. - -

.

- _ .

m. 5( w#' rAar'~

/ ~X ,,.

OAK RIDGE NATIONAL LABORATORY-

oatmaTro av

UNION CARBIDE CORPORATIONNUCLE AR Cm310N

PC5T OFFl E Bo1 X~

*C AK Rf De t, T ENNE 51EE 37830

May 22, 1979

,

Ib. Andrew L. BatesAdvisory Committec on Reactor SafeguardsU.S. Nuclear Regulatory CommissionWashington, DC 20555

Dear Mr. Bates:

Review of Licensee Event Reports

A review of licensee event reports (LER's) from the viewpoint ofa control and protection system designer reinforces the conviction thatthe instrumentation and control (ISC) systems play a major role in theestablishment and maintenance of safe and orderly plant operation. Evenif a failure of an ISC item does not directly influence plant operation,it may require that plant operation be altered or even shut down becausethe failure may reduce unacceptabry the margins deemed necessary forsafe operation.

There is little correlation bet.veen the magnitude or consequences ofa reported event involving ISC systems and the potential value of thelessons to be learned. Relatively minor events can indicate significantdeficiencies, while spectacular and serious consequences can accompanyevents where na new insights are provided. This may be largely the resultof the widespread use of redundancy techniques in ISC systems, which makesthe systems tolerant of single random failures within them. The signifi-cant events are not those wherein equipment items fail as a result of arandem defect, premature wearout and the like (except when the rate greatlyexceeds normal expectations), but those involving misapplication," surprising" responses, nisunderstood or neglected requirements and thelike which are likely to produce system-level failure rates that areconsiderably higher than expected. Thus, from this reviewer's viewpoint,a broad spectrum of events must be examined carefully to see what lessonsare to be learned. Since each event is usually accompanied by a "fix"of the particular scenario, one must look beyond the immediate cause-consequence relationship if significant improvements are to be made.

One problem that has come to our attention is the large number ofcases where essential equipment has failed to operate (or was incapableof operation) as a result of failure of fuses or other devices installedfor the express purpose of protection that essential equipment or itsservices. It is common practice to use fuses, fault detection devices,

80022,00 O @ g,g,jo'f,

t. .

_ _. -_ . _

- ._. _

.

.

'

.

* l"

Mr. Andrew L. Bate, 2 May 22, 1979 -

-

.

torque limiters, and other devices to assure that electrical or mechanicalequipment is not damaged as a result of specific types of malfunction ormisoperation. However, many such practices were developed in situationswhere shutting down such equipment was less costly than allowing damageto the equipment. When such equipment is required to provide vitalprotective functions, such as afterheat removal or containment isolation, _

the rationale for protecting such safety related equipment must be,

clearly established. Specifically, if protective devices for essential i

'

equipment significantly increase the probability that the equipment willbe unavailable when needed, one must consider carefully the justificationfor these devices. It may be that the level of protection afforded i

strongly influences the impact; that is, if less conservative choices offuse or breaker ratings are made it may be that the adverse impact onsafety could be greatly reduced.

The suggestion is therefore made that a study be undertaken todetermine what practices are being employed to protect vital equipmentand if the practices are found to be deficient to suggest improvements.As mentioned previously, the field is large, including electrical over-current, undervoltage, and unde frequency protection, torque limiting onvalves, diesel engine interlocks en oil pressure, temperature, and the likeas well as other similar items.

Another type c? situation that appears repeatedly is failure todetermine (and co: rect) fundamental shortcomings. An example is theMillstone event ir. olving degraded grid voltage. The first fix had aflaw that require a second try, and there still appears to be nointention to look any further at fusing the control circuits. Whileit is certainly true that it is difficult to evaluate quickly andcorrectly many transient t>7e events, it is quite possible that acareful independent follow-up study could lead to a better understandingof rcot causes and eventual overall plant improvements. Perhaps a teamof experts shculd be formed to evaluate, across the board, the LER'srelated to ISC and the followup actions, with the aim being a more rapidweeding out of design, maintenance, and operational flaws. Not onlycould such an effort be effective in uncovering plant specific problems,it could be an efficient way of integrating lessons learned in one plantinto the design and operation of simi:ar plants.

