ML022830834

Part 3 of 4 - Babcock & Wilcox Crosstraining Course

ML022830834
Person / Time
Site:	Oconee, Crystal River
Issue date:	09/19/2002
From:	Babcock & Wilcox
To:	Office of Nuclear Reactor Regulation
References
FOIA/PA-2002-0343
Download: ML022830834 (118)

Text

BABCOCK AND WILCOX CROSS TRAINING MANUAL CHAPTER 13 OTSG In-Service Inspection

B&W Crosstrainin* Course Manual B&W CrosstraininL, Course Manual nT4Zd-- 1nQ.-;- T f; TABLE OF CONTENTS 13.0 ONCE-THROUGH STEAM GENERATOR IN-SERVICE INSPECTION 13.1 Operating Experience ............................................... 13-1 13.2 Steam Generator Inservice Inspection Requirements ........................ 13-2 13.2.1 SG Tube Surveillance Basis ....................................... 13-3 13.2.2 Eddy Current Testing ............................................ 13-3 13.3 Tube Repairs ......................................................... 13-4 13.3.1 Tube Plugging ..................................................... 13-4 13.3.2 Sleeving .......................................................... 13-4 13.4 Long Term Corrective Actions ........................................... 13-5 13.4.1 Design Changes .................................................... 13-5 13.4.2 W ater Chemistry Control ............................................ 13-5 13.5 References ........................................................... 13-7 TABLE 13-1 Operating Experience With B&W OTSGs Through November 1981 ............. 13-8 FIGURE 13-1 Inspection Lane Flow Blocker USNRC Technical Training Center USNRC Training Center 13-i Rev 0896 Technical 13-i Rev 0896

- OTSG In-Service Inspection D1X YY T.. r UC 3LI L u liSiS ., W .. l I In 13.0 ONCE-THROUGH STEAM GEN A second steam generator tube leak occurred ERATOR IN-SERVICE INSPEC on October 31, 1976, in the Oconee Unit 2 steam oTION generator A. The tube was again located near the open lane, and visual inspection using fiber optics Learning Objectives: revealed a circumferential crack near the upper tube sheet. This tube was also removed from

. service by plugging. J

1. Define:

a. Degraded tube

b. Defective tube On December 4' 1976, a leak developed in the

c. -Plugging limit Oconee Unit 2 steam generator B. The leaking "d. Inspection lane tube was a*ain identified as a lane tube,-and was determined to have a 2700 circumferential crack at This tube was removed from

2. Describe where most leaks have occurred in "2the upper tube sheet.

B&W once-through steam geneiators. the steam generator and subjected to visual, chemical, and metallurgical examinations. The

3. Explain the basis for the 20% and 40% of metallurgical examination revealed that the crack wall thickness limits for steam generator had initiated on the outside surface of the tube and tube degradation. propagated through the wall, and then had continued circumferentially in both directions "4. List the 3 major 6ontributors to steam around the tube. The propagation of'the crack ienerator corrosion problems. -around the tube was attributable to a high frequency, low-stress fatigue mechanism.

13.1 Operating Experience As of November 1979, 17 tube leaks had oc Sixteen of The first tube leak in a B&W steam genierato r curred in B&W steam generators.

at the Oconee Nuclear occurred on July 21, 1976, in the Oconee Unit: 3 these leaks occurred October 1979, Crystal River Unit 3 steam generatoi B. -Subsequent plant shutdowi n Station. In and inspection revealed that the leaking tube wa s experienced a small tube-to-tube-sheet seal weld breakup of a burnable poison the 11th tube in row 77 near the open inspectioln leak caused by the in damage to the tube lane. Eddy current testing (ECT) revealed that th e rod assembly that resulted in steam generator B. In defect was located at the uppermost (15th) suppoxt to-tube-sheet welds became lodged in a small per plate level. The tube was removed from servic e addition, debris of the tubes in steam generator B.

by plugging. This event was the'first indication of centage actions taken -by Florida Power abnormal degradation in any B&W stearn'. Corrective' generator. Prior to this date, two inservic e Corporation included video inspection of the inspections of the Oconee Unit 1 steam generator s damaged tube stubs, leak testing, a free path check 100 percent of the A and B steam generator and one inspection of the Oconee Unit 2 stearn of eddy current testing, and tube plugging.

generators had been performed. These inspection is tubes, included eddy curient testing in accordance wit Regulatory Guide 1.83 ;and visual and fiber opti c Most of the leaks in B&W once-through steam have occurred in tubes adjacent to the inspections.: The eddy current testing did ncWt generators This lane consists of the area reveal any tubes with greater than 20 percent wa I1 -inspection' lane.

f created where a row-of tubes extending halfway penetration; and, in general, no evidence (

"across the ,tube bundle has been omitted to abnormal degradation had been observed.,

":13-1 - Rev 0896 USNRC Technical Training Center

I B&W Crosstraining Course Manual OTSG In-Se~rvice In n~eactfmn facilitate inspection and chemical cleaning of the with debris found on the support plates and lower tube bundle. These leaks have occurred in the tubesheet. The debris deposits also provide a uppermost span at the intersection of the tube and medium for the concentration of adverse the upper tubesheet or at the intersection of the chemicals which can lead to corrosion of the tube and the 15th support plate., After fiber-optic tubing. Samples removed from the field indicate inspections, through-wall circumferential cracks that the debris is predominantly iron oxide with have been reported as the source of the leakage. traces of other elements. B&W and the affected Examination of tube specimens removed from the utilities are evaluating chemical cleaning as a generators indicates that fatigue, believed to have method for removing the debris, and thus reducing iesulted from flow-induced vibration, was the the potential for further tube degradation. Table crack propagating mechanism. In at least two 13-1 shows once-through steam generator instances (Oconee Unit 3 in 1980 and Rancho operating experience.

Seco in 1981), fiber-optic inspection has revealed the source of the leak to be a 3600 crack around 13.2 Steam Generator Inservice Inspection the tube circumference. B&W believes that the Requirements full circumferential failures have occurred during plant cooldown when the tubes are subject to The program for inservice inspection of steam tensile stress due to differential thermal loadings. generator tubes, as set forth in the SG Tube Surveillance, is a modification of Regulatory The initiating mechanism for the Guide 1.83, "Inservice Inspection of Pressurized circumferential fatigue cracks is believed to be a Water Reactor Steam Generator Tubes." It is an combination of surface damage from corrosion augmented program designed to provide more products and concentrated chemical agents carried extensive inspection of steam generators with by moisture during adverse secondary system evidence of abnormal tube degradation. Degrad conditions. ed tubes are those that have a reduction in wall thickness of greater than 20 percent but less than B&W has developed a flow-blocking device the plugging limit, which is the maximum allow (Figure 13-1) to be placed in the inspection lane. able reduction in tube wall thickness minus an These devices can be attached to tube support operational allowance. Any tube with a reduction plates at several elevations. The purpose of this in wall thickness exceeding the plugging limit is device is to alleviate corrosive attacks on tubes a defective tube.

adjacent to the inspection lane in the upper span by forcing the steam and water mixture out of the The NRC has approved a modified version of open lane and into the heated bundle, where it will the Standard Technical Specifications for Three be evaporated. Mile Island Unit 1,Arkansas Unit 1, Davis-Besse, and Oconee Units 1, 2, and 3. This modified A tube degradation phenomenon which version treats tubes in areas of unique operating appears to be increasingly -prevalent in B&W conditions or physical construction separately steam generators is localized wall thinning, and it from the randomly selected tube samples.

is believed to be an impingement or erosion phe Specifically, tubes within three rows of the open nomenon. This phenomenon has been observed at inspection lane, where fatigue cracks have support plates, particularly the 14th support plate, occurred in the Oconee units, and tubes that pass and has caused at least three leaks at Oconee Unit through drilled holes in the 15th support plate

1. This phenomenon appears to be associated rather than the broached openings, are subject to 13-2 Rev 0896 USNRC USNRC Technical Training Center Technical Training Center 13-2 ý Rev 0896

flI,? M~uC.necr~

nuidOTSG ~Cnnr~ In-Service Insnection 100 percent inspection. This form of inspection primary-4o-'secondaryleakage less than this limit therefore distinguishes between random and during operation will have an adequate margin of deterministic forms of -'degradation. 'Similar safety to'withstand the loads imposed during technical specifications are under review for other normal operation and by postulated accidents.

"B&Wunits, including the Oconee units. Operating plants have demonstrated that primary "to-secondary leakage of one gpm can be' detected At present, the SG Tube Surveillanices for by monitoring the secondary coolant. Leakage in "nuclear -power plants require ithat inservice excess of this limit -will require plant shutdown "and an unscheduled inspection, during which the inspections be performed every 12 to 40 months, depending on the condition of the steain genera leaking tubes will ,be located and plugged.-

tors. In cases where ihe degradatiori processes are

'-highly active, the -NRC has required that the . Wastage-type defects are unlikely with proper inspections be performed at even more frequent chemistry treatment of the 'secondary coolant.

'intervals.' However,, even if a defect should develop in service, it will be found during scheduled 13.2.1 SG Tube Surveillance Basis inservice steam generator tube examinations.

Plugging ,will be required for all tubes with The Surveillance Requirements for inspection imperfections exceeding the plugging limit (40%

"ofthe 'steam generator tubes ensure' that the of the ,nominal tube; wall thickness). - Steam structural integrity of this portion of the RCS will generator tube inspections of operating plants be maintained. The program for inservice inspec have demonstrated the capability to reliably detect tion of steam generator tubes is based on a degradation that has penetrated to or beyond 20%

modification of Regulatory Guide 1.83, Revision of the original tube wall thickness.,

1: Inservice inspection of steam generator tubing

'is essential in order to maintain surveillance of the 13.2.2 Eddy Current Testing conditions of the tubes in the event that there is evidence of mechanical'damage or progressive Eddy current testing is the primary means for degradation due to design, manufacturing errors, performing tube inspections. This inspection or inservice conditions that lead to corrosion., method involves the insertion of a test coil inside Inservice inspection of steam generator tubing the tube that traverses its length. The test coil is also provides a means of characterizing the nature then excited by alternating current, which creates and cause of any tube degiadation so that correc "a magnetic'field that induces eddy currents in the tive nieasures can be taken. tube wall.- Disturbances of .the eddy currents caused by flaws'in'the tube wall will produce The plant is expected to be 'operated in a.- 'orresponding changes in the electrical impedance manner such that the secondary coolant will be, '- as seen at the test coil terminals. Instruments are maintained within those chemistry limits'found to" ,used to translate these changes in test coil result in negligible corrosion of the steam genera-- impedance into output voltages which' can be tor tubes. If the'secondary coolant chemistry is monitored by the test operator.. The depth of the not maintained within these 'limits, 'localized flaw can be determined by the observed phase corrosion may likely-result in stress -corrosion angle response. The test equipment is calibrated cracking. The extent of cracking during plant using tube specimens containing artificially operation would be limited by the I-gpm limit on induced flaws of known depth.

primary-to-secondary leakage. Cracks resulting in USNRC Technical Training Center 13-3 ' Rev 0896

-1 B&W Crosstraining Course Manual OTSG In-Service Inspection IGeometric discontinuities along the tube 13.3 Tube Repairs length, such as tubesheets, tube support plates, and dents, also produce eddy current signals, 13.3.1 Tube Plugging which make discriminating defect signals at these locations difficult. The recent development of The plugging limit is established in multifrequency eddy current techniques (whereby accordance with criteria in Regulatory Guide the test coil is excited at multiple frequencies 1.121, "Basis for Plugging Degraded PWR Steam rather than at a single frequency) has substantially Generator Tubes." B&W has conducted burst and enhanced operator capabilities to detect relatively collapse tests on steam generator tubes with small-volume flaws in the presence of extraneous simulated defects, to establish the extent of signals. "allowable" tube degradation. Specimens tested included undamaged tubes and tubes with varying Very small volume flaws, such as those depths of longitudinal slits, circumferential slits, caused by intergranular attack, stress corrosion, uniform thinning, and long, flat defects on tube fatigue cracks, and small pits, have traditionally outer surfaces. The burst and collapse tests were been hard to detect with the single-frequency eddy run at normal, operating temperature. Based on current test method. The use of multi-frequency the burst and collapse test data and on calculations techniques and specialized, nonstandard probes performed in accordance-with Regulatory Guide has improved detection capabilities in this regard. 1.121, B&W has calculated the maximum defect However, further improvements are necessary and depths allowable under normal operating or are the subject of much ongoing effort by the accident conditions.

nuclear industry and through NRC-sponsored research programs. Including a margin for continued degradation between inspections and for error in eddy current For the present, the staff concludes that small testing, the plugging limit for B&W steam flaws of structural significance are generally generator tubes has been conservatively estab detectable. If such flaws go undetected and result lished as 40 percent. This tube plugging criterion in leaks, the initial leakage will generally be small assures that tubes will not become degraded to the and of little consequence, a conclusion confirmed extent that they could fail during postulated by operating experience. The restrictive leakage accident conditions prior to the next inservice rate limits in the plant Technical Specifications inspection., The plugging repair technique provide assurance that the unit will be shut down involves the installation of plugs at the-tube inlet in a timely manner for the appropriate corrective and outlet. After plugging, the tube no longer action. If necessary, preventive repairs, more functions as the boundary between the primary restrictive limits on primary-to-secondary leakage, and secondary coolant systems.

hydrotesting of the tube bundle, and corrective measures to retard the rate of further corrosion are 13.3.2 Sleeving additional steps which can be taken to provide added assurance of safe operation. When tubes are severely degraded, often large numbers of them must be removed from service by plugging to ensure the generator's safe operation. Plugging steam generator tubes results Sin a loss of heat' transfer surface and can eventually necessitate a reduction in power levels.

13-4 Rev 0896 Training Center Technical Training USNRC Technical Center 13-4 Rev 0896

S OTSG In-Service lnsnection n~eW -rnvcfcraunvna Couurse Mianual TS nSrvc nseto To prolong the life of severely degraded steam "sleeves af the'Oconee units 'are being performed generator tubes, ,some utilities, with prior NRC during each inservice inspection.

approval, have elected to repair them by sleeving. - I, Sleeving not only decreases the plant downtime 13.4 Long Term Corrective Actions but also leaves the repaired tubes functional.

II ,,I 13.4.1 Design Changes The tube sleeving procedure involves inserting a tube of smaller diameter (or sleeve) inside the. - B&W has modified its existing designs in an tube to be repaired. The sleeve is positioned to ,attempt to eliminate the known mode of degrada span the degraded portion of the original tube and tion. For example, to reduce tube failures at the is then 'either, hydraulically or mechanically upper tubesheet along the inspection lane, B&W expanded above and below the degraded region. has recommended that operating plants install five

-The expanded joints are sometimes brazed to, lane blockers, Figure 13-1, between the 7th and ensure additional leak tightness. J14th tube support plates to minimize the potential for moisture to enter the upper levels of the steam Sleeving has been used for two different generator along the inspection lane during normal purposes: (1) to repair degraded tubes as an operations. The installation of blockers, coupled alternative to plugging and (2) to stiffen the tubes with strict attention to secondary plant operations, so as to alter their natural frequency in an effort to should minimize the occurrence of this form of eliminate or reduce flow-induced vibration. degradation.

Sleeving repairs to restore primary coolant Another area of improved design concentrates boundary integrity have been performed, to date, on the selection of more corrosion-resistant on tubing degraded by wastage, intergranular ,materials in the condenser. Water leaking through attack, and stress corrosion cracking. the failed condenser tubing, when combined with air, can contaminate the condensate, feedwater, The tube sleeves intended to stiffen the tubes, steam generator water, and steam. This contami thereby reducing dynamic stresses resulting from nation in turn degrades the structural integrity of flow-induced vibration, vary in length from the steam generator tubes, turbine, and- other

.. approximately 1 foot to 1-1/2 feet and are secured components in the cooling system. The utilities

-.-.. inside the generator tube by two expanded are reducing the amount of ammonia-sensitive regions. One or more sleeves can be installed in ,alloys from the condensers and replacing them

,a given tube to achieve the desired vibration with more corrosion-resistant alloy tubing.

characteristics. The sleeves are not intended to perform as part of the primary coolant system 413.4.2 Water Chemistry Control boundary and are not used for repairing degraded tubes. The tube sleeves were qualified analytical The Babcock and Wilcox 'recommends all ly and experimentally, and demonstration pro volatile treatment (AVT). for steam generator grams involving installation of a small number of water chemistry control. AVT consists of the tube sleeves were approved by, the NRC for the addition of hydrazine (N2H4) to the condensate Oconee units and Three Mile Island Unit 2. No water for the purpose of scavenging oxygen.

inservice inspection of the steam generators was Excess hydrazine (that amount stoichiometrically performed at Three Mile Island Unit 2 prior to the in excess of dissolved oxygen) thermally decom March 28, 1979, accident. Inspection of the tube poses to ammonia at,,steam generator operating 13-5 Key USYO USNRC Technical Training Center Technical Training Center 113-5 RKev 0896

I-B&W Crosstrainine Course Manual - OTSG In-Servici* Inspection B&rssrii~C ureM nulO S ........... insn ......

temperatures, which will provide for pH control to with the OTSG design. During low-power reduce carbon steel corrosion. If the thermal operations, the lower portion of the OTSG has decomposition of hydrazine to ammonia does not internal recirculation, which tends to concentrate sufficiently raise the pH, additional tanks and feedwater impurities (similar to the normal pumps are utilized so that other nonsolid additives concentration mechanism in U-tube steam gener such as ammonium hydroxide, morpholine, or ators). Therefore, blowdown is necessary during cyclohexamine can be added. These additives act low-power operation to mitigate the effects of t6 increase the pH throughout the entire concentrating these impurities. However, when condensate and feedwater system, steam genera the OTSG starts producing superheated steam, the tors, and steam cycle to reduce corrosion of internal recirculation and concurrent concentration carbon steel components thrbughout the secondary of feedwater impurities stops. Without this system. Extensive experience in both the fossil concentration, of, impurities, blowdown then and nuclear industries has demonstrated the becomes simply a discharge of feedwater, which benefits of these additives for secondary cycle is an inefficient method for removing impurities.

corrosion control in electric power generating The production of impurities, for the most part, is plants. enhanced by the following:

The primary advantage of AVT is that no dis 1. Condenser water inleakage is the most solved solid additives are used (such as phos significant contributor to steam generator phates) which can concentrate in' the steam corrosion problems for plants with AVT.

generators to induce corrosion, such as phosphate Improved condenser designs, materials, leak wastage of Inconel-600 tubing. The disadvantage detection procedures, and repair procedures of AVT is that it provides no buffering capacity to are recommended. Items to be considered mitigate the effects of impurities in the cooling include improved condenser tubes, double water introduced through condenser leakage or tube sheets, and welded tube/tubesheetjoints.

corrosion products. Thus, when condenser leakage occurs, the resultant impurities can enter 2. Excessive condenser air ingress is the primary the steam generators and cause severe changes in contributor to condensate and feedwater the pH, with resultant increases in corrosion rates. system corrosion. Excessive corrosion of the condensate and feedwater system can result in B&W recommends continuous full-flow corrosion product buildup in the steam condensate polishing at all times, and blowdown generators and concurrent concentration of only during startup, before a power level sufficient condenser cooling water impurities to form to produce superheated steam is reached. Both sludge, which enhances corrosion in the steam recommendations are prudent for the once generators.

through superheating steam generator (OTSG) design. Continuous full-flow condensate polish 3. Copper alloys should be eliminated from all ing is necessary to minimize the possibility of areas of the condensate/feedwater/steam cycle.

hardened salts (from, condenser inleakage) Substantial evidence exists that copper oxides enteiing the steam generator's, where, because of in the steam generators are an important their low solubility 'as the steam becomes catalyst in accelerating the rate of corrosion superheated, the salts will deposit on heat-transfer processes within steam generators.

surfaces, thus reducing 'efficiency. The use of blowdown during startup only is also consistent 13-6 Rev 0896 Training Center Technical Training USNRC Technical Center 13-6 Rev 0896

OTSG In-Service Inspection B&W Crosstrainin. Course Manual 13.5 , References

1. NUREG-0571, "Summary of Tube Integrity Operating Experience with Once-Through Steam Generators," March 1980.

2. NUREG-0886, "Steam Generator Tube Experience," February 1982.

3. Nuclear Power Experience Manual, Vol.

PWR-2, Reactor Coolant System - Steam Generators.

13-7 Rev WSYb Technical Training USNRC Technical Center Training Center 13-7 - Rev 0896

B&W Crosstraining Co-urse Manual TABLE 13-1 OPERATING EXPERIENCE WITH BABCOCK AND WILCOX ONCE-THROUGH STEAM GENERATORS THROUGH NOVEMBER 1981 Plant name OL Fatigue Erosion/ No. of, No. of tubes Sleeves Issuance crackin corrosio leaking tubes plugged installed date g n Oconee 1 2/73 X X 11 311 (2%) 16 Oconee 2 10/73 X X 3 30 (<1%)

Oconee 3 7/74 X X 5 101 (<1%)

Arkansas 1 5/74 X 3 13 (<1%)

Rancho Seco 1 8/74 X X 1 15 (<1%)

Three Mile Island 4/74 X 0 19 (<1%)

1 12/76 X 0 32 Crystal River 3 4/77 X 2 13 (<1%)

Davis Besse 1 13-8 Rev 0896 USNRC Training Center Technical Training USNRC Technical Center 13-8 Rev 0896

DRY STEAM RE-ENTERING LANE Figure 13-1 Inspection Lane Flow Blocker

BABCOCK AND WILCOX CROSS TRAINING MANUAL CHAPTER 14 Oconee Tube Leak

I -_______

B&W Crosstraining Course Manual Oeonee Tube 1leak TABLE OF CONTENTS 14.0 OCONEE-2 STEAM GENERATOR TUBE LEAKAGE 14.1 Initiation of the Leak .................................................. 14-1 14.2 Shutdown and Leak Isolation ........................................... 14-1 14.3 Plant Cooldown ...................................................... 14-2 14.4 Turbine Building Flooding and Decontamination ........................... 14-3 Appendix - Sequence of Events .................................................. 14-4 LIST OF FIGURES 14-1 Pressures and OTSG Levels 14-2 System Temperatures 14-3 Oconee-2 Main Steam System 14-4 Oconee-2 Condensate and Feed System 14-i Rev 0896 USNRC Training Center Technical Training USNRC Technical Center 14-i Rev 0896

Oconee Tube Leak RBtW Crosstraininp Course Manual Ooe ueLa

-14.0 OCONEE-2 STEAM, GENERATOR guidance for identifying the leaking steam gener TUBE LEAKAGE ator and criteria for shutting down and isolating the plant. 1 I-Learning Objectives:

At 4200, the turbine building and Powdex

1. List the symptoms'of a steam generator tube "-sump pumps were secured to avoid unplanned leak. release of potentially contaminated water in the sumps. By 1420, potentially contaminated drains "2. -Describe the actions that should be taken if the were rerouted fromn the turbine building sump to tube leakage exceeds technical specification the hotwell pump sump in order to minimize the limits spread of contamination.

3. .Lit(thiee actions that can be taken to mini At 1300, radiation measurements on the "A" "mizeoffsite releases during'steam generator and "B", main steam lines showed no detectable tube leakage events. difference. However, by 1350, measurements on the "B" line had increased to 0.02 mR/hr above 14.1, 'Initiation of the Leak background, while the "A" line remained at background.

On September 18, 1981, Oconee Unit 2 was in the power escalation phase of a mid- cycle restart At 1529, 2RIA-40 went off-scale-high and adfter a short-term outage. At 1010, the power, 2RIA-17 (main steam line "B" radiation monitor) increase was stopped at approximately 94 percent 'increased to about 5 mR/hr. This indicated that the power to calibrate nuclear instrumentation. The ,leak had suddenly increased and that it was in the

• RCS was at 2150 psig and 579°F(Tave) ""B" steam generator. The leak was calculated to be about 25 gpm based on a grab sample from the At 0930, the plant staff noted that the reading CSAE: An "Unusual Event" was declared, and on the condenser off-gas monitor, 2RIA-40, was :appropriate NRC, corporate, and local civil au increasing from the normal 3,000 cpm that had thorities were notified.

'been indicated at 0800: By 1145, the condenser

'offgas monitor had increased to 40,000 cpm.,The 14.2 Shutdown and Leak Isolation primary-to-secondary leak rate was calculated to be'0.03 gpm, based on grab samplesfrom the Immediately following the sudden increase in condensate steam air ejector' (CSAE). 'Shortly leak--rate, a rapid plant shutdown using-normal thereafter, the 6perators initiated corrective ac procedures was initiated. The shutdown followed tions in accordance with procedure *,procedure OP/2/A/ 1102/10, "Controlling Proce OP/O/A/1106/31, "Control of Secondary dure for Unit Shutdown." The leak rate was Containinati6n." This procedure provides three calculated as 25 gpm; and the event was classified functions when primary-to-secondary leakage is as a major tube leak rather than as a tube rupture.

suspected: (1)it minimizes radioactive discharges Consequently,, procedure . EP/O/A/1800/17, from the secondary system to the turbine building "Steam Generator Tube Rupture," was not fol sumps, (2) it controls any contaminated water that lowed,' although it, was occasionally. used for does accumulate in the turbine building by termi general guidance. Reactor power was reduced at "natingall automatic discharges, and (3) it provides a rate of approximately 3 percent/minute (coin-Cnte Tehnicl Tainng 14- Ke U7 USNRC Technical Training USNR Center :o:*14-1 KeY 0890

B&W Crosstraining Course Manual Oconee Tube Leak B&W Crosstraining Course Manual Oconee Tube Leak pared to a normal shutdown rate of about 10 Shortly after the reactor was shut down, both percent/hour.) The reactor was subcritical ap SG levels decreased, to about 25 inches on the proximately one hour after the high leak rate start-up range (about 29 inches above the lower commenced. The electrical generator was taken tubesheet). The "A" steam generator remained at off line when the power level fell to 15 percent. this level; at 1718, the last running main Initially, the turbine bypass valves were opened to feedwater pump (2A) was manually tripped, and maintain steam pressure below the steam safety the condensate booster pumps were used to supply relief valve setpoints. Main feedwater pump "B" water to the "A" steam generator. At 1745, the was manually tripped at 1622, and the "B" steam "B" steam generator level began to rise at about generator feedwater and turbine bypass valves 0.4 percent/minute. This corresponded, to a net were closed at 1632, when "B" main steam pres water addition rate of about 50 gpm and included sure was about 840 psig. Other valves were also the tube leak and the effects of feedwater in closed so that by 1745 the "B" steam generator leakage and steam out- leakage. At 2200, as the was essentially isolated except for minor leakage level in the "B" steam generator approached 90 paths. percent on the operating range, a reactor building entry was made and the bottom drains on the "B" 14.3 Plant Cooldown steam generatorwere opened in order to drain the SG to the main condenser hotwell through the hot With action having been taken to isolate the blowdown lines. This was done to prevent filling "B" steam generator, cooldown was continued the main steam lines with water. As far as can be using the "A" steam generator. At about this time determined, this periodic draining of the steam (1627), an additional high pressure injection (HPI) generator did prevent overflow of water into the pump was started to make upý for cooldown steam lines, although the level exceeded the upper "shrink" and continued leakage. The reactor was limit of the operating range on the level initially cooled down and depressurized from instrumentation.

1627 until about 2300 on September 18. Pressure in both SGs was decreased within normal shut From about 1930 until 2230 on September 18, down limits from an initial value of about 890 the RCS pressure was held steady at about 540 psig to 40 psig at 2100. Following actions to psig. The reason for holding pressure rather than isolate the "B" steam generator, its pressure was continuing to lower it may have been related to nearly the same as the saturation pressure corre certain activities that were taking place during that sponding to the primary temperature (TJ)after time, such as setting the valve line-up for the Low 1745, as shown in Figures 14-1 and 14-2. Range Reactor Coolant System Pressure indicator.

By 2300, the RCS pressure had been lowered to Figure 14-2 also shows that the temperatures 300 psig.

in both steam lines remained higher than the saturation temperature of the liquid in the steam At approximately 0800 on September 19, the generators throughout the cooldown. Since RCS reached the conditions specified in Oconee superabov'e the reactor coolant temperature could operating procedures (<250°F, <350 psig) for

'not have existed, these temperature lags are initiating decay heat removal via the LPI system.

evidently caused by the slower cooling of the metal in the steam lines where the steam tempera At about 0900, an attempt was made to open ture detectors were located. the LPI suction valves from the reactor coolant 14-2 Rev 0896 Center Technical Training Center USNRC Technical 14-2 Rev 0896

Oconee Tube Leak ny~w Cr-ectrainino Coiurse ManualIOoneTbeLa system (2LP-1 and 2LP-2):Valve 2LP-2 failed to At about 1200 on September 19, the circuit open electrically both from the control panel and breakers for the feedwater pump (FDWP) seal from the circuit breaker. Three reactor building injection sump pumps tripped due to a breaker entries were made from 1100 on September 19 malfunction. While these were being repaired, the through 0400 on September 20 in an attempt to sumps overflowed to the turbine building sumps.

open the valve manually. During those three Since radioactive water from the "'B" steam entries, the valve operator was manually moved generator was being drained to the hotwell at this 3/4 turn, 3/4 turn, and 2 turns respectively. After time, the FDWP seal injection water was each entry, the plant staff tried to open the valve contaminated and resulted in contamination of the electrically from the breaker. These efforts were water in the turbine building sumps. At 0930 on unsuccessful because the valve stem had been September 20 the CSToverflowed to the turbine deformed. At 0400 on September 20, the valve building sumps again. The cause of the overflow was opened by removing the operator and may have been related to restarting the FDWP seal "jacking" the valve open using manual hoists injection sump pumps or to manual hotwell level (come-alongs). control in preparation. for breaking main condenser vacuum.

By 0647 on September 20, the LPI system line-up was complete, and decay heat removal was Cleanup of contaminated water required initiated, having been delayed about 21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br />. temporary large-scale water processing. Demin Cooldown and depressurization of the RCS eralizers, pumps, hoses, and fittings were resumed, and at 0430 on September 21, the .acquired. By the afternoon of September 19, 1981, operators began pumping down the RCS loops. normal leakoff from all three units was being The tube leak was terminated at 0615 on Septem processed' by' portable demineralizers. The ber 21, 1981. processed water was routed along with Unit 3's turbine building sump to the-upper settling basin.

