ML022830834

Part 3 of 4 - Babcock & Wilcox Crosstraining Course

ML022830834
Person / Time
Site:	Oconee, Crystal River
Issue date:	09/19/2002
From:	Babcock & Wilcox
To:	Office of Nuclear Reactor Regulation
References
FOIA/PA-2002-0343
Download: ML022830834 (118)

Text

BABCOCK AND WILCOX CROSS TRAINING MANUAL CHAPTER 13 OTSG In-Service Inspection

B&W Crosstrainin* Course Manual TABLE OF CONTENTS 13.0 ONCE-THROUGH STEAM GENERATOR IN-SERVICE INSPECTION 13.1 Operating Experience...............................................

13-1 13.2 Steam Generator Inservice Inspection Requirements........................

13-2 13.2.1 SG Tube Surveillance Basis.......................................

13-3 13.2.2 Eddy Current Testing............................................

13-3 13.3 Tube Repairs.........................................................

13-4 13.3.1 Tube Plugging.....................................................

13-4 13.3.2 Sleeving..........................................................

13-4 13.4 Long Term Corrective Actions...........................................

13-5 13.4.1 Design Changes....................................................

13-5 13.4.2 W ater Chemistry Control............................................

13-5 13.5 References...........................................................

13-7 TABLE 13-1 Operating Experience With B&W OTSGs Through November 1981.............

13-8 FIGURE 13-1 Inspection Lane Flow Blocker USNRC Technical Training Center 13-i Rev 0896 Rev 0896 B&W CrosstraininL, Course Manual nT4Zd-- 1nQ.-;-

T f;

USNRC Technical Training Center 13-i

OTSG In-Service Inspection D1X YY T..

UC 3LI r

liSiS L

u W

l I

In 13.0 ONCE-THROUGH STEAM GEN ERATOR IN-SERVICE INSPEC o TION Learning Objectives:

1. Define:

a. Degraded tube

b. Defective tube

c. -Plugging limit "d. Inspection lane

2. Describe where most leaks have occurred in B&W once-through steam geneiators.

3. Explain the basis for the 20% and 40% of wall thickness limits for steam generator tube degradation.

"4. List the 3 major 6ontributors to steam ienerator corrosion problems.

13.1 Operating Experience The first tube leak in a B&W steam genierato occurred on July 21, 1976, in the Oconee Unit:

steam generatoi B. -Subsequent plant shutdowi and inspection revealed that the leaking tube wa the 11th tube in row 77 near the open inspectiol lane. Eddy current testing (ECT) revealed that th defect was located at the uppermost (15th) suppox plate level. The tube was removed from servic by plugging. This event was the'first indication o abnormal degradation in any B&W stear generator.

Prior to this date, two inservic inspections of the Oconee Unit 1 steam generator and one inspection of the Oconee Unit 2 stear generators had been performed. These inspection included eddy curient testing in accordance wit Regulatory Guide 1.83 ;and visual and fiber opti inspections.: The eddy current testing did nc reveal any tubes with greater than 20 percent wa penetration; and, in general, no evidence (

abnormal degradation had been observed.,

USNRC Technical Training Center A second steam generator tube leak occurred on October 31, 1976, in the Oconee Unit 2 steam generator A. The tube was again located near the open lane, and visual inspection using fiber optics revealed a circumferential crack near the upper tube sheet. This tube was also removed from service by plugging.

J On December 4' 1976, a leak developed in the Oconee Unit 2 steam generator B. The leaking tube was a*ain identified as a lane tube,-and was determined to have a 2700 circumferential crack at "2 the upper tube sheet. This tube was removed from the steam generator and subjected to visual, chemical, and metallurgical examinations. The metallurgical examination revealed that the crack had initiated on the outside surface of the tube and propagated through the wall, and then had continued circumferentially in both directions around the tube. The propagation of'the crack

-around the tube was attributable to a high frequency, low-stress fatigue mechanism.

As of November 1979, 17 tube leaks had oc r

curred in B&W steam generators.

Sixteen of 3

these leaks occurred at the Oconee Nuclear n

Station. In October 1979, Crystal River Unit 3 s

experienced a small tube-to-tube-sheet seal weld n

leak caused by the breakup of a burnable poison e

rod assembly that resulted in damage to the tube t

to-tube-sheet welds in steam generator B.

In e

addition, debris became lodged in a small per f

centage of the tubes in steam generator B.

n'. Corrective' actions taken -by Florida Power e

Corporation included video inspection of the s

damaged tube stubs, leak testing, a free path check n

of 100 percent of the A and B steam generator is tubes, eddy current testing, and tube plugging.

c Most of the leaks in B&W once-through steam Wt generators have occurred in tubes adjacent to the I1 -inspection' lane. This lane consists of the area f

created where a row-of tubes extending halfway "across the,tube bundle has been omitted to

":13-1 Rev 0896

B&W Crosstraining Course Manual facilitate inspection and chemical cleaning of the tube bundle. These leaks have occurred in the uppermost span at the intersection of the tube and the upper tubesheet or at the intersection of the tube and the 15th support plate., After fiber-optic inspections, through-wall circumferential cracks have been reported as the source of the leakage.

Examination of tube specimens removed from the generators indicates that fatigue, believed to have iesulted from flow-induced vibration, was the crack propagating mechanism. In at least two instances (Oconee Unit 3 in 1980 and Rancho Seco in 1981), fiber-optic inspection has revealed the source of the leak to be a 3600 crack around the tube circumference. B&W believes that the full circumferential failures have occurred during plant cooldown when the tubes are subject to tensile stress due to differential thermal loadings.

The initiating mechanism for the circumferential fatigue cracks is believed to be a combination of surface damage from corrosion products and concentrated chemical agents carried by moisture during adverse secondary system conditions.

B&W has developed a flow-blocking device (Figure 13-1) to be placed in the inspection lane.

These devices can be attached to tube support plates at several elevations. The purpose of this device is to alleviate corrosive attacks on tubes adjacent to the inspection lane in the upper span by forcing the steam and water mixture out of the open lane and into the heated bundle, where it will be evaporated.

A tube degradation phenomenon which appears to be increasingly -prevalent in B&W steam generators is localized wall thinning, and it is believed to be an impingement or erosion phe nomenon. This phenomenon has been observed at support plates, particularly the 14th support plate, and has caused at least three leaks at Oconee Unit

1. This phenomenon appears to be associated OTSG In-Se~rvice In n~eactfmn with debris found on the support plates and lower tubesheet. The debris deposits also provide a medium for the concentration of adverse chemicals which can lead to corrosion of the tubing. Samples removed from the field indicate that the debris is predominantly iron oxide with traces of other elements. B&W and the affected utilities are evaluating chemical cleaning as a method for removing the debris, and thus reducing the potential for further tube degradation. Table 13-1 shows once-through steam generator operating experience.

13.2 Steam Generator Inservice Inspection Requirements The program for inservice inspection of steam generator tubes, as set forth in the SG Tube Surveillance, is a modification of Regulatory Guide 1.83, "Inservice Inspection of Pressurized Water Reactor Steam Generator Tubes." It is an augmented program designed to provide more extensive inspection of steam generators with evidence of abnormal tube degradation. Degrad ed tubes are those that have a reduction in wall thickness of greater than 20 percent but less than the plugging limit, which is the maximum allow able reduction in tube wall thickness minus an operational allowance. Any tube with a reduction in wall thickness exceeding the plugging limit is a defective tube.

The NRC has approved a modified version of the Standard Technical Specifications for Three Mile Island Unit 1, Arkansas Unit 1, Davis-Besse, and Oconee Units 1, 2, and 3. This modified version treats tubes in areas of unique operating conditions or physical construction separately from the randomly selected tube samples.

Specifically, tubes within three rows of the open inspection lane, where fatigue cracks have occurred in the Oconee units, and tubes that pass through drilled holes in the 15th support plate rather than the broached openings, are subject to USNRC Technical Training Center 13-2 Rev 0896 13-2

ý Rev 0896 I

USNRC Technical Training Center

flI,?

C.necr~

~Cnnr~

M~u nuidOTSG In-Service Insnection 100 percent inspection. This form of inspection therefore distinguishes between random and deterministic forms of -'degradation. 'Similar technical specifications are under review for other "B&W units, including the Oconee units.

At present, the SG Tube Surveillanices for "nuclear -power plants require ithat inservice inspections be performed every 12 to 40 months, depending on the condition of the steain genera tors. In cases where ihe degradatiori processes are

'-highly active, the -NRC has required that the inspections be performed at even more frequent

'intervals.'

13.2.1 SG Tube Surveillance Basis The Surveillance Requirements for inspection "of the 'steam generator tubes ensure' that the structural integrity of this portion of the RCS will be maintained. The program for inservice inspec tion of steam generator tubes is based on a modification of Regulatory Guide 1.83, Revision 1: Inservice inspection of steam generator tubing

'is essential in order to maintain surveillance of the conditions of the tubes in the event that there is evidence of mechanical'damage or progressive degradation due to design, manufacturing errors, or inservice conditions that lead to corrosion.,

Inservice inspection of steam generator tubing also provides a means of characterizing the nature and cause of any tube degiadation so that correc tive nieasures can be taken.

primary-4o-'secondaryleakage less than this limit during operation will have an adequate margin of safety to'withstand the loads imposed during normal operation and by postulated accidents.

Operating plants have demonstrated that primary "to-secondary leakage of one gpm can be' detected by monitoring the secondary coolant. Leakage in excess of this limit -will require plant shutdown "and an unscheduled inspection, during which the leaking tubes will,be located and plugged.-

. Wastage-type defects are unlikely with proper chemistry treatment of the 'secondary coolant.

However,, even if a defect should develop in service, it will be found during scheduled inservice steam generator tube examinations.

Plugging,will be required for all tubes with imperfections exceeding the plugging limit (40%

of the,nominal tube; wall thickness). - Steam generator tube inspections of operating plants have demonstrated the capability to reliably detect degradation that has penetrated to or beyond 20%

of the original tube wall thickness.,

13.2.2 Eddy Current Testing Eddy current testing is the primary means for performing tube inspections.

This inspection method involves the insertion of a test coil inside the tube that traverses its length. The test coil is then excited by alternating current, which creates "a magnetic'field that induces eddy currents in the tube wall.- Disturbances of.the eddy currents caused by flaws'in'the tube wall will produce The plant is expected to be 'operated in a.- 'orresponding changes in the electrical impedance manner such that the secondary coolant will be, '- as seen at the test coil terminals. Instruments are maintained within those chemistry limits'found to",used to translate these changes in test coil result in negligible corrosion of the steam genera--

impedance into output voltages which' can be tor tubes. If the'secondary coolant chemistry is monitored by the test operator.. The depth of the not maintained within these 'limits, 'localized flaw can be determined by the observed phase corrosion may likely-result in stress -corrosion angle response. The test equipment is calibrated cracking. The extent of cracking during plant using tube specimens containing artificially operation would be limited by the I -gpm limit on induced flaws of known depth.

primary-to-secondary leakage. Cracks resulting in USNRC Technical Training Center 13-3 Rev 0896

B&W Crosstraining Course Manual IGeometric discontinuities along the tube length, such as tubesheets, tube support plates, and dents, also produce eddy current signals, which make discriminating defect signals at these locations difficult. The recent development of multifrequency eddy current techniques (whereby the test coil is excited at multiple frequencies rather than at a single frequency) has substantially enhanced operator capabilities to detect relatively small-volume flaws in the presence of extraneous signals.

Very small volume flaws, such as those caused by intergranular attack, stress corrosion, fatigue cracks, and small pits, have traditionally been hard to detect with the single-frequency eddy current test method. The use of multi-frequency techniques and specialized, nonstandard probes has improved detection capabilities in this regard.

However, further improvements are necessary and are the subject of much ongoing effort by the nuclear industry and through NRC-sponsored research programs.

For the present, the staff concludes that small flaws of structural significance are generally detectable. If such flaws go undetected and result in leaks, the initial leakage will generally be small and of little consequence, a conclusion confirmed by operating experience. The restrictive leakage rate limits in the plant Technical Specifications provide assurance that the unit will be shut down in a timely manner for the appropriate corrective action.

If necessary, preventive repairs, more restrictive limits on primary-to-secondary leakage, hydrotesting of the tube bundle, and corrective measures to retard the rate of further corrosion are additional steps which can be taken to provide added assurance of safe operation.

OTSG In-Service Inspection 13.3 Tube Repairs 13.3.1 Tube Plugging The plugging limit is established in accordance with criteria in Regulatory Guide 1.121, "Basis for Plugging Degraded PWR Steam Generator Tubes." B&W has conducted burst and collapse tests on steam generator tubes with simulated defects, to establish the extent of "allowable" tube degradation. Specimens tested included undamaged tubes and tubes with varying depths of longitudinal slits, circumferential slits, uniform thinning, and long, flat defects on tube outer surfaces. The burst and collapse tests were run at normal, operating temperature. Based on the burst and collapse test data and on calculations performed in accordance-with Regulatory Guide 1.121, B&W has calculated the maximum defect depths allowable under normal operating or accident conditions.

Including a margin for continued degradation between inspections and for error in eddy current testing, the plugging limit for B&W steam generator tubes has been conservatively estab lished as 40 percent. This tube plugging criterion assures that tubes will not become degraded to the extent that they could fail during postulated accident conditions prior to the next inservice inspection.,

The plugging repair technique involves the installation of plugs at the-tube inlet and outlet. After plugging, the tube no longer functions as the boundary between the primary and secondary coolant systems.

13.3.2 Sleeving When tubes are severely degraded, often large numbers of them must be removed from service by plugging to ensure the generator's safe operation. Plugging steam generator tubes results Sin a loss of heat' transfer surface and can eventually necessitate a reduction in power levels.

USNRC Technical Training Center 13-4 Rev 0896

-1 USNRC Technical Training Center 13-4 Rev 0896

n~eW -rnvcfcraunvna Couurse Mianual TS nSrvc nseto To prolong the life of severely degraded steam "sleeves af the'Oconee units 'are being performed generator tubes,,some utilities, with prior NRC during each inservice inspection.

approval, have elected to repair them by sleeving.

I, Sleeving not only decreases the plant downtime 13.4 Long Term Corrective Actions but also leaves the repaired tubes functional.

I I I 13.4.1 Design Changes The tube sleeving procedure involves inserting a tube of smaller diameter (or sleeve) inside the.

tube to be repaired. The sleeve is positioned to span the degraded portion of the original tube and is then 'either, hydraulically or mechanically expanded above and below the degraded region.

-The expanded joints are sometimes brazed to, ensure additional leak tightness.

Sleeving has been used for two different purposes: (1) to repair degraded tubes as an alternative to plugging and (2) to stiffen the tubes so as to alter their natural frequency in an effort to eliminate or reduce flow-induced vibration.

Sleeving repairs to restore primary coolant boundary integrity have been performed, to date, on tubing degraded by wastage, intergranular attack, and stress corrosion cracking.

The tube sleeves intended to stiffen the tubes, thereby reducing dynamic stresses resulting from flow-induced vibration, vary in length from

.. approximately 1 foot to 1-1/2 feet and are secured

-.-.. inside the generator tube by two expanded regions. One or more sleeves can be installed in

,a given tube to achieve the desired vibration characteristics. The sleeves are not intended to perform as part of the primary coolant system boundary and are not used for repairing degraded tubes. The tube sleeves were qualified analytical ly and experimentally, and demonstration pro grams involving installation of a small number of tube sleeves were approved by, the NRC for the Oconee units and Three Mile Island Unit 2. No inservice inspection of the steam generators was performed at Three Mile Island Unit 2 prior to the March 28, 1979, accident. Inspection of the tube B&W has modified its existing designs in an

,attempt to eliminate the known mode of degrada tion. For example, to reduce tube failures at the upper tubesheet along the inspection lane, B&W has recommended that operating plants install five lane blockers, Figure 13-1, between the 7th and J14th tube support plates to minimize the potential for moisture to enter the upper levels of the steam generator along the inspection lane during normal operations. The installation of blockers, coupled with strict attention to secondary plant operations, should minimize the occurrence of this form of degradation.

Another area of improved design concentrates on the selection of more corrosion-resistant

,materials in the condenser. Water leaking through the failed condenser tubing, when combined with air, can contaminate the condensate, feedwater, steam generator water, and steam. This contami nation in turn degrades the structural integrity of the steam generator tubes, turbine, and-other components in the cooling system. The utilities are reducing the amount of ammonia-sensitive

,alloys from the condensers and replacing them with more corrosion-resistant alloy tubing.

413.4.2 Water Chemistry Control The Babcock and Wilcox 'recommends all volatile treatment (AVT). for steam generator water chemistry control. AVT consists of the addition of hydrazine (N2H4) to the condensate water for the purpose of scavenging oxygen.

Excess hydrazine (that amount stoichiometrically in excess of dissolved oxygen) thermally decom poses to ammonia at,,steam generator operating Key USYO USNRC Technical Training Center 13-5 USNRC Technical Training Center 113-5 S

OTSG In-Service lnsnection RKev 0896

B& rssrii~C ureM nulO S

insn......

temperatures, which will provide for pH control to reduce carbon steel corrosion. If the thermal decomposition of hydrazine to ammonia does not sufficiently raise the pH, additional tanks and pumps are utilized so that other nonsolid additives such as ammonium hydroxide, morpholine, or cyclohexamine can be added. These additives act t6 increase the pH throughout the entire condensate and feedwater system, steam genera tors, and steam cycle to reduce corrosion of carbon steel components thrbughout the secondary system. Extensive experience in both the fossil and nuclear industries has demonstrated the benefits of these additives for secondary cycle corrosion control in electric power generating plants.

The primary advantage of AVT is that no dis solved solid additives are used (such as phos phates) which can concentrate in' the steam generators to induce corrosion, such as phosphate wastage of Inconel-600 tubing. The disadvantage of AVT is that it provides no buffering capacity to mitigate the effects of impurities in the cooling water introduced through condenser leakage or corrosion products.

Thus, when condenser leakage occurs, the resultant impurities can enter the steam generators and cause severe changes in the pH, with resultant increases in corrosion rates.

B&W recommends continuous full-flow condensate polishing at all times, and blowdown only during startup, before a power level sufficient to produce superheated steam is reached. Both recommendations are prudent for the once through superheating steam generator (OTSG) design. Continuous full-flow condensate polish ing is necessary to minimize the possibility of hardened salts (from, condenser inleakage) enteiing the steam generator's, where, because of their low solubility 'as the steam becomes superheated, the salts will deposit on heat-transfer surfaces, thus reducing 'efficiency. The use of blowdown during startup only is also consistent with the OTSG design.

During low-power operations, the lower portion of the OTSG has internal recirculation, which tends to concentrate feedwater impurities (similar to the normal concentration mechanism in U-tube steam gener ators). Therefore, blowdown is necessary during low-power operation to mitigate the effects of concentrating these impurities. However, when the OTSG starts producing superheated steam, the internal recirculation and concurrent concentration of feedwater impurities stops.

Without this concentration, of, impurities, blowdown then becomes simply a discharge of feedwater, which is an inefficient method for removing impurities.

The production of impurities, for the most part, is enhanced by the following:

1. Condenser water inleakage is the most significant contributor to steam generator corrosion problems for plants with AVT.

Improved condenser designs, materials, leak detection procedures, and repair procedures are recommended.

Items to be considered include improved condenser tubes, double tube sheets, and welded tube/tubesheetjoints.

2. Excessive condenser air ingress is the primary contributor to condensate and feedwater system corrosion. Excessive corrosion of the condensate and feedwater system can result in corrosion product buildup in the steam generators and concurrent concentration of condenser cooling water impurities to form sludge, which enhances corrosion in the steam generators.

3. Copper alloys should be eliminated from all areas of the condensate/feedwater/steam cycle.

Substantial evidence exists that copper oxides in the steam generators are an important catalyst in accelerating the rate of corrosion processes within steam generators.

USNRC Technical Training Center 13-6 Rev 0896 13-6 Rev 0896 I-B&W Crosstrainine Course Manual

- OTSG In-Servici* Inspection USNRC Technical Training Center

B&W Crosstrainin. Course Manual 13.5, References

1. NUREG-0571, "Summary of Tube Integrity Operating Experience with Once-Through Steam Generators," March 1980.

2. NUREG-0886, "Steam Generator Tube Experience," February 1982.

3. Nuclear Power Experience Manual, Vol.

PWR-2, Reactor Coolant System - Steam Generators.

USNRC Technical Training Center 13-7 Rev WSYb USNRC Technical Training Center 13-7 OTSG In-Service Inspection Rev 0896

TABLE 13-1 OPERATING EXPERIENCE WITH BABCOCK AND WILCOX ONCE-THROUGH STEAM GENERATORS THROUGH NOVEMBER 1981 Plant name OL Fatigue Erosion/

No. of, No. of tubes Sleeves Issuance crackin corrosio leaking tubes plugged installed date g

n Oconee 1 2/73 X

X 11 311 (2%)

16 Oconee 2 10/73 X

X 3

30 (<1%)

Oconee 3 7/74 X

X 5

101 (<1%)

Arkansas 1 5/74 X

3 13 (<1%)

Rancho Seco 1 8/74 X

X 1

15 (<1%)

Three Mile Island 4/74 X

0 19 (<1%)

1 12/76 X

0 32 Crystal River 3 4/77 X

2 13 (<1%)

Davis Besse 1 USNRC Technical Training Center 13-8 Rev 0896 Rev 0896 B&W Crosstraining Co-urse Manual USNRC Technical Training Center 13-8

DRY STEAM RE-ENTERING LANE Figure 13-1 Inspection Lane Flow Blocker

BABCOCK AND WILCOX CROSS TRAINING MANUAL CHAPTER 14 Oconee Tube Leak

B&W Crosstraining Course Manual Oeonee Tube 1leak TABLE OF CONTENTS 14.0 OCONEE-2 STEAM GENERATOR TUBE LEAKAGE 14.1 Initiation of the Leak..................................................

14-1 14.2 Shutdown and Leak Isolation...........................................

14-1 14.3 Plant Cooldown......................................................

14-2 14.4 Turbine Building Flooding and Decontamination 14-3 Appendix - Sequence of Events..................................................

14-4 LIST OF FIGURES 14-1 Pressures and OTSG Levels 14-2 System Temperatures 14-3 Oconee-2 Main Steam System 14-4 Oconee-2 Condensate and Feed System USNRC Technical Training Center 14-i Rev 0896 I

USNRC Technical Training Center 14-i Rev 0896

RBtW Crosstraininp Course Manual Ooe ueLa

-14.0 OCONEE-2 STEAM, GENERATOR guidance for identifying the leaking steam gener TUBE LEAKAGE ator and criteria for shutting down and isolating the plant.

1 I-Learning Objectives:

1. List the symptoms'of a steam generator tube leak.

"2. -Describe the actions that should be taken if the tube leakage exceeds technical specification limits

3..Lit(thiee actions that can be taken to mini "mize offsite releases during'steam generator tube leakage events.

14.1, 'Initiation of the Leak On September 18, 1981, Oconee Unit 2 was in the power escalation phase of a mid-cycle restart adfter a short-term outage. At 1010, the power, increase was stopped at approximately 94 percent power to calibrate nuclear instrumentation. The

• RCS was at 2150 psig and 579°F(Tave)

At 0930, the plant staff noted that the reading on the condenser off-gas monitor, 2RIA-40, was increasing from the normal 3,000 cpm that had

'been indicated at 0800: By 1145, the condenser

'offgas monitor had increased to 40,000 cpm.,The primary-to-secondary leak rate was calculated to be'0.03 gpm, based on grab samplesfrom the condensate steam air ejector' (CSAE). 'Shortly thereafter, the 6perators initiated corrective ac tions in accordance with procedure OP/O/A/1106/31, "Control of Secondary Containinati6n." This procedure provides three functions when primary-to-secondary leakage is suspected: (1) it minimizes radioactive discharges from the secondary system to the turbine building sumps, (2) it controls any contaminated water that does accumulate in the turbine building by termi "nating all automatic discharges, and (3) it provides At 4200, the turbine building and Powdex

"-sump pumps were secured to avoid unplanned release of potentially contaminated water in the sumps. By 1420, potentially contaminated drains were rerouted fromn the turbine building sump to the hotwell pump sump in order to minimize the spread of contamination.

At 1300, radiation measurements on the "A" and "B", main steam lines showed no detectable difference. However, by 1350, measurements on the "B" line had increased to 0.02 mR/hr above background, while the "A" line remained at background.

At 1529, 2RIA-40 went off-scale-high and 2RIA-17 (main steam line "B" radiation monitor)

'increased to about 5 mR/hr. This indicated that the

,leak had suddenly increased and that it was in the

" "B" steam generator. The leak was calculated to be about 25 gpm based on a grab sample from the CSAE: An "Unusual Event" was declared, and

appropriate NRC, corporate, and local civil au thorities were notified.

14.2 Shutdown and Leak Isolation Immediately following the sudden increase in leak--rate, a rapid plant shutdown using-normal procedures was initiated. The shutdown followed

• ,procedure OP/2/A/ 1102/10, "Controlling Proce dure for Unit Shutdown." The leak rate was calculated as 25 gpm; and the event was classified as a major tube leak rather than as a tube rupture.

Consequently,, procedure. EP/O/A/1800/17, "Steam Generator Tube Rupture," was not fol lowed,' although it, was occasionally. used for general guidance. Reactor power was reduced at a rate of approximately 3 percent/minute (coin-USNR Tehnicl Tainng Cnte 14-Ke U7 USNRC Technical Training Center

o:*14-1 Oconee Tube Leak KeY 0890

B&W Crosstraining Course Manual Oconee Tube Leak pared to a normal shutdown rate of about 10 percent/hour.) The reactor was subcritical ap proximately one hour after the high leak rate commenced. The electrical generator was taken off line when the power level fell to 15 percent.

Initially, the turbine bypass valves were opened to maintain steam pressure below the steam safety relief valve setpoints. Main feedwater pump "B" was manually tripped at 1622, and the "B" steam generator feedwater and turbine bypass valves were closed at 1632, when "B" main steam pres sure was about 840 psig. Other valves were also closed so that by 1745 the "B" steam generator was essentially isolated except for minor leakage paths.

14.3 Plant Cooldown With action having been taken to isolate the "B" steam generator, cooldown was continued using the "A" steam generator. At about this time (1627), an additional high pressure injection (HPI) pump was started to make upý for cooldown "shrink" and continued leakage. The reactor was initially cooled down and depressurized from 1627 until about 2300 on September 18. Pressure in both SGs was decreased within normal shut down limits from an initial value of about 890 psig to 40 psig at 2100. Following actions to isolate the "B" steam generator, its pressure was nearly the same as the saturation pressure corre sponding to the primary temperature (TJ) after 1745, as shown in Figures 14-1 and 14-2.

Figure 14-2 also shows that the temperatures in both steam lines remained higher than the saturation temperature of the liquid in the steam generators throughout the cooldown.

Since superabov'e the reactor coolant temperature could

'not have existed, these temperature lags are evidently caused by the slower cooling of the metal in the steam lines where the steam tempera ture detectors were located.

Shortly after the reactor was shut down, both SG levels decreased, to about 25 inches on the start-up range (about 29 inches above the lower tubesheet). The "A" steam generator remained at this level; at 1718, the last running main feedwater pump (2A) was manually tripped, and the condensate booster pumps were used to supply water to the "A" steam generator. At 1745, the "B" steam generator level began to rise at about 0.4 percent/minute. This corresponded, to a net water addition rate of about 50 gpm and included the tube leak and the effects of feedwater in leakage and steam out-leakage. At 2200, as the level in the "B" steam generator approached 90 percent on the operating range, a reactor building entry was made and the bottom drains on the "B" steam generatorwere opened in order to drain the SG to the main condenser hotwell through the hot blowdown lines. This was done to prevent filling the main steam lines with water. As far as can be determined, this periodic draining of the steam generator did prevent overflow of water into the steam lines, although the level exceeded the upper limit of the operating range on the level instrumentation.

From about 1930 until 2230 on September 18, the RCS pressure was held steady at about 540 psig. The reason for holding pressure rather than continuing to lower it may have been related to certain activities that were taking place during that time, such as setting the valve line-up for the Low Range Reactor Coolant System Pressure indicator.

By 2300, the RCS pressure had been lowered to 300 psig.

At approximately 0800 on September 19, the RCS reached the conditions specified in Oconee operating procedures (<250°F, <350 psig) for initiating decay heat removal via the LPI system.

At about 0900, an attempt was made to open the LPI suction valves from the reactor coolant USNRC Technical Training Center 14-2 Rev 0896 B&W Crosstraining Course Manual Oconee Tube Leak USNRC Technical Training Center 14-2 Rev 0896

ny~w Cr-ectrainino Coiurse ManualIOoneTbeLa system (2LP-1 and 2LP-2):Valve 2LP-2 failed to open electrically both from the control panel and from the circuit breaker. Three reactor building entries were made from 1100 on September 19 through 0400 on September 20 in an attempt to open the valve manually. During those three entries, the valve operator was manually moved 3/4 turn, 3/4 turn, and 2 turns respectively. After each entry, the plant staff tried to open the valve electrically from the breaker. These efforts were unsuccessful because the valve stem had been deformed. At 0400 on September 20, the valve was opened by removing the operator and "jacking" the valve open using manual hoists (come-alongs).

By 0647 on September 20, the LPI system line-up was complete, and decay heat removal was initiated, having been delayed about 21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br />.

Cooldown and depressurization of the RCS resumed, and at 0430 on September 21, the operators began pumping down the RCS loops.

The tube leak was terminated at 0615 on Septem ber 21, 1981.

14.4 Turbine Building Flooding and Decontamination As described earlier (Section 14.1), the turbine building sumps were isolated shortly after initial tube leak determination on September 19,1981, in accordance with procedure OP/O/A/1106/31.

Normal leakoff from both Units 2 and 3 was flowing to the sumps from such things as valves, flanges, and drains. Thus, a considerable amount of initially uncontaminated water flowed to the sumps. (Unit 1 was shut down and did not contribute to the water inventory in the sumps.) At about 1700 on September 18, the CST overflowed to the turbine building trenches. This occurred following system alignment for entering the feedwater cleanup mode.