'In addition to in-depth studies of certain classes of failures andevaluation of appropriateness of the follow-up conclusions and actions,a look, as sugges*ed by Dr. Hanauer,'at all LER's of a givensystem to reveal cormon mode failures or adverse systems interactions

' would be extremely useful. Such effects are often missed during intensivestudies of specific failures and statistical exercises.

Perh'aps, lastly, there should be a continuing activity, outside the'

licensing cha n, devoted to the study of LER's as soon as they appear(currently a few hundred per month). The previous suggestions are in thenature of " catch-up" tasks; this one is to stay abreast of activities.New.t Lniques and hardware often bring new manifestations of old problems.

_

1 Minutes of the Eval"ation of Licensee Event Reports SubcommitteeMeeting, hbrch 1 and 2, 1979, p. 3. ,

.. , ,. . ..

# # 4 9

7 7n'F~

- __ _ _ _ _ _ _ _ . _ - _ . _ _ . _ _ _ _

*'

.

Mr. Andrew L. Bates 3 May 22, 1979*

,

. .

Funy read current LER's but lack the strength or support to follow up.The enforcement people are concerned primarily with compliance and lackthe resources to provide much improvement beyond the minimum requirements.Someone workin; outside the constraints of licensing or regulatorypositions would be in a better positien to judge on technical issuesalone.

..

It is this reviewer's opinion that the LER structure should not bealtered solely to improve its statistical value. If the LER's are soaltered, I suggest that some other method be found to assure rapiddissemination of good information relative to system failures. Whilestatistical data are certainly important for many purposes, they do notprovide all the insights needed for improvements in safety. If, forexample, it is required to identify a "cause," using a coded list forstatistics, significant factors could be obscured because of the implica-tion that there is only one cause. A good description, of sufficientlength and detail, should be encouraged.

Although one would like to think that the number of LER's written

could be reduced by raising the threshold, there is the risk of losingsome significant events. On the other hand, elimination of reporting(or reporting via another avenue) of " technical" violations such as failureto perform a test en time could reduce 'th- number by a few percent withoutloss of informatien of general interest.

Sincerc'y,'' *

DI.\ fQ ' W,.~.-( ,.. . . ._ .

S. 3. Citto-

* SJD: cwl

ec: D. W. Moeller.

.

. . . . .. . . . . - . .- . . . . . . . . .. ..

. . . . . . .. ..

.. . . .

.

a

. . .

. . . . . .

. . .

. . ..

.

, , . . "

.

.- ..

.. .. . .. ... . ~_ . .. . . . . . .

. . .

. . . .

.

. . . . .-

. .. . . . .. .

. .

'

. . .

~

.

.-. .., . . , . . .. - . .

- - _ _ _ . - . _ _ . . . . _ _,

_

. . . , . -

J.

-.~ 4 & '^ g/ c < Z .-

W -,

-

DRAFT

An Exar.ination of Selected

Licensee Event Reports 1976 t'veugh 1973 _

?eo basic types of Reactors are used for production of pouer within.