14.4 Turbine Building Flooding and Between September, 19 and September 24, a Decontamination temporary discharge line was installed between the CST pumps 'and the'normal plant discharge As described earlier (Section 14.1), the turbine line, which included RIAs 33 and 34.Thie Unit 2 building sumps were isolated shortly after initial and Unit I CSTs ,were used as holding tanks tube leak determination on September 19,1981, in where processed, demineralized water was stored accordance with procedure OP/O/A/1106/31. for sampling prior to release to Keowee tailrace.

Normal leakoff from both Units 2 and 3 was This method was generally'used until the Units 1 flowing to the sumps from such things as valves, and 2 turbine building sump was put back on flanges, and drains. Thus, a considerable amount batch release. Including water used for decon of initially uncontaminated water flowed to the tamination purposes, an estimated 2.5 million sumps. (Unit 1 was shut down and did not gallons of contaminated water was processed. The contribute to the water inventory in the sumps.) At entire cleanup process required about six weeks.

about 1700 on September 18, the CST overflowed to the turbine building trenches. This occurred following system alignment for entering the feedwater cleanup mode.

14-3 Key UJO USNRC Technical Training Center Center 14-3 -. - Rev 0896Y

Oconee Tube Leak 1l&W Crosstrainin0 Couirse Malnual Oconee Tube Leak APPENDIX - SEQUENCE OF EVENTS 9/17/81 0000 - Plant condition 2150 psig and 535TF

- Deboration in progress 0543 - Reactor critical

- increasing power 1600 - Reactor power - 60%

9/18/81 0800 - Reactor power 87.5%, increasing

- Condenser off-gas monitor 2RIA-40 reads 3000 cpm (normal) 0930 - 2RIA-40: increasing 1030 - 2RIA-40: 10,000 cpm 1145 - 2RIA-40: 40,000 cpm

- Condensate steam air ejector (CSAE) grab sample indicates primary-to-secondary leak of 0.03 gpm 1200 - Initiated "Control of Secondary Contamination" procedure, OP/O/A/1 106/31.

- Stopped turbine and powdex sump pumps 1300 - Radiation measurements of"A" and "B" main steam lines show no detectable'difference 1319 - 2RIA-40 grab samp!e: 425x0-4 mCi/ml gaseous activity 1350 - Radiation measurements of main steam lines "A" are background: "B" lines are 0.02 mRhr 'above background 1420 - Completed rerouting potentially radioactive drains from the turbine building sump to the hotwell pump sump 1529 - 2RIA-40: off-scale high

- Main steam line "B" radiation monitor 2RIA- 17 indicates 5 mR/hr

- Leak determined to be in "B" steam generator

- Commenced reactor shutdown 1543 - Declared "Unusual Event" since tube leak calculated to be approximately 25 gpm

- Notified authorities 1558 - Generator off line 1622 - Main feedwater pump "B" manually tripped 1627 - Reactor subcritical

- Cooling down RCS

- Started additional HPI pump to keep up with "shrink" and leak 1632 - Closed SG "2B" feedwater and turbine bypass valves 1640 - RCPs 2A2 and 2B2 shutdown 1655 - All CRDs inserted 1700 - Condensate storage tank overflows to turbine building trenches USNRC Technical Training Center USNRC Rev 0896 Center 14-4 Training Technical Rev 0896

B&W Crosstraining Course Manual Oconee Tube Leak SEQUENCE OF EVENTS (continued) 1718 - Main feedwater pump "A" manually tripped 1750 - 2B OTSG level increasing; 2A OTSG level at 25" 1800 - 2B OTSG level is increasing 1900 - 2B OTSG leVel is 40% (operating range) 2100 - -Made reactor building (RB) entry to line up pressurizer auxiliary spray 2200 - Opened bottom drains on 2B OTSG and started drain back to hotwell through blowdown lines 9/19/81 0000 - RCS at 286-F, 300 psig

- SG "B" pressure is 35 psig 0900 - 2LP-2 ( LPI suction from RCS ) would not open electrically 1100 - Made three RB entries to try to open 2LP-2 manually 1300 - Reactor building purge on 2045 - RCS gross activity 6.4x10"' mCi/mi 9/20/81 0400 - 2LP-2 opened manually by maintenance personnel 0647 - Started LPI pump 2A (Decay Heat Removal) 0714 - Secured 2A1 RCP 0930 - CST overflowed to trenches 1000 - Broke vacuum on main condenser 9/21/81 0430 - Started pumping down RCS loops 0615 - Leak stopped 14-5 Rev 0896 USNRC Technical Center Technical Training Center 14-5 Rev 0896

2400 Legend:

2200

- A RCS Press.

Pst for T.

2000 I-SG "B" Press.

SG "A" Press.

SG "B" Level 18001- SG "A" Level

_/ 'WI Psal for 50°F Subcooling 1600 1'

1400 l- L

• 1 rl)

U) 1200 -- I a) 0..

\

100 1000 10 I 1/

80 800 Ca 60 600 CL6 II 0 / \A 0 40 /

400 /

/

-J K

20 200 I-1...

1500 1500 1600 1700 1800 1900 2000 2100 2200 2300 2400 Clock Time (9/18/81)

Figure 14-1 Pressures and OTSG Levels

"1"1

-n CD

_A S400

-.I CD I.-

CD 3

"a CD cn 200' 1500 1600 1700 1800 1900 2000 2100 2200 2300 2400

Steam To HP Generator Stop Valve Turbine A E Turbine E

Valve Turbine Bypass 41 To Condenser 0 Feedwater Emergency 0

,= Pump Feed Pump (D

(D Turbines Turbine ci, 3

U)

Turbine E (D

3 Bypass E Valve Steam Turbine To HP Generator Stop Valve Turbine B

"Safety Valves

-n C:

0 0

CD CD r'3 0

0.

CD CD CL CD CD C',

BABCOCK AND WILCOX CROSS TRAINING MANUAL CHAPTER 15 Rancho Seco Loss of ICS Power

B&W Crosstraining Course Manual Rancho Seco Loss of ICS Power TABLE OF CONTENTS 15.0 RANCHO SECO LOSS OF ICS POWER 15.1 Introduction ......................................................... 15-1 15.1.1 ICS Power Supplies ............................................... 15-1 15.1.2 M ain Steam System ............................................... 15-1 15.1.3 M ain Feedwater System ............................................ 15-2 15.1.4 Auxiliary Feedwater System ......................................... 15-2 15.1.5 High-Pressure Injection System ...................................... 15-2 15.2 Loss of ICS DC Power ............... ................................ 15-2 15.2.1 Initial Conditions ................................................. 15-2 15.2.2 Initiating Event ................................................... 15-2 15.2.3 RCS Overcooling ................................................ 15-3 15.2.4 Safety Features Actuation System(SFAS) Actuation ...................... 15-3 15.2.5 Partial RCS Repressurization ........................................ 15-4 15.2.6 Restoration of ICS dc Power and Plant Stabilization ...................... 15-6 15.3 M ajor Issues ........................................................ 15-9 15.3.1 ICS Power Failure ................................................. 15-9 15.3.2 M akeup Pump Failure .............................................. 15-9 15.3.3 RCS Overcooling ................................................ 15-10 15.3.4 PRA Insights .................................................... 15-11 15.4 References ........................................ ................ 15-11 Appendix - Sequence of Events ................................................. 15-12 LIST OF FIGURES 15-1 ICS Power Supplies 15-2 Main Steam System 15-3 Main Feedwater System 15-4 Auxiliary Feedwater System 15-5 High-Pressure Injection System 15-i Rev 0896 USNRC Technical USNRC Training Center Technical Training Center 15-i Rev 0896

-g,BW Crosstrainino Course Manual S Rancho Seco Loss of ICS Power RRWCrqtrii~,CureMaulRaco eo osofIS oe 15.0 RANCHO SECO LOSS OEICS .15.1.1 ICS Power Supplies POWER As shown in Figure 15-1, there are redundant

.-Learning Objectives: 120-vac supplies to the ICS.- One of the supply sources is from a 120-vac vital bus, and the sec "1.Describe the symptoms of an overcooling ond supply is a non-vital 120-vac bus. Each of the transient. 120-vac sources supplies positive and negative 24-vdc power supplies through switches S I and

2. Explain how the loss of power to the ICS S2. The +24-vdc power supplies and the vdc control stations resulted in: power supplies are auctioneered, and the highest voltage provides power to the ICS buses. A a.' An overheating event and power supply monitor is installed and monitors

b. -A subsequent overcooling event' the output of each power supply as well as the auctioneered output. Because of the inability to

3. Describe the effect of operating a multi-stage predict the response of the ICS under degraded centrifugal pump without a suction source. voltage situations,-the power supply monitor will open switches S I and S2 if any monitored voltage 15.1 Introduction drops to 22 vdc.

On December 26, 1985, Rancho Seco experi Internally, the ICS will convert the +/- 24 vdc enced a loss of ICS power causing a reactor trip to a -10 to +10 Vdc that is used by the system.

and rapid cooldown of the reactor coolant system. When this signal is sent to the control valves, the This incident was not the first time Rancho Seco v demand represents a fully closed signal; the had experienced problems with its ICS power ,+10-v, signal represents a fully open signal; the supplies. A reactor trip and excessive plant zero signal will position the valve to 50% open.

cooldown occurred on January 5, 1979, resulting The valves of interest in this transient are:

from a personnel error that caused a ground fault in the ICS DC power supplies. The plant response 1. Atmospheric dump valves (ADVs),

to the 1979 event was almost identical to the 2. Turbine bypass valves (TBVs)

December 26, 1985 event; On March 20, 1978, a 3. Main feedwater valves, reactor trip and excessive plant cooldown oc "4. Auxiliary feedwater valves curred resulting from a ,light bulb--;from a backlighted push button being dropped into the The main feedwater pump turbine speed is socket grounding the NNI DC power: A complete also controlled by the ICS. In this control circuit, of loss of NNI DC power resulted. This is referred - a 0- to +10-v signal is used. The signal range to maxi to as the "light bulb" incident and is considered. 3.4 to 7.3 v corresponds to the minimum the most,, severe overcooling transient to ever mum range of feed pump speeds.

occur at Rancho Seco and is referenced in several vendor, licensee, and regulatory documents. -15.1.2 Main Steam System Although ICS power was not lost during the "light Sbulb" incident, the design of the power supplies is The main steam system (Figure 15-2) supplies virtually identical. A brief description of Rancho steam from the once-through steam generators Seco system differences follows. (OTSGs) to the turbine-generator, the turbine

- Iixv uou nOnE 15-1 Center Training Center ° 15-1 I Re.tv 0876

- USNRC USNRC Technical Technical Training

I___________

B&W Crosstrainin* Course Manual I Rancho Seco Loss nfICS Power driven main feedwater pumps, the dual drive 15.1.5 High-Pressure Injection System auxiliary feedwater pump, and other plant auxil iary systems. Three atmospheric dump valves The high-pressure injection system (Figure 15 (ADV) and two turbine bypass valves (TBV) are 5) is typical of the 177 FA high-pressure injection installed on each header to remove excess reactor (HPI) systems. As shown, the pumps normally coolant system energy during a turbine trip or load receive a suction from the makeup tank and rejection. The valves have a total capacity of 50 discharge to an RCS cold leg via the makeup flow percent, with equal amounts of heat removal control valve. If an emergency core cooling capacity available by dumping steam to the atmo actuation signal is received, the following changes sphere or bypassing steam to the condenser. will occur in the system:

These valves are controlled by the ICS. Rancho Seco normally operates with four of the six ADVs 1. The makeup tank outlet valve closes.

manually isolated to prevent overcooling follow 2. The borated water storage tank suction ing a reactor trip. valves open.

3. The four HPI motor operated valves open.

15.1.3 Main Feedwater System 4. The HPI recirculation isolation valves close.

The discharge of the turbine driven main feedwater pumps (Figure 15-3) is routed to the 15.2 Loss of ICS DC Power OTSGs via high-pressure feedwater heaters, startup feedwater regulating valces, and the main 15.2.1 Initial Conditions feedwater regulating valves and their associated block valves. As previously stated, the main The plant had been returned to power follow feedwater pump speed, the startup regulating ing a two-day outage for repairs. Power had been valves, and the main feedwater regulating valves escalated to 76% (712 Mwe) and stabilized. RCS are controlled by the ICS. T.,e was at its normal value of 582°F, and system pressure was 2150 psig. The pressurizer level was 15.1.4 Auxiliary Feedwater System at its normal value of 220 inches.

The auxiliary feedwater (AFW) system is 15.2.2 Initiating Event shown in Figure 15-4 and consists of redundant pumps and flowpaths to each steam generator. The loss of ICS dc power was caused by a One of the two pumps is 'motor driven, and the failure of the powerisupply monitor which opened othei"pump is dual driven. The dual driven pump switches SI and S2 (Figure, 15-1). The loss of is powered by a turbine on one end'of the pump input power resulted in a zero voltage on the +/

shaft and a motor on the other end. The pumps 24-vdc busses in the ICS. At zero volts, the main normally receive a suction from the condensate feedwater regulating valves and the startup regu storage tank (CST). Auxiliary feedwater flow to lating valves assumed a 50% open position. Since the steam generators'is' controlled- by parallel voltage was lost, the main feedwater pumps valves in each supply line. One of the two valves dropped to minimum speed. With the reactor at receives a signal from the ICS, and the second 76% power and almost no feedwater flow to the valve receives a signal from the safety features once-through steam generators for RCS heat actuation system (SFAS). removal, an overheating event started even though 15-2 Rev 0896 USNRC Training Center Technical Training USNRC Technical Center 15-2 Rev 0896

, Rancho Seco Loss oflICS Power B&W Crosstraining Course ManualRacoSoLosfICPoe the turbine bypass and atmospheric dump valves valves from the remote shutdown panel. How were 50% open due to the loss of ICS power.. ever, they over-looked that method.

.With reduced heat removal, the reactor's energy causes an increase in RCS temperatures. The Operators in the control room noticed increase in temperatures results in an increase in pressurizer level decreasing and fully opened the

-,pressurizer' pressure and pressure level. , The "A" high-pressure injection valve for more "pressurizerspray valve was manually opened in an makeup flow to the RCS. The makeup tank level effort to lower RCS pressure. began to rapidly decrease, and the operators opened the-BWST suction valve to the makeup

.15.2.3 RCS Overcooling pumps and started the "B" HPI pump.

Due to the net undercooling, the reactor "Believing that- significant main feedwater tripped on high RCS pressure sixteen seconds (MFW) flow (chart recorder also failed to mid "after the loss of ICS power. The RCS pressure scale) existed, the operators tripped both MFW

• peaked about one second later at a value of 2298 pumps. The AFW system was supplying about psig: Several of the steam generator safety valves 1000 gpm to each steam generator at this time.

lifted and then reseated. The reactor trip signal With failed steam valves and excessive auxiliary "alsotripped the turbine generator. The operators feedwater flow, the RCS pressure and temperature closed the pressurizer spray valve when the reac continued to decrease.

tor tripped, in anticipation of RCS cooldown and depressurization. With the reactor at decay heat 15.2.4 Safety Features Actuation levels, and a heat removal capacity of greater than System(SFAS) Actuation 25% due to the half-open TBVs and ADVs, an overcooling transient began. In a little less than three minutes, after the reactor trip, RCS pressure decreased from 2298 Both AFW pumps actuated about the time the psig to the SFAS actuation setpoint of 1.600 psig, "reactortripped due to the low MFW pump dis and pressurizer level had decreased from 220 in.

charge pressure. These pumps began to supply to 15 in. The actuation signal opened all four HPI AFW flow to both steam generators through the motor operated valves and placed a second make half open AFW (ICS controlled) flow control up pump in service. Also, the makeup tank outlet "valves. ,valve and the pump recirculation valves were closed. Selected emergency equipment, including The operators recognized that power had been the motor driven AFW pump, were automatically lost to the ICS about two minutes after the reactor shed from the vital buses and sequence loading of trip, but they did not initially understand the plant "SFAS equipment began. The AFW (SFAS) response to this loss of power. The operators also valves came fully open. Even with full high Srecognized the 'beginning of an overcooling pressure injection flow, RCS pressure continued

. transient due to the 50% demand to the TBVs,*

to decrease.

"ADVs,arid the AFW valves. Realizing that these components could .not be operated from the The control room operators, recognizing that control room due to the loss of power, equipment the AFW flow was excessive, initiated an override

-operators were dispatched to close manual isola of the SFAS signals to the AFW (SFAS) valves "tionvalves. The operators could have closed the and closed them. However, the AFW (ICS) flow 15-3 Rev W9b USNRC Technical Center Technical Training Center =15-3 ÷td Rev 0896

B&W Crosstrainini! Course Manual B&W rossrainni~Coure MaualRancho Seco Loss of ICS Power control valves remained at the 50% position. Although the cooldown continued, the flow Meanwhile, the motor driven AFW pump from the high-pressure injection system apparently sequenced back onto its vital bus. began to refill the pressurizer, although the level was still below the indicating range. RCS During this time frame, several people pressure also began to increase from a low point checked the ICS power cabinets. It was realized of 1064 psig. The continued cooldown, combined that all four 24-vdc power supplies were with the. RCS pressure increase resulted in deenergized; however, no one seemed to conditions that exceeded the B&W pressure/tem recognize that switches S 1 and S2 were open. perature limits for pressurized thermal shock of the reactor vessel. However, the nil ductility Because of continued overfeeding and transition temperature technical specifications excessive steam dumping, the cooldown of the limits were not violated.

RCS continued. When steam generator pressure decreased to 500 psig, the running condensate The control room operators throttled the HPI pumps began to supply feedwater to the OTSGs. flow slightly as RCS pressure and subcooling The feeding by the condensate pumps added margin continued to increase. The cooldown had approximately 1000 gpm flow to each steam now decreased steam generator pressures to about generator. The RCS temperature had cooled 100 435 psig, causing the main steam line failure logic degrees in the first 7 min. following the reactor to actuate. This actuation closed the feedwater trip. Later, the RCS pressure decreased to a low flow control, valves, stopping flow from the of 1064 psig, and the pressurizer water level condensate pumps. The flow had lasted for dropped off-scale. Subsequent evaluation approximately two minutes.

indicated that a small steam bubble formed in the upper head region of the reactor vessel. Nine minutes after being dispatched by the control room, the operators at the TBVs and the 15.2.5 Partial RCS Repressurization ADVs reported that the valves had been isolated.

However, the nonlicensed operator at the AFW IThe transient continued with the pressurizer (ICS) flow control valves was experiencing some level off-scale low, and with full high-pressure difficulty in closing them. He used the valve injection in progress. The operators outside ofthe handwheel to partially close the "B" AFW (ICS) control room were working feverishly to isolate flow control valve, although he thought he had the sources of released steam and the excessive completely closed the valve. As a result, the flow AFW flow. Although pressurizer level was off continued to the "B" steam generator, decreased scale, the RCS subcooling margin was substantial by about 40 percent. He then went to the "A" (85 degrees and increasing). The subcooling AFW (ICS) flow control valve and closed it with margin began to increase prior to the reactor trip the valve handwheel. Closing this valve caused and did not decrease to the pre-trip value of 40 the flow through the "B" AFW flow control valve degrees at any time during the transient. The high to increase because much of the flow that had subcooling margin while the pressurizer level was been going through the "A" AFW (ICS) flow off-scale was an indication to the operators that control valve was apparently being redirected the pressurizer had not completely emptied, but through a line crossconnecting the two valves.

the pressurizer was empty for approximately 3 However, the operator believed that the "A" AFW minutes. flow control valve was only 80 percent closed 15-4 Rev 0896 USNRC Technical Training Center Center 15-4 Rev 0896

"B&W Crosstrainingy Course Manual Rancho Seco Loss of ICS Power

'B&W Crosstrainin Course Manual Rancho Seco Loss of ICS Power since he could still see' about 1/2-inch of The Shift Supervisor, Shift Technical Advisor, uncorroded valve stem. Using a valve wrench, he and the Senior Control Room Operator had earlier applied additional force to the valve, which discussed whether the AFW pumps should be resulted in failure of the manual operator, where tripped. -The emergency procedures had been upon the 'valve reopened. As a, result, local modified after the cooldown transient of October manual control of the valve by the valve hand 2, 1985 to require that the AFW pumps be tripped wheel was no longer possible. during an overcooling transient if the steam generator could not be isolated by shutting valves.

In the 'meantime, a second nonlicensed The Shift Supervisor,'however, made the decision operator arrived at the "B" AFW (ICS) flow to delay tripping the AFW pumps. The operators control valve and fully closed it completely. The were concerned that AFW might not be available, first operator then called the control room and was when later required, if the AFW -pumps were

• told to close the "A" AFW manual isolation valve. tripped.

Since it would not move, even after he applied a valve wrench, it remained open. The "A" AFW Meanwhile, the chart recorders indicated that (ICS) flow control valve also remained open until the A steam generator was overfilling with the ICS power was restored. Because of its location, overflow entering the steam lines. The safety the' second operator found it expeditious to jump parameter display system (SPDS) video screen a controlled area fence approximately 6 feet high also showed steam generator levels and this "whengoing from the "B" to the "A" AFW (ICS) indication was later reported to have indicated the flow control valves. This appeared to have saved steam generators were not full. Th'e "A" steam about 2 minutes. generator actually filled to the top of the steam shroud and began to spill water into the steam Meanwhile' in the control room pressurizer annulus and into the main steam line for about 7

'level was ,back on-scale and increasing so that 'minutes until ICS power was restored. The AFW operators started to throttle all the HPI valves to flow rate to the "A" steam generator at this time slow, the increase in RCS, pressure. The, was off-scale high (greater than 1300 gpm).' (A subcooling margin was 170 'F. later evaluation and inspection showed there was no apparent damage to the main steam lines or the The operators opened the HPI pump, SFAS turbine driven AFW pump as a result of this controlled, recirculation valves to prevent ,the overflow).

"pumps from overheating when flow was subse quently further throttled. However, the suction. The makeup tank (MUT) was still receiving valve from the makeup tank was still closed at this the HPI pump recirculation flow and, in turn, was "time. Recirculation flow was sent to the makeup 'relieving to the flash tank. The control room

'tank, which soon filled, and the relief valve began' 'operators, therefore, closed the suction valve from

-to discharge to the flash tank. , the borated water storage tank in an attempt to mitigate the high level in the MUT, forgetting the The operators in the control room stopped the suction line from the MUT was shut.. This action "C" reactor coolant pump (RCP) and the "A" HPI isolated the suction to the makeup pump, the "A" pump at an RCS temperature of 418 °F. HPI pump (which had been stopped earlier), and the "A" --low pressure injection ý(decay heat removal) pump, which was in recirculation.

15-5 Rev WS9b Technical Training USNRC Technical USNRC Center Training Center 15-5 Rev 0896

B&W Crosstrainine Course Manual Rancho Seco Loss oflICS Power B&W Crosstrainin Course Manual Rancho Seco Loss of ICS Power While the steam releases had been isolated the TBVs and ADVs had been closed and the "B" earlier, the "A" AFW (ICS) flow control valve AFW (ICS) flow control valve had been shut with was still open which produced an RCS cooldown the handwheel. The control room operators rate of approximately 200 'F per hour. The RCS immediately shut all open ICS-controlled valves, subcooling margin peaked at 201 *F at 4:39 a.m. at including the open !'A" AFW (ICS) flow control an RCS temperature of 390'F and an RCS valve, from the control room. All AFW flow to pressure of 1430 psig. This was about 800 psig both steam generators was now stopped, and the higher than the pressure limit for the pressurized RCS began to heat up. The lowest RCS temper thermal shock region at this temperature. ature reached was 386'F. (The plant had cooled by 180'F in 26 minutes.)

Finally, at 4:40 a.m. the "backup" Shift Supervisor had returned back to the control room At this time, RCS pressure was being reduced after having helped to isolate the steam release to achieve conditions outside the pressurized and discovered that switches S I and S2 to the ICS thermal shock region. The operators were de power supplies were tripped to the OFF directed to disengage the manual handwheel on position. the "B" AFW (ICS) flow control valve and to open the isolation valves for the ADVs and TBVs 15.2.6 Restoration of ICS de Power and so that the ICS could completely resume control Plant Stabilization of these valves. The "A" steam generator level decreased below the steam shroud shortly after the

Twenty-six minutes after it was lost, ICS dc "A" AFW (ICS) flow control valve was closed.

power was restored when switches S1 and S2 were turned back to the ON position. With power The RCS cooldown had been arrested, so restored, normal remote control ofICS equipment operators stopped the "B" HPI pump and closed in the control room also was restored. Shortly the open HPI! injection valves ("A" and "B").

after ICS power was restored, the Senior Control However, they left the makeup pump operating.

Room Operator (SCO) called the NRC Operations The "A" HPI pump had been stopped earlier. The Center and reported an Unusual Event. The SCO operators attempted to restore normal makeup briefly described the event and promised to call flow through the makeup valve. However, the back later with additional details. The operators makeup isolation valve could not be opened from were now able to stop the RCS cooldown and the control room because the operators did. not continue to depressurize out of the pressurized reset one of the SFAS isolation signals for this thermal shock region. The main items of interest valve.

during this period were the damage to the makeup pump, which subsequently released radioactivity, A short time after stopping the "B" HPI pump, the illness of the "backup" Shift Supervisor, and the operators noticed a loss of reactor coolant an additional loss of ICS de power. pump seal flow (they were alerted by an alarm and low flow indication) and restarted the "B" pump When power to the ICS was restored, to reestablish seal flow. They checked the valve apparently all the ICS-controlled valves shifted to lineup to the seals and again stopped the "B" the manual mode and received a demand signal to makeup pump. Again, flow to the seals stopped go fully open, a condition that was unexpected by and the "B" HPI pump was restarted. What the the operators. However, the isolation valves for operators did not realize was that the makeup 15-6 Rev 0896 USNRC Technical Training Center USNRC Center 15-6 , Rev 0896

SB&W Crosstraininey Course Manual Rafich -oSeco.Loss of ICS Power B&W Crosstrainin Course Manual Rancho Seco Loss of ICS Power puinp was severely damaged and could not supply pump room contaified airborne radioactivity, and "adequatereactor coolant pump seal injection flow. contaminated water on the floor. Although the

-(Tle "A" decay heat removal pump was nonlicensed operators wore some protective apparently'fiot damaged since it was operating' clothing, they did notwear respirators or high top with its recirculation line -open and therefore boots because none were available near the pump discharging back to its own suction.) room entrance. They performed a radiation survey before entering the makeup pump room, Coincident with this seal flow problem, the however, no assessment was made of particulate auxiliary building ' siack radiation , monitor - or gaseous radioactivity until after they entered.

- alarmed. 'A smoke alarm'was also received that 'After isolating- the makeup pump, the isolated the auxiliary building ventilation system.

The inadequate seal flow and radiation alarms ,operators entered the west decay heat reinoval were apparently all caused by the failure of the cooler room to attempt to open the SFAS-actuated makeup pump that had been operating for about makeup isolation valve by hand.. This' valve still 10 min. with both suction valves (BWST and had a "close" signal so they were unable to open

. MUT) closed. At 5:00 a.m., the operators in the it. The operators later found that the SFAS signal control room heard a loud noise and observed that had not been reset for the makeup isolation valves the makeup pump ammeter was reading only at the B 'safety features panel. (Following

'about 1/3 of normal running current. It was then actuation 6f the SFAS, the makeup valve "close" that they realized that the makeup pump had been signal must be cleared at both the "A" and "B"

-damaged. They also discovered that both makeup safety features panels.) The operators then went pump suction valves were closed and immediately back into the makeup pump r6om briefly to check opened the suction valve fromr the MUT in the its status and then left the area. (Both operators hope of preventing further damage to the pump. were monitored and whole body counted on the Opening the Valve allowed water to spill from the "morningofDecember26. The results showed that damaged makeup pumponto the makeup pump they had not received a significant radiation dose

- room floor.' The operators closed the valve after from the entry into the makeup pump room.)

approximately 450 gallons had spilled.

"Meanwhile, the' "backup" Shift Supervisor "became ill in the control room and collapsed in The failed makeup pump had only a single stop-check valve that isolated the RCS from the front of the control paniel.- He had assisted in failed makeup pump seals.' In' addition; the Sisolating the ADVs, which are located outside makeup pump was isolated from the operating " where the weather was cold and damp. 'At this

- HPI pump recirculation line by only a single stop-' time an additional Senior Control Room Operator check valve. Consequently, there was-some arrived at the plant. He was not scheduled to be concern on the -part of, the Control -Room on shift and had arrived early to do some paper Operators that this failure-could lead to a small iwork. When he reached the control room, he break LOCA. Therefore, the Shift Supervisor sent , turned his attention to the backup shift supervisor two nonlicensed operators to enter the makeup -who had bec6me ill. After discussing the situa pump' room and isolate the-,makeup pump by, tion with .the' Shift Supervisor, he 'called an closing' the' locked-open manually operated ambiilance. The supervisor was later transported suction- valves, dis6harge valves, and' the to the hospital and later released.' The supervi recirculation line isolation' valve. The Tmakeup sor's illness diverted the attention of the control

'USNRC Technical Training'Center Key (11i96

'Center 15-7 Training Technical USNRC Rev 0896

B&W Crosstraining Course Manual

&-i Rancho Seco Loss of ICS Power room operators and resulted in the loss of the maximum permissible concentration for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

supervisor, although it did not have a significant The whole body dose to a person hypothetically at effect on the incident. (The utility stated, during the site boundary during the event would have the investigation, that based upon the medical been no greater than 0.2 mrem. The thyroid dose diagnosis at the hospital and other available would have been zero mrem. These results are information, there was no indication that drugs or well within Rancho Seco Technical Specification alcohol were involved with the illness.) limits.)