At about 1200 on September 19, the circuit breakers for the feedwater pump (FDWP) seal injection sump pumps tripped due to a breaker malfunction. While these were being repaired, the sumps overflowed to the turbine building sumps.

Since radioactive water from the "'B" steam generator was being drained to the hotwell at this time, the FDWP seal injection water was contaminated and resulted in contamination of the water in the turbine building sumps. At 0930 on September 20 the CSToverflowed to the turbine building sumps again. The cause of the overflow may have been related to restarting the FDWP seal injection sump pumps or to manual hotwell level control in preparation. for breaking main condenser vacuum.

Cleanup of contaminated water required temporary large-scale water processing. Demin eralizers, pumps, hoses, and fittings were

.acquired. By the afternoon of September 19, 1981, normal leakoff from all three units was being processed' by' portable demineralizers.

The processed water was routed along with Unit 3's turbine building sump to the-upper settling basin.

Between September, 19 and September 24, a temporary discharge line was installed between the CST pumps 'and the'normal plant discharge line, which included RIAs 33 and 34.Thie Unit 2 and Unit I CSTs,were used as holding tanks where processed, demineralized water was stored for sampling prior to release to Keowee tailrace.

This method was generally'used until the Units 1 and 2 turbine building sump was put back on batch release. Including water used for decon tamination purposes, an estimated 2.5 million gallons of contaminated water was processed. The entire cleanup process required about six weeks.

USNRC Technical Training Center 14-3 Key UJO 14-3 USNRC Technical Training Center Oconee Tube Leak

-. - Rev 0896Y

1l&W Crosstrainin0 Couirse Malnual Oconee Tube Leak APPENDIX - SEQUENCE OF EVENTS 9/17/81 0000 Plant condition 2150 psig and 535TF Deboration in progress 0543 Reactor critical increasing power 1600 Reactor power - 60%

9/18/81 0800 Reactor power 87.5%, increasing Condenser off-gas monitor 2RIA-40 reads 3000 cpm (normal) 0930 2RIA-40: increasing 1030 2RIA-40: 10,000 cpm 1145 2RIA-40: 40,000 cpm Condensate steam air ejector (CSAE) grab sample indicates primary-to-secondary leak of 0.03 gpm 1200 Initiated "Control of Secondary Contamination" procedure, OP/O/A/1 106/31.

Stopped turbine and powdex sump pumps 1300 Radiation measurements of"A" and "B" main steam lines show no detectable'difference 1319 2RIA-40 grab samp!e: 425x0-4 mCi/ml gaseous activity 1350 Radiation measurements of main steam lines "A" are background: "B" lines are 0.02 mRhr 'above background 1420 Completed rerouting potentially radioactive drains from the turbine building sump to the hotwell pump sump 1529 2RIA-40: off-scale high Main steam line "B" radiation monitor 2RIA-17 indicates 5 mR/hr Leak determined to be in "B" steam generator Commenced reactor shutdown 1543 Declared "Unusual Event" since tube leak calculated to be approximately 25 gpm Notified authorities 1558 Generator off line 1622 Main feedwater pump "B" manually tripped 1627 Reactor subcritical Cooling down RCS Started additional HPI pump to keep up with "shrink" and leak 1632 Closed SG "2B" feedwater and turbine bypass valves 1640 RCPs 2A2 and 2B2 shutdown 1655 All CRDs inserted 1700 Condensate storage tank overflows to turbine building trenches USNRC Technical Training Center 14-4 Rev 0896 Rev 0896 14-4 Oconee Tube Leak USNRC Technical Training Center

SEQUENCE OF EVENTS (continued) 1718 Main feedwater pump "A" manually tripped 1750 -

2B OTSG level increasing; 2A OTSG level at 25" 1800 -

2B OTSG level is increasing 1900 -

2B OTSG leVel is 40% (operating range) 2100

-Made reactor building (RB) entry to line up pressurizer auxiliary spray 2200 -

Opened bottom drains on 2B OTSG and started drain back to hotwell through blowdown lines 9/19/81 0000 RCS at 286-F, 300 psig SG "B" pressure is 35 psig 0900 2LP-2 ( LPI suction from RCS ) would not open electrically 1100 Made three RB entries to try to open 2LP-2 manually 1300 Reactor building purge on 2045 RCS gross activity 6.4x10"' mCi/mi 9/20/81 0400 2LP-2 opened manually by maintenance personnel 0647 Started LPI pump 2A (Decay Heat Removal) 0714 -

Secured 2A1 RCP 0930 -

CST overflowed to trenches 1000 Broke vacuum on main condenser 9/21/81 0430 -

Started pumping down RCS loops 0615 Leak stopped USNRC Technical Training Center 14-5 Rev 0896 B&W Crosstraining Course Manual Oconee Tube Leak USNRC Technical Training Center 14-5 Rev 0896

RCS Press.

Pst for T.

SG "B" Press.

SG "A" Press.

SG "B" Level SG "A" Level Psal for 50°F Subcooling

-- I

\\

• 1 I

/

/

/

/

\\A K

1600 1700 1800 1900 2000 Clock Time (9/18/81) 2100 2200 2300 2400 Figure 14-1 Pressures and OTSG Levels 2400 2200 2000 A

Legend:

18001-

_/

1600 1400 l-

'WI 1'

L 1200 1000 800 rl)

U) a)

0..

100 80 Ca 60 CL6 0

0 40

-J 20 600 10 1/

400 200 I-1...

1500 1500 I-II

1700 1800 1900 2000 "1"1

-n CD

_A

-.I CD CD 3

"a CD cn S400 I.-

200' 1500 1600 2100 2200 2300 2400

Steam Generator A

41 0

0

,=

(D (D

ci, 3

U)

(D 3

Steam Generator B

Stop Valve E

E Emergency Feed Pump Turbine E

E Turbine Stop Valve Turbine Valve Turbine Bypass To Condenser Turbine Bypass Valve Feedwater Pump Turbines To HP Turbine To HP Turbine "Safety Valves

-n C:

0 0

CD CD r'3 0

0.

CD CD CL CD CD C',

BABCOCK AND WILCOX CROSS TRAINING MANUAL CHAPTER 15 Rancho Seco Loss of ICS Power

B&W Crosstraining Course Manual Rancho Seco Loss of ICS Power TABLE OF CONTENTS 15.0 RANCHO SECO LOSS OF ICS POWER 15.1 Introduction.........................................................

15-1 15.1.1 ICS Power Supplies 15-1 15.1.2 M ain Steam System 15-1 15.1.3 M ain Feedwater System............................................

15-2 15.1.4 Auxiliary Feedwater System.........................................

15-2 15.1.5 High-Pressure Injection System......................................

15-2 15.2 Loss of ICS DC Power...............

15-2 15.2.1 Initial Conditions 15-2 15.2.2 Initiating Event...................................................

15-2 15.2.3 RCS Overcooling 15-3 15.2.4 Safety Features Actuation System(SFAS) Actuation......................

15-3 15.2.5 Partial RCS Repressurization........................................

15-4 15.2.6 Restoration of ICS dc Power and Plant Stabilization......................

15-6 15.3 M ajor Issues........................................................

15-9 15.3.1 ICS Power Failure.................................................

15-9 15.3.2 M akeup Pump Failure..............................................

15-9 15.3.3 RCS Overcooling 15-10 15.3.4 PRA Insights....................................................

15-11 15.4 References........................................

15-11 Appendix - Sequence of Events.................................................

15-12 LIST OF FIGURES 15-1 ICS Power Supplies 15-2 Main Steam System 15-3 Main Feedwater System 15-4 Auxiliary Feedwater System 15-5 High-Pressure Injection System USNRC Technical Training Center 15-i Rev 0896 Rev 0896 USNRC Technical Training Center 15-i

RRWCrqtrii~,CureMaulRaco eo osofIS oe 15.0 RANCHO SECO LOSS OEICS POWER

.-Learning Objectives:

"1. Describe the symptoms of an overcooling transient.

2. Explain how the loss of power to the ICS control stations resulted in:

a.' An overheating event and

b. -A subsequent overcooling event'

3. Describe the effect of operating a multi-stage centrifugal pump without a suction source.

15.1 Introduction On December 26, 1985, Rancho Seco experi enced a loss of ICS power causing a reactor trip and rapid cooldown of the reactor coolant system.

This incident was not the first time Rancho Seco had experienced problems with its ICS power supplies.

A reactor trip and excessive plant cooldown occurred on January 5, 1979, resulting from a personnel error that caused a ground fault in the ICS DC power supplies. The plant response to the 1979 event was almost identical to the December 26, 1985 event; On March 20, 1978, a reactor trip and excessive plant cooldown oc curred resulting from a,light bulb--;from a backlighted push button being dropped into the socket grounding the NNI DC power: A complete loss of NNI DC power resulted. This is referred to as the "light bulb" incident and is considered.

the most,, severe overcooling transient to ever occur at Rancho Seco and is referenced in several vendor, licensee, and regulatory documents.

Although ICS power was not lost during the "light Sbulb" incident, the design of the power supplies is virtually identical. A brief description of Rancho Seco system differences follows.

.15.1.1 ICS Power Supplies As shown in Figure 15-1, there are redundant 120-vac supplies to the ICS.- One of the supply sources is from a 120-vac vital bus, and the sec ond supply is a non-vital 120-vac bus. Each of the 120-vac sources supplies positive and negative 24-vdc power supplies through switches S I and S2. The +24-vdc power supplies and the vdc power supplies are auctioneered, and the highest voltage provides power to the ICS buses. A power supply monitor is installed and monitors the output of each power supply as well as the auctioneered output. Because of the inability to predict the response of the ICS under degraded voltage situations,-the power supply monitor will open switches S I and S2 if any monitored voltage drops to 22 vdc.

Internally, the ICS will convert the +/- 24 vdc to a -10 to +10 Vdc that is used by the system.

When this signal is sent to the control valves, the v demand represents a fully closed signal; the

,+10-v, signal represents a fully open signal; the zero signal will position the valve to 50% open.

The valves of interest in this transient are:

1. Atmospheric dump valves (ADVs),

2. Turbine bypass valves (TBVs)

3. Main feedwater valves, "4. Auxiliary feedwater valves The main feedwater pump turbine speed is also controlled by the ICS. In this control circuit,

- a 0- to +10-v signal is used. The signal range of 3.4 to 7.3 v corresponds to the minimum to maxi mum range of feed pump speeds.

-15.1.2 Main Steam System The main steam system (Figure 15-2) supplies steam from the once-through steam generators (OTSGs) to the turbine-generator, the turbine



nOnE Iixv uou USNRC Technical Training Center

15-1 USNRC Technical Training Center

° 15-1 S Rancho Seco Loss of ICS Power

-g, BW Crosstrainino Course Manual I

Re.tv 0876

B&W Crosstrainin* Course Manual I Rancho Seco Loss nfICS Power driven main feedwater pumps, the dual drive auxiliary feedwater pump, and other plant auxil iary systems. Three atmospheric dump valves (ADV) and two turbine bypass valves (TBV) are installed on each header to remove excess reactor coolant system energy during a turbine trip or load rejection. The valves have a total capacity of 50 percent, with equal amounts of heat removal capacity available by dumping steam to the atmo sphere or bypassing steam to the condenser.

These valves are controlled by the ICS. Rancho Seco normally operates with four of the six ADVs manually isolated to prevent overcooling follow ing a reactor trip.

15.1.3 Main Feedwater System The discharge of the turbine driven main feedwater pumps (Figure 15-3) is routed to the OTSGs via high-pressure feedwater heaters, startup feedwater regulating valces, and the main feedwater regulating valves and their associated block valves. As previously stated, the main feedwater pump speed, the startup regulating valves, and the main feedwater regulating valves are controlled by the ICS.

15.1.4 Auxiliary Feedwater System The auxiliary feedwater (AFW) system is shown in Figure 15-4 and consists of redundant pumps and flowpaths to each steam generator.

One of the two pumps is 'motor driven, and the othei" pump is dual driven. The dual driven pump is powered by a turbine on one end'of the pump shaft and a motor on the other end. The pumps normally receive a suction from the condensate storage tank (CST). Auxiliary feedwater flow to the steam generators'is' controlled-by parallel valves in each supply line. One of the two valves receives a signal from the ICS, and the second valve receives a signal from the safety features actuation system (SFAS).

15.1.5 High-Pressure Injection System The high-pressure injection system (Figure 15

5) is typical of the 177 FA high-pressure injection (HPI) systems. As shown, the pumps normally receive a suction from the makeup tank and discharge to an RCS cold leg via the makeup flow control valve.

If an emergency core cooling actuation signal is received, the following changes will occur in the system:

1.

2.

3.

4.

The makeup tank outlet valve closes.

The borated water storage tank suction valves open.

The four HPI motor operated valves open.

The HPI recirculation isolation valves close.

15.2 Loss of ICS DC Power 15.2.1 Initial Conditions The plant had been returned to power follow ing a two-day outage for repairs. Power had been escalated to 76% (712 Mwe) and stabilized. RCS T.,e was at its normal value of 582°F, and system pressure was 2150 psig. The pressurizer level was at its normal value of 220 inches.

15.2.2 Initiating Event The loss of ICS dc power was caused by a failure of the powerisupply monitor which opened switches SI and S2 (Figure, 15-1). The loss of input power resulted in a zero voltage on the +/

24-vdc busses in the ICS. At zero volts, the main feedwater regulating valves and the startup regu lating valves assumed a 50% open position. Since voltage was lost, the main feedwater pumps dropped to minimum speed. With the reactor at 76% power and almost no feedwater flow to the once-through steam generators for RCS heat removal, an overheating event started even though USNRC Technical Training Center 15-2 Rev 0896 I___________

15-2 Rev 0896 USNRC Technical Training Center

B&W Crosstraining Course ManualRacoSoLosfICPoe the turbine bypass and atmospheric dump valves were 50% open due to the loss of ICS power..

.With reduced heat removal, the reactor's energy causes an increase in RCS temperatures.

The increase in temperatures results in an increase in

-,pressurizer' pressure and pressure level., The "pressurizer spray valve was manually opened in an effort to lower RCS pressure.

.15.2.3 RCS Overcooling Due to the net undercooling, the reactor tripped on high RCS pressure sixteen seconds "after the loss of ICS power. The RCS pressure

• peaked about one second later at a value of 2298 psig: Several of the steam generator safety valves lifted and then reseated. The reactor trip signal "also tripped the turbine generator. The operators closed the pressurizer spray valve when the reac tor tripped, in anticipation of RCS cooldown and depressurization. With the reactor at decay heat levels, and a heat removal capacity of greater than 25% due to the half-open TBVs and ADVs, an overcooling transient began.

Both AFW pumps actuated about the time the "reactor tripped due to the low MFW pump dis charge pressure. These pumps began to supply AFW flow to both steam generators through the half open AFW (ICS controlled) flow control "valves.

The operators recognized that power had been lost to the ICS about two minutes after the reactor trip, but they did not initially understand the plant response to this loss of power. The operators also Srecognized the 'beginning of an overcooling transient due to the 50% demand to the TBVs, "ADVs, arid the AFW valves. Realizing that these components could.not be operated from the control room due to the loss of power, equipment

-operators were dispatched to close manual isola "tion valves. The operators could have closed the valves from the remote shutdown panel. How ever, they over-looked that method.

Operators in the control room noticed pressurizer level decreasing and fully opened the "A" high-pressure injection valve for more makeup flow to the RCS. The makeup tank level began to rapidly decrease, and the operators opened the-BWST suction valve to the makeup pumps and started the "B" HPI pump.

"Believing that-significant main feedwater (MFW) flow (chart recorder also failed to mid scale) existed, the operators tripped both MFW pumps. The AFW system was supplying about 1000 gpm to each steam generator at this time.

With failed steam valves and excessive auxiliary feedwater flow, the RCS pressure and temperature continued to decrease.

15.2.4 Safety Features Actuation System(SFAS) Actuation In a little less than three minutes, after the reactor trip, RCS pressure decreased from 2298 psig to the SFAS actuation setpoint of 1.600 psig, and pressurizer level had decreased from 220 in.

to 15 in. The actuation signal opened all four HPI motor operated valves and placed a second make up pump in service. Also, the makeup tank outlet

,valve and the pump recirculation valves were closed. Selected emergency equipment, including the motor driven AFW pump, were automatically shed from the vital buses and sequence loading of "SFAS equipment began.

The AFW (SFAS) valves came fully open. Even with full high pressure injection flow, RCS pressure continued

• to decrease.

The control room operators, recognizing that the AFW flow was excessive, initiated an override of the SFAS signals to the AFW (SFAS) valves and closed them. However, the AFW (ICS) flow USNRC Technical Training Center 15-3 Rev W9b

=15-3

÷td Rancho Seco Loss oflICS Power Rev 0896 USNRC Technical Training Center

B&W rossrainni~Coure MaualRancho Seco Loss of ICS Power control valves remained at the 50% position.

Meanwhile, the motor driven AFW pump sequenced back onto its vital bus.

During this time frame, several people checked the ICS power cabinets. It was realized that all four 24-vdc power supplies were deenergized; however, no one seemed to recognize that switches S 1 and S2 were open.

Because of continued overfeeding and excessive steam dumping, the cooldown of the RCS continued. When steam generator pressure decreased to 500 psig, the running condensate pumps began to supply feedwater to the OTSGs.

The feeding by the condensate pumps added approximately 1000 gpm flow to each steam generator. The RCS temperature had cooled 100 degrees in the first 7 min. following the reactor trip. Later, the RCS pressure decreased to a low of 1064 psig, and the pressurizer water level dropped off-scale.

Subsequent evaluation indicated that a small steam bubble formed in the upper head region of the reactor vessel.

15.2.5 Partial RCS Repressurization IThe transient continued with the pressurizer level off-scale low, and with full high-pressure injection in progress. The operators outside of the control room were working feverishly to isolate the sources of released steam and the excessive AFW flow. Although pressurizer level was off scale, the RCS subcooling margin was substantial (85 degrees and increasing).

The subcooling margin began to increase prior to the reactor trip and did not decrease to the pre-trip value of 40 degrees at any time during the transient. The high subcooling margin while the pressurizer level was off-scale was an indication to the operators that the pressurizer had not completely emptied, but the pressurizer was empty for approximately 3 minutes.

Although the cooldown continued, the flow from the high-pressure injection system apparently began to refill the pressurizer, although the level was still below the indicating range.

RCS pressure also began to increase from a low point of 1064 psig. The continued cooldown, combined with the. RCS pressure increase resulted in conditions that exceeded the B&W pressure/tem perature limits for pressurized thermal shock of the reactor vessel. However, the nil ductility transition temperature technical specifications limits were not violated.

The control room operators throttled the HPI flow slightly as RCS pressure and subcooling margin continued to increase. The cooldown had now decreased steam generator pressures to about 435 psig, causing the main steam line failure logic to actuate. This actuation closed the feedwater flow control, valves, stopping flow from the condensate pumps.

The flow had lasted for approximately two minutes.

Nine minutes after being dispatched by the control room, the operators at the TBVs and the ADVs reported that the valves had been isolated.

However, the nonlicensed operator at the AFW (ICS) flow control valves was experiencing some difficulty in closing them. He used the valve handwheel to partially close the "B" AFW (ICS) flow control valve, although he thought he had completely closed the valve. As a result, the flow continued to the "B" steam generator, decreased by about 40 percent. He then went to the "A" AFW (ICS) flow control valve and closed it with the valve handwheel. Closing this valve caused the flow through the "B" AFW flow control valve to increase because much of the flow that had been going through the "A" AFW (ICS) flow control valve was apparently being redirected through a line crossconnecting the two valves.

However, the operator believed that the "A" AFW flow control valve was only 80 percent closed USNRC Technical Training Center 15-4 Rev 0896 Rev 0896 B&W Crosstrainini! Course Manual USNRC Technical Training Center 15-4

'B&W Crosstrainin Course Manual Rancho Seco Loss of ICS Power since he could still see' about 1/2-inch of uncorroded valve stem. Using a valve wrench, he applied additional force to the valve, which resulted in failure of the manual operator, where upon the 'valve reopened.

As a, result, local manual control of the valve by the valve hand wheel was no longer possible.

In the 'meantime, a second nonlicensed operator arrived at the "B" AFW (ICS) flow control valve and fully closed it completely. The first operator then called the control room and was

• told to close the "A" AFW manual isolation valve.

Since it would not move, even after he applied a valve wrench, it remained open. The "A" AFW (ICS) flow control valve also remained open until ICS power was restored. Because of its location, the' second operator found it expeditious to jump a controlled area fence approximately 6 feet high "when going from the "B" to the "A" AFW (ICS) flow control valves. This appeared to have saved about 2 minutes.

Meanwhile' in the control room pressurizer

'level was,back on-scale and increasing so that operators started to throttle all the HPI valves to slow, the increase in RCS, pressure.

The, subcooling margin was 170 'F.

The operators opened the HPI pump, SFAS controlled, recirculation valves to prevent,the "pumps from overheating when flow was subse quently further throttled. However, the suction.

valve from the makeup tank was still closed at this "time. Recirculation flow was sent to the makeup

'tank, which soon filled, and the relief valve began'

-to discharge to the flash tank.

The operators in the control room stopped the "C" reactor coolant pump (RCP) and the "A" HPI pump at an RCS temperature of 418 °F.

The Shift Supervisor, Shift Technical Advisor, and the Senior Control Room Operator had earlier discussed whether the AFW pumps should be tripped. -The emergency procedures had been modified after the cooldown transient of October 2, 1985 to require that the AFW pumps be tripped during an overcooling transient if the steam generator could not be isolated by shutting valves.

The Shift Supervisor,'however, made the decision to delay tripping the AFW pumps. The operators were concerned that AFW might not be available, when later required, if the AFW -pumps were tripped.

Meanwhile, the chart recorders indicated that the A steam generator was overfilling with the overflow entering the steam lines. The safety parameter display system (SPDS) video screen also showed steam generator levels and this indication was later reported to have indicated the steam generators were not full. Th'e "A" steam generator actually filled to the top of the steam shroud and began to spill water into the steam annulus and into the main steam line for about 7

'minutes until ICS power was restored. The AFW flow rate to the "A" steam generator at this time was off-scale high (greater than 1300 gpm).' (A later evaluation and inspection showed there was no apparent damage to the main steam lines or the turbine driven AFW pump as a result of this overflow).

The makeup tank (MUT) was still receiving the HPI pump recirculation flow and, in turn, was

'relieving to the flash tank. The control room

'operators, therefore, closed the suction valve from the borated water storage tank in an attempt to mitigate the high level in the MUT, forgetting the suction line from the MUT was shut.. This action isolated the suction to the makeup pump, the "A" HPI pump (which had been stopped earlier), and the "A" --low pressure injection ý(decay heat removal) pump, which was in recirculation.

USNRC Technical Training Center 15-5 Rev WS9b Rancho Seco Loss of ICS Power "B&W Crosstrainingy Course Manual Rev 0896 USNRC Technical Training Center 15-5

B&W Crosstrainin Course Manual Rancho Seco Loss of ICS Power While the steam releases had been isolated earlier, the "A" AFW (ICS) flow control valve was still open which produced an RCS cooldown rate of approximately 200 'F per hour. The RCS subcooling margin peaked at 201 *F at 4:39 a.m. at an RCS temperature of 390'F and an RCS pressure of 1430 psig. This was about 800 psig higher than the pressure limit for the pressurized thermal shock region at this temperature.

Finally, at 4:40 a.m. the "backup" Shift Supervisor had returned back to the control room after having helped to isolate the steam release and discovered that switches S I and S2 to the ICS de power supplies were tripped to the OFF position.

15.2.6 Restoration of ICS de Power and Plant Stabilization

Twenty-six minutes after it was lost, ICS dc power was restored when switches S1 and S2 were turned back to the ON position. With power restored, normal remote control ofICS equipment in the control room also was restored. Shortly after ICS power was restored, the Senior Control Room Operator (SCO) called the NRC Operations Center and reported an Unusual Event. The SCO briefly described the event and promised to call back later with additional details. The operators were now able to stop the RCS cooldown and continue to depressurize out of the pressurized thermal shock region. The main items of interest during this period were the damage to the makeup pump, which subsequently released radioactivity, the illness of the "backup" Shift Supervisor, and an additional loss of ICS de power.

When power to the ICS was restored, apparently all the ICS-controlled valves shifted to the manual mode and received a demand signal to go fully open, a condition that was unexpected by the operators. However, the isolation valves for the TBVs and ADVs had been closed and the "B" AFW (ICS) flow control valve had been shut with the handwheel.

The control room operators immediately shut all open ICS-controlled valves, including the open !'A" AFW (ICS) flow control valve, from the control room. All AFW flow to both steam generators was now stopped, and the RCS began to heat up. The lowest RCS temper ature reached was 386'F. (The plant had cooled by 180'F in 26 minutes.)

At this time, RCS pressure was being reduced to achieve conditions outside the pressurized thermal shock region.

The operators were directed to disengage the manual handwheel on the "B" AFW (ICS) flow control valve and to open the isolation valves for the ADVs and TBVs so that the ICS could completely resume control of these valves. The "A" steam generator level decreased below the steam shroud shortly after the "A" AFW (ICS) flow control valve was closed.

The RCS cooldown had been arrested, so operators stopped the "B" HPI pump and closed the open HPI! injection valves ("A" and "B").

However, they left the makeup pump operating.

The "A" HPI pump had been stopped earlier. The operators attempted to restore normal makeup flow through the makeup valve. However, the makeup isolation valve could not be opened from the control room because the operators did. not reset one of the SFAS isolation signals for this valve.

A short time after stopping the "B" HPI pump, the operators noticed a loss of reactor coolant pump seal flow (they were alerted by an alarm and low flow indication) and restarted the "B" pump to reestablish seal flow. They checked the valve lineup to the seals and again stopped the "B" makeup pump. Again, flow to the seals stopped and the "B" HPI pump was restarted. What the operators did not realize was that the makeup USNRC Technical Training Center 15-6 Rev 0896 B&W Crosstrainine Course Manual Rancho Seco Loss oflICS Power USNRC Technical Training Center

, Rev 0896 15-6

B&W Crosstrainin Course Manual Rancho Seco Loss of ICS Power puinp was severely damaged and could not supply "adequate reactor coolant pump seal injection flow.

-(Tle "A" decay heat removal pump was apparently'fiot damaged since it was operating' with its recirculation line -open and therefore discharging back to its own suction.)

Coincident with this seal flow problem, the auxiliary building ' siack radiation, monitor

- alarmed. 'A smoke alarm'was also received that isolated the auxiliary building ventilation system.

The inadequate seal flow and radiation alarms were apparently all caused by the failure of the makeup pump that had been operating for about 10 min. with both suction valves (BWST and

. MUT) closed. At 5:00 a.m., the operators in the control room heard a loud noise and observed that the makeup pump ammeter was reading only

'about 1/3 of normal running current. It was then that they realized that the makeup pump had been

-damaged. They also discovered that both makeup pump suction valves were closed and immediately opened the suction valve fromr the MUT in the hope of preventing further damage to the pump.

Opening the Valve allowed water to spill from the damaged makeup pumponto the makeup pump

- room floor.' The operators closed the valve after approximately 450 gallons had spilled.

The failed makeup pump had only a single stop-check valve that isolated the RCS from the failed makeup pump seals.'

In' addition; the makeup pump was isolated from the operating

-HPI pump recirculation line by only a single stop-'

check valve.

Consequently, there was-some concern on the -part of, the Control -Room Operators that this failure-could lead to a small break LOCA. Therefore, the Shift Supervisor sent two nonlicensed operators to enter the makeup pump' room and isolate the-,makeup pump by, closing' the' locked-open manually operated suction-valves, dis6harge valves, and' the recirculation line isolation' valve. The Tmakeup pump room contaified airborne radioactivity, and contaminated water on the floor. Although the nonlicensed operators wore some protective clothing, they did notwear respirators or high top boots because none were available near the pump room entrance.

They performed a radiation survey before entering the makeup pump room, however, no assessment was made of particulate

- or gaseous radioactivity until after they entered.

'After isolating-the makeup pump, the

,operators entered the west decay heat reinoval cooler room to attempt to open the SFAS-actuated makeup isolation valve by hand.. This' valve still had a "close" signal so they were unable to open it. The operators later found that the SFAS signal had not been reset for the makeup isolation valves at the B 'safety features panel.

(Following actuation 6f the SFAS, the makeup valve "close" signal must be cleared at both the "A" and "B" safety features panels.) The operators then went back into the makeup pump r6om briefly to check its status and then left the area. (Both operators were monitored and whole body counted on the "morning of December26. The results showed that they had not received a significant radiation dose from the entry into the makeup pump room.)

"Meanwhile, the' "backup" Shift Supervisor "became ill in the control room and collapsed in front of the control paniel.- He had assisted in Sisolating the ADVs, which are located outside

" where the weather was cold and damp. 'At this time an additional Senior Control Room Operator arrived at the plant. He was not scheduled to be on shift and had arrived early to do some paper iwork. When he reached the control room, he

, turned his attention to the backup shift supervisor

-who had bec6me ill. After discussing the situa tion with.the' Shift Supervisor, he 'called an ambiilance. The supervisor was later transported to the hospital and later released.' The supervi sor's illness diverted the attention of the control USNRC Technical Training

'Center 15-7 Key (11i96 15-7 Rafich -o Seco.Loss of ICS Power SB&W Crosstraininey Course Manual

'USNRC Technical Training'Center Rev 0896

&-i Rancho Seco Loss of ICS Power room operators and resulted in the loss of the supervisor, although it did not have a significant effect on the incident. (The utility stated, during the investigation, that based upon the medical diagnosis at the hospital and other available information, there was no indication that drugs or alcohol were involved with the illness.)

After calling the ambulance, the off-duty SCO answered the Emergency Notification System (ENS) phone when the NRC Operations Center called and requested an update on the plant's initial report. After the SCO briefed the NRC Operations Center, he was requested to maintain an open line. The open line was maintained until the Unusual Event was terminated. Operators in the control room were intent on stabilizing the plant and bringing all systems and parameters to normal where possible..

The. RCS had now depressurized out of the pressurized thermal shock region and a 3-hour soak at the existing RCS temperature and pressure (870 psig and 428°F) was begun in accordance with B&W guidelines.

Operators began to drain the overfilled steam generator to the condenser to reestablish MFW flow with the main condensate pumps.