the t'nited States. ""he Soiling '4ctor Reactor that produces steam from

derineralized water in direct contact with the Reactor fuel elenants,

and the Pressurized '4ater Reactor that utilizes a secendary fluid

(Reactor Coolant) to transfer heat from the Reactor to host exchar.gers

(Stoan Generators) in which stean is producod. An electrically heated

pressurieer is incorporated in the Reactor Coolant Systen to r.aintain

the pressure of the Reactor Coolant high enough to prevent bcilin; in

the Reactor,

3cron solutions are usel wN. boil. typ+c of Reactors. Ecw+. mr in

the Eoiling 'Jater Reactor it is ussd only in the Standby Liquid ;ontrol

3yston. The function of this syste is to provide a backup r.ethod,

which is independent of the c:ntrol rods, to rake the Reactor sub-

critical over it's full re.nge of operating cenditions. Thic is accon-

p11shed by injecting a poison solution of sodium pentaborato in dec.ivra-

11:od water into the Reactor '/essel through two explosively actuated

valves connected in parallel. Motal diaphragns incorporated in e. hose

valves isolate the boren solution fro: the Reactor until they are sher. rod

by the cr;1osive actuators. ':"nis systan has no other function and would

be expected to remain in standby condition throughout the life of the

Rea ctor.

Pres'surized '4ater Reactors have three rajor Eeron Systons:

A. Reactor Coolant Systen

B. Residual Heat Rer. oval Syste=b

,

gd s

{.'C. D.ergency Core Cooling System

_ _ -

. - - _- -

,.

, , ,e.-

i

d.

,

The Reactor Coolant Systen includes the reactor coolant punps that

circulate the coolant through the systen, the stean generators, the

pressurieer, piping and associated inst:-ments and controls. The

reactor coolant, conposed of denineralized water, sodium pentaborate1

and other ehenicals added for Ph control, serves not on1,y as a heat

transfer : edia, but because of it's boron poisen content, as a shi=

control to reduce the number of control rods needed and to L prove

power dist'ribution. The boren content of the coolant is decreased

from about 13,000 ppn (F.330)) with a new cere to about 100 ppn with

spent fuel.

The D.ergency Core Cooling Systen is designed to cool the reactor

core and provide shutdown capability in case of the rupture of ar,y

coolant or staan pipe, a tube rupture in the steam generator, or a f!

rupture of the control red device nechanism causing a red cluster I

control assenbly ejection accident. ~his is acconplished by injecting

borated water into either the cold lee or the upper head of the

reactor fron large safety injection tanks in which the liquid is

stored under nitrogen pressure. b' hen these tanks are depleted

additional berated water nay be punped from the refueling storage tank9

or from the reactor containment sump. ]

Che ,ical control of the borie acid solutions is acconplished

by thu chonical volume control sysceo located outside the reactor'

1

containnent building. It contains equipment for continuously with-

drawing'a small side strean of reactor coolant, purifying it by ion

exchange, adding chenicals and denineralized water as needed and

returnin6 it to the coolant systen with high pressure charging pucps.

.

~--w>'-~ we a m w. p+ 6 , s. m p, m.w_ , _ , , , _ _

- -

-- -- - _ - _ _ _ _ _ _ _ _ _ _ _ . _ . _ _ _ _

. . .-

. . . . .: ..

.

1

1

.

.

A ec=piLitien of 642 Licensee Event Reports issued during 1976, 1977

and 1978 on Boren Systens, prepared try the Nuclear Safety Informatien ._

Center, were reviewed. These reports were grouped as follews:.

Presstt-ize.d Water ReactorsNo. of LERs

Reactor Core Cooling e.nd ChemicalVolume Control Systems 173

Residual Heat Renoval Systa= 106

Teorgency Core Cooling System 215

Sub Total 494

Pm ps

iTransfer P=ps 11Charging Peps 84 1

Reactor Coolant Peps 44 ;1

Seb Total 139Total Pressurized Water Reactors leg 5 633

Soiling Water Reactors t r. M 9Total %2 l

As r.ight be expected due to the lin.ited use of Soren in Boiling|

Water Reactors, fewer problems are encountered. The nine events !i

,

|

reported were all due to concentrations being outside Technical Speci- !

fleation Limits. The re=aiider of this report will discuss LERs concer- |1

ned only with Pressurized Water Raaetors. ;1

The causos for Events for which LERs were issued for the three )!

Soron Systens are given int,

i

Table 1

Boron Systems For Reactor Core Cooling & Chemical Volume.

Control*

-!

