ML18152A016
| ML18152A016 | |
| Person / Time | |
|---|---|
| Site: | Surry  |
| Issue date: | 09/30/1988 |
| From: | Julian C, Shymlock M NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| To: | |
| Shared Package | |
| ML18152A017 | List: |
| References | |
| 50-280-88-34, 50-281-88-34, IEB-84-03, IEB-84-3, IEIN-84-93, NUDOCS 8810130050 | |
| Download: ML18152A016 (43) | |
See also: IR 05000280/1988034
Text
.
UNITED STATES
NU_CLEAR REGULATORY COMMISSION
REGION 11
101 MARIETTA ST., N.W.
ATLANTA, GEORGIA 30323
Report Nos.:
50-280/88-34 and 50-281/88-34
Li~ensee:
Virginia Electric and Power Company
Richmond, Virginia 23261
Docket Nos.:
50-280 and 50-281
Facility Name:
Surry 1 and 2
License No$.:
Inspection Con
T earn Leader:
Team Members:
Approve~ by:
1-3, 1988
-ntrcJU
T. Collins, Radiation Specialist, Region II
M. DeGraff, Reactor Engineer, Region II
W. Holland, Senior Resident Inspector, Surry
W. LeFave, Senior Reactor Engineer, Plant
Systems Branch, NRR
L. Lawyer, Reactor Engineer, Reg*; on II
J. Mathis, Resident Inspector, Grand Gulf
C- 6-
~'Yl
t. A. Julian, Chie~
Operations Branch
Division-~f Reactor Safety
8810130050 880930
ADOCK 05000280
G
PNU.
c:/3 o / <1s
'Date Signed
'
t - (
TABLE OF CONTENTS
Page
I.
INTRODUCTION - FORMATION AND INITIATION OF AUGMENTED
INSPECTION TEAM (AIT) * . . * . . . . . * * * * . . * . . . . . . . . . * . . . . * . * . * . . . . * .
1
A.
Background . . . * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . . . . . . . . . . . .
1
B.
Formation of AIT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1
C.
AIT Charter - Initiation of Inspection...................
1
D.
Persons Contacted........................................
3
E.
Description of Operations Shift Staffing at the Time
of the Event ........................... * . . . . . . . . . . . . . . . . . .
3
F.
Design Description ****...***.**.*.*.......*******..*.***.
4
II.
DESCRIPTION OF EVENT..........................................
4
A.
Overview of Event fpr Surry Unit 1 ...*......*.**....*....
4
1.
Initial Conditions . ..... ... ......... .. .. .... .. . .. ...
4
2.
Event De~cription ..*.......***.......*....*....**...
4
3.
Licensee Actions Following the Event................
5
B.
Deta i 1 ed Sequence of Events- * . * * . . . . . . . . . . . . * * * . . . . . . . . . . .
5
III.
SUBSEQUENT LICENSEE ACTIONS ...**......................... ~~...
9
A.
Refill of the Reactor Cavity From the Spent Fuel Pool ...*
9
B.
- Deviation and Human Performance Evaluation System
Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10
C.
Incore Instrument Room Cleanup *.*.......... i ************* 12
D.
Lack of Engineering Review and Subsequent Fuel Reload .**. 12
E.
IOER Evaluation of the Event .................*.*......*.. 12
F.
IOER Evaluation Presented to Station Management and NRC .. 15
G.
Justification for Continued Operation .........**...*.*... 16
IV.
EQUIPMENT STATUS, FAILURES/MALFUNCTIONS, AND ANOMALIES ........ 17
A
IEB 84-03 Lic~nsee Response and Modification ........**. ~.
17
B.
Significan~e of Seal Failure ............... ~ ............. 20
i
C.
Maintenance Activities
20
1.
Local Leak Rate Testing ...............*.........*... 20
2.
Maintenance History . . . . . . . . . . . . . . * . . . . . . . . . . . . . . . . . .
21
D.
Refueling Cavity_ Floor Seal_ ...........*....*............. 22
1.
Refueling Cavi~y Floor Seal Design Application ...... 22
2.
Equipment Vendor Involvement .....*.................. 23
V.
RADIOLOGICAL CONSEQUENCES .................................*. ~.
24
VI.
FINDINGS OF THE AIT . . . . . . * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
25
A.