The Shift Supervisor, concerned about the habitability of the auxiliary building after the ventilation system shutdown, decided to restart the ventilation system. However, a smoke detector alarm in the radiological waste area prevented the ventilation system from operating. The smoke detector in the radiological waste area is believed to have detected smoke from the reactor building radiation monitor, which overheated when its suction was isolated by the SFAS actuation.

Efforts to start the auxiliary building ventilation system were finally successful, and ventilation from the auxiliary building to the atmosphere was restored. (The maximum permissible radionuclide concentration at the site boundary was later calculated to be less than one-fifth of the maximum permissible concentration for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

The whole body dose to a person hypothetically at the site boundary during the event would have been no greater than 0.2 mrem. The thyroid dose would have been zero mrem. These results are well within Rancho Seco Technical Specification limits.)

After assisting in isolating the makeup pump, a nonlicensed operator noticed he had. lost his security badge. Thus, he was no longer able to open doors to the areas that require a badge for entrance. After reporting the loss to the control room, he was escorted by a security guard to the control room where he remained until a spare security badge was brought to him about 20 minutes later.

The SFAS signal was also "bypassed" at 6:06 a.m. At approximately 6:10 a.m., the plant-was stabilized. The main steamline failure logic had been inhibited and the steam generators were being fed by the main condensate pumps.

At 6:11 a.m., a momentary "ICS or Fan Power Failure" alarm occurred. The S 1 and S2 switches remained closed and the alarm cleared without operator action. No equipment response was noted.

At 6:14 a.m., a third "ICS or Fan Power Failure" alarm was received. The ICS-controlled valves again received a 50 percent demand signal.

The operators immediately reset switches S 1 and S2 to restore ICS power. This caused the ICS controlled valves to receive a 100 percent demand signal.

The-operators then closed the valves remotely from the control room.

The Plant, Superintendent relieved the Shift Supervisor as Emergency Coordinator and manned the Technical Support Center (TSC) at 7:15 a.m. Meanwhile, several gallons of water USNRC Technical Training Center B&W Crosstraining Course Manual 15-8 Rev 0896

l1&W Crnsstraininp Course ManualRncoSoLssf CPwe

- had spilled onto the TSC floor. The water came from a drain on a pilot-operated valve in the fire main when a fire alarm.was received and the normally dry fire header was pressurized with water. There was no release of water from the fire

- main header and the spilled water had no significant effect on this incident. The Emergency Coordinator terminated the Unusual Event at 8:41 a.m.

15.3 Mijor Issues The post event evaluation and investigation resulted in the compilation of an action list that consisted: of 14 'sections, with several items contained in each section. Three of these sections are discussed in the following paragraphs.

"15.3.1 ICS Power Failure "There are redundant dc power supplies for the ICS, whose outputs are auctioneered to provide

+24 vdc and -24 'vdc power for use in various modules within the ICS. The outputs of each of the +24 vdc and -24 vdc power supplies are monitored by. a single power supply monitor (PSM) module, which will alarm in the control room if the output voltage of any of the dc power suliplies'drops to 23.5 vdc. The PSM also senses the auctioneered output of each pair of power supplies and will trip open the input switches, S I and S2, if the voltage on either output bus drops -

to 122 vdc. This results in interrupting all dc

'power within the ICS. This is a designed response to prevent voltage fluctuations from causing the

,ICS to behave in an erratic or *unpredictable

,manner.--,

,Early findings determined that the PSM trip.

setpoint was drifting. Significant to the event was the finding, that small amounts of resistance, as little as one-ohm, in series with the "sensed",

voltage to the PSM could cause tripping of the PSM. During the troubleshooting process it was found that the time delay drop of switches S I and S2 was much shorter than the manufacturer's tolerance.

This time delay feature may explain why the intermittent "ICS or fan power failure" alarm received at 06:11 did not result in a trip., During the investigation, it was reported that this alarm had also occurred intermittently on at least two occasions in the weeks before the trip, although no documentation of these alarms could be found and no work requests to'investigate them could be located. The fact thatthe time delays on Sl,and S2 were shorter than designed (which is in the conservative direction) may have contributed to the loss of ICS power in this event. Had they been within the design tolerance, the voltage fluctuation caused 'by an improperly crimped wire may not

,-have been long enough in duration to cause S1 and S2 to trip.

During inspections of the physical wiring in the ICS cabinets, and in an attempt to identify the source of a possible increased input resistance, the technicians found that the input lead wire to the

+/-24 vdc monitor had an improperly crimped connection at the +24 volt bus bar in cabinet one.

In fact, the lug fell free from the wire when it was

'disconnected from the bus.

This 'wire is an

-internal cabinet wire installed by the vendor prior to delivery of the cabinets.

Following the, discovery of the improperly

-crimped connection, the Quality Control group inspected the remainder of the.factory and field

,wire terminations in ICS and NNI cabinets, and

'found numerous deficiencies in the quality of the wire terminations in these cabinets.

The root cause for the loss of the ICS power was identified as the loose connection. The factory bus wiring has been replaced with current standard wiring.

-15.3.2 Makeup Pump Failure USNRC Technical Training Center 15-9 KeY UJb 1 15-9 USNRC Technical Training Center S

1 1...............

Rancho Seco Loss of ICS Power I

,.RevU0739

B&W Crosstrainini Course Manual Rancho Seco Loss of ICS Power At time 04:16:57, the makeup tank isolation valve shut on Safety Features Actuation System (SFAS) initiation due to reactor pressure falling below 1600 psig. During the subsequent SFAS recovery, the valve was not reopened. At 04:30 operators secured the "A" HPI train which included shutting the supply valve from the Borated Water Storage Tank (BWST). They did not realize that this action also isolated the suction to the Makeup Pump., Upon securing the "B" HPI train at 04:42, RCP seal injection flow decreased toward zero. The "B" HPI was restarted, the lineup verified, and the, pump secured again.

Once again RCP seal injection flow decreased toward zero.

At 05:00, operator's statements indicate that a loud noise was heard in the plant.

The operators then realized that the makeup pump was without suction and tripped the pump and opened the makeup tank isolation valve. The makeup pump had run for nearly thirty minutes with its suctions to both the BWST and the makeup tank closed. However, by this time a pump seal had been badly damaged and over 1200 gallons of water from the makeup tank spilled to the pump room floor prior to reclosing the makeup tank isolation valve.

Operating procedures for the HPI, Makeup and SFAS systems were reviewed. No procedural direction could be found instructing operations to reopen the makeup tank isolation valve during SFAS recovery or otherwise ensuring an adequate source of water to the makeup pump. In addition to the absence of a procedural requirement to prevent this occurrence, there were no warning or control devices such as a pump low suction alarm or trip, nor interlocks between the makeup tank or BWST outlet valves and the pump to ensure adequate suction existed.

The root cause of the damage to the makeup pump was determined to be inadequate proce-dures. The procedural inadequacy is evidenced in this regard by the lack of guidance for operators to recover from SFAS initiation. A contributory cause of the damage to the pump was personnel error, as evidenced by the operators performing valve operations which isolated the suction of the makeup pump while the pump was running.

15.3.3 RCS Overcooling The reactor trip and overcooling event was initiated by a loss of ICS power and subsequent repositioning of valves that regulate the rate of RCS heat removal. When the ICS DC power supply tripped, voltage output from the hand/auto stations that control main feedwater (MFW) regulating and startup valve positions and MFW pump speed failed to mid-scale (0 vdc), resulting in a reduction in MFW flow. Within 16 seconds, the loss of heat transfer in the once-through steam generators (OTSGs) caused a reactor trip on high reactor coolant, system (RCS) pressure.

The hand/auto stations for the ICS controlled auxiliary feedwater (AFW) valves, the atmospheric dump valves (ADVs), and the turbine bypass valves (TBVs) also failed to mid-scale, resulting in those valves opening to their 50% demand position.

Steaming through the ADVs and TBVs was a steam demand significantly in excess of decay heat generation. Additionally, both AFW pumps started due to low MFW pump discharge pressure and were delivering feedwater to the OTSGs within a few seconds of the reactor trip. This excessive heat transfer condition created an RCS cooldown rate in excess of technical specification limits that was not fully controlled for 26 minutes.

Remote control was also lost. No procedural guidance was in place to identify other points of remote control (such as the Appendix R remote shutdown panel), or toward recovering power to the ICS.

USNRC Technical Training Center 15-10 Rev 0896 15-10 B&W Crosstrainine Course Manual Rancho Seco Loss oflICS Power Rev 0896 USNRC Technical Training Center

B&W Crosstraining Course Manual The issue of potential loss of ICS power has been raised in numerous vendor and regulatory documents over the past 8 years as well as being included as an independent casualty in B&W's Abnormal Transient, Operating Guidelines (ATOG).

The deficiency in this area was the lack of procedural direction aimed at ICS recovery, or guidance toward alternate points of control which will more quickly mitigate a transient. The root cause was determined to be failure to implement changes addressed in 1980 concerning the potential cooldown affects of the turbine bypass valve failure mode during a loss of ICS. At that time the utility was alerted to the design deficiency and was requested to make corrections be made in a timely manner.

15.3.4 PRA Insights Rancho Seco Loss of ICS Power Sinitiator, successes of AFW and MFW, failure of the PORV to reseat, and HPI. The conditional probability of this sequence is 3.OE-5/Rx-yr.

15.4 : References

1. U.S. Nuclear Regulatory Commission. "Loss of Integrated Control System Power and Overcooling Transient at Rancho Seco on December 26,, - 1985",

USNRC -Report NUREG 1195, February 1986.

2. Docket 50-312, Rancho Seco Nuclear Gener ating Station Unit 1, "Resolution of Issues Regarding the December 26, 1985 Reactor Trip", February 19, 1986.

-3.

Sacramento Municipal Utility District "Inci dent Analysis Root Cause 85-41", March 19, 1986.

1 t All major events are reviewed by Oak Ridge National Laboratory from a PRA standpoint.

Each year, NUREG/CR-4674, "Precursors to Potential Severe Core Damage Accidents,"

publishes the results of this review. The Rancho Seco results were published in the 1985 issue.

The NUREG lists the major sequences that result in core vulnerability and core damage.

The major core vulnerable sequence is shown

.in Figure 15-6. The sequence involves a transient (initiated by the loss ofICS power), a reactor trip, success of AFW, success of Main Feedwater, a challenge to the PORV (the valve was opened to,,

control RCS pressure), success of the reseating of

. the PORV, and failure of the HPI system (one pump was rendered inoperable by the incorrect suction lineup). The conditional probability for this sequence is 1.766E-4.

The major core damage sequence is shown in Figure 15-7. The sequence involves a transient USNRC Technical Training Center 15-11 Rev WITh

(

I tL USNRC Technical Training Center Rev 0896 "I '.

15-11

APPENDIX - SEQUENCE OF EVENTS INITIAL CONDITIONS:

Average temp 582°F. RCS pressure 2150 psig. Reactor Power 76%. ICS in full automatic control.

Note: Rancho Seco does not have main steam isolation valves.

TRANSIENT INITIATOR - LOSS OF ICS DC POWER 04:13:47 Loss of ICS DC power-(power supply monitor failed).

04:13 :+

Main feedwater flow decreasing rapidly. MFPs to minimum speed. RCS pressure increase, spray valve opened manually.

04:14:01 AFW initiated on low MFP discharge pressure (<850 psig).

PLANT TRIP AND START OF COOLDOWN 04:14:03 Reactor trip on high RCS pressure. Pzr spray closed.

04:14:04 RCS pressure peaks at 2298 psig. Six OTSG safety valves open and later reseat.

04:14:06 Second AFW pump staits on low MFP discharge pressure.

04:14:06 Peak hot leg temperature of 606.5°F reached.

04:14:+

Operators start to perform E.01 - reactor trip letdown isolated. Operators start E.02 - vital systems verification 04:14:11 AFW flow to both OTSGs via 50% AFW (ICS) valves.

04:14:25 Pzr level decreasing. "A" HPI MOV opened to increase makeup flow to the RCS.

04:14:30 Overcooling symptoms noted. Loss of ICS DC power has positioned the following valves to 50%:

1. Turbine Bypass Valves

2. Atmospheric Dump Valves

3. AFW Flow Control Valves 04:14:48 Makeup tank level decreases due to excessive RCS makeup. MU pump suction shifted to BWST.

04:15:04 "B" makeup (HPI) pump started for additional makeup.

04:16:02 AFW flow to OTSGs >1000 gpm. MFW flow indicating about 3 million pounds per hour.

Actual MFW flow is zero because of MFP speed.' In addition, the main feedwater stop valves were closed. However, a flowpath from the MFP to the OTSGs is available through the startup main feedwater valves.

USNRC Technical Training Center 15-12 Rev 0896 B&W Crosstrainingy Course Manual

, Rancho Seco Loss of ICS Power USNRC Technical Training Center 15-12 Rev 0896

SEQUENCE OF EVENTS (contintued)

SFAS ACTUATION - COOLDOWN - DEPRESSURIZATION'

,04:16:57 RCS pressure decreased from 2298 psig to 1600 psig. SFAS actuated at the setpoint of 1600 psig. Pzr level dropped from 220 inches to 15 inches. The SFAS actuation opened all 4 HPI MOVs to predetermined positions. The following equipment was also actuated bythe SFAS signal:

1. MUT outlet valve closed - BWST supply to HPI opened.

2. MU pump recirculation path isolated.,'

3. AFW valves to the 100% position.

4. LPI/DHR pumps start.

5. Both DGs start.

04:16:59 The "A" HPI pump started by SFAS. "B" HPI already running. Both HPI pumps and the MU

'pump supplying MU to RCS.

04:17:10 AFW (SFAS) flow control valves manually closed.

04:17:15 A & B emergency~air conditioning units auto start. Significant increase in control room

-noise level.

04:17:27 Motor driven AFW pump auto sequenced back to the vital bus. -Dual drive AFW running on steam source.

04:18:58 RCS temperature less than 500'F..

04:19:00 Pressurizer-emptied. Steam bubble in reactor vessel head.

04:19:15 Emergency air conditioning stopped to reduce noise level.

04:20:00- STA to turbine deck to determine lifting relief valves.

04:20:00 Pzr level off scale low. Subcooling margin of 85 degrees and increasing.

-04:20:+

Technician sent to check ICS power-supplies. All four 24-vdc power supplies were deenergized. The automatic bus transfer (ABT) did not transfer. The power supply to the ICS would be inspected by three people during the next 20 minutes without dicovering that switches S I and S2 feeding the 24-vdc supplies were open.

04:20:20 OTSG pressures at 500 psig.- Feedwater into the OTSGs from condensate pumps via open startup feedwater valves. An additional 1000 gpm feedwater flow to the steam generator.

04:21:25 Minimum RCS pressure of 1064,psig (RCS temperature of 464°F).is reached..

" PLANT REPRESSURIZATION 04:21:+

RCS cooldown continuing., However, flow from the HPI pumps starts to increase RCS pressure even though pressurizer level is off scale low.

04:22:00 B&W pressure 'and temperature limits for PTS are exceeded; however, technical specification NDT limits are not exceeded. Operator starts to throttle HPI flow.

04:22:50 OTSG pressures decrease to 435 psig. Steam line break logic actuated. Main and startup regulating valves are closed. Feedwater flow from the condensate pumps is terminated.

USNRCTechical rainng Cnter..

3.Ke IJA B&W Crosstraininiz Course Manual

. I Rancho Seco Loss oflICS Power

-" 15-13

-,Rev 0896 USNRC Technical Training Center

SEQUENCE OF EVENTS (con tinued) 04:23:00 Atmospheric dump valves and turbine bypass valves were shut locally. (Manual handwheels used.)

04:23:10 "B" AFW (ICS) flow control valve partially closed. Operator thought valve was fully closed.

Flow has decreased by 40%.

4:25:30 HPI recirculation valves to makeup tank opened. HPI pump suction being supplied by BWST.

4:26:22 "A" AFW flow control valve closed locally. Operator thinks that the valve is only 80%

closed.

04:26:47 Pzr level back on scale. Subcooling margin is 170 degrees. Operators throttle HPI to slow the increase in RCS pressure.

04:28:00 Makeup tank level off scale high. Makeup tank relief valve lifts.

04:28:00 RCP "C" stopped at an RCS temperature of 418'F.

04:28:43 RCS letdown restored.

04:28:59 "A" HPI stopped.

04:29:40 Operator damages "A" AFW flow control valve in an attempt to close valve >80% closed.

Operator directed to close AFW manual isolation.

04:29:40 RCS pressure peaks at 1616 psig. RCS temperature is 418'F.

04:29:45 "C" and "D" HPI valves are closed in order to reduce the repressurization while temperature is decreasing.

04:30:00 An unusual event is declared.

04:30:30 Plant is depressurized using pzr spray in an attempt to restore PTS limits.

04:33:20 "B" AFW flow control valve closed by second operator. AFW flow to "B" OTSG is stopped.

04:33:20 "A" OTSG filled to top of steam shroud. Water begins to spill into the steam lines. Flow into the OTSG is in excess of 1300 gpm.

04:35:+

The "A" HPI suction valve from the BWST is closed in an effort to lower makeup tank level.

However, the makeup tank outlet valve is still closed.,

04:36:+

The manual AFW isolation valve cannot be closed by the operator.

04:39:00 RCS subcooling margin reached a peak of 201 degrees and began to decrease (RCS temp =

390'F, RCS press = 1430 psig). This is approximately 800 psig into the PTS region.

ICS POWER RESTORATION AND PLANT STABILIZATION 04:40:00 The "Backup" shift supervisor finds switches SI and S2 in the OFF position. The switches were closed. The valve stations reverted to the HAND position. All valves with the exception of the AFW flow control valves had been isolated. The control room operators closed the AFW (ICS) flow control valves.

04:40:+

With AFW flow isolated, the RCS starts to heat up. The lowest RCS temperature was 386°F. The RCS had cooled down 180 degrees in 26 minutes.

USNRC Technical Training Center 15-14 Rev 0896 B&W Crosstraining Course Manual SRancho Seco Loss oflICS Power USNRC Technical Training Center 15-14 Rev 0896

B&W Crosstraining Course Manual Rancho Seco Loss of ICS Power 04:41:00 Operators report that the "A" AFW manual isolation valve is stuck open. Operators are directed to disengage the handwheel for the "B" AFW flow control valve and to returnthe ADVs and TBVs to service.

SEQUENCE OFEVENTS (continued) 04:41:10 "A" OTSG level below the steam shroud.

04:42:42 "B" HPI pump stopped. The makeup pump remains in service.

04:42:56.- Operators closed the "A" and "B" HPI MOVs.

04:43:50 RCP seal injection low flow.

04:43:54 "B" HPI pump restarted to reestablish RCP seal injection flow.

04:40:+

'Steam leakage from the damaged makeup pump causes an auxiliary building stack radiation

,monitor alarm. Makeup pump damaged due to a lack of suction. Radioactive release is

-within Tech. Spec. limits.

04:50:19 "B" HPI pump stopped.

04:50:30 "B" HPI pump restarted in response to a low RCP seal flow alarm. 'The operators have not realized that the makeup pump has been damaged.

04:52:+

"Backup" shift supervisor collapsed in control room. This operator had assisted in closing the ADV and TBV manual isolations.

05:00:+

Control room operators hear a loud noise. They observe that the makeup pump ammeter is reading low and realize that the pump has been damaged.

05:00:10 Makeup pump istripped. Makeup tank outlet valve is opened allowing 450 gallons of water to ýspill out of the damaged pump. Makeup tank outlet valve is reclosed.

05:05:+

RCS pressure decreased out of the PTS region. A 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> soak is initiated. (RCS temp 4281F, RCS press = 870 psig).

05:05:+

Ambulance called for "backup shift supervisor".

05:27:+

Two auxiliary operators are contaminated while isolating the damaged makeup pump.

Operators did not follow j'roper radiological safety procedures.

05:29:+

Operators are Unable'to-6pen mak6up isolation to the RCS. It was later found that the SFAS signal had not been cleared from the valve.

05:29:04 Second reactor coolant 1ump ýt6pped.

06:06:00 Operators bypass SFAS.

07:15:+

Plant superintendent relieV&s shift supervisor as emergency coordinator.

08:41 :+

The unusual event is terminated.

KY U5YO USNRC Technical Training Center 15-15 Kev 089O 15-15 USNRC Technical Training Center

I____________

120 Vac r"",

FROM VITAL BUS 1C Q FROM NON-VITAL BUS 1J AUTO BUS TRANSFER TO ICS ac LOADS FAN

-FAILURE lii AUCTIONEERING-DIODES

+24 Vdc

-24 Vdc ICS BUS ICS BUS II I I I

I L

I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I I Figure 15-1 ICS Power Supplies

TO MOISTURE SEPERATOR ATMOSPHERIC DUMP REHEATERS VALVES (3/HEADER)

I A-A Ki2

A OTSG TURBINE BYPASS VALVES TO CONDENSER (2/HEADER)

"PEGGING" STEAM TO FW HEATERS TURBINE THROTTLE "TO MFW PUMPS

>-TO AFW PUMP P-318 VALVES I'

i FV-30801 CONTAINMENT BUILDING P

TURBINE BOUNDARY "PEGGING" STEAM HV-20596

.HV-20560 TO FW HEATERS CONTROL A

VALVES ITO MOISTURE iSEPERATOR REHEATERS B OTSG

,I I

FROM MOISTURE SEPERATOR REHEATERS EXHAUSTTO LP CONDENSER FROM LP FW HEATERS

"-n

-rl CE)

CL (D

C')

(D 2

FROM LP FW HEATERS-

CONDENSATE

STORAGE, TANK, FROM PLANT" RESERVOIR AFW PUMP, P-318 FWS-063 AFW (ICS)

FLOW CONTROL' VALVE (ICS)

(MOTOR DRIVEN)

A OTSG CONTAINMENT BUILDING BOUNDARY CD 4,.

CD CDi CL

=1 CD cD a

0

SEAL RETURN FROM RCPs BWST SEAI cc SFV-25003 -- >

CD SFV-25004 I

MUT CD FLASH ET TANK SFV-2 (D

Ca CD 3

B HPI PUMP

BABCOCK AND WILCOX CROSS TRAINING MANUAL CHAPTER 16 Davis-Besse Loss of All Feedwater r

• B&W Crosstraining Course Manual Davis-Besse Loss of All Feedwater TABLE OF CONTENTS 16.0 DAVIS-BESSE LOSS OF ALL FEEDWATER EVENT 16.1 Description of Plant Systems..............................................

16-1 16.1.1 General Design......................................................

16-1 16.1.2 M ain Steam System 16-1 16.1.3 M ain Feedwater System...............................................

16-2 16.1.4 Auxiliary Feedwater System 16-3 16.1.5 Makeup/High-Pressure Injection Cooling Systems..........................

16-4 16.1.6 Steam and Feedwater Rupture Control System (SFRCS)......................

16-5 16.1.7 Pressurizer Pilot Operated Relief Valve 16-6 16.2 Event N arrative.........................................................

16-7 16.2.1 Shift Change........................................................

16-7 16.2.2 Reactor Trip - Turbine Trip 16-8 16.2.3 Loss of M ain Feedwater...............................................

16-9 16.2.4 Loss of Emergency Feedwater.........................................

16-10 16.2.5 Reactor Coolant System Heatup........................................

16-11 16.2.6 Operator Actions....................................................

16-11 16.2.7 PORV Failure......................................................

16-14 16.2.8 Steam Generator Refill...............................................

16-15 16.2.9 PRA Insights.......................................................

16-16 Appendix - Sequence of Events.................................................

16-18 LIST OF FIGURES 16-1 Davis-Besse NSSS 16-2 Main Steam System 16-3 Main Feedwater System 16-4 Auxiliary Feedwater System 16-5 Emergency Core Cooling System 16-6 Steam and Feedwater Rupture Control System Logic 16-7 Reactor Coolant System and Pressurizer Response 16-8 Number One Steam Generator Parameters 16-9 Number Two Steam Generator Parameters 16-10 Trip Throttle Valve 16-11 Dominant Core Vulnerability Sequence Event Tree 16-12 Dominant Core Damage Sequence Event Tree USNRC Technical Training Center 16-i Rev 0896 I

USNRC Technical Training Center 16-i Rev 0896

nzw ~

nn~e1~hnt~

Dvi-BeseLos f llFedwte 16.0 DAVIS-BESSE LOSS OF ALL FEEDWATER EVENT Learning Objectives:

1. List the indications of a "Loss of Heat Trans fer" event.

2.", Explain what operator actions and equipment failures led to the "Loss of Heat Transfer" event at Davis'-Besse.

3. Explain' the protection provided in an event that exceeds the design bases of the unit.:

4. Describe how the "Feed and Bleed" method of core cooling is used to remove decay heat following a reactor trip.

'5.

State why an operator/supervisor may be reluctant to use this method of decay heat removal.

16.1 Description of Plant Systems 16.1.1 General Design, The Nuclear Steam Supply System (NSSS) for

'.the Davis-Besse plant was supplied'by the Bab cock & Wilcox Company. The NSSS, shown in Figure 16-1, consists of two heat tiansport loops

"* with each containing a hot leg, a once-through steam generator "(OTSG), and r two 'cold legs.

Water from the OTSG is returned to the reactor vessel by the reactor coolant pumps, with one pump lociated in each cold leg: "Reactor coolant

• system (RCS) pressure is maintained byan electri

'cally heated pressurizer that is connected to one of the hot.legs. - During normal operations, the pressurizer contains ýi 700 ft3 steam bubble that exerts a pressure of approximately 2150 psig on

'the RCS. Protection against over-pressurization is provided by the pilot operated relief valve (PORV) and two code safety valves. The pilot operated relief valve discharges to a quench tank.

The two code safety valves discharge directly to the containment building.

The reactor design power level is 2,772 Mwt, which is also the design power level for the station and all components. At a power level of 2,772 Mwt, the net station electrical output is 906 Mwe.

16.1.2 Main Steam System The main steam system functions to deliver superheated steam from the steam generators (OTSGs) to the main turbine and required plant auxiliaries. As shown in Figure 16-2, the system begins with the outlet piping from the steam generators and passes through the containment building to the main,steam isolation.valves (MSIVs). Protection against overpressurization for the steam generators is provided by 18 code safety valves (9 per steam generator) located on the system piping upstream of the MSIVs, and two atmospheric vent valves (one per steam generator) which act as relief valves. The atmo spheric vent valves are controlled bythe integrat ed control system (ICS) and aid in controlling steam pressure if a large transient occurs when the unit is in service, if condenser vacuum is lost, or if the MSIVs are closed. Connections upstream of each main steam isolation valve supply steam to the redundant turbine-driven auxiliary feedwater pumps. Either system header is capable of sup

-plying either turbine; however, 'the auxiliary feedwater pump turbine normally receives steam from its associated steam header.

The piping downstream of the MSIVs contains

• non-return valves that prevent reverse flow when steam generator pressures are not equal. From the non-return valves, steamflows to the high pres-ntv uoyu USNRC Technical Training Center 16.-i Rlev 0896

, 16-1 I

Davis-Besse Loss of All Feedwater

'" USNRC Technical Training Center

i CDavis-Besse Loss of All Feedwater sure turbine and secondary systems, such as the air ejectors.

During normal operations, the main steam system valves are not required to change position; however, reactor trips and steam and feedwater rupture control system (SFRCS) actuations cause changes in valve position.' When the reactor trips, OTSG pressure rises rapidly resulting in the actuation of the steam line safety valves. The integrated control system (ICS) biases the steam generator pressure control setpoint to a value higher than the normal steam header pressure control value to minimize the cooldown of the reactor coolant system.

Once the ICS gains control of the steam pressure, the safety valves should close.

The steam and feedwater rupture control system (SFRCS) also changes the position of the main steam system valves. If an SFRCS actuation signal is received, the following changes can occur in the system:

I.

2.

3.

The MSIVs close.

The atmospheric vent valves close.

The steam supply valves open to supply steam to the auxiliary feedwater pump turbines.

16.1.3 Main Feedwater System The main feedwater system, Figure 16-3, begins with the cross-connected deareator storage tanks.

Each of these tanks has a capacity of 64,000 gallons and provides the required net positive suction head (NPSH), i.e. pressure, for the booster feedwater 'pumps.

The booster feedwater pumps are driven through a gear re ducer by the main feedwater pump turbines and function to increase system pressure to satisfy the suction requirements for the main feedwater pumps. The direct-driven main feedwater pumps increase feedwater pressure to a value greater than steam generator pressure and discharge through the high pressure feedwater heaters to the feedwater regulating valves.

Two parallel valves are used to govern the flow of feedwater to each OTSG. The first of the two valves is called the startup control valve and regulates feedwater flow from 0% power to approximately 15% power. Startup control valve SP-7B supplies the #1 OTSG, and startup control valve SP-7A supplies the #2 OTSG. When the startup control valves reach the 80% open posi tion, the main feedwater regulating block valves open, and flow is also controlled by the main feedwater regulating valves. The main feedwater regulating valves control feedwater flow during the power escalation from 15% to 100%. The pressure drop across the valve network is moni tored and used to control main feedwater pump turbine speed. From the outlet of the feedwater regulating valves, the feedwater travels to the OTSGs via a motor-operated main feedwater isolation valve. Main feedwater is added to the OTSG through the external main feedwater ring and the main feedwater nozzles.

A separate auxiliary feedwater ring is used for the addition of auxiliary feedwater flow. After entering the steam generator, auxiliary feedwater is sprayed on the tubes to enhance natural circula tion when reactor coolant pumps are not running and to minimize thermal shock to the steam generator.

When the plant is in mode 3 (Hot Standby), a motor-driven startup feedwater pump is used to maintain steam generator level.

The startup feedwater pump receives its suction from the deareator storage'tanks and discharges to the steam generator main feed rings viathe high pressure feedwater heaters, the feedwater regulat ing valves, and the main feedwater isolation USNRC Technical Training Center 16-2

-1 B&W CrosstraininL, Course Manual I Rev 0896

.&.W Crotrainin" Course Manual Davis-Besse Loss of All Feedwater

'valves. After reactor criticality is achieved, power

'is escalated to about-1% anda main feedwater pump is placed in,service.. When the main Sfeedwater pump is-in service, the startup

'Teedwater pump is shutdown and isolated from the

".. main feedwater system. Startup feedwater pump

",--isolation includes the closing of the suction,

- discharge,'and the cooling water isolation valves.

