IR 05000219/1987029
| ML20236Q544 | |
| Person / Time | |
|---|---|
| Site: | Oyster Creek |
| Issue date: | 09/25/1987 |
| From: | Bettenhausen L NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML20236Q524 | List: |
| References | |
| 50-219-87-29, NUDOCS 8711200120 | |
| Download: ML20236Q544 (32) | |
Text
. . . _ .
.
,
.
.
'
-
DCS 50219870911 U.S. NUCLEAR REGULATORY COMMISSION
REGION I
Report No. 50-219/87-29
-
Docket No. 50-219 License No. DPR-11 Priority -
Category -
Licensee: GPU Nuclear Corporation P. O. Box 338
.
Forked River, New Jersey 08731
Facility Name: Oyster Creek Nuclear Station
.
Inspection At: Forked River, New Jersey Inspection Conducted: September 11 - 17, 1987 Participating Inspectors:
C. Cowgill, Chief Reactor Projects, Section ID W. Bateman, Senior Resident Inspector, Oyster Creek D. Allsopp, Resident Inspector, Hope Creek A. Dromerick, Licensing Project Manager, NRR J. Wechselberger, Resident Inspector, Dyster Creek Approved By: M,MN[ m 9/25/87 L'ee H. Bettenhausen, Chief Date Reactor Projects Branch 1, DRP Inspection Summary:
Inspection on September 11 - 17, 1987 (Report No. 50-219/87-29)
Areas Inspected:
Technical issues associated with the reported violation of Safety Limit 2. on September 11, 1987 wherein a condition requiring at least two sets of suction to be in and the full associated discharge open position was valves in the five reactor recirculation loops not me Results:
See inspection summar kk P
k9
- _ _ .
'
(4 -> ';
'
1,gh i d> !
y ?
.g, y . ,
?!
f4 f TABLE OF CONTENTS-w -
$f I y Summary j Background ] Plant Status and Sequence of Events )
3.1 Plant Conditions Immediately Prior To Event ,
3.2 Sequence Of Event i 3.3 Analysis Of Safety Significance ;
J Maintenance Activities Leading To Event
> ; Safety Limit ,
l 5.1 History of Technical Specification Safety Limit 2. .2 History of Recirculation Loop Alarm-Interlock Human Factors in the Control Room 6.1 Procedural Requirements for Operation of Recirculation Valves 6.2 Procedural Requirements for Operation of Recirculation Pumps 6.3 Operator Training -- Motor Operated Valves ; Contamination Incident
< Notifications Review of Sequence of Alarms Recorder Tapes and Control Room Operator Logs 1 Licensee Review of Event i
11. Conclusions !
Figure 1 --
Photographs of Valve V-5-167 Figure 2 --
Photographs of Control Room and Panels t Figure 3 --
Plot of Process Computer Data - Reci.rculation Flows Figure 4 --
Plot of Process Computer Data - Recirculation Loop Temperature Table 1 --
Sequence of Events Appendix A -- Procedures and Documents Used Appendix B -- Augmented Inspection Team Charter Appendix C -- Confirmation of Action Letter Appendix D -- Equipment Release Memorandum Appendix E -- Time Correction Appendix F -- Attendees at Exit Meeting J
i
______m____.______._- ___ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _________..m.__._. ..___ _ _.__ -. _ _
_ - _ _ _ _ _ _ --
.
.
.
.
1. Summary On September 11, 1987, maintenance activities in progress at the plant led to the violation of a Technical Specification Safety Limit. The purpose of this inspection was to review the technical issues associated with this event to determine its causes and safety implication An Augmented Inspection Team was dispatched on September 11, 1987 to conduct the inspection in a timely, thorough, and systematic manner. This reports the results of the inspectio On September 11, 1987, Oyster Creek Nuclear Generating Station reported to the Nuclear Regulatory Commission that a violation of Safety Limit 2. had occurred in that fewer than two sets of recirculation loop valves were not fully open for a short period of time as required by the limi This Augmented Inspection Team confirmed by their review and analysis of plant records that this condition existed for about two and a half minute The control room operator involved quickly recognized the error and took prompt action to recover from the sitpatio The team concluded that tne event had minor significance from a reactor safety viewpoint for the following reasons: The plant had been shutdown for one day and was being-cooled by the shutdown cooling system; this system continued to function throughout the eve . With the combination of valves being opened and closed, there was always sufficient fluid communication between the reactor core region and the annulus region of the reactor vessel to assure fluid commun-ication and ascertain fluid level in the core region; this is the reason the Safety Limit was imposed in 197 . Since the imposition of the Safety Limit in 1979, a fuel zone fluid level indicator had been added as part of the enhancement required by the Three Mile Island Action Plan for all nuclear power plants. This level indicator was operable and provided a record of adequate level throughout the even The team also inspected the circumstances leading to the event and several of the related activitie A maintenance activity led to a leak in a cooling water system and resulted in an immediate need to secure recircu-lation pumps; the consequent valving error led to the violatio This maintenance activity, discussed in detail in the report, was conducted with poor adherence to plant procedures, poor communications among the several individuals involved and one apparent lack of skill and knowledge by a licensed reactor operato The recovery from the leak and the hand-ling of the resulting minor personnel contamination / personal safety problems were accomplished promptly and properl Reporting of the event to the Nuclear Regulatory Commission met the four hour reporting requirement for events of this typ _ _ _ _ _ _
.
.
' '
2 \
.
The inspection report details the history of the safety limit, including a brief recap of the May 2,1979 event that explains its need Also dis-cussed is the history of the alarm installed in 1986 which notifies the l operator when there are an inadequate number of valves full ope I Since a missing or destroyed record was identified by the licensee subse- l quent to the event, some inspection effort was spent examining similar l records to ascertain whether there was any pattern of missing records. No pattern was evident from the limited sample examine i A review of the procedures governing the activities conducted in the con- !
trol room showed that the activities did not strictly adhere to the pro- l cedures written. In this instance, it appears that the recirculation loop operating procedures had not been revised to reflect current plant prac-tices for shutting down .a hd operating recirculation pumps and valve )
1 Backaround -
Oyster Creek is a boiling water reactor located in Ocean County, New Jersey with a power rating of 1930 megawatts thermal and 650 megawatts electri In May of 1979, as a result of closing all 5 recirculation system valves simultaneously dur ng a transient, a reactor zone water i
l level transient occurred that went undetected until the receipt of the j l
low-low-low level alar .
l Soon after this incident, the NRC imposed a Safety Limit on the facility I that required at least two loops to have both the recirculation pump suc- '
tion and discharge valves open during all plant conditions unless the reactor vessel head was removed. Technical Specification 2.1.E states,
"During all modes of operation except when the reactor head is off and the reactor is flooded to a level above the main steam nozzles, at least two (2) recirculation loop suction valves and their associated discharge valves will be in the full open position."
As part of the post-Three Mile Island Action Plan, the NRC imposed re-quirements for an interlock to prevent less than two loop operation. This was subsequently changed to an alarm in the control room that would actuate if less than two recirculation loop suction and discharge valves were fully open. This alarm was installed during the recent (11R) refuel-ing outage which was completed in December 1986, some 8 years after the original event at Oyster Creek.
( On September 10, 1987, Oyster Creek was taken off line at 0107 hours0.00124 days <br />0.0297 hours <br />1.76918e-4 weeks <br />4.07135e-5 months <br /> for I
plant maintenance. Included in this maintenance was a planned job to repack .aive V-5-167. This valve is a primary containment isolation valve in the Reactor Building Closed Cooling Water (RBCCW) System. On the l 53ptember 10 day shift, tagging to support accomplishment of this activity wa: completed. At 0200 on September 11, 1987, the piant was in cold shut-t down, reacter vessel vented, and primary coolant temperature at approxi-I mately 140 F. Recirculation pumps B and C were operating; A, D and E were secured and their pump discharge valves close The shutdown cooling system attached to Loop E was in operation.
w_______________________
_ - _ _ -
.
.
-
.
, Around 0210 hours0.00243 days <br />0.0583 hours <br />3.472222e-4 weeks <br />7.9905e-5 months <br /> on September 11, 1987, during removal of packing f rom
!
