Information Notice No. 94-90: Transient Resulting in a Reactor Trip and Multiple Safety Injection System Actuations at Salem

                                 UNITED STATES
                         NUCLEAR REGULATORY COMMISSION
                     OFFICE OF NUCLEAR REACTOR REGULATION
                            WASHINGTON, D.C. 20555

                               December 30, 1994


NRC INFORMATION NOTICE 94-90:  TRANSIENT RESULTING IN A REACTOR TRIP 
                               AND MULTIPLE SAFETY INJECTION SYSTEM 
                               ACTUATIONS AT SALEM


Addressees

All holders of operating licenses or construction permits for nuclear power
reactors.

Purpose

The U.S. Nuclear Regulatory Commission (NRC) is issuing this information
notice to alert addressees to the events associated with the loss of
circulating water at Salem Nuclear Power Plant, Unit 1, on April 7, 1994, that
led to a reactor trip followed by multiple automatic actuations of the safety
injection system.  It is expected that recipients will review the information
for applicability to their facilities and consider actions, as appropriate, to
avoid similar problems.  However, suggestions contained in this information
notice are not NRC requirements; therefore, no specific action or written
response is required.

Description of Circumstances

On April 7, 1994, at 10:00 a.m., Salem, Unit 1 was in Mode 1 at 73-percent
power.  Public Service Electric and Gas Company (the licensee) was operating
the unit at reduced power because river detritus (marsh grass) had fouled the
circulating water intake structure causing a reduction in condenser cooling
efficiency.  In response, the operators decreased the power level of Unit 1 to
approximately 60 percent because of an increase in condenser back pressure
caused by grass fouling of the traveling screens at the intake structure.  In
response to an impending loss of circulating water, the operators began
reducing load by 1 percent per minute.  However, in rapid succession, several
of the Unit 1 traveling screens became clogged with grass, causing the
associated pumps to trip, until only 1 circulating water pump remained
running.  As the pumps were lost from service, operators increased the rate of
the load reduction to 8 percent per minute.  

Operators attempted to reduce unit load as rapidly as reactor power was being
decreased by insertion of control rods and addition of boron.  The effort
caused a power mismatch that resulted in a slight, but continuing, increase in
reactor coolant temperature.  In response, the nuclear shift supervisor
directed the operator controlling reactor power to go to the electrical
distribution control panel and shift plant electrical loads to offsite power
sources.  Although operators believed that the plant was stable, they failed 


9412270233.                                                            IN 94-90
                                                            December 30, 1994
                                                            Page 2 of 5


to recognize that reactor power was still decreasing because of the delayed
effect of a previous addition of boron.  This caused a reversal of the power
mismatch and resulted in reactor coolant system (RCS) temperature decreasing
to below the minimum temperature at which criticality is allowed.  The
operators attempted to restore RCS temperature by increasing reactor power
from approximately 7 percent to 25 percent.  However, since power had been
below 10 percent, the power range "high neutron flux-low setpoint" trip had
been automatically reinstated, establishing 25-percent reactor power as the
trip setpoint.  When power reached 25 percent, the reactor automatically
tripped.

Almost immediately, train "A" of the safety injection (SI) logic actuated on a
high steam flow signal coincident with low RCS temperature.  (Later
investigation revealed that the high steam flow signal was actually the result
of a pressure wave created in the main steam lines when the turbine stop
valves closed as a result of the turbine trip).  In response to the reactor
trip and safety injection, the operators entered the plant emergency operating
procedures.  The SI logic did not reposition all necessary components to the
expected, post-actuation position because the initiating signal was so short. 
The operators manually repositioned the affected components to their proper
positions.  At 11:00 a.m., the licensee declared an unusual event based on a
"manual or automatic emergency core cooling system actuation with a discharge
to the vessel."  When the operators took action to reset the SI logic, they
discovered that train "B" of the SI logic had not actuated, indicating an
apparent logic error.

As the operators were attempting to stabilize the plant, the RCS continued to
heat up because of reactor decay heat combined with reactor coolant pump heat. 
Steam generator pressure increased but was not automatically relieved by the
steam generator atmospheric relief valves because of a pre-existing condition
that prevented the proper automatic operation of the valves.  Concurrently,
because of RCS heatup and the volume of water added by the safety injection,
the pressurizer filled to a solid condition, and the pressurizer power-
operated relief valves cycled several hundred times to control RCS pressure. 
A short time later, steam generator pressure increased in the "11" and "13"
steam generators to the safety valve lift setpoint.  The opening of a safety
valve caused a rapid cooldown and depressurization of the RCS that was
magnified by the solid condition of the system.  RCS pressure rapidly reached
the automatic SI setpoint of 1755 psig, and since train "B" of the SI logic
had remained armed, a second automatic SI actuation occurred.  At about the
same time, operators manually initiated safety injection in response to the
rapidly decreasing RCS pressure.  After the second safety injection, operators
remained in the emergency operating procedures, and continued their attempts
to stabilize plant conditions.  The pressurizer relief tank rupture disk
actuated because of increasing tank pressure caused by the volume of RCS water
relieved to the pressurizer relief tank from the pressurizer power-operated
relief valves.
.                                                            IN 94-90
                                                            December 30, 1994
                                                            Page 3 of 5


The operators controlled plant pressure using the charging and letdown
provisions of the chemical and volume control system because normal RCS
pressure control was not available due to the solid condition of the system. 
At 1:16 p.m., licensee management declared an alert to ensure activation of
the Salem Technical Support Center to provide the Salem operators with
additional technical assistance to support cooldown of the plant. 
Accordingly, the Technical Support Center was fully staffed.