All of.these valves are located in the turbine building and must be locally operated. In addition to the manual operation of the pump isolation valves, the breaker control, power fuses are removed as a safety precaution. This prevents the operation of the pump with its suction supply isolated.

The startup feedwater pump is designed to

-deliver feedwater flow at approximately 200 gpm with a steam :generator pressure of 1050 psig.

Electrical 'power is supplied to the pump motor from the non-Class 1E distribution; however, the

• pump power supply may be manually transferred to the diesel generator busses if required. Opera tion of the startup feedwater pump in off-normal situations requires the manual opening of the suction, discharge, cooling water inlet and outlet valves, and the installation of the breaker control

,power fuses.

"If the reactor trips, the feedwater system is c controlled by the rapid feedwater reduction system which closes the main feedwater regulating valves and positions the startup control: valves to a "position that allows proper OTSG level control.

'These actions -are taken to -prevent excessive

- cooling of the,RCS caused.by.overfeeding the steam generators. This system also increases the speed of the operating main feedpump turbine(s' from a normal value of 4400 rpm to 4600 rpm.

In addition to the,control actions described above, the steam and feedwater rupture 'control system (SFRCS) 'closes the main feedwatei regulating valves, the startup regulating valves, and the main feedwater isolation valves when certain abnormal plant conditions are detected.

16.1.4 Auxiliary Feedwater System The auxiliary feedwater system (AFW), Figure 16-4, is designed to remove the core's decay heat by the addition of feedwater to the steam genera tors following a reactor trip, if main feedwater is not available. The system consists of redundant turbine-driven auxiliary feedwater pumps and associated piping.

Three suction sources are available to the AFW pumps: -the deareator storage ianks, the condensate storage tank (CST),

and the service Water system. The CST serves as the normal suction source for the system; however, if a low suction pressure condition is sensed, the AFW suction will automatically transfer to the service water system. "Manual action would be required to transfer suction to the deareator storage tanks.

When the AFW system is actuated by the steam and feedwater rupture control system (SFRCS) on signals,other - than low steam generator pressure, the steam'to drive the AFW pump turbine and the discharge of each pump are aligned with the associated steam generator. Each

• of the AFW pumps is ratedat 1050 gpm when

• pumping -against a steam generator pressure of 1050 psig; 250 gpm of the 1050 gpm is used for recirculation flow.

-The #1 pump supplies the #1 OTSGyvia motor-operated valves AF-360, AF-3870, and AF 608. The feedwater supply for #2 OTSG is from the #2 pump through valves AF-388, AF-3872, and AF-599. However, if the SFRCS is actuated on low OTSG pressure, the flow path of the Ssystem is altered to prevent -the -feeding of a I

ruptured steam generator.

The, isolation of feedwater to the faulted steam generator is USNRC Technical Training Center 16-3 kevuz9

1 16-3 USNRC Technical Training Center r, Rev 0596

B&W Crosstraining Course Manual Davis-Besse Loss of All Feedwater accomplished by closing the AFW.containment isolation valve (AF-599 or AF-608). Feedwater to the intact steam generator is supplied by both pumps through the appropriate cross-connect valve (AF-3869 or AF-3871). The steam supply valves for the turbine-driven pumps are also realigned to provide steam for both pumps from the intact steam generator. The following listing gives the position of the AFW system valves during various SFRCS actuations:

NORMAL SYSTEM ALIGNMENT Open valves - AF-360, AF-388, AF-599, AF-608 Closed valves - AF-3869, AF-3870, AF-3871, AF-3872, MS-106, MS-106A, MS-107, MS-107A SFRCS LOW LEVEL ACTUATION Open valves - AF-360, AF-388, AF-3870, AF-3872, AF 599, AF-608, MS-106, MS-107 Closed valves - AF-3869,AF-3871, MS-106A, MS-107A SFRCS ACTUATION #1 OTSG LOW PRES SURE Open valves - AF-360, AF-388, AF-3869, AF-3872, AF 599, MS-106A, MS-107 Closed valves-AF-608, AF-3870,AF-3871, MS-106, MS 107A SFRCS ACTUATION #2 OTSG LOW PRES SURE Open valves - AF-360, AF-388, AF-3870, AF-3871, AF 608, MS-106, MS-107A Closed valves - AF-3869, AF-3872, AF-599, MS-106A, MS-107 The SFRCS is described in more detail in section 16.1.6.

16.1.5 Makeup/High-Pressure Injection Cooling Systems Makeup/High-Pressure Injection (MU/HPI) core cooling (also called PORV cooling or feed and-bleed core cooling) involves the use of the makeup and purification system, the high pressure injection system and, at the operator's discretion, the low pressure injection system. These three systems are shown'in Figure 16-5. The system contains two multistage centrifugal makeup pumps rated at 150 gpm each, with a discharge pressure of approximately 2500 psig.

Two suction sources are available to the pumps; the makeup tank and the borated water storage tank (BWST). During normal operations, the makeup pumps - supply seal injection and -control pressurizer level by discharging into the RCS via the makeup flow control valve (MU-32). The discharge of the makeup pumps enters the RCS through one of the high-pressure injection penetrations. When feed-and-bleed operations are required, plant procedures require the positioning of the three-way suction valve (MU-3971) to the BWST suction source, fully opening the makeup flow control valve, and the starting of both makeup pumps.

The high-pressure injection pumps (HPI) are a part of the emergency core cooling system and are not in service during normal operations. The system consists of redundant pumps and four injection paths into the cold legs of the RCS. The pumps receive their suction from the BWST and have a shutoff head of 1630 psig. When these pumps are used in the feed and bleed mode of core coolinig, both pumps are started, and the discharge of the low-pressure injection pumps can be aligned to the HPI pump suctions as described below.

The low-pressure injection (LPI) pumps are also a part of the emergency core cooling systems.

The LPI pumps receive a suction from the BWST and discharge via the decay heat removal coolers (not shown in Figure 16-5) into the reactor vessel.

USNRC Technical Training Center 16-4 Rev 0896 B&W Crosstraining Course Manual Davis-Besse Loss of All Feedwater USNRC Technical Training Center 16-4 Rev 0896

U2.i~~~~

ncdr~~uflil nu2

~u ai-BseLs fA edae The pumps are rated at 3000 gpm with a discharge "pressure of approximately 150 psig. The shutoff head of the, pumps is about 200 psig. -Plant procedures allow the discharge of the LPI pumps to be aligned to the suction of the HPI pumps by opening valves DH-62 and DH-63:.

' This alignment increases thedischarge pressure of the HPI pumps from 1630 psig to approximately 1830 psig and 'allows HPI flow at a higher:RCS pressure.

When the feed and bleed mode of core cooling is required, plant procedures call for starting the makeup pumps and the high-pressure injection pumps., After the pumps are in service, the "pressurizer pilot-operated relief valve, the pres surizer vent, and the hot leg vents are opened.

The HPI/LPI piggy-back mode of operation is not specifically addressed in the loss of subcooling margin or the overheating sections of plant procedures but may be aligned at the discretion of the operator. All the required feed-and-bleed alignments are performed in the control room.

16.1.6 Steam and Feedwater Rupture Control System (SFRCS)

The steam and feedwater rupture control system (SFRCS) is provided in the plant design as an engineered safety features system for postulated transient or accident conditions arising generally from the secondary (steam generation)

'.side of the plant, because the OTSGs serve as the heat sinks for the reactor power. The SFRCS senses loss of main feedwater (MFW),flow, rupture of an MFW line, and rupture of a'main steamline. It also senses loss of all forced coolant flow in the primary system.,

The safety function' of the SFRCS 'is to provide safety actuation signals to equipment that

-will:, isolate thesteam flow from the OTSGs, isolate the MFW flow, and start and align the AFW system. The SFRCS also provides output signals to the turbine trip system and to the Anticipatory Reactor Trip System (ARTS).

"In the event of loss of MFW pumps or a main feedwater line rupture, the OTSGs would start to boil dry, and, if action is not initiated promptly, there would be no motive steam available for the turbine-driven AFW -system and the OTSGs would be lost as heat sinks. As soon as the MFW pump discharge pressure falls below the pressure in the OTSG (i.e., reverse differential pressure across a check valve) by a predetermined value, the SFRCS provides safety actuation -signals to close the main steam isolation valves (MSIVs),

close the MFW stop and control valves, and start AFW. The SFRCS also receives OTSG low level signals which, are diverse from the 'reverse

'differential pressure signals.

In the event of steamline pipe ruptures, when the main steam pressure drops, the SFRCS will

. 'close both MSIVs and the MFW stop and control "valves. The description of the ýSFRCS in the Updated Safety Analysis Report (USAR) Section 7.4.1.3 does not mention the SFRCS closure (or re-opening) of the AFW containment isolation valves (AF-608 and AF-599), although the design

.does include such features. -The AFW is also

.initiated and both AFW trains are aligned to draw

'steam only from, and to provide feed only to, the

- uhaffected "intact" OTSG.-,

- In the event of loss of all four reactor coolant pumps (RCPs), forced cooling flow of the reactor coolant system would be lost and AFW flow is needed to enhance, natural circulation flow.

Therefore, the -SFRCS senses the loss of, four RCPs and automatically initiates AFW..

Figure 16-6 depicts the channelization of the SFRCS. There are two Actuation Channels, each of which contains two identical logic channels.

itev uo USNRC Technical Training Center 16-5 16-5 USNRC Technical Training Center

, t Davis-Besse Loss of All Feedwater SIn-e,1yf

-"-;canino 4-n"re Mannual

-.Kev 0896

B&W Crosstraining Course Manual 5sv~-t taa tJSJa

u. nj wcuater Within each Actuation Channel, one logic channel is ac powered and the other logic channel is dc powered.

The field wiring at the actuated equipment is such that generally both logic channels must "trip" (i.e., a two-out-of-two AND logical arrangement) to actuate most equipment, which is referred to as a "full trip." However, some equipment is actuated by a "half trip" (i.e.,

only one logic channel ofan actuation channel has tripped). For example, the atmospheric steam vent valves are closed by "half trips."

16.1.7 Pressurizer Pilot Operated Relief Valve At the top of the pressurizer as shown in Figure 16-1, there are two code' safety valves which vent directly to the containment atmosphere, a high-point vent line, and the pilot operated relief valve (PORV) with its associated upstream block valve.

The PORV block valve is a manually controlled motor-operated valve, equipped with position instrumentation including a position alarm.

The PORV is a style HPV-SN solenoid-con trolled pilot-operated pressure relief valve manu factured by the Crosby Valve and Gage Company.

It was the Incident Investigation Team's (liT) understanding that Davis-Besse is the only B&W designed PWR that has a Crosby PORV. The Crosby PORV is operated by the reactor coolant system pressure via a solenoid-operated pilot valve and therefore does not-involve any pneumatic power (instrument air or nitrogen).

Electric power is used for the solenoid control device. To actuate the' PORV, the solenoid is energized. This action allows the use of reactor coolant system pressure to open the main disc of the valve.

The controls for the PORV include features for automatic operation, manual open, manual close, and lock open. In automatic, the pressure channel's bistable would close one set of contacts above the high pressure setpoint (2425 psig) and would close another set of contacts below the low pressure setpoint (2375 psig). When the high pressure setpoint is reached, the control relay is energized and an electrical seal-in circuit is energized. When the low setpoint is reached, an auxiliary relay is operated which in turn interrupts the valve-open seal-in circuit.

In manual control, the circuit is designed for momentary-only operation of the switch to the valve-open position. The seal-in circuit will hold the valve open if the pressure is above the low pressure setpoint. To lock open the PORV (as would be done for MU/HPI cooling), the manual control switch would be rotated to the "lock open" position. The control circuitry would maintain the PORV solenoid energized regardless of RCS pressure.

To manually close the PORV, the control switch must be rotated to the "auto" position and the control switch pushed inward.

This action causes, both control relays to be deenergized and the seal-in circuit to be deenergized, which in-turn causes the PORV solenoid to be deenergized.

The indicators for the PORV include: control power available (blue), automatic (white), PORV open (red), PORV close (green), and lock open (amber).

The PORV open/close lights are operated by a limit switch operated by the PORV solenoid plunger (i.e., the output of the electric solenoid; the mechanical input to the PORV). All of these position lights, are PORV command indicators, in that they indicate only the position that the electric controls have commanded for the PORV.

Only the acoustic monitor is a direct indicator of the flow condition through the PORV/block valve path.

USNRC Technical Training Center 16-6 Rev 0896 16-6 Rev 0896 I

USNRC Technical Training Center

B&W CrosstraininL2 Course ManualDas-esLosoAlFedte The acoustic monitor *for'the PORV wa, installed as one of the post-TMI safet3 improvements.- Two redundant accelerometei sensors are mounted on -the discharge piping Each sensor channel provides a signal to drive the remote 0-100% (open) PORV position meter or "the post-accident monitoring (PAM) panel, anc an adjustable positionsignal switch to drive thc remote PORV open/closed lights -on the PAN panel. The IIT was told that the adjustable switcl was set such that the red (open) light would bN energized if the flow signal is greater than 22% o:

the full flow value.

If PORV/block valve flow is less than 22%

the red (open) light would be turned off and the green (closed) light would,be energized.- Th(

-" meter could be.used to obtain more precis(

position/flow information.

The Post-Acciden

"-Monitoring, (PAM) panel is a separate pahe mounted about 7 ft to the left of where'the reacto:

operator assigned to the primary system would b(

standing. "Both redundant red/green POR\\,

'indicating lights are easily visible to the operato "ifhe turns his head. However, the 0-100% meter are relatively small, i.e., about a 3-inch tal vertical edge-mounted meters. To read this meter the operator would have to step a pace or tw(

toward the PAM panel.

16.2 Event Narrative

, This detailed description of the Davis-Bessi

• loss-of-feedwater event focuses attention on thi operator actions which prevented a potentiall:

serious event,' both in terms of safety and eco nomics, from occurring.

From their norma "operating routine, the operators were plungei abruptly into a high stress situation reluirin, complicated responses outside the control room Furthermore, these "activities unfolded early on.

Sunday morning -when additional technica expertise from either onsite or offsite was at a

'minimum.

In view of the importance of the operator actions, the narrative of the event which follows is Sbaised upon a composite of the operator interviews I

performed by the (IIT). The narrative is written to reflect the operators' descriptions of their actions, observations, and thoughts during the event. The SIIT decided that this would best convey the effects of stress, training, experience, teamwork, and f

impediments on operator performance. There are

.-undoubtedly lessons to be learned about what "operators are likely to do during a serious event which, are not easily summaiized, but which perhaps can be inferred from the descriptions of what occurred during this particular event.

t 16.2.1 Shift Change r

On June 9, 19859 the midnight shift of e

operators assumed control of the Davis-Besse 7

nuclearpowerplant. The oncoming shift included r

four licensed operators, four equipment operators, s

an auxiliary operator, and an administrative assis 1

tant.

The shift supervisor and assistant shift supervisor were the most experienced members of the operating crew. Both were at the plant before it was issued an operating license in April 1977.

The two reactor operators, who were responsible for the 'control room;, had decided.between

'themselves who would be responsible for the primary-side and who would take the secondary side work station. The secondary-side operator y

had been a licensed reactor operator for about two years; the primary-side operator was licensed in

.1 January 1985.

g The shift turnover on June 9 was easy-there

i.

were no ongoing tests or planned changes to the a

plant status.

The,plant was operating at 90 tl percent of the full power authorized in the license granted by the NRC in April 1977, to minimize USNRC Technical Training Center 16-7 Rev WS9b USNRC Technical Training Center

, 16-7

' Davis-Besse Loss of All Feedwater S

f7 Rev 0896

B&W Crosstrainina Course Manual Davis-Besse Loss of All Feedwater the potential for an inadvertent reactor trip (i.e.,

shutdown) due to noise on primary coolant flow instrumentation.

All the major equipment control stations were in automatic except the No. 2 main feedwater pump. As a result, the integrated control system instruments were monitoring and controlling the balance between the plant's reactor coolant system and the secondary coolant system.

Since April 1985, there had been control prob lems with both main feedwater pumps. Trouble shooting had neither identified nor resolved the problems. In fact, a week earlier, on June 2,1985, both feedwater pumps tripped unexpectedly after a

reactor trip.

After some additional troubleshooting, the decision was made to not delay startup any longer, but to put instrumenta tion on the pumps to help diagnose the cause of a pump trip, if it occurred again. As a precaution, the number two main feedwater pump was operating in manual control to prevent it from tripping and to ensure that all main feedwater would not be lost should the reactor trip.

During the first hour of the shift, the operators' attention and thoughts were directed to examining the control panels and alarm panels, and performing instrument checks and routine surveillances associated with shift turnover. Thus, at 1:35 in the morning, the plant generator was providing electricity to the Ohio countryside. The secondary-side operator' had gone to the kitchen where' he joined an equipment operator for a snack. The other reactor operator was at the operator's desk studying procedures for requalification examinations. The assistant shift supervisor had just left the kitchen on his way back to the control room after a break. The shift supervisor was in his office outside the control room performing administrative duties.

16.2.2 Reactor Trip - Turbine Trip The assistant shift supervisor entered the control room and was examining one of the consoles when he noticed that main feedwater flow was decreasing and that the No. 1 main feedwater pump had tripped (Figures 16-7 thru 16-9 trace the major primary and secondary parameters and will be 'referred to for the remainder of this discussion). Since the No. 2 feedwater pump was in manual control, it could not respond to the integrated control system demand automatically to increase feedwater flow.

The "winding down" sound of the feedwater pump turbine was heard by the reactor operator in the kitchen, and by the administrative assistant and the shift supervisor, both of whom were in their respective offices immediately outside the control room. They headed immediately for the control room-the event had begun.

The secondary-side reactor operator ran to his station and immediately increased the speed of the No. 2 main feedwater pump to compensate for the decrease of feedwater flow from the No. 1 pump.

The primary-side operator had already opened the pressurizer spray valve in an attempt to reduce the pressure surge resulting from the heatup of the reactor coolant system due to a decrease in feedwater flow.

The plant's integrated control system attempted automatically to reduce reactor/turbine power in accordance with the reduced, feedwater flow. The control rods were being inserted into the core and reactor power had been reduced to about 80 percent. At the same time the primary side reactor operator held open the pressurizer spray valve in an attempt to keep the reactor coolant pressure below the high pressure reactor trip setpoint of 2300 psig (normal pressure is 2150 psig). However, the reduction of feedwater and USNRC Technical Training Center

.B&W Crosstrainin2 Course Manual Davis-Besse Loss of All Feedwater 16-8 Rev 0896

D2.'I

• .,1...n(nurcD V~nV~dDavis-Besse Loss of All Feedwater JD.t11 d-

• aa. *.

P-a ana subsequent degradation of heat removal from the primary coolant system caused the reactor to trip, on high reactor coolant pressure. The operators had done all they could do to prevent the trip, but the safety systems had acted automatically to shut down the nuclear reaction.

The primary-side operator acted in accordance with the immediate post-trip actions specified in the emergency procedure that he had memorized.

, Among other things, he checked that all control rod bottom lights were on, hit,the' reactor trip

- (shutdown) button, isolated letdown from the reactor coolant system, and started a second makeup pump in anticipation of a reduced pres surizer inventory after a normal reactor trip. Then he waited, and watched the reactor coolant pressure to see how it behaved.-

The secondary-side operator heard the turbine stop valves slamming shut and knew the reactor had tripped. This "thud" was heard by most of the' equipment operators who also recognized its meaning, and two of them headed for the control room. Almost simultaneously, the secondary-side operator heard the loud roar of main steam safety valves opening, a sound providing further proof that the reactor had tripped. The lifting of safety valves after a high-power reactor trip was normal.-:

Everything was going as expected'as he waited and watched the steam generator water levels boil, down-each should have reached the normal post-,

trip low-level limit of 35 inches onthestartup

-level instrumentation and held steady.

The shift supervisor joined the operator at the secondary-side control console and watched thes rapid decrease of the steam generator levels. The rapid feedwater reduction system (a subsystem of

-the integrated control system) 'had -closed the Sstartup feedwater valves, but as' the -level

'approached the low level limits, the startup valves opened to hold the level steady.. The main steam safety valves closed as expected. The system response was looking "real good" to the shift supervisor.

The assistant shift supervisor in the meantime opened the plant's looseleafemergency procedure book. (It is about two inches thick, with tabs for quick reference.,The 'operators refer to-it as emergency procedure 1202:01; the NRC refers to it as the ATOG procedure - Abnormal Transient Operating Guidelines.) *As he read aloud the immediate actions specified, the reactor operators were responding in the affirmative. After phoning the shift technical advisor (STA) to come to the control room, the administrative assistant began

-ýwriting down what the operators were saying, although they were speaking faster than she could write..

16.2.3 Loss of Main Feedwater Although the assistant shift supervisor was loudly reading the supplementary actions from the emergency procedure book, the shift supervisor heard the main steam safety valves open again.

He knew from experience that something was unusual and instinctively surveyed the control console and panels for a clue., He discovered that both main steam,isolation valves (MSIVs) had closed-the first and second

,of a list of unexpected equipment performances and failures that occurred during the event.

The secondary-side operator was also aware that something was wrong because he noticed that the speed of the only operating main feedwater pump was decreasing. After verifying that the status of.the main feedwater pump turbine was "normal, he concluded that the turbine was losing steam pressure at about the same time that the shift supervisor: shouted that,the MSIVs were closed.

All eyes then turned up to the annunciators at the top of the back panel. They U~~ ;nQQ1<

USNRC Technical Training Center 1 16-9*

IX*¥ UI37*

B&W...............Course Manual

¢ f1,v -

,*k 1

T

-e

/

nf All V oA,.,n

1. l.

saw nothing abnormal in the kind or number of annunciators lit after the reactor trip.

The operators expected to find an alarm indicating that the Steam Feedwater Rupture Control System (SFRCS, pronounced S-FARSE) had activated.

Based on their knowledge of previous events at the plant, they believed that either a partial or full actuation of the SFRCS had closed the MSIVs.

However, the SFRCS annunciator lights were dark. The MSIVs had closed at 1:36 a.m. and they were going to stay closed. It normally takes at least one-half hour to prepare the steam system for reopening the valves.

The No. 2 main feedwater pump turbine, de prived of steam, was slowly winding down. Since the MSIVs were closed and there was limited steam inventory in the moisture separator reheaters, there was inadequate motive power to pump feedwater to the steam generators. At about 1:40 a.m. the discharge pressure of the pump had dropped below the steam pressure, which terminated main feedwater flow.

16.2.4 Loss of Emergency Feedwater The secondary-side operator watched the levels in both steam generators boil down; he had also heard the main steam safety valves lifting.

Without feedwater, he knew that an SFRCS actuation on low steam generator level was imminent. The SFRCS would actuate the auxil iary feedwater system (AFWS), which in turn would provide emergency feedwater to the steam generators. He was trained to trip manually any system that he felt was going to trip automatically.

He requested and received permission from the shift supervisor to trip the SFRCS on low level to conserve steam generator inventory; i.e., the AFWS would be initiated before the steam generator low-level setpoint was reached.

He went to the manual initiation switches at the back panel and pushed two buttons to trip the SFRCS. He inadvertently pushed the wrong two buttons, and, as a result, both steam generators were isolated from the emergency feedwater supply. He had activated the SFRCS on low pressure for each steam generator instead of on low level. By manually actuating the SFRCS on low pressure, the SFRCS was signalled that both generators had experienced a steamline break or leak, and the system responded, as designed, to isolate both steam generators.

The operator's anticipatory action defeated the safety function of the auxiliary feedwater system-a common-mode failure and the third abnormality to occur within 6 minutes after the reactor trip.

The operator returned to the auxiliary feedwater station expecting the AFWS to actuate and to provide the much-needed feedwater to the steam generators that were boiling dry. Instead, he first saw the No. I AFW pump, followed by the No. 2 AFW pump trip, on overspeed-a second common-mode failure of the auxiliary feedwater system and abnormalities four and five.

He returned to the SFRCS panel to find that he had pushed the wrong two buttons.

The operator knew what he was supposed to do. In fact, most knowledgeable people in the nuclear-power industry, even control room designers, know that the once-through steam generators in Babcock & Wilcox-designed plants can boil dry in as little as 5 minutes; consequently, it is vital for an operator to be able to quickly start the AFWS.

There could have been a button labeled simply,"AFWS-Push to Start."

But instead, the operator had to do a mental exercise to first identify a signal in the SFRCS that would indirectly start the AFW system, find the correct set of buttons from a selection of five identical sets located knee-high from the floor on the back panel, and then push them without being distract-USNRC Technical Training Center 16-10 Rev 0896 Rev 0896 I

ý B&W Crosstraining Course Manual USNRC Technical Training Center 16-10

R&W Crnsstrainini Course ManualDai-esLosfAlFedtr ed by the numerous alarms and loud exchanges of information between operators.

The shift supervisor quickly determined that

• "K the '~alves in the AFWS were improperly aligned.

'He reset the SFRCS,'tfipped it on low level, and corrected the operator's error about one minute after it 'occuried. - This action commanded the SFRCS to realign itself such that each AFW pump delivered flow to its associated steam generator.

Thus;had both systems (the AFWS and SFRCS)

"operated properly, the operator's mistake would have had no significant consequences on plant safety.

The assistant shift -supervisor, meanwhile, continued reading aloud from-the emergency "procedure. i" He, had reached 'the point in the

";supplementary fictions that require verification that feedwater flow was available.

However, "there was no feedwater, not even from the AFWS, a safety systeni'designed to provide feedwater in the situation that existed.

(The Davis-Besse emergency plan identifies such a situation as a Site Area Emergency.) -Given this condition, the, procedure directs the operator to the section entitled, "Lack of Heat Transfer." -He opened the procedure at the tab corresponding to this, condition, but left the desk and the procedure at this point, to diagnose why the AFWS had failed.

"He performed a valve alignment verification and found that the isolation valve in each AFW train had closed. Both valves (AF-599 and AF-608)

Shad failed to reopen automatically after the shift, supervisor had reset the 'SFRCS.

'He -tried unsuccessfully to open-the valves with the' pushbuttons on the back panel. -He went to the SFRCS cabinets in the back of the back panel to clear any trips in the system and block them so that the isolation valves -could open. However, there were 'no signals keeping the valves closed.

He concluded that the torque switches in the valve

,:operators must have tripped. The AFW system had now suffered its'third common-mode failure, thus increasing the number of malfunctions to seven within 7 minutes after the reactor trip (1:42 a.m.).

16.2.5 Reactor Coolant System Heatup Meanwhile, about 1:40 a.m., the levels in both steam generators began to' decrease below the normal post-reactor-trip limit (about 35 inches on the startup range). The feedwater flow provided by the No. 1 main feedwater pump had terminat

ýed.' The flow, from the No. 2 main feedwater pump was decreasing because the MSIVs were closed; which isolated the main steam supply to the pump. With decreasing feedwater flow, the effectiveness of the steam generators as a heat sink for removing decay (i.e., residual) heat from the reactor coolant system rapidly decreased. As the levels boiled down through -the low-level setpoint (the auxiliary feedwater should automati cally initiate,at about 27 inches), the average temperature ofthe reactor coolant system began to

.',increase, indicating a lack of heat transfer from the primary to the secondary coolant system.

When the operator incorrectly initiated SFRCS on

- low pressure,-all feedwater was isolated toboth steam generators.

The reactor coolant system began to heat up because heat transfer to the steam

,.generators -was essentially lost due to-,loss of

• steam generator water level.

',The average, reactor coolant -temperature increased at the rate of about 4 degrees Fahrenheit

-per minute for about,12 minutes. - The system "pressure also increased steadily until the operator fully opened the pressurizer spray valve (at about 1:42 a.m.). The spray reduced the steam volume in the pressurizer and temporarily interrupted the pressure increase. The pressurizer level increased

. rapidly, but the pressurizer did not completely fill

'with water.- As the indicated level exceeded the USNRC Technical Training Center 16-11 Rev IJ1Yb USNRC Technical Training Center 116-11 S..

l 1...............

I ;

-Davis-Besse Loss of All Feedwater

-- Rev 0896

B&W Crosstraining Course Manual Davis-Besse Loss of All Feedwater normal value of 200 inches, the control valve for makeup flow automatically closed.

At this point, things in the control room were hectic. The plant had lost all feedwater; reactor pressure and temperature were increasing; and a number of unexpected equipment problems had occurred. The seriousness of the situation was fully appreciated.

16.2.6 Operator Actions By 1:44 a.m., the licensed operators had ex hausted every option available in the control room to restore feedwater to the steam generators. The main feedwater pumps no longer had a steam supply. Even if the MSIVs could be opened, the steam generators had essentially boiled dry, and sufficient steam for the main feedwater pump turbines would likely not have been available.

The turbines for the AFW pumps had tripped on overspeed, and the trip throttle valves could not be reset from the control room. Even if the AFW pumps had been operable, the isolation valves between the pumps and steam generators could not be opened from the control room, which also inhibited the AFWS from performing its safety function. The likelihood of providing emergency feedwater was not certain, even if the AFW pump overspeed trips could be reset and the flow paths established; for example, there was a question as to whether there was enough steam remaining in the steam generators to start the steam-driven pumps. Unknown to the operators, the steam inventory was further decreased because of problems controlling main steam pressure. The number of malfunctions had now reached eight.

Three equipment operators had been in the control room since shortly after the reactor tripped. They had come to the control room to receive directions and to assist the licensed operators as necessary.

They were on the sidelines watching their fellow operators trying to gain control of the situation.

The safety-related AFW equipment needed to restore water to the steam generators had failed in a manner that could only be remedied at the equipment locations and not from the control room. The affected pumps and valves are located in locked compartments deep in the plant.

The primary-side reactor operator directed two of the equipment operators to go to the auxiliary feedwater pump room to determine what was wrong-and hurry.

The pump room, located three levels below the control room; has only one entrance: a sliding grate hatch that is locked with a safety padlock.