V-5-167, a leak occurred from the packing gland which required securing
,
the RBCCW system. This was done by isolating the drywell portion of the 1 RBCCW syste Since this cools recirculation pump components, the pumps I were to be secured. The control room operators, while in the process of
! shutting down the two running recirculation pumps, entered into a condi-l tion which violated the Safety Limit imposed by Technical Specification 2.1.E. The plant remained in this condition for approximately two-and-a-half minutes. The NRC was notified of the event at 0403 on September 11, 198 . Plant Status and Sequence of Events 3.1 Plant Conditions Immed ate,1y Prior to Event The reactor plant was subcritical reading approximately 40 counts per second on the source range instrumentation with the mode switch i locked in the shutdown positio Reactor coolant temperature was l approximately 141 F with the "C" shutdown cooling loop operating.
I Ractor water level was being maintained at approximately 160 inches
! above the top of the active fuel; letdown flow to the reactor water ;
( cleanup system was in progress with an auxiliary pump running. Total i recirculation flow was approximately 4.3 x 10' gallons per minute l (gpm) maintained using the "B" and "C" recirculation pumps. Tne i control rod drive system was in operation with the NCOBB pump in service with automatic flow contro The "C" condensate puro was operating and hot well level control was in manual. The (RBCCW)
system was operating with both pumps ranning maintaining a discharge temperature of 89 F. The reactor was vented through the main steam lines. Torus draining was in progress and the "A" and "D" recircula-tion pump motor generator sets were being warmed up prior to start-ing. Preparations were being made to conduct maintenance on V-5-167, an RBCCW drywell isolation valv .2 Sequence of Events During the early morning of September 11, 1987, at approximately 0210, a radiological control technician reported a leak to the con-trol room. The group operating supervisor (GOS) responded to the 23 foot elevation to investigate while the shift personnel prepared to take action in the control roo The GOS recognized the purplish color water as RBCCW system fluid, remembered maintenance was in progress on V-5-167, a RBCCW system containment isolation valve, and reported to the control room that the leak was from V-5-167. After studying piping diagrams, the control room operators (CRO's) prepared to isolate that section of RBCCW system piping, directing equipment operators to manipulate a manual isolation valve while they closed a
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
..
r
.:
'
.
motor-operated valve. Action was taken.in the control room to remove the recirculation pumps from operation as isolating this section of-RBCCW system piping will interrupt cooling flow to the "B" and "C" recirculation pumps. From analyzing available information .on plant-L parameters and alarms, the _ inspection team's best judgement is - tha the "B" recirculation discharge valve was shut ' at approximately 02:17:20 followed immediately by : closure of the "C" recirculation
-
.
discharge valve at approximately 02:17:22.- The graphi_c time history -
of significant parameters used to~ draw these conclusions is shown in Figures 3 and 4 and events are described in detail _ in Table 1. 'The conclusion that "C" recirculation discharge valve 1 was shut can not be verified, however, the weight of technical evidence supports- this-conclusio As tt.e "B" and "C" discharge isolation valves stroked shut, the alarm-annunciator in the control room "Less Than 2- LpS" was actuated. :This l
' alarm indicates that less' than 2 recirculation system -. loops are unisolated and is described in the Oyster Creek technical specifica-tion as a safety limi (See paragraph 5.1 for further detail.) At l
this point with ' "B" and "C" valves shutting and the annunciator alarming, action was taken by the CR0 to immediately open "D" and "A"
-
recirculation discharge valves at approximately.02:17:28.and 02:17:30 respectively. Action could not have been taken to simply reopen the
"B" and "C" recirculation discharge isolation valves- since the valve.
,
closing signal seals in -requiring the valve to full stroke closed prior to permitting the valve to be reopene ~
(
Opening "D" and "A" was accomplished to assure adequate fluid com-munication between the reactor vessel core region and the annulus region (safety limit basis). This is important as most= of the reat-tor ' level instrumentation measures water level in the annulus' region with the exception of the fuel zone level instrumentation.which meas-ures the core region leve (See paragraph 5.2 for further detail.)
With the "B" and "C" recirculation pumps still running and the dis-charge valves shutting, the operator reduced recirculation flow using the master recirculation flow controller prior to ' tripping "B"' and
"C" recirculation pumps at approximately 02:18:10 and 02:18:14 respectively. During this time, shif t -personnel were able to stop the RBCCW 1eak by isolating RBCCW to the drywell and as a. result to the recirculation pump At this point, the recirculation pumps were coasting down and two isolation valves were stroking open and two isolation valves were stroking shut. The less than two loops alarm was still illuminate The "E" recirculation loop remaind isolated with shutdown cooling system operating throughout the event.
^l.
l l
_ _ _ _ _ _ _ -
. . .
.
.
..
The valve stroke times are such that the "C" valve was able to stroke shut prior to the opening valves clearing the "Less Than 2 LPS" annunciator. The inspection team concluded that when "C" valve closed it was immediately . reopened which would support the' "C" loop suction temperature decrease identified later in the event. Immedi-ately after "C" loop was reopened, the "Less Than 2 LP S'- alarm cleared at 02:19:17,' since "A" and "D" valves were now full ope (See Figure 3.)
Subsequently, cleanup letdown flow was stopped and condensate flow was increased to raise reactor water level to 185" to enhance shut-down cooling circulation and develop natural circulation flo The
"B" discharge recirculation valve was opened approximately 27 minutes after start of the event and about 25 minutes prior to the start of the recirculation pumph. V-5-167 was eventually backseated, permit-ting restoration of RBCCW flow to the recirculation pumps and start-ing of the "A" and "D" recirculation pump After the initial event and prior to st'arting recirculation pumps "A" and "D", the loop suction temperatures trended down for the open recirculation loops A, C, and D. This occurred prior to ' water level being raised to 185" inches above Top of Active. Fuel (TAF).to facili-tate natural circulation and shutdown cooling flow. Prior to. this time, shutdown cooling flow likely was'backflowing in the open recir-culation loops to cause the suction temperature decline as indicated on Figure 4. Almost 40 minutes af ter the event, the "A" and "D" recirculat. ion pumps were started causing increased reverse. flow through unisolated loop "B" and "C" and increased core flow. The increased flow promoted uniform mixing ' of the --reactor coolant and eliminated any stagnant water. As a result the. loop suction tempera-ture profiles responded as irMicated in Figure 4. The maximum recir-culation suction water temperature occurred at this time and was 155 F.
!
3.3 Analysis of Safety Significance The safety significance of this event is considered low based upon
-
the analysis of the events by the inspection team. The basis of the safety limit is to maintain fluid communication between the core region and the annulus region of the reactor vesse The annulus region is where most of the level instrumentation measures reactor vessel level. Only the fuel zone level instrumentation measures level in the core region. Therefore, to accurately measure vessel level and activate ~ the associated alarms and . safety features, at least two loops must be open to faci.litate adequate fluid communica-tion between the core region and the annulus, according to Technical L
l -l
-__ - - - _ _ - - - _ - _ _ -- _ __- _
.
-
.
I Specifications. The licensee has determined that one loop open would be sufficient to maintain communication and that during a plant shut-down, if no action is taken upon ' isolating all five recirculation loops, it would take approximately six hours before boiloff. of water would lower vessel level to the top 'of active fuel from the normal water level band. The inspection team review agrees with this-analysi In this case, two isolation valves were opening as two isolation valves were closing and in addition all five recirculation discharge bypass isolation valves (2" valves) were full open. The inspection team's analysis indicates that the time span from when the first isolation valve started to close until second isolation valve reached the full open position and cleared the-less-than-two-loops-isolated alarm, the time was ap roximately two minutes. The . maximum ' possible time duration for this valve stroke sequence to occur would have been approximately two and one half mimute s . Therefore, considering actual valve stroke times and ' time duration of the sequence, there was no time period during which the core region was completel isolated from the annulus region. In addition, the pump. discharge bypass valves were open throughou In conclusion, this event is considered to be a literal violation of the safety limit Technical Specification, but its' safety significanc is considered low. The basis for this conclusion is 'that core cool-ing was always adequate due to the low decay heat levels, fluid com--
munication between vessel regions was always maintained and, in addi-tion, the fuel zone level instrumentation was functional and . indi-cated that the fuel region water level was always maintained ' at appropriate levels for a shutdown reacto . Maintenance Activities Leading Up to the Event A leak of approximately 250 gallons of mildly radioactive liquid from the Reactor Building Closed Cooling Water (RBCCW) system occurred while' re-placing the packing on isolation valve V-5-167 shortly after 0200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br /> on September 11, 1987. This occurred over a period of 10-15 minutes, con-taminated the worker involved in the valve packing, and required plant operations to secure the leak and render assistance to the worke The RBCCW system is a closed loop cooling water system which provides cooling to the following components in the drywell:
--
Reactor Recirculation pump and notor coolers (5)
--
Drywell cooling units (5 with one spare)
--
Drywell equipment drain tank (1)
_ ___-_-___ -_- _ __ _ - - - _ - - _ _ _ _ _ _ -
.