After calling the ambulance, the off-duty SCO After assisting in isolating the makeup pump, answered the Emergency Notification System a nonlicensed operator noticed he had. lost his (ENS) phone when the NRC Operations Center security badge. Thus, he was no longer able to called and requested an update on the plant's open doors to the areas that require a badge for initial report. After the SCO briefed the NRC entrance. After reporting the loss to the control Operations Center, he was requested to maintain room, he was escorted by a security guard to the an open line. The open line was maintained until control room where he remained until a spare the Unusual Event was terminated. Operators in security badge was brought to him about 20 the control room were intent on stabilizing the minutes later.

plant and bringing all systems and parameters to normal where possible.. The. RCS had now The SFAS signal was also "bypassed" at 6:06 depressurized out ofthe pressurized thermal shock a.m. At approximately 6:10 a.m., the plant-was region and a 3-hour soak at the existing RCS stabilized. The main steamline failure logic had temperature and pressure (870 psig and 428°F) been inhibited and the steam generators were was begun in accordance with B&W guidelines. being fed by the main condensate pumps.

Operators began to drain the overfilled steam generator to the condenser to reestablish MFW At 6:11 a.m., a momentary "ICS or Fan Power flow with the main condensate pumps. Failure" alarm occurred. The S1 and S2 switches remained closed and the alarm cleared without The Shift Supervisor, concerned about the operator action. No equipment response was habitability of the auxiliary building after the noted.

ventilation system shutdown, decided to restart the ventilation system. However, a smoke detector At 6:14 a.m., a third "ICS or Fan Power alarm in the radiological waste area prevented the Failure" alarm was received. The ICS-controlled ventilation system from operating. The smoke valves again received a 50 percent demand signal.

detector in the radiological waste area is believed The operators immediately reset switches S1 and to have detected smoke from the reactor building S2 to restore ICS power. This caused the ICS radiation monitor, which overheated when its controlled valves to receive a 100 percent demand suction was isolated by the SFAS actuation. signal. The- operators then closed the valves Efforts to start the auxiliary building ventilation remotely from the control room.

system were finally successful, and ventilation from the auxiliary building to the atmosphere was The Plant, Superintendent relieved the Shift restored. (The maximum permissible radionuclide Supervisor as Emergency Coordinator and concentration at the site boundary was later manned the Technical Support Center (TSC) at calculated to be less than one-fifth of the 7:15 a.m. Meanwhile, several gallons of water USNRC Technical Training Center 15-8 Rev 0896

Rancho Seco Loss of ICS Power S

..l1&W Crnsstraininp Course ManualRncoSoLssf CPwe

- had spilled onto the TSC floor. The water came PSM. During the troubleshooting process it was from a drain on a pilot-operated valve in the fire found that the time delay drop of switches S I and main when a fire alarm .was received and the S2 was much shorter than the manufacturer's normally dry fire header was pressurized with tolerance.

water. There was no release of water from the fire

- main header and the spilled water had no This time delay feature may explain why the significant effect on this incident. The Emergency intermittent "ICS or fan power failure" alarm Coordinator terminated the Unusual Event at 8:41 received at 06:11 did not result in a trip., During a.m. the investigation, it was reported that this alarm had also occurred intermittently on at least two 15.3 Mijor Issues occasions in the weeks before the trip, although no documentation of these alarms could be found and The post event evaluation and investigation no work requests to'investigate them could be resulted in the compilation of an action list that located. The fact thatthe time delays on Sl,and consisted: of 14 'sections, with several items S2 were shorter than designed (which is in the contained in each section. Three of these sections conservative direction) may have contributed to are discussed in the following paragraphs. the loss of ICS power in this event. Had they been within the design tolerance, the voltage fluctuation "15.3.1 ICS Power Failure caused 'by an improperly crimped wire may not

,-have been long enough in duration to cause S1 "Thereare redundant dc power supplies for the and S2 to trip.

ICS, whose outputs are auctioneered to provide

+24 vdc and -24 'vdc power for use in various During inspections of the physical wiring in modules within the ICS. The outputs of each of the ICS cabinets, and in an attempt to identify the the +24 vdc and -24 vdc power supplies are source of a possible increased input resistance, the monitored by. a single power supply monitor technicians found that the input lead wire to the (PSM) module, which will alarm in the control +/-24 vdc monitor had an improperly crimped room if the output voltage of any of the dc power connection at the +24 volt bus bar in cabinet one.

suliplies'drops to 23.5 vdc. The PSM also senses In fact, the lug fell free from the wire when it was the auctioneered output of each pair of power 'disconnected from the bus. This 'wire is an supplies and will trip open the input switches, S I -internal cabinet wire installed by the vendor prior and S2, if the voltage on either output bus drops - to delivery of the cabinets.

to 122 vdc. This results in interrupting all dc Following the, discovery of the improperly

'power within the ICS. This is a designed response -crimped connection, the Quality Control group to prevent voltage fluctuations from causing the inspected the remainder of the .factory and field

,ICS to behave in an erratic or *unpredictable ,wire terminations in ICS and NNI cabinets, and

,manner.--, 'found numerous deficiencies in the quality of the wire terminations in these cabinets. The root

,Early findings determined that the PSM trip. cause for the loss of the ICS power was identified setpoint was drifting. Significant to the event was as the loose connection. The factory bus wiring the finding, that small amounts of resistance, as has been replaced with current standard wiring.

little as one- ohm, in series with the "sensed", I voltage to the PSM could cause tripping of the -15.3.2 Makeup Pump Failure 15-9 KeY UJb Technical Training USNRC Technical Center Training Center 1 15-9 .: ,.RevU0739

B&W Crosstrainine Course Manual Rancho Seco Loss oflICS Power B&W Crosstrainini Course Manual Rancho Seco Loss of ICS Power dures. The procedural inadequacy is evidenced in At time 04:16:57, the makeup tank isolation this regard by the lack of guidance for operators to valve shut on Safety Features Actuation System recover from SFAS initiation. A contributory (SFAS) initiation due to reactor pressure falling cause of the damage to the pump was personnel below 1600 psig. During the subsequent SFAS error, as evidenced by the operators performing recovery, the valve was not reopened. At 04:30 valve operations which isolated the suction of the operators secured the "A" HPI train which makeup pump while the pump was running.

included shutting the supply valve from the Borated Water Storage Tank (BWST). They did 15.3.3 RCS Overcooling not realize that this action also isolated the suction to the Makeup Pump., Upon securing the "B" HPI The reactor trip and overcooling event was train at 04:42, RCP seal injection flow decreased initiated by a loss of ICS power and subsequent toward zero. The "B" HPI was restarted, the repositioning of valves that regulate the rate of lineup verified, and the, pump secured again. RCS heat removal. When the ICS DC power Once again RCP seal injection flow decreased supply tripped, voltage output from the hand/auto toward zero. At 05:00, operator's statements stations that control main feedwater (MFW) indicate that a loud noise was heard in the plant. regulating and startup valve positions and MFW The operators then realized that the makeup pump pump speed failed to mid-scale (0 vdc), resulting was without suction and tripped the pump and in a reduction in MFW flow. Within 16 seconds, opened the makeup tank isolation valve. The the loss of heat transfer in the once-through steam makeup pump had run for nearly thirty minutes generators (OTSGs) caused a reactor trip on high with its suctions to both the BWST and the reactor coolant, system (RCS) pressure. The makeup tank closed. However, by this time a hand/auto stations for the ICS controlled auxiliary pump seal had been badly damaged and over 1200 feedwater (AFW) valves, the atmospheric dump gallons of water from the makeup tank spilled to valves (ADVs), and the turbine bypass valves the pump room floor prior to reclosing the (TBVs) also failed to mid-scale, resulting in those makeup tank isolation valve. valves opening to their 50% demand position.

Operating procedures for the HPI, Makeup Steaming through the ADVs and TBVs was a and SFAS systems were reviewed. No procedural steam demand significantly in excess of decay direction could be found instructing operations to heat generation. Additionally, both AFW pumps reopen the makeup tank isolation valve during started due to low MFW pump discharge pressure SFAS recovery or otherwise ensuring an adequate and were delivering feedwater to the OTSGs source of water to the makeup pump. In addition within a few seconds of the reactor trip. This to the absence of a procedural requirement to excessive heat transfer condition created an RCS prevent this occurrence, there were no warning or cooldown rate in excess of technical specification control devices such as a pump low suction alarm limits that was not fully controlled for 26 minutes.

or trip, nor interlocks between the makeup tank or BWST outlet valves and the pump to ensure Remote control was also lost. No procedural adequate suction existed. guidance was in place to identify other points of remote control (such as the Appendix R remote The root cause of the damage to the makeup shutdown panel), or toward recovering power to pump was determined to be inadequate proce- the ICS.

15-10 Rev 0896 USNRC Technical USNRC Training Center Technical Training Center 15-10 Rev 0896

B&W Crosstraining Course Manual Rancho Seco Loss of ICS Power The issue of potential loss of ICS power has Sinitiator, successes of AFW and MFW, failure of been raised in numerous vendor and regulatory the PORV to reseat, and HPI. The conditional documents over the past 8 years as well as being probability of this sequence is 3.OE-5/Rx-yr.

included as an independent casualty in B&W's Abnormal Transient, Operating Guidelines 15.4 : References (ATOG).

1. U.S. Nuclear Regulatory Commission. "Loss The deficiency in this area was the lack of of Integrated Control System Power and procedural direction aimed at ICS recovery, or Overcooling Transient at Rancho Seco on guidance toward alternate points of control which December 26,, - 1985", USNRC -Report will more quickly mitigate a transient. The root NUREG 1195, February 1986.

cause was determined to be failure to implement changes addressed in 1980 concerning the 2. Docket 50-312, Rancho Seco Nuclear Gener potential cooldown affects of the turbine bypass ating Station Unit 1, "Resolution of Issues valve failure mode during a loss of ICS. At that Regarding the December 26, 1985 Reactor time the utility was alerted to the design Trip", February 19, 1986.

deficiency and was requested to make corrections be made in a timely manner. -3. Sacramento Municipal Utility District "Inci dent Analysis Root Cause 85-41", March 19, 15.3.4 PRA Insights 1986. 1t All major events are reviewed by Oak Ridge National Laboratory from a PRA standpoint.

Each year, NUREG/CR-4674, "Precursors to Potential Severe Core Damage Accidents,"

publishes the results of this review. The Rancho Seco results were published in the 1985 issue.

The NUREG lists the major sequences that result in core vulnerability and core damage.

The major core vulnerable sequence is shown

.in Figure 15-6. The sequence involves a transient (initiated by the loss ofICS power), a reactor trip, success of AFW, success of Main Feedwater, a (

challenge to the PORV (the valve was opened to,,

control RCS pressure), success of the reseating of

. the PORV, and failure of the HPI system (one pump was rendered inoperable by the incorrect suction lineup). The conditional probability for this sequence is 1.766E-4.

The major core damage sequence is shown in Figure 15-7. The sequence involves a transient 15-11 Rev WITh I tL USNRC USNRC Technical Center Technical Training Center "I'.

- 15-11 Rev 0896

B&W Crosstrainingy Course Manual , Rancho Seco Loss of ICS Power APPENDIX - SEQUENCE OF EVENTS INITIAL CONDITIONS:

Average temp 582°F. RCS pressure 2150 psig. Reactor Power 76%. ICS in full automatic control.

Note: Rancho Seco does not have main steam isolation valves.

TRANSIENT INITIATOR - LOSS OF ICS DC POWER 04:13:47 Loss of ICS DC power-(power supply monitor failed).

04:13 :+ Main feedwater flow decreasing rapidly. MFPs to minimum speed. RCS pressure increase, spray valve opened manually.

04:14:01 AFW initiated on low MFP discharge pressure (<850 psig).

PLANT TRIP AND START OF COOLDOWN 04:14:03 Reactor trip on high RCS pressure. Pzr spray closed.

04:14:04 RCS pressure peaks at 2298 psig. Six OTSG safety valves open and later reseat.

04:14:06 Second AFW pump staits on low MFP discharge pressure.

04:14:06 Peak hot leg temperature of 606.5°F reached.

04:14:+ Operators start to perform E.01 - reactor trip letdown isolated. Operators start E.02 - vital systems verification 04:14:11 AFW flow to both OTSGs via 50% AFW (ICS) valves.

04:14:25 Pzr level decreasing. "A" HPI MOV opened to increase makeup flow to the RCS.

04:14:30 Overcooling symptoms noted. Loss of ICS DC power has positioned the following valves to 50%:

1. Turbine Bypass Valves

2. Atmospheric Dump Valves

3. AFW Flow Control Valves 04:14:48 Makeup tank level decreases due to excessive RCS makeup. MU pump suction shifted to BWST.

04:15:04 "B" makeup (HPI) pump started for additional makeup.

04:16:02 AFW flow to OTSGs >1000 gpm. MFW flow indicating about 3 million pounds per hour.

Actual MFW flow is zero because of MFP speed.' In addition, the main feedwater stop valves were closed. However, a flowpath from the MFP to the OTSGs is available through the startup main feedwater valves.

15-12 Rev 0896 USNRC Technical Training Center Technical Training Center 15-12 Rev 0896

B&W Crosstraininiz Course Manual .I Rancho Seco Loss oflICS Power SEQUENCE OF EVENTS (contintued)

SFAS ACTUATION - COOLDOWN - DEPRESSURIZATION'

,04:16:57 RCS pressure decreased from 2298 psig to 1600 psig. SFAS actuated at the setpoint of 1600 psig. Pzr level dropped from 220 inches to 15 inches. The SFAS actuation opened all 4 HPI MOVs to predetermined positions. The following equipment was also actuated bythe SFAS signal:

1. MUT outlet valve closed - BWST supply to HPI opened.

2. MU pump recirculation path isolated.,'

3. AFW valves to the 100% position.

4. LPI/DHR pumps start.

5. Both DGs start. -;

04:16:59 The "A" HPI pump started by SFAS. "B" HPI already running. Both HPI pumps and the MU

--. 'pump supplying MU to RCS.

04:17:10 AFW (SFAS) flow control valves manually closed.

04:17:15 A & B emergency~air conditioning units auto start. Significant increase in control room

-noise level.

04:17:27 Motor driven AFW pump auto sequenced back to the vital bus. -Dual drive AFW running on steam source.

04:18:58 RCS temperature less than 500'F..

04:19:00 Pressurizer-emptied. Steam bubble in reactor vessel head.

04:19:15 Emergency air conditioning stopped to reduce noise level.

04:20:00- STA to turbine deck to determine lifting relief valves.

04:20:00 Pzr level off scale low. Subcooling margin of 85 degrees and increasing.

-04:20:+ Technician sent to check ICS power-supplies. All four 24-vdc power supplies were deenergized. The automatic bus transfer (ABT) did not transfer. The power supply to the ICS would be inspected by three people during the next 20 minutes without dicovering that switches S I and S2 feeding the 24-vdc supplies were open.

04:20:20 OTSG pressures at 500 psig.- Feedwater into the OTSGs from condensate pumps via open startup feedwater valves. An additional 1000 gpm feedwater flow to the steam generator.

04:21:25 Minimum RCS pressure of 1064,psig (RCS temperature of 464°F).is reached..

" PLANT REPRESSURIZATION 04:21:+ RCS cooldown continuing., However, flow from the HPI pumps starts to increase RCS pressure even though pressurizer level is off scale low.

04:22:00 B&W pressure 'and temperature limits for PTS are exceeded; however, technical specification NDT limits are not exceeded. Operator starts to throttle HPI flow.

04:22:50 OTSG pressures decrease to 435 psig. Steam line break logic actuated. Main and startup regulating valves are closed. Feedwater flow from the condensate pumps is terminated.

Cnter..

USNRCTechical rainng -"15-133.Ke ... IJA

-,Rev 0896 USNRC Technical Training Center

B&W Crosstraining Course Manual SRancho Seco Loss oflICS Power SEQUENCE OF EVENTS (con tinued) 04:23:00 Atmospheric dump valves and turbine bypass valves were shut locally. (Manual handwheels used.)

04:23:10 "B" AFW (ICS) flow control valve partially closed. Operator thought valve was fully closed.

Flow has decreased by 40%.

4:25:30 HPI recirculation valves to makeup tank opened. HPI pump suction being supplied by BWST.

4:26:22 "A" AFW flow control valve closed locally. Operator thinks that the valve is only 80%

closed.

04:26:47 Pzr level back on scale. Subcooling margin is 170 degrees. Operators throttle HPI to slow the increase in RCS pressure.

04:28:00 Makeup tank level off scale high. Makeup tank relief valve lifts.

04:28:00 RCP "C" stopped at an RCS temperature of 418'F.

04:28:43 RCS letdown restored.

04:28:59 "A" HPI stopped.

04:29:40 Operator damages "A" AFW flow control valve in an attempt to close valve >80% closed.

Operator directed to close AFW manual isolation.

04:29:40 RCS pressure peaks at 1616 psig. RCS temperature is 418'F.

04:29:45 "C" and "D" HPI valves are closed in order to reduce the repressurization while temperature is decreasing.

04:30:00 An unusual event is declared.

04:30:30 Plant is depressurized using pzr spray in an attempt to restore PTS limits.

04:33:20 "B" AFW flow control valve closed by second operator. AFW flow to "B" OTSG is stopped.

04:33:20 "A" OTSG filled to top of steam shroud. Water begins to spill into the steam lines. Flow into the OTSG is in excess of 1300 gpm.

04:35:+ The "A" HPI suction valve from the BWST is closed in an effort to lower makeup tank level.

However, the makeup tank outlet valve is still closed.,

04:36:+ The manual AFW isolation valve cannot be closed by the operator.

04:39:00 RCS subcooling margin reached a peak of 201 degrees and began to decrease (RCS temp =

390'F, RCS press = 1430 psig). This is approximately 800 psig into the PTS region.

ICS POWER RESTORATION AND PLANT STABILIZATION 04:40:00 The "Backup" shift supervisor finds switches SI and S2 in the OFF position. The switches were closed. The valve stations reverted to the HAND position. All valves with the exception of the AFW flow control valves had been isolated. The control room operators closed the AFW (ICS) flow control valves.

04:40:+ With AFW flow isolated, the RCS starts to heat up. The lowest RCS temperature was 386°F. The RCS had cooled down 180 degrees in 26 minutes.

15-14 Rev 0896 USNRC Technical Training Center Center 15-14 Rev 0896

B&W Crosstraining Course Manual Rancho Seco Loss of ICS Power 04:41:00 Operators report that the "A" AFW manual isolation valve is stuck open. Operators are directed to disengage the handwheel for the "B" AFW flow control valve and to returnthe ADVs and TBVs to service.

SEQUENCE OFEVENTS (continued) 04:41:10 "A" OTSG level below the steam shroud.

04:42:42 "B" HPI pump stopped. The makeup pump remains in service.

04:42:56.- Operators closed the "A" and "B" HPI MOVs.

04:43:50 RCP seal injection low flow.

04:43:54 "B" HPI pump restarted to reestablish RCP seal injection flow.

04:40:+ 'Steam leakage from the damaged makeup pump causes an auxiliary building stack radiation

,monitor alarm. Makeup pump damaged due to a lack of suction. Radioactive release is

-within Tech. Spec. limits.

04:50:19 "B" HPI pump stopped.

04:50:30 "B" HPI pump restarted in response to a low RCP seal flow alarm. 'The operators have not realized that the makeup pump has been damaged.

04:52:+ "Backup" shift supervisor collapsed in control room. This operator had assisted in closing the ADV and TBV manual isolations.

05:00:+ Control room operators hear a loud noise. They observe that the makeup pump ammeter is reading low and realize that the pump has been damaged.

05:00:10 Makeup pump istripped. Makeup tank outlet valve is opened allowing 450 gallons of water to ýspill out of the damaged pump. Makeup tank outlet valve is reclosed.

05:05:+ RCS pressure decreased out of the PTS region. A 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> soak is initiated. (RCS temp 4281F, RCS press = 870 psig).

05:05:+ Ambulance called for "backup shift supervisor".

05:27:+ Two auxiliary operators are contaminated while isolating the damaged makeup pump.

Operators did not follow j'roper radiological safety procedures.

05:29:+ Operators are Unable'to-6pen mak6up isolation to the RCS. It was later found that the SFAS signal had not been cleared from the valve.

05:29:04 Second reactor coolant 1ump ýt6pped.

06:06:00 Operators bypass SFAS.

07:15:+ Plant superintendent relieV&s shift supervisor as emergency coordinator.

08:41 :+ The unusual event is terminated.

Training Center 15-15 KY U5YO Kev 089O USNRC Technical Training Center 15-15

I____________

120 Vac r"",

FROM VITAL BUS 1C Q FROM NON-VITAL BUS 1J AUTO BUS TRANSFER TO ICS ac LOADS FAN

- -FAILURE I I I I I I I I lii I I I I I I I I I I I I I I I I AUCTIONEERING- I I DIODES I I I I

+24 Vdc -24 Vdc I I ICS BUS ICS BUS II I I I I I I I I L

Figure 15-1 ICS Power Supplies

TO MOISTURE SEPERATOR ATMOSPHERIC DUMP REHEATERS VALVES (3/HEADER)

I A- A TURBINE BYPASS VALVES TO CONDENSER Ki2 (2/HEADER)

"PEGGING" STEAM TO FW HEATERS TURBINE

- - - - THROTTLE A OTSG "TOMFW PUMPS >-TO AFW PUMP P-318 '" VALVES I' i ' FV-30801 CONTAINMENT BUILDING P TURBINE BOUNDARY "PEGGING" STEAM HV-20596

.HV-20560 TO FW HEATERS CONTROL A VALVES

,I I

ITO MOISTURE iSEPERATOR REHEATERS B OTSG

FROM MOISTURE SEPERATOR REHEATERS EXHAUSTTO LP CONDENSER FROM LP FW HEATERS

"-n

-rl CE)

CL (D

C')

(D 2 FROM LP FW HEATERS-

A OTSG AFW PUMP, P-318 CONDENSATE FWS-063 STORAGE, CD TANK, AFW (ICS)

FLOW CONTROL' VALVE 4,.

CDi

$ FROM CL PLANT" CD RESERVOIR CD cD

=1 a

(ICS)

(MOTOR DRIVEN)

CONTAINMENT BUILDING BOUNDARY 0

SEAL RETURN FROM RCPs BWST SEAI cc SFV-25003 -- >

CD SFV-25004 I MUT CD FLASH ET TANK SFV-2 (D

Ca CD 3

B HPI PUMP

BABCOCK AND WILCOX CROSS TRAINING MANUAL CHAPTER 16 Davis-Besse Loss of All Feedwater r

• I B&W Crosstraining Course Manual Davis-Besse Loss of All Feedwater TABLE OF CONTENTS 16.0 DAVIS-BESSE LOSS OF ALL FEEDWATER EVENT 16.1 Description of Plant Systems .............................................. 16-1 16.1.1 General Design ...................................................... 16-1 16.1.2 M ain Steam System .................................................. 16-1 16.1.3 M ain Feedwater System ............................................... 16-2 16.1.4 Auxiliary Feedwater System ........................................ 16-3 16.1.5 Makeup/High-Pressure Injection Cooling Systems .......................... 16-4 16.1.6 Steam and Feedwater Rupture Control System (SFRCS) ...................... 16-5 16.1.7 Pressurizer Pilot Operated Relief Valve ................................... 16-6 16.2 Event N arrative ......................................................... 16-7 16.2.1 Shift Change ........................................................ 16-7 16.2.2 Reactor Trip - Turbine Trip ............................................ 16-8 16.2.3 Loss of M ain Feedwater ............................................... 16-9 16.2.4 Loss of Emergency Feedwater ......................................... 16-10 16.2.5 Reactor Coolant System Heatup ........................................ 16-11 16.2.6 Operator Actions .................................................... 16-11 16.2.7 PORV Failure ...................................................... 16-14 16.2.8 Steam Generator Refill ............................................... 16-15 16.2.9 PRA Insights ....................................................... 16-16 Appendix - Sequence of Events ................................................. 16-18 LIST OF FIGURES 16-1 Davis-Besse NSSS 16-2 Main Steam System 16-3 Main Feedwater System 16-4 Auxiliary Feedwater System 16-5 Emergency Core Cooling System 16-6 Steam and Feedwater Rupture Control System Logic 16-7 Reactor Coolant System and Pressurizer Response 16-8 Number One Steam Generator Parameters 16-9 Number Two Steam Generator Parameters 16-10 Trip Throttle Valve 16-11 Dominant Core Vulnerability Sequence Event Tree 16-12 Dominant Core Damage Sequence Event Tree 16-i Rev 0896 USNRC Technical Training Center Center 16-i Rev 0896

I Davis-Besse Loss of All Feedwater nzw ~ nn~e1~hnt~ Dvi-BeseLos f llFedwte 16.0 DAVIS-BESSE LOSS OF ALL (PORV) and two code safety valves. The pilot FEEDWATER EVENT operated relief valve discharges to a quench tank.

The two code safety valves discharge directly to Learning Objectives: the containment building.

1. List the indications of a "Loss of Heat Trans The reactor design power level is 2,772 Mwt, fer" event. which is also the design power level for the station and all components. At a power level of 2.", Explain what operator actions and equipment 2,772 Mwt, the net station electrical output is 906 failures led to the "Loss of Heat Transfer" Mwe.

event at Davis'-Besse.

16.1.2 Main Steam System

3. Explain' the protection provided in an event that exceeds the design bases of the unit.: The main steam system functions to deliver superheated steam from the steam generators

4. Describe how the "Feed and Bleed" method of (OTSGs) to the main turbine and required plant core cooling is used to remove decay heat auxiliaries. As shown in Figure 16-2, the system following a reactor trip. begins with the outlet piping from the steam generators and passes through the containment

'5. State why an operator/supervisor may be building to the main ,steam isolation .valves reluctant to use this method of decay heat (MSIVs). Protection against overpressurization removal. for the steam generators is provided by 18 code safety valves (9 per steam generator) located on 16.1 Description of Plant Systems the system piping upstream of the MSIVs, and two atmospheric vent valves (one per steam 16.1.1 General Design, generator) which act as relief valves. The atmo spheric vent valves are controlled bythe integrat The Nuclear Steam Supply System (NSSS) for ed control system (ICS) and aid in controlling

'.the Davis-Besse plant was supplied'by the Bab steam pressure if a large transient occurs when the cock & Wilcox Company. The NSSS, shown in unit is in service, if condenser vacuum is lost, or Figure 16-1, consists of two heat tiansport loops if the MSIVs are closed. Connections upstream of

"*with each containing a hot leg, a once-through each main steam isolation valve supply steam to steam generator "(OTSG), and rtwo 'cold legs. the redundant turbine-driven auxiliary feedwater Water from the OTSG is returned to the reactor pumps. Either system header is capable of sup vessel by the reactor coolant pumps, with one -plying either turbine; however, 'the auxiliary pump lociated in each cold leg: "Reactor coolant feedwater pump turbine normally receives steam

• system (RCS) pressure is maintained byan electri from its associated steam header.

'cally heated pressurizer that is connected to one of the hot .legs. - During normal operations, the The piping downstream of the MSIVs contains reverse flow when pressurizer contains ýi 700 ft3 steam bubble that

• non-return valves that prevent steam generator pressures are not equal. From the exerts a pressure of approximately 2150 psig on

'the RCS. Protection against over-pressurization non-return valves, steamflows to the high pres-is provided by the pilot operated relief valve 16.-i ntv uoyu Technical Training

'" USNRC Technical Center Training Center , 16-1 Rlev 0896

-1 B&W CrosstraininL, Course Manual i CDavis-Besse Loss of All Feedwater sure turbine and secondary systems, such as the air increase feedwater pressure to a value greater than ejectors. steam generator pressure and discharge through the high pressure feedwater heaters to the During normal operations, the main steam feedwater regulating valves.

system valves are not required to change position; however, reactor trips and steam and feedwater Two parallel valves are used to govern the rupture control system (SFRCS) actuations cause flow of feedwater to each OTSG. The first of the changes in valve position.' When the reactor trips, two valves is called the startup control valve and OTSG pressure rises rapidly resulting in the regulates feedwater flow from 0% power to actuation of the steam line safety valves. The approximately 15% power. Startup control valve integrated control system (ICS) biases the steam SP-7B supplies the #1 OTSG, and startup control generator pressure control setpoint to a value valve SP-7A supplies the #2 OTSG. When the higher than the normal steam header pressure startup control valves reach the 80% open posi control value to minimize the cooldown of the tion, the main feedwater regulating block valves reactor coolant system. Once the ICS gains open, and flow is also controlled by the main control of the steam pressure, the safety valves feedwater regulating valves. The main feedwater should close. regulating valves control feedwater flow during the power escalation from 15% to 100%. The The steam and feedwater rupture control pressure drop across the valve network is moni system (SFRCS) also changes the position of the tored and used to control main feedwater pump main steam system valves. If an SFRCS actuation turbine speed. From the outlet of the feedwater signal is received, the following changes can regulating valves, the feedwater travels to the occur in the system: OTSGs via a motor-operated main feedwater isolation valve. Main feedwater is added to the I. The MSIVs close. OTSG through the external main feedwater ring

2. The atmospheric vent valves close. and the main feedwater nozzles.

3. The steam supply valves open to supply steam to the auxiliary feedwater pump A separate auxiliary feedwater ring is used for turbines. the addition of auxiliary feedwater flow. After entering the steam generator, auxiliary feedwater 16.1.3 Main Feedwater System is sprayed on the tubes to enhance natural circula tion when reactor coolant pumps are not running The main feedwater system, Figure 16-3, and to minimize thermal shock to the steam begins with the cross-connected deareator storage generator.

tanks. Each of these tanks has a capacity of 64,000 gallons and provides the required net When the plant is in mode 3 (Hot Standby), a positive suction head (NPSH), i.e. pressure, for motor-driven startup feedwater pump is used to the booster feedwater 'pumps. The booster maintain steam generator level. The startup feedwater pumps are driven through a gear re feedwater pump receives its suction from the ducer by the main feedwater pump turbines and deareator storage'tanks and discharges to the function to increase system pressure to satisfy the steam generator main feed rings viathe high suction requirements for the main feedwater pressure feedwater heaters, the feedwater regulat pumps. The direct-driven main feedwater pumps ing valves, and the main feedwater isolation USNRC Technical Training Center 16-2 I Rev 0896

.&.W Crotrainin"Course Manual Davis-Besse Loss of All Feedwater

'valves. After reactor criticality is achieved, power regulating valves, the startup regulating valves,

'is escalated to about- 1% anda main feedwater and the main feedwater isolation valves when pump is placed in ,service.. When the main certain abnormal plant conditions are detected.