One of the operators carried the key ring with the padlock key in his hand as they left the control room. They violated the company's "no running" policy as they raced down the stairs. The first operator was about 10 feet ahead of the other operator, who tossed him the keys so as not to delay unlocking, the auxiliary feedwater pump room. The operator ran as fast as he could and had unlocked'the padlock by the time the other operator arrived to help slide the hatch open.

The operators descended the steep stairs resembling a ladder into the No. 2 AFW pump room. They recognized immediately that the trip throttle valve had tripped (Figure 16-10). One operator started to remove the lock wire on the handwheel while the other operator opened the water-tight door to the No. 1 AFW pump. He also found the trip throttle valve tripped and began to remove the lock wire from the handwheel.

The shift supervisor had just dispatched a third equipment operator to open AFW isolation valves AF-599 and AF-608.

These are chained and locked valves, and the shift supervisor gave the USNRC Technical Training Center 16-12 Rev 0896 B&W Crosstraininu Course Manual Davis-Besse Loss of All Feedwater USNRC Technical Training Center 16-12 Rev 0896

B&WA Crosstrainin~ Cou e Manual Davis-Besse Loss of All Feedwater locked-valve key to the operator before he left the control room., He paged a fourth equipment' operator over the plant commimications systems and directed him also to open valves AF-599 and AF-608. Although the operators had to go to a different room for each valve, they opened both valves in about 3-1/2 minutes. They were then directed to the AFW pump room.

As the operators ran.to the equipment, a variety of troubling th6ughts ran through their minds. One operator was uncertain if he would be able to carry out the task that he had been directed "to do. He knew that the valves he had to open were 16cked valves, and that they could not be operated manually without a key. He did not have a key and that concerned him. As he moved through the turbine building, he knew there were

-numerous locked doors that he would have to go through to reach the valves. He had a plastic card to get through the card readers, but they had been known to break and fail., He did not have a set of door keys,-and he would not gain'access if his key card broke, and that concerned him too.'

'The assistant shift supervisor came back into the control console area after having cleared the logic for the SFRCS and he tried again, unsuccessfully,, to open the AFWS isolation valves. At this point, the assistant shift supervisor.

made the important decision to attempt to place the startup feedwater pump (SUFP) in service to supply-feedwater to the steam generators. He

-wentto the key locker for the key required to perform one of the five operations required to get the pump running.

The SUFP is a motor-driven pump, usually more reliable than a turbine-driven pump, and more importantly, it does not require steam from the steam generatorsito operate. -The SUFP is

"* located in the same compartment as the No. 2 "AFW pump. -But since the refueling outage in January 1985,' the SUFP had been isolated by closing four manual valves, and its fuses were

removed from the motor control circuit. This

-isolation was believed necessary because of the

-consequences of a high-energy break of the non "seismic grade piping which passes through the two seismic-qualified AFW pump rooms. Prior to January 1985,- the SUFP could be initiated from the control room by the operation of a single switch.

The assistant shift supervisor headed ýfor-the turbine building, where he opened the four valves and placed the fuses in the pump electrical switchgear. This equipment is located at four different places;- in fact, other operators had walked through the procedure, of placing the SUFP in operation and required 15 to 20 minutes to do it. The assistant shift supervisor took about

'4 minutes to perform these activities. -He then paged the control' room from the AFW pump room and instructed the secondary-side operator to start the pump and align it with the No. I steam

'generator.

The two equipment operators in the AFW pump rooms had been working about 5 minutes to reset the trip throttle valves when the assistant shift, supervisor entered the room to check the SUFP. The equipment operators thought that they had latched and opened the valves. However,

- neither operator was initially successful in getting the pumps operational.

--Finally,, after one

• equipment operator had tried everything that the knew to get the No. 1 AFW pump operating, he left it and went to the No. 2 AFW pump, where the'other operator was having the same problem

- of getting steam to the turbine. Neither operator

• had previously performed the task that he was at tempting."

The assistant shift supervisor went over to assist the equipment operators and noticed USNRC Technical Training Center 16-13 Rev 1)896 USNRC Technical Training Center

, --,

• 16-13 SRev 0896

B&W Crosstrainin! Course Manual Davis-Resse Loss of All Feedwater immediately that the trip throttle valves were still closed. Apparently, the equipment operators had only removed the slack in attempting to open the valve. The valve was still closed, and the differ ential pressure on the wedge disk made it difficult to turn the handwheel after the slack was re moved, thus necessitating the use of a valve wrench. A third, more experienced operator had entered the pump room and used a valve wrench to open the trip throttle valve on AFW pump No.

2. Without the benefit of such assistance, the equipment operators may well have failed to open the trip throttle valves to admit steam to the pump turbines.

The third equipment operator then proceeded to the No. 1 AFW pump trip throttle valve. The valve had not been reset properly, and he experi enced great difficulty in relatching and opening it because he had to hold the trip mechanism in the latched position and open the valve with the valve wrench. Because the trip mechanism was not reset properly, the valve shut twice before he finally opened the valve and got the pump operat ing.

16.2.7 PORV Failure Prior to being informed by the assistant shift supervisor that the SUFP was available, the secondary-side operator requested the primary side operator to reset the isolation signal to the startup feedwater valves in preparation for starting the SUFP. In order to perform this task, the operator left the control console and went to the SFRCS cabinets in back of the control room. As he re-entered the control panel area, he was requested to reset the atmospheric vent valves. As a result of these activities, the primary-side operator estimated that he was away from his station for 20 to 30 seconds. (In fact, he was away for about two minutes.)

While the operator was away from the primary-side,control station, the pressurizer PORV opened -and closed twice without his knowledge. The pressure had increased because of the continued heatup of the reactor coolant system that resulted when both steam generators had essentially boiled dry.

According to the emergency procedure, a steam generator is considered "dry" when its pressure falls below 960 psig and is decreasing, or when its level is below 8 inches on the startup range (normal post-trip pressure is 1010 psig and post-trip level is 35 inches). The instrumentation in the control room is inadequate for the operator to determine with certainty if these conditions exist in a steam generator. The lack of a trend recorder for' steam generator pressure makes it difficult to determine if the steam pressure is 960 psig and decreasing., Therange of the steam generator level indicator in the control room is 0 250 inches, a scale which makes determining the 8-inch level difficult.

The safety parameter display system (SPDS) is intended to provide the operators with these critical data, but both channels of the SPDS were inoperable prior to and during this event. Thus,- the operators did not know that the conditions in the steam generators beginning at about 1:47 a.m. were indicative of a "dry" steam generator, or subsequently, that both steam generators were essentially dry.

When both steam generators are dry, the procedure requires the initiation of makeup/high pressure injection (MU/HPI) cooling, or what is called the "feed-and-bleed" method for decay heat removal. Even before conditions in the steam generators met these criteria, the shift supervisor was fully aware that MU/HPI cooling might have been necessary..When the hot-leg temperature reached 591°F-(normal post-trip temperature is about 5507F),

the secondary-side operator recommended to the shift supervisor that MU/HPI USNRC Technical Training Center 16-14 Rev 0896 B&W CrosstraininL, Course Manual

.Davis-Besse Loss of All Feedwater USNRC Technical Training Center 16-14 I Rev 0896

-R&W Crnstrainin Course Manual Davis-Besse Loss of All Feedwater cooling be initiated. At about the same time, the operations superintendent told the shift supervisor in a telephone discussion that if an auxiliary feedwater pump was not providifig cooling to one

/ steam generator within one minute, to prepare fort MU/HPI cooling. However, the shift, supervisor "did not initiate MU/HPI cooling. He waited for

.the equipment oplerators to recover the auxiliary "feedwater system.:

The shift supervisor appreciated the economic consequences of initiating MUJHPI cooling. One

-operator described it as a drastic action. During' MU/HPI,' the PORV and the high point vents on the reactor coolant system are locked open, which.

breaches one of the plant's radiological barriers.

Consequefitly,, radioactive 'reactor coolant is "released -inside the containment building.", The

• plant would have to be shut down for days for "cleanup 'even if MU/HPI cooling was successful.

Inaddition, achie'ing cold shutdown could be

'delayed. Despite his delay, the shift supervisor acknowledged having confidence in this mode of

"-core cooling based on his simulator training; he would have initiated MU/HPI cooling if"it comes to that."

"The primary-side operator returned t6o his station and began monitoring the pressure in the pressurizer,' which was near the PORV setpoint (2425 psig). The PORV then opened, and he watched the pressure decrease. The indicator in front of him signaled that there Was a closed signal to the PORV and that it should be closed.

The 'acoustic monitor installed after the'TMI accident was available to hirii'to verify that the PORV was 'closed, -but, he did not-look at it.

Instead, he looked at the indicated. pressurizer level,- which appeared steady, and based on "simulatortraining,he concluded that the PORV was closed..,

,. In fact, the PORV had not completely closed and, asa result, the pressure decreased at a rapid rate for about 30 seconds.

The operator did not know that the PORV had failed. He believed that the RCS depressurization was due either to the fully open pressurizer spray valve -or to the feedwater flow to the, steam generators. He closed the spray valve and the PORV block valve as precautionary measures.

But subsequent analyses showed that-the failed PORV was responsible for the rapid RCS

-depressurization.' Two minutes later, thereactor operator opened the PORV block valve to ensure "that the PORV was available: Fortunately,' the PORV had closed during the time the block valve was closed. The failed PORV was the ninth

"*-abnormality that had occurred within 15 minutes

- after reactor trip.

16.2.8 Steam Generator Refill At about 1:50 a.m. the No. 1 atmospheric vent valve opened and depressurized the No. 1 steam generator to about 750 psig when,the SFRCS signal was reset by the primary-side operator. The atmospheric vent valve for the,No. 2 steam generator had been closed by the secondary-side operator before the SFRCS signal was reset. The indicated No. 1 steam generator level was less

than 8 inches. The corresponding pressure and indicated level in the No. 2 steam generator were about 928 psig and 10 inches, respectively. The indicated levels continued to decrease until the secondary-side operator started the SUFP after

.being informed by the assistant shift supervisor that it was available and after the other operator had reset the isolation signal to the startup feedwater valves.

Although the,flow capacity of the SUFP is somewhat greater, approximately 150 gallons per minute (gpm) were fed to the steam generators nonr USNRC Technical Training Center

'16-15 KCYUOD

. Rev 0896

• 16-15

.B&W Croistraininp, Course Manual Davis-Besse Loss of All Feedwater USNRC Technical Training Center

B W Crosstrainin. Course Manual Davis-Besse Loss of All Feedwater because the startup valves were not fully opened.

Essentially all the feedwater from the SUFP was directed to the No. 1 steam generator. At about 1:52 a.m., the pressure in the No. 1 steam generator increased sharply, while the indicated water level stopped decreasing and began slowly to increase. Since there was little feedwater sent to the No. 2 steam generator, its condition did not change significantly.

The trip throttle valve for the No. 2 AFW pump was opened by the equipment operators at about 1:53 a.m. After the SFRCS was reset and tripped on low level by the shift supervisor, the AFWS aligned itself so that each AFW pump would feed only its associated steam generator; i.e., the No. 2 AFW pump would feed the No. 2 steam generator. Thus, the No. 2 AFW pump refilled the No. 2 steam generator, and its pressure increased abruptly to the atmospheric vent valve relief set point. The turbine governor valve was fully open when the trip throttle valve was opened, and the pump delivered full flow for about 30 seconds until the operator throttled the flow down.

The No. I trip throttle valve was opened by the equipment operator about -1:55 a.m., and feedwater from the AFWS flowed to the No. 1 steam generator. However, the No. 1 AFW pump was not controlled from the control room but controlled locally by the equipment operators.

The equipment operators controlled the pump locally using the trip throttle valve. One operator manipulated the valve based on hand signals from the operator who was outside the No. 1 AFW pump room communicating with the control room operator. For two hours the AFW pump was controlled in this manner by the operators. Their task was made more difficult from the time they first entered the AFW pump room by the intermittent failures of the plant communication station in the room.

With feedwater flow to the steam generators, the heatup of the reactor coolant system ended. At about 1:53 a.m. the average reactor-coolant temperature peaked at about 592°F, and then decreased sharply to 540'F in approximately 6 minutes (normal post-trip average temperature is 550'F). Thus, the reactor coolant system experi enced an overcooling transient caused by an excessive AFW flow from the condensate storage tank. The overfill of the steam generators caused the reactor coolant system pressure to decrease towards the safety features actuation system (SFAS) setpoint of 650 psig. To compensate for the pressure decrease, and to avoid an automatic SFAS actuation,, at approximately 1:58 a.m., the primary-side operator aligned one train of the emergency core cooling system (ECCS) in the piggyback configuration. In this configuration the discharge of the low-pressure injection pump is aligned to the suction of the high-pressure injection pump to increase its shutoff head pressure to about 1830 psig. At about the time the train was actuated, the combination of pressurizer heaters, makeup flow, and reduction of the AFW flow increased the reactor coolant pressure above 1830 psig. -As a result, only a limited amount (an estimated 50 gallons) of borated water was injected into the primary system from the ECCS.

At 1:59 a.m., the No. 1 AFW pump suction transferred spuriously from the condensate storage tank to the service water system (malfunction number 10). This action was not significant, but it had occurred before and had not been corrected.

Similarly, a source range nuclear instrument became inoperable after the reactor trip (malfunction number 11) and the operators initiated emergency boration pursuant to procedures.

(Note:

One channel had been inoperable prior to the event.) The source range USNRG Technical Training Center 16-16 Rev 0896 USNRC Technical Training Center 16-16 Rev 0896

-1Q C,

a,.,wd oo

-n-nc C urse*..

n. ia L

o l

w instrumentation had malfunctioned previously and, apparently had not been properly repaired. Also, the control room ventilation system tripped into its emergency recirculation mode (malfunction number 12), which had also occurred prior to this event.

The steam generator water levels soon exceeded the normal post-trip level, and the operator terminated AFW flow to the steam generators.

The subcooling margin remained adequate throughout this event. The event ended at about 2 o'clock in the morning, twelve malfunctions and approximately 30 minutes after it began.

16.2.9 PRA Insights Two major points concerning risk are evident from this event. The first is the probability of multiple equipment failures, and the second is a human reliability issue.

One of the major insights gained from a PRA is the risk associated with multiple failures of plant systems.

However, the assumption of.

multiple failures is usually criticized by the plant staff as a series of incredible failures. This event provides a very dramatic example. of the possibility of multiple failures. First, the loss of one main feedwater pump resulted in a transient that challenged plant systems. Next, multiple failures of safety-related systems-did occur. As discussed in this chapter, both AFW pump turbines, both AFW isolation,yalves, -and the PORV failed to respond properly during the event.

This list does not include the actionsof the SFRCS system, the failure of a turbine bypass

valve, and the loss of.source

• range instrumentation.,

One of the most difficult probabilities to include in a PRA is the failure of the operators to take proper action or human failure that results in an improper action. In this event, an operator error occurred when the SFRCS 'was manually initiated. Failure to recover after a system failure has occurred is demonstrated by the failure of the auxiliary operators to correctly reset the overspeed trips on the auxiliary feedwater pump turbines. In contrast to these two errors is the almost heroic actions that were performed by the assistant shift supervisor. This individual attempted to reset the SFRCS so that auxiliary feedwater could be added to the steam generators, and aligned the startup feedwater pump for service.

A calculation of conditional core vulnerability and core damage probabilities for this event was performed and appears in NUREG/CR-4674, "Precursors to Potential Severe Core Damage Accidents: 1985 A Status Report." The dominant sequence for core vulnerability has a probability of 9.085E-03, and the event tree for this sequence is shown in Figure 16-11..The dominant sequence for core damage has a conditional probability of 4.680E-03, and the event tree for this sequence is shown in Figure 16-12. Note that this sequence contains a failure of the HPI feed and bleed. The hesitancy of the °shift supervisor to initiate this system could have led to-this failure.

T,.

n nonai USNRC Technical Training Center

ý Davis-Besse Loss of All Feedwater ett*v M 16-17

APPENDIX - SEQUENCE OF EVENTS Initial Conditions

• Unit operating at 90% power

• #1 MFP operating in automatic (ICS) control

1. 2 MFP operating in manual control One source range NI inoperable

• Both channels of the SPDS inoperable Transient Initiator 01:35:00 #1 MFP trips. Control system causes MFP flow increase; MFP turbine trips on overspeed.

Partial Loss of Main Feedwater 01:35:01 Unit runback at 50%/mimn toward 55%.

01:35:21 Manual increase of #2 MFP speed. PZR spray valve opened to 100% in manual.

01:35:30 Reactor/turbine trip from 80% caused by high RCS pressure (2300 psig).

01:35:31 SFRCS low level trip - channel 2.

01:35:31 Both MSIVs start to close.

01:35:34 SFRCS actuation signal clears automatically.

01:35:36 MSIV #2 close.

01:35:37 MSIV #1 closed. The main steam supply to #2 MFP is isolated. Steam from the MSR and MS piping will drive the turbine for about 4-1/2 minutes.

01:35:45 PZR spray valve closed.

01:35:56 OTSGs on low level limits (35 in.).

01:40:00 OTSG levels begin to drop below low level limits.

Complete Loss of Main Feedwater 01:41:04 SFRCS OTSG #1 low level (26.5 in.) actuation. #1 AFW turbine being supplied with steam from and supplying feedwater to #1 OTSG.

01:41:08 Operator manually actuates SFRCS on low OTSG pressure. The low pressure actuation is in both SFRCS channels, and the system senses "steam ruptures" in both OTSGs. The following equipment changes due to the manual actuation:

1. #1 AFW turbine is aligned to be supplied from #2 OTSG.

2. #2 AFW turbine is aligned to be supplied from #1 OTSG.

3. #1 OTSG AFW containment isolation valve is automatically closed.

4. #2 OTSG AFW containment isolation valve is automatically closed.

5. The AFW cross-connect valves open.

-1 B&W Crosstraining Course Manual USNRC Technical Training Center 16-18 Rev 0896

B..

WCr..tr.inin. CourseMnual

.Davis-Besse Loss of All Feedwater SEQUENCE OF EVENTS (continued) 01:41:13 SFRCS channel 2 low level trip. Pressure trip has priority.

01:41:31

1. 1 AFW turbine trips on overspeed.'

01:41:44

1. 2 AFW turbine trips on overspeed.

01:42:00 Manual reset of SFRCS. The AFW containment isolation valves should have re-opened automatically, but did not. An attempt was made to re-open the valves from the main control panel, but the valves did not respond.

01:42:00 PZR spray valve opened.

01:43:55 "Initiate reset and block" of SFRCS attempted in an effort to re-open AFW containment isolation valves. Valves did not open.

01:44: +

Equipment operators dispatched to the plant to operate the following equipment:

"1. Two operators to the AFW turbines to restore AFW pumps to service.

2,,The assistant shift supervisor left the control room to place the startup feed pump in

-service.

3. Two operators were sent to open the AFW containment isolation valves.

01:44:50 Makeup flow decreases as pressurizer level increases above the normal setpoint of 200 in.

01:45:50

1. 2 AFW turbine overspeed trip reset locally.

01:45:29 OTSG #1 atmospheric vent valve opened.

01:46:30

1. 1 AFW turbine throttle valve relatched and valve opened (overspeed trip not cleared).

Speed controlled locally throughout event 01:47:33 OTSG #1 below 960 psig and decreasing..

01:47:48 OTSG #2 AFW containment isolation valve opened locally.

01:48:08 OTSG #1 atmospheric vent valve closed.

01:48:49 PZR PORV opens at 2433 psig (2425 psig setpoint).

01:48:51 OTSG #2 pressure <960 psig and decreasing. Both OTSGs now "dried out." Procedures require MU/HPI core cooling. MU/HPI core cooling is also called "feed and bleed" core cooling.

01:48:52 PORV closed at 2377 psig. (2375 setpoint) 01:49:28 OTSG #1 AFW containment isolation valve opened manually.

01:50:09 PORV opens at 2434 psig.

01:50:12 PORV closes at 2369 psig.,,

01:50:13 OTSG #1 atmospheric vent valve opened; OTSG pressure drops rapidly to 750 psig.

01:51:17 OTSG #1 level drops below 8 in.,(MU/HPI cooling criterion) 01:51:18 PORV opens at 2435 psig and does not close.

01:51:23 Startup feedwater pump.motor started.

01:51:30 Obtained flow from startup feedpump to OTSG #1.

01:51:42 Operator started to close the PORV block valve as pressure fell through 2140 psig.

01:51:42 RCS loop #1,reaches a minimum ýpressure of 2081 psig.

Loop #1 Thb0t588.6'F, Tave=587.5 0F.

01:51:43 PZR spray valve closed.

01:51:49 'Acoustic monitor indicates <20% flow through the PORV and PORV block valve.

01:53:00 Tho. reaches maximum value of 593.5 0F.

"I USNRC Technical Training Center

-Rev 0896

., 16-19

01:53:22 AFW train #2 has significant flow, with control locally via the trip-throttle valve.

SEQUENCE OF EVENTS (Continued) 01:53:25 RCS Tave reaches maximum of 592.3°F.

01:53:25 RCS Tave reaches maximum of 592.3°F.

01:53:35 OTSG #2 returns to above 960 psig.

01:53:56 PORV block valve re-opened.

01:54:45 OTSG #1 returns to above 960 psig.

01:54:46 AFW train #1 has significant flow.

01:56:58 OTSG #2 atmospheric vent valve open. Pressure <960 psig.

01:57:05 OTSG #1 <960 psig.

01:57:53 Low suction pressure developed on #1 afw pump.

01:58: +

Tave passed through the normal post-trip value. The cooldown (due to feedwater) has lowered RCS pressure to about 1720 psig. The operators have manually started #1 HPI pump in the piggy back mode of operation to maintain pressurizer level. About 50 gallons of water is injected.

01:58:08 RCS pressure reaches a minimum of 176 psig. Thot=546°F, Ta,,e=546.2°F.

01:58:27 AFW pump suction pressure returns to normal.

01:58:28 OTSG #1 atmospheric vent valve closed.

01:58:33 AFW flow to #1 OTSG reduced to control level.

01:58:40 AFW #1 suction transfers to service water. Manual realignment to CST.

01:58:57 AFW pump turbine overspeed trip reset.

02:01: +

When AFW turbine #2 was returned to service, the control room operator controlled the pump in manual rather than returning it to auto.

02:01:13 AFW train #2 flow reduced.

02:02:27 OTSG #1 pressure >960 psig.

02:02:30 OTSG #2 pressure >960 psig.

02:04:

Plant conditions essentially stable.

Additional Complications

"* Control room HVAC spuriously tripped to the emergency mode.

"* Upon energization, the remaining source range NI failed off-scale low. All control rods were verified to be fully inserted, and emergency boration was initiated.

"* The main turbine did not go on turning gear.

"* The operator attempted to override the automatic close signal for one of the SU reg valves, but a burned out light bulb prevented reset indication.

"* When vacuum was restored and the MSIVs opened, a water slug damaged one of the turbine bypass valves.

B&W Crosstraining Course Manual Davis-Besse Loss of All Feedwater USNRC Technical Training Center 16-20 Rev 0896

PRESSURIZER (SEE INSERT)

AUX FEED INLET I

HOT LEG M A I N NT S G INLET I

I I

r:

SURGE LINE

,.REACTOR COOLANT PUMP COLDREACTOR LEG_

VESSEL X

PORV AN[

SAFETY VALVE I (TYPICAL OF

-SPRAYNO2 NORMAL WATI LEVEL THERMOWELL' LEVEL SENSING NOZZLE,

(TYPICAL OF 3)

RESSURIZER INSERT ER, I SPACE L SUPPORTS (8)

Figure 16-1 Davis-Besse NSSS

SAFETY VENT CONTAINMENT 1 #1 OTSG SAFETY VALVE CONTAINMENT TRIP THROTTLE GOVERNOR AFW TURBINE

1. 1 ATMOSPHERIC VENT TO MAIN "TURBINE TO MAIN TURBINE TRIP THROTTLE AFW TURBINE

1. 2 MSIV I I I I I I

i I

I I I

DEAREATOR TANKS PUMP TURBINE DRIVER FEED MAIN FEED PUMP STARTUP FEEDWATER PUMP MAIN MAIN FEEDWATER FEED REGULATING BLO5

VALVE,

.p HIGH PRESSURE FEEDWATER HEATERS NOTE:

SYSTEM VALVES NOT INVOLVED IN THE EVENT OMITTED FOR CLARITY TO "OTSG #1 TO OTSG #2 STARTUP REGULATING VALVE "11

(.

(D

0) ci, 11

FROM CST FROM DEAREATOR 608 AF 3869 SERVICE WATER

-n CD CL CD c)

CD x

'.1 09 CD

1. 1 AF-360 AF AF 3871 TO OTSG #1 TO OTSG #2

1. 2 AF-388 WATER AF 3872 AF 599

cl

.MU-32 (D

am 3t (D

o0 HIGH PRESSURE DD H 6 IN J E C T IO N 5

CoTO RCS COLD LEGS CD TO 3

• TOREACTOR

ACTUATION CHANNEL #1 REV. dp LOW PRESS.

RCP CD 0

0 Cl<

"CD r

0 Co INSTRUMENT SENSING CHANNELS ACTUATION CHANNEL #2

320-620 ZoI I

I I

I uu 288-610 -

2390 RCS Pressure 256-600 2280 "2

\\/

10 a)

-2170

.. '/\\/._2 224 5

a)

CD_0.

a)

, t

"*2060 a)

0.

0 0

E, E a) 160

< 570 -

C1950

,Z C'V; N

"'C 0

cn co-0 3n 128

,560 -/

1840 0

nl L

,6/

RCS Temperature

\\80

=

0 CDa D-1730 96-,,, 550

\\/

C4 Pressurizer Level

-1620 2-540--1510 5 0 IIIIIIII I

t 1400 AM 1:35:31 1:38:31 1:41:31 1:44:31 1:47:31 1:5U:01 1:b3:01 1:06:01 1:59:31 2-:u4;0I Time

250 225 200 1200 f

1080 960

,9840

-_720 (D

a 600 II 0

Auxiliar E

I u 480 -

i 0

E 360 240 --

Startup Feedwater F 120 Level 0

AM 1:35:31 1:38:31 1:41:31 1:44:31 1:47:3

'50:31 1:53:31 1:56:31 1:59:31 2:02:31 Time

-.l C

co z

c CD 0 M C

(I)

(D 0 3

CD M

CD 0

CD U1)

S175 75

-1150 Q

0 ca c

(D 125 E

ca, a) 100 0

• 0 75 z

50 1500 1350 1200 0 CL LL 1050 (D

900 L,

ca.

750 600 (9

E ci, 450 a

C 0

E 300

z 150 0

0.

E 0L ci, CD 0

a) ca)

U 0

cu) ci E

0 ca, U) ai)

CD

-0 E

z 0

25 0

250 r-225 -

200 I-175 -

150 [-

125 -

100 -

75-50-25!-

1200 1080 960 cn 0.840 ci) a)

A 720

( 480 E360

3 E

240 120 1500 1350 1200 0

0.

0 1050 900 U

0.

a) a)

ca a)

E 30 z

a, 150 0

Time C:

(D CD z

CD 0

G),

CD CD 0,

-0 CD CD CD c,)

a) a)

ca, a) 0 z

4

-1 0

I I

I I

AM 1:35:31 1:38:31 1:41:31 1:44:31 1:47:31 1:50:31 1:53:31 1:56:31 1:59:31 2:02:31 I

-TRIP HOOK REPOSITION SPRING

-Trip Hook Latch-Up Steam In Valve Trip Mechanism Manual Trip LINK Turbine Tnp Mechanism Steam To Turbine Figure 16-10 Trip Throttle Valve

BABCOCK AND WILCOX CROSS TRAINING MANUAL CHAPTER 17 ANO-1 Seal Failure

TABLE OF CONTENTS 17.0 ANO-1 REACTOR COOLANT PUMP SEAL FAILURE 17.1 Introduction.........................................................

17-1 17.2 Event Description....................................................

17-1 17.2.1 Seal Failure and Power Reduction....................................

17-1 17.2.2 Increased Seal Leakage and HPI Initiation..............................

17-1 17.2.3 Plant Cooldown...................................................

17-1 17.3 Failure Analysis 17-2 17.4 Corrective Actions 17-3 17.5 Similar Event - Oconee 2 (1/74).........................................

17-3 17.6 PRA Insights........................................................

17-4 Appendix - Sequence of Events..................................................

17-5 USNRC Technical Training Center I 7-i Rev 0896 I

B&W Crosstraining Course Manual ANO-I Seal Failure USNRC Technical Training Center 17-i Rev 0896

-, ANO-lSeal Failure

,t

yr 

J3Ma *

F.

17.0 ANO-1 REACTOR COOLANT.

PUMP SEAL FAILURE, Learning Objectives:

1. Describe how control room instrumentation can be used to determine RCP seal failures.

2. -Explain the different methods that can be used to initiate high pressure injection.

• 3. Explain why isolation of the core flood tanks is necessary during a plant cooldown.

"17.1, Introduction 2

-Arkansas Nuclear One, Unit 1 (ANO-1) is a 177 fuel assembly B&W designed plant with a*

core rating of 2568 Mwt. --The unit is equipped with Byron Jackson reactor coolant pumps driven "by 9000 hp, 6900vac, 3-phase induction motors.

"The design, electrical output of, the unit is 850

-Mwe. Priorto the loss of the RCP seal, the unit

-was operating at 86% power with all parameters

, "ithin their normal operating ranges.

17.2 Event Description 17.2.1, Seal Failure and Power Reduction.

reduction to minimize RCS inventory losses.

Sixty-two minutes after the power reduction was started, the turbine-generator was removed from

.service.

One minute later, the "C" RCP was stopped.- Three minutes later, 'the reactor was manually tripped from 10% power.

17.2.2 Increased Seal Leakage and HPI Initi ation "After the "C" RCP was stopped, the RCS leak rate increased to an estimated 250-300 gpm. Four actions were taken in response to-the increased leakage.- First, high pressure injection was manu

'ally placed in service by starting two makeup pumps, opening the four high pressure injection valves, and opening the suction valves from the "borated water storage tank (BWST). Note that these actions could have been accomplished by pressing the manual initiation pushbuttons.