Table II I

|

Emergency Core Cooling Systems

Table III'

'

Resi6a41 Heat Renoval Systa=

LER causes for ymps are shown in Tables I7;V and VI| -

.. _ _ __

m en n : ca o o ta :: o m < g'p 9 s e Dr la pH O la c f. s -s u w e o t- *sn *s o o .st x R- g+ <+ 3

e oia o g t- I, e 3s or<a :s e e in

N se &* to * *s o 491- c. r s e e a p o

+ u -: 5e e> ou g 314 e J P o'V. ".*2

M '" Ot.': c u: o o I-e i* e e :s d. "e4 o e *sa o < > > *$ u ox o o

I.T* [[H<Dn. u

,

rt ijeoY -

ete

ooo g?h2M Personnel-ProceduresE u m u u e e c en u

a 6" e o Leak '* Un'

1) "$*

e to to 6-- # 111sa11gned Valvesi}+ nf

g,u

Design Error '8 ho t- to t- N * "

-s< "

y e e v to I a C Failure ."* 8po.I o

v e t- t- Constniction Error *Cys

to & @ Valve Leak S9o *f *:O @

'" " "Valve Failure.u, u

''3 * * " Ng ibron Crystals

u '" *- 6' '" '" Vendor Error

O 6" N *- O flaintenanco Error

'' ** * F 6" * '-y Defective Equitrient

0 " lbric Acid Damgo*

.

I

eN t* TO 6-- P Osu to u o y os N os o o; u u o- e Totals

_ _ _ _ - _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _

,

.

Table II

-

Energency Core Cooling Systen

Procedures & Personnel Errors 54

Instrunents & Controls 46

Valves 40

Design Errors 15

Pipe I4aks 10

Defective Equi;rnent 10

LElectrican Power 8

Inadvertant Safety Injections 8

Construction Errors 7 j

|Punps 6

'

|

Cther 5 ||

F.aint4 nance 4 ||

Seal Water Leaks 2

Total T15

.

e

4

- -

.

, , .

Table III,

.

Residual Heat Removal Syste.

Procedures & Persor.nel Errors 31

Valves 24,,

Pipe leaks 10

Pumps 8

Design Errors 6

Instraments & Controls 6'

Maintenance 4

Electric Fewer 3

Constraction Errors 3

Airbound Pumps 1

Seal '4ater IAsks 2

Other 8Total 106

Table II

Transfer Pumps

Seal Failures 3

PluSEed with Boron Crystals 3

Power System 2

Procedures & Personnel Error 1

Valve Alig;n=ent 1,

Vendor Irror 1Total 11

.

%

.=

. - . . . . - . _ . . - _ . - . . - - . . - - . .. _ . . . . . . .

.

. . ,, . . . ,. . . _

.

f

Table V.

N

Chargins Pumps

Design and F,umfacturing Errors 18

Cracks & Leaks in Castings 10-

Packing & Seal Leaks 10

Pipe Laaks 8

Ma?ntenance 7

Procedures & Fersonnel Prror 10

Electriesi Motors 71

Instra.ents & Controls 5,

Valves 4 j!

Suetien Airbound 2 - |; |

Seal Water Punp Failures 3 !

Total 84

.

Table VI

.

Tseacter Coolant Pu:::ps

Design Construction Errors 15

Seal Leaks 10 .

Leaks in 3:all Pipes Connected to Punps 9.

Instruments & Controls 4

Defective Procedures & Personnel Errors 3

Electric Power 3-

. Total 44

.

*

v t e -E' - < _..___.__..._-_arre._______._ __ _

_ __

. . ,. .

.

Discussion of 12?J

Boron Concentration

It my be observed that about one fourth of the IIRs for the _

Reactor Coolant System originata because observed Eoren Concentrationsi

fall outside the Technical Specifications. Technical Specifications i

require sufficient Soron under all operating conditions to provide an

adequate shutdown margin to ensure that (1) the Reactor can % made

suberitical from all operating eenditions, (2) the reactivity transients

associated with postulated accident conditions are controllable within

acceptable linits, and (3) the reactor vill W maintained sufficiently

suberitical to preclude inadvertent criticality in the shutdown sendi-.

