Bulletin 79-06A: Review of Operational Errors And System Misalignments Identified During The Three Mile Island Incident

                               UNITED STATES 
                        NUCLEAR REGULATORY COMMISSION
                    OFFICE OF INSPECTION AND ENFORCEMENT
                           WASHINGTON, D,C. 20555
                                     
                               April 14, 1979

                                                     IE Bulletin No. 79-06A 

REVIEW OF OPERATIONAL ERRORS AND SYSTEM MISALIGNMENTS IDENTIFIED DURING THE 
THREE MILE ISLAND INCIDENT 

Description of Circumstances: 

IE Bulletin 79-06 identified actions to be taken by the licensees of all 
pressurized water power reactors (except Babcock & Wilcox reactors) as a 
result of the Three Mile Island Unit 2 incident. This Bulletin clarifies the
actions of Bulletin 79-06 for reactors designed by Westinghouse, and the 
response to this bulletin will eliminate the need to respond to Bulletin 
79-06. 

Actions to be taken by Licensees: 

For all Westinghouse pressurized water reactor facilities with an operating 
license (the actions specified below replace those identified in IE Bulletin
79-06 on an item by item basis): 

1.   Review the description of circumstances described in Enclosure 1 of IE 
     Bulletin 79-05 and the preliminary chronology of the TMI-2 3/28/79 
     accident included in Enclosure 1 to IE Bulletin 79-05A. 

     a.   This review should be directed toward understanding: (1) the 
          extreme seriousness and consequences of the simultaneous blocking 
          of both auxiliary feedwater trains at the Three Mile Island Unit 
          2 plant and other actions taken during the early phases of the 
          accident; (2) the apparent operational errors which led to the 
          eventual core damage; (3) that the potential exists, under certain
          accident or transient conditions, to have a water level in the 
          pressurizer simultaneously with the reactor vessel not full of 
          water; and (4) the necessity to systematically analyze plant 
          conditions and parameters and take appropriate corrective action. 

     b.   Operational personnel should be instructed to: (1) not override 
          automatic action of engineered safety features unless continued 
          operation of engineered safety features will result in unsafe 
          plant conditions (see Section 7a.); and (2) not make operational 
          decisions based solely on a single plant parameter indication when 
          one or more confirmatory indications are  available. 
.

IE Bulletin No. 79-06A                                      April 14, 1979 
                                                            Page 2 of 5 

     c.   All licensed operators and plant management and supervisors with 
          operational responsibilities shall participate in this review and 
          such participation shall be documented in plant records. 

2.   Review the actions required by your operating procedures for coping 
     with transients and accidents, with particular attention to: 

     a.   Recognition of the possibility of forming voids in the primary 
          coolant system large enough to compromise the core cooling 
          capability, especially natural circulation capability. 

     b.   Operation action required to prevent the formation of such voids. 

     c.   Operator action required to enhance core cooling in the event such
          voids are formed. (e.g., remote venting) 

3.   For your facilities that use pressurizer water level coincident with 
     pressurizer pressure for automatic initiation of safety injection into 
     the reactor coolant system, trip the low pressurizer level setpoint 
     bistables such that, when the pressurizer pressure reaches the low 
     setpoint, safety injection would be initiated regardless of the 
     pressurizer level. In addition, instruct operators to manually initiate
     safety Injection when the pressurizer pressure indication reaches the 
     actuation setpoint whether or not the level indication has dropped to 
     the actuation setpoint. 

4.   Review the containment isolation initiation design and procedures, and 
     prepare and implement all changes necessary to permit containment 
     isolation whether manual or automatic, of all lines whose isolation 
     does not degrade needed safety features or cooling capability, upon 
     automatic initiation of safety injection. 

5.   For facilities for which the auxiliary feedwater system is not 
     automatically initiated, prepare and implement immediately procedures 
     which require the stationing of an individual (with no other assigned 
     concurrent duties and in direct and continuous communication with the 
     control room) to promptly initiate adequate auxiliary feedwater to the 
     steam generator(s) for those transients or accidents the consequences 
     of which can be limited by such action. 
.

IE Bulletin No. 79-06A                                      April 14, 1979 
                                                            Page 3 of 5 

6.   For your facilities, prepare and implement immediately procedures 
     which: 

     a.   Identify those plant indications (such as valve discharge piping 
          temperature, valve position indication, or valve discharge relief 
          tank temperature or pressure indication) which plant operators may
          utilize to determine that pressurizer power operated relief 
          valve(s) are open, and 

     b.   Direct the plant operators to manually close the power operated 
          relief block valve(s) when reactor coolant system pressure is 
          reduced to below the set point for normal automatic closure of the
          power operated relief valve(s) and the valve(s) remain stuck open.

