trip durirn prp start. The existim timo relays for the MW prps at Trojan scro also adjusted to provido sufficient tire for suction ficw to stabilize tofore actmtion of the hw prcosure tripa, without degradiry the prep protection frus cavitation.

(6) The corrtctivo actions taken by the other two plants shere the trip prob 1cn m, mrtd are different. 1ho licensoo of Millstone 3 rcrmcd xthe Icw suctico pressure trip frcn Loth mVM pu:Ta since it was not psrt of rafety amlysis j and was an cpcraticml feature pzwidcd for '

equipTnt prutoction. The icw suction pressure trip was replacrd with an alanVcporator actico ,

carbimtion at D.C. Cook 1. The alarm will actmte shen the water 1cvel in the er dropa to [

the point khcre there is still 14 minutes to rmch the centet' lire of the suction pipo for the MW prpo. The tire is sufficient for the cperator to take apprcpriato actions.

l 56

h- Dyinocring Date l

t. Evaluation Issued Subiect AIDD/E709 (7) ImW suction pressure trip functim is provided

$ (Cont'd) to protect centrifugal pups fras cavitation ard t subsequent damage. It trips the pmp within a )

desirable time upon a loss of ade@ ate pressuru to provide the r+---- 7 not positive suction d

head (NPSH) at the suction of the pump. Without low pressure trip or using alarWcperator action crrbination, as in the cases of Millstone 3 ard D.C. Cook 1, the automatic pap protection may p not be adequate. 'Ibers are ocniitions ot.her than inadequate available auction head that can cause cavitation and damage the pap, such as air or vapor biniing of the suction line, or 1

imdvertent closuru of the suction valve. An alarWoperator action ocabination based on available suction head, such as water level in CSr, by itself would not provide protection agsimt vapor binding or suct;,on valve closure.

t t l l

57 i

3.4 Generic Intters issual in July-Atnust 1987 Generic letters are issued by the Office of Nuclear Reactor Regulation, Division of Licensing. They are similar to imC Balletins (see Se,t. 3.2) in that they transntit informtion to, and obtain infonnation frm, reactor lican-seen, applicants, arrt/or equipent appliers rajan11rq matters of safety, safeguants, or enviremental significance.

Generic letters umally either (1) prwide infon.wtion thatght to be important in assurity continued safe operation of facilities, or (2) rupest inforation en a specific schedule that would enable regulatory decisicos to be mde runantirg the contintal safe operation of facilities. They have been a sig-nificant reans of corrunicating with licensees on a ruber of Lvortant issues, the resolutions of which have contributed to imprwed quality of design and operation.

Generic Dite .

Imtter Issuni Title 87-12 7/9/87 50.54(f) 11 TIM RDWRDDC IDGS OF RESIIUAL lE:AT PIM7.'AL (M{R) 11]RIlc MID-IDOP OIDATICN (Issucri to all holders of an operating license or a c.cnstruction remit for pressucized water reactor facilities) 87-13 7/10/87 INTEGRITY OF REQUALIFICATION EXAMDMTICtG AT Int-I%u REACICRs (Issued to all non-power reactor licensces) 87-14 8/4/87 RDQUEst IVR OIDATOR 7ICDGE FatEDJII:S (Issued to all power reactor li:nnsws) t

)

I 3.5 NRC Docuvntation Ctrollations he Office of Alministration issues two publications that list h= ants mde p tlicly available.

We cputerly Pan 11atolv aM Technical Reoorts (NURm-0304) oogiles

, bibliographic data and abstracts for the fomal rugulatory and technical f reports issuod by the NRC Staff aM its contractors.

We renthly Title List of Docurents Made Publielv Available (NURm-0540) ooritains &scriptions of inforation twooived aM generated by the NRC.

/ %is informtion includes (1) dockstad starial ===v iated with civilian

, ruclear power plants aM other users of rwiloactive matarlais, aM (2)

L non-docketed mterial received aM generated by NRC pertinent to its role L as a regulatory agency. %is series of h=aants is iniawai by Personal Author, corporata source, ard Report Nurter.

%s ren hly License Event Reoort (tzm acrollation (NURm/CR-2000) might also

, be useful for those interested in operational experiarce. %is document contains Licensee Event Report (IJR) operational inforp tion that was

prmae=1 into the IIR chta file of the Nuclear Safety Inforation Center at Oak Rickyt durim the monthly pericd identified on the otr.'er of the document.

%e IIR sumtrics in this report are arramed alphabetically by facility mme aM then chttnologically by event chte for each facility. Cc.ent, systan, keywced, and cup;Oent verdor irdexes follow the surraries, ocpies and subscriptions of those three docunents are available from the Superinten$ent of Dooments, U.S. Gcriernment Printing Office, P.O. Ibx 37082, Washington, DC 20013-7982.

59 l

eu,s,s 4ess it ,etstis; y ,3ct,9s,s.r:2. r e r .e p p L .

UNITED STATES ,,,,9ca o,4 m 'aos *esosenio NUCLEAR REGULATORY COMMISSION "'

WASHINGTON, D.C. 20555 esau.t n. e o OFFICLAL BU$1 NESS PLNALTY FOR PRIVATE ust, sxc 120555130217 1 1A01N411$)1M1 US NRC-0 ARM *ADM DIV F0la L PUBLICATIONS S V C ),

RRES-POR N U R ti. 0 5k NSTON OC 20555 /

J l

)