I

1 {tion.l

With only a few exceptions the I2Rs exand.ned deviated from the,

specified values by less than 2% and in no instance did the safety of

the public appear to be conpromised. It would seem that the basis for

the technical specifications should be reexamined to deter =ine whether

the present limits are appropriate. Regardless of the outcome of such

a proposed study, it is apparent that a great deal needs t.o be learned

about the develop 3ent of procedures and the training of personnel res-

ponsible for the control of boren concentration.,

Foron Crystals

Eeron solutions r:ust be maintained at tenperatures high enough to

prevent crystals forming. Crystals plug pipelines, prevent valves fromtu

seating properly, fom#in strument sensing devices and in lines leading-

to instruments, thereby a"Iceting calibration. They are responsible for

25% of the IIRs for blocked flow paths, 25% of the instrunent and control

problems, and 40% of the chemical punp problems (See Table I)

t

.%r- .m-* --i.4-..

_ . _ . . . _ _ . _ _ _ ._, . ._

. , ,, ,

.

.

Attention is called to the folleving IIRs that enphasize the im-_

portance of this problem.

R0-251-78-1 Turkey Point I

"Sovie acid flow path fron boric acid storage tank to Reactor Coolant

System blocked" "Tnere was no operable flev path from the BAST to the RC3".

123 77-014-03- L4

" Boron flow path to charging punp blocked at Surry 2"

"Cause-Boron Crystals on valve seat"..

"This eli-inated one of two flow paths to the charging pump suction"

"RanpdowTt was i=ediately initiated".

IIR78-035/0IT-0

" Blockage found in EIT tank discharge at Indian Point 2"

Heaters

Crystal formation is prevented by careful attention to Boron concen-

tration and by a reliable system of heat tracing for process lines.

Fresent systens appear to be far from trouble free and vere responsible

for 10,5 of the. coolant systen IIRs. Irenically about half of the.

problems with heat tracing systens were caused by boric acid fron leaks

or spills, penetrating the heat tape and shorting the conductors. Studies

to develop nere reliable heat systens are suggested as it is believed they

. =ight contrih:te significantly to mini-izing operating and safety proble=s..

Leaks

Leakage of boron solutions is frequently reported. Leaks develop

threugh cracks and velds in pipe and equipment, gaskew.t Dints, valve

.

,-

; yese , ," .--*'*~S~~WNW-W*""

, . . . . . - . . . . . . .. - .- - - - . . _ .

,~c . ;e .

ciaphragns, pump seals, and in valve sten and pump packing.

Leakage from eracks or velds reported is usually in sna11 diar.eter _

lines attached to equipnent or to larger dianetor lines, e a tigue or

vibration is frequently cited as the cause. Th* ? suggests that greater

attentien should be given to resonance problems and to minimizing the

vibration and repeated stresses by the greater use of snubbers and pulse-'

tion dar.pers. Several reports indicate that pulsation danpers are now

being inste.11ed on the suction and discharge lines of positive displace- |

nent charging pumps that were origin:.lly installed witnout them. (!!?.C

is requesting data frem these systens to deter .ine their effectiveness

in reducing stress related leakage proble=s),

problens with diaphragn valves should be ninimized by a preventive

maintenance progran to replace valve diaphragns before the end of service

life is reached. A carefully plc.nned, well coordinated e:cperimental pro-

gram is indicated for the developnent of nere reliable shaf t packings

and sesis.

'

.

|

|

|*

.

e

5

^

c. , - - " _ ,.______1_,''*"2"_

_ *__

P

*-

-

e

.

Table VII.