.
.
1
.
The RBCCW system normally operates at approximately 100 psi, with tempera-ture maintained in the low end of the 70 to 150 F operating ban V-5-167 is an outboard primary containment isolation valve used to isolate the RBCCW system drywell cooling return header. V-5-167 is a six inch ,
motor operated gate valve mounted upside down (Fig.1) in that the gate is !
above the valve stem (packing leakage travels down the valve stem). I V-5-167 failed to meet its required valve stroke time during a surveil- l lance test conducted on July 31, 1987. An investigation determined that a ;
corrosion inhibitor (Boron Nitrate) used in the RBCCW system had leaked !
from the packing down the valve stem (valve is mounted upside down). This packing leakage allowed boron crystals to form in the limitorque operator 4 stem nut, increasing valve stem friction to the point that the limitorque {
motor cut off on high torque. The licensee cleaned up the stem nut and {
applied a nuclear grade lubricant on the valve stem while stroking the I valve. This action enabled the valve to meet its required stroke time l demonstrated during MOVATs testing conducted on August 3,1987. However, 4
the MOVATs testing also determined that the motor operator was still l experiencing higher than desired motor current during valve operation. As the long term corrective action, the licensee initiated a work order on s August 6, 1957 to repack the valve with Chesterton live loaded packin !
This packing usually prevents or minimizes packing leaks and would prevent j recurrence of the previous proble Until the valve could be repacked, i the licensee in'plemented additional action to ensure valve operabilit I This action included partially closing the valve monthly using the manual operator and fully closing the valve quarterly using the electric motor operato The maintenance planner specified the use of a Chesterton repacking pro-cedure (700.1.030) which reauired the valve to be isolated and vented as a prerequisite to repacking the valve. On the morning of September 10, 1987, the Maintenance Supervisor (MS) submitted a tagging request to the Group Shif t Supervisor (GSS) which was in accordance with the procedure refer-enced in the work orde The GSS on shift then correctly advised the MS that the valve could not be isolated at the time since the system was supplying cooling to critical loads which could not be secured, and that the tagging request would have to be revised to repack the valve on its backsea The MS informed his superiors that he did not think he could perform the repacking work under the procedure ref erred to in the work plan. His management discussed the adequacy of the procedure with plant engineering f (including the procedure's author) and the maintenance planner. A commun-1 ication misunderstanding occurred in that plant engineering's position was l that the procedure would be adequate only with a temporary change to the
{
-
- __--
<
,
-
l
.
procedure or additional precaution However, maintenance management and the maintenance planner concluded from these conversations that plan j engineering concurred that the referenced procedure was adequate without any additions or modifications (communication problem #1). This is con-trary to procedure control procedure 107 which stipulates a modification to a procedure prerequisite requires a temporary change to the procedure i l with approval of one of the following personnel: Plant Operations Director Manager Plant Operation Operations Control Manager Manager Plant Materiel Plant Engineering Director Director / Deputy Manager Radiological Controls (Rad' Con require-ments only) ' 1 PRG Chairman or Vice Chairman ' Director / Deputy Director, Oyster' Creek During the day (September 10), maintenance management held additional dis-cussions within their department including the maintenance functional manager and concluded the valve could be repacked on its backseat without procedure' modification. In the af ternoon, the 8 A.M. to 4 P.M. shif t MS submitted a revised tagging request that specified the . valve was to be placed on its backseat and tagged for repacking. The MS told the GSS he desired the valve to be manually placed on its backseat and a tag hung on the valve. The GSS refused to manually backseat the valve due to concern for damaging the valve stem and backseat and gave instructions to backseal I electricall The GSS incorrectly thought that he was backseating the valve by giving the valve a two second additional open signal on the nor-mal control switch. The GSS believed that the two second additional- open command would allow the torque switch to adequately backseat the valve without any valve damage (technical problem #1). This method to backseat the valve is not in accordance with any station approved procedure (proce-dure problem #1). This action, accomplished late in the 8:00 a.m. to 4:00 p.m. shift, did not place the valve on its backseat as the limit switch l is not bypassed in the open direction. The GSS assumed the valve was being repacked due to a visible packing leak. He reasoned that if his attempt to backseat the valve was unsuccessful, the packing leak would .
still be eviden The GSS cautioned the MS to look for and report any '
indication of packing leakage so an operator could be dispatched to manually backseat the valv The station has two approved procedures which could have been utilized to backseat this valve, a manual backseat-ing procedure ( A100-SMM-3917.06) and an electrical' backseating procedure (700.2.012), both of which require completion of a data sheet which was not filled out. The electrical backseating procedure (700.2.012) is not applicable for the subject valve and could only have been utilized by first obtaining concurrence from plant engineering, which was not done.
l
_ _ _ . _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ . - _ _ _ . _ _ _ _ _ _ _ _ . . . .
.
.
. 9
.
A Reportable Occurrence (50-219/81-65/01T) occurred on December 23, 1981, and involved limitorque operators and isolation valves for the Isolation Condenser System which were found to have defects which did affect the operability of one valve and could affect those on other systems that per-form a reactor coolant pressure boundary and primary containment isolation function. Corrective action taken for this incident required that all station operating procedures would be reviewed and modified such that safety system isolation valves would be backseated in an approved manne Neither the GSS, the maintenance planner, nor the MS knew that approved station procedures were available on the proper method to backseat this valve (procedure problem #2). A detailed discussion of operator training in the area of limitorque valve operations is discussed in paragraph of this repor A second communication misunderstanding occurred when the dayshif t GSS advised the MS that the valve was very close to its backseat or just on its backseat. The MS lef t the control room understanding that the valve had been electrically backseated (communication problem #2). The valve j was in fact, approximately one and 1/4 turn off its backsea The day-shift GSS directed that the breaker that provides power to V-5-167 motor operator be tagged out. This is the only tag that was hung for the re-packing of V-5-167. This is contrary to equipment control procedure 108, paragraph 5.1.9, which requires that "If equipment or piping is to be opened, valves and switches shall be aligned and tagged so as to insure that the work does not present a hazard to personnel or equipment from pressure, vacuum, fluids, gasses, or radioactive contamination. . ." Also, paragraph 5.1.15 requires that "If a tag is placed on a component's power supply, a tag shall also be placed on each remote control. A tag need not l
necessarily be placed on the component's manual operator in this case, if the manual operator or its associated component is not part of the safety boundary."
The 4 to 12 P.M. shif t on September 10 was unable to accomplish the re-packing due to required machining on the packing follower. The September 11, 12:00 midnight to 8:00 A.M. operation shif t was turned over with the information that the valve was backseated (communication problem #3). The mechanic performing the maintenance went to the control room to verify valve position prior to commencing work. The operating shif t confirmed that the valve was backseated. The mechanic proceeded to remove the valve packing one ring at a time and observed no leakage while removing the first four rings of packin At approximately 2:10 A.M. , the mechanic commenced removal of the fifth ring of packing (8 rings total) when the remaining packing blew out causing a sizable RBCCW system lea Personnel in the area responded promptly and took effective action to isolate the leak and minimized the size of the spill area. The radiological impact of this event is discussed in paragraph 7 of this repor _ _ _ _ _ _ _ _ _ _ _ _ _ _
.
.
. 10
.
Summary of Maintenance Activities The final work' package as written effectively communicated to' the MS and the GSS that V-5-167 was required to be on its backseat to per-form the valve repacking. The GSS overruled the MS's request that the valve be ' manually backseated and tagged. The GSS~was not aware of the approved station procedures for backseating this valve. . The GSS did not' request guidance from plant engineering or Technical Functions as to the method or. procedure which should be used to back- i seat this valve.