At 3:11 p.m., the operators established a steam bubble in the pressurizer
using pressurizer heaters.  At 4:30 p.m., operators restored pressurizer level
to the normal band and returned level control to automatic.  They subsequently
exited the emergency operating procedures and used the integrated operating
procedures to cool the plant down to Mode 4 (Hot Shutdown), which was achieved
at 1:06 a.m. on April 8, and then to Mode 5 (Cold Shutdown), which was
achieved at 11:24 a.m. on the same day.

Discussion

On April 8, 1994, the NRC dispatched an Augmented Inspection Team to
investigate the event.  The results of that inspection were documented in NRC
Inspection Report 50-272/94-80, dated June 24, 1994.  Although several issues
emerged from the NRC investigation of this event, three specific aspects are
of particular concern.  These aspects are discussed below.

Solid State Protection System Logic Mismatch:  During the first SI actuation,
the "A" and "B" logic trains of the solid state protection system were
mismatched.  Train "A" sensed and responded to conditions representative of a
steam line break accident, namely a low RCS temperature coincident with a high
steam line flow.  Although these conditions were real indications, the RCS low
temperature was due to operator error and the high steam flow was a transient
signal induced by a pressure wave resulting from the closure of the turbine
stop and control valves.  This transient signal had a duration of about 30
milliseconds, which system response testing later showed was sufficient for
certain portions of the "A" logic to respond, but of insufficient duration for
the "B" logic to respond.  The logic mismatch appears to be a result of the
variations in response sensitivity to the steam flow input relays.  The
licensee modified the design to require a longer signal duration before the
logic is actuated so that such transient signals would not result in an
undesired safety injection.

Nuclear Instrument Rod Shadowing:  Before the initial reactor trip, when the
operators were raising reactor power to restore RCS temperature, the
intermediate range and power range nuclear instruments were not in agreement
with respect to indicated power.  The intermediate range detectors were
"trailing" the power range by about 5 to 10 percent.  This led to a condition
in which the reactor was tripped at the 25-percent power range setpoint before
the rod block signal was received from the intermediate range detectors at  
20-percent power.  The discrepancy between the power and intermediate range
nuclear instruments was apparently due to "rod shadowing." .                                                            IN 94-90
                                                            December 30, 1994
                                                            Page 4 of 5


The combination of the cool RCS and the rod pattern resulting from the down
power maneuver shielded the intermediate range detectors, causing the
instruments to indicate a lower power than the power range detectors. 
Although this bias was within an acceptable envelope for detector operability,
the response of the instruments was not initially understood.  This led to
concern that the nuclear instruments were not properly operating.

Control Room Command and Control:  Before the initial reactor trip, shift
management directed staff to support actions necessary to restore circulating
water.  The Shift Technical Advisor, a senior reactor operator assigned to the
work control station, was directed to assist in the restoration of affected 
equipment.  The extra duty reactor operator was directed to assist at the
intake structure.  The senior shift supervisor was initially in the control
room area, but subsequently left to go to the turbine building.  This
deployment of licensed operators led to minimal staffing of the control room
at the onset of the transient.

During this time, the operators were preparing to take the unit turbine off
line, and the reactor controls operator was directed by the shift supervisor
to initiate actions to transfer plant electrical loads.  This led to the
reactor controls watch station not being staffed during a reactivity change. 
The RCS began to cool as a result of a slight power mismatch between the
reactor and the turbine.  When the shift supervisor first discovered this
mismatch, he began to raise reactor power to restore temperature, which led to
a momentary loss of the command oversight function.  He subsequently
recognized the need to maintain an overall command posture and stopped
withdrawing control rods.  However, he continued to allow the reactor controls
operator to swap the electrical loads and the RCS temperature continued to
decrease.  When the reactor controls operator completed the electrical plant
realignment, the shift supervisor then directed him to raise reactor power to
restore RCS temperature.  The shift supervisor did not discuss the fact that
he had manipulated the control rods with the reactor controls operator, and
his direction to the relatively inexperienced operator lacked specificity (how
far or how fast to raise power).  The operator subsequently raised reactor
power until the 25-percent power trip was reached.

Related Generic Communications

.     NRC Information Notice 94-55, "Problems with Copes-Vulcan Pressurizer
      Power-Operated Relief Valves," August 4, 1994.

      This information notice discusses cracking of plug material, severe wear
      of plugs and cages, and a problem with the misalignment and galling of a
      stem in the power-operated relief valves discovered as a result of valve
      inspection subsequent to the April 7, 1994, event.

.     NRC Information Notice 94-36, "Undetected Accumulation of Gas in Reactor
      Coolant System," May 24, 1994.

      This information notice discusses lack of operator awareness of an
      accumulation of nitrogen in the reactor vessel head during cooldown and
      depressurization of the RCS subsequent to the April 7, 1994, event. .                                                            IN 94-90
                                                            December 30, 1994
                                                            Page 5 of 5


This information notice requires no specific action or written response.  If
you have any questions about the information in this notice, please contact
the technical contact listed below or the appropriate Office of Nuclear
Reactor Regulation (NRR) project manager.

                                    /s/'d by BKGrimes


                                    Brian K. Grimes, Director
                                    Division of Project Support
                                    Office of Nuclear Reactor Regulation

Technical contacts:  Robert J. Summers, RI
                     (609) 935-3850

                     Eric J. Benner, NRR
                     (301) 504-1171

Attachment:  
List of Recently Issued NRC Information Notices