Radiological Consequences .......................... :. . . . .
25
B.
Failure Investigation ............*........................ 26
C.
Modifications .**...*.....................*............... 26
D.
Installation and Test of Refueling Cavity Floor Seal .. ~ ..
26
E.
Local Leak Rate Test ..................................... 26
F.
Inadequate Instructions and Drawings . . . . . . . . . . . . . . . . . . . . .
27
G.
Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
27
"VII.
GENERIC IMPLICATION OF SEAL FAILURE***************************
28
VIII.
ROOT CAUSE DETERMINATION ...................................... 28
IX.
CONCLUSIONS ..****..***..*..* ; * . * * . . * * . . . . * . * * * * . . . * . * . . * * . * . . *
28
X.
EXIT INTERVIEW . .............................................. . 29
ii
APPENDICES
APPENDIX 1
PERSONS CONTACTED
APPENDIX 2 -
ACRONYMS AND ABBREVIATIONS
APPENDIX 3 -
DESIGN DESCRIPTIONS
A.
Refueling cavity floor seal
B.
Instrument air system
C.
Nitrogen back-up system
D.
Upper core internals storage
iii
..
' ** t
REPORT DETAILS
- I.
INTRODUCTION -
FORMATION AND INITIATION OF AUGMENTED INSPECTION TEAM
(AIT)
A.
Background
Surry Units 1 and 2 are Westinghouse (W) pressurized water reac*tors
(PWR) with Stone & Webster designed sub-atmospheric containments.
The units are located five miles south of Williamsburg, Virginia,
on the James River in Surry County~ Virginia.
Unit 1 went critical
in July, 1972 and was declared commercial in December, 1972.
On Tuesday, August 30, 1988, the resident inspectors became aware
of a report by the Independent Offsite Evaluation Review (IOER)
group relating to an event involving borated water leakage through
- the Unit 1 refueling cavity floor seal.
This event occurred on
May 17, 1988, during the Unit 1 refueling and maintenance outage.
This information was provided to regional management after prelim-
inary assessment by the residents.*
B.
Formation of AIT
- On the morning of Wednesday, August 31, 1988, the acting Regional
- Administrator, after further briefing by the regional and resident
staff and consultation with senior NRC management, directed the
dispatch of an AIT headed by the Section Chief of the Regfon II
Operational Programs Section.
The team included participation by
the Office of Nuclear Reactor Regulation *
. C.
AIT Charter - Initiation of Inspection
The Charter for the AIT was prepared on August 31, 1988, and
the AIT members arrived at the Surry site on September 1, 1988.
Security badging was completed for the team, and the special
inspection commenced with an entrance meeting and briefing by
licensee management at 1100 hours0.0127 days <br />0.306 hours <br />0.00182 weeks <br />4.1855e-4 months <br /> on September 1, 1988.
The
Charter for the AIT speci!ied the following:
1.
Develop and validate the sequence ~f events associated with
approximately 15,000 gallons of borated water leakage from
the Unit 1 refueling cavity through the refueling -cavity
floor seal which occurred during the approximate time frame
of May 17, 1988, while Surry Unit 1 was in a refueling outage.
Our specific concerns which require evaluation include:
(1) the potential degradation of safety-related instrumen-
tation and equipment resultant from exposur~ to corrosive
borated water, (2) adequac~ of operator response during the
\\ .
l
-.
2
incident; (3) adequacy of the positive "J" seal design to
.prevent leakage of this type on Surry Unit 1 or Unit 2 and
potential generic implications, (4) extent and significance
of personnel radiation exposures during event, (5) adequacy of
low head safety injection to replace the leakage, (6) extent
of failure and safety significance of the failure of the
instrument air, backup nitrogen supply, and related seals and
equipment sufficient to support conclusions regarding the
safety of continued pl ant operations, (7) adequacy of manage-
ment evaluation of the event both with respect to s~ope and
timeliness, and (8) licensee reporting of the event.
Key
items the AIT should emphasize _incJude all equipment malfunc-
tions, major plant evolutions/status changes, operator errors,
licensee management/support organization response, and reports
made to the NRC.
2.
Evaluate the significance of the event with regard to
radi ol ogi cal consequences, safety system performance, and
plant proximity to-safety limits as defined in the Technical*
Specifications.