, The GSS developed and implemented his own method which 'he thought;
! would place the valve just on its backseat or very close to its back- 3 seat for maintenance work that would remove all the valve packing 4
, from the stuffing box: The GSS and MS did'not understand from the )
l work package that all the packing would be removed from the stuffing )
l box. The GSS's method actually placed the valve approximately one and a quarter turns off its backsea . The system conditions for the repacking maintenance did not meet' the
~
prerequisites in the procedure referenced in the work package ~. Pro- 9 cedure 107 requires a modification to a procedure prerequisite obtain approval of senior level review, which was not don The work package did not specify the specific procedure to be uti-~
lized to backseat the valve for ~ the maintenance work (plant-wide standard practice). The equipment control procedure 108, Sections 5.1.9 and 5.1.15 were not complied with in that the manual operator on the valve was not tagged and its operation affected the safety boundary. Several other procedure problems, three communication problems, and a technical problem were identified and are highlighted in the above. write u . Safety Limit 5.1 History of Technical Specification Safety Limit 2. i l
l On May 2,1979, an event occurred at Oyster Creek involving closure of all five recirculation pump discharge valves shortly after a reactor scram and subsequent initiation of the isolation condenser Because the five discharge valves were closed, there was a break. in the communication of fluid between the annulus and reactor fuel spaces within the reactor vesse Since the reactor vessel low and low-low level alarms are sensed from level indicators that monitor water level in the annulus region, the loss -of water inventory f rom
~
the fuel region caused by isolation condenser operation remained i undetected until the low-low-low level alarm was received. This l alarm was received because its water level system's variable leg is 1 the core s' pray sparger which is within the reactor fuel space region j of the vesse ]
];
l4
__ _ __ _~____. _ _ _ d
_
t
.
-
'l
-
..
l i
j Prior to this event, 'the' Technical Specifications (TS) did 'not spec- d I ifically address any. requirements for. recirculation loop valve :I
positions. The TS did, however, specify in Safety Limit 2.1.D the minimum water level during the shutdown mode. -Subsequent ;to this .
1979 event, TS Amendment No. 36 was issued on May 30, 1979 to amend'
-]
.
Safety Limit 2.1.0 to specify the minimum water level in all modes of
-
operation and add Safety Limit 2.1.E that required two recirculation !
loops to remain open during all modes of' operation except. with .the .
reactor vessel head removed. At about the' time this amendment' was -
issued, all affected site procedures were revised to reflect the new Safety Limit and plant operator training was-update I 5.2 History of the Recirculation loop Alarm / Interlock j
!
As a result of the incident described in' Paragraph. 5.1 above, the licensee investigated the use of an interlock scheme to prevent iso- 3 lating more than three. recirculation . loops. 2* Following. the ' Three' l Mile Island (TMI) 2 event, the NRC issued NUREG-0626 on May 7, 198 I Recommendation A.8 stated interlocks should be ' installed on all j nuclear power plants without jet pumps for recirculation to assure j
'
that at least two recirculation loops are open for recirculation flo for modes other than cold shutdow Later 'in- 1980, position II.K.3.19 in NUREG-0660 and 0737 reiterated this statement and clar-ified it to be a post TMI Action Ite The licensee's initial re-sponses to these NUREGs indicated they-intended to install the inter -
lock.8 An installation specification was developed,'and the project planned for the 1983-84 refueling outage. It was subsequently can-celled. Because of delays encountered with designing and installing the modification, the licensee took compensatory measures by ' adding hinged covers to the 3F control room panel that covered the control switches for each pair of recirculation. loop isolation valves. An engraved caution sign was: affixed to each cover alerting the opera-tors to avoid less than three loop operatio On March 14, 1983, the NRC issued a Confirmatory Order. to GPUN set-ting forth dates by which various TMI Action Plan Items were to be completed. This Order stated that the licensee had until the end of the 11R outage to complete installation of the interlock modifica-tio In September 1985, the licensee informed NRC by letter * that an alarm would meet the functional requirements of an interlock. The letter went on to say the alarm provides positive active indicatio to the operator that a fourth loop has been isolated and further explained that the NRC Staff evaluation, presented in NUREG-0626, did not take into consideration a fuel zone level monitoring system for, Oyster Creek vintage plant During the' 1979-80 Cycle 9 refueling -
outage wide range fuel zone level indication and a recorder were installed. With recirculation pumps tripped, this instrumentation provides the reactor operator with level indication- in the core regio * Footnote references can be found in Appendix _. .--
_ - _ _ _ _ _ - _ _ _______
.
.
.
A meeting between GPUN and NRC/NRR to discuss this proposal occurred on October 9,1985. The NRC requested further amplification of the proposal which was provided by GPUN in a January 1986 letter.' This letter explained that: (1) the alarm on closure of the fourth loop isolation valve would alert the operator that a Safety Limit had been violated, (2) analysis concluded only one unisolated/ recirculation loop is required to provide coolant communication between the annulus and core regions, (3) with one loop open in addition to the five 2-inch discharge valve bypass valves open the recirculation flowrate is about 5 to 6 times the boiloff rate in the core region, thus, indicating the conservativeness of the Safety Limit that requires two open loops, (4) with the alarm modification, an operator would have to disregard training, violate procedures and ignore posted warnings, and be unaware of the significance of the switch covers in order to violate the safety limi NRC accepted GPUN's proposal for the alternative in a July 1986 letter' that accompanied TS Amendment No. 106. This letter stated it documented revising the requirement in the March 14, 1983 Order to agree with the change from an interlock to an alar NRC concluded that the alarm only modification and trained operators would have the same effect as the interlock without the complexity introduced by the interlock. The alarm was installed during the 11R outage and has been functional during cycle 11 operation. It is a unique alarm in that when it alarms the alarm light has a green background whereas other alarms have a white background. The engraving on the alarr states, "Less than two recirc loops open". It should be noted that, until the recent installation of this alarm, operators would not have been alerted had they violated Safety Limit 2. . Human Factors in the Control Room 6.1 Procedural Requirements For Operation of Recirculation Loop Valves Station Procedure 30s,. Nuclear Steam Supply System, contains the pro-cedure for operation of the recirculation loop valve Paragraph 4.2.2, which is a precaution, restates Safety Limit 2. Paragraphs 4.3.3 and 4.3.4 are the steps to open or close a suction or discharge valve and appear to be poorly written regarding closing the valves as described in the last paragraph of this sectio _______
.
. ,
' '
.
13 !
.
The steps read:
"4. To open suction or discharge valves, hold their s respective . control = switches on. 3F in the "0 PEN" position ~and then release the switc . Repeat the same procedure.for valve closur NOTE: Torque switches . shut off the valve ' drive motors to prevent _ strain on ~ valve parts should an obstruction or damaged . valve pre-vent proper. operation. -If _ the valve 'does not stroke in its normal time ~ +~ 10 se (suction valve - 2- min. , 20 s'ec. ; discharge
, valve - 2 min.), _ release the control' switch -
and investigate the cause of' .ime j malfunction." l The last sentence of the " NOTE" in 4.3.4 implies the ~ operator holds i the switch in the closed position for a specified time. . Yet _ the initial action in 4.3.4 'is to repeat 4.3.3 which requires the oper -
ator to position the switch and then release it. Because the 'close'
{
contact locks in af ter the switch is positioned to close the- valve, i it is not necessary for the operator to hold the switch in the cle:sei position and, in actual practice, the operators do not hold t~e; switc !
l 6.2 procedural Requirements for Operation of the Recirculation puros Station Procedure 301 also contains the steps.for normal operation af.'
the recirculation' pumps. Steps. 6.2.4 and 6.3.1: discuss how.to - change recirculation flow and require that the individual recirc pump speed control units should be in AUTO. In actual practice, operators do l
'
not adhere to this requirement. The individual speed control units ,
are left in BALANCE. While this is not a problem from the '
operational performance, it is a departure from present practic Paragraph 7.0 of Standard Procedure 301 contains' the steps requimd to remove a recirculation pump from service under normal conditior,. It restates safety Limit 2.1.E requirements. The - sequence . is de-signed for normal plant operation, not an emergency type situatic The steps require the operator to, in order:
(1) Run the speed for the pump to be secured 'to the mininum possible vai _ _ _ _ _ - _ - _ - .