However, all the ESF equipment associated with high pressure injection (e.g., diesel-generators, service water, LPI etc.) would also have been realigned. The second action that was taken was the operation of the RCP oil lift pumps. The lift pumps were started and stopped four times in an

,effort to change the radial alignment of the seal package. After the fourth lift pump start, a de crease in the RCS leak rate was observed. The next action was the isolation of the seal return While performing an RCS inventory balance, path from the "C" RCP. The final action involved the control room operators observed a step de-increasing the seal injection flow to the failed seal.

crease in makeup tank level. Seal pressures and This action was taken to quench the steam/water seal flows confirmed that a problem existed with that was leaking by the seal. Reactor building the "C" RCP seal. Since the leak rate exceeded pressure had increased from 14.7 psia to 15.2 psia,

• technical specification limits, an orderly shutdown confirming the RCS leakage. The reactor building of the plant was initiated., -The initial rate of emergency coolers -were placed in service to power'reduction was 5%/minute, andthe initial reduce containment pressure.

leak rate was between 10 and 20 gpm. During the power reduction, an increase in the leak rate was 17.2.3 Plant Cooldown observed, and the rate of power decrease was increased to approximately 20 to 30% per minute.

After the seal leakage from the C" RCP had RCS letdown was isolated during the power.. been reduced, one of the operating makeup (HPI)

Key UO USNRC Technical Training Center 17-1

• 17-1 in JP. lu 9-1---a manuol Rev U5yo USNRC Technical Training Center

B&W Crosstrainin. Course Manual..............

pumps was stopped and the HPI valves were shut.

Normal makeup was established from the BWST with two makeup pumps in service. The"A" RCP was stopped in preparation for a plant cooldown.

A plant cooldown was initiated at a rate of 750F/hour.

Due to the relatively high RCS cooldown rate, the operators did not reach the remote controls to bypass the steam line break instrumentation control (SLBIC) system prior to reaching the 600 psig setpoint on the "B" loop. When SLBIC actuated, the "B" MSIV closed and the steam driven emergency feedwater pump started. The "A" loop did not reach the SLBIC setpoint at this time. Steam header pressure was controlled by cycling the "B" loop MSIV. After raising the "B" loop steam pressure above 600 psig the SLBIC function was bypassed; however, the header pressure was increased to approximately 650 psig, which reset SLBIC and removed the bypass.

Consequently, "A" loop had SLBIC actuation when steam header pressure was decreased to the 600-psig setpoint. The steam header pressure was again increased and SLBIC reset.

This time, SLBIC was successfully bypassed and the steam pressure was dropped below 600 psig without SLBIC actuation. About two and a half hours into the event, the emergency feedwater pump was stopped, and the auxiliary feedwater pump was placed in service.

As RCS pressure was decreased, a contain ment building entry was made to isolate the core flood tank (CFT) discharge valves. The entry was necessary to prevent the CFTs from discharging as the RCS pressure decreased below the 600 psig N2 pressure in the CFTs. However, some water discharged from the tanks during the-time opera tors took to isolate the discharge valves.The RCS cooldown was essentially complete eight hours after the seal failure. Both DHR loops were placed in service, and all four RCPs were stopped.

As a result of the seal failure and cooldown, approximately 60,000 gallons of water was col lected in the reactor building basement.

17.3 Failure Analysis The cartridge-type shaft seal consists of an upper, middle, and lower stage.

These three stages are cooled by seal injection coolant provid ed by the normally operating RCS makeup pump and by the integral heat exchanger which is cooled by the component cooling water system. The stages are in series, and each stage is designed to be capable of withstanding RCS operating pres sure so that a single stage failure could be detected and appropriate operator action completed in a timely manner without incident or consequential failure of the remaining two stages. On examina tion of the failed "C" pump seal package, how ever, all three stages were found to be severely damaged. The upper stage experienced the most damage. The stationary carbon ring had disinte grated; it appeared to have been ground into carbon particles and washed away. It is believed that this carbon ring breakdown was the initial failure; the loss of this ring probably resulted in the other two stages shifting upward, causing subsequent breakage of the carbon ring in each of the other two stages.

The failure of the upper stage carbon ring was postulated to have occurred from either excessive wear or fatigue due to compression. The mecha nism or conditions leading to the ultimate failure of the ring are not positively known. It has been postulated that either excessive axial movement or improper seating of the seal cartridge led to wear or failure by compression.

USNRC Technical Training Center 17-2 Rev 0896 Rev 0896 I

I.1....

AN(*-1 Seal Failure USNRC Technical Training Center 17-2

"- 'ANO-1 Seal Failure D

IT tL,,i UA1

a.

U, 17.4 Corrective Actions

" First, all four-RCP seal -packages'were re placed., The CFT isolation valve breakers were relocated to a motor control center outside of the reactor building. Finally,-all leakage was repro cessed for use in the RCS, thus requiring no liquid releases as a result of the seal failure.

17.5 Similar Event - Oconee 2 (1/74)

-A leak was discovered by an operator in the 1

1/2 inch seal 'injection line to reactor coolant pump 2A1 between the seal injection stop valve S'and the seal injection throttle valve. About three

'and a'half hours later'the seal injection flow to RCP 2A1 was secured to repair the leak. Due to loundary valve leakage, seal flow (-1.5 gpm) to RCP 2A1 continued, and the leak could 'not be "repaired.' The total seal flow control valve was

.'closed to secure flow to all 4 RCP's and permil repair of the leak, but leakage continued.

After 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />,;the seal injection flow wa.

stopped completely by closing a manually operat.

ed isolation 'valve. *The following events werc recorded by the plant computer over the next 1 (

min. period:

RCP 2B2 Seal Inlet Temp. Hi

-' -'(217.14°F), RCP 2B2 Seal Leakoff (Return) Flov Hi (1.75 gpm), Quench Tank Press. Hi, RCP 2B3 "Seal Leakoff Flow 1.28 gpm, RCP 2B2 Seal Inle Temp. 344.31°F, RCP 2B2 Off, RCP 2B2 Sea Return Closed, RCP 2B2 Seal Inlet.Temp 363.91°F, etc. RCP 2A1 Seal Inlet Temp. H 186.651F, RCP Motor 2B2 LWR Air Temp. H 187°F, Quench Tank Level Hi 90.05 in., RCP Sea Filter DP Hi, RCP 2A1 Leakoff 1.4 gpm, RC]

Motor 2B2 Upper Air Temp. Hi 188.32°F, ani Reactor Manual Trip. In addition, alarms wer received from the reactor building (RB) fir monitor, RCP 2B2 oil catch tank level, RCP 2B oil catch tank level (overflow from 2B2), and o the loose parts monitor (RCP 2B2) prior to shut down of RCP 2B2.

Three minutes after the manual isolation of seal flow, the operator commenced a load reduc tion from 22% power. The turbine was taken off the line within 12 minutes.. The reactor was manually tripped from 15% full power and system cooldown was started.

Fourteen minutes-after the reactor :trip, an operator entered the RB to investigate the cause of the fire monitor and RCP oil catch tank level alarms. He reported steam blowing around the RCP 2B2 seals and no visual indication of fire.

Fire monitor, oil catch tank level and quench tank

-' -high pressure alarms were -due to this leaking

'steam.

Fourteen hours from the discovery of the seal leak, a unit cooldown was in progress, with the RCS pressure at -700 psig. Depressurization of the core flood tanks was initiated by bleeding the nitrogen to the quench tank instead of to the vent header or waste gas filter, as is normally done.

Venting to the waste gas filter or vent header i

Would have required operation of 2 valves located in the RB basement, and these valves were inac I

cessible due to the seal leakage collecting there.

!.In the process of venting the core flood tanks to t

the quench tank, the, quench tank ' became 1

overpressurized and its rupture disk blew out, severing the impulse line on pressurizer level i

instrumentation, bending the stem on the impulse i.-

line root valve,,.thus,preventing isolation of the I

leak,'and damaging the insulation on the bottom P and side of the pressurizer.

e When the RCP seal failed, it allowed primary e

coolant water to flow to the floor of the contain 1, ment building. The leakage persisted for -10 to n

12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> at a rate of-90 gpm, resulting in a total

-leakage of -50,000 gal. In order to reclaim the

'.--.

none zv uou USNRC Technical Training Center

'17-3 Rev U876

• 17-3 USNRC Technical Training Center

ii ANO-1 Seal Failure water rather than process it as waste, they allowed it to flow to the containment floor where it reached a maximum depth of-12 inches. Equip ment was to be examined for possible damage prior to plant startup.

Radioactivity in the water was 7 x 10-3 mCi/ml gross beta and 5 x 10-3 mCi/ml gross gamma.

Reactor water level was maintained with one of the available makeup pumps, each of which has a capacity of 300 gpm; and no difficulty was en countered with the plant cooldown.

17.6 PRA Insights The failure of reactor coolant pumps seals is one of the leading contributors to core melt frequencies at ANOL. According to their PRA, the contribution to core melt frequency from this initiator is 4.4 E-6/Rx-yr.

RCP Seal Failure Seauence This sequence is initiated by a reactor coolant pump seal rupture or a rupture in the RCS in the break range of 0.38 inches in diameter to a break diameter of 1.2 inches, followed by failure of the high pressure injection system.

Containment failure is predicted by one of the following: (a) containment overpressure due to hydrogen burn ing, (b) penetration leakage, or (c) base mat melt through.

This sequence assumes a small LOCA occurs followed by a failure of the high pressure injection system (HPI). Containment systems would oper ate as designed to control the atmosphere, but failure of the core cooling system would lead to boil off of the water covering the core.

The dominant failure mode of the HPI is predicted to be failure of the operator to initiate the system. Information received from Babcock and Wilcox indicates an engineered safeguards HPI actuation signal due to low RCS pressure may not be generated following some LOCAs < 1.2 inches in diameter. This sequence assumes an ESFAS signal will not be generated prior to core uncovery, and the the operator must initiate the system.

An important insight realized from the analy sis of this sequence is that a possibility exists for failing one of the three HPI pumps, given a LOCA of 1.2 inches in diameter. During normal opera tion, one of the pumps is operating and takes a suction from the makeup tank to perform -the function of makeup and purification. (This same pump is realigned to take suction from the BWST upon an ESFAS signal to perform ECCS func tions.) Upon a small LOCA, the pressurizer level and pressure would begin to decrease, and auto matic control actions will cause the makeup flow control valve to go fully open and the pressurizer heaters to turn on. Calculations indicate that the pressurizer heaters will remain covered for an extended period and thus maintain RCS pressure well above the ESFAS actuation setpoint. The calculations also indicate that the makeup tank would empty prior to uncovering the pressurizer heaters. The makeup tank is estimated to empty within approximately 14 minutes after LOCA initiation or about 10 minutes after the low makeup tank alarm. Upon dryout of the makeup tank, it is assessed that the operating HPI pump will fail in a short time.

USNRC Technical Training Center 17-4 Rev 0896 Rev 0896 I

B&W Crosstraininz Course Manual ANO-I Seal Failure USNRC Technical Training Center 17-4

Rtrw Crrnstriininq Coiurse Manual AO1Sa alr APPENDIX - Sequence ofEvents ANO-1 RCP Seal Failure - May 10, 1980 Initial Conditions The unit was operating at 86% with all parameters in their normal range. An inventory balance of the RCS was in progress.

Time Event 0145 The reactor operator observes a step decrease in makeup tank level.

(0)

RCP "C" Seal Failure diagnosed. RCS Leakage 20 gpm.

Power reduction at 5%/min. initiated.'

0214 Unit loads transferred to offsite power.

(+29 min) 0220 Letdown igolated.

(+35 min) 0225 Extra operations staff called in to aid in placing the unit Cold Shutdown.

(+40 min) 0227 NRC Emergency Response Center and resident inspector notified.

(+42 min)

Increase in leak rate observed. Increased reduction rate to 20%-30%/min.

0247 Generator off line.

(+62 min) 0248 RCP "C" stopped. RCS leakage increases to -250-300 gpm.

(+63 min) 0250 Reactor manually tripped from 10% power. Manually started 2 additional

(+65 min) makeup pumps. Opened all HPI MOVs. Cycled "C" RCP lift pumps four times. After 4th start of lift pumps, RCS leakage decreases. Started RCS cooldown 0254

(+69 min)

Isolated RCP "C" seal return. Increased seal injection flow to quench steam from failed seal. RB pressure increases from atmospheric pressure to 15.2 0256 psia.

(+71 min)

Placed RB emergency coolers in service.

1-uorld*n USNRC Technical Training Center 17-5

- i.

u*.,

• .v*.........i.I*v "ANO-I Seal Failure ney UaOY

B&W Crosstrainins Course Manual ANO-1 Seal Failure APPENDIX - Sequence of Events (continued)

Event Stopped RCP "A".

Stopped "C" makeup pump, closed all HPI MOVs, established normal makeup with 2 makeup pumps with suction supply from BWST.

"B" OTSG Steamline Break Isolation and Control (SLBIC) actuation at 600 psig due to high RCS cooldown.

Steam driven EFW pump starts.

Raised header pressure to >600 psig.

Bypass SLBIC.

Steam pressure>650 psig, SLBIC automatically resets.

SLBIC actuated on low pressure (<600 psig)

Raised header pressure to >600 psig.

SLBIC successfully bypassed.

Steam driven EFW pump stopped. Aux. Feedwater pump placed in service.

Containment entry to power up and close CFT outlet valves.

CFTs inject some water prior to isolation.

Unit in cold shutdown USNRC Technical Training Center 17-6

- Rev 0896 Time 0301

(+76 min) 0305

(+80 min) 0320

(+95 min) 0800

(+375 min) 0900

(+435 min) 17-6 B&W Crosstrainine Course Manual ANO-I Seal Failure

-Rev 0896 USNRC Technical Training Center

BABCOCK AND WILCOX CROSS TRAINING MANUAL CHAPTER 18 Three Mile Island

TABLE OF CONTENTS 18.0 THREE MILE ISLAND 18.1 Introduction (Figure 18-1)...............................................

18-1 18.2 Loss of Feedwater - March 28, 1979 18-2 18.2.1 4:00 AM (Figure 18-2).............................................

18-2 18.2.2 4:08 AM (Figure 18-3) 18-4 18.2.3 5:00 AM (Figure 18-4).............................................

18-6 18.2.4 6:00 AM - 8:00 PM (Fig. 18-5) 18-8 18.2.5 8:00 PM (Figure 18-6) 18-12 18.3 M ajor Issues.......................................................

18-13 18.3.1 Natural Circulation...............................................

18-13 18.3.2 Reactor Coolant Pump Operation....................................

18-15 18.3.3 Hydrogen Generation 18-16 18.3.4 Radiation Release Paths (Figure 18-7)................................

18-17 18.4 A nalysis...........................................................

18-21 18.5 References.........................................................

18-22 Appendix - Sequence of Events.................................................

18-22 LIST OF FIGURES 18-1 Three Mile Island 18-2 T= 0 Minutes 18-3 T = 8 Minutes 18-4 T=IHour 18-5 T=2Hours 18-6 T=16Hours 18-7 TMI Radiation Release Path USNRC Technical Training Center 18-i Rev 0896 I

USNRC Technical Training Center B&W Crosstrainine Course Manual Three Mile kland 18-i Rev 0896

nk~eW d

.. #-*.;~nit Cnympc MamnuuaI Three Mile Island 18.0 THREE MILE ISLAND Learning Objectives:.

1-Explain how a loss of feedwater resulted in a reactor trip and subsequent LOCA.

2. Describe -.the major radiation release paths which occurred at TMI-2.

3. -Describe the decay heat removal methods used S at TMI-2 during the transient.

., 4. Explain Which parameters are used and how they indicate decay heat removal by natural circulation (or loss of natural circulation).

-5. List the operational conditions which enhance natural circulation.

Include which systems

-may. be operated different from normal conditions.

6. List the sources of hydrogen and oxygen within the primary system and contain "ment.

7. Determine which RCS parameters can be used as, possible indications of boiling (steam formation) within the system.

• ,18.1 Introduction (Figure 18-1)

The accident at TMI-2 began March 2, 1979 al 4 o'clock in the morning. The initiating event was a loss of feedwater to the steam generators. The S'resulting degradation ofheat transfer,from the

-primary system caused an increase in pressure anc shutdown of the reactor. The pilot operated reliel

- valve (PORV) on the pressurizer opened at thi setpoint of 2255 psig in response to the increase ir primary system pressure: -. The.coolant leakagt through the open PORV continued until about 14(

min later when a block valve was closed. Th(

coolant leakage rate during most of this perioc USNRC Technical Training Center was about 2800 lb/min while the net makeup rate from ECC injection,was an order of magnitude less. The system pressure fell below 1300 psig at J15 min and remained at approximately. 1100 psig until 101 min., when the last two primary coolant pumps were shut down in response to indications of pump cavitation. The first sign of core un covery began at-about.110 min. -when thermo couples in the hotlegs indicated the steam boiling "out of the core was,superheated..Thesystem pressure decreased'to a minimum of about 650 psia at about the time the coolant leakage was stopped at 140 min. Also,, during -this period

>between 110 and 140 min., thermocouples above the core and the self powered neutron detectors (SPND) began to indicate temperatures in the 1000'F range, source range-, core power level monitors began to read high in response to in creased neutron flux from the uncovering core, and high radiation levels were observed in coolant

-samples and in the containment building as the result of fission product release from the over heated core.

When the coolant leakage was stopped at about 140 min, the system pressure began to increase. At about the time reactor coolant pump "2B" was temporarily turned on at 174 min, the system pressure increased rapidly to over 2000

• psi. ECC injection was significantly increased at

• about 200 min. (March calculations indicate the core remained covered after 3.5 hrs.) Over the next 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br />, the primary system pressure varied between about 2200 and 550 psi in response to

-changes in the ECC injection rate and the opening and closing of the block valve in the line of the I

stuck relief valve. Containmentbuildingtempera F

tures and pressure generally responded as ex e pected to whether the relief valve line was open or I-closed. -. At about 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />, the containment e pressure briefly increased by 28 psi, indicating a containment hydrogen burn. During most of the first 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> of the accident, the pressurizer water I

-level indicated a full pressurizer. Under normal 1RI Rev 0896

B&W Crosstraining Course Manual conditions, this would be an indication that the primary system was water-filled.

18.2 Loss of Feedwater - March 28, 1979 18.2.1 4:00 AM (Figure 18-2)

At 4:00 a.m. on March 28, 1979, TMI-2 was operating between 97% and 98% full power. The shift foreman and two auxiliary operators had been working in the auxilia'ry building on the No.

7 condensate polisher. Two licensed control room operators were on duty in the control room: The shift superintendent was in his office adjacent to the control room.

The condensate polishers use ion exchange resins for purification of the feedwater (Figure 18 1). During operation, flow through the resin bed tends to compact the material into a rather solid mass. To transfer the resin beads to the resin regeneration system, it is necessary to break up this mass by blowing compressed air through it.

(Apparently, during this process water entered an instrument air line through a check valve that had frozen in the open position.)

It has been postulated that the water in the air piping caused the polisher inlet oroutlet valves, or both, to close. Closure of either the inlet or outlet valves would interrupt the flow of feedwater and cause the condensate pumps and condensate booster pumps to trip, that is, to be automatically shut down.

Tripping of these pumps causes triffing of the main feedwater pumps, which in turn, causes tripping of the main turbine and electrical generator.

The three emergency feedwater (EFW) pumps (two ielectric-driven and one steam-driven) started automatically within 1 second after the main feedwater pumps tripped. Water from the EFW pumps is not normally delivered to the steam generators immediately after the main pumps Three Mile Island cease to operate. The automatic valves will not open until two conditions have been met: (a) the emergency pumps are delivering their normal discharge pressure (at least 875 psig) and (b) the water level in the steam generators is 30 inches or less.

In addition to the automatic valves, there are block valves in the lines to the steam generators.

These valves are required to be open while the plant is operating. At the time of the accident, however, the block valves were closed.

The closed indication of these valves, which was shown on an indicator light in the control room, was not noticed by the operators.

On loss of feedwater followed by turbine trip, the energy removed from the steam generators was less than the energy added by the reactor, and the pressure in the reactor coolant system (RCS)

,increased. The pressure increase began immedi ately.

To protect the RCS from excessive pressure, a pilot-operated relief valve (PORV) and two safety valves are provided. Three seconds after turbine trip, the pressure in the RCS had increased to the point (2255 psig) at which the PORV opened. The reactor was still delivering power, and pressure continued to rise, although not as rapidly. Eight seconds after the turbine trip, the pressure had reached the point (2355 psig) at which the reactor is automatically shut down.

Before the accident, leakage was higher than usual, because a code safety valve, or possibly the PORV, was leaking. Leakage from the PORV went to the reactor coolant drain tank (RCDT) where it was condensed and was then pumped to the reactor coolant bleed tanks. The buildup of water in the bleed tanks was then being trans ferred periodically to the makeup tank.

USNRC Technical Training Center I 8-2 Rev 0896 I

USNRC Technical Training Center 18-2 Rev 0896

flA-W Crosstrainin~ Course ManualTreMieIan o Ifnot compensated for, the expected shrinkage of reactor coolant on cooldown could cause an excessive change of volume. To reduce the rate

,of volume change, therefore, letdown is stopped "and makeup is increased.

Ah indicator light in the control room shows

-when the PORV has been ordered to close - that is, when power to the valve opening solenoid is cut off - but does not show when the valve actu

" ally closes.. It is now known that the valve did "not,' if fact, close as it was designed to do. The

',-operators; however, had no direct means of know ing this.-By 28 seconds after turbine trip, the two conditions for 'admission of emergency feedwater to the steam generators had been met, and the "automatic valves should have begun to open.

Because the block valves were closed, of course, no water could be admitted to the steam genera

, tors even with the automatic valves open.

It

" appeared to the operator that the automatic valves

'were opening -at an unusually slow rate, and the slow opening of these valves was initially attrib "uted to the delay in feeding the steam generators.

-A second operator now noticed that the second makeup pump had not started, and successfully started pump "lB." He also opened the makeup "throttling valve to increase the amount of makeup flow. (This increased flow, along with reduced Unfortunately,, the meter showing this temperature "is in back of the main control panels and cannot be seen from the normal operating position.

Two minutes after, turbine trip, the RCS

-,pressure had dropped to 1600 psig. At this pres sure, the engineered safeguards (ES) automatically actuate. The ES system is designed so that when the RCS pressure drops -to this level; makeup

• pumps "JA" and "IC" will start (if not already

- operating) makeup pump."IB" will trip (if run ning), and the makeup valves will open to admit the full output of the pumps into the RCS.

If the PORV had not been opened, it could not be expected that increased flow of makeup water into the system would accelerate the rate of the rise of the pressurizer level and cause the RCS pressure to-begin to climb again. Uncontrolled filling, of the pressurizer might cause it to fill.

-. completely (pressurizer "solid"). Control of RCS

• pressure is lost with a solid pressurizer, and a very small temperature increase in the totally filled system could cause the pressure to rise to the point

,where the safety.valves would open. The safety

-valves might have to be repaired, because it is not "unusual for safety valves to leak after being lifted.

Operators are trained to avoid this situation.

Operating procedures require them to switch to manual control and reduce makeup as soon as the letdown, apparently overcame the coolant con-.: pressurizer regains a normal level._,

"* traction.)

The operator bypassed the ES system and re Meanwhile, the condenser hotwell was

- duced the makeup flow, but the pressurizer level "undergoing some expected level fluctuations, first '- continued to increase rapidly. Pressure.,did not dropping to 21.7, inches, then rising to normal.-

rise.and even began to move slightly downward.

Unknown to the operators, however, an air line to The reason for the anomaly of rising pressurizer the hotwell level controller. was broken, appar-level and decreasing pressure was not recognized ently -by a "water hammer"- during the initial by the operators. Trained to avoid a solid pres transient. The operators were unable to regain surizer, they stopped makeup pump "IC" and control of hotwell level, increased letdown flow to its high limit, thereby

-, temporarily arresting the rate of pressurizer level Very shortly thereafter, the temperature of the - increase.

water in the RCDT. had significantly increased.

USNRC Technical Training Center 18-3

- Rev 0896

,, I Three Mile Island

B&W Crosstrainina Course Manual Three Mile Island If the pressure dropped low enough for boiling to occur, control of the pressurizer level would have become more difficult. The open PORV would reduce the pressure in the pressurizer steam space. Steam forming elsewhere in the system would force more water through the surge line, raising the pressurizer level. If the RCS pressure rose so that the water was no longer saturated, the steam bubbles in other parts of the system would be condensed, and the pressurizer level would fall.

In other words, the pressurizer level would be controlled by steam formation, as well as by the makeup and letdown system. At the same time, it would have been difficult to regain a bubble by using the heaters. The rate of energy loss through the PORV at the system pressure was many times greater than the energy added by the heaters.

The relief valve on the RCDT was opening intermittently after approximately 3-1/2 minutes.

Operation of this valve allowed the tank to over flow into the reactor building sump-Operation of the relief valve was not noticed by the operators.

RCDT parameters are displayed on a panel lo cated out of the operator's view. The level in the reactor building sump eventually got high enough to cause a sump pump to be automatically turned on.

The reactor building sump is normally pumped to the miscellaneous waste holdup tank.

It appears that at the time of the accident, however, the reactor building sump pump was actually lined up to pump into the auxiliary building sump tank - which was already nearly full and had a broken rupture disk. Overflow of the auxiliary building sump tank would cause overflow to go to the auxiliary building sump.

18.2.2 4:08 AM (Figure 18-3)

At 8 minutes after turbine trip, the operator discovered that the emergency feedwater block valves were closed and opened them. Opening these valves caused a rapid increase in steam pressure, which had previously dropped when the steam generators boiled dry, and a drop in RCS temperature. The reason for the 14 minute lag in recovery of the steam generator level is that emergency feedwater is sprayed directly onto the hot tubes and evaporates immediately. Evapora tion raises steam pressure, but no water collects in the bottom until the tubes are cooled down.

At the beginning of the accident, the computer alarm printout was synchronized with real time.

The alarm printer can only type one line every 4 seconds, however, and during the accident; several alarms per second were occurring. Within a few minutes; the computer was far behind real time, and the alarms being printed were for events that had occurred several minutes earlier.

About 25 minutes after turbine trip, the opera tors received a computer printout of the PORV outlet temperatures.

(The high temperature 285'F - was. not perceived by the operators as evidence that the PORV was still open. When the PORV opened in the initial transient, the outlet pipe temperature would have increased even if the PORV had closed as designed. The operators supposed that the abnormally slow cooling of the outlet pipe was caused by the known leak in the relief or safety valves. Actually, sufficient evi dence of the failure of the PORV to reclose was now available: the rapid rise in RCDT pressure and temperature, the fact that the rupture disk had blown, the rise in reactor building sump level (with operation of the sump pumps), and the continuing high PORV outlet temperature. The PORV outlet temperature was read again at 27 minutes after turbine trip. The evidence of an open valve, however, was not interpreted as such by the operators.

An auxiliary operator noticed that the reactor building sump pumps were on and that the meter showing the depth of water in the reactor building USNRC Technical Training Center 18-4 Rev 0896 Rev 0896 I

B&W Crosstraining Course Manual Three Mile Island USNRC Technical Training Center 18-4

B&W Crosstraininp Course ManualTheMiesan sump was at its :high limit (6 feet). The back ground 'radiation in the auxiliary building had

- increased.- '(Although it was believed that the u-reactor bfiilding'sump pumps were discharging to

'the miscellaneous waste holdup tank, the level in',

"the holdup tank had not changed. On the orders of the control room operator, with the shift supervi-'

sor's concurrence, the operator shut off the sump pumps.)

The reasons for the problems with the reactor coolant pumps were that steam bubble voids had formed throughout the system when the pressure was below the saturation pressure.-.'The system pressure at the coolant pump inlets is required to

.be rsignificantly -above the saturation pressure.!,

'This requirement is called the net p6sitive suction:

head (NPSH) requirement. *If the NPSH require-.

"ment is not met; vapor bubbles willform in the

-lowest pressure regions on the suction side of the pumps. The formation of vapor bubbles, called cavitation, could cause severe pump vibration, which in turn could damage the seals and might "even damage. the attached piping.

Operators' ignored the NPSH requirement and left the reactor coolant pumps operating as long as possible. Had they not done this, more severe core damage could

'"have occurred. As long as the pumps provided circulation,- even of froth, 'the core was being cooled. As soon as all the pumps were stopped,

_circulation'of coolant decreased drastically,' be

"`*cause natural circuilation was blocked by steam.

'Somne circulation can beimaintained by refluxing.

In this type of flow, the water boils in the reactor vessel, and the steam flows through the hot legs, "is condensed in the steam generators, and flows (as liquid water) back to the reactor vessel. For refluxing' to. occur, -a.-spray 'of emergency, feedwater muist be hitting the tubes,' or the water

- level on the' secondary - side,'of the steam generators must be higher than the water level on the primary side and the temperature significantly cooler. The level in'steam generator A was low (about 30 inches). -The steampressure, hence the USNRC Technical Training Center C- -1 temperature, on the secondary side was not much lower'than that on the primary side. -.Reflux

-circulation, therefore, would probably not have been effective. Effective cooling might have been maintained if the steam generators had been filled to a high level and if the steam pressure had been kept significantly lower than the RCS pressure.

The voids in the system also caused the neu tron detectors outside the core to read higher than expected. Normally,, water sin" the downcomer annulus, outside the core but inside the reactor vessel, shields the detectors. Because this water was now frothy, however, it was not shielding the detectors as well as usual. Not.realizing that the

-apparent increase in neutrons reaching the detec tors was caused by these voids, operators feared the possibility of a reactor restart. Although it can now be seen that their fears were unfounded, at the time they were one more source of distraction.

The emergency diesel -generators' had 'been running unloaded ever since ES actuation. These diesels cannot be run *unloaded for long without

.damage.

They cannot be shut down from.the control room, but must be locally tripped.* Once the diesels are stopped, the fuel-racks must be reset so the diesels can be automatically restarted.

'At 30 minutes after the turbine trip, the operator sent a man to the diesels to shut them down. The fuel racks,, however, were not reset. -Failure to reset these racks could,have 'had serious conse quences if offsite power had been subsequently lost,'because radioactivity restricted access to the diesels.

-4

Voiding' throughout -the,system-and the

.deteriorating performance of the reactor coolant

.,-pumps decreased the efficiency ofthe heat transfer

'through the steam generators. The rate of boiling was lower than usual, and operators found it difficult to keep the water level from creeping up.