3.
Evaluate the accuracy, timeliness, and effectiveness with
which information on this event was reported to the NRC.
4.
For each seal or related equipment malfunction, to the extent
practical, determine:
a.
Root cause.
b.
If the equipment was known to be deficient prior to tne
event.
c.
If equipment history would indicate that the equipment
had been historically unreliable or if maintenance or
modifications had been recently performed.
d.
Any equipment vendor involvement prior to or after the
event.
e.
Pre-event status of surveillance, testing, (e.g., Section
XI), and/or preventative maintenance.
-
.
f.
The extent to which the equipment was covered by existing
corre*ctive action programs and the implication of the
failure with respect to program effectiveness.
5.
Evaluate the licensee's actions taken to verify equipment
operability.
6.
Identify any human factors/procedural deficiencies related to
this event.
----- ---~~~
\\ '
!
i
I
-
3
7.
Through operator and technician interviews, determine if any
of the following played a significant role in the event;* plant
material condition; the quality of maintenance; or the respon-
siveness of engineering to identified problems.
Unless these
concerns involve immediate safety issues, team actions. should
be limited to communicating the concerns to NRC management.
D. -
Persons Contacted
Those persons contacted by the AIT are identi-fied in Appendix 1.
E.
Description of principal Operations Shift Staffing at the Time of
- the Event
Abbrevi ati ans for the pri nci pal Operations Staff are used for
convenience throughout the report. The following brief explanation
of each posjtion is provided:
Shift Supervisor - A Senior Reactor Operator (SRO) responsible
for both Vnit 1 and Unit 2 operations.
While on shift he/she
is also the unit supervi-sor for one of the two units.
USS
Unit Shtft Supervisor - The junior of the two SROs on the
shift and responsible for the other unit.
STA Shift Technical Advisor - He/she is assigned to the shift to
advise the SS on matters pertaining to the engineering aspects
of assuring safe operations of the plant.
-
-
CRO
Control Room Operator - A licensed reactor operator respon-
sible for the operation of his/her assigned unit.
RS
Refueling Supervisor - An SRO responsible for all fuel move-
ment activities.
Containment Supervisor - An SRO responsible for overall opera-
tions activities in containment other than fuel movement.
UTS -Unit Test Supervisor - An SRO responsible for Type C testing
of containment- penetrations and repair of their associated
components.
Severa 1 non-1 i censed operators work under the
direction of this individual in fulfilling his responsibili-
ties.
-
Non-Licensed Operator - A non-licensed operati~ns department
i_ndividual trained in the location, operation, and safety
significance of plant equipment in his work area.
Reports to
- one of ;he CROs or supervisors des~ribed above.
These and other acronyms and abbreviations used in this report are
iaentified in Appendix 2.
' ' ,.
4
F.
Design Description
Design descriptions for the major equipment and systems discussed
in the report are provided in Appendix 3.
II. Description_ of Event
A.
Overview of Event for Surry Unit 1
1.
Initial Conditions
2.
On the morning of May 17,- 1988, Surry, Unit 1 was in the
mi9dle of a refueling and maintenance outage.
The reactor
- vessel was defueled (all fuel had been transferred to the
spent fue*l pool).
No fuel movement was in progress.
The
reactor cavity was flooded to approximately 27 feet and
the spent .fuel pool was isolated.
Contract personnel, W
were performing work from the refueling bridge on the upper
internals package thermocouple conduits.
An operations
department group was performing Local Leak Rate Tests (LLRT)
and maintenance on various containment penetrations.
Unit 2 had experienced an automatic reactor trip .from mo
- percent power with a nianua l sa.fety injection early on the
morning of May 16, 1988.
Following the trip, the unit
experienced problems associated with auxiliary feedwater (AFW)
flow to the
11A
11 steam generator.
Evaluation and trouble-
shooting of the AFW flow problems were still receiving manage-
ment and operations staff attention on .May 17, 1988.
Event Description
On May 17, 1988, while preparing to repair instrument air
(IA) valve, l-IA-849, an NLO requested between 0800 and 0830
hours, via the control room, that IA to Unit 1 containment be
isolated (this was necessary to facilitate repair of the
valve).
Upon entering the
11C
11 loop room (located in contain-
ment) he observed water cascading down the wa 11 s through
the reactor loop piping penetrations.