-____ _______ -
.
,
-
.
(2) Check open the pump discharge bypass valve and then close the discharge valve. There is a CAUTION in the procedure at this point that states: The suction and main discharge valves of at least two (2) recirculation loops must remain ope (3) Stop the recirculation pump drive moto This procedure is lacking in specifics if three pumps are secured and their respective discharge valve closed which is generally the case when the plant is in cold shutdown. The steps create the potential during cold shutdown that the operator would unknowingly violate safety limit 2.1.E; that is to say three valves are shut during cold shutdown but the procedure tells the operator to close the valve associated with the pump to be secured thereby resulting in four of five valves closed. The quandary could be avoided if the procedure specifically instructed the ooerator-to open an idle loop discharge valve before entering the shutdown sequence for . the fourth pump, Abnormal Procedure 2000-ABN-3200.19, RBCCW Failure Response, contains the steps required to remove recirculation pumps under abnormal con-ditions, e.g., complete loss of RBCCW flow, major RBCCW 1eak, et The steps in paragraph 3.1 of this procedure require the operator in sequence to:
(1) Scram the reactor; (2) Trip all operating recirculation pumps; and (3) Confirm that all recirculation pump suction and discharge valves are ope Based on a post event review of available data, it appears the operator did not respond in accordance with this procedur .3 Ooerator Training - Motor Operated Valves A review of operator training in the area of motor operated valves (MOVs) indicated that all licensed operators received training on MOVs in December 1986, Ja n ua ry , and February 1987. The training described, in part, that the motor can be stopped by a signal to its control circuit from either a torque switch or a limit switc It was explained that valve travel in the closed direction can be stopped either by limit switch or torque switch and in the open direction by limit switch. Additionally, a torque switch will stop valve travel in either direction to prevent valve damage. This would prevent, for example, damage to the valve if the open limit switch failed, l
_ _ _ _ _ _ _ _ _ _ _ _ _ . _
.<
.
i
- 15
.
The training material consisted of several _ handouts, a video tape presentation, and an actual valve and motor operator. The classroom material that was discussed included backseating for leakage control,.
including electrical backseating 'using site procedures and stan' ding orders. It appeared from a review of this training'that the recipi-ents should have been aware that a MOV could not be backseated elec-trically using the valve's control switc This knowledge - should have been reinforced by the routine use of site procedures to elec-trically backseat valve These procedures require overriding a contactor locally at the breaker and monitoring current to the motor using an ammete . Contamination Incident The maintenance worker performing the valve repacking was sprayed with water from the RBCCW system. He was quickly removed from the area and his clothing removed. He was frisked and found to have less than 100 cpm contamination on his skin. He then showered and had a. whole body count performe The results of the whole body count identified. no abnormal activity. The individual also received water containing boron nitrate. in his eyes and was treated for eye irritatio One AIT inspector discussed the incident with station personnel,_ reviewed the applicable Radiation Work Permit (RWP), the results of a whole body count on the affected individual and a statement by a licensee physician who exartined the individual . During the review, the inspector noted that the individual performing the maintenance was dressed only in rubbe_r gloves and a hoo Review of the RWP identified that anticontamination clothing was only required if the surface area surrounding the valve was contaminate The inspector asked about this requirement. Licensee representatives stated that based on conditions in the RBCCW system, the backseating of the affected valve and the fact that a catch basin was being placed under the work area to catch minor leakage, no further pro-tection was required. The licensee representative further stated that had they expected a large amount of water, plastic suits would have been required. The inspector, in consultation with Region I radiation protec-tion personnel, determined that the licensee's actions were appropriate for the circumstances. The inspector had no further questions regarding this matte . Notification On September 11, 1987, at about 0218, while performing maintenance on the Reactor Building Closed Cooling System (RBCCW) leakage occurred from the system and an operator proceeded to shutdown the two recirculation pumps, which were in service at the time as a result of a need to isolate the
- __________ _________--
_ ___-_ ______ -
.
.
.
.
RBCCW system leak. This is in violation of Technical Specification 2.1.E, Fuel Cladding Integrity, which requires two recirculation loops to have their suction and discharge valves in the full open position during all modes of operation. At the time of the event, the Oyster Creek plant was in cold shutdown conditions. The licensee notified the NRC Operations Center in Bethesda, MD of this event at 0403 on September 11, 1987 (one hour and forty-five minutes after the event).
10 CFR 50.72(b)(2) requires that for such an event that occurred at Oyster Creek, the licensee shall notify the NRC as soon as practical and in all cases within four hours of the occurrenc The staff is presently reviewing the licensee's internal management notification of this event. Preliminary information indicates that oper-ations management was not advised of the event in a timely manner and that some details were not communicated to management by the operations staf . Review of Sequence of Alarms Recorder Tapes and Control Room Operator Logs Late on the morning of September 11, 1987, the licensee reported to NRC that a portion of the Sequence of Alarms Recorder printout was missin Later in the day, an operator disclosed that he tore off the tape, dis-carded some in wastebaskets and threw some in a toilet. The circumstances surrounding this missing record are subjects of investigation by the licensee and by NR The inspection team examined a sample of similar records to ascertain pattern A review of the sequence alarms recorder tapes from the period of August 28, 1987 at 3:15 A.M. through September 10, 1987 at 4:53:00 (two large rolls of recorder tape) did not reveal any evidence that recorder tape had been destroyed or missing. The inspector also reviewed Control Room Operator logs for the period of August 1,1987 through September 10, 198 Based on his review of this information, the inspector concluded that control room operator logs were in orde In Inspection Report 50-219/86-38, the resident inspector of Oyster Creek stated in his review of an event which occurred on December 27, 1986, that, "During the course of reviewing this sequence of events, the inspec-tors' investigation was hampered by the sequence of alarm recorder missing approximately seven hours of informatio Apparently, the operator neglected to insert new paper tape when the recorder ran out." Based on the fact that similar information was missing during the Safety Violation event, the inspector again reviewed the information provided on the sub-ject tape. The inspector concluded that there were no irregularities on the subject sequence of alarms recorder tape. The physical examination of the tape corroborated the original view that the operator neglected to insert a new tape when the recorder tape ran ou .
_ _ _ - _ -
_ __
l
.
l
.
. 17
.
1 Licensee Review of Event i
By the time the AIT leader arrived at the site on September 11, 1987, the l licensee had formed two internal task groups and engaged investigative
'
consultants. One onsite review group examined the maintenance activities discussed in Section 4 of this report. The onsite group completed its review during this inspection period and is formulating corrective action Inspector interaction with the licensee review found it to be objective and self-critical in its determination of root cause The second effort was the technical review and analysis of the event and its safety implication While considerable work is still in progress, inspector interactions witn members of this group found the effort to be i directed to complete consideration of the event and its ramifications and i to be a detailed reconstruction of the sequence of events and explanation of exactly what happened,t The results of this group's work will be focused toward submitting the required (TS 6.7) report to the Commissio The investigative consultants were retained by the licensee to examine the circumstances of missing record The investigation was ongoing at the l conclusion of this inspection and was beyond the scope of the AIT charte . Conclusions .
On the basis of our review and analysis of plant records as discussed in this report, the inspection team has concluded that a violation of Safety i Limit 2.1.E had occurred in that fewer than two sets of valves were f ully ope l The inspection team also concluded that the event has minor significance from a reactor safety viewpoint for the following reasons: The plant had been shut down for one day and was being cooled by the shutdown cooling system as described in Section 4 of this repor . With the combination of valves being opened and closed, the augmented inspection team has concluded as discussed in Section 3 of this report and depicted in Figure 3 that there was always sufficient fluid communication between the reactor core region and the annulus region of the reactor vessel to ascertain fluid level in the core regio . The fuel zone level indicator was operable throughout the event and, as discussed in Section 3 of this report, the water level was always capable of being monitore _ _ _ _ _ _ _ ____ _ _ _
.
.
. 18
.
