IUCE.4.EiW.mT REPOr7T

'co*[TaOL etock. | | | | '. | lh (PLEASE PRINT OR TYPE ALL REQUIRED 1*JFORMA710M' I 9

|- |0 lo |@ 4| 1) 1| 1| 1|@ I |@| Al LI J| M! F| 1|@ 0l 0| * 010 4 0 10 8o 17 8 9 Lice.5EE LoDi 14 :$ 1A;i.ssi r v. aw.1 23 26 L E*.5s t v P6, Ju $J LAT SJ

CON'T

lolil 5CnN I Ll@l 01510101OT314I8!@0|2|1 |4 |8 |0 l@]012I219|810|h"

J 8 d>J 61 (, ,c s E ; F.L? M T- > GJ s DENT CATE 14 74 REPGHT DATI 80

EVENT DESCRIPTICN AN3 P9C9 ADLE CONSFERNC6! y ,

o 2 | On 9/5/78, a design change was implemented which installed an " auto-defeat" selector |

| o | 31 | switch to allow bypass of the control grade auto start signal of the MDAF pumps upon |

Ja[.l| | trip of both Main Feedwater pumps when Main Feedwater pumps are intentionally removed I~

| from service. At 1500 on 2/l' /80, while testing the control grade auto start feature,go 3

g [c | | A and B MDAF pumps failed to auto start on the " Loss of Main Feedwater Pump" test g

- 3[7|| signal. At the time of the incident the plant was in Mode 4 and the requirements of [

yy , 3 | Tech. Spec. 3.7.1.2 were not applicabic. g

SYSTE?J CES E C,trtSE CCNs. vatygCCDE CO;E SL''C;rJE CO*.980N1*eT CODE SUSCCOE sua:CCE

ri]T1 | wi clO Lx1@ l z iS A P ! U| M | P | X | X [h | B |@ y @; a 9 13 : IC '12 id 19 23

TGQ. ENT( AL CCCURRENCE PEFORT 8tEV151o*4_ EVENT YE AP EG808t T N O. CO''E TYPE No.

@ ,ag.g.pg I 8! Oigg g

'-I !O fl !4 1 1/1 1013I |t i 1-1 LO_J_ 21 22 :: 71 2.:> 27 IS ;3 33 31 02

ACTION FUTURE E''ECT J-t?OC . a A TT AC c *.t E *.T WP D-4 PW5 CC"3 COUPCNENTTAKE*4 ACTION ON 8LA?.? UETaC3 e&0L'*15 SU3YlTTED FCa!.t w 9 $1P' L i' ' ' %t ANUF AC TURE54

I c [g|24H|g |_ zig [z @ f O! 01010 | | Y|@ |Ni@ [Aj@ | I | 0 |. 7 | S Jg40 'I 42 43 44 4733 4 o

'ICAUSE DESCRIPTION A.NO COMI~TIVE *CTLCWC hIilo||This event is attributable to inadequate desion change control. The pre-implementatiotj

gii,g| engineering review of design changes has been strengthened and includes amone other i

Ir,7 1 things a review to identify design errors, a review to identify procedures affected byI

g,,3 |the design change, a review to verify compliance of the design with Tech. Specs. and |

g, . | other licensing requirements, and a determination of post implementation testing i> 8 9 EL*quireWntS. So

craeasmT s h EcEo?NY#'s'r,0ElC t

/ De$CevERY DESCRIPitCNsPowsR

ii {s | | G !@ | Ol Ol Oh| NA I ,|Blh| Performing test |* 8 <a 13 ' . * 1) 44 45 46 SJ

ACitvliv CON TENTPELE%5EO C F RE L E ?.5 E AnC:.4T OS AC3sW LOCAT6CN o7 RELEASE

EITl | Zj @ [7;,g|l NA I { NA |T- 8 *, la is so 45 ga

PEH50raNEL EXPOSURESNL".*B f A TTPE CE ,CWlPTO4 "J

Lug 10IO!0!@!z13,, NA |r . ., ,, .: sa

PE HSONN E L INJVHli$f.U *.* 9 F .'t DESCMPitoN

Qiaj|0|0|0|Q| NA |- 8 9 11 12

EO% OF on D A'.tAGE To FCL8TV -

TvPE OL5CH6PilON

ItIol'lZl@| NA |

t . .us r ^ ozSCaiPnow b f NRCUSE ONtYPUBLscTVl !I F %

L' , l 1 I i 111 I ! I ! I I 12i[2 f n | I N , ) NA

^ .C - a unma v 'l u o a a

H ton, III. .

MAA'E OF PRifAHER PHONE: ,

s o o 30 s oor,3_. _ _

.

.