The condensers must be maintained at a vacuum

,'to operate efficiently, however, and condenser 8-5 Rev.0896 I Three Mile Island

B&W rossraiin~

oure MaualThir-Mfl1a Teland vacuum was gradually being lost. If condenser vacuum were to drop below acceptable levels, the condensate system would be automatically tripped and an uncontrolled dump of secondary steam to the atmosphere would occur. To prevent loss of vacuum, operators deliberately shut down the condensate system 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the turbine trip and sought to maintain control over steam pressure by controlling the atmospheric steam dump.

18.2.3 5:00 AM (Figure 18-4)

At the end of the first hour, the situation with which the operators were confronted had severely deteriorated: pressurizer level was high and was only barely being held down, the reactor coolant pumps were still operating but with decreasing efficiency, the condensate system was no longer operable, the reactor building pressure and tem perature were slowly increasing, the alarm com puter lagged so badly that it was virtually useless, and radiation alarms were beginning to come on.

At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 11 minutes,, operators initiated reactor building cooling. Their action soon halted, and eventually reversed, the rise in reactor building temperature and pressure. The increasing temperature and pressure should have been a good indication that a small-break LOCA was in prog ress. In fact, if the air cooling had not been initi ated, the reactor building would probably have been isolated (sealed off) shortly after this time.

The operation of the reactor coolant pumps was seriously impaired. High vibration, low flow, low amperage, and inability to meet NPSH requirements led the operators to start shutting down pumps. At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 13 minutes, reactor coolant pump "1 B" was stopped, and pump "213" wvas stopped a few seconds later (pressurizer spray comes from the A loop).

Shutting down two pumps reduced the flow of coolant through the reactor core. Apparently, there was still enough, mass flow in the steam/water mixture to provide cooling, but not as much cooling as that provided when a large vol ume of void-free water was circulating.. There is no firm evidence of overheating at this time. The open valve was reducing the inventory of water in the RCS, though, and the pressure was getting lower. Water continued to boil to remove decay heat; this boiling increased the amount of steam in the system and further impeded circulation.

A few minutes later, analysis of a sample of reactor coolant indicated a low boron concentra tion. This finding, coupled with that of apparently increasing neutron levels, increased operators' fears of a reactor restart. As explained earlier, the supposed increase in neutron levels was spurious, appearing on the detector only because bubbles in the downcomer:were allowing more neutrons to reach it. It is believed that condensed steam diluted the sample.

At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, 20 minutes, an operator had the computer print out the PORV (283*F) and pressurizer safety valve outlet temperatures (21 iF and 219'F).

Since there had been essentially, no change in temperature in 55 minutes, the operators should have realized that the PORV valve had not closed. Additionally, the letdown line radiation monitor began to increase.

It increased steadily to the full-scale reading.,The letdown monitor was notoriously sensitive, so that even minor changes in radioactivity would cause great variations in the reading.

The low steam pressure in steam generator "B" and the increase in reactor building pressure were believed to be caused by a leak from the steam generator., At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 27 minutes, steam generator "B" was isolated (taken out of service).

With hindsight, it can be seen that the low pressure was simply caused by steam bubbles and a reduction of heat transfer in the "B" loop follow ing stoppage of the pumps.

USNRC Technical Training Center 18-6 Rev 0896 Rev 0896 B&W Crosstrainini! Course Manual Throo M;I* lcl*nd USNRC Technical Training Center 18-6

B&W Crosstraining Course Manual The temperature of the RCS -coolant in all primary system piping had been slowly increasing.

Eventually, the primary side of steam generator A got hot enough so that more steam was produced on the secondary'side, and the steam pressure beganto rise. The increased steamproductionhad

-two side effects: '(1) the water level on the sec ondary side dropped and the steam generator boiled dry for the second time, and (2) the in creased heat removal brought the RCS tempera ture down again.

I The efficiency of the reactor coolant pumps was still decreasing, and at 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 40 minutes; the frothy mixture became too` light to circulate.

-Separation of the froth would have sent the steam to the high parts of the system, while water col lected in the low parts. An analogy is a kitchen blender with the bowl half full of water. With the

-blender at high speed, enough air bubbles are whipped into'the water so that the b6wl is full. If the speed drops, the air bubbles are lost and the lower half of the bowl is solidly filled with liquid water. This was reflected in the behavior of the neutron instrumentation. Apparently -the down comer, which had been previously filled with froth, now filled with water.

The increased

,shielding stopped neutrons from reaching the

-detector and the apparent neutron level dropped by a factor of 30.

Operators recognized that steam generator "A" was dry, and in an attempt to regain water level, they increased feedwater flow.

At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 41 minutes, both remaining reactor coolant pumps were stopped because of increasing vibration and erratic flow. The only heat transfer through the steam generators was now achieved by reflux flow. This was inadequate,for core cooling. It is 'now believed that the core was drying out. The operators were hoping to estab lish natural circulation in the primary system.

Natural circulation was blocked by steam; and USNRC Technical Training Center Three Mile Island

- refluxingj ivbuld be *ineffective because the secondary temperature was nearly as high as the primary temperature.

The pressurizer is at a higher level than the

• reactor. It was assumed that the presence of water in the pressurizer meant that the core must be cov ered. Actually, because the PORV was open, pressure in the upper part of the pressurizer was reduced. The strong boiling that was occurring in the core, however, caused more steam to go into the upper part of the reactor vessel, and the pres sure there was increased., The difference of pres sure forced the water level higher, in,the pressurizer than in the reactor vessel.

Previous reports have alluded to a "loop seal,"

thus giving the false impression that the piping configuration alone somehow created this differ ence of level.' Even with the loop configuration, to maintain a higher level in the pressurizer when the water in the pressurizer is saturated, a higher pressure is required in the reactor than in the pressurizer. Ifthe pressures are equalized with the hot leg voided, the saturated pressurizer water level would drop to the level of the connection of the pressurizer surge line into the hot leg.

Subcooled water could be maintained at a higher

• level. During most of the accident, the water in the pressurizer was slightly subcooled or saturat ed. During the time that the surge line was uncov ered, the water in the pressurizer was subcooled.

It was the combination of loop seal and tempera

". ture that kept the level high, rather than the loop

--seal alone.

At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 42 minutes, the decreasing level in "the reactor vessel again reduced the shielding of the neutron instrumentation, and the apparent neu tron count increased by about a -factor of 100.

Emergency boration was commenced to avert a

--restart.

18-ie a'

-R*ev o~

18-7

ii Three Mile Island The hot-leg temperature now became decid edly higher than the cold-leg temperature. Super heated steam was present in the hot leg. The superheating of the hot leg showed that a fair amount of the core was uncovered. It is impossi ble to superheat the hot leg without uncovering the core.

Although none of the instrumentation directly indicates to the operators that the saturation temperature has been reached or exceeded, a copy of tables that show saturation temperatures as a function of pressure (the "steam tables") was available to them.

Up to this time, it might have been possible to salvage the situation without extensive core dam age. If the PORV had been closed and full make up flow had been instituted, it might have been possible to fill the system enough so that a reactor coolant pump could be restarted. As the uncover ing of the core became more extensive, the oppor tunity to reverse the tide dwindled.

The upper part of the core was now uncov ered. The steam rising past the fuel rods gave some cooling, but not nearly as much as when they were covered with water. The decay heat about 26 MW - was higher than the heat removed, so the fuel temperature increased.

The fuel rods are clad with Zircaloy, an alloy of zirconium.

Zirconium reacts with water to form zirconium dioxide and hydrogen.

At operating temperatures, this reaction is extremely slow and does not represent a problem. At higher temperatures, however, the reaction goes faster.

It is believed that the temperature of the fuel rods reached a point at with the reaction occurred rapidly, producing significant amounts of hydro "gen. Furthermore, the reaction itself releases heat.

Heat released from the reaction would have caus ed the cladding to become hotter, driving the reaction faster.

As long as the upper part of the system con tained only steam, the bubble could be condensed (collapsed) by increasing the pressure or decreas ing the temperature.

However, with large amounts of hydrogen in the system, these mea sures would, reduce the size of the bubble but could never collapse it. The accident could not now have been reversed by simply closing the PORV and increasing makeup.

18.2.4 6:00 AM - 8:00 PM (Fig. 18-5)

At 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> into the accident, the pressure in loop A was 735 psig. The loop A hot-leg temper ature was actually 558'F - definitely superheated.

The narrow, range, hot-leg temperatures went offscale high, and cold-leg temperatures went offscale low.

The wide range temperature measurements were still available, although the narrow range temperatures can be read more accurately and the operators are in the habit of using them exclu sively. One meter shows average temperature, which is actually an average of the narrow range indications. Average temperature shown at this time was 570'F, the average of the constant readings of 520'F and 620'F (lower to upper limits). (This steady average temperature evi dently convinced the operators that the situation was static). The operators now knew that there was a problem. Natural circulation had not been established, and they had been forced to turn off the last RCP. At 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 15 minutes, the reactor building air sample particulate radiation monitor went off scale. This was the first of many radia tion alarms that could definitely be attributed to gross fuel damage.

A shift supervisor who had just come into the control room isolated the PORV valve by closing the block valve in the same line. Apparently, he did this to see whether it would have an effect on the anomaly of high pressurizer level and low USNRC Technical Training Center 18-8 Rev 0896 Rev 0896

-1 B&W Crosstraining Course Manual Three Mile Island USNRC Technical Training Center 18-8

I

n. I IDAu d

n uurpi-Mainual-he Ml Il steam pressure. The reactor building temperature and pressure immediately began to decrease and the pressure of the RCS increased. The shift supervisor who had closed the block valve imme

,diately recognized that a leak had been stemmed.

'Leakage through the PORV had now been stopped, but there was still no way to get rid of the decay heat, because 'there was virtually no "circulation through the steam generators. The

• once-through steam generator ("A" OTSG) had' 50% cold water, which would have been iadequate if there had been circulation. The situation was in some ways worse than it was before the valve was closed.

Duliring this period of probable core damage, there was virtually no informatioh on conditions in the core. Incore thermocouples (temperature measuring devices), Which measure reactor cool ant temperature at:the exit from the core,' could mneasure only up"to 7007F. This limit is imposed by the signal conditioning and data logging equip-,

ment, not by the instruments themselves.

Many radiation monitors began to go offscale' high. This is an ifidication of severe core damage..

'The intense boiling could have caused shattering

'of much of this material, and the loss of cladding integrity, coupled with the high temperatures,

• could have allowed the moire volatile radioactive substances in the fuel to escape into the reactor

'coolant.

The problems with the condenser hotwell level,-

a slug of water was forced into the downcomer by "the momentary' running of pump "2B."

The boiling caused a rapid pressure rise and probably did considerable damage to the brittle oxidized cladding.

As a result of receiving several high radiation alarms within the plant,' a site 'emergency was declared and the local authorities notified. The letdown' sample lines had now been reported to "have an extremely high radiation level (600 r/hr),

"and the auxiliarybuilding was evacuated. An

',attempt was being made to obtain another reactor coolant sample..

By 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after the tuirbine trip, the situation appears in hindsight to have become quite grave.

It should have been obvious that there was no circulation of reactor coolant. - The -abortive attempts to start reactor coolant-pumps and the attempts to secure natural circulation by a high water level in the steam generator indicate that this was,suspected at the time..Most incore thermocouples were reading off scale. The hot

-leg temperatures' were nearly 800'F. - This superheating of the hot leg indicates both that the hot leg had virtually no liquid water in it and that at least the upper part of the core was dry., The many high radiation alarms indicate that extensive fuel damage had occurred.

-At 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />,-the condenser vacuum pump exhaust radiation monitor was showing increased radiation levels. A leak in steam generator B had been previously suspected, and the increased level control were finally solved at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 50 minutes.-,', of radiation seemed to confirm this. At 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> 4 The broken air, line-to thereject valve was re paired, the valve now operated properly, and the Scondensate hotwell was pumped down to its, normal level.

The 'attempted starts of the reactor. coolant pump :had not established circulation in the reactor coolant system. It appears,' however, that!

USNRC Technical Training Center

" 18-,

minutes, the turbine bypass valves from steam generator "B" and the auxiliary feedwater valves to this generator were closed. This completely isolated the steam generator from the condensate system.,

At 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> 12 minutes, the PORV block valve was opened in an attempt to control RCS pressure.

9

1.

Rev 0896 I,

Three Mile Island

B&W Crosstraining Course Manual "The opening of the valve caused a pressure spike in the RCDT, an increase in reactor building pressure, and an increase in the valve outlet tem perature.

At 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> 20 minutes, the ES were manually initiated by the operator. This was quickly fol lowed by a drop in pressurizer level. The reason for actuation of the ES was the rapidly dropping RCS pressure. Makeup pump "IC" started and the makeup valves opened fully.

RCS temperature dropped rapidly as the cold water flooded in.

It is, believed that the sudden admission of cold water to the extremely hot core probably caused additional major damage to the core because of thermal shock.

The external neutron indicators dropped suddenly, indicating a rapid, change of level in the downcomer. The water added should have ensured that the coolant level was above the core height.

Almost immediately, many radiation monitors registered alarms. The control building, except for the control room itself, was evacuated. These radiation alarms are a good indication that severe core damage occurred. Apparently, the brittle oxidized cladding was shattered by the sudden admission of cold water, so that the fuel pellets were no longer held in their original position.

This sudden rearrangement of the core may have permitted the volatile fission products to enter the coolant; these could later have streamed out of the open PORV into the reactor building.

At 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> 24 minutes, a general emergency was declared on the basis of the many radiation alarms.

The borated water storage tank (BWST) low level alarm was received at 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> 30 minutes.

There were still 53 feet of water in the BWST.

That the level was falling, however, caused con cem. Additional ES actuations could cause all the

-water in the BWST to be used up, and the highly Three Mile Island radioactive water in the reactor building sump would have to be used for high pressure injection.

The HPI pumping system would became radioac tive, which could cause grave problems if repairs became necessary. There was thus an inclination to use ES as little as possible (high pressure injection water is taken from the BWST). ES was reset and makeup pump " 1 C" was stopped. At the same time, the PORV block valve was shut.

Closing this valve, with makeup pump "1 A" still

.running, caused a~rapid increase in pressurizer level.

About 4 to 4-1/2 hours into the accident, incore thermocouple temperature readings were taken off the computer; many registered question marks. Shortly after, at the request of the station superintendent, an instrumentation control engi neer had several foremen and instrument techni cians go to a room below the control room and take readings with a millivoltmeter on the wires from the thermocouples. The first few readings ranged from about 200'F to 2300'F. These were the only readings reported by the instrumentation control engineer to the station superintendent.

Both have testified that they discounted or did not believe the accuracy of the high readings because they firmly believe the low readings to be inaccu rate. In the meantime, the technicians read the rest of the thermocouples - a number of which were above 2000'F -and entered these readings in a computer book which was later placed on a con trol room console. The technicians then left the area when nonessential personnel were evacuated.

Both makeup pumps ("IA" and "IC") were stopped at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 18 minutes. Two unsuccessful attempts were made to restart pump IA. The control switch was then put in the "pull-to-lock" position. This completely defeated automatic starts of the pump. The pressurizer indicated full, and the operators were concerned about full high pressure injection flow coming on with an appar ently "solid" system.

USNRC Technical Training Center I

18-10 Rev 0896

'Three Mile Island "EMX rV SStfl n~U anhI..

,s a

Actually, a very large part of the RCS was filled with steam and gas, and the system was far from being solid. This condition could have been "recognized Tfrom the fact that the RCS hot legs were superheated.

Problems -in.the condensate system were continuing. The condensers had been steadily losing vacuuni.' It was also necessary to maintain steam to the main turbine seals in order to operate the condenser at a vacuum. When main steam is not available, seal steam is provided by the oil fired auxiliary boiler, which is shared by both TMI tinits. -The auxiliary boiler broke down, so that seal steam could not be maintained, and it was necessary to shut down the condensate system, completely.,

Only a small amount of heat could be removed by the steam generator because the upper part of

'the RCS was filled by a steam-gas mixture. This drastically cut flow on the primary side. The

-water level on the secondary side was rising because more water was coming in as feedwater

'" than was leaving as steam. At 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 42 minutes,

'emergency feedwater pump was stopped.

The diesel engines that operate the emergency generators had been stopped at 30 minutes after the turbine trip..-These details'provide an 'emer gency electrical supply for the ES in the event of failure of the regular supply. During the past 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, the diesels had been incapable'of being rapidly started. If there had been an-interruption.

in 'the power, someone would -have had to go to

'the diesel generator area to start them. On the

'other hand, if the fuel racks were reset, the diesels would have restarted on every ES actuation. They' cannot be run for long periods when unloaded, and someone would have had to go to the diesel generator, area each time to reset them. Either way, someone would have had to pass through a high radiation area.

USNRC Technical Training Center Up to this time, the atmospheric steam dump valve was open. Sometime between 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 30 minutes and 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 15 minutes, the atmospheric dump valve was closed on orders to the control

',-room.from Metropolitan Edison management,

-because of concern that this might be the source of C_1 __

, Rev 0896 l*--li It was possible to reset the fuel racks at once, however, and then to leave the controls in position so that the diesels would not automatically start on ES actuation.

In the event, of a blackout, the diesels could have been immediately started from the control room, as soon as the operators realized that power was lost. Resetting the fuel racks was carried out at 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 29 minutes.

By 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 43 minutes, the RCS was full repressurized., The pressure was, maintained between 2000 and 2200 psig by operation of the PORV block valve.

It was supposed that the higher pressure might be able to collapse the bubble and allow natural circulation. In order to encourage natural circula tion, operators raised the water level' of steam generator "A" to 90% by using the condensate pump for feeding.

It became clear that even with a full steam generator and high pressure, natural circulation was not being established. The next plan was to depressurize sufficiently to inject water from the core flood tanks. When water is injected from the core flood tanks, expansion of,the nitrogen gas causes its pressure to drop until it balances the RCS pressure. If the RCS pressure drops slightly below 600 psig, only a small amount of water will be injected. An amount of water approaching the fuel volume of the tanks will be injected into the reactor vessel only when the RCS pressure is much lower than 600 psig. The operators did not realize this and incorrectly believed that the small amount of water injected was indicating that the core was covered.

I

B C

t inC eM uThrP MHiile iirii small radioactivity levels being measured outside the plant.

At 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 50 minutes, coincident with open ing of the PORV, there was a very sudden spike of pressure and temperature in the reactor building.

The building was isolated, and the ES actuated and building sprays came on. The setpoint for the building sprays to come on is 28 psig, so the pressure spike must have been at least that high.

The strip chart shows a peak pressure of 28 psig.

It is now known that the pressure spike was due to hydrogen combustion in the reactor build ing. The building sprays quickly brought the pressure and temperatures down. At 6 minutes after actuation, the sprays were shut off from the control room because there appeared to be no need for them.

Initially, the spike was dismissed as some type of instrument malfunction.

Shortly afterward, however, at least some supervisors concluded that for several independent instruments to have been affected in the same way, there must have been a pressure pulse. It was not until late Thursday night, however, that control, room personnel became generally aware of the pressure spike's meaning.

Its meaning became common knowledge among the management early Friday morning.

At 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> after the turbine trip, the auxiliary boiler was brought back into operation. Steam for the turbine seals was now available and it was possible to hold a vacuum on the condenser.

Two condenser vacuum pumps were started.

It was now expected that repressurization would collap3se the bubble in the hot legs, and natural circulation could be achieved through OTSG "A."

It was now believed that it, might be possible to-start a reactor coolant pump. There was some concern, however, as to whether a pump would operate. If there were voids in the system, sus tained running would possible damage the pump or blow out the seals. Therefore, the control room personnel decided to "bump" one of the pumps (run it for only a few seconds) and to observe current and flow while the pump was running.

The loss of two MCCS (at a time of explosion) meant that the ac oil lift pumps were out of service. It is not possible to start a reactor coolant pump unless the oil lift pump can be started. There is a standby dc oil lift pump, but it was necessary to send people to the auxiliary building to start it.

At 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> 33 minutes, operators started reactor coolant pump "1 A" by manually bypassing some of the inhibiting circuitry. The pump was run for 10 seconds, with normal amperage and flow. Dramatic results were seen immediately.

RCS pressure and temperature instantly dropped, but began to rise again as soon as the pump was stopped.

Evidently, there was an immediate transfer of heat to the steam generator when the coolant circulated. There was also a rapid spike in the steam pressure and a drop in steam generator level.

18.2.5 8:00 PM (Figure 18-6)

After analysis of the results of the short term run of the reactor coolant pump, conditions looked so hopeful that operators decided to start the pump and to let it run if all continued to go well. Rea sonably stable conditions had now, for the first time, been established. New problems were to arise later, but they were less serious than those that had been handled up to this time.

Apparently, no none at this time realized that a bubble still existed in the RCS. What appears to have happened is that the starting of the reactor coolant pumps swept the remaining gas in the USNRC Technical Training Center 18-12 Rev 0896 Rev 0896

-1 USNRC Technical Training Center B&W Crosstrainine Course Manual Thrpo Mllo lq:l*nd 18-12

DR.UJ



("nnrcp Mn.wi1 Three Mile Island fltX V

..I Va,...F.

upper part of the system around with the water as discrete bubbles. The gas bubbles would tend to collect in the most quiescent part of the system the upper head of the reactor vessel.

It is now,believed that the gas was largely hydrogen. Hydrogen is slightly soluble in water, and its solubility is greater at high pressure. An

-attempt to depressurize the system would cause some of the dissolved hydrogen to effervesce out of the water, thereby increasing the amount of hydrogen in,the bubble which would interfere with attempts to depressurize. As the pressure dropped, the bubble would grow in size and could interfere with circulation of the reactor coolant.

In addition to growing in size, the bubble and the dissolved gas would make it impossible to depressurize the RCScompletely. The pressure is Scontrolled by the size of the steam bubble in the upper part of the pressurizer. When this bubble contains only steam, spraying colder water'into

-the top of the pressurizer shrinks the bubble and reduces the pressure. When the bubble contains a

-gas like hydrogen, however,, spraying does not reduce the size of the bubble as much, so there is less contr6l over the pressure.

Another problem with reduced 'pressure occurred in the letdown system., As explained, gas comes out of solution when the pressure is reduced.-

The gas from the letdown water collected in the bleed,tanks and makeup tank, increasing the pressure and making it necessary to vent the tanks often. The gas vented off; though, was not pure hydrogen -there were small amounts of radioactive materials as well. There was a limited *space available for holding,'the gas released from. the letdown flow.. These two factors would make the reduction of pressure an extremely' slow process that took several days to accomplish.

USNRC Technical Training Center At 9:25 p.m. on March 28 (17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> 25 minutes after turbine trip), it was apparent that the utility believed pressure could soon be reduced to a level at which the decay heat system could be used.

18.3, Major Issues 18.3.1 Natural Circulation

..Natural circulation is a basic thermal hydraulic phenomenon that occurs during the loss of power to the reactor coolant pumps. Heating and cooling of water changes the density of the coolant. As the density decreases, a given volume,of water contains less mass. The heated water will tend to rise while the cooled water will tend to fall. This

-is similar to the principles of operation of a hot air balloon. To rise, heat is added to the gas volume of the ballon. As the hot air cools, the ballon falls.

Natural circulation is the mechanism by.which the coolant is transferred out of the reactor vessel to the steam generators which act as a heat sink.

To take advantage of the buoyant forces, sometimes called the thermal driving head, the plant is designed with a maximum height differ ence between the center of heat generation, the core, and the center of heat removal, the steam generator.

Resistances to, flow such as pipe restrictions, valves, bends, elbows, etc., especially in the hot legs of the RCS, are minimized. The design enhances the natural circulation flow due to the thermal gradients which will occur when a loss of pumping power is sustained.

Although plant design is fixed, there are some

.-,operational things that can occurthat will inter Srupt natural 'circulation.

Operation of normal plant systems is sometimes different, during natural circulation. -Therefore, the operator must understand natural circulation to avoid problems.

Several things can be done to enhance natural circulation. Pressurizer level should be main 18-13 Rev 0896 In JP. 111 9-f, Man"al a Vaa

_5 Three Mile Island 1 1

Wn C.Three Mile Island tained at 50% or greater to ensure that no vapor pockets have formed in the loops. Large vapor pockets result in large resistance to flow. The Reactor Coolant System should be maintained at least 15 degrees subcooled.

50 degrees subcooling is desired, but at least 15 degrees subcooling is required. Again, this ensures that no steam pockets form in the reactor coolant loops or the steam generators.

Another necessary requirement is to maintain a heat sink. The heat sink required is at least one steam generator. The Auxiliary Feedwater System should be used as necessary to maintain narrow range level, in one steam generator.

Without the heat sink, the reactor coolant will not be cooled and the thermal driving head will be reduced, therefore natural circulation will be reduced. Boiling will likely occur in the core and hot leg forming steam voids in the steam generator tubes and in the reactor vessel head. These will all offer a high resistance to natural circulation flow.

Several parameters measured in the plant are available to help provide indication of natural circulation. The Reactor Coolant System differ ential temperature should be approximately 25%

to 80% of full power as indicated by wide range resistance temperature detectors (RTDs). The hot leg RTD should be indicating either a steady value or a slowly decreasing value. This indicates that heat removal is operating properly and that the decay heat generated by the core is decreasing slowly as it should. Core exit thermocouples should be monitored. These also should be indi cating either a steady value or a slowly decreasing value.

Steam pressure should follow reactor coolant temperatures. As average reactor coolant temperature decreases, so should steam pressure.

Cold leg temperatures of the RCS should also indicate either a constant value or slowly decreas ing value. This measurement is again by RTDs.

These measured parameters can also be used to detect a loss of natural ciiculation flow. If natural circulation flow is lost, the RCS differential tem-perature will exceed the 100% full power value.

This is because the hot leg temperature will in crease as boiling occurs in the core. Since there is no flow, the hot leg temperature will rise dramati cally while cold legtemperature remains relatively constant. The core thermocouple temperatures will also rise as the heat is generated by the core.

Steam pressure from the steam generated will decrease as boil off occurs in the steam generators. Since flow is zero, temperature and pressure will decrease in the steam generator as a cold water slug is formed on the reactor coolant side of the steam generator. Steam generator level will also -increase with the same auxiliary feedwater flow since less steam will be formed as the RCS cools.

As mentioned previously, some systems will have to be operated differently when in natural circulation. One of these systems is the Pressur izing System. Normally spray comes from one of the reactor coolant loops. In natural circulation, however, there will not be enough driving head for this spray to work. In this case, an auxiliary spray will have to be used. The operator will have to control spray very carefully manually to control pressurizer pressure. During natural circulation it is imperative to make changes to reactor coolant loop temperatures and pressures in a slow manner.

Otherwise, the thermal driving head can be upset and natural circulation will stop. If the operator does not control pressurizer pressure correctly, the subcooling temperature may be lost and a bubble or steam void may be formed in the reactor vessel or loops. The operator must prevent pressure from rising to the power operated relief valves opening setpoint. These valves have been known to fail to reseat. A sudden drop in pressure due to a stuck open relief valve could cause flashing in the reactor coolant loop hot leg and a loss of natural circulation. As mentioned, the operator must control pressurizer pressure by controlling auxiliary spray and heaters.

USNRC Technical Training Center 18-14 Rev 0896 Rev 0896 I

B&W Crosstrainine Course Manual Three Mile kland 18-14 USNRC Technical Training Center

B&W Crosstraining Course Manual The cooldown of the RCS will have to be accomplished by c6ntrol ofithe atmospheric dumps or turbine bypass valves (if condenser is available). The -operator will have to manually make,all changes to the system control parameters. Once again, all changes should be made slowly or natural circulation flow may be disrupted.

The Auxiliary Feedwater System flow will

--also have to be controlled manually by the operator. Flow.should be controlled 'so as to maintain a fairly constant level in the,steam generators. Overfeeding can cause a rapid cooling' down of the steam generator and a disruption to the natural circulation flow in the RCS. As small

'-,changes are made to the.Steam Dump Control System, small changes should be made to the flow in the Auxiliary Feedwater System. These two systems should be adjusted slowly to provide a slow, steady cooldown rate of the Reactor Coolant System.

18.3.2 Reactor Coolant Pump Operation The previous section discussed considerations and operations in the natural circulation mode of core cooling. Emergency procedures, based on recommendations from vendors, outline the crite ria for operating the RCPs if natural circulation is not working. This section will discuss factors to be considered in RCP operation during accident conditions.

Consideration will be given to

,possible situations in which written procedures may be inadequate to prevent severe degradation of the reactor core.

Many operating procedures usually require some minimum value ofRCS pressure (normally 1250 psig to 1550 psig) before RCPs can be started, regardless of other conditions in the RCS.

Several factors, however, could affect a decision to operate the pumps below this minimum pres sure. First, the RCS inventory may be sufficient Three Mile Island to operate the pumps intermittently without serious damage. For example, a non-condensible blockage could occur in the steam generator tubes and the only method of removal could be RCP operation. Secondly, if chemistry, radiation levels and hydrogen generation indicate severe core damage is occurring and operator actions to cover the core are not adequate, turning on the RCPs in an attempt to send slugs of water and steam for cooling the core may be necessary.

Prior to attempting to start a RCP, an alterna tive method of restoring natural circulation would be to increase steaming in the steam generator (in crease the size of the heat sink). This could be accomplished using turbine bypass valves or atmospheric dump valves. Using this method should condense steam that may be blocking material circulation flow in the steam generator U tubes. However, if the void in the steam generator U-tubes contains,large quantities, of non condensible gases, RCPs may be needed intermit tently to force the blockage out-of the steam generator and into the reactor vessel. Another alternative that may be pursued if inadequate core cooling exists is to intentionally depressurize the RCS in a controlled fashion, using a pressurizer relief valve.

The purpose of depressurization is to create conditions which will allow increased emergency core cooling flow. Extreme caution must be used in a depressurization as increased voiding may result at lower pressures, if core cooling continues to be inadequate and saturated conditions exist in the RCS.