As discussed in Sections 3 and 4 of this report, the Augmented Inspection Team determined that a maintenance activity led to a leak in a cooling water system which resulted in a rapid need to secure recirculation pumps and a consequent valving error led to the violation of the safety limi On the basis of our review of maintenance activities, and as discussed in Section 4 of this report, the inspection team concluded that: The final work package as written effectively communicated to the MS and GSS that V-5-167 was required to be on its backseat to perform the valve repacking, but the GSS overruled the MS request that the valve be manually backseated and tagged. The GSS was not aware of the approved station procedure for back-seating the valve and did not request guidance from Plant Engineering nor Technical Functions as to the method or procedure which should be used to backseat the valv . The system conditions for the repacking maintenance did not meet the prerequisites in procedure 107 referenced in the work packag . The equipment control procedure 108, sections 5.1.9 and 5.1.55 were not complied with in that the manual operator on the valve was not tagge Based on our review of procedures governing the activities conducted in the control room, the inspection team concluded that the activities did not strictly follow the procedures writte In this instance, it appears that the procedures had not been revised to reflect existing plant prac-tices for shutting down and operating recirculation pumps and valve Details of our review are presented in Section 6 of this report. Further, all licensed operators received training on motor-operated valves (MOV) in the period December 1986 - February 1987. From lesson plans, operators should have been aware that MOVs could not be backseated electrically using only the control switc The inspection team also reviewed the recovery from the leak and the handling of the resulting minor contamination / personnel safety problem As discussed in Section 7 the team concluded that actions taken were accomplished promptly anc' properly and were appropriate for the circum-stance The Nuclear Regulatory Commission was notified approximately one hour and forty five minutes after the even Therefore, the licensee met the four hour reporting requirement of Section 50.72, paragraph (b) of 10 CFR 5 The operators' actions subsequent to the event were not reviewed during this inspectio The reviews of those activities and the corrective actions taken as a result of licensee evaluation will be conducted separatel _ . __ _
FIGURE 1 4 .
-[
. \.
.
'
- -
I
..
m'
\, .
<
. su=.
--
, m
?
'
-
,
,
q + .
- '
.
-
.
.i
, t I
'
i l
VM DEMTO: AC KKC,t-E'. .
37TS KC STE" G
- .E i-E-167
-
e
'
d .
..
/
4.;>
a g 37
-
l7-
.
i
-
-
l F
- >
, .
'
i rivI s .
.
-__- -_ _- __
FIGURE 2
'
-
'
'*
w p* p -
~. -
,
.
.Un...
..
i EE
. l J, p, E[. k
-
i l 1131 lh $!
, r pf ' -
~ ,
~
,
m s a w .-
= /. * \ *
"
E E "
.
.
fY
$L .
>
-
,
u
'lE
_
ITE
--
- .
-
View of 3F pane Five indivicui recirc purp speed contrcliers cr Viewof3FanddFpanelsfror[behind bogg goga r v cf ,
control roor des ' discharge valve operatic I' dk , ,
~
- .
W,
...._ .
__
. .E l- ;':p -- == - [
! 6dMs 1 :i <. Y: 5 ~15
-
.
i IIii-- ,ii d 'ej li I
A +e e'p g&
% i
,
L
' s E l Alam display E cr. 3r panel . Alarr
'
4-b reads "LESS THAN 2 RECIRC LOOPS Seouence of Alarms Recorder (SU '
OPEN. ,. with tape coming out.
- _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ - _ _ _ _ _ _ _ _ .
,
. _ _ _ - _ _ _ - - . - - - . - - _ _ _ . _ _--
f a
f yrvst/v sv r 3,sv wA sss7, {
(10a*'33 *>of 3 31pv w 3, set)r esasse sw AvsAceana, sawa ,se,e ,,3, .= p-(ar-4r.re erse a s ,
isoasstS 9 3 )ner*HSV .s' tor.n31**A 2 f!tAess g, s e)"'A ses la',sA5 n 3367293 i'Aea i m'
-
I
. f0 (y
!w,. ens 90/ pr 4. s **sAs Ava'r') S s3Dio paiva pJoec ,,7 4;y, fine d "' ei ut
(essae wead esmu.tieevons tu A 3 2n8A 3a*364 64A ls, peers g.3 sysaypme199 Pawa +v1Sas*8 9th"88'8
- ,,,,e,rs top : a u sa'e's 'va) * * **'s sa w^ a a'*
1T: 61:ap ( in y
I, . g ;
)
!
'. 3f861'80 ~ipeU u
" -
'
o I il,I ( 32s&stio evoeg c *>a.ligtresst *
- >6 i sn'A sesAa 4.na'a) rw aso urin patra ****e ,,o, T3C ,
perSt rao ~ + ut J,,
it j
LO Hl Ot g ,y mi nr . * 9 j
) 4HBllt .
C
.
.
x "' "'
~ ,y g
$$$$$ {- ;
'I y (: .
2 \
o </ 4 , 5- 0
.J ' ' 3 w j
- en a g g z <r i
- i .
a *
o ' "*\'"a 3-
- ... g l
- -llgll 2 j g
-
<r ce47 ==== =- -
1,-
. w.,..a.,,,.,_, , --- a
,
ca sca*w$ 88*'7 3 'w L. St%rda ys[ : ;
33ntJ33d 431&no an nesyren ,w es t a 2777753o bu/ i
- . u A .
Oe=*M j
~*, C y i 7 - o en a
- y * I Ua
, , f
?" gg ce=+w !
j c:- ' i
- f Ei .
. f
'O <
ca 4 '"
'
, d t %0 i
l
- , s C ,o o ce w
-
g
-
, s s e
o p n f,,,
E s
l i
i en
.5 eswsk n & a rvN se</s as .3, AT ;9620-" C" g j g r,n . <
e csww.aA tr. d evad paina 9, otiti s te -b 1 S
~ j a
~~ 6 -
1 re sa d t e s e A, sagra i 3 p* **.c Sa't#3 . r. Sv d oes seirna *
'I
,,v, won +s idi r=r's itasava vo avvAs g C pe?qsto '. n . g
' ,T sa-.a as ,
Le ,
ru e.. o..*,*,re+.,n ng S
-
,,0. reorws*u /* n a ., a. wist3Sg3Asa so 4asAs 95:41:3 0 - i n g a ,,,
.
IO l
.s no 2 c,-. n =
- =
~
s C U " o
$ t m
.
m -
-
a$ un s ,
m ,,,, ~
o m
- ,
~
m ... _ . ... s _ ;.r... ,,.., .., . .. _ .
_
nm
=
L nm . .
.
no 3 z o a g a
o o a
,,g -- .-
.
" "
l
,
C ai. sains sassa a)*'* v. on :4.o ro -nn 8 {f f 5, f f j m " " .... _ , ,.,.. ..... ... ... .... _- m . ...... .
J wav95,,w93avuaS*s7. m u:to -"O
~3 " "
is o mew,w *
C ( ra vses.7*Sa') eA sAs*** 3^,' "** a ' + S U " ** ~ " " I .. . .,'-
'"
o .
_
co*ote
..
os*ess
.,,,,,, . . ,. .. - n o 1
!
co 4s's os'ses co 6s os es osho.* h ' *
, Ola co*(s 310N!W W3d $N01100
.
_ _ _ _ _ _ _ - . _ . _ - - - - _ - - - -
~i 'tx s .-
s'
. .x u . ...
- i 8 uP g s
.
I - 4'
NJ* . , ,;
%
g %.
-
1- r i
s
, a 3, . Ps -
-
ar (t ,
. .
g .. . . . . . _
.,-
. I
=
I' v %
g
,
p <. {. . . . . . . . . . _ -
,
_y ... __ _ _
I _l g i i
o
,
4 '
.
- <4~***
,
-
,
i .H -I- - - ~ ~ ' '
'2
.C
. _ . . .
4 . .. ... .
~
~. -. < ---
.,. *I.. * '. *
._
?
,
g
_ - .. _- . _- -
.
. . . _. _ . . . . . _ . - . 1
- - =
- .
. -- -- -
-
-,
.. .... .. -
.
. . . . _ . . -
. -
. . .. .. . - _ . . . . - . - - - - - - - - -
8 .- -. } - . . - . g
- . . ,,. . . .. . . _ . . ---t- --~*~ -~ ~ ,'s-
- -. t,.