7.   Review the action directed by the operating procedures and training 
     instructions to ensure that: 

     a.   Operators do not override automatic actions of engineered safety 
          features, unless continued operation of engineered safety features
          will result in unsafe plant conditions. For example, if continued 
          operation of engineered safety features would threaten reactor 
          vessel integrity then the HPI should be secured (as noted in b(2) 
          below). 

     b.   Operating procedures currently, or are revised to, specify that if
          the high pressure injection (HPI) system has been automatically 
          actuated because of low pressure condition, it must remain in 
          operation until either: 

          (1)  Both low pressure injection (LPI) pumps are in operation and 
               flowing for 20 minutes or longer; at a rate which would 
               assure stable plant behavior; or 

          (2)  The HPI system has been in operation for 20 minutes, and all 
               hot and cold leg temperatures are at least 50 degrees below 
               the saturation temperature for the existing RCS pressure. If 
               50 degress subcooling cannot be maintained after HPI cutoff, 
               the HPI shall be reactivated. The degree of subcooling beyond
               50 degrees F and the length of time HPI is in operation shall
               be limited by the pressure/temperature considerations for the
               vessel integrity. 
.

IE Bulletin No. 79-06A                                      April 14, 1979 
                                                            Page 4 of 5 

     c.   Operating procedures currently, or are revised to, specify that in
          the event of HPI initiation with reactor coolant pumps (RCP) 
          operating, at least one RCP shall remain operating for two loop 
          plants and at least two RCPs shall remain operating for 3 or 4 
          loop plants as long as the pump(s) is providing forced flow. 

     d.   Operators are provided additional information and instructors to 
          not rely upon pressurizer level indication alone, but also examine
          pressurizer pressure and other plant parameter, indications in 
          evaluating plant conditions, e.g., water, inventory in the reactor
          primary system. 

8.   Review all safety-related valve positions, positioning requirements and
     positive controls to assure that valves, remain positioned (open or 
     closed) in a manner to ensure the proper operation of engineered safety
     features. Also review related procedures, such as those for 
     maintenance, testing, plant and system startup, and supervisory 
     periodic (e.g., daily/shift checks,) surveillance to ensure that such 
     valves are returned to their correct positions following necessary 
     manipulations and are maintained in their proper positions during all 
     operational modes. 

9.   Review your operating modes and procedures for all systems designed to 
     transfer potentially radioactive gases and liquids out of the primary 
     containment to assure that undesired pumping, venting or other release 
     of radioactive liquids and gases will not occur inadvertently. 

     In particular, ensure that such an occurrence would not be caused by 
     the resetting of engineered safety features instrumentation. List all 
     such systems and indicate: 

     a.   Whether interlocks exist to prevent transfer when high radiation 
          indication exists, and 

     b.   Whether such systems are isolated by the containment isolation 
          signal. 

     c.   The basis on which continued operability of the above features is 
          assured. 

10.  Review and modify as necessary your maintenance and test procedures to 
     ensure that they require: 

     a.   Verification, by test or inspection, of the operability of 
          redundant safety-related systems prior to the removal of any, 
          safety-related system from service. 
.

IE Bulletin No. 79-06A                                      April 14, 1979 
                                                            Page 5 of 5 

     b.   Verification of the operability of all safety-related systems when
          they are returned to service following maintenance or testing. 

     c.   Explicit notification of involved reactor operational personnel 
          whenever a safety-related system is removed from and returned to 
          service. 

11.  Review your prompt reporting procedures for NRC notification to assure 
     that NRC is notified within one hour of the time the reactor is not in 
     a controlled or expected condition of operation. Further, at that time 
     an open continuous communication channel shall be established and 
     maintained with NRC. 

12.  Review operating modes and procedures to deal with significant amounts 
     of hydrogen gas that may be generated during a transient or other 
     accident that would either remain inside the primary system or be 
     released to the containment. 

13.  Propose changes, as required, to those technical specifications which 
     must be modified as a result of your implementing the above items. 

For all light water reactor facilities designed by, Westinghouse with an 
operating license, respond to Items 1-12 within 10 days of the receipt of 
this Bulletin. Respond to item 13 (Technical Specification Change proposals)
in 30 days. 

Reports should be submitted to the Director of the appropriate NRC Regional 
Office and a copy should be forwarded to the NRC Office of Inspection and 
Enforcement, Division of Reactor Operations Inspection, Washington, D.C. 
20555. 

For all other power reactors with an operating license or construction 
permit, this Bulletin is for information purposes and no written response is
required. 

Approved by GAO, B180225 (R0072); clearance expires 7/31/80. Approval was 
given under a blanket clearance specifically for identified generic 
problems.