Inadvertent Safety Inject. ions. ,

'

:

e Event Power causeHeactor_-

Date Leveli

*'A

Cook 1 9/1/76 0 Ioss of Vital tus channet caussi SI signal

Cook 1 9/30/76 O Unknown- may be master drivo card,

Salem 1 12/30/76 0 Iteactor trip

Crystal River 12/21/76 0 risintenance error caused try circuit drawing error'

Trojan 10/28/76 0 1(eactor trip caused by too rapid boron additionZion 2 12/21/77 75 Hoactor trip while testing i!IT valve

Salem 1 3/30/ 7/ 0 lloactor trip :

)j Cook 1 't/21/7/ Sts ulown ruse caused loss of inverter .

'

Farley 1 7/21/7/ 0 '!rong test procedure used

tearley 1 6/01/ 7/ 0 Operator turned wrong switch -,

,

Boavor Valley 1 ft/29/7/ 100 Heactor trip following partial closing of main steam isointion valve i

|| by instnunent air leak,

' I;| Zion 1 7 / 11 / 7 / 0 Heactor trip-water hammer caused false SI signs 1j ltobinson 2 10/26/7/ 0 Instrument failure caused false signal *

Crystal itiver 12/22/ 7/ 100 tirong switch operation

Farley 1 12/211/77 100 Failure to follow procedure during test i

3

||| Zion 1 9/1'*/7t3 0 Heactor trip- water hammer caused falso SI signal ,

q .

~ i j

!

Note: Table II lists only eight inadvertent safety injection events. The remaindershown above are listed under the cause that initiated the initial Iteactor trip.

L

i! ,

i1 ,

. t,-

t.

] I

. .

. _ _ __ . . _ _ _ - - . _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

. -- . .- .~ . . .. - - _- . -. -- .

.. .

.

,

Pumps

Events reports were reviewed for three types of punps; transfer

punps, charging or =nkeup pumps and reacter ceclant punps, causos_

for failure are re;:erted in Tables rl, V & VI respectively.

Transfer pumps are standard industrial punps used to transfer

boren solutions from the borie acid blender to the refueling water'

storage te.nks, As they are outside the reactor containment they are

accessible at all tines. Eleven LE?.s on transfer punps were re-

viewed and none are believed to have safety significance.,

l

Charging pumps are used to transfer borated water from the I,

lrefueling water storage tank to the reactor coolant s/ stem and the ;

1

energency core cooling system. Both centrifugal and variable speed I

positive displacenent pu=ps are used.

Metalurgical problens have been encountered that caused shaft

breakage on one nanufacturors centrifugal punp. This problem was

investigated and the latest event for this cause was in 4/4/77. These

events are included under Design Manufacturing Errors in Table V.

Positive cisplacement ch2rging punps are responsible for nany problems.

Many of these punps have been installed without pulsation dampers.

Very high pressure peaks developed especially if the suction is par-,

,

tially airbound. These hign pressure peaks are probably responsible

for many fatigue & piping problems reported.

Reactors are permitted to operate with two of the three charging

punps out of service for 24 hours. This occurred in twelve situations.,

-Robinson 2 operated for 24 rd.nutes with all three punps cut of

service on 6/7/77 and because of an operator error 4/21/70 the third

charging punp was tripped off at Beaver Valley momentarily.

.

- +m. .-w.m _ ~ _ ys- p

_ . _ _ _ _ _ . - . . . . , _ _ . . . _ _ -__ _ - _ _ . _

, , , _ . . . . - _. . . . -

1 ) , {.n3. ,,. rL''..

J.

.

.

Class of Event

Set point drift in instrumentation.

General Descriotiena

An unplanned change in the set-point of an instrument is referred to as set'

point drift. The effect of set point drift is to alter the actual value ofj the measured parameter at which a particular action is to occur. When thei drift is of sufficient magnitude to cause the set point to be out of compli-4 ance with the plant's Technical Specifications, the event is required to be

,

reported.