Sfeedwater pump is- in service, the startup

'Teedwater pump is shutdown and isolated from the 16.1.4 Auxiliary Feedwater System

" .. main feedwater system. Startup feedwater pump

",--isolation includes the closing of the suction, The auxiliary feedwater system (AFW), Figure

- discharge,'and the cooling water isolation valves. 16-4, is designed to remove the core's decay heat All of.these valves are located in the turbine by the addition of feedwater to the steam genera building and must be locally operated. In addition tors following a reactor trip, if main feedwater is to the manual operation of the pump isolation not available. The system consists of redundant valves, the breaker control, power fuses are turbine-driven auxiliary feedwater pumps and removed as a safety precaution. This prevents the associated piping. Three suction sources are operation of the pump with its suction supply available to the AFW pumps: -the deareator isolated. storage ianks, the condensate storage tank (CST),

and the service Water system. The CST serves as The startup feedwater pump is designed to the normal suction source for the system;

-deliver feedwater flow at approximately 200 gpm however, if a low suction pressure condition is with a steam :generator pressure of 1050 psig. sensed, the AFW suction will automatically Electrical 'power is supplied to the pump motor transfer to the service water system. "Manual from the non-Class 1E distribution; however, the action would be required to transfer suction to the

• pump power supply may be manually transferred deareator storage tanks.

to the diesel generator busses if required. Opera tion of the startup feedwater pump in off-normal When the AFW system is actuated by the situations requires the manual opening of the* steam and feedwater rupture control system suction, discharge, cooling water inlet and outlet (SFRCS) on signals ,other - than low steam valves, and the installation of the breaker control generator pressure, the steam'to drive the AFW

,power fuses. pump turbine and the discharge of each pump are aligned with the associated steam generator. Each "Ifthe reactor trips, the feedwater system is*of the AFW pumps is ratedat 1050 gpm when ccontrolled by the rapid feedwater reduction system

• pumping -against a steam generator pressure of which closes the main feedwater regulating valves 1050 psig; 250 gpm of the 1050 gpm is used for and positions the startup control: valves to a recirculation flow.

"position that allows proper OTSG level control.

'These actions -are taken to -prevent excessive -The #1 pump supplies the #1 OTSGyvia

- cooling of the ,RCS caused .by.overfeeding the motor-operated valves AF-360, AF-3870, and AF steam generators. This system also increases the 608. The feedwater supply for #2 OTSG is from speed of the operating main feedpump turbine(s' the #2 pump through valves AF-388, AF-3872, from a normal value of 4400 rpm to 4600 rpm. and AF-599. However, if the SFRCS is actuated on low OTSG pressure, the flow path of the In addition to the ,control actions describedSsystem is altered to prevent -the -feeding of a above, the steam and feedwater rupture 'controlI ruptured steam generator. The, isolation of system (SFRCS) 'closes the main feedwatei feedwater to the faulted steam generator is 16-3 -' kevuz9 r, Rev 0596 USNRC Center USNRC Technical Training Center 1 16-3

B&W Crosstraining Course Manual Davis-Besse Loss of All Feedwater B&W Crosstraining Course Manual Davis-Besse Loss of All Feedwater accomplished by closing the AFW.containment Makeup/High-Pressure Injection (MU/HPI) isolation valve (AF-599 or AF-608). Feedwater core cooling (also called PORV cooling or feed to the intact steam generator is supplied by both and-bleed core cooling) involves the use of the pumps through the appropriate cross-connect makeup and purification system, the high pressure valve (AF-3869 or AF-3871). The steam supply injection system and, at the operator's discretion, valves for the turbine-driven pumps are also the low pressure injection system. These three realigned to provide steam for both pumps from systems are shown'in Figure 16-5. The system the intact steam generator. The following listing contains two multistage centrifugal makeup gives the position of the AFW system valves pumps rated at 150 gpm each, with a discharge during various SFRCS actuations: pressure of approximately 2500 psig. Two suction sources are available to the pumps; the NORMAL SYSTEM ALIGNMENT makeup tank and the borated water storage tank (BWST). During normal operations, the makeup Open valves - AF-360, AF-388, AF-599, AF-608 pumps - supply seal injection and -control Closed valves - AF-3869, AF-3870, AF-3871, AF-3872, pressurizer level by discharging into the RCS via MS-106, MS-106A, MS-107, MS-107A the makeup flow control valve (MU-32). The discharge of the makeup pumps enters the RCS SFRCS LOW LEVEL ACTUATION through one of the high-pressure injection Open valves - AF-360, AF-388, AF-3870, AF-3872, AF penetrations. When feed-and-bleed operations are 599, AF-608, MS-106, MS-107 required, plant procedures require the positioning Closed valves - AF-3869,AF-3871, MS-106A, MS-107A of the three-way suction valve (MU-3971) to the BWST suction source, fully opening the makeup SFRCS ACTUATION #1 OTSG LOW PRES flow control valve, and the starting of both SURE makeup pumps.

Open valves - AF-360, AF-388, AF-3869, AF-3872, AF The high-pressure injection pumps (HPI) are 599, MS-106A, MS-107 a part of the emergency core cooling system and Closed valves- AF-608, AF-3870,AF-3871, MS-106, MS 107A are not in service during normal operations. The system consists of redundant pumps and four SFRCS ACTUATION #2 OTSG LOW PRES injection paths into the cold legs of the RCS. The SURE pumps receive their suction from the BWST and have a shutoff head of 1630 psig. When these Open valves - AF-360, AF-388, AF-3870, AF-3871, AF pumps are used in the feed and bleed mode of 608, MS-106, MS-107A core coolinig, both pumps are started, and the Closed valves - AF-3869, AF-3872, AF-599, MS-106A, discharge ofthe low-pressure injection pumps can MS-107 be aligned to the HPI pump suctions as described below.

The SFRCS is described in more detail in section 16.1.6. The low-pressure injection (LPI) pumps are also a part of the emergency core cooling systems.

16.1.5 Makeup/High-Pressure Injection The LPI pumps receive a suction from the BWST Cooling Systems and discharge via the decay heat removal coolers (not shown in Figure 16-5) into the reactor vessel.

16-4 Rev 0896 USNRC Technical Training Center Technical Training Center 16-4 Rev 0896

SIn-e,1yf -"-;canino 4-n"re Mannual ,t Davis-Besse Loss of All Feedwater U2.i~~~~

ncdr~~uflil nu2 ~u ai-BseLs fA edae The pumps are rated at 3000 gpm with a discharge AFW system. The SFRCS also provides output "pressure of approximately 150 psig. The shutoff signals to the turbine trip system and to the head of the, pumps is about 200 psig. -Plant Anticipatory Reactor Trip System (ARTS).

procedures allow the discharge of the LPI pumps to be aligned to the suction of the HPI pumps by "Inthe event of loss of MFW pumps or a main opening valves DH-62 and DH-63:. This '

feedwater line rupture, the OTSGs would start to alignment increases thedischarge pressure of the boil dry, and, if action is not initiated promptly, HPI pumps from 1630 psig to approximately 1830 there would be no motive steam available for the psig and 'allows HPI flow at a higher:RCS turbine-driven AFW -system and the OTSGs pressure. would be lost as heat sinks. As soon as the MFW pump discharge pressure falls below the pressure When the feed and bleed mode of core cooling in the OTSG (i.e., reverse differential pressure is required, plant procedures call for starting the across a check valve) by a predetermined value, makeup pumps and the high-pressure injection the SFRCS provides safety actuation -signals to pumps., After the pumps are in service, the close the main steam isolation valves (MSIVs),

"pressurizer pilot-operated relief valve, the pres close the MFW stop and control valves, and start surizer vent, and the hot leg vents are opened. AFW. The SFRCS also receives OTSG low level The HPI/LPI piggy-back mode of operation is not signals which, are diverse from the 'reverse specifically addressed in the loss of subcooling 'differential pressure signals.

margin or the overheating sections of plant procedures but may be aligned at the discretion of In the event of steamline pipe ruptures, when the operator. All the required feed-and-bleed the main steam pressure drops, the SFRCS will alignments are performed in the control room. . 'close both MSIVs and the MFW stop and control "valves. The description of the ýSFRCS in the 16.1.6 Steam and Feedwater Rupture Updated Safety Analysis Report (USAR) Section Control System (SFRCS) 7.4.1.3 does not mention the SFRCS closure (or re-opening) of the AFW containment isolation The steam and feedwater rupture control valves (AF-608 and AF-599), although the design also system (SFRCS) is provided in the plant design as .does include such features. -The AFW is trains are aligned to draw an engineered safety features system for .initiated and both AFW feed only to, the postulated transient or accident conditions arising 'steam only from, and to provide generally from the secondary (steam generation) - uhaffected "intact" OTSG.-,

'.side of the plant, because the OTSGs serve as the reactor coolant heat sinks for the reactor power. The SFRCS -* - In the event of loss of all four senses loss of main feedwater (MFW),flow, pumps (RCPs), forced cooling flow of the reactor rupture of an MFW line, and rupture of a'main coolant system would be lost and AFW flow is steamline. It also senses loss of all forced coolant needed to enhance, natural circulation flow.

flow in the primary system., . "

Therefore, the -SFRCS senses the loss of, four RCPs and automatically initiates AFW..

The safety function' of the SFRCS 'is to provide safety actuation signals to equipment that ' Figure 16-6 depicts the channelization of the

-will:, isolate thesteam flow from the OTSGs, SFRCS. There are two Actuation Channels, each isolate the MFW flow, and start and align the of which contains two identical logic channels.

USNRC Technical Training Center Technical Training Center 16-5 16-5 -.itev Kev uo 0896

I B&W Crosstraining Course Manual 5sv~-t taa tJSJa u. nj wcuater Within each Actuation Channel, one logic channel The controls for the PORV include features is ac powered and the other logic channel is dc for automatic operation, manual open, manual powered. The field wiring at the actuated close, and lock open. In automatic, the pressure equipment is such that generally both logic channel's bistable would close one set of contacts channels must "trip" (i.e., a two-out-of-two AND above the high pressure setpoint (2425 psig) and logical arrangement) to actuate most equipment, would close another set of contacts below the low which is referred to as a "full trip." However, pressure setpoint (2375 psig). When the high some equipment is actuated by a "half trip" (i.e., pressure setpoint is reached, the control relay is only one logic channel ofan actuation channel has energized and an electrical seal-in circuit is tripped). For example, the atmospheric steam energized. When the low setpoint is reached, an vent valves are closed by "half trips." auxiliary relay is operated which in turn interrupts the valve-open seal-in circuit.

16.1.7 Pressurizer Pilot Operated Relief Valve In manual control, the circuit is designed for momentary-only operation of the switch to the At the top of the pressurizer as shown in valve-open position. The seal-in circuit will hold Figure 16-1, there are two code' safety valves the valve open if the pressure is above the low which vent directly to the containment pressure setpoint. To lock open the PORV (as atmosphere, a high-point vent line, and the pilot would be done for MU/HPI cooling), the manual operated relief valve (PORV) with its associated control switch would be rotated to the "lock open" upstream block valve. position. The control circuitry would maintain the PORV solenoid energized regardless of RCS The PORV block valve is a manually pressure. To manually close the PORV, the controlled motor-operated valve, equipped with control switch must be rotated to the "auto" position instrumentation including a position position and the control switch pushed inward.

alarm. This action causes, both control relays to be deenergized and the seal-in circuit to be The PORV is a style HPV-SN solenoid-con deenergized, which in-turn causes the PORV trolled pilot-operated pressure relief valve manu solenoid to be deenergized.

factured by the Crosby Valve and Gage Company.

It was the Incident Investigation Team's (liT) The indicators for the PORV include: control understanding that Davis- Besse is the only B&W power available (blue), automatic (white), PORV designed PWR that has a Crosby PORV. The open (red), PORV close (green), and lock open Crosby PORV is operated by the reactor coolant (amber). The PORV open/close lights are system pressure via a solenoid-operated pilot operated by a limit switch operated by the PORV valve and therefore does not- involve any solenoid plunger (i.e., the output of the electric pneumatic power (instrument air or nitrogen). solenoid; the mechanical input to the PORV). All Electric power is used for the solenoid control of these position lights, are PORV command device. To actuate the' PORV, the solenoid is indicators, in that they indicate only the position energized. This action allows the use of reactor that the electric controls have commanded for the coolant system pressure to open the main disc of PORV. Only the acoustic monitor is a direct the valve. indicator of the flow condition through the PORV/block valve path.

16-6 Rev 0896 USNRC USNRC Technical Training Center Technical Training Center 16-6 Rev 0896

' Davis-Besse Loss of All Feedwater S

B&W CrosstraininL2 Course ManualDas-esLosoAlFedte The acoustic monitor *for'the PORV wa, expertise from either onsite or offsite was at a installed as one of the post-TMI safet3 'minimum.

improvements.- Two redundant accelerometei sensors are mounted on -the discharge piping In view of the importance of the operator Each sensor channel provides a signal to drive the actions, the narrative of the event which follows is remote 0-100% (open) PORV position meter or Sbaised upon a composite of the operator interviews "thepost- accident monitoring (PAM) panel, ancI performed by the (IIT). The narrative is written to an adjustable positionsignal switch to drive thc reflect the operators' descriptions of their actions, remote PORV open/closed lights -on the PAN observations, and thoughts during the event. The panel. The IIT was told that the adjustable switcl SIIT decided that this would best convey the effects was set such that the red (open) light would bN of stress, training, experience, teamwork, and energized if the flow signal is greater than 22% o:f impediments on operator performance. There are the full flow value. .-undoubtedly lessons to be learned about what "operatorsare likely to do during a serious event If PORV/block valve flow is less than 22% which, are not easily summaiized, but which the red (open) light would be turned off and the perhaps can be inferred from the descriptions of green (closed) light would ,be energized.- Th( what occurred during this particular event.

-" meter could be .used to obtain more precis(

position/flow information. The Post-Acciden t 16.2.1 Shift Change

"-Monitoring, (PAM) panel is a separate pahe mounted about 7 ft to the left of where'the reacto:r On June 9, 19859 the midnight shift of operator assigned to the primary system would b(e operators assumed control of the Davis-Besse standing. "Both redundant red/green POR\,7 nuclearpowerplant. The oncoming shift included

'indicating lights are easily visible to the operato r four licensed operators, four equipment operators, "ifheturns his head. However, the 0-100% meter s an auxiliary operator, and an administrative assis are relatively small, i.e., about a 3-inch tal1 tant. The shift supervisor and assistant shift vertical edge-mounted meters. To read this meter , supervisor were the most experienced members of the operator would have to step a pace or tw( the operating crew. Both were at the plant before toward the PAM panel. it was issued an operating license in April 1977.

The two reactor operators, who were responsible 16.2 Event Narrative for the 'control room;, had decided .between

'themselves who would be responsible for the

, This detailed description of the Davis-Bessi primary-side and who would take the secondary

• loss-of-feedwater event focuses attention on thi side work station. The secondary-side operator operator actions which prevented a potentiall: y had been a licensed reactor operator for about two serious event,' both in terms of safety and eco - years; the primary-side operator was licensed in nomics, from occurring. From their norma .1 January 1985.

"operating routine, the operators were plungei abruptly into a high stress situation reluirin,g The shift turnover on June 9 was easy-there complicated responses outside the control roomi. were no ongoing tests or planned changes to the Furthermore, these "activitiesunfolded early on. a plant status. The ,plant was operating at 90 Sunday morning -when additional technicatl percent of the full power authorized in the license granted by the NRC in April 1977, to minimize 16-7 Rev WS9b USNRC Technical Training Center USNRC Center , 16-7 Rev 0896

.B&W Crosstrainin2 Course Manual Davis-Besse Loss of All Feedwater B&W Crosstrainina Course Manual Davis-Besse Loss of All Feedwater the potential for an inadvertent reactor trip (i.e., 16.2.2 Reactor Trip - Turbine Trip shutdown) due to noise on primary coolant flow instrumentation. The assistant shift supervisor entered the control room and was examining one of the All the major equipment control stations were consoles when he noticed that main feedwater in automatic except the No. 2 main feedwater flow was decreasing and that the No. 1 main pump. As a result, the integrated control system feedwater pump had tripped (Figures 16-7 thru instruments were monitoring and controlling the 16-9 trace the major primary and secondary balance between the plant's reactor coolant system parameters and will be 'referred to for the and the secondary coolant system. remainder of this discussion). Since the No. 2 feedwater pump was in manual control, it could Since April 1985, there had been control prob not respond to the integrated control system lems with both main feedwater pumps. Trouble demand automatically to increase feedwater flow.

shooting had neither identified nor resolved the problems. In fact, a week earlier, on June 2,1985, The "winding down" sound of the feedwater both feedwater pumps tripped unexpectedly after pump turbine was heard by the reactor operator in a reactor trip. After some additional the kitchen, and by the administrative assistant troubleshooting, the decision was made to not and the shift supervisor, both of whom were in delay startup any longer, but to put instrumenta their respective offices immediately outside the tion on the pumps to help diagnose the cause of a control room. They headed immediately for the pump trip, if it occurred again. As a precaution, control room-the event had begun.

the number two main feedwater pump was operating in manual control to prevent it from The secondary-side reactor operator ran to his tripping and to ensure that all main feedwater station and immediately increased the speed of the would not be lost should the reactor trip. No. 2 main feedwater pump to compensate for the decrease of feedwater flow from the No. 1 pump.

During the first hour of the shift, the The primary-side operator had already opened the operators' attention and thoughts were directed to pressurizer spray valve in an attempt to reduce the examining the control panels and alarm panels, pressure surge resulting from the heatup of the and performing instrument checks and routine reactor coolant system due to a decrease in surveillances associated with shift turnover. Thus, feedwater flow.

at 1:35 in the morning, the plant generator was providing electricity to the Ohio countryside. The The plant's integrated control system secondary-side operator' had gone to the kitchen attempted automatically to reduce reactor/turbine where' he joined an equipment operator for a power in accordance with the reduced, feedwater snack. The other reactor operator was at the flow. The control rods were being inserted into operator's desk studying procedures for the core and reactor power had been reduced to requalification examinations. The assistant shift about 80 percent. At the same time the primary supervisor had just left the kitchen on his way side reactor operator held open the pressurizer back to the control room after a break. The shift spray valve in an attempt to keep the reactor supervisor was in his office outside the control coolant pressure below the high pressure reactor room performing administrative duties. trip setpoint of 2300 psig (normal pressure is 2150 psig). However, the reduction of feedwater and USNRC Technical Training Center 16-8 Rev 0896

JD.t11 d- *. *aa.*. P-a ana D2.'I V~nV~dDavis-Besse

• .,1...n(nurcD Loss of All Feedwater subsequent degradation of heat removal from the safety valves closed as expected. The system primary coolant system caused the reactor to trip, response was looking "real good" to the shift on high reactor coolant pressure. The operators supervisor.

had done all they could do to prevent the trip, but the safety systems had acted automatically to shut The assistant shift supervisor in the meantime down the nuclear reaction. opened the plant's looseleafemergency procedure book. (It is about two inches thick, with tabs for The primary-side operator acted in accordance quick reference. ,The 'operators refer to-it as the NRC refers to with the immediate post-trip actions specified in emergency procedure 1202:01; the emergency procedure that he had memorized. it as the ATOG procedure - Abnormal Transient

, Among other things, he checked that all control Operating Guidelines.) *As he read aloud the rod bottom lights were on, hit ,the' reactor trip immediate actions specified, the reactor operators After phoning

- (shutdown) button, isolated letdown from the were responding in the affirmative.

reactor coolant system, and started a second the shift technical advisor (STA) come to the to makeup pump in anticipation of a reduced pres control room, the administrative assistant began were saying, surizer inventory after a normal reactor trip. Then -ýwriting down what the operators he waited, and watched the reactor coolant although they were speaking faster than she could pressure to see how it behaved.- write..

The secondary-side operator heard the turbine 16.2.3 Loss of Main Feedwater stop valves slamming shut and knew the reactor had tripped. This "thud" was heard by most of the' Although the assistant shift supervisor was equipment operators who also recognized its loudly reading the supplementary actions from the meaning, and two of them headed for the control emergency procedure book, the shift supervisor room. Almost simultaneously, the secondary-side heard the main steam safety valves open again.

operator heard the loud roar of main steam safety He knew from experience that something was valves opening, a sound providing further proof unusual and instinctively surveyed the control that the reactor had tripped. The lifting of safety console and panels for a clue., He discovered that valves after a high-power reactor trip was normal.-: both main steam ,isolation valves (MSIVs) had closed-the first and second a list of Everything was going as expected'as he waited

,of and watched the steam generator water levels boil, unexpected equipment performances and failures down-each should have reached the normal post-, that occurred during the event.

trip low-level limit of 35 inches onthestartup

-level instrumentation and held steady. The secondary-side operator was also aware that something was wrong because he noticed that The shift supervisor joined the operator at the the speed of the only operating main feedwater secondary-side control console and watched thes pump was decreasing. After verifying that the rapid decrease of the steam generator levels. The status of.the main feedwater pump turbine was rapid feedwater reduction system (a subsystem of "normal,he concluded that the turbine was losing

-the integrated control system) 'had -closed the steam pressure at about the same time that the Sstartup feedwater valves, but as' the -level shift supervisor: shouted that ,the MSIVs were

'approached the low level limits, the startup valves closed. All eyes then turned up to the opened to hold the level steady.. The main steam annunciators at the top of the back panel. They U~~ ;nQQ1<

USNRC Technical Training Center 1 16-9* IX*¥ UI37*

I

ýB&W Crosstraining Course Manual B&W...............Course Manual ¢ f1,v - ,*k T1 -e nf/ All V oA,.,n #l.

saw nothing abnormal in the kind or number of He went to the manual initiation switches at annunciators lit after the reactor trip. The the back panel and pushed two buttons to trip the operators expected to find an alarm indicating that SFRCS. He inadvertently pushed the wrong two the Steam Feedwater Rupture Control System buttons, and, as a result, both steam generators (SFRCS, pronounced S-FARSE) had activated. were isolated from the emergency feedwater Based on their knowledge of previous events at supply. He had activated the SFRCS on low the plant, they believed that either a partial or full pressure for each steam generator instead of on actuation of the SFRCS had closed the MSIVs. low level. By manually actuating the SFRCS on However, the SFRCS annunciator lights were low pressure, the SFRCS was signalled that both dark. The MSIVs had closed at 1:36 a.m. and generators had experienced a steamline break or they were going to stay closed. It normally takes leak, and the system responded, as designed, to at least one-half hour to prepare the steam system isolate both steam generators. The operator's for reopening the valves. anticipatory action defeated the safety function of the auxiliary feedwater system-a common-mode The No. 2 main feedwater pump turbine, de failure and the third abnormality to occur within 6 prived of steam, was slowly winding down. Since minutes after the reactor trip.

the MSIVs were closed and there was limited steam inventory in the moisture separator The operator returned to the auxiliary reheaters, there was inadequate motive power to feedwater station expecting the AFWS to actuate pump feedwater to the steam generators. At about and to provide the much-needed feedwater to the 1:40 a.m. the discharge pressure of the pump had steam generators that were boiling dry. Instead, dropped below the steam pressure, which he first saw the No. I AFW pump, followed by terminated main feedwater flow. the No. 2 AFW pump trip, on overspeed-a second common-mode failure of the auxiliary 16.2.4 Loss of Emergency Feedwater feedwater system and abnormalities four and five.

He returned to the SFRCS panel to find that he The secondary-side operator watched the had pushed the wrong two buttons.

levels in both steam generators boil down; he had also heard the main steam safety valves lifting. The operator knew what he was supposed to Without feedwater, he knew that an SFRCS do. In fact, most knowledgeable people in the actuation on low steam generator level was nuclear- power industry, even control room imminent. The SFRCS would actuate the auxil designers, know that the once-through steam iary feedwater system (AFWS), which in turn generators in Babcock & Wilcox-designed plants would provide emergency feedwater to the steam can boil dry in as little as 5 minutes; consequently, generators. He was trained to trip manually any it is vital for an operator to be able to quickly start system that he felt was going to trip automatically. the AFWS. There could have been a button He requested and received permission from the labeled simply ,"AFWS-Push to Start." But shift supervisor to trip the SFRCS on low level to instead, the operator had to do a mental exercise conserve steam generator inventory; i.e., the to first identify a signal in the SFRCS that would AFWS would be initiated before the steam indirectly start the AFW system, find the correct generator low-level setpoint was reached. set of buttons from a selection of five identical sets located knee-high from the floor on the back panel, and then push them without being distract-16-10 Rev 0896 USNRC Training Center Technical Training USNRC Technical Center 16-10 Rev 0896

I; - Davis-Besse Loss of All Feedwater S..

R&W Crnsstrainini Course ManualDai-esLosfAlFedtr ed by the numerous alarms and loud exchanges of had now suffered its'third common-mode failure, information between operators. thus increasing the number of malfunctions to seven within 7 minutes after the reactor trip (1:42 The shift supervisor quickly determined that a.m.).

• "Kthe '~alves in the AFWS were improperly aligned.

'He reset the SFRCS,'tfipped it on low level, and 16.2.5 Reactor Coolant System Heatup corrected the operator's error about one minute

.- after it 'occuried. - This action commanded the Meanwhile, about 1:40 a.m., the levels in both SFRCS to realign itself such that each AFW pump steam generators began to' decrease below the delivered flow to its associated steam generator. normal post-reactor-trip limit (about 35 inches on Thus;had both systems (the AFWS and SFRCS) the startup range). The feedwater flow provided "operatedproperly, the operator's mistake would by the No. 1 main feedwater pump had terminat have had no significant consequences on plant ýed.' The flow, from the No. 2 main feedwater safety. pump was decreasing because the MSIVs were closed; which isolated the main steam supply to The assistant shift -supervisor, meanwhile, the pump. With decreasing feedwater flow, the continued reading aloud from- the emergency effectiveness of the steam generators as a heat "procedure. i"He, had reached 'the point in the sink for removing decay (i.e., residual) heat from

";supplementary fictions that require verification the reactor coolant system rapidly decreased. As that feedwater flow was available. However, the levels boiled down through -the low-level "therewas no feedwater, not even from the AFWS, setpoint (the auxiliary feedwater should automati a safety systeni'designed to provide feedwater in cally initiate ,at about 27 inches), the average the situation that existed. (The Davis-Besse temperature ofthe reactor coolant system began to emergency plan identifies such a situation as a .',increase, indicating a lack of heat transfer from Site Area Emergency.) -Given this condition, the, the primary to the secondary coolant system.

procedure directs the operator to the section When the operator incorrectly initiated SFRCS on entitled, "Lack of Heat Transfer." -He opened the - low pressure,-all feedwater was isolated toboth procedure at the tab corresponding to this, steam generators. The reactor coolant system condition, but left the desk and the procedure at began to heat up because heat transfer to the steam this point, to diagnose why the AFWS had failed. ,.generators -was essentially lost due to-,loss of "Heperformed a valve alignment verification and

• steam generator water level.

found that the isolation valve in each AFW train had closed. Both valves (AF-599 and AF-608) ',The average, reactor coolant -temperature Shad failed to reopen automatically after the shift, increased at the rate of about 4 degrees Fahrenheit supervisor had reset the 'SFRCS. 'He -tried -per minute for about ,12 minutes. - The system unsuccessfully to open-the valves with the' "pressurealso increased steadily until the operator pushbuttons on the back panel. -He went to the fully opened the pressurizer spray valve (at about SFRCS cabinets in the back of the back panel to 1:42 a.m.). The spray reduced the steam volume clear any trips in the system and block them so in the pressurizer and temporarily interrupted the that the isolation valves -could open. However, pressure increase. The pressurizer level increased there were 'nosignals keeping the valves closed. . rapidly, but the pressurizer did not completely fill He concluded that the torque switches in the valve 'with water.- As the indicated level exceeded the

,:operators must have tripped. The AFW system 16-11

• Rev IJ1Yb Technical Training USNRC Technical Center Training Center 116-11 -- Rev 0896

B&W Crosstraininu Course Manual Davis-Besse Loss of All Feedwater B&W Crosstraining Course Manual Davis-Besse Loss of All Feedwater normal value of 200 inches, the control valve for sidelines watching their fellow operators trying to makeup flow automatically closed. gain control of the situation.

At this point, things in the control room were The safety-related AFW equipment needed to hectic. The plant had lost all feedwater; reactor restore water to the steam generators had failed in pressure and temperature were increasing; and a a manner that could only be remedied at the number of unexpected equipment problems had equipment locations and not from the control occurred. The seriousness of the situation was room. The affected pumps and valves are located fully appreciated. in locked compartments deep in the plant.

16.2.6 Operator Actions The primary-side reactor operator directed two of the equipment operators to go to the auxiliary By 1:44 a.m., the licensed operators had ex feedwater pump room to determine what was hausted every option available in the control room wrong-and hurry.

to restore feedwater to the steam generators. The main feedwater pumps no longer had a steam The pump room, located three levels below supply. Even if the MSIVs could be opened, the the control room; has only one entrance: a sliding steam generators had essentially boiled dry, and grate hatch that is locked with a safety padlock.

sufficient steam for the main feedwater pump One of the operators carried the key ring with the turbines would likely not have been available. padlock key in his hand as they left the control The turbines for the AFW pumps had tripped on room. They violated the company's "no running" overspeed, and the trip throttle valves could not be policy as they raced down the stairs. The first reset from the control room. Even if the AFW operator was about 10 feet ahead of the other pumps had been operable, the isolation valves operator, who tossed him the keys so as not to between the pumps and steam generators could delay unlocking, the auxiliary feedwater pump not be opened from the control room, which also room. The operator ran as fast as he could and inhibited the AFWS from performing its safety had unlocked'the padlock by the time the other function. The likelihood of providing emergency operator arrived to help slide the hatch open.

feedwater was not certain, even if the AFW pump overspeed trips could be reset and the flow paths The operators descended the steep stairs established; for example, there was a question as resembling a ladder into the No. 2 AFW pump to whether there was enough steam remaining in room. They recognized immediately that the trip the steam generators to start the steam-driven throttle valve had tripped (Figure 16-10). One pumps. Unknown to the operators, the steam operator started to remove the lock wire on the inventory was further decreased because of handwheel while the other operator opened the problems controlling main steam pressure. The water-tight door to the No. 1 AFW pump. He also number of malfunctions had now reached eight. found the trip throttle valve tripped and began to remove the lock wire from the handwheel.