His first response was
to inform the control room and have IA re-established to the
containment and his second was to determine if the nitrogen
bottles were supplying pressure to the refueling cavity floor
seal. He noted that one of the nitrogen bottles was empty and
the pressure regulator on the other bottle was misadjusted.
This prevented it from being able to pressurize the seal.
He
then adjusted the regulator to supply pressure to the seal and -
noted that the leak-decreased.
' '
5
This serie~ of events resulted in nearly 30,000 gallons (which
equates to approximately three feet of water in the refueling
cavity) of water being drained through the deflated refueling
cavity floor seal.
The reduction in cavity level resul°ted in
increased radiation level on the Unit 1 operating deck.
Work
on the upper i nterna 1 s package h*ad been suspended by the
health physics (HP) technician due to increased radiation
levels.
3.
Licensee Actions FQllowing the Event
The NLO, noting the water leak in the
11C
11 loop room informed
the control room.
The CRO and SS were informed of the
problem.
The CRO noted that the incore sump high level alarm
had alarmed.
Attempts to start the incore instrument room
sump pump failed.
An NLO was sent to check out the incore
instrument room sump pump breaker at the motor control center.
It was noted that the breaker had tripped on thermal overload
and it would not reset.
This may have indicated that the
motor was submerged.
Sometime between 0830 hours0.00961 days <br />0.231 hours <br />0.00137 weeks <br />3.15815e-4 months <br /> and 0900 hours0.0104 days <br />0.25 hours <br />0.00149 weeks <br />3.4245e-4 months <br /> the Operations
Coordinator entered the control room.
The SS informed him
that there had been
11 a foot or so drop
11 in cavity water levei,
and that HP had suspended* work on the operating deck due
to increased radiation levels.
The Operations Coordfoator
immediately went to inform the Assistant Station Manager.
Sometime later on May 17, 1988, the Superintendent of Opera-
tions and the Operations Coordinator insp~cted the
11C
11 loop
room.
No problems were identified.
The Station Manager was
also informed of ~he event that day.
The team was unable to determine whether any additional evalu-
ations or other actions pertinent to the event were taken
by the 1 i c*ensee unti 1 two days 1 ater when an STA prepared
deviation report Sl-88-422.
B.
Detailed Sequence of Events
SURRY UNIT 1 - REACTOR CAVITY SEAL FAILURE
MAY 15, 1988
Time
(EST
Hours)
0554
Data Source
CRO. Log-
Item
Periodic Test; PT-10 Reactor
Coolant Leakage walkdown. com-
pleted satisfactory. Containment
- sump in-leakage calculated to be
..
Time
(EST
Hours)
Data Source
MAY 16, 1988
0200
0223
1433
1504
1610
SS Log
CRO Log
SS Log
CRO Log
SS Log
CRO Log
Type C Test Log
- NLO Interview
6
Item
8.2 gpm.
Nitrogen bottle pres-
sures ( to the refueling cavity
floor seal) found to be 1800 psig
and 2200 psig.
Verified Instrument Air supply to
Unit 1 Containment instrument
air header being supplied through
valves 1-IA-446, and 447.
PT-10 Reactor Coolant Leakage
walkdown completed satisfactory.
Containment
in-leakage
calculated to be 9.9 gpm.
Instrument air to Unit 1 contain-
ment isqlated to investigate a
problem associated with instru-
ment air valve, 1-IA-849.
The
nitrogen bottles were verified as
being aligned to the refue 1 i ng
cavity floor seal.
Instrument air re-established to
Unit 1 containment.
Instrument air was valved out
to Unit 1 containment (verified
that the refueling cavity floor
seal was being supplied by the
bottles).
Attempted
to seat valve 1-IA-849, the valve
still leaks.
Instrument air
returned to service.
The
NLO performing the valve
manipulations indicated that upon
exiting containment he requested
that his relief perform
11 indepen-
dent verification". associated
with instrument air and nitrogen
back-up supply valve line~ups.
r
' .
Time
(EST
Hours)
Data Source
MAY 17, 1988
- NLO Interview
0223
SS Log
0230
Chart recorder
0830
CRO Log
- CRO Interview
- USS Interview
7
Item
This
NLO indicated that the
verification requested from the
previous shift was completed
between 0