1 Freauency of Occurrencel-

1976 1977 1978 Total4

1

BWR 158 211 141 510 |PWR 76 88 98 262 l

lHTGR 0 2 2 4{; Total 234 301 241 776 I

Implications recardino Safety I1

Safety instrumentation channels are redundant and, in general, the set point;

drift of the associated redundant instruments were within techniral specifica-tion limits. A review of each of the above 776 LERs is require' so deteminewhether there are any instances of simultaneous drift of redunetra channels

q beyond technical specification limits.

Corrective Action

For those cases where the set point drift is caused by component failures whichoccur at random within an instrument, the corrective action is to make the nec-

1essary repair, recalibrate, and to restore the instrument to service. In other !cases, the margin between the selected set point and the technical specificationilimit is not sufficient to allow for the normal instrument inaccuracy. The cor- :rective action for these cases is to increase the margin between the selected1set point and the technical specification limit to accormodate the inherent

instrument inaccuracy.

,

e

panH.- -

.

.

.

C' .-

,~

'.~<,

i,e ' '.

SET POIt4T ORIFT s'' ' .=

LICENSEE EVENT REPORTS Y':_

.

1976 1977 1978 Total

Power Range Instrument 24 17 11 53

Intermediate Range Instrument 1 3 1 5

Startup Range Instrument 1 0 0 1

In Core Instrument i 1 2 4

Flow Sensor 15 35 30 80

Level Sensor 37 56 57 150

Pressure Sensor 108 119 83 310

Temperature Sensor 14 18 16 48

Protective Instrument 7 3 3 13

Misc. Instruments 26 49 38 113

i

Total 234 301 241 776|

|

|;

I

.

.

%

+ e *

- __. ,- .. - - . . .- --

.,n{|D

* ~. .

Seale5/25/~/9

Search 1 - Contaircent Integrity Leak Rate, Containment Valves, Violation -

of Contaircent, Isolation of Containment When Not Necessary

27 - Door Interlocks ,

36 - Excessive Leakage in Test31 - Design Oversight or Constraction Error4 - Panel Settling, Bulges, Determination of Seal ~Mete:8 - Maintenance Error1 - Weather

56 - Personnel Error1 - Shipping Gash leaking

164 4 T.

Search 2 - Contairment Leak Rate i

l17 - Valve Leaks '

9 - Ventilation Leaks2 - Large Door Leaks2 - Penetration Leaks

!1 - Maintenance Error4 - Test Hardware Leaks1 - Air Monitoring Equi;nent failure

.E |

|Search 3 - Contairment Isolation and Valves i

248 - Valve Failures20 - Valve Controller Failure

108 - Valve Leaks ._

27 - ClosureNout of time specification91 - Personnel Error (Operator, Designer, Maintenance, etc.)

500

There are not real surprises in the distribution of causes of failure. 3ings- wear out 35-50% of the time, people make mistakes 20-25% of the time, performance-degrades out of specification limits 20-25% of the time, etc. The real messagesare in the details of a few of the LER's and only with a proper write-up and adetailed examination can that event be passed along.

|

_

1

Gkb m-

_ _ _ _ _ _ _ _ _ _ _ - _

- u. , ,_ ,

9

,

, . ' Seale5/25/79

7 ,

. , , , -

Class of Event_

Defective materials used in construction

General Description

Several instances of defective materials being used by sappliers infabricating a large group of valves, pipe runs, etc.

Frecuency of Occurrence

Isolated cases as for as kind of material, vendor identification, type*of system involved.

Implications Regardina Safety

Possible failure of groups of similar equipment due to common flaws.Precise consecuences depends of particular systems involved. Ceg radationof contaircent integrity.

Corrective Action

(a) Eculpment from same vendor identified and examined by appropriateGA methods. Other uses of similar type steels examined for similardefec ts.

(b) No indication of follow-up with vendor.%

Class of Event

Cavity found in concrete in reactor building dome.