ALABAMA POWER COMPANYJOSEPH M. FARLEY NUCLEAR PLANT

DOCKET NO. 50-348ATTACHMENT TO LER 80-014/03L-0

Facility: Joseph M. Farley Unit 1

Report Date: 2/29/80

Event Date: 2/14/80

Identification of Event

On 9/5/78, a design change was implemenced which installed an" auto-defeat" selector switch to allow bypass of the control gradeauto start signal of the MDAF pumps upon trip of both Main Feedwaterpumps when Main Feedwater pumps are intentionally removed fromservice. As a result of errors in the review, implementation andretest of the above design change, A and B MDAF pumps failed toauto start on the loss of Main Feedwater pump test signal duringthe perfonnance of the 18 month surveillance test FNP-1-STP-22.9(Auxiliary Feedwater Pumps IA and IB Auto Start Test) at 1560 on2/14/80.

Conditions Prior to Event

The unit was in Mode 4 when the condition was identified.

Description of Event

On 9/5/78, a design change (prepared Ly off-site engineering) wasimplemented which installed an " auto-defeat" selector switch toallow bypass of the control grade auto start signal of the MDAFpumps upon trip of both Main Feedwater pumps when Main Feedwaterpumps are intentionally removed f rom service. At 1500 on 2/14/80,while testing the control grade auto start feature, A and B MDAFpumps failed to start on the loss of Main Feedwater pump testsignal with the " auto-defeat" selector switch in the auto (enable)position. At the time of the incident the plant was in Mode 4 andthe requirements of Tech. Spec. 3.7.1.2 were not applicable.Subsequent investigation indicated that the auto-start of the MDAFpumps upon trip of both Main Feedwater pumps had been inoperallesince 9/5/78.

Designation of Apparent Cause

This occurrence is attributable to inadequate design change control.The design change review performed in accordance with 10CFR50.59did not ascertain that an amendment to correct a Technical Specificationdiscrepancy was required. Also, functional testing was inadequatein that it did not determine that switches were mislabeled andli-ks were open.

__ .._ s . _ . - .. . . _ . -

- .- 80-014/03L-0.

Analysis of Event

The following errors were made with regard to this event.

The design change review performed in accordance with 10CFR50.59a.

did not ascertain that an amendment to correct a Tech. Spec.discrepancy was required. During development of the Unit 1ST.C the auto start of the MDAFW pumps by trip of both MainFeeuwater pumps was deleted from Section 3 since the autostart was not protection grade and not required for any accidentanalyzed in the FSAR. The surveillance requirement to verifyOPERABILITY of the auto start was erroneously included inSection 4.7. The 10CFR50.59 evaluation identified the changeas a change to the plant as described in the FSAR and a safetyevaluation was provided which showed that the change did not

- involve an unreviewed safety question. The presence of thesurveillance requirement in Section 4.7.1.2 was overlooked.The design change was reviewed in accordance with requirementsof Plant Technical Specifications and was reported to the NRCin the Annual 10CFR50.59 Report.

b. Functional testing after implementation of the design changewas inadequate in that it did not verify auto start of theMDAF pumps upon loss of botn Main Feedwater pumps. Thistesting only verified that protection grade circuitry for AFWpump start on S/G lo-lo level had not been affected. As aresult of inadequate functional testing the following errors

-- in the design and implementation were not detected:

(1) Handswitches which were added to allow defeat of theauto-start in Modes 2 and 3 were incorrectly labeled inthe design document, i.e., auto position was actuallydefeat and vice versa.

(2) Links in the associated circuitry were apparentlyopened during the implementation of the design change

- and were not reclosed as required by FNP-0-AP-52," Equipment Status Control and Maintenance Authorization"and FNP-0-AP-13, " Temporary Alteration and JumperControl".

It should be noted that the loss of off-site power, safetyinjection and low-low steam generator safety grade auto startcircuits and manual start circuits were all operable duringthe period.

Corrective Action

1. The handswitches were relabeled, links closed and thesurveillance test was successfully performed.

2. Implementation of administrative controls over design changeshad already been strengthened prior to discovery of this eventand has been reviewed for adequacy. The pre-implementation

- . . . . . . . - .- -

-

80-014/03L-0..

.

engineering review has been strengthened and includes amongother things a review to iden:lfy design errors, a review toidentify procederes affected Lf the design change, a review toverify compliance of the design with Technical Specificationsand other license requirements, and a determination of p'ostimplementation testing requirements.

3. A Technical bpecification change to delete the surveillancerequirements in Section 4.7.1.2.2.b for the auto start of theMDAFP on loss of Main Feedwater pumps has been initiated.This auto start signal is a control grade signal and no-credithas been taken in any safety analysis for the auto start ofthe auxiliary feedwater pumps by this signal. Also, thesignal is not included in Tech. Speu. Table 3.3-3, 3.3-4,4.3-2 or 3.3-5; however, the reference to the signal wasinadvertently left in Section 4.7.1.2.2.b of the TechnicalSpecification draf t and was issued as part of the operatinglicense.

Failure Data

None