Three equipment operators had been in the control room since shortly after the reactor The shift supervisor had just dispatched a third tripped. They had come to the control room to equipment operator to open AFW isolation valves receive directions and to assist the licensed AF-599 and AF-608. These are chained and operators as necessary. They were on the locked valves, and the shift supervisor gave the 16-12 Rev 0896 Technical Training Center USNRC Technical USNRC Center 16-12 Rev 0896

B&WA Crosstrainin~Cou e Manual Davis-Besse Loss of All Feedwater locked-valve key to the operator before he left the January 1985,' the SUFP had been isolated by control room., He paged a fourth equipment' closing four manual valves, and its fuses were operator over the plant commimications systems ;removed from the motor control circuit. This and directed him also to open valves AF-599 and -isolation was believed necessary because of the AF-608. Although the operators had to go to a -consequences of a high-energy break of the non different room for each valve, they opened both "seismic grade piping which passes through the valves in about 3-1/2 minutes. They were then two seismic-qualified AFW pump rooms. Prior to directed to the AFW pump room. January 1985,- the SUFP could be initiated from the control room by the operation of a single As the operators ran .to the equipment, a switch. ,.

variety of troubling th6ughts ran through their minds. One operator was uncertain if he would be The assistant shift supervisor headed ýfor- the able to carry out the task that he had been directed turbine building, where he opened the four valves "todo. He knew that the valves he had to open and placed the fuses in the pump electrical were 16cked valves, and that they could not be switchgear. This equipment is located at four operated manually without a key. He did not have different places;- in fact, other operators had a key and that concerned him. As he moved walked through the procedure, of placing the through the turbine building, he knew there were SUFP in operation and required 15 to 20 minutes

-numerous locked doors that he would have to go to do it. The assistant shift supervisor took about through to reach the valves. He had a plastic card '4 minutes to perform these activities. -He then to get through the card readers, but they had been paged the control' room from the AFW pump known to break and fail., He did not have a set of room and instructed the secondary-side operator to door keys,-and he would not gain'access if his key start the pump and align it with the No. I steam card broke, and that concerned him too.' 'generator. -,

'The assistant shift supervisor came back into The two equipment operators in the AFW the control console area after having cleared the pump rooms had been working about 5 minutes to logic for the SFRCS and he tried again, reset the trip throttle valves when the assistant unsuccessfully,, to open the AFWS isolation shift, supervisor entered the room to check the valves. At this point, the assistant shift supervisor. SUFP. The equipment operators thought that they made the important decision to attempt to place had latched and opened the valves. However, the startup feedwater pump (SUFP) in service to - neither operator was initially successful in getting supply-feedwater to the steam generators. He the pumps operational. --Finally,, after one

-wentto the key locker for the key required to

• equipment operator had tried everything that the perform one of the five operations required to get knew to get the No. 1 AFW pump operating, he the pump running. left it and went to the No. 2 AFW pump, where the'other operator was having the same problem The SUFP is a motor-driven pump, usually - of getting steam to the turbine. Neither operator more reliable than a turbine-driven pump, and

• had previously performed the task that he was at more importantly, it does not require steam from tempting."

the steam generatorsito operate. -The SUFP is

"*located in the same compartment as the No. 2 The assistant shift supervisor went over to "AFW pump. -But since the refueling outage in assist the equipment operators and noticed Rev 1)896 Center Technical Training Center USNRC Technical , -- , *16-13 16-13 SRev 0896

B&W CrosstraininL, Course Manual .Davis-Besse Loss of All Feedwater B&W Crosstrainin! Course Manual Davis-Resse Loss of All Feedwater immediately that the trip throttle valves were still While the operator was away from the closed. Apparently, the equipment operators had primary-side ,control station, the pressurizer only removed the slack in attempting to open the PORV opened -and closed twice without his valve. The valve was still closed, and the differ knowledge. The pressure had increased because ential pressure on the wedge disk made it difficult of the continued heatup of the reactor coolant to turn the handwheel after the slack was re system that resulted when both steam generators moved, thus necessitating the use of a valve had essentially boiled dry.

wrench. A third, more experienced operator had entered the pump room and used a valve wrench According to the emergency procedure, a to open the trip throttle valve on AFW pump No. steam generator is considered "dry" when its

2. Without the benefit of such assistance, the pressure falls below 960 psig and is decreasing, or equipment operators may well have failed to open when its level is below 8 inches on the startup the trip throttle valves to admit steam to the pump range (normal post- trip pressure is 1010 psig and turbines. post-trip level is 35 inches). The instrumentation in the control room is inadequate for the operator The third equipment operator then proceeded to determine with certainty if these conditions to the No. 1 AFW pump trip throttle valve. The exist in a steam generator. The lack of a trend valve had not been reset properly, and he experi recorder for' steam generator pressure makes it enced great difficulty in relatching and opening it difficult to determine if the steam pressure is 960 because he had to hold the trip mechanism in the psig and decreasing., Therange of the steam latched position and open the valve with the valve generator level indicator in the control room is 0 wrench. Because the trip mechanism was not 250 inches, a scale which makes determining the reset properly, the valve shut twice before he 8-inch level difficult. The safety parameter finally opened the valve and got the pump operat display system (SPDS) is intended to provide the ing. operators with these critical data, but both channels of the SPDS were inoperable prior to and 16.2.7 PORV Failure during this event. Thus,- the operators did not know that the conditions in the steam generators Prior to being informed by the assistant shift beginning at about 1:47 a.m. were indicative of a supervisor that the SUFP was available, the "dry" steam generator, or subsequently, that both secondary-side operator requested the primary steam generators were essentially dry.

side operator to reset the isolation signal to the startup feedwater valves in preparation for starting When both steam generators are dry, the the SUFP. In order to perform this task, the procedure requires the initiation of makeup/high operator left the control console and went to the pressure injection (MU/HPI) cooling, or what is SFRCS cabinets in back of the control room. As called the "feed-and-bleed" method for decay heat he re-entered the control panel area, he was removal. Even before conditions in the steam requested to reset the atmospheric vent valves. As generators met these criteria, the shift supervisor a result of these activities, the primary-side was fully aware that MU/HPI cooling might have operator estimated that he was away from his been necessary. .When the hot-leg temperature station for 20 to 30 seconds. (In fact, he was away reached 591°F-(normal post-trip temperature is for about two minutes.) about 5507F), the secondary-side operator recommended to the shift supervisor that MU/HPI 16-14 Rev 0896 USNRC Technical Training Center Technical Training Center 16-14 I Rev 0896

.B&W Croistraininp, Course Manual Davis-Besse Loss of All Feedwater

- R&W Crnstrainin Course Manual Davis-Besse Loss of All Feedwater cooling be initiated. At about the same time, the ,. In fact, the PORV had not completely closed operations superintendent told the shift supervisor and, asa result, the pressure decreased at a rapid in a telephone discussion that if an auxiliary rate for about 30 seconds.

feedwater pump was not providifig cooling to one

/ steam generator within one minute, to prepare fort The operator did not know that the PORV had MU/HPI cooling. However, the shift, supervisor failed. He believed that the RCS depressurization "didnot initiate MU/HPI cooling. He waited for was due either to the fully open pressurizer spray

.the equipment oplerators to recover the auxiliary valve -or to the feedwater flow to the, steam "feedwater system.: generators. He closed the spray valve and the PORV block valve as precautionary measures.

The shift supervisor appreciated the economic But subsequent analyses showed that-the failed consequences of initiating MUJHPI cooling. One PORV was responsible for the rapid RCS

-operator described it as a drastic action. During' -depressurization.' Two minutes later, thereactor MU/HPI,' the PORV and the high point vents on operator opened the PORV block valve to ensure the reactor coolant system are locked open, which. "thatthe PORV was available: Fortunately,' the breaches one of the plant's radiological barriers. PORV had closed during the time the block valve Consequefitly,, radioactive 'reactor coolant is . was closed. The failed PORV was the ninth "released-inside the containment building.", The "*-abnormality that had occurred within 15 minutes

• plant would have to be shut down for days for - after reactor trip.

"cleanup 'even if MU/HPI cooling was successful.

Inaddition, achie'ing cold shutdown could be 16.2.8 Steam Generator Refill

'delayed. Despite his delay, the shift supervisor acknowledged having confidence in this mode of At about 1:50 a.m. the No. 1atmospheric vent

"-core cooling based on his simulator training; he valve opened and depressurized the No. 1 steam would have initiated MU/HPI cooling if"it comes generator to about 750 psig when ,the SFRCS to that." signal was reset by the primary-side operator. The atmospheric vent valve for the ,No. 2 steam "The primary-side operator returned t6o his generator had been closed by the secondary-side station and began monitoring the pressure in the operator before the SFRCS signal was reset. The pressurizer,' which was near the PORV setpoint indicated No. 1 steam generator level was less (2425 psig). The PORV then opened, and he :than 8 inches. The corresponding pressure and watched the pressure decrease. The indicator in indicated level in the No. 2 steam generator were front of him signaled that there Was a closed about 928 psig and 10 inches, respectively. The signal to the PORV and that it should be closed. indicated levels continued to decrease until the The 'acoustic monitor installed after the'TMI secondary-side operator started the SUFP after accident was available to hirii'to verify that the .being informed by the assistant shift supervisor PORV was 'closed, -but, he did not-look at it. that it was available and after the other operator Instead, he looked at the indicated. pressurizer had reset the isolation signal to the startup level,- which appeared steady, and based on feedwater valves.

"simulatortraining,he concluded that the PORV was closed.., Although the ,flow capacity of the SUFP is somewhat greater, approximately 150 gallons per minute (gpm) were fed to the steam generators nonr Center USNRC Technical Training Center '16-15

• 16-15 . KCYUOD Rev 0896

B W Crosstrainin. Course Manual Davis-Besse Loss of All Feedwater because the startup valves were not fully opened. intermittent failures of the plant communication Essentially all the feedwater from the SUFP was station in the room.

directed to the No. 1 steam generator. At about 1:52 a.m., the pressure in the No. 1 steam With feedwater flow to the steam generators, generator increased sharply, while the indicated the heatup of the reactor coolant system ended. At water level stopped decreasing and began slowly about 1:53 a.m. the average reactor- coolant to increase. Since there was little feedwater sent temperature peaked at about 592°F, and then to the No. 2 steam generator, its condition did not decreased sharply to 540'F in approximately 6 change significantly. minutes (normal post-trip average temperature is 550'F). Thus, the reactor coolant system experi The trip throttle valve for the No. 2 AFW enced an overcooling transient caused by an pump was opened by the equipment operators at excessive AFW flow from the condensate storage about 1:53 a.m. After the SFRCS was reset and tank. The overfill of the steam generators caused tripped on low level by the shift supervisor, the the reactor coolant system pressure to decrease AFWS aligned itself so that each AFW pump towards the safety features actuation system would feed only its associated steam generator; (SFAS) setpoint of 650 psig. To compensate for i.e., the No. 2 AFW pump would feed the No. 2 the pressure decrease, and to avoid an automatic steam generator. Thus, the No. 2 AFW pump SFAS actuation,, at approximately 1:58 a.m., the refilled the No. 2 steam generator, and its pressure primary-side operator aligned one train of the increased abruptly to the atmospheric vent valve emergency core cooling system (ECCS) in the relief set point. The turbine governor valve was piggyback configuration. In this configuration the fully open when the trip throttle valve was discharge of the low-pressure injection pump is opened, and the pump delivered full flow for aligned to the suction of the high-pressure about 30 seconds until the operator throttled the injection pump to increase its shutoff head flow down. pressure to about 1830 psig. At about the time the train was actuated, the combination of pressurizer The No. I trip throttle valve was opened by heaters, makeup flow, and reduction of the AFW the equipment operator about -1:55 a.m., and flow increased the reactor coolant pressure above feedwater from the AFWS flowed to the No. 1 1830 psig. -As a result, only a limited amount (an steam generator. However, the No. 1 AFW pump estimated 50 gallons) of borated water was was not controlled from the control room but injected into the primary system from the ECCS.

controlled locally by the equipment operators.

At 1:59 a.m., the No. 1 AFW pump suction The equipment operators controlled the pump transferred spuriously from the condensate storage locally using the trip throttle valve. One operator tank to the service water system (malfunction manipulated the valve based on hand signals from number 10). This action was not significant, but the operator who was outside the No. 1 AFW it had occurred before and had not been corrected.

pump room communicating with the control room Similarly, a source range nuclear instrument operator. For two hours the AFW pump was became inoperable after the reactor trip controlled in this manner by the operators. Their (malfunction number 11) and the operators task was made more difficult from the time they initiated emergency boration pursuant to first entered the AFW pump room by the procedures. (Note: One channel had been inoperable prior to the event.) The source range 16-16 Rev 0896 USNRG USNRC Technical Training Center Technical Training Center 16-16 Rev 0896

ý Davis-Besse Loss of All Feedwater

-1Q C, oo a,.,wd -n-ncC urse*.. n. ia - L o l w instrumentation had malfunctioned previously and, take proper action or human failure that results in apparently had not been properly repaired. Also, an improper action. In this event, an operator the control room ventilation system tripped into error occurred when the SFRCS 'was manually its emergency recirculation mode (malfunction initiated. Failure to recover after a system failure number 12), which had also occurred prior to this has occurred is demonstrated by the failure of the event. auxiliary operators to correctly reset the overspeed trips on the auxiliary feedwater pump turbines. In The steam generator water levels soon contrast to these two errors is the almost heroic exceeded the normal post-trip level, and the actions that were performed by the assistant shift operator terminated AFW flow to the steam supervisor. This individual attempted to reset the generators. The subcooling margin remained SFRCS so that auxiliary feedwater could be adequate throughout this event. The event ended added to the steam generators, and aligned the at about 2 o'clock in the morning, twelve startup feedwater pump for service.

malfunctions and approximately 30 minutes after it began. A calculation ofconditional core vulnerability and core damage probabilities for this event was 16.2.9 PRA Insights performed and appears in NUREG/CR-4674, "Precursors to Potential Severe Core Damage Two major points concerning risk are evident Accidents: 1985 A Status Report." The dominant from this event. The first is the probability of sequence for core vulnerability has a probability the event tree for this sequence multiple equipment failures, and the second is a of 9.085E-03, and human reliability issue. is shown in Figure 16-11. .The dominant sequence for core damage has a conditional probability of One of the major insights gained from a PRA 4.680E-03, and the event tree for this sequence is is the risk associated with multiple failures of shown in Figure 16-12. Note that this sequence of the HPI feed and bleed. The plant systems. However, the assumption of. contains a failure multiple failures is usually criticized by the plant hesitancy of the °shift supervisor to initiate this staff as a series of incredible failures. This event system could have led to-this failure.

provides a very dramatic example. of the possibility of multiple failures. First, the loss of one main feedwater pump resulted in a transient that challenged plant systems. Next, multiple failures of safety-related systems-did occur. As discussed in this chapter, both AFW pump turbines, both AFW isolation ,yalves, -and the PORV failed to respond properly during the event.

This list does not include the actionsof the SFRCS system, the failure of a turbine bypass valve, and the loss of .source

• range instrumentation., .

One of the most difficult probabilities to include in a PRA is the failure of the operators to n

T,. nonai ett*v M USNRC Technical Training Center 16-17

-1 B&W Crosstraining Course Manual APPENDIX - SEQUENCE OF EVENTS Initial Conditions

• Unit operating at 90% power

• #1 MFP operating in automatic (ICS) control

• #2 MFP operating in manual control

• One source range NI inoperable

• Both channels of the SPDS inoperable Transient Initiator 01:35:00 #1 MFP trips. Control system causes MFP flow increase; MFP turbine trips on overspeed.

Partial Loss of Main Feedwater 01:35:01 Unit runback at 50%/mimn toward 55%.

01:35:21 Manual increase of #2 MFP speed. PZR spray valve opened to 100% in manual.

01:35:30 Reactor/turbine trip from 80% caused by high RCS pressure (2300 psig).

01:35:31 SFRCS low level trip - channel 2.

01:35:31 Both MSIVs start to close.

01:35:34 SFRCS actuation signal clears automatically.

01:35:36 MSIV #2 close.

01:35:37 MSIV #1 closed. The main steam supply to #2 MFP is isolated. Steam from the MSR and MS piping will drive the turbine for about 4-1/2 minutes.

01:35:45 PZR spray valve closed.

01:35:56 OTSGs on low level limits (35 in.).

01:40:00 OTSG levels begin to drop below low level limits.

Complete Loss of Main Feedwater 01:41:04 SFRCS OTSG #1 low level (26.5 in.) actuation. #1 AFW turbine being supplied with steam from and supplying feedwater to #1 OTSG.

01:41:08 Operator manually actuates SFRCS on low OTSG pressure. The low pressure actuation is in both SFRCS channels, and the system senses "steam ruptures" in both OTSGs. The following equipment changes due to the manual actuation:

1. #1 AFW turbine is aligned to be supplied from #2 OTSG.

2. #2 AFW turbine is aligned to be supplied from #1 OTSG.

3. #1 OTSG AFW containment isolation valve is automatically closed.

4. #2 OTSG AFW containment isolation valve is automatically closed.

5. The AFW cross-connect valves open.

USNRC Technical Training Center 16-18 Rev 0896

B.. WCr..tr.inin..Davis-Besse CourseMnual Loss of All Feedwater SEQUENCE OF EVENTS (continued) 01:41:13 SFRCS channel 2 low level trip. Pressure trip has priority.

01:41:31 #1 AFW turbine trips on overspeed.'

01:41:44 #2 AFW turbine trips on overspeed.

01:42:00 Manual reset of SFRCS. The AFW containment isolation valves should have re-opened automatically, but did not. An attempt was made to re-open the valves from the main control panel, but the valves did not respond.

01:42:00 PZR spray valve opened.

01:43:55 "Initiate reset and block" of SFRCS attempted in an effort to re-open AFW containment isolation valves. Valves did not open.

01:44: + Equipment operators dispatched to the plant to operate the following equipment:

"1. Two operators to the AFW turbines to restore AFW pumps to service.

"*

• 2,,The assistant shift supervisor left the control room to place the startup feed pump in

-service.

3. Two operators were sent to open the AFW containment isolation valves.

01:44:50 Makeup flow decreases as pressurizer level increases above the normal setpoint of 200 in.

01:45:50 #2 AFW turbine overspeed trip reset locally.

01:45:29 OTSG #1 atmospheric vent valve opened.

01:46:30 #1 AFW turbine throttle valve relatched and valve opened (overspeed trip not cleared).

Speed controlled locally throughout event 01:47:33 OTSG #1 below 960 psig and decreasing..

01:47:48 OTSG #2 AFW containment isolation valve opened locally.

01:48:08 OTSG #1 atmospheric vent valve closed.

01:48:49 PZR PORV opens at 2433 psig (2425 psig setpoint).

01:48:51 OTSG #2 pressure <960 psig and decreasing. Both OTSGs now "dried out." Procedures require MU/HPI core cooling. MU/HPI core cooling is also called "feed and bleed" core cooling.

01:48:52 PORV closed at 2377 psig. (2375 setpoint) 01:49:28 OTSG #1 AFW containment isolation valve opened manually.

01:50:09 PORV opens at 2434 psig.

01:50:12 PORV closes at 2369 psig. ,,

01:50:13 OTSG #1 atmospheric vent valve opened; OTSG pressure drops rapidly to 750 psig.

01:51:17 OTSG #1 level drops below 8 in. ,(MU/HPI cooling criterion) 01:51:18 PORV opens at 2435 psig and does not close.

01:51:23 Startup feedwater pump.motor started.

01:51:30 Obtained flow from startup feedpump to OTSG #1.

01:51:42 Operator started to close the PORV block valve as pressure fell through 2140 psig.

01:51:42 RCS loop #1,reaches a minimum ýpressure of 2081 psig. Loop #1 Thb0t588.6'F, Tave=587.5 0F.

01:51:43 PZR spray valve closed.

01:51:49 'Acoustic monitor indicates <20% flow through the PORV and PORV block valve.

0 01:53:00 Tho. reaches maximum value of 593.5 F.

"I

- USNRC Technical Training Center ., 16-19 -Rev 0896

B&W Crosstraining Course Manual Davis-Besse Loss of All Feedwater 01:53:22 AFW train #2 has significant flow, with control locally via the trip-throttle valve.

SEQUENCE OF EVENTS (Continued) 01:53:25 RCS Tave reaches maximum of 592.3°F.

01:53:25 RCS Tave reaches maximum of 592.3°F.

01:53:35 OTSG #2 returns to above 960 psig.

01:53:56 PORV block valve re-opened.

01:54:45 OTSG #1 returns to above 960 psig.

01:54:46 AFW train #1 has significant flow.

01:56:58 OTSG #2 atmospheric vent valve open. Pressure <960 psig.

01:57:05 OTSG #1 <960 psig.

01:57:53 Low suction pressure developed on #1 afw pump.

01:58: + Tave passed through the normal post-trip value. The cooldown (due to feedwater) has lowered RCS pressure to about 1720 psig. The operators have manually started #1 HPI pump in the piggy back mode of operation to maintain pressurizer level. About 50 gallons of water is injected.

01:58:08 RCS pressure reaches a minimum of 176 psig. Thot=546°F, Ta,,e=546.2°F.

01:58:27 AFW pump suction pressure returns to normal.

01:58:28 OTSG #1 atmospheric vent valve closed.

01:58:33 AFW flow to #1 OTSG reduced to control level.

01:58:40 AFW #1 suction transfers to service water. Manual realignment to CST.

01:58:57 AFW pump turbine overspeed trip reset.

02:01: + When AFW turbine #2 was returned to service, the control room operator controlled the pump in manual rather than returning it to auto.

02:01:13 AFW train #2 flow reduced.

02:02:27 OTSG #1 pressure >960 psig.

02:02:30 OTSG #2 pressure >960 psig.

02:04: Plant conditions essentially stable.

Additional Complications

"* Control room HVAC spuriously tripped to the emergency mode.

"* Upon energization, the remaining source range NI failed off-scale low. All control rods were verified to be fully inserted, and emergency boration was initiated.

"* The main turbine did not go on turning gear.

"* The operator attempted to override the automatic close signal for one of the SU reg valves, but a burned out light bulb prevented reset indication.

"* When vacuum was restored and the MSIVs opened, a water slug damaged one of the turbine bypass valves.

USNRC Technical Training Center 16-20 Rev 0896

PRESSURIZER (SEE INSERT)

AUX FEED INLET I HOT LEG SG M A INNT INLET I I I r:

SURGE LINE

,.REACTOR COOLANT .

PUMP COLDREACTOR LEG_ VESSEL RESSURIZER INSERT X

PORV AN[

SAFETY VALVE I (TYPICAL OF

-SPRAYNO2 ISPACE NORMAL WATIER, LEVEL L SUPPORTS (8)

THERMOWELL' LEVEL SENSING NOZZLE ,

(TYPICAL OF 3)

Figure 16-1 Davis-Besse NSSS

SAFETY I

I I VENT CONTAINMENT TO MAIN I "TURBINE I

1#1 OTSG TRIP TRIP THROTTLE THROTTLE GOVERNOR AFW AFW TURBINE TURBINE

1. 1 #2 SAFETY VALVE iI CONTAINMENT TO MAIN I MSIV TURBINE I ATMOSPHERIC VENT

DEAREATOR TANKS "11 PUMP

(.

TURBINE DRIVER FEED MAIN FEED PUMP MAIN MAIN FEEDWATER ci, FEED REGULATING BLO5 VALVE, 11 .p (D

0)

TO "OTSG #1 STARTUP FEEDWATER HIGH PRESSURE PUMP FEEDWATER HEATERS TO OTSG #2 NOTE: SYSTEM VALVES NOT INVOLVED IN THE EVENT OMITTED STARTUP REGULATING FOR CLARITY VALVE

SERVICE WATER TO OTSG #1 AF-360 AF 608

1. 1 FROM AF

-n CST 3869 CD CD CL x

CD c)

FROM AF

'.1 DEAREATOR 3871 09 CD TO OTSG #2 AF-388 AF AF 3872 599

1. 2 WATER

cl - .MU-32 (D

am (D

3t o0 HIGH PRESSURE DD H6 INJ ECT ION ,

RCS COLD LEGS 5 CoTO

1. TO CD 3

• _

• TOREACTOR

ACTUATION CHANNEL #1 REV. dp LOW PRESS.

RCP CD 0

"CD 0

Co Cl<

r 0

ACTUATION CHANNEL #2 INSTRUMENT SENSING CHANNELS

320- 620 I I I I ZoIuu 288- 610 - 2390

- RCS Pressure 256- 600 2280 "2 \/ - 10 a) '. .. '/\/._2 -2170 224 5 a)

CD_0. a)

' , t "*2060 a) 0.

0 -*

0 "" ,

E E,

a)

- 160 < 570 - ,ZC1950

' N "'C 0 C'V; 3n cn 128 - co-0,560 -/ ,,- 1840 0 nl L ,6/ RCS Temperature \80

= 0 96-,,, CDa 550 \/ ,,

D-1730 ,

C4 Pressurizer Level .-. -1620 2- 540--1510 5 0 IIIIIIII I t 1400 AM 1:35:31 1:38:31 1:41:31 1:44:31 1:47:31 1:5U:01 1:b3:01 1:06:01 1:59:31 2-:u4;0I Time

250 1200 f 1500 225 1080 1350

- 960 0.

200 E 1200 0 0L CL

-. l C U1)

S175 ,9840 LL 1050 co 75 a) ci, 0ca)

CD z (D c -1150 - _720 U 900 L, M

CD Q 0

ca ca.

0 (D c

C (D 125 a 600 II 750 (I) 0 Auxiliar 0 (D E E I 0

CD ca, cu) a) 100 u480 - i ci 600 (9 0CD 0 0 E E 3 ca, ci,

• 0 M

U)

, 75 E 360 ai) 450 a CD z C 0 0 CD

-0 E E 50 240 -- Startup Feedwater F 300 z z:

25 120 Level 150 0 0 0 0 AM 1:35:31 1:38:31 1:41:31 1:44:31 1:47:3 '50:31 1:53:31 1:56:31 1:59:31 2:02:31 Time

. I 1200 1500 250 r-225 - 1080 1350 I- 960 4 1200 0 200 0.

0 C:

a) cn 1050 (D

175 - 0.840 CD ci) z a)

A 720 -1900 U 150 [-

a)

CD 0 ca, 125 - 0.

a) a)

a)

G),

( 480 ca CD 0 100 - :3 a)

CD E E360 0,

-0 E 75- 30 z CD z a, CD CD 50- 240 c,)

120 25!- 150 0

0 I -I I I ' ,-.

AM 1:35:31 1:38:31 1:41:31 1:44:31 1:47:31 1:50:31 1:53:31 1:56:31 1:59:31 2:02:31 Time

-TRIP HOOK REPOSITION SPRING

-Trip Hook Latch-Up Valve Trip Manual Mechanism Trip LINK Turbine Tnp Mechanism Steam In Steam

- To Turbine Figure 16-10 Trip Throttle Valve

BABCOCK AND WILCOX CROSS TRAINING MANUAL CHAPTER 17 ANO-1 Seal Failure

I B&W Crosstraining Course Manual ANO-I Seal Failure TABLE OF CONTENTS 17.0 ANO-1 REACTOR COOLANT PUMP SEAL FAILURE 17.1 Introduction ......................................................... 17-1 17.2 Event Description .................................................... 17-1 17.2.1 Seal Failure and Power Reduction .................................... 17-1 17.2.2 Increased Seal Leakage and HPI Initiation .............................. 17-1 17.2.3 Plant Cooldown ................................................... 17-1 17.3 Failure Analysis ..................................................... 17-2 17.4 Corrective Actions ................................................... 17-3 17.5 Similar Event - Oconee 2 (1/74) ......................................... 17-3 17.6 PRA Insights ........................................................ 17-4 Appendix - Sequence of Events .................................................. 17-5 I17-i 7-i Rev 0896 USNRC Technical Training Center Technical Training Center Rev 0896

F. -, ANO-lSeal Failure in JP.luyr

,t 9-J3Ma *

• ; ; 1---a manuol 17.0 ANO-1 REACTOR COOLANT. reduction to minimize RCS inventory losses.

PUMP SEAL FAILURE, Sixty-two minutes after the power reduction was started, the turbine-generator was removed from Learning Objectives: .service. One minute later, the "C" RCP was stopped.- Three minutes later, 'the reactor was

1. Describe how control room instrumentation manually tripped from 10% power.

can be used to determine RCP seal failures.

17.2.2 Increased Seal Leakage and HPI Initi

2. -Explain the different methods that can be used - ation to initiate high pressure injection.

"Afterthe "C" RCP was stopped, the RCS leak

• 3. Explain why isolation of the core flood tanks rate increased to an estimated 250-300 gpm. Four is necessary during a plant cooldown. actions were taken in response to-the increased leakage.- First, high pressure injection was manu "17.1, " Introduction 'ally placed in service by starting two makeup 2

pumps, opening the four high pressure injection

-Arkansas Nuclear One, Unit 1 (ANO-1) is a valves, and opening the suction valves from the 177 fuel assembly B&W designed plant with a* "borated water storage tank (BWST). Note that core rating of 2568 Mwt. --The unit is equipped these actions could have been accomplished by with Byron Jackson reactor coolant pumps driven pressing the manual initiation pushbuttons.

"by9000 hp, 6900vac, 3-phase induction motors. However, all the ESF equipment associated with "The design, electrical output of, the unit is 850 high pressure injection (e.g., diesel-generators,

-Mwe. Priorto the loss of the RCP seal, the unit service water, LPI etc.) would also have been

-was operating at 86% power with all parameters realigned. The second action that was taken was

, "ithin their normal operating ranges. the operation of the RCP oil lift pumps. The lift pumps were started and stopped four times in an

17.2 Event Description ,effort to change the radial alignment of the seal package. After the fourth lift pump start, a de 17.2.1, Seal Failure and Power Reduction. crease in the RCS leak rate was observed. The next action was the isolation of the seal return While performing an RCS inventory balance, path from the "C" RCP. The final action involved the control room operators observed a step de- increasing the seal injection flow to the failed seal.

crease in makeup tank level. Seal pressures and This action was taken to quench the steam/water seal flows confirmed that a problem existed with that was leaking by the seal. Reactor building the "C" RCP seal. Since the leak rate exceeded pressure had increased from 14.7 psia to 15.2 psia,

• technical specification limits, an orderly shutdown confirming the RCS leakage. The reactor building of the plant was initiated., -The initial rate of emergency coolers -were placed in service to power'reduction was 5%/minute, andthe initial reduce containment pressure.

leak rate was between 10 and 20 gpm. During the power reduction, an increase in the leak rate was 17.2.3 Plant Cooldown observed, and the rate of power decrease was .. , - -

increased to approximately 20 to 30% per minute. . After the seal leakage from the C" RCP had RCS letdown was isolated during the power .. been reduced, one of the operating makeup (HPI) 17-1 Key UO USNRC Technical Training Center Technical Training Center

• 17-1 Rev U5yo

I I .1.... AN(*-1 Seal Failure B&W Crosstrainin. Course Manual.............. "

pumps was stopped and the HPI valves were shut. placed in service, and all four RCPs were stopped.

Normal makeup was established from the BWST As a result of the seal failure and cooldown, with two makeup pumps in service. The"A" RCP approximately 60,000 gallons of water was col was stopped in preparation for a plant cooldown. lected in the reactor building basement.

A plant cooldown was initiated at a rate of 75 0 F/hour. 17.3 Failure Analysis Due to the relatively high RCS cooldown rate, The cartridge-type shaft seal consists of an the operators did not reach the remote controls to upper, middle, and lower stage. These three bypass the steam line break instrumentation stages are cooled by seal injection coolant provid control (SLBIC) system prior to reaching the 600 ed by the normally operating RCS makeup pump psig setpoint on the "B" loop. When SLBIC and by the integral heat exchanger which is cooled actuated, the "B" MSIV closed and the steam by the component cooling water system. The driven emergency feedwater pump started. The stages are in series, and each stage is designed to "A" loop did not reach the SLBIC setpoint at this be capable of withstanding RCS operating pres time. Steam header pressure was controlled by sure so that a single stage failure could be detected cycling the "B" loop MSIV. After raising the "B" and appropriate operator action completed in a loop steam pressure above 600 psig the SLBIC timely manner without incident or consequential function was bypassed; however, the header failure of the remaining two stages. On examina pressure was increased to approximately 650 psig, tion of the failed "C" pump seal package, how which reset SLBIC and removed the bypass. ever, all three stages were found to be severely damaged. The upper stage experienced the most Consequently, "A" loop had SLBIC actuation damage. The stationary carbon ring had disinte when steam header pressure was decreased to the grated; it appeared to have been ground into 600-psig setpoint. The steam header pressure was carbon particles and washed away. It is believed again increased and SLBIC reset. This time, that this carbon ring breakdown was the initial SLBIC was successfully bypassed and the steam failure; the loss of this ring probably resulted in pressure was dropped below 600 psig without the other two stages shifting upward, causing SLBIC actuation. About two and a half hours into subsequent breakage of the carbon ring in each of the event, the emergency feedwater pump was the other two stages.

stopped, and the auxiliary feedwater pump was placed in service. The failure of the upper stage carbon ring was postulated to have occurred from either excessive As RCS pressure was decreased, a contain wear or fatigue due to compression. The mecha ment building entry was made to isolate the core nism or conditions leading to the ultimate failure flood tank (CFT) discharge valves. The entry was of the ring are not positively known. It has been necessary to prevent the CFTs from discharging as postulated that either excessive axial movement or the RCS pressure decreased below the 600 psig improper seating of the seal cartridge led to wear N2 pressure in the CFTs. However, some water or failure by compression.

discharged from the tanks during the-time opera tors took to isolate the discharge valves.The RCS cooldown was essentially complete eight hours after the seal failure. Both DHR loops were 17-2 Rev 0896 USNRC Technical Training Center Technical Training Center 17-2 Rev 0896

"-'ANO-1 Seal Failure D tL,,i ITUA1 a. U, 17.4 Corrective Actions the loose parts monitor (RCP 2B2) prior to shut down of RCP 2B2.

"First, all four-RCP seal -packages'were re placed., The CFT isolation valve breakers were Three minutes after the manual isolation of relocated to a motor control center outside of the seal flow, the operator commenced a load reduc reactor building. Finally,-all leakage was repro tion from 22% power. The turbine was taken off cessed for use in the RCS, thus requiring no liquid the line within 12 minutes.. The reactor was releases as a result of the seal failure. manually tripped from 15% full power and system cooldown was started.

17.5 Similar Event - Oconee 2 (1/74)

' Fourteen minutes-after the reactor :trip, an

-A leak was discovered by an operator in the 1 operator entered the RB to investigate the cause of

1/2 inch seal 'injection line to reactor coolant the fire monitor and RCP oil catch tank level pump 2A1 between the seal injection stop valve alarms. He reported steam blowing around the S'and the seal injection throttle valve. About three RCP 2B2 seals and no visual indication of fire.

'and a'half hours later'the seal injection flow to Fire monitor, oil catch tank level and quench tank RCP 2A1 was secured to repair the leak. Due to -'-high pressure alarms were -due to this leaking

'steam. .

loundary valve leakage, seal flow (-1.5 gpm) to RCP 2A1 continued, and the leak could 'not be Fourteen hours from the discovery of the seal "repaired.' The total seal flow control valve was

.'closed to secure flow to all 4 RCP's and permil leak, a unit cooldown was in progress, with the repair of the leak, but leakage continued. RCS pressure at -700 psig. Depressurization of the core flood tanks was initiated by bleeding the After 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />,;the seal injection flow wa. nitrogen to the quench tank instead of to the vent waste gas filter, as is normally done.

stopped completely by closing a manually operat.- header or ed isolation 'valve. *The following events werc Venting to the waste gas filter or vent header have required operation of 2 valves located recorded by the plant computer over the next 1(i Would min. period: RCP 2B2 Seal Inlet Temp. Hi in the RB basement, and these valves were inac the seal leakage collecting there.

-' -'(217.14°F), RCP 2B2 Seal Leakoff (Return) Flov I cessible due to

!.In the process of venting the core flood tanks to Hi (1.75 gpm), Quench Tank Press. Hi, RCP 2B3 tank, the, quench tank ' became "SealLeakoff Flow 1.28 gpm, RCP 2B2 Seal Inle t the quench and its rupture disk blew out, Temp. 344.31°F, RCP 2B2 Off, RCP 2B2 Sea 1 overpressurized Return Closed, RCP 2B2 Seal Inlet .Temp severing the impulse line on pressurizer level bending the stem on the impulse 363.91°F, etc. RCP 2A1 Seal Inlet Temp. Hi instrumentation, line root valve,,.thus,preventing isolation of the 186.651F, RCP Motor 2B2 LWR Air Temp. Hi.-

damaging the insulation on the bottom 187°F, Quench Tank Level Hi 90.05 in., RCP Sea I leak,'and P and side of the pressurizer.

Filter DP Hi, RCP 2A1 Leakoff 1.4 gpm, RC]

Motor 2B2 Upper Air Temp. Hi 188.32°F, ani When the RCP seal failed, it allowed primary Reactor Manual Trip. In addition, alarms wer e coolant water to flow to the floor of the contain received from the reactor building (RB) fir e building. The leakage persisted for -10 to monitor, RCP 2B2 oil catch tank level, RCP 2B 1 , ment n 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> at a rate of-90 gpm, resulting in a total oil catch tank level (overflow from 2B2), and o

-leakage of -50,000 gal. In order to reclaim the

'17-3 zv

'.--. uou none USNRC Technical Training Center

• 17-3 Rev U876 USNRC Technical Training Center

I B&W Crosstraininz Course Manual ANO-I Seal Failure ii ANO-1 Seal Failure water rather than process it as waste, they allowed and Wilcox indicates an engineered safeguards it to flow to the containment floor where it HPI actuation signal due to low RCS pressure may reached a maximum depth of-12 inches. Equip not be generated following some LOCAs < 1.2 ment was to be examined for possible damage inches in diameter. This sequence assumes an prior to plant startup. ESFAS signal will not be generated prior to core uncovery, and the the operator must initiate the Radioactivity in the water was 7 x 10-3 mCi/ml system.

gross beta and 5 x 10-3 mCi/ml gross gamma.

Reactor water level was maintained with one of An important insight realized from the analy the available makeup pumps, each of which has a sis of this sequence is that a possibility exists for capacity of 300 gpm; and no difficulty was en failing one ofthe three HPI pumps, given a LOCA countered with the plant cooldown. of 1.2 inches in diameter. During normal opera tion, one of the pumps is operating and takes a 17.6 PRA Insights suction from the makeup tank to perform -the function of makeup and purification. (This same The failure of reactor coolant pumps seals is pump is realigned to take suction from the BWST one of the leading contributors to core melt upon an ESFAS signal to perform ECCS func frequencies at ANOL. According to their PRA, tions.) Upon a small LOCA, the pressurizer level the contribution to core melt frequency from this and pressure would begin to decrease, and auto initiator is 4.4 E-6/Rx-yr. matic control actions will cause the makeup flow control valve to go fully open and the pressurizer RCP Seal Failure Seauence heaters to turn on. Calculations indicate that the pressurizer heaters will remain covered for an This sequence is initiated by a reactor coolant extended period and thus maintain RCS pressure pump seal rupture or a rupture in the RCS in the well above the ESFAS actuation setpoint. The break range of 0.38 inches in diameter to a break calculations also indicate that the makeup tank diameter of 1.2 inches, followed by failure of the would empty prior to uncovering the pressurizer high pressure injection system. Containment heaters. The makeup tank is estimated to empty failure is predicted by one of the following: (a) within approximately 14 minutes after LOCA containment overpressure due to hydrogen burn initiation or about 10 minutes after the low ing, (b) penetration leakage, or (c) base mat melt makeup tank alarm. Upon dryout of the makeup through. tank, it is assessed that the operating HPI pump will fail in a short time.

This sequence assumes a small LOCA occurs followed by a failure of the high pressure injection system (HPI). Containment systems would oper ate as designed to control the atmosphere, but failure of the core cooling system would lead to boil off of the water covering the core.

The dominant failure mode of the HPI is predicted to be failure of the operator to initiate the system. Information received from Babcock Center 17-4 Rev 0896 Technical Training USNRC Technical USNRC Training Center 17-4 Rev 0896

"ANO-I Seal Failure u*.,

Rtrw *.v*.........i.I*v Crrnstriininq .............Manual Coiurse AO1Sa alr APPENDIX - Sequence ofEvents ANO-1 RCP Seal Failure - May 10, 1980 Initial Conditions The unit was operating at 86% with all parameters in their normal range. An inventory balance of the RCS was in progress.

Time Event 0145 The reactor operator observes a step decrease in makeup tank level.

(0) RCP "C" Seal Failure diagnosed. RCS Leakage 20 gpm.

Power reduction at 5%/min. initiated.'

0214 Unit loads transferred to offsite power.

(+29 min) 0220 Letdown igolated.

(+35 min) .,

0225 Extra operations staff called in to aid in placing the unit Cold Shutdown.

(+40 min) 0227 NRC Emergency Response Center and resident inspector notified.

(+42 min) Increase in leak rate observed. Increased reduction rate to 20%-30%/min.

0247 Generator off line.

(+62 min) 0248 RCP "C" stopped. RCS leakage increases to -250-300 gpm.

(+63 min) 0250 Reactor manually tripped from 10% power. Manually started 2 additional

(+65 min) makeup pumps. Opened all HPI MOVs. Cycled "C" RCP lift pumps four times. After 4th start of lift pumps, RCS leakage decreases. Started RCS cooldown 0254

(+69 min) Isolated RCP "C" seal return. Increased seal injection flow to quench steam from failed seal. RB pressure increases from atmospheric pressure to 15.2 0256 psia.

(+71 min)

Placed RB emergency coolers in service.

_ _ - 1- uorld*n 17-5 ., - i. ney UaOY USNRC Technical Training Center

B&W Crosstrainine Course Manual ANO-I Seal Failure B&W Crosstrainins Course Manual ANO-1 Seal Failure APPENDIX - Sequence of Events (continued)

Time Event 0301 Stopped RCP "A".

(+76 min) 0305 Stopped "C" makeup pump, closed all HPI MOVs, established normal makeup

(+80 min) with 2 makeup pumps with suction supply from BWST.

"B" OTSG Steamline Break Isolation and Control (SLBIC) actuation at 600 psig due to high RCS cooldown.

Steam driven EFW pump starts.

Raised header pressure to >600 psig.

Bypass SLBIC.

Steam pressure>650 psig, SLBIC automatically resets.

SLBIC actuated on low pressure (<600 psig)

Raised header pressure to >600 psig.

SLBIC successfully bypassed.

0320 Steam driven EFW pump stopped. Aux. Feedwater pump placed in service.

(+95 min) 0800 Containment entry to power up and close CFT outlet valves.

(+375 min) CFTs inject some water prior to isolation.

0900 Unit in cold shutdown

(+435 min) 17-6 - Rev 0896 Technical Training Center USNRC Technical Center 17-6 -Rev 0896

BABCOCK AND WILCOX CROSS TRAINING MANUAL CHAPTER 18 Three Mile Island

I B&W Crosstrainine Course Manual Three Mile kland TABLE OF CONTENTS 18.0 THREE MILE ISLAND 18.1 Introduction (Figure 18-1) ............................................... 18-1 18.2 Loss of Feedwater - March 28, 1979 ..................................... 18-2 18.2.1 4:00 AM (Figure 18-2) ............................................. 18-2 18.2.2 4:08 AM (Figure 18-3) ............................................. 18-4 18.2.3 5:00 AM (Figure 18-4) ............................................. 18-6 18.2.4 6:00 AM - 8:00 PM (Fig. 18-5) ...................................... 18-8 18.2.5 8:00 PM (Figure 18-6) ............................................ 18-12 18.3 M ajor Issues ....................................................... 18-13 18.3.1 Natural Circulation ............................................... 18-13 18.3.2 Reactor Coolant Pump Operation .................................... 18-15 18.3.3 Hydrogen Generation ............................................. 18-16 18.3.4 Radiation Release Paths (Figure 18-7) ................................ 18-17 18.4 A nalysis ........................................................... 18-21 18.5 References ......................................................... 18-22 Appendix - Sequence of Events ................................................. 18-22 LIST OF FIGURES 18-1 Three Mile Island 18-2 T= 0 Minutes 18-3 T = 8 Minutes 18-4 T=IHour 18-5 T=2Hours 18-6 T=16Hours 18-7 TMI Radiation Release Path USNRC Technical Training Center USNRC Technical Training 18-i Center Rev 0896 18-i Rev 0896

nk~eW d .. #-*.;~nit Cnympc MamnuuaI Three Mile Island 18.0 THREE MILE ISLAND was about 2800 lb/min while the net makeup rate from ECC injection ,was an order of magnitude Learning Objectives:. less. The system pressure fell below 1300 psig at J15 min and remained at approximately. 1100 psig 1- Explain how a loss of feedwater resulted in a until 101 min., when the last two primary coolant reactor trip and subsequent LOCA. pumps were shut down in response to indications of pump cavitation. The first sign of core un

2. Describe -.the major radiation release paths covery began at-about.110 min. -when thermo which occurred at TMI-2. couples in the hotlegs indicated the steam boiling "out of the core was ,superheated. .Thesystem

3. -Describe the decay heat removal methods used pressure decreased'to a minimum of about 650 Sat TMI-2 during the transient. psia at about the time the coolant leakage was stopped at 140 min. Also,, during -this period

., 4. Explain Which parameters are used and how >between 110 and 140 min., thermocouples above they indicate decay heat removal by natural the core and the self powered neutron detectors circulation (or loss of natural circulation). (SPND) began to indicate temperatures in the 1000'F range, source range-, core power level

-5. List the operational conditions which enhance monitors began to read high in response to in natural circulation. Include which systems creased neutron flux from the uncovering core,

-may. be operated different from normal and high radiation levels were observed in coolant conditions. - samples and in the containment building as the result of fission product release from the over

6. List the sources of hydrogen and oxygen heated core.

within the primary system and contain

- "ment. When the coolant leakage was stopped at about 140 min, the system pressure began to

7. Determine which RCS parameters can be used increase. At about the time reactor coolant pump as, possible indications of boiling (steam "2B" was temporarily turned on at 174 min, the formation) within the system. system pressure increased rapidly to over 2000

• psi. ECC injection was significantly increased at

• ,18.1 Introduction (Figure 18-1)

• about 200 min. (March calculations indicate the core remained covered after 3.5 hrs.) Over the The accident at TMI-2 began March 2, 1979 al next 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br />, the primary system pressure varied 4 o'clock in the morning. The initiating event was between about 2200 and 550 psi in response to a loss of feedwater to the steam generators. The -changes in the ECC injection rate and the opening S'resulting ofheat transfer ,from the degradation and closing of the block valve in the line of the

-primary system caused an increase in pressure ancI stuck relief valve. Containmentbuildingtempera shutdown of the reactor. The pilot operated relielF tures and pressure generally responded as ex

- valve (PORV) on the pressurizer opened at thi e pected to whether the relief valve line was open or setpoint of 2255 psig in response to the increase irI- closed. -. At about 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />, the containment primary system pressure:-. The.coolant leakagt epressure briefly increased by 28 psi, indicating a through the open PORV continued until about 14( containment hydrogen burn. During most of the min later when a block valve was closed. Th( first 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> ofthe accident, the pressurizer water coolant leakage rate during most of this periocI -level indicated a full pressurizer. Under normal 1RI .. . Rev 0896 USNRC Technical Training Center

- I B&W Crosstraining Course Manual Three Mile Island conditions, this would be an indication that the cease to operate. The automatic valves will not primary system was water-filled. open until two conditions have been met: (a) the emergency pumps are delivering their normal 18.2 Loss of Feedwater - March 28, 1979 discharge pressure (at least 875 psig) and (b) the water level in the steam generators is 30 inches or 18.2.1 4:00 AM (Figure 18-2) less.

At 4:00 a.m. on March 28, 1979, TMI-2 was In addition to the automatic valves, there are operating between 97% and 98% full power. The block valves in the lines to the steam generators.

shift foreman and two auxiliary operators had These valves are required to be open while the been working in the auxilia'ry building on the No. plant is operating. At the time of the accident, 7 condensate polisher. Two licensed control room however, the block valves were closed. The operators were on duty in the control room: The closed indication of these valves, which was shift superintendent was in his office adjacent to shown on an indicator light in the control room, the control room. was not noticed by the operators.

The condensate polishers use ion exchange On loss of feedwater followed by turbine trip, resins for purification of the feedwater (Figure 18 the energy removed from the steam generators 1). During operation, flow through the resin bed was less than the energy added by the reactor, and tends to compact the material into a rather solid the pressure in the reactor coolant system (RCS) mass. To transfer the resin beads to the resin ,increased. The pressure increase began immedi regeneration system, it is necessary to break up ately.

this mass by blowing compressed air through it.

(Apparently, during this process water entered an To protect the RCS from excessive pressure, instrument air line through a check valve that had a pilot-operated relief valve (PORV) and two frozen in the open position.) safety valves are provided. Three seconds after turbine trip, the pressure in the RCS had increased It has been postulated that the water in the air to the point (2255 psig) at which the PORV piping caused the polisher inlet oroutlet valves, or opened. The reactor was still delivering power, both, to close. Closure of either the inlet or outlet and pressure continued to rise, although not as valves would interrupt the flow of feedwater and rapidly. Eight seconds after the turbine trip, the cause the condensate pumps and condensate pressure had reached the point (2355 psig) at booster pumps to trip, that is, to be automatically which the reactor is automatically shut down.

shut down. Tripping of these pumps causes triffing of the main feedwater pumps, which in Before the accident, leakage was higher than turn, causes tripping of the main turbine and usual, because a code safety valve, or possibly the electrical generator. PORV, was leaking. Leakage from the PORV went to the reactor coolant drain tank (RCDT)

The three emergency feedwater (EFW) pumps where it was condensed and was then pumped to (two ielectric-driven and one steam-driven) started the reactor coolant bleed tanks. The buildup of automatically within 1 second after the main water in the bleed tanks was then being trans feedwater pumps tripped. Water from the EFW ferred periodically to the makeup tank.

pumps is not normally delivered to the steam generators immediately after the main pumps I18-2 8-2 Rev 0896 USNRC Technical Training Center Technical Training Center Rev 0896

, , I Three Mile Island flA-W Crosstrainin~Course ManualTreMieIan o Ifnot compensated for, the expected shrinkage Unfortunately,, the meter showing this temperature of reactor coolant on cooldown could cause an "isin back of the main control panels and cannot excessive change of volume. To reduce the rate be seen from the normal operating position.

,of volume change, therefore, letdown is stopped "andmakeup is increased. Two minutes after, turbine trip, the RCS

-,pressure had dropped to 1600 psig. At this pres Ah indicator light in the control room shows sure, the engineered safeguards (ES) automatically

-when the PORV has been ordered to close - that actuate. The ES system is designed so that when is, when power to the valve opening solenoid is the RCS pressure drops -to this level; makeup cut off - but does not show when the valve actu *pumps "JA" and "IC" will start (if not already

" ally closes.. It is now known that the valve did - operating) makeup pump ."IB" will trip (if run "not,' if fact, close as it was designed to do. The ning), and the makeup valves will open to admit

',-operators; however, had no direct means of know the full output of the pumps into the RCS.

ing this.-By 28 seconds after turbine trip, the two conditions for 'admissionof emergency feedwater If the PORV had not been opened, it could not to the steam generators had been met, and the be expected that increased flow of makeup water "automatic valves should have begun to open. into the system would accelerate the rate of the Because the block valves were closed, of course, rise of the pressurizer level and cause the RCS no water could be admitted to the steam genera pressure to-begin to climb again. Uncontrolled

, tors even with the automatic valves open. It filling, of the pressurizer might cause it to fill.

" appeared to the operator that the automatic valves -. completely (pressurizer "solid"). Control of RCS

'were opening -atan unusually slow rate, and the

• pressure is lost with a solid pressurizer, and a very slow opening of these valves was initially attrib small temperature increase in the totally filled "utedto the delay in feeding the steam generators. system could cause the pressure to rise to the point

,where the safety.valves would open. The safety is not

-A second operator now noticed that the second -valves might have to be repaired, because it makeup pump had not started, and successfully "unusualfor safety valves to leak after being lifted.

started pump "lB." He also opened the makeup Operators are trained to avoid this situation.

"throttlingvalve to increase the amount of makeup Operating procedures require them to switch to flow. (This increased flow, along with reduced manual control and reduce makeup as soon as the letdown, apparently overcame the coolant con-.: pressurizer regains a normal level._,

"*traction.) ' . .

The operator bypassed the ES system and re Meanwhile, the condenser hotwell was - duced the makeup flow, but the pressurizer level "undergoingsome expected level fluctuations, first '- continued to increase rapidly. Pressure.,did not dropping to 21.7, inches, then rising to normal.- rise.and even began to move slightly downward.

Unknown to the operators, however, an air line to The reason for the anomaly of rising pressurizer the hotwell level controller. was broken, appar- level and decreasing pressure was not recognized ently -by a "water hammer"- during the initial by the operators. Trained to avoid a solid pres transient. The operators were unable to regain surizer, they stopped makeup pump "IC" and control of hotwell level, increased letdown flow to its high limit, thereby

-' -, temporarily arresting the rate of pressurizer level Very shortly thereafter, the temperature of the - increase.

water in the RCDT. had significantly increased.

USNRC Technical Training Center 18-3 , - Rev 0896

- I B&W Crosstraining Course Manual Three Mile Island B&W Crosstrainina Course Manual Three Mile Island Ifthe pressure dropped low enough for boiling these valves caused a rapid increase in steam to occur, control of the pressurizer level would pressure, which had previously dropped when the have become more difficult. The open PORV steam generators boiled dry, and a drop in RCS would reduce the pressure in the pressurizer steam temperature. The reason for the 14 minute lag in space. Steam forming elsewhere in the system recovery of the steam generator level is that would force more water through the surge line, emergency feedwater is sprayed directly onto the raising the pressurizer level. If the RCS pressure hot tubes and evaporates immediately. Evapora rose so that the water was no longer saturated, the tion raises steam pressure, but no water collects in steam bubbles in other parts of the system would the bottom until the tubes are cooled down.

be condensed, and the pressurizer level would fall.

In other words, the pressurizer level would be At the beginning of the accident, the computer controlled by steam formation, as well as by the alarm printout was synchronized with real time.

makeup and letdown system. At the same time, it The alarm printer can only type one line every 4 would have been difficult to regain a bubble by seconds, however, and during the accident; several using the heaters. The rate of energy loss through alarms per second were occurring. Within a few the PORV at the system pressure was many times minutes; the computer was far behind real time, greater than the energy added by the heaters. and the alarms being printed were for events that had occurred several minutes earlier.

The relief valve on the RCDT was opening intermittently after approximately 3-1/2 minutes. About 25 minutes after turbine trip, the opera Operation of this valve allowed the tank to over tors received a computer printout of the PORV flow into the reactor building sump- Operation of outlet temperatures. (The high temperature the relief valve was not noticed by the operators. 285'F - was. not perceived by the operators as RCDT parameters are displayed on a panel lo evidence that the PORV was still open. When the cated out of the operator's view. The level in the PORV opened in the initial transient, the outlet reactor building sump eventually got high enough pipe temperature would have increased even if the to cause a sump pump to be automatically turned PORV had closed as designed. The operators on. supposed that the abnormally slow cooling of the outlet pipe was caused by the known leak in the The reactor building sump is normally relief or safety valves. Actually, sufficient evi pumped to the miscellaneous waste holdup tank. dence of the failure of the PORV to reclose was It appears that at the time of the accident, now available: the rapid rise in RCDT pressure however, the reactor building sump pump was and temperature, the fact that the rupture disk had actually lined up to pump into the auxiliary blown, the rise in reactor building sump level building sump tank - which was already nearly (with operation of the sump pumps), and the full and had a broken rupture disk. Overflow of continuing high PORV outlet temperature. The the auxiliary building sump tank would cause PORV outlet temperature was read again at 27 overflow to go to the auxiliary building sump. minutes after turbine trip. The evidence of an open valve, however, was not interpreted as such 18.2.2 4:08 AM (Figure 18-3) by the operators.

At 8 minutes after turbine trip, the operator An auxiliary operator noticed that the reactor discovered that the emergency feedwater block building sump pumps were on and that the meter valves were closed and opened them. Opening showing the depth of water in the reactor building 18-4 Rev 0896 USNRC Technical USNRC Training Center Technical Training Center 18-4 Rev 0896

I Three Mile Island B&W Crosstraininp Course ManualTheMiesan sump was at its :high limit (6 feet). The back temperature, on the secondary side was not much

- ground 'radiation in the auxiliary building had lower'than that on the primary side. -.Reflux

- increased.- '(Although it was believed that the -circulation, therefore, would probably not have u-reactor bfiilding'sump pumps were discharging to been effective. Effective cooling might have been

'the miscellaneous waste holdup tank, the level in', maintained if the steam generators had been filled "theholdup tank had not changed. On the orders of to a high level and if the steam pressure had been the control room operator, with the shift supervi-' kept significantly lower than the RCS pressure.

sor's concurrence, the operator shut off the sump pumps.) The voids in the system also caused the neu tron detectors outside the core to read higher than The reasons for the problems with the reactor expected. Normally,, water sin" the downcomer coolant pumps were that steam bubble voids had annulus, outside the core but inside the reactor formed throughout the system when the pressure vessel, shields the detectors. Because this water was below the saturation pressure.-.'The system was now frothy, however, it was not shielding the pressure at the coolant pump inlets is required to detectors as well as usual. Not.realizing that the

.be rsignificantly -above the saturation pressure.!, -apparent increase in neutrons reaching the detec

'This requirement is called the net p6sitive suction: tors was caused by these voids, operators feared head (NPSH) requirement. *Ifthe NPSH require-. the possibility of a reactor restart. Although it can "mentis not met; vapor bubbles willform in the now be seen that their fears were unfounded, at

-lowest pressure regions on the suction side of the the time they were one more source of distraction.

pumps. The formation of vapor bubbles, called cavitation, could cause severe pump vibration, The emergency diesel -generators' had 'been which in turn could damage the seals and might running unloaded ever since ES actuation. These "even damage. the attached piping. Operators' diesels cannot be run *unloaded for long without ignored the NPSH requirement and left the reactor .damage. They cannot be shut down from .the coolant pumps operating as long as possible. Had control room, but must be locally tripped.* Once they not done this, more severe core damage could the diesels are stopped, the fuel-racks must be

'"have occurred. As long as the pumps provided reset so the diesels can be automatically restarted.

circulation,- even of froth, 'the core was being 'At 30 minutes after the turbine trip, the operator cooled. As soon as all the pumps were stopped, sent a man to the diesels to shut them down. The

_circulation'of coolant decreased drastically,' be fuel racks,, however, were not reset. -Failure to

"`*cause natural circuilation was blocked by steam. reset these racks could ,have 'had serious conse

'Somne circulation can beimaintained by refluxing. quences if offsite power had been subsequently In this type of flow, the water boils in the reactor lost,'because radioactivity restricted access to the vessel, and the steam flows through the hot legs, diesels. , "

-4

"iscondensed in the steam generators, and flows (as liquid water) back to the reactor vessel. For ;Voiding' throughout -the ,system- and the refluxing' to . occur, -a .-spray 'of emergency, .deteriorating performance of the reactor coolant feedwater muist be hitting the tubes,' or the water .,-pumps decreased the efficiency ofthe heat transfer

- level on the' secondary - side,'of the steam

'through the steam generators. The rate of boiling generators must be higher than the water level on was lower than usual, and operators found it the primary side and the temperature significantly difficult to keep the water level from creeping up.

cooler. The level in'steam generator A was low The condensers must be maintained at a vacuum (about 30 inches). -The steampressure, hence the ,'to operate efficiently, however, and condenser C- -1 8-5 - Rev.0896 USNRC Technical Training Center

B&W Crosstrainini! Course Manual Throo M;I* lcl*nd B&W MaualThir-rossraiin~ oure Mfl1a Teland vacuum was gradually being lost. If condenser there was still enough, mass flow in the vacuum were to drop below acceptable levels, the steam/water mixture to provide cooling, but not as condensate system would be automatically tripped much cooling as that provided when a large vol and an uncontrolled dump of secondary steam to ume of void-free water was circulating.. There is the atmosphere would occur. To prevent loss of no firm evidence of overheating at this time. The vacuum, operators deliberately shut down the open valve was reducing the inventory of water in condensate system 1hour after the turbine trip and the RCS, though, and the pressure was getting sought to maintain control over steam pressure by lower. Water continued to boil to remove decay controlling the atmospheric steam dump. heat; this boiling increased the amount of steam in the system and further impeded circulation.

18.2.3 5:00 AM (Figure 18-4)

A few minutes later, analysis of a sample of At the end of the first hour, the situation with reactor coolant indicated a low boron concentra which the operators were confronted had severely tion. This finding, coupled with that of apparently deteriorated: pressurizer level was high and was increasing neutron levels, increased operators' only barely being held down, the reactor coolant fears of a reactor restart. As explained earlier, the pumps were still operating but with decreasing supposed increase in neutron levels was spurious, efficiency, the condensate system was no longer appearing on the detector only because bubbles in operable, the reactor building pressure and tem the downcomer:were allowing more neutrons to perature were slowly increasing, the alarm com reach it. It is believed that condensed steam puter lagged so badly that it was virtually useless, diluted the sample.

and radiation alarms were beginning to come on.

At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, 20 minutes, an operator had the At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 11 minutes,, operators initiated computer print out the PORV (283*F) and reactor building cooling. Their action soon halted, pressurizer safety valve outlet temperatures and eventually reversed, the rise in reactor (21 iF and 219'F). Since there had been building temperature and pressure. The increasing essentially, no change in temperature in 55 temperature and pressure should have been a good minutes, the operators should have realized that indication that a small-break LOCA was in prog the PORV valve had not closed. Additionally, the ress. In fact, if the air cooling had not been initi letdown line radiation monitor began to increase.

ated, the reactor building would probably have It increased steadily to the full-scale reading. ,The been isolated (sealed off) shortly after this time. letdown monitor was notoriously sensitive, so that even minor changes in radioactivity would cause The operation of the reactor coolant pumps great variations in the reading.

was seriously impaired. High vibration, low flow, low amperage, and inability to meet NPSH The low steam pressure in steam generator requirements led the operators to start shutting "B" and the increase in reactor building pressure down pumps. At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 13 minutes, reactor were believed to be caused by a leak from the coolant pump "1B" was stopped, and pump "213" steam generator., At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 27 minutes, steam wvas stopped a few seconds later (pressurizer spray generator "B" was isolated (taken out of service).

comes from the A loop). With hindsight, it can be seen that the low pressure was simply caused by steam bubbles and Shutting down two pumps reduced the flow of a reduction of heat transfer in the "B" loop follow coolant through the reactor core. Apparently, ing stoppage of the pumps.

Training Center 18-6 Rev 0896 USNRC Technical USNRC Technical Training Center 18-6 Rev 0896

B&W Crosstraining Course Manual Three Mile Island The temperature of the RCS -coolant in all - refluxingj ivbuld be *ineffective because the primary system piping had been slowly increasing. secondary temperature was nearly as high as the

- Eventually, the primary side of steam generator A primary temperature.

got hot enough so that more steam was produced on the secondary'side, and the steam pressure The pressurizer is at a higher level than the beganto rise. The increased steamproductionhad

• reactor. It was assumed that the presence ofwater

-two side effects: '(1) the water level on the sec in the pressurizer meant that the core must be cov ondary side dropped and the steam generator ered. Actually, because the PORV was open, boiled dry for the second time, and (2) the in pressure in the upper part of the pressurizer was creased heat removal brought the RCS tempera reduced. The strong boiling that was occurring in ture down again. I the core, however, caused more steam to go into the upper part of the reactor vessel, and the pres The efficiency of the reactor coolant pumps sure there was increased., The difference of pres was still decreasing, and at 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 40 minutes; the sure forced the water level higher, in ,the frothy mixture became too` light to circulate. pressurizer than in the reactor vessel.

-Separation of the froth would have sent the steam

- to the high parts of the system, while water col Previous reports have alluded to a "loop seal,"

lected in the low parts. An analogy is a kitchen thus giving the false impression that the piping blender with the bowl half full of water. With the configuration alone somehow created this differ

-blender at high speed, enough air bubbles are ence of level.' Even with the loop configuration, whipped into'the water so that the b6wl is full. If to maintain a higher level in the pressurizer when the speed drops, the air bubbles are lost and the the water in the pressurizer is saturated, a higher lower half of the bowl is solidly filled with liquid pressure is required in the reactor than in the water. This was reflected in the behavior of the pressurizer. Ifthe pressures are equalized with the neutron instrumentation. Apparently -the down hot leg voided, the saturated pressurizer water comer, which had been previously filled with level would drop to the level of the connection of froth, now filled with water. The increased the pressurizer surge line into the hot leg.

,shielding stopped neutrons from reaching the Subcooled water could be maintained at a higher

-detector and the apparent neutron level dropped

• level. During most of the accident, the water in by a factor of 30. the pressurizer was slightly subcooled or saturat ed. During the time that the surge line was uncov subcooled.

Operators recognized that steam generator "A" ered, the water in the pressurizer was was dry, and in an attempt to regain water level, It was the combination of loop seal and tempera they increased feedwater flow. ". ture that kept the level high, rather than the loop

--seal alone. , .....

At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 41 minutes, both remaining reactor coolant pumps were stopped because of increasing At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 42 minutes, the decreasing level in vibration and erratic flow. The only heat transfer "thereactor vessel again reduced the shielding of through the steam generators was now achieved the neutron instrumentation, and the apparent neu by reflux flow. This was inadequate ,for core tron count increased by about a -factor of 100.

avert a cooling. It is 'now believed that the core was Emergency boration was commenced to drying out. The operators were hoping to estab --restart.

lish natural circulation in the primary system.

Natural circulation was blocked by steam; and18- ie a' USNRC Technical Training Center 18-7 -R*ev o~

-1 B&W Crosstraining Course Manual Three Mile Island ii Three Mile Island The hot-leg temperature now became decid As long as the upper part of the system con edly higher than the cold-leg temperature. Super tained only steam, the bubble could be condensed heated steam was present in the hot leg. The (collapsed) by increasing the pressure or decreas superheating of the hot leg showed that a fair ing the temperature. However, with large amount of the core was uncovered. It is impossi amounts of hydrogen in the system, these mea ble to superheat the hot leg without uncovering sures would, reduce the size of the bubble but the core. could never collapse it. The accident could not now have been reversed by simply closing the Although none of the instrumentation directly PORV and increasing makeup.

indicates to the operators that the saturation temperature has been reached or exceeded, a copy 18.2.4 6:00 AM - 8:00 PM (Fig. 18-5) of tables that show saturation temperatures as a function of pressure (the "steam tables") was At 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> into the accident, the pressure in available to them. loop A was 735 psig. The loop A hot-leg temper ature was actually 558'F - definitely superheated.

Up to this time, it might have been possible to The narrow, range, hot-leg temperatures went salvage the situation without extensive core dam offscale high, and cold-leg temperatures went age. If the PORV had been closed and full make offscale low.

up flow had been instituted, it might have been possible to fill the system enough so that a reactor The wide range temperature measurements coolant pump could be restarted. As the uncover were still available, although the narrow range ing of the core became more extensive, the oppor temperatures can be read more accurately and the tunity to reverse the tide dwindled. operators are in the habit of using them exclu sively. One meter shows average temperature, The upper part of the core was now uncov which is actually an average of the narrow range ered. The steam rising past the fuel rods gave indications. Average temperature shown at this some cooling, but not nearly as much as when time was 570'F, the average of the constant they were covered with water. The decay heat readings of 520'F and 620'F (lower to upper about 26 MW - was higher than the heat removed, limits). (This steady average temperature evi so the fuel temperature increased. dently convinced the operators that the situation was static). The operators now knew that there The fuel rods are clad with Zircaloy, an alloy was a problem. Natural circulation had not been of zirconium. Zirconium reacts with water to established, and they had been forced to turn off form zirconium dioxide and hydrogen. At the last RCP. At 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 15 minutes, the reactor operating temperatures, this reaction is extremely building air sample particulate radiation monitor slow and does not represent a problem. At higher went off scale. This was the first of many radia temperatures, however, the reaction goes faster. tion alarms that could definitely be attributed to It is believed that the temperature of the fuel rods gross fuel damage.

reached a point at with the reaction occurred rapidly, producing significant amounts of hydro A shift supervisor who had just come into the "gen. Furthermore, the reaction itself releases heat. control room isolated the PORV valve by closing Heat released from the reaction would have caus the block valve in the same line. Apparently, he ed the cladding to become hotter, driving the did this to see whether it would have an effect on reaction faster. the anomaly of high pressurizer level and low 18-8 Rev 0896 Training Center Technical Training USNRC Technical Center 18-8 Rev 0896

I, - Three Mile Island In. I IDAu d ;n uurpi- Mainual- he Ml Il steam pressure. The reactor building temperature a slug of water was forced into the downcomer by and pressure immediately began to decrease and "the momentary' running of pump "2B." The the pressure of the RCS increased. The shift boiling caused a rapid pressure rise and probably supervisor who had closed the block valve imme did considerable damage to the brittle oxidized

,diately recognized that a leak had been stemmed. cladding.

-. 'Leakage through the PORV had now been As a result of receiving several high radiation stopped, but there was still no way to get rid of the alarms within the plant,' a site 'emergency was decay heat, because 'there was virtually no declared and the local authorities notified. The "circulation through the steam generators. The letdown' sample lines had now been reported to r/hr),

• once-through steam generator ("A" OTSG) had' "havean extremely high radiation level (600 50% cold water, which would have been iadequate "and the auxiliarybuilding was evacuated. An another reactor if there had been circulation. The situation was in ',attempt was being made to obtain coolant sample..

some ways worse than it was before the valve was closed.

By 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after the tuirbine trip, the situation Duliring this period of probable core damage, appears in hindsight to have become quite grave.

there was virtually no informatioh on conditions It should have been obvious that there was no in the core. Incore thermocouples (temperature circulation of reactor coolant. - The -abortive measuring devices), Which measure reactor cool attempts to start reactor coolant-pumps and the ant temperature at:the exit from the core,' could attempts to secure natural circulation by a high mneasure only up"to 7007F. This limit is imposed water level in the steam generator indicate that time. .Most incore by the signal conditioning and data logging equip-, this was ,suspected at the ment, not by the instruments themselves. thermocouples were reading off scale. The hot

-leg temperatures' were nearly 800'F. - This that the Many radiation monitors began to go offscale' superheating of the hot leg indicates both water in it and that high. This is an ifidication of severe core damage.. hot leg had virtually no liquid

'The intense boiling could have caused shattering at least the upper part of the core was dry., The

'ofmuch of this material, and the loss of cladding many high radiation alarms indicate that extensive fuel damage had occurred. .

integrity, coupled with the high temperatures,

• could have allowed the moire volatile radioactive substances in the fuel to escape into the reactor -At 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />,-the condenser vacuum pump

'coolant. exhaust radiation monitor was showing increased radiation levels. A leak in steam generator B had suspected, and the increased level The problems with the condenser hotwell level,- been previously control were finally solved at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 50 minutes.- ,', of radiation seemed to confirm this. At 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> 4 The broken air, line-to thereject valve was re minutes, the turbine bypass valves from steam paired, the valve now operated properly, and the generator "B" and the auxiliary feedwater valves This completely Scondensate hotwell was pumped down to its, to this generator were closed.

normal level. isolated the steam generator from the condensate system. ,

The 'attempted starts of the reactor. coolant At 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> 12 minutes, the PORV block valve pump :had not established circulation in the reactor coolant system. It appears,' however, that! was opened in an attempt to control RCS pressure.

9 1. - - Rev 0896 USNRC Technical Training Center " 18-,

I B&W Crosstraining Course Manual Three Mile Island "Theopening of the valve caused a pressure spike radioactive water in the reactor building sump in the RCDT, an increase in reactor building would have to be used for high pressure injection.

pressure, and an increase in the valve outlet tem The HPI pumping system would became radioac perature. tive, which could cause grave problems if repairs became necessary. There was thus an inclination At 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> 20 minutes, the ES were manually to use ES as little as possible (high pressure initiated by the operator. This was quickly fol injection water is taken from the BWST). ES was lowed by a drop in pressurizer level. The reason reset and makeup pump "1C" was stopped. At the for actuation of the ES was the rapidly dropping same time, the PORV block valve was shut.

RCS pressure. Makeup pump "IC" started and Closing this valve, with makeup pump "1A" still the makeup valves opened fully. RCS .running, caused a~rapid increase in pressurizer temperature dropped rapidly as the cold water level.

flooded in. It is, believed that the sudden admission of cold water to the extremely hot core About 4 to 4-1/2 hours into the accident, probably caused additional major damage to the incore thermocouple temperature readings were core because of thermal shock. The external taken off the computer; many registered question neutron indicators dropped suddenly, indicating a marks. Shortly after, at the request of the station rapid, change of level in the downcomer. The superintendent, an instrumentation control engi water added should have ensured that the coolant neer had several foremen and instrument techni level was above the core height. cians go to a room below the control room and take readings with a millivoltmeter on the wires Almost immediately, many radiation monitors from the thermocouples. The first few readings registered alarms. The control building, except ranged from about 200'F to 2300'F. These were for the control room itself, was evacuated. These the only readings reported by the instrumentation radiation alarms are a good indication that severe control engineer to the station superintendent.

core damage occurred. Apparently, the brittle Both have testified that they discounted or did not oxidized cladding was shattered by the sudden believe the accuracy of the high readings because admission of cold water, so that the fuel pellets they firmly believe the low readings to be inaccu were no longer held in their original position. rate. In the meantime, the technicians read the This sudden rearrangement of the core may have rest of the thermocouples - a number of which permitted the volatile fission products to enter the were above 2000'F -and entered these readings in coolant; these could later have streamed out of the a computer book which was later placed on a con open PORV into the reactor building. trol room console. The technicians then left the area when nonessential personnel were evacuated.

At 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> 24 minutes, a general emergency was declared on the basis of the many radiation Both makeup pumps ("IA" and "IC") were alarms. stopped at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 18 minutes. Two unsuccessful attempts were made to restart pump IA. The The borated water storage tank (BWST) low control switch was then put in the "pull-to-lock" level alarm was received at 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> 30 minutes. position. This completely defeated automatic There were still 53 feet of water in the BWST. starts of the pump. The pressurizer indicated full, That the level was falling, however, caused con and the operators were concerned about full high cem. Additional ES actuations could cause all the pressure injection flow coming on with an appar

-water in the BWST to be used up, and the highly ently "solid" system.

USNRC Technical Training Center 18-10 Rev 0896

"EMX rV SStfl anhI..

n~U - ,s a

'Three Mile Island Actually, a very large part of the RCS was It was possible to reset the fuel racks at once, filled with steam and gas, and the system was far however, and then to leave the controls in position from being solid. This condition could have been so that the diesels would not automatically start on "recognized Tfrom the fact that the RCS hot legs ES actuation. In the event, of a blackout, the were superheated. diesels could have been immediately started from the control room, as soon as the operators realized Problems -in .the condensate system were that power was lost. Resetting the fuel racks was continuing. The condensers had been steadily carried out at 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 29 minutes.

losing vacuuni.' It was also necessary to maintain steam to the main turbine seals in order to operate By 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 43 minutes, the RCS was full the condenser at a vacuum. When main steam is repressurized. , The pressure was, maintained not available, seal steam is provided by the oil between 2000 and 2200 psig by operation of the fired auxiliary boiler, which is shared by both TMI PORV block valve.

tinits. -The auxiliary boiler broke down, so that seal steam could not be maintained, and it was It was supposed that the higher pressure might necessary to shut down the condensate system, be able to collapse the bubble and allow natural completely., circulation. In order to encourage natural circula tion, operators raised the water level' of steam Only a small amount of heat could be removed generator "A" to 90% by using the condensate by the steam generator because the upper part of pump for feeding.

'the RCS was filled by a steam-gas mixture. This drastically cut flow on the primary side. The It became clear that even with a full steam

-water level on the secondary side was rising generator and high pressure, natural circulation because more water was coming in as feedwater was not being established. The next plan was to

'" than was leaving as steam. At 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 42 minutes, depressurize sufficiently to inject water from the

'emergency feedwater pump was stopped. core flood tanks. When water is injected from the core flood tanks, expansion of,the nitrogen gas The diesel engines that operate the emergency causes its pressure to drop until it balances the generators had been stopped at 30 minutes after RCS pressure. If the RCS pressure drops slightly the turbine trip. .-These details'provide an 'emer below 600 psig, only a small amount of water will gency electrical supply for the ES in the event of be injected. An amount of water approaching the failure of the regular supply. During the past 5 fuel volume of the tanks will be injected into the hours, the diesels had been incapable'of being reactor vessel only when the RCS pressure is rapidly started. If there had been an-interruption. much lower than 600 psig. The operators did not in 'the power, someone would -have had to go to realize this and incorrectly believed that the small

'the diesel generator area to start them. On the amount of water injected was indicating that the

'other hand, if the fuel racks were reset, the diesels core was covered.

would have restarted on every ES actuation. They' cannot be run for long periods when unloaded, Up to this time, the atmospheric steam dump and someone would have had to go to the diesel valve was open. Sometime between 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 30 generator, area each time to reset them. Either minutes and 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 15 minutes, the atmospheric control way, someone would have had to pass through a dump valve was closed on orders to the high radiation area. ',-room.from Metropolitan Edison management,

-because of concern that this might be the source of I C_1__ - , Rev 0896 USNRC Technical Training Center l*--li

-1

. B&W Crosstrainine Course Manual Thrpo Mllo lq:l*nd B CeM t uThrPinC MHiile iirii small radioactivity levels being measured outside concern, however, as to whether a pump would the plant. operate. If there were voids in the system, sus tained running would possible damage the pump At 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 50 minutes, coincident with open or blow out the seals. Therefore, the control room ing of the PORV, there was a very sudden spike of personnel decided to "bump" one of the pumps pressure and temperature in the reactor building. (run it for only a few seconds) and to observe The building was isolated, and the ES actuated current and flow while the pump was running.

and building sprays came on. The setpoint for the building sprays to come on is 28 psig, so the The loss of two MCCS (at a time of pressure spike must have been at least that high. explosion) meant that the ac oil lift pumps were The strip chart shows a peak pressure of 28 psig. out of service. It is not possible to start a reactor coolant pump unless the oil lift pump can be It is now known that the pressure spike was started. There is a standby dc oil lift pump, but it due to hydrogen combustion in the reactor build was necessary to send people to the auxiliary ing. The building sprays quickly brought the building to start it.

pressure and temperatures down. At 6 minutes after actuation, the sprays were shut off from the At 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> 33 minutes, operators started control room because there appeared to be no reactor coolant pump "1A" by manually bypassing need for them. some of the inhibiting circuitry. The pump was run for 10 seconds, with normal amperage and Initially, the spike was dismissed as some type flow. Dramatic results were seen immediately.

of instrument malfunction. Shortly afterward, RCS pressure and temperature instantly dropped, however, at least some supervisors concluded that but began to rise again as soon as the pump was for several independent instruments to have been stopped. Evidently, there was an immediate affected in the same way, there must have been a transfer of heat to the steam generator when the pressure pulse. It was not until late Thursday coolant circulated. There was also a rapid spike in night, however, that control, room personnel the steam pressure and a drop in steam generator became generally aware of the pressure spike's level.

meaning. Its meaning became common knowledge among the management early Friday 18.2.5 8:00 PM (Figure 18-6) morning.

After analysis of the results of the short term At 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> after the turbine trip, the auxiliary run of the reactor coolant pump, conditions looked boiler was brought back into operation. Steam for so hopeful that operators decided to start the pump the turbine seals was now available and it was and to let it run if all continued to go well. Rea possible to hold a vacuum on the condenser. sonably stable conditions had now, for the first time, been established. New problems were to Two condenser vacuum pumps were started. arise later, but they were less serious than those It was now expected that repressurization would that had been handled up to this time.

collap3se the bubble in the hot legs, and natural circulation could be achieved through OTSG "A." Apparently, no none at this time realized that a bubble still existed in the RCS. What appears to It was now believed that it, might be possible have happened is that the starting of the reactor to- start a reactor coolant pump. There was some coolant pumps swept the remaining gas in the USNRC Technical Training Center USNRC Training Technical Center 18-12 Rev 0896 18-12 Rev 0896

("nnrcp Mn.wi1 Mile Island Three Mile DR.UJ V In JP.111 fltX ..I 9- aVa,...F.

Vaa #"; . ; _5 f, - - Man"al upper part of the system around with the water as At 9:25 p.m. on March 28 (17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> 25 discrete bubbles. The gas bubbles would tend to minutes after turbine trip), it was apparent that the collect in the most quiescent part of the system utility believed pressure could soon be reduced to the upper head of the reactor vessel. a level at which the decay heat system could be used.

It is now,believed that the gas was largely hydrogen. Hydrogen is slightly soluble in water, 18.3 , Major Issues and its solubility is greater at high pressure. An

-attempt to depressurize the system would cause 18.3.1 Natural Circulation some of the dissolved hydrogen to effervesce out ..Natural circulation is a basic thermal hydraulic of the water, thereby increasing the amount of hydrogen in ,the bubble which would interfere phenomenon that occurs during the loss of power with attempts to depressurize. As the pressure to the reactor coolant pumps. Heating and cooling dropped, the bubble would grow in size and could of water changes the density of the coolant. As interfere with circulation of the reactor coolant. the density decreases, a given volume ,of water contains less mass. The heated water will tend to In addition to growing in size, the bubble and rise while the cooled water will tend to fall. This the dissolved gas would make it impossible to -is similar to the principles of operation of a hot air depressurize the RCScompletely. The pressure is balloon. To rise, heat is added to the gas volume Scontrolled by the size of the steam bubble in the of the ballon. As the hot air cools, the ballon falls.

upper part of the pressurizer. When this bubble Natural circulation is the mechanism by.which the contains only steam, spraying colder water'into coolant is transferred out of the reactor vessel to

-the top of the pressurizer shrinks the bubble and the steam generators which act as a heat sink.

reduces the pressure. When the bubble contains a

-gas like hydrogen, however,, spraying does not To take advantage of the buoyant forces, reduce the size of the bubble as much, so there is sometimes called the thermal driving head, the less contr6l over the pressure. plant is designed with a maximum height differ ence between the center of heat generation, the Another problem with reduced 'pressure core, and the center of heat removal, the steam occurred in the letdown system., As explained, generator. Resistances to, flow such as pipe gas comes out of solution when the pressure is restrictions, valves, bends, elbows, etc., especially reduced.- The gas from the letdown water in the hot legs of the RCS, are minimized. The collected in the bleed ,tanks and makeup tank, design enhances the natural circulation flow due increasing the pressure and making it necessary to to the thermal gradients which will occur when a vent the tanks often. The gas vented off; though, loss of pumping power is sustained.

was not pure hydrogen -there were small amounts of radioactive materials as well. There was a Although plant design is fixed, there are some occurthat will inter limited *space available for holding,'the gas .-,operational things that can Operation of normal released from. the letdown flow.. These two Srupt natural 'circulation.

factors would make the reduction of pressure an plant systems is sometimes different, during

-Therefore, the operator must extremely' slow process that took several days to natural circulation.

accomplish. understand natural circulation to avoid problems.

Several things can be done to enhance natural circulation. Pressurizer level should be main 1 118-13 Rev 0896 USNRC Technical Training Center

I B&W Crosstrainine Course Manual Three Mile kland WnC.Three Mile Island tained at 50% or greater to ensure that no vapor perature will exceed the 100% full power value.

pockets have formed in the loops. Large vapor This is because the hot leg temperature will in pockets result in large resistance to flow. The crease as boiling occurs in the core. Since there is Reactor Coolant System should be maintained at no flow, the hot leg temperature will rise dramati least 15 degrees subcooled. 50 degrees cally while cold legtemperature remains relatively subcooling is desired, but at least 15 degrees constant. The core thermocouple temperatures subcooling is required. Again, this ensures that no will also rise as the heat is generated by the core.

steam pockets form in the reactor coolant loops or Steam pressure from the steam generated will the steam generators. Another necessary decrease as boil off occurs in the steam requirement is to maintain a heat sink. The heat generators. Since flow is zero, temperature and sink required is at least one steam generator. The pressure will decrease in the steam generator as a Auxiliary Feedwater System should be used as cold water slug is formed on the reactor coolant necessary to maintain narrow range level, in one side of the steam generator. Steam generator level steam generator. Without the heat sink, the will also -increase with the same auxiliary reactor coolant will not be cooled and the thermal feedwater flow since less steam will be formed as driving head will be reduced, therefore natural the RCS cools.

circulation will be reduced. Boiling will likely occur in the core and hot leg forming steam voids As mentioned previously, some systems will in the steam generator tubes and in the reactor have to be operated differently when in natural vessel head. These will all offer a high resistance circulation. One of these systems is the Pressur to natural circulation flow. izing System. Normally spray comes from one of the reactor coolant loops. In natural circulation, Several parameters measured in the plant are however, there will not be enough driving head available to help provide indication of natural for this spray to work. In this case, an auxiliary circulation. The Reactor Coolant System differ spray will have to be used. The operator will have ential temperature should be approximately 25% to control spray very carefully manually to control to 80% of full power as indicated by wide range pressurizer pressure. During natural circulation it resistance temperature detectors (RTDs). The hot is imperative to make changes to reactor coolant leg RTD should be indicating either a steady value loop temperatures and pressures in a slow manner.

or a slowly decreasing value. This indicates that Otherwise, the thermal driving head can be upset heat removal is operating properly and that the and natural circulation will stop. If the operator decay heat generated by the core is decreasing does not control pressurizer pressure correctly, the slowly as it should. Core exit thermocouples subcooling temperature may be lost and a bubble should be monitored. These also should be indi or steam void may be formed in the reactor vessel cating either a steady value or a slowly decreasing or loops. The operator must prevent pressure value. Steam pressure should follow reactor from rising to the power operated relief valves coolant temperatures. As average reactor coolant opening setpoint. These valves have been known temperature decreases, so should steam pressure. to fail to reseat. A sudden drop in pressure due to Cold leg temperatures of the RCS should also a stuck open relief valve could cause flashing in indicate either a constant value or slowly decreas the reactor coolant loop hot leg and a loss of ing value. This measurement is again by RTDs. natural circulation. As mentioned, the operator These measured parameters can also be used to must control pressurizer pressure by controlling detect a loss of natural ciiculation flow. If natural auxiliary spray and heaters.

circulation flow is lost, the RCS differential tem-18-14 Rev 0896 USNRC Training Center Technical Training USNRC Technical Center 18-14 Rev 0896

Three Mile Island B&W Crosstraining Course Manual The cooldown of the RCS will have to be to operate the pumps intermittently without accomplished by c6ntrol ofithe atmospheric serious damage. For example, a non-condensible dumps or turbine bypass valves (if condenser is blockage could occur in the steam generator tubes available). The -operator will have to manually and the only method of removal could be RCP make ,all changes to the system control operation. Secondly, if chemistry, radiation levels parameters. Once again, all changes should be and hydrogen generation indicate severe core made slowly or natural circulation flow may be damage is occurring and operator actions to cover disrupted. the core are not adequate, turning on the RCPs in an attempt to send slugs of water and steam for The Auxiliary Feedwater System flow will cooling the core may be necessary.

--also have to be controlled manually by the operator. Flow.should be controlled 'so as to Prior to attempting to start a RCP, an alterna maintain a fairly constant level in the ,steam tive method of restoring natural circulation would generators. Overfeeding can cause a rapid cooling' be to increase steaming in the steam generator (in down of the steam generator and a disruption to crease the size of the heat sink). This could be the natural circulation flow in the RCS. As small accomplished using turbine bypass valves or

'-,changes are made to the.Steam Dump Control atmospheric dump valves. Using this method System, small changes should be made to the flow should condense steam that may be blocking in the Auxiliary Feedwater System. These two material circulation flow in the steam generator U systems should be adjusted slowly to provide a tubes. However, if the void in the steam generator slow, steady cooldown rate of the Reactor Coolant U-tubes contains ,large quantities, of non System. condensible gases, RCPs may be needed intermit tently to force the blockage out-of the steam 18.3.2 Reactor Coolant Pump Operation generator and into the reactor vessel. Another alternative that may be pursued if inadequate core The previous section discussed considerations cooling exists is to intentionally depressurize the and operations in the natural circulation mode of RCS in a controlled fashion, using a pressurizer core cooling. Emergency procedures, based on relief valve.

recommendations from vendors, outline the crite ria for operating the RCPs if natural circulation is The purpose of depressurization is to create not working. This section will discuss factors to conditions which will allow increased emergency be considered in RCP operation during accident core cooling flow. Extreme caution must be used conditions. Consideration will be given to in a depressurization as increased voiding may

,possible situations in which written procedures result at lower pressures, if core cooling continues may be inadequate to prevent severe degradation to be inadequate and saturated conditions exist in of the reactor core. the RCS.