General Description

Cavity extending across the top of the building dome was found while set-ing~!nen anchors in the concrete. Cavity was in several pours. Voids 1 3/4' thick '

and up to 15 inches deep in the pour were discovered in detailed acousticexamination.

Implicatico Regardine Safety

capabilities of several section of the containment dome are suspect due toflaws in the stractural materials.

.

S

}

,

.

Seale5/25/79

Corrective Actions:_

(a) Extent of the problem in this case carefully determined

Wb llow-up port written.

Class of Event

Door Interlocks defeated while performing maintenance, bringingmaterial into building, etec.

General Description

A widespread occurrence of overt defeat of the integrity of containmentto run air liner into restricted ventilation areas, transfer large objectiveinto building, etc.

Implications Regarding Safety

Containment Integrity violated.

Corrective Action

(a) Reprimand employees involved.

(b) Retraining as to proper procedures. -

(c) Little indication of decrease in nu ber of occurrence with time.I!

1,

:

.

.

9

e

.

#

e - ve- -'

- . _ _ _ _ _ _ _ .- _ __ . __ _ . . _ _ . . __ _ _ _ . _ _ _- -

' *. . , . :. .

, e,.,, ,.

')?..

,

t

.

A. Grendon7.ay 25, 1M9~

Class of Event_

Probable use of unlicensed cperator without adequate supervision.1

General Oescription,

' Although few LERs indicate what category of operating personnel wasresponsible for events reported as personnel errors, at least 3instances (1 at Brunswick 1&2 and 2 at Point Beach 1) noted that an" auxiliary operator" was at fault in connection with an erroneousdischarge of radioactive liquid or gas. It seems probable that theterm refers to an operator undergoing training prior to licensing,although it may not be necessary, under the Tech. Specs., to employlicensed operators for auxiliary activities such as controlled effluentdischarges.

iFrecuency of Occurrence

Since 3 reports explicitly noted that the individual at fault was an" auxiliary operator" while only 2 or 3 of the 26 instances examined ,

cited licensed operators, it is likely that cther events among the 20or so in which qualifications of the individual at fault were not -

described involve " auxiliary opertors".

Implication Recardino Safety.

:

In none of the cases of erroneous effluent discharge was the amount of |activity such as to constitute a significant hazard; but the possibility !-

of significant discharges is present.

Corrective Action-!

Few of the LERs attributing radioactive effluent discharges to personnel |error make mention of any corrective action, though it is virtually cer-tain that the individual at fault was told of his error and cautioned i

against reFesting it. A more positive corrective measure would be to re- .

quire a supervisor to check the performance of an operator who is supposedly |; undergoing training before he acqua11y initiates an authorized discharge. !

.

O*

i

,

MM ;

!-

.

- . . . - - , - - . . - -- - - _ . _ _ _ _ _ _ - - - _ _ _ . --_ .-.

1. - - . .. . 1. . < . .a. :

-

i-

.I |

}.' JJ'

Mu >' A. GrerdenMay 25, 1979

,,?.-

Class of Event_

Replacement of failed component without correction of cause of failure.

General Description

1

An unintended discharge of radioactive gas was discovered by a routine gas'

volume calculation at Yankee Rowe. The cause was determined to be a leakingdiaphragm in a value which " indicated attack by a petrolium based substance". |

"The diaphragm was replaced in kind."

Frequency of Occurrence

This is an isolated case in the comparatively small list of componentfailures noted in a review of unauthoriced radioactive effluent dis-charges. It see:ns probable, however, that component replacement withoutcorrection of an unexpected cause of failure may occur in other systems.

Implications Recardino Safety

Since safety is enhanced if compenents can be replaced just short of failure,it is desirable to know the expected life of each. Conditions that greatlyreduce the expected life can lead to prolorged neglect of proper maintenance.

Corrective Action

Replacement in kind is not an adepate corrective action when the failurewas caused by an unexpected condition. The proper corrective action shouldinclude analysis of the origin of that condition and measures to forestallits repetition.

.

e *

4

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _