Information Notice No. 84-58: Inadvertent Defeat of Safety Function Caused by Human Error Involving Wrong Unit, Wrong Train, or Wrong System
SSINS No.: 6835
IN 84-58
UNITED STATES
NUCLEAR REGULATORY COMMISSION
OFFICE OF INSPECTION AND ENFORCEMENT
WASHINGTON, D.C. 20555
July 25, 1984
Information Notice No. 84-58: INADVERTENT DEFEAT OF SAFETY FUNCTION
CAUSED BY HUMAN ERROR INVOLVING WRONG
UNIT, WRONG TRAIN, OR WRONG SYSTEM
Addressees:
All nuclear power reactor facilities holding an operating license (OL) or
construction permit (CP).
Purpose:
This information notice is provided as a notification of potentially
significant problems pertaining to inadvertent defeat of safety functions
caused by human errors involving the wrong unit, wrong train, or wrong
system. It is expected that recipients will review and consider actions, if
appropriate, to preclude similar problems occurring at their facilities.
However, suggestions contained in this information notice do not constitute
NRC requirements and, therefore, no specific action or written response is
required.
Description of Circumstances:
A large number of reports have been made to the NRC that describe events in
which safety functions were inadvertently defeated as a result of actions
performed on the wrong unit of a multi-unit plant, the wrong train of
systems with redundant trains, or a wrong system. In many cases, the loss of
safety function was not recognized for a long period of time, resulting in
significant degradation of the levels of safety. An example of each type of
event, caused by human error involving the wrong unit, wrong train or wrong
system, is described below. A sample listing from among at least 50 reports
of other similar events that have occurred is contained in Table 1.
On October 2, 1983, an operator was dispatched to lock closed a manual valve
on the discharge side of each of the redundant containment spray pumps for
Turkey Point Unit 3. The activity was required by the procedure for
proceeding from hot to cold shutdown in preparation for a refueling outage.
The operator, instead of closing the Unit 3 valves, locked closed the valves
for Unit 4 which was operating at power. Subsequent to this activity, there
was a change in operators. The replacement operator later went to the Unit 3
containment spray pump discharge valves and closed them as he found them to
be open. He was
8407230079
.
IN 84-58
July 25, 1984
Page 2 of 3
unaware that the Unit 4 valves were closed. It was over a day later before
the licensee's technical staff discovered the Unit 4 valves to be locked
closed during a monthly periodic test of the containment spray system.
Hatch Unit 2 was operating at 100% power on August,17, 1982, with the "B"
loop of the residual heat removal service water system (RHRSWS) out of
service for maintenance. While removing "B" loop from service, the personnel
tasked with closing the "B" loop strainer inlet valve inadvertently closed
the "A" loop strainer inlet. This resulted in the total loss of RHRSWS and,
thus, the residual heat removal (RHR) system including the postaccident heat
removal capability.
On February 7, 1984, the FitzPatrick plant was operating at full power when
the high-pressure coolant injection (HPCI) system was intentionally tagged
out of service to permit general maintenance and modification of the
overspeed trip. Tagging out the HPCI system included closing of the motor
operated steam supply valves, and racking out the breakers for the valves
and oil pumps for the turbine. Before removing HPCI from service, other
safety systems were demonstrated operable as required by the Technical
Specifications. As a part of the maintenance, technicians were assigned to
calibrate the HPCI turbine speed indication which involved disconnecting the
speed feedback circuit and thus disabling the HPCI system regardless of any
other actions. After completing the calibration on what they thought to be
the HPCI turbine speed instrumentation, the technicians reported that the
as-found tolerance was over 40% higher than the procedure limit. When the
responsible supervisor initiated an investigation of the as-found tolerance,
it was discovered that the technicians had calibrated the reactor core
isolation cooling (RCIC) speed instrumentation instead of the HPCI
instrumentation. This activity had resulted in loss of RCIC with HPCI
unavailable.
Discussion:
A review of the inadvertent defeat of safety function events including those
cited above and summarized in Table 1, indicates that many events were
highly significant from the standpoint of safety and others would have been
significant if they had occurred under different circumstances. The review
also indicates that misidentification of equipment by personnel was the
primary cause of most events. Other events were caused by inadequate
planning, defective procedures, or defective labeling of equipment. Although
not the primary cause, design error or failure to perform adequate
verification of activities was a contributing factor in some events.
In the Turkey Point event, the operator had access to the wrong unit because
the access keys were the same for the two units. Also, the valves had
identical identification tags for both units. The operator did not carry the
tag out sheet with him and thus did not sign it for completion of the
activity. Later, the replacement operator closed the correct valves. The
closed valves on the operating unit were not discovered for over 28 hours
because no verification of the activities was performed. Following the
event, the procedural and administrative deficiencies were corrected. A
walkdown of the accessible portions of all safety-related flow paths was
performed to verify that all valves were in correct positions, the locks for
the two units were color coded, and different keys were made for the locks
of the two units.
.
IN 84-58
July 25, 1984
Page 3 of 3
The Hatch Unit 2 event was attributed to personnel error and lack of
adequate independent verification. As a part of corrective actions, new
identification tags were made and locks were changed so that the, keys for
valves in one loop will not open the valves in the other loop. In addition,
the personnel responsible were counseled and reprimanded.
The FitzPatrick loss of RCIC event with HPCI out of service was caused by
personnel error. Following the event, the licensee instituted an awareness
program for the technicians in addition to improving the identification of
HPCI and RCIC equipment.
Adequate procedures, planning, labeling, awareness and training of
personnel, and an independent verification program are needed to prevent the
occurrences of such events. The frequency and number of such events being
reported to the NRC indicates a need for further industry action in these
areas. Additional guidance on independent verification programs is provided
in Information Notice No. 84-51, "Independent Verification."
If you have any questions regarding this matter, please contact the Regional
Administrator of the appropriate NRC regional office or this office.
Edward L. Jordan Director
Division of Emergency Preparedness
and Engineering Response
Office of Inspection and Enforcement
Technical Contact: R. Singh, IE
(301) 492-8068
Attachment
1. Sample List of Recent Inadvertent
Defeat of Safety Function Events
2. List of Recently Issued IE Information Notices
.
IN 84-58
July 25, 1984
Page 1 of 1
Table 1: Sample List of Inadvertent Defeat
of Safety Function Events
Plant/Date Event Summary
D.C. Cook An auxiliary equipment operator was
03/14/81 instructed to deenergize breakers for five
motor operated valves of the Unit 2 safety
injection system. He instead deenergized the
breakers of five Unit 1 valves.
Calvert Cliffs Electricians began work on Unit 2 control
04/17/82 element assemblies (CEAs) instead of the
assigned Unit 1 CEAs.
Point Beach An operator was instructed to perform part
04/22/82 of a procedure to drain the reactor coolant
of Unit 2 which was shutdown. Instead, he
performed the procedure steps on operating
Unit 1.
North Anna 2 Both trains of the quench spray subsystem
05/28/82 and the recirculation spray system were made
inoperable because jumpers were installed in
the train "A" instead of the train "B" solid
state protection output cabinet.
St. Lucie 1 During full power operation, the primary and
06/29/83 back up heat tracing for the boron injection
flow paths were isolated for 24 hours. The
condition existed because the entire
chemical and volume control system heat
tracing was isolated rather than only that
required for the "A" boric acid piping.
Turkey Point 3 With the unit at 100% power and auxiliary
04/19/83 feed water pump "A" out of service, all
steam supply valves for "B" and "C" pumps
were found to have been closed for five
days. The operators had misidentified the
valves and independent verification was not
performed.
D.C. Cook 2 During containment spray system testing,
06/03/83 operators closed a wrong valve which
rendered the train not under test
inoperable.
Kewaunee Both trains of shield building ventilation
03/13/84 were taken out of service for one hour when
maintenance personnel began work on the "A"
train instead of the "B" train.
Page Last Reviewed/Updated Tuesday, March 09, 2021
Page Last Reviewed/Updated Tuesday, March 09, 2021