.
(._ _ _ _ _ _ . _ . _ . _ . . - .
.
-
.
. ~
, .
n s i N, tJa i. I I g n .s ..
_ .. .
.e
. .
x, T. ,
'
s .
'~.-i
)) _ _... .. -
.
i I' . ,l, __ .* ,-..... - - . . . - - .
'
N,TJ !-
<
...,,
.
,
$
.
.
, .
W ' i 1
".-
,
. . .
i
/ -
.1 .- .
.,
,
+ o \
..
3 3 m ..
.
.., ,.
.. _._ . .._.__
.. . . _ . . .
, :
-
g _. .. - . . _ . . . . . . . . . _
-
U
.l . . - . _ - i
.
.;.,
.T"U m .. . - . . . _ . .
u a
- a3 _ _ _ . _
_c z* e k .-
o o
I c$~
a c .
=>
_e E 85 _. . .:, . .6 3 . A
..
3_..,._.._....
.
a y
._p,_.....___,..____
u
,e y !.
? op~s i .
.
g'
.
da 4 g_ . . - . . . . .
_ . .
s ( % o
-
v
. . . - . . .M
& se
-
o g .- - h.qg s
g g g
- - -
a e
g, e
'
s
j.'3.. . ..gj
g e g .
j L -. ,g s, 3 .. ._g.-..
.. s .. ;
- .. g ,o .__ . . . _ .
%
[,4g
,
e
, ,
l
' s $. ; A
,F Z
u
.
j - v
% :.
,,. 1 k &. (
..-..... .\.L{_
.. . . . - -. ..- . . ,.... . -. . .3 ..
.
n n .n i s
. - . . . . . . . ._ .u <
,*, o . -.
-Asmmkos2q b
--. .. h
- '
3% { g . -._ . *'
,,.,
-_
.{ .;
'
W
. . _-. . .-._ _ . _ g h [
o u ,
k
.
_
E
.
00 181 ch ts:
.
ce*et ..oe stt
.
og stV'Ub est
- u
-
ch hit os cis oe ts: og ssi" 'coosi; a o0 o00 (301 Nil 1A31 02H XW g co oda co cht co 095 co ce'h co*odh
.0!= co ott co owr 00 c9: 'i 00 0 F
co-Qs 00 c41 WW/01-M M0ld WiM033d - + 6 co kst co sil co rit co gii - c g Id 030)o pit co htt co sti dW31 3Wl33W co eti co 901 .
. co coi D
.
f
_ _ _ _ _ _ _
.
d
.
e
.
TABLE 1 SEQUENCE OF EVENTS OYSTER CREEK EVENT, SEPTEMBER 11, 1987 Time Source Event
02:02 Control Room "A" and "D" motor generator set motor winding j Recorder temperatures start to increas "A" and . "D" recircu . 3 1ation pumps are'not operating. Temperatures increase - J from approximately 85 F to 100*' F over a period of "
about 16 minute The recorder chtrt shows these F for about 25 minutes
~
temperatures . remained at '100 until "4" and "D" retirc pumps were started.
t 02:10 Operator kajor spill reported to control room from 23' )
Estimated Interviews, elevation by radiological control technician i
! Time * Calculations, {
( Security I Computer Group Operating Supervisor (GOS) dispatched to 23' )
elevation GOS reports-water coming from RBCCW- I Shift personnel suspect leak is coming from V-5-167 which was undergoing maintenance Leak confirmed to be from V-5-167 2:17:20 SAR & "B" recirculation discharge valve started to clos Analysis This time is based on the operator closing "B" recir-culation discharge valve shortly before the annunci-ator alarm "less than 2 LPS" actuatin Time was allowed for "B" retire discharge valve travel from an electrically backseated position. (From backseat to-95% limit switch position: 5-6 seconds; valve stroke time: 107 seconds.)
_ _ _ _ _ _ _ _ _ . _ _ _ _ _
.
.
..
Table 1 2
,
.
Time Source Event
.
02:17:22 SAR & Probable "C" recirculation discharge valve closure Analysis commences. This time as above is based on considered 'l operator action prior to actuating .the annunciator indicating. less . than 2 loops are operating or idl (Backseat to 95% limit: 5-6- seconds;- valve stroke )'
time: 106 seconds.) In addition, examining the "B" and "C" flow coastdown (see Figure 3),.no graduali tailoff .is evident as would be apparent with the ~ dis-charge valve full open. Comparing the flow coastdown for "B" and "C" the flow decrease compares favorabl Therefore, whatever actions taken to produce the "B" flow curve would have to be duplicated for the "C"
'
loo ,
Note that the op,erator opened "A" - and "D" ;
recirculation valves within 2 second j 02:17:26 SAR & "Less Than '2 LPS" annunciator actuated in control room ;
Analysis and printed on the sequence of alarm recorder.(SAR). l The actual time of the annunciator could not be deter- ,
mined exactly from the SAR paper tape but a time check .;
on the - tape immediately after the "Less than 2 LPS"
~
alarm indicated 02:17:45. This time was corrected to the new plant computer system time to yield 02:17:3 This time represents the latest time the alarm could have actuated. Based on the valve stroke times to !
clear the annunciator and analysis of plant parameters 02:17:26 was considered a prabable time for annunciator actuatio :17:28 SAR & "D" recirculation discharge valve starts to ope ;
Analysis This time was estimated from the "Less than 2 LPS :
Normal" indicated on the SAR tape considering valve stroke t'ime and analysis of plant parameters. (Valve stroke time: 96 seconds)
02:17:30 SAR & "A" recirculation discharge valve starts to'ope !
Analysis This time was estimated from the "less than 2 LPS
'
normal" indicated on the' SAR tape considering valve stroke time and analysis of plant parameters. (Valve stroke time': 107 seconds)
i l
_ _ _ _ _ _ _ - _ _ -
.
.
'
. Table 1 3
.
Time Source Event 02:17:42' Analysi s "B" and "C" recirculation pumps are' run' back in auto-matic control from the master recirculation ' flow con-troller. _The computer graphical representation (of recirculation- flow ~ for .the 9/11/87 event almost exactly. duplicates a 9/10/87' recirculation flow re-sponse in which both ."B" and: "C" recire ' pumps ~ were -
-
ramped down in. automatic control. The instrumentation and control ' supervisor had installed. strip' chart
-
recorders monitoring "B" . and "C" recirculation . pump controller . responses for, a tro'ubleshooting effort to correct flow ' oscillations with the "C" recirculation-pump. _The 9/10 controller signal matches the i 9/11 recorded: controller respon'se for "B":' recirculation pump during the event. "C": recirculation pumpi . con-troller was not available' foricomparison as the strip -
chart recorder had run out' of paper. 'at approximately'
1800 on 9/11/87. Comparing controller signal' re-sponses and recirculation flow responses for.9/10 and 9/11, it was conclude'd ' that the responses were essen--
tially the same and .that the operator had ramped both
"B" and "C" recirculation pumps back 'together using-automatic control from 'the master' recirculation flow controlle :17:58 Analysis Reverse flow is indicated in "D" recirculation loop as
"D" recirculation discharge valve strokes.ope :18:04 Analysis Reverse flow is indicated in "A" recirculation loop'as
"A" recirculation discharge valve strokes ope :18:08 SAR & RBCCW isolation alarm (due to closing V-5-166)
Analysis
_
V-5-166 and - V-5-709 were closed to stop RBCCW 1eak 02:18:10 Analysis "B" recirculation pump tripped. "B" recirc -loop flo starts to coast down "B" motor -' generator (MG) . set motor winding temperatures start. decreasing from =
137 F to about 90 F over a period of hours._ "B" pump motor winding temperatures decrease si.ightl (Control-room recorder)'
l l
- _ _ _ _ _ - _ _ _ . _ _ - _ _ _ _ _ _ _ - _ _ _ _ _
..
'
)
-
j
-
Table 1 4 I
.
'
Time Source Event The strip chart recorder that' was monitoring "B"
. recirculation pump. controller signals cat the time .of the' event captures the "B"- recirculation pump t r i p '.
The blind controller output signal indicates. a ste decrease in ' demanded recirculation -flow,.followed immediately by the pump trip - indicated by the tach-ometer feed back signal dropping precipitously to zero:
and the blindf controller output', signa 11-immediately
-
positioning to the low limiter setpoint which:on 5the'
.