Many operating procedures usually require If depressurization below the low pressure some minimum value ofRCS pressure (normally safety injection pump discharge head fails to 1250 psig to 1550 psig) before RCPs can be improve core cooling and increase vessel water started, regardless of other conditions in the RCS. level, then pressure should be increased by isolat and closing the pressurizer relief Several factors, however, could affect a decision --ing letdown valves. Then, once pressure reaches the minimum to operate the pumps below this minimum pres sure. First, the RCS inventory may be sufficient level for RCP operation or the maximum achiev-

,USNRC Technical Training Center 18-15 R~ev u~OY

I B&W Crosstrainine Course Manual Thr*p Milp Ithnd B&W MaualThree rossraiing oure Mile Te~N-A able pressure, an attempt should be made to start ably above,1 ppm. Thus, radiolysis in the RCS the RCPs. This procedure of depressurization, was a source of neither hydrogen nor oxygen.

repressurization and RCP operation can be re peated until blockages are cleared and the core is Above 1600'F zirconium alloys react with covered. water to form hydrogen and zirconium dioxide.

18.3.3 Hydrogen Generation Zr + 2H 20 -- > Zr02+ 2H 2 The issue causing the most concern and public The reaction rate increases with temperature and apprehension during the incident at TMI involved is very rapid above 2700'F. Stoichiometrically, hydrogen and the hydrogen bubble. The errone about 8 standard cubic feet of hydrogen are pro ous assumption that the accumulation ofhydrogen duced" per pound of zirconium oxidized. Each within the primary system was or could become kilogram of Zr that reacts can release about 6.5 explosive led to speculations of a massive spread megawatts of energy.

of contamination and consequent damages to the general population. As was later confirmed pub If the coolant were lost from the reactor vessel licly, these speculations and fears about the "bub due to an accident, the temperature of the fuel ble" were totally unfounded. The presence of would increase dramatically. When temperatures even small amounts of free hydrogen prevents reached near 2200'F, the zirconium-water accumulation of oxygen and thus any possibility reaction would begin, in the presence of water of hydrogen/oxygen explosion. However, the vapor. The "reaction would then proceed amount of hydrogen produced was, sufficient to autocatalytically, accelerating rapidly to a temper cause legitimate concerns about core cooling and ature of approximately 3000'F, where actual flammability in the reactor building atmosphere. melting occurs. Once the heat source is removed, An ignition, as measured' by pressure and the reaction, in the presence of liquid water, stops temperature spikes, did occur about 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> into by itself. However, a complete and violent the incident. Although equipment may have been reaction with water is conceivable if the entire damaged, the integrity of the reactor building reactor core vaporizes, an event that is considered remained in tact. Significant amounts of hydrogen highly improbable. In the course of the may be produced by radiolysis and the zirconium-water reaction, hydrogen gas is zirconium/water reaction. produced in proportion to the amount of the cladding material that has reacted. A large con Absorption of energy from ionizing radiation centration of hydrogen would therefore indicate a will cause the decomposition of water by a some large amount of damaged cladding. During a what complicated mechanism to form primarily LOCA, the hydrogen gas may escape through a hydrogen and oxygen. break in the reactor vessel. Since hydrogen is lighter than the surrounding air, it will tend to rise 2H 20 <--> 2H 2 + 02 and collect in a "bubble" at the top of the contain ment dome. The cohcentration of hydrogen in the The yield of this reaction is dependent upon the top of the dome would be high enough to prevent energy absorbed, the nature of the radiation, oxygen from entering the bubble and creating an temperature, reaction produces residence time, explosion; however, an explosion could occur etc. Throughout the incident at TMI-2, the dis while the hydrogen is rising from the reactor solved hydrogen levels in the RCS were consider- vessel toward the dome.

18-16 Rev 0896 USNRC Training Center Technical Training USNRC Technical Center 18-16 Rev 0896

-Three Mile Island 13mvv Crosstra :n : air, t- ou. a, M an. .1 During containment spray, bperation another Hydr6gen gas generation in the reactor core is means of hydrogen gas production exists. If the of major concern in the operation of a pressurized operation -uses a sodium hydroxide (NaOH) water reactor. The hydrogen gas which was "chemicaladdition, any aluminum inside the con produced at TMI was a major.importance for "tainment may react as shown in the following several reasons:

• equation.

1. The presence of a hydrogen bubble in the 2A1 + 2 (NaOH) + 2H 20 --> 2NaA10 2 + 3H2 vessel at TMI confirmed what had already The amount of hydrogen gas generated by this been suspected: 'a significant amount of fuel process can be'limited by keeping the amount of damage had occurred.

"aluminumused in the plant to a practical mini mum: In the event that hydrogen gas does collect 2. The gas bubble in the core complicated the

-in the containment, hydrogen' recombiners are task of cooling the core.

"-provided to bum off the hydrogen under con

," trolled conditions. 3. The explosive nature of the hydrogen gas introduced another danger 'to the already Another possible reaction with aluminum complicated recovery process.

-,which can liberate hydrogen is:

'18.3.4 Radiation Release Paths (Figure 18-7) 2A1 + 3H20 --> A1 203 + 3H2 The radioactive 'materials released, to the

. The'potential sources 'of aluminum within the environment as a result of the TMI-2 accident containment building are as follows: ,were those that escaped from the damaged fuel and were transported 'in the coolant yia the let (1) Neutron detector supports down line into the auxiliary building and then into (2) Reactor Coolant Pump fins -the environment. , 'The noble, gases -and (3) Electrical conductors radioiodines, because of their volatile nature and (4) Refueling machine large concentration, were the primary (5) Incore instrumentation components radionuclides available for release from the auxil iary building. Because the releases' occurred "In addition, hydrogen may be liberated by primarily through a series of filters including means of zinc-water reactions following a loss of charcoal filters designed to remove radioiodines, reactor coolant within the containment. ,The the released materials consisted primarily of the typical reaction which takes place under these noble gas isotopes of krypton and xenon. The circumstances is: 'total quantity of released radioactive materials is estimated as 2.5 million curies.

"Zn+ H20 --> ZnO + H2 T Iý OnMarch 28,,1979, prior to 4:00 a.m., the

-Thetypical zinc metal sources in containment are: ,TMI-2 .liquid radwaste -treatment- system, was

,operating normally. ' TMI-1 was returning to (1) Floor gratings -,"' operations after a refueling outage, which gener (2) Electrical conduit and trays ated liquid radwaste that required processing in (3) Ventilation ducts order to continue startup. A spill of 20,000 (4) Zinc-based paint gallons of contaminated water from the fuel

- Rev 0896 USNRC Technical Training Center 1ýý , 18-17 "'

I B&W CrosstraininL, Course Manual Three Mile Island B&WMaualThree rossraiin2 oure Mile Island transfer canal into the reactor building of TMI-l Operation ofcompressor A resulted in releases near the end of the outage resulted in large vol of gaseous radioactive materials to the auxiliary umes of low level liquid radwaste from and fuel handling buildings with each venting of decontamination operations. Because there is no the makeup tank to the waste gas decay tanks.

minimum level below which low level liquid The radioactive noble gases in this leakage were radwaste can be released untreated, this volume not held up in the decay tanks and were released was being stored, which reduced the available untreated to the environment. Compressor B, liquid radwaste storage capacity at Three Mile which was to be operated only in an emergency Island Station on March 28. because it was considered to be in poor condition, was not used until Thursday, March 29 and there Immediately prior to the accident, approxi fore, leaks in this compressor were not significant.

mately 60% of the station's available liquid We find that the leaks, particularly in compressor radwaste storage capacity (300,000 gallons per A, which led to the release of small amounts of unit) was filled. Of particular importance, the radioactive material during normal operation, led auxiliary building sump was approximately 63% to releases of radioactive material after core full, the auxiliary building sump tank was was damage.

approximately 76% full, the two contaminated drains tanks were 77% and 24% full, respectively, Following the turbine trip, the open pilot and the three reactor coolant bleed holdup tanks, operated relief valve (PORV) on the pressurizer each of 83,000-gallon capacity, were 40%, 61%, permitted reactor coolant, at high temperature and and 61% full, respectively.' Although there was pressure, to fill the reactor coolant drain tank.

minimal input of liquid radwaste from TMI-2, Fifteen minutes after the turbine trip, the reactor 60% of the Three Mile Island Stations' liquid coolant drain tank rupture disc, which had a radwaste tank capacity was not available on setpoint of 192 psig, failed and primary coolant March 28. Accordingly, we find that for normal flowed to the reactor building sumps. As a result, operations the liquid radwaste storage and the reactor building sump pumps started automati treatment system was marginal at best. cally and transferred at most 8100 gallons to the auxiliary building sump tank. These pumps were SPrior to March 28, 1979, the gaseous radwaste manually turned off at 4:38 a.m. Since the avail system and the heating and ventilating systems able capacity of the auxiliary building sump tank had satisfactorily undergone numerous functional was only 700 gallons, liquid overflowed to the and acceptance tests. However, a number of auxiliary building sump, which caused water to maintenance work requests for the waste gas back up through the floor drains in both the auxil system were outstanding at the time, of the iary and fuel handling buildings.

accident. Both waste gas compressors needed service for various conditions (described in This liquid did not contain large amounts of maintenance requests as "over pressurized," radioactive material because significant core "makes loud noise,". "no seal water level," "level damage did not occur until after 6:00 a.m. How cohtrol pump operation"). These compressors ever, the liquid proved to be a means for highly leaked during the March 28 incident. In addition, contaminated reactor coolant to travel into areas makeup tank vent valve was suspected to be of the auxiliary and fuel handling buildings as the leaking. accident progressed.

18-18 Rev 0896 USNRC Training Center Technical Training USNRC Technical Center 18-18 Rev 0896

t.tfl*

Three Mile Island fIX "Ex III VT 1-ross 4 :

• U33I ga n ng I**uhIF, d- o - ma"Vini After core damage occurred, radioactive radioactive gas were the major source of radioac tive gaseous releases.

material was transported out of the reactor by the letdown line of the makeup and purification sys tem. Because the letdown is a stream ofprimary Leaks in the vent header system and the waste coolant directly from the reactor, it contained gas decay system were the primary mechanisms significant amounts of radioactivity. for the direct release of gaseous radioactive material. The high pressure in the reactor coolant It-was necessary to maintain some ,letdown drain tank (up to 192 psig) prior to rupture disc flow to -the makeup and purification system to failed led to a sequence of events that created a ensure safe cooldown of the reactor between significant release pathway for gaseous radioac March 28 and April 2, 1979. As a result, leaks in tivity through the vent header.

the makeup and purification system (located in the auxiliary building), which release small amounts -The reactor coolant drain tank was connected of radioactive material in normal operation, to the vent headeryia two paths. Pressures in the released :large amounts of radioactive material reactorcoolant drain tank prior to rupture disc duririg the accident,'even though the letdown flow failure pressurized the vent header. Before the was reduced from its normal volumetric flow of rupture of the reactor coolant drain tank relief at 45 gallons per minute to about 20 gallons per 4:15 ýa.m., the radiation monitoring system de minute. The letdown flow was, in fact, the major tected activity that indicated that the waste gas path for transferring radioactive material out of vent header was leaking. Subsequent inspection the reactor. has identified six leaks in the vent header system.

The vent line from the reactor coolant drain tank

-We find. that leakage of radwaste system to the vent header was open on March 28, 1979.

components, particularly in the makeup and purification system, which contained -small The high pressures in the reactor coolant drain amounts of radioactive material during normal tank forced liquid (primary coolant) through the to the vent. header. The vent header "operation,led to the most significant releases of -,vent line radioactive material after core damage occurred. relief valve is set at '150 psig, so water under caused leaks in the water drains. This This source of liquid radioactivity was released to pressure also damaged some of the 10 check valves the auxiliary building and uncontaminated water -water spread over the floors of the auxiliary and fuel located between the vent header and connected handling buildings. tanks reactor coolant bleed holdup tanks. These check valves are designed to, permit flow only The TMI-2 stack was the main release point from the component to the vent header and not in for gaseous effluents. Numerous pathways to the the opposite direction, but are known to operate inefficiently and fail easily. Therefore, a signifi

"ýstackexisted for the release of radioactive gaseous effluents. The release pathways from the reactor cant pathway existed from the vent header to a to the auxiliary~and fuel handling buildings are number of tanks. The relief valves on these tanks, shown in Figure 18-7. which were set at relatively low pressures (reactor bleed holdup tank at 20 psig, reactor The release of radioactive gases into the auxiliary %coolant coolant evaporator at 10 psig), opened. Lifting of

, and fuel handling building occurred by direct gas

,these relief valves resulted in untreated releases leakage *and leakage .of radioactive liquid from which radioactive gases evolved. Direct leaks of directly to the, stack yia the- relief valve'vent header. We find that the gaseous radwaste system 18-19 _Rev 0896 USNRC Technical Training Center

-1 Thrpp MlI* I*12nd B&W Crosstraining Course Manual Three Mile Telin design included "relief to atmosphere," which water bypassed -the primary system and was provided a path to the environment for untreated recirculated to the makeup tank and to the reactor gas. We find, also, that the high reactor coolant coolant bleed holdup tanks through the open drain tank pressures between 4:00 and 4:30 a.m. liquid relief valve, thus depleting the supply of on March 28 damaged portions of the vent gas borated water.

system and resulted in a gaseous release pathway to the vent header, through failed check valves to It was crucial to reduce the pressure in the components with low-pressure reliefvalves. Once makeup tanks at this time for two reasons. First, established, this release path was available the supply of borated water in the borated water whenever the vent header was used, such as in the storage tanks was being depleted. This supply venting of the makeup tank. was the only readily available source of borated water for continued boron control of the primary The makeup tank has a liquid relief to the coolant. Second, the increase in pressure in the reactor coolant bleed holdup tanks. The tank is reactor coolant bleed holdup tanks through the designed to operate with approximately one-third open relief valve on the makeup tank increased of its volume as a gas space to allow gases from the probability that the relief valves on the bleed the cooled and depressurized primary coolant to holdup tanks would open. The opening of the evolve and be collected. Collection of tanks would permit an uncontrolled release of noncondensible gases in the makeup tank caused gaseous radioactive material to the environment a reduction in the letdown flow because of pres via the relief system.

sure buildup. This reduction of letdown flow became a concern in the early morning of March A decision was made to vent the makeup tank

29. As a result, manual ventings of the makeup continuously in an attempt to reduce pressure.

tank to reduce pressure began at 4:35 a.m. on During the morning of March 30, 1979, this action March 29. The venting process consisted of short was suggested by a Control Room Operator, and bursts, with vent valve being cycled open for short all personnel present in the TMI-2 control room periods oftime to minimize leakage of radioactive agreed. At approximately 7:00 a.m. on March 30, material. According to a Shift Supervisor, venting the makeup vent valve was opened. A caution tag of the makeup tank occurs only once every 2 or 3 was placed on the valve on March 31 at 11:15 months during normal operation to remove p.m., stating, "Do not move this valve without nonradioactive noncondensible gases and there is Supt. or Shift permission."

no standard operating procedure for venting the tank. Nonetheless, on March 29, Met Ed wrote The opening of the vent valve at 7:10 a.m. on and approved operating procedures for the peri Friday, March 30 resulted in a momentary reading odic venting of the makeup tank. of 1200 mR/h, 130 feet above the TMI-2 stack.

This reading was the event that apparently trig The rate of pressure buildup in the makeup gered the Friday evacuation recommendations.

tank became too rapid to control with the cyclic Leaving the valve open provided a continual opening of the vent valve during early Friday pathway for gaseous radioactive material to enter morning,: March 30. The liquid relief on the the auxiliary building. Leaks in the vent header makeup tank opened, allowing all of the contents permitted the gases to enter the auxiliary and fuel in the' tank to flow into the reactor coolant bleed handling buildings and be discharged through the holdup tanks. The makeup pumps then switched stack. Since 'letdown. flow is still being suction to the borated water storage tank. This maintained, this release pathway still exists.

USNRC Technical Training Center USNRC Center 18-20 Training Rev 0896 Technical 18-20 Rev 0896

B&W Crosstraining Course Manual I f Three Mile Island However, all short-lived radionuclides in the core damage. An additional delay of one hour reactor coolant have undergone significant decay in closing the valve would have resulted in since-. March 28, and "releases 'of radioactive severe core damage and possibly core melt

,'material from Three Mile Island Station are now down.

negligible.

3. The delay-in operation of the emergency I A postaccident examination of waste gas com -feedwater system had little effect on the extent pressor B found a hole approximately the size of of core damage. However, a delay of one hour a quarter. The operation of the compressor at any in the delivery of emergency feedwater would pressure would be con'sidered a significant release probably have resulted in more severe core path.' However,'compressor "B" was off line from damage and possibly core meltdown.

March 28 until March 29. In addition, the design of the waste gas system includes a pressure Although the operation of a reactor coolant

'regulator that -limits the 'inlet pressure to the pump at 2:54 was probably important in limiting conmpressors -to approximately -1 inch of water the extent of core damage, the core was not recov gauge. This prveeited any high pressures in the ered until operation of the HPI at 3:20. The top of vent header from reaching the compressors. the core was not uncovered again, although re These two factors lessened the significance of the gions of the core remained vapor blanketed for release pathway presented by the leaking waste days. 'For a number of hours following core gas system compressors. recovery, flow through the hot legs was blocked by the presence of hydrogen and the hot 'leg 18.4 Analysis temperatures remained in the range of 750 800'F, to which they had been heated during core A number of analyses were performed with uncovery.

the MARCH computer code to assist the TMI Special Inquiry Group. The MARCH code Some analyses were performed with MARCH predicts the thermal ahd hydraulic conditions in for sequences leading to complete core meltdown the reactor primary system and containment "to examine thie likelihood of different containment building in core meltdown accidents. The purpose failure modes. Since the containment coolers threat to contain

-of the analyses was to examine a number of, were operational, the greatest variations in system operation in the TMI accident ment -integrity was felt to be from the rapid to evaluate their effect on the extent of core "combustion of the hydrogen: generated from damage. The results indicate that: metal-water reactions. If the hydrogen concen tration in containment "onrrespondiiig to '100 well 1.: The throttling of HPI had a major-effect on -percent cladding reaction were to accumulate core damage. If the system had been permit beyond the flammability limit, containment failure ted to operate at high flow, the core would not could result upon ignition. The most likely time have uncovered regardless of PORV position for this to occur would be when the pressure or the availability of emergency feedwater. vessel fails and the molten core falls into the reactor cavity. Whether, indeed, hydrogen would

2. Closure of the block valve in the PORV line at accumulate to critical levels without undergoing 25 minutes into the accident would have prior combustion and then explode with sufficient permitted the operation of the reactor coolant energy to fail'containment, carnnot be determined pumps to continue and would have prevented without further research.

Center 18-21 ievuoyo USNRC Technical Training Training Center 18-21 - , , ev U089

I B&W Crosstrainine Course Manual Three Mile Island BICo.Three Mile Island Finally, analyses were performed to evaluate 18.5 References the impact that the hydrogen burning event that occurred in the TMI-2 containment would have, if 1. NUREG/CR-1250 Vol. II Part 2, "A re it were to occur in other types of containment port to the Commissioners and to the pub design. In general, the pressure suppression lic."

containment designs with lower design pressures are much more vulnerable to hydrogen explosion 2. General Physics "Mitigating Core Dam than large dry containments. age."

3. NUREG/CR-1219, "Analysis ofthe Three Mile Island Accident and Alternative Sequences."

4. General Physics Courseware, "Heat Transfer, Thermodynamics, and Fluid Flow Characteristics."

Appendix - Sequence of Events Initial Conditions:

Reactor Power 97% Average Temp 58 I1F RCS Pressure 2155 psig Pressurizer Level 229 inches Pressurizer Heaters and Sprays in Manual ICS in Full Automatic RCS Boron = 1030 ppm RCS Activity 0.397 uC/ml 6 gpm Identified RCS Leakage Transient Initiator - Loss ofCondensate Booster Pump Two licensed control room operators were on duty in the control room. The shift superintendent was in his office adjacent to the control room. The shift foreman and two auxiliary operators had been working in the auxiliary building on the No.

7 condensate polisher.

The condensate polishers use ion exchange resins for purification of the feedwater. Flow through the resin bed tends to compact the material into a solid mass. The transfer procedure utilizes demineralized water and station compressed air to break up this mass. During this transfer process a resin block developed in the transfer line.

At this point, the plant operators had hypothesized that water pressure may have exceeded air pressure, forcing water into theair system. Further, the watei made its way to the polisher isolation valve controls causing them to drift toward the close position. It is assumed that the condensate booster pumps tripped first, since the polisher outlet is operated within 50 psig of the NPSH limit for the booster pumps. This problem had occurred before.

Sequence of Events:

04:00:00 Condensate pump "IA" tripped. Feedwater pumps "IA" and "IB" tripped. Main Turbine tripped. EFW pumps "1"," 2A", and "2B" started 04:00:03 Pressure setlpoint of Power Operated Relief Valve (PORV) was exceeded (2255 psig).

04:00:08 Reactor tripped on high RCS pressure (2355).

04:00:12 RCS pressure decreased below PORV setpoint. Solenoid deenergizes providing a closed indication to the operator.

USNRC Technical Training Center 18-22 Rev 0896

Three Mile Island IPIe,V (' ncctn~n Couurse ManualThe Ml Iln Sequence of Events (continued) 04 :00:13 Indicated Pzr level peaked at 256 inches and began a rapid decrease. Letdown flow was isolated. Makeup pump "IA" was started and a HPI isolation valve opened. This pump kept tripping (reason unknown) Pzr sprays and beater control returned to automatic.

04:00:15 SG "A"level indicates 74 inches (S/U range). SG "B" level indicates 76 inches (S/U faange).

04:00:30 PORV and Pzr safety valve outlet temperatures alarmed high. RCS low pressure trip setpoint reached.

04:00:58 Pzr low level alarm. SG levels are very low, and the differential temperature, hot to cold leg, rapidly approaching zero indicating that OTSGs are going dry.

04:01:45 Both SGs are boiled dry 04:02:01 ESFAS on low RCS pressure. Makeup pump "IB" tripped. HPI pump "IC" started.

04:02:04 DHR pumps "lA" and "IB" started.

04:03:13 The safety injection portion of ESF was manually bypassed. RCDT relief valve lifted.

04:03:28 Pzr high level alarm 04:04:38 The operator stopped makeup pump "IC" and throttled the HP1 isolation valves.

04:05:00 Pzr level reached 377 inches and continued to rise (pressure continued to decrease).

04:05:30 Indicated RCS Th and pressure reached saturation (582'F and 1340 psig).

04:08:18 OTSG level at 10 inches on the startup range. The EFW pumps were running, but the discharge valves were closed. The valves are now opened resulting in a dry OTSG being fed with relatively cool water. T, and T, decreased. RCS pressure, now under control of the loop saturation considerations, followed.

04:10:19 --Reactor building sump pump "2B3" started. 71" 04:11:43 Pzr level came back on scale and dropped rapidly, as RCS loop temperature continued to decrease from the heat being removed by the OTSGs and EFW pumps.

04:13:13 DHR pumps "IA" and "IB" were shut down.

04:14:48 The RCDT rupture dis6 failed (191.6 psig).

04:14:50 RCP related alarms actuated. Reactor coolant flow indicated oscillations. (RCS pressure =1275 psig, T, 567-F). -. '

04.24:58 PORV outlet temperature = 285.4*F. Safety valve outlet temperature =270'F 04:27:51 Reactor coolant temperature begins to stabilize at approximately 550'F. Pressure 1040 psig. -OTSG levi

= 0 inches

-3 04:38:10 Reactor building sump pumps "2A" and "2B3" were stopped.

04:40:00 Increasing count rate continued on the Source Range neutron 'detector.

04:46:23 -Letdown cooler monitor count rate began increasing. It will increase by a factor of 10 within the next 40 minutes.

05:13:40 Stopped loop "B" RCPs ("IB" and "2B3").

05:30:00 NI-3 (IR) came on scale (increasing).

05:40:40 Stopped loop "A"RCPs ("IlA" and "2A") due to high vibration, erratic flow, and decreasing flow.

05:41:00 Excore instrumentation indicated a decreasing flux (factor of 30).

05:42:30 Excore instrumentation indicated increasing flux levels.

05:5 1:27 Loop "A"and "B" Th temperatures were increasing (eventually went off scale high - 620'F). Cold leg I- I temperatures were decreasing.I-06:14:23 Reactor building radiation monitor (particulate sample) went off-scale high. f1 0F.-Safety valve outlet temperature 189'F and 1941F. Operator closes 06:19:00 PORV outlet temperature 228.7 PORV block valve I .I 06:38:23' Letdow'n cooler "A" rad. monitor off-scale high..

06:39:23 Two samples indicate RCS boron is 400 ppM., Emergency boration started (feared restart).

06:47:00 Alarm typewriter indication showed SPNI~s responding to high temperatures down to 4' level of the core.

• ~90% of the core exit thermocouples >700'F.~

06:54:09 After attempting to start RCPs "2A" and "IB", the operator successfully started RCP."2B" by jump starting the interlocks. "213" ran with high vibration. Flow was indicated for only a few seconds and returned to zero.

USNRC Technical Training Center  : ', ý18-23 Rev 0876

B&W Crosstrainine Course Manual Three Mile Island Sequence of Events (continued) 06:54:50 ESFAS logic automatically reset (HPI injection) on increasing pressure (1845).

06:55:00 Site emergency declared Radiation alarms: waste gas discharge, station vent, fuel handling building exhaust 06:55:13 ESF bypasses were cleared.

07:00:00 RCS pressure at 2045 psig.

07:12:00 Opened PORV block valve (RCS pressure control).

07:13:00 RCP "2B" was stopped (zero flow, low current, high vibration).

07:17:00 PORV block valve was closed.

07:19:45 Manually initiated safety injection (low RCS pressure).

07:20:13 Makeup pump "IC" started (rapid quenching probably caused major fuel damage).

07:21:00 Excore instrumentation indicated sharp decrease (reflood).

07:23:23 General emergency declared. Notified the off-site authorities.

07:32:26 High pressurizer level alarm.

07:37:00 Tripped makeup pump "IC."

07:40:00 Opened PORV block valve.

07:55:39 ESF "A" and "B" actuated on high reactor building pressure. Makeup pump "IC" started.

08:00:00 Over the next 90 minutes, core exit thermocouple readings were manually obtained ranging from 217 to 2580'F. Pzr level = 380 in. RCS pressure = 1500 psig. ESF actuation cleared.

08:18:00 Makeup pumps "IA" and "IC" tripped. Operator attempted to restart "IA" (switch then placed in "Pull to Lock")

08:22:00 Makeup pump "IB" was started.

09:15:00 Decision made to repressurize RCS. Closed the PORV block valve. RCS pressure = 1250 psig 09:43:00 By cycling the PORV block valve, RCS pressure was maintained 1865-2150 psig during the next 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

10:04:00 Commenced filling OTSG "A" (to 97%) using condensate pumps.

11:08:00 EFW pump "2A" was started. OTSG "A" level reached 100% (operating range) 11:38:54 Station manager ordered the PORV block valve opened.

11:41:35 Bypassed ESFAS 12:30:00 Power operated emergency main steam dump valve was closed at the request of corporate management.

12:31:00 RCS pressure had decreased to 600 psig (indicates floating on CFT).

13:04:00 Makeup pump "I C" stopped (concerned with BWST inventory).

13:10:00 PORV block valve was closed. RCS pressure had decreased to 435 psig and then began to increase (could not get on DHR).

13:50:00 ESF on high-high RB pressure (28 psig). HPI, RB isolation, RB spray pumps & valves, DHR pumps started, Makeup pump "IC" started. Makeup pump "IA" - no indication of starting or running.

13:50:30 Makeup pump "IC" was stopped. RB spray pumps were stopped 13:57:00 DHR pumps "IA" and "IB" were stopped.

13:58:38 Cleared ESFAS 14:00:00 Opened PORV 14:26:15 Loop "A" Th <620'F. Stays on scale 10 minutes.

14:35.00 RCS pressure decreased to 410 psig and began to increase.

15:06:00 Pzr level decreases to 180" in the next 18 minutes. RCS loop "A" temperature increasing.

16:00:00 PLANT STATUS: No RCPs running, Makeup pump "IB" running, RCS pressure = 560 psig (increasing),

Pzr level = 294" (increasing) Loop "A", Th = 590'F, Tc = 340'F, OTSG without heat sink, 44 psig decreasing, nearly full. Loop "B", Th = 620'F, T, = 1801F, OTSG - isolated & full.

There is no indication of natural circulation. Very little of the decay heat is being removed, except by makeup water and by occasional opening of the PORV block valve. Gradual heatup of the RCS is causing temperature and pressure to rise.

Pressure control is being attempted by juggling makeup and PORV block valve.

18-24 Rev 0896 USNRC Technical Training USNRC Technical Training Center Center 18-24 Rev 0896

Three Mile Island B&

I*W W Crosstraining Course W4 anua 1 Sequence of Events (continued) 17:20:00 Reactor building pressure starts to go negative. Pressurizer level staits to drop. RCS pressure = 637 psig (decreasing). Two HPI pumps are providing 425 gpm (total) makeup flow. It is now the intention to repressurize, hopefully t6 collapse bubbles and begin steaming from OTSG "A".

the High points were actually hydrogen filled. Collapse of loop bubbles was still impossible. It is the operator's belief that main condenser will soon be available.

20:00:00 maintained at Indications show that forced circulation had been reestablished using RCP "iA." RCS pressure was being was being removed from the RCS using OTSG "A".

1000 - 1100 psig with temperatures indicating a cooling trend. Heat OTSG "B" was isolated and condenser vacuum had been established.

by the way is During the accident, there apparently was much concentration on the water level in the pressurizer. This, It is, therefore, understandable that they natural, because the operators knew to never let the pressurizer get empty (or full).

would not be trying to imagine boiling occurring elsewhere in the system.

were not During this tranisient, the system pressure and temperature and their relationship to saturated steam conditions steam tables. We must correlated, at least not in the control room; the operators were much too busy to think about the will create partial film endeavor to keep in mind the fact that if pressure drops, we can have DNB occur which ultimately boiling in the reactor.

ID Qorl

ý* IhU USNRC Technical Training Center 18-25

CD CD CL

LOOP A LOOP B LOOP A LOOP B LOOP A LOOP B

-n co II t0 c

LOOP A LOOP B

LOOP A LOOP B STEAM

-GENERATOR STEAM CD LINE

-I 0

(D CD QUENCH TANK DEMINERALIZERS SUMP COTIMN (j AUX.BUIDIN PUPSUMP MAKEUP CA