If depressurization below the low pressure safety injection pump discharge head fails to improve core cooling and increase vessel water level, then pressure should be increased by isolat

--ing letdown and closing the pressurizer relief valves. Then, once pressure reaches the minimum level for RCP operation or the maximum achiev-

,USNRC Technical Training Center 18-15 R~ev u~OY

B&W rossraiing oure MaualThree Mile Te~N-A able pressure, an attempt should be made to start the RCPs. This procedure of depressurization, repressurization and RCP operation can be re peated until blockages are cleared and the core is covered.

18.3.3 Hydrogen Generation The issue causing the most concern and public apprehension during the incident at TMI involved hydrogen and the hydrogen bubble. The errone ous assumption that the accumulation of hydrogen within the primary system was or could become explosive led to speculations of a massive spread of contamination and consequent damages to the general population. As was later confirmed pub licly, these speculations and fears about the "bub ble" were totally unfounded. The presence of even small amounts of free hydrogen prevents accumulation of oxygen and thus any possibility of hydrogen/oxygen explosion.

However, the amount of hydrogen produced was, sufficient to cause legitimate concerns about core cooling and flammability in the reactor building atmosphere.

An ignition, as measured' by pressure and temperature spikes, did occur about 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> into the incident. Although equipment may have been damaged, the integrity of the reactor building remained in tact. Significant amounts of hydrogen may be produced by radiolysis and the zirconium/water reaction.

Absorption of energy from ionizing radiation will cause the decomposition of water by a some what complicated mechanism to form primarily hydrogen and oxygen.

2H20 <--> 2H2 + 02 The yield of this reaction is dependent upon the energy absorbed, the nature of the radiation, temperature, reaction produces residence time, etc. Throughout the incident at TMI-2, the dis solved hydrogen levels in the RCS were consider-ably above,1 ppm. Thus, radiolysis in the RCS was a source of neither hydrogen nor oxygen.

Above 1600'F zirconium alloys react with water to form hydrogen and zirconium dioxide.

Zr + 2H 20 -- > Zr02+ 2H 2 The reaction rate increases with temperature and is very rapid above 2700'F. Stoichiometrically, about 8 standard cubic feet of hydrogen are pro duced" per pound of zirconium oxidized. Each kilogram of Zr that reacts can release about 6.5 megawatts of energy.

If the coolant were lost from the reactor vessel due to an accident, the temperature of the fuel would increase dramatically. When temperatures reached near 2200'F, the zirconium-water reaction would begin, in the presence of water vapor.

The "reaction would then proceed autocatalytically, accelerating rapidly to a temper ature of approximately 3000'F, where actual melting occurs. Once the heat source is removed, the reaction, in the presence of liquid water, stops by itself.

However, a complete and violent reaction with water is conceivable if the entire reactor core vaporizes, an event that is considered highly improbable.

In the course of the zirconium-water reaction, hydrogen gas is produced in proportion to the amount of the cladding material that has reacted. A large con centration of hydrogen would therefore indicate a large amount of damaged cladding. During a LOCA, the hydrogen gas may escape through a break in the reactor vessel. Since hydrogen is lighter than the surrounding air, it will tend to rise and collect in a "bubble" at the top of the contain ment dome. The cohcentration of hydrogen in the top of the dome would be high enough to prevent oxygen from entering the bubble and creating an explosion; however, an explosion could occur while the hydrogen is rising from the reactor vessel toward the dome.

USNRC Technical Training Center 18-16 Rev 0896 Rev 0896 I

B&W Crosstrainine Course Manual Thr*p Milp Ithnd USNRC Technical Training Center 18-16

-Three Mile Island During containment spray, bperation another means of hydrogen gas production exists. If the operation -uses a sodium hydroxide (NaOH)

"chemical addition, any aluminum inside the con

" tainment may react as shown in the following

• equation.

2A1 + 2 (NaOH) + 2H20 --> 2NaA10 2 + 3H2 The amount of hydrogen gas generated by this process can be'limited by keeping the amount of "aluminum used in the plant to a practical mini mum: In the event that hydrogen gas does collect

-in the containment, hydrogen' recombiners are

"-provided to bum off the hydrogen under con

," trolled conditions.

Another possible reaction with aluminum

-,which can liberate hydrogen is:

2A1 + 3H20 --> A1203 + 3H2

. The'potential sources 'of aluminum within the containment building are as follows:

(1) Neutron detector supports (2) Reactor Coolant Pump fins (3) Electrical conductors (4) Refueling machine (5) Incore instrumentation components "In addition, hydrogen may be liberated by means of zinc-water reactions following a loss of reactor coolant within the containment.,The typical reaction which takes place under these circumstances is:

"Zn + H20 --> ZnO + H2

-The typical zinc metal sources in containment are:

(1) Floor gratings -,"'

(2) Electrical conduit and trays (3) Ventilation ducts (4) Zinc-based paint USNRC Technical Training Center Hydr6gen gas generation in the reactor core is of major concern in the operation of a pressurized water reactor.

The hydrogen gas which was produced at TMI was a major.importance for several reasons:

1. The presence of a hydrogen bubble in the vessel at TMI confirmed what had already been suspected: 'a significant amount of fuel damage had occurred.

2. The gas bubble in the core complicated the task of cooling the core.

3. The explosive nature of the hydrogen gas introduced another danger 'to the already complicated recovery process.

'18.3.4 Radiation Release Paths (Figure 18-7)

The radioactive 'materials released, to the environment as a result of the TMI-2 accident

,were those that escaped from the damaged fuel and were transported 'in the coolant yia the let down line into the auxiliary building and then into

-the environment., 'The noble, gases -and radioiodines, because of their volatile nature and large concentration, were the primary radionuclides available for release from the auxil iary building.

Because the releases' occurred primarily through a series of filters including charcoal filters designed to remove radioiodines, the released materials consisted primarily of the noble gas isotopes of krypton and xenon. The

'total quantity of released radioactive materials is estimated as 2.5 million curies.

OnMarch 28,,1979, prior to 4:00 a.m., the

,TMI-2.liquid radwaste -treatment-system, was

,operating normally. ' TMI-1 was returning to operations after a refueling outage, which gener ated liquid radwaste that required processing in order to continue startup.

A spill of 20,000 gallons of contaminated water from the fuel 18-17 Rev 0896 1ýý t-M

.1 13mvv Crosstra n air, ou. a, an.

T I ý

B&W rossraiin2 oure MaualThree Mile Island transfer canal into the reactor building of TMI-l near the end of the outage resulted in large vol umes of low level liquid radwaste from decontamination operations. Because there is no minimum level below which low level liquid radwaste can be released untreated, this volume was being stored, which reduced the available liquid radwaste storage capacity at Three Mile Island Station on March 28.

Immediately prior to the accident, approxi mately 60% of the station's available liquid radwaste storage capacity (300,000 gallons per unit) was filled. Of particular importance, the auxiliary building sump was approximately 63%

full, the auxiliary building sump tank was was approximately 76% full, the two contaminated drains tanks were 77% and 24% full, respectively, and the three reactor coolant bleed holdup tanks, each of 83,000-gallon capacity, were 40%, 61%,

and 61% full, respectively.' Although there was minimal input of liquid radwaste from TMI-2, 60% of the Three Mile Island Stations' liquid radwaste tank capacity was not available on March 28. Accordingly, we find that for normal operations the liquid radwaste storage and treatment system was marginal at best.

SPrior to March 28, 1979, the gaseous radwaste system and the heating and ventilating systems had satisfactorily undergone numerous functional and acceptance tests. However, a number of maintenance work requests for the waste gas system were outstanding at the time, of the accident. Both waste gas compressors needed service for various conditions (described in maintenance requests as "over pressurized,"

"makes loud noise,". "no seal water level," "level cohtrol pump operation"). These compressors leaked during the March 28 incident. In addition, makeup tank vent valve was suspected to be leaking.

Operation of compressor A resulted in releases of gaseous radioactive materials to the auxiliary and fuel handling buildings with each venting of the makeup tank to the waste gas decay tanks.

The radioactive noble gases in this leakage were not held up in the decay tanks and were released untreated to the environment.

Compressor B, which was to be operated only in an emergency because it was considered to be in poor condition, was not used until Thursday, March 29 and there fore, leaks in this compressor were not significant.

We find that the leaks, particularly in compressor A, which led to the release of small amounts of radioactive material during normal operation, led to releases of radioactive material after core damage.

Following the turbine trip, the open pilot operated relief valve (PORV) on the pressurizer permitted reactor coolant, at high temperature and pressure, to fill the reactor coolant drain tank.

Fifteen minutes after the turbine trip, the reactor coolant drain tank rupture disc, which had a setpoint of 192 psig, failed and primary coolant flowed to the reactor building sumps. As a result, the reactor building sump pumps started automati cally and transferred at most 8100 gallons to the auxiliary building sump tank. These pumps were manually turned off at 4:38 a.m. Since the avail able capacity of the auxiliary building sump tank was only 700 gallons, liquid overflowed to the auxiliary building sump, which caused water to back up through the floor drains in both the auxil iary and fuel handling buildings.

This liquid did not contain large amounts of radioactive material because significant core damage did not occur until after 6:00 a.m. How ever, the liquid proved to be a means for highly contaminated reactor coolant to travel into areas of the auxiliary and fuel handling buildings as the accident progressed.

USNRC Technical Training Center 18-18 Rev 0896 Rev 0896 I

B&W CrosstraininL, Course Manual Three Mile Island USNRC Technical Training Center 18-18

Three Mile Island fIX VT

.* U33I I**uhIF, t.tfl*

After core damage occurred, radioactive material was transported out of the reactor by the letdown line of the makeup and purification sys tem. Because the letdown is a stream ofprimary coolant directly from the reactor, it contained significant amounts of radioactivity.

It-was necessary to maintain some,letdown flow to -the makeup and purification system to ensure safe cooldown of the reactor between March 28 and April 2, 1979. As a result, leaks in the makeup and purification system (located in the auxiliary building), which release small amounts of radioactive material in normal operation, released :large amounts of radioactive material duririg the accident,'even though the letdown flow was reduced from its normal volumetric flow of 45 gallons per minute to about 20 gallons per minute. The letdown flow was, in fact, the major path for transferring radioactive material out of the reactor.

-We find. that leakage of radwaste system components, particularly in the makeup and purification system, which contained -small amounts of radioactive material during normal "operation, led to the most significant releases of radioactive material after core damage occurred.

This source of liquid radioactivity was released to the auxiliary building and uncontaminated water spread over the floors of the auxiliary and fuel handling buildings.

The TMI-2 stack was the main release point for gaseous effluents. Numerous pathways to the

"ýstack existed for the release of radioactive gaseous effluents. The release pathways from the reactor to the auxiliary~and fuel handling buildings are shown in Figure 18-7.

The release of radioactive gases into the auxiliary

, and fuel handling building occurred by direct gas leakage *and leakage.of radioactive liquid from which radioactive gases evolved. Direct leaks of USNRC Technical Training Center radioactive gas were the major source of radioac tive gaseous releases.

Leaks in the vent header system and the waste gas decay system were the primary mechanisms for the direct release of gaseous radioactive material. The high pressure in the reactor coolant drain tank (up to 192 psig) prior to rupture disc failed led to a sequence of events that created a significant release pathway for gaseous radioac tivity through the vent header.

-The reactor coolant drain tank was connected to the vent headeryia two paths. Pressures in the reactorcoolant drain tank prior to rupture disc failure pressurized the vent header. Before the rupture of the reactor coolant drain tank relief at 4:15 ýa.m., the radiation monitoring system de tected activity that indicated that the waste gas vent header was leaking. Subsequent inspection has identified six leaks in the vent header system.

The vent line from the reactor coolant drain tank to the vent header was open on March 28, 1979.

The high pressures in the reactor coolant drain tank forced liquid (primary coolant) through the

-,vent line to the vent. header. The vent header relief valve is set at '150 psig, so water under pressure caused leaks in the water drains. This

-water also damaged some of the 10 check valves located between the vent header and connected tanks reactor coolant bleed holdup tanks. These check valves are designed to, permit flow only from the component to the vent header and not in the opposite direction, but are known to operate inefficiently and fail easily. Therefore, a signifi cant pathway existed from the vent header to a number of tanks. The relief valves on these tanks, which were set at relatively low pressures (reactor

% coolant bleed holdup tank at 20 psig, reactor coolant evaporator at 10 psig), opened. Lifting of

,these relief valves resulted in untreated releases directly to the, stack yia the-relief valve'vent header. We find that the gaseous radwaste system 18-19

_Rev 0896 III 1-4 d-ma"Vini "Ex ross ga n ng o

B&W Crosstraining Course Manual Three Mile Telin design included "relief to atmosphere," which provided a path to the environment for untreated gas. We find, also, that the high reactor coolant drain tank pressures between 4:00 and 4:30 a.m.

on March 28 damaged portions of the vent gas system and resulted in a gaseous release pathway to the vent header, through failed check valves to components with low-pressure reliefvalves. Once established, this release path was available whenever the vent header was used, such as in the venting of the makeup tank.

The makeup tank has a liquid relief to the reactor coolant bleed holdup tanks. The tank is designed to operate with approximately one-third of its volume as a gas space to allow gases from the cooled and depressurized primary coolant to evolve and be collected.

Collection of noncondensible gases in the makeup tank caused a reduction in the letdown flow because of pres sure buildup. This reduction of letdown flow became a concern in the early morning of March

29. As a result, manual ventings of the makeup tank to reduce pressure began at 4:35 a.m. on March 29. The venting process consisted of short bursts, with vent valve being cycled open for short periods oftime to minimize leakage of radioactive material. According to a Shift Supervisor, venting of the makeup tank occurs only once every 2 or 3 months during normal operation to remove nonradioactive noncondensible gases and there is no standard operating procedure for venting the tank. Nonetheless, on March 29, Met Ed wrote and approved operating procedures for the peri odic venting of the makeup tank.

The rate of pressure buildup in the makeup tank became too rapid to control with the cyclic opening of the vent valve during early Friday morning,: March 30. The liquid relief on the makeup tank opened, allowing all of the contents in the' tank to flow into the reactor coolant bleed holdup tanks. The makeup pumps then switched suction to the borated water storage tank. This water bypassed -the primary system and was recirculated to the makeup tank and to the reactor coolant bleed holdup tanks through the open liquid relief valve, thus depleting the supply of borated water.

It was crucial to reduce the pressure in the makeup tanks at this time for two reasons. First, the supply of borated water in the borated water storage tanks was being depleted. This supply was the only readily available source of borated water for continued boron control of the primary coolant. Second, the increase in pressure in the reactor coolant bleed holdup tanks through the open relief valve on the makeup tank increased the probability that the relief valves on the bleed holdup tanks would open. The opening of the tanks would permit an uncontrolled release of gaseous radioactive material to the environment via the relief system.

A decision was made to vent the makeup tank continuously in an attempt to reduce pressure.

During the morning of March 30, 1979, this action was suggested by a Control Room Operator, and all personnel present in the TMI-2 control room agreed. At approximately 7:00 a.m. on March 30, the makeup vent valve was opened. A caution tag was placed on the valve on March 31 at 11:15 p.m., stating, "Do not move this valve without Supt. or Shift permission."

The opening of the vent valve at 7:10 a.m. on Friday, March 30 resulted in a momentary reading of 1200 mR/h, 130 feet above the TMI-2 stack.

This reading was the event that apparently trig gered the Friday evacuation recommendations.

Leaving the valve open provided a continual pathway for gaseous radioactive material to enter the auxiliary building. Leaks in the vent header permitted the gases to enter the auxiliary and fuel handling buildings and be discharged through the stack.

Since 'letdown. flow is still being maintained, this release pathway still exists.

USNRC Technical Training Center 18-20 Rev 0896 Rev 0896

-1 USNRC Technical Training Center Thrpp MlI* I*12nd 18-20

B&W Crosstraining Course Manual However, all short-lived radionuclides in the reactor coolant have undergone significant decay since-. March 28, and "releases 'of radioactive

,'material from Three Mile Island Station are now negligible.

I A postaccident examination of waste gas com pressor B found a hole approximately the size of a quarter. The operation of the compressor at any pressure would be con'sidered a significant release path.' However,'compressor "B" was off line from March 28 until March 29. In addition, the design of the waste gas system includes a pressure

'regulator that -limits the 'inlet pressure to the conmpressors -to approximately -1 inch of water gauge. This prveeited any high pressures in the vent header from reaching the compressors.

These two factors lessened the significance of the release pathway presented by the leaking waste gas system compressors.

18.4 Analysis A number of analyses were performed with the MARCH computer code to assist the TMI Special Inquiry Group.

The MARCH code predicts the thermal ahd hydraulic conditions in the reactor primary system and containment building in core meltdown accidents. The purpose

-of the analyses was to examine a number of, variations in system operation in the TMI accident to evaluate their effect on the extent of core damage. The results indicate that:

1.: The throttling of HPI had a major-effect on core damage. If the system had been permit ted to operate at high flow, the core would not have uncovered regardless of PORV position or the availability of emergency feedwater.

2. Closure of the block valve in the PORV line at 25 minutes into the accident would have permitted the operation of the reactor coolant pumps to continue and would have prevented I f Three Mile Island ievuoyo USNRC Technical Training Center 18-21 18-21 USNRC Technical Training Center core damage. An additional delay of one hour in closing the valve would have resulted in severe core damage and possibly core melt down.

3. The delay-in operation of the emergency

-feedwater system had little effect on the extent of core damage. However, a delay of one hour in the delivery of emergency feedwater would probably have resulted in more severe core damage and possibly core meltdown.

Although the operation of a reactor coolant pump at 2:54 was probably important in limiting the extent of core damage, the core was not recov ered until operation of the HPI at 3:20. The top of the core was not uncovered again, although re gions of the core remained vapor blanketed for days. 'For a number of hours following core recovery, flow through the hot legs was blocked by the presence of hydrogen and the hot 'leg temperatures remained in the range of 750 800'F, to which they had been heated during core uncovery.

Some analyses were performed with MARCH for sequences leading to complete core meltdown "to examine thie likelihood of different containment failure modes.

Since the containment coolers were operational, the greatest threat to contain ment -integrity was felt to be from the rapid "combustion of the hydrogen: generated from metal-water reactions. If the hydrogen concen tration in containment "onrrespondiiig to '100

-percent cladding reaction were to accumulate well beyond the flammability limit, containment failure could result upon ignition. The most likely time for this to occur would be when the pressure vessel fails and the molten core falls into the reactor cavity. Whether, indeed, hydrogen would accumulate to critical levels without undergoing prior combustion and then explode with sufficient energy to fail'containment, carnnot be determined without further research.

ev U089

BI Co.Three Mile Island Finally, analyses were performed to evaluate the impact that the hydrogen burning event that occurred in the TMI-2 containment would have, if it were to occur in other types of containment design.

In general, the pressure suppression containment designs with lower design pressures are much more vulnerable to hydrogen explosion than large dry containments.

18.5 References

1. NUREG/CR-1250 Vol. II Part 2, "A re port to the Commissioners and to the pub lic."

2. General Physics "Mitigating Core Dam age."

3. NUREG/CR-1219, "Analysis of the Three Mile Island Accident and Alternative Sequences."

4. General Physics Courseware, "Heat Transfer, Thermodynamics, and Fluid Flow Characteristics."

Appendix - Sequence of Events Initial Conditions:

Reactor Power 97%

Average Temp 58 I1F Pressurizer Heaters and Sprays in Manual RCS Activity 0.397 uC/ml Transient Initiator - Loss ofCondensate Booster Pump RCS Pressure 2155 psig ICS in Full Automatic 6 gpm Identified RCS Leakage Pressurizer Level 229 inches RCS Boron = 1030 ppm Two licensed control room operators were on duty in the control room. The shift superintendent was in his office adjacent to the control room. The shift foreman and two auxiliary operators had been working in the auxiliary building on the No.

7 condensate polisher.

The condensate polishers use ion exchange resins for purification of the feedwater. Flow through the resin bed tends to compact the material into a solid mass. The transfer procedure utilizes demineralized water and station compressed air to break up this mass. During this transfer process a resin block developed in the transfer line.

At this point, the plant operators had hypothesized that water pressure may have exceeded air pressure, forcing water into theair system. Further, the watei made its way to the polisher isolation valve controls causing them to drift toward the close position. It is assumed that the condensate booster pumps tripped first, since the polisher outlet is operated within 50 psig of the NPSH limit for the booster pumps. This problem had occurred before.

Sequence of Events:

04:00:00 Condensate pump "IA" tripped. Feedwater pumps "IA" and "IB" tripped. Main Turbine tripped. EFW pumps "1"," 2A", and "2B" started 04:00:03 Pressure setlpoint of Power Operated Relief Valve (PORV) was exceeded (2255 psig).

04:00:08 Reactor tripped on high RCS pressure (2355).

04:00:12 RCS pressure decreased below PORV setpoint. Solenoid deenergizes providing a closed indication to the operator.

I B&W Crosstrainine Course Manual Three Mile Island USNRC Technical Training Center 18-22 Rev 0896

IPIe,V

('

ncctn~n Couurse ManualThe Ml Iln Sequence of Events (continued) 04 :00:13 Indicated Pzr level peaked at 256 inches and began a rapid decrease. Letdown flow was isolated. Makeup pump "I A" was started and a HPI isolation valve opened. This pump kept tripping (reason unknown) Pzr sprays and beater control returned to automatic.

04:00:15 SG "A" level indicates 74 inches (S/U range). SG "B" level indicates 76 inches (S/U faange).

04:00:30 PORV and Pzr safety valve outlet temperatures alarmed high. RCS low pressure trip setpoint reached.

04:00:58 Pzr low level alarm. SG levels are very low, and the differential temperature, hot to cold leg, rapidly approaching zero indicating that OTSGs are going dry.

04:01:45 Both SGs are boiled dry 04:02:01 ESFAS on low RCS pressure. Makeup pump "IB" tripped. HPI pump "I C" started.

04:02:04 DHR pumps "lA" and "IB" started.

04:03:13 The safety injection portion of ESF was manually bypassed. RCDT relief valve lifted.

04:03:28 Pzr high level alarm 04:04:38 The operator stopped makeup pump "I C" and throttled the HP1 isolation valves.

04:05:00 Pzr level reached 377 inches and continued to rise (pressure continued to decrease).

04:05:30 Indicated RCS Th and pressure reached saturation (582'F and 1340 psig).

04:08:18 OTSG level at 10 inches on the startup range. The EFW pumps were running, but the discharge valves were closed. The valves are now opened resulting in a dry OTSG being fed with relatively cool water. T, and T, decreased. RCS pressure, now under control of the loop saturation considerations, followed.

04:10:19 -- Reactor building sump pump "2B3" started.

71" 04:11:43 Pzr level came back on scale and dropped rapidly, as RCS loop temperature continued to decrease from the heat being removed by the OTSGs and EFW pumps.

04:13:13 DHR pumps " IA" and " I B" were shut down.

04:14:48 The RCDT rupture dis6 failed (191.6 psig).

04:14:50 RCP related alarms actuated. Reactor coolant flow indicated oscillations. (RCS pressure =1275 psig, T, 567-F).

04.24:58 PORV outlet temperature = 285.4*F. Safety valve outlet temperature =270'F 04:27:51 Reactor coolant temperature begins to stabilize at approximately 550'F. Pressure 1040 psig. -OTSG levi

=

-3 0 inches 04:38:10 Reactor building sump pumps "2A" and "2B3" were stopped.

04:40:00 Increasing count rate continued on the Source Range neutron 'detector.

04:46:23

-Letdown cooler monitor count rate began increasing. It will increase by a factor of 10 within the next 40 minutes.

05:13:40 Stopped loop "B" RCPs ("IB" and "2B3").

05:30:00 NI-3 (IR) came on scale (increasing).

05:40:40 Stopped loop "A" RCPs ("IlA" and "2A") due to high vibration, erratic flow, and decreasing flow.

05:41:00 Excore instrumentation indicated a decreasing flux (factor of 30).

05:42:30 Excore instrumentation indicated increasing flux levels.

05:5 1:27 Loop "A" and "B" Th temperatures were increasing (eventually went off scale high - 620'F). Cold leg temperatures were decreasing.I-I-

I 06:14:23 Reactor building radiation monitor (particulate sample) went off-scale high.

f1 06:19:00 PORV outlet temperature 228.70F.-Safety valve outlet temperature 189'F and 1941F. Operator closes PORV block valve I

.I 06:38:23' Letdow'n cooler "A" rad. monitor off-scale high..

06:39:23 Two samples indicate RCS boron is 400 ppM., Emergency boration started (feared restart).

06:47:00 Alarm typewriter indication showed SPNI~s responding to high temperatures down to 4' level of the core.

~90% of the core exit thermocouples >700'F.~

06:54:09 After attempting to start RCPs "2A" and "IB", the operator successfully started RCP."2B" by jump starting the interlocks. "213" ran with high vibration. Flow was indicated for only a few seconds and returned to zero.

USNRC Technical Training Center Three Mile Island Rev 0876

', ý 18-23

Sequence of Events (continued) 06:54:50 ESFAS logic automatically reset (HPI injection) on increasing pressure (1845).

06:55:00 Site emergency declared Radiation alarms:

waste gas discharge, station vent, fuel handling building exhaust 06:55:13 ESF bypasses were cleared.

07:00:00 RCS pressure at 2045 psig.

07:12:00 Opened PORV block valve (RCS pressure control).

07:13:00 RCP "2B" was stopped (zero flow, low current, high vibration).

07:17:00 PORV block valve was closed.

07:19:45 Manually initiated safety injection (low RCS pressure).

07:20:13 Makeup pump "IC" started (rapid quenching probably caused major fuel damage).

07:21:00 Excore instrumentation indicated sharp decrease (reflood).

07:23:23 General emergency declared. Notified the off-site authorities.

07:32:26 High pressurizer level alarm.

07:37:00 Tripped makeup pump "IC."

07:40:00 Opened PORV block valve.

07:55:39 ESF "A" and "B" actuated on high reactor building pressure. Makeup pump "IC" started.

08:00:00 Over the next 90 minutes, core exit thermocouple readings were manually obtained ranging from 217 to 2580'F. Pzr level = 380 in. RCS pressure = 1500 psig. ESF actuation cleared.

08:18:00 Makeup pumps "IA" and "IC" tripped. Operator attempted to restart "IA" (switch then placed in "Pull to Lock")

08:22:00 Makeup pump "IB" was started.

09:15:00 Decision made to repressurize RCS. Closed the PORV block valve. RCS pressure = 1250 psig 09:43:00 By cycling the PORV block valve, RCS pressure was maintained 1865-2150 psig during the next 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

10:04:00 Commenced filling OTSG "A" (to 97%) using condensate pumps.

11:08:00 EFW pump "2A" was started. OTSG "A" level reached 100% (operating range) 11:38:54 Station manager ordered the PORV block valve opened.

11:41:35 Bypassed ESFAS 12:30:00 Power operated emergency main steam dump valve was closed at the request of corporate management.

12:31:00 RCS pressure had decreased to 600 psig (indicates floating on CFT).

13:04:00 Makeup pump "I C" stopped (concerned with BWST inventory).

13:10:00 PORV block valve was closed. RCS pressure had decreased to 435 psig and then began to increase (could not get on DHR).

13:50:00 ESF on high-high RB pressure (28 psig). HPI, RB isolation, RB spray pumps & valves, DHR pumps started, Makeup pump "IC" started. Makeup pump "I A" - no indication of starting or running.

13:50:30 Makeup pump "IC" was stopped. RB spray pumps were stopped 13:57:00 DHR pumps "IA" and "IB" were stopped.

13:58:38 Cleared ESFAS 14:00:00 Opened PORV 14:26:15 Loop "A" Th <620'F. Stays on scale 10 minutes.

14:35.00 RCS pressure decreased to 410 psig and began to increase.

15:06:00 Pzr level decreases to 180" in the next 18 minutes. RCS loop "A" temperature increasing.

16:00:00 PLANT STATUS: No RCPs running, Makeup pump "IB" running, RCS pressure = 560 psig (increasing),

Pzr level = 294" (increasing) Loop "A", Th = 590'F, Tc = 340'F, OTSG without heat sink, 44 psig decreasing, nearly full. Loop "B", Th = 620'F, T, = 1801F, OTSG - isolated & full.

There is no indication of natural circulation. Very little of the decay heat is being removed, except by makeup water and by occasional opening of the PORV block valve. Gradual heatup of the RCS is causing temperature and pressure to rise.

Pressure control is being attempted by juggling makeup and PORV block valve.

USNRC Technical Training Center 18-24 Rev 0896 18-24 B&W Crosstrainine Course Manual Three Mile Island USNRC Technical Training Center Rev 0896

Three Mile Island Sequence of Events (continued) 17:20:00 Reactor building pressure starts to go negative. Pressurizer level staits to drop. RCS pressure = 637 psig (decreasing). Two HPI pumps are providing 425 gpm (total) makeup flow. It is now the intention to repressurize, hopefully t6 collapse bubbles and begin steaming from OTSG "A".

High points were actually hydrogen filled. Collapse of loop bubbles was still impossible. It is the operator's belief that the main condenser will soon be available.

20:00:00 Indications show that forced circulation had been reestablished using RCP "iA." RCS pressure was being maintained at 1000 - 1100 psig with temperatures indicating a cooling trend. Heat was being removed from the RCS using OTSG "A".

OTSG "B" was isolated and condenser vacuum had been established.

During the accident, there apparently was much concentration on the water level in the pressurizer. This, by the way is natural, because the operators knew to never let the pressurizer get empty (or full). It is, therefore, understandable that they would not be trying to imagine boiling occurring elsewhere in the system.

During this tranisient, the system pressure and temperature and their relationship to saturated steam conditions were not correlated, at least not in the control room; the operators were much too busy to think about the steam tables. We must endeavor to keep in mind the fact that if pressure drops, we can have DNB occur which ultimately will create partial film boiling in the reactor.

ID Qorl USNRC Technical Training Center 18-25 W4 1

B& W Crosstraining Course anua I*W urossIl allllIi t..,UUl LVl lllu l

ý* IhU

CD CD CL

LOOP A LOOP B

LOOP A LOOP B

LOOP A LOOP B

-n II co t0 c

LOOP A LOOP B

LOOP A LOOP B

STEAM

-GENERATOR STEAM CD LINE

-I 0

(D CD QUENCH TANK DEMINERALIZERS SUMP (j

PUPSUMP MAKEUP CA COTIMN AUX.BUIDIN