'
'
chart is. reflected as approximately 38 ma. -(An I &. C-supervisor later.. recalibrates ;the rec' order and deter-mined the- reading to be approximately 24.43' ma which corresponds roughly .to a 20% limiter: setting'. This'is:
~
l
'
'an appropriate limiter setting for. a running recirc - J pump. .0ther limiter -settings were . as . follows, "A"'
recirc pump: Lo-20; HI-97, "B" : recirc pump: Lo-98; HI-100, "C" recire pump: Lo-100; HI-100, "D" recirc pump: Lo-100; HI-100, ' "E" reci rc pump: Lo-20'; HI-10 "A", "D", . and "E" ' pumps were running atu the -. time. )
Upon recirculation pump trip, the low limiter setpoint I becomes the controlling input to the blind controlle Af ter approximately 6 minutes, the controller output signal step increases offscale which might correspond-to raising .the low limiter setpoint. up to '.100. After
,
the event, the "B" pump limiter setpoint. was dis- 1 l
'
covered to be set at 98. -Possibly there was some con- l sideration given to restarting the "B" pump after. the trip as one would raise'the limiter setpoint up to 100 to warm MG set hydraulic fluid prior to restarting the ,
pum This .is a plausible explanation for , the strip 1
.
chart recorder trace. Others were explored, but this'
!
I one was found to be most suitabl .i
02:18:14 Analysis "C" recirculation pump tripped. "C" recirc loop flow 1
'
starts to coastdown. "C" motor generator set motor - l winding temperatures start decreasin "C" pump. motor < l winding -temperatures start decreasing from approxi- !
mately 137 F to about 90* F over a period of hours.
'
(Control room recorder)
]
a Core delta P goes to zero. If all-pumps ar.e tripped
.
l at this time, fuel zone level . turned on, but does . net .;
come onseale until later, i
,
02:18:32 Analysis RBCCW common heat exchanger out1.et . pressure. increases approximately 7 psig in pressure ' step increments' cor-
.
.
responding to the time V-5-166,- V-5-709. were shu !
.
i
_ _ _ _ - _ - _ _ _ _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ - _ _ _ _ _ -
_
- _ _ - _ _ - _ _ -
_
. ..
.
.
Table 1 5
.
, Time Source Event 02:18:34 SAR Reactor level . high alarm 170" yarwa Level increase'
due to recirc pump trips and reduction in letdown-flow.
l 02:18:36 SAR Reactor._ level high alarm l- 02:18:38 SAR "A" recirc pump CCW low flow due to ' isolation , of -
l V-5-166 and V-5-709 l 02:18:39 SAR "D" retirc pump CCW low flow l
02:18:50 SAR "B" recire pump CCW low flow 02:18:51 SAR "C" recirc pump CCW low flow
'
02.19:04 Analysis "D" recirculation discharge' reaches. full stroke and is-open. (Valve stroke time: 96 seconds)
This estimated time is based'on the valve'being opened at 02:17:2 Note that if "C" had been open at this point the "Less ,
than 2 LPS" alarm would have cleare !
02:19:12 Analysis "B" recirculation discharge valve close (Valve q l stroke time: 107 seconds; electrical backseating time l l allowance: 5-6 seconds.) _j This time is based on the valve starting to close at _
02:17:2 ,
02:19:13 Analysis Probable "C" recirculation discharge valve closur (Valve stroke time: 106 seconds; electrical backseat-
, ing allowance: 5-6 seconds.) .The operator probably l now reopened the valve as the "Less than 2 LPS" annunciator would be still illuminated and "C" loop is
, more preferable to reopen as."B" loop has RWCV on the luo "C" has no other systems tied into loop pipin :19:17 SAR & Less than 2 loops isolated normal alarm. At least 2 Analysis recirculation loops are open.
l
'
"A" recirculation discharge isolation valve reaches full open position and clears the "Less than ' 2 LPS" I
annunciato Stroke times are essentially based on the amount of time it takes the valve; to' travel from the 95's open limit switch to the full close positio The licensee estimated approximately- seconds travel time from the full open position to the 95?;
open limit switch under the no recirculation flow and-unbackseated conditio _ _ _ - _ _ _ _ _ _ _ -
.
-
Table 1 6
.
Time Source Event 02:20 Licensee Cleanup letdown flow stoppe Commenced raising Rx Operator water level to 185 inches for natural circulation Interviews 02:20:24 Analysis "C" recirc suction temp decreases from 144 to 142 This occurs as shutdown cooling flow backflows in the loops. "C" recirc discharge valve is approximately ,
66's ope j l
02:20:34 Analysis Fuel zone water level comes onscale. Fuel zone water j
.
level is turned on with no recirculation pumps running )
l but only indicates core region water level below 180" j l TA Considering plant conditions with level trans-ients from turning off pumps and opening valves, it was not considered un14kely that this instrument would take nearly two minutes to indicate onscale as level J drops accordingl !
02:20:59 Analysis "C" recirculation discharge isolation valve reaches full open positio :21:30 Analysi s "C" recirculation loop temperature decreases from 142 to 137 F. This occurs as shutdown cooling flow back-flows in the loops and possible cold feedwater flow l distributio Condensate flow is increased from =
71.5 x 10' lb/hr to 80.35 x 10' lb/h This likely j resulted from operator action to open a bypass valve I
'
around a nain feed regulating valve to raise reactor vessel level to 185" to facilitate shutdown cooling flow circulatio :21:32 Analysi s "A" recirculation loop suction temperature decreases from 143 to 139 :22:16 Analysis "0" recirculation loop suction temperature decreases from 142 F to 138 :24:24 SAR 02:24:57 PSMS Computer Reactor water level Hi/Lo Alarm (170"; GEMAC)
Graph 02:30 Interviews V-5-167 Backseated; RBCCW leak stop : 44 Analysis "B" recirc pump discharge valve opene _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ .
_ _ - _
.
'
.)
-
Table 1 7' ]
-
Time Source Event- 2
.02:54:49 -SAR V-5-166 opene RBCCW isolation alarm norma j 02:58:19 SAR RCP ' "C" : CCW Lo -- flow alarm norma V-5-709 . opened restoring RBCCW to RCP's 02:58:29 SAR .RCP "B" CCW Lo flow normal 02:58:31 SAR RCP "D" CCW Lo flow. normal 02:'68:39 SAR 'RCPL"A" CCW Lo flow normal, 03:08:41 SAR "0" recirc pump'. starte t .
l 03:15:03 SAR ~"A" . reci rc pump .- started; normal shutdown ' condition restore l
i i
!
I l
!
!
,
!
.. -
- _ _ _ - _ _ _ - - - _ - _ - - - _
_ ___
. .
.
-
!
.
APPENDIX A EFFECTIVE PROCEDURE TITLE- RE DATE 700.1.030 Generic Repack Procedure for 3 8/21/87 the use of Chesterton style 5300 style' one (1) packing j Standing Backseating/Unbackseating of 4 3/23/87, Order 33 1 \
700.2.012 Electrically,Backseating 4 5/06/85 )
Station Valves A100-SMM-3917.06 Manually backseating station 'O .1D13/86 valves i 107 Procedure Control 32 8/14/87 108 Equipment Control 38 6/08/E7 301 Nuclear Steam Supply System 39 3/29/87 2000-ABN-3200.19 RBCCW Failure Response 4 11/22/86
I
' '
Bibliography for Section . Engineering Request ET No. 391 issued 7/31/79 Letter from Finfrock to Eisenhut dated 6/23/80 Letter from Finfrock to Director NRR dated 4/3/83 Design Criteria 391-80-3, 9/12/80 Engineering Evaluation 391-80-1, 7/29/80 Installation Spec 391-80-4, 3/20/81 Modification Proposal 391-80-2, 3/18/81 Installation Spec 391-80-5, 12/10/81 (BA 402207) Letter from R. F. Wilson to J. Zwolinski dated 9/19/85 (RFW-0614) Letter from R. F. Wilson to J. Zwolinski dated 1/30/86 (RFW-0770) ; Letter from J. Donohew to P. Fiedler dated 7/15/86
l
,
I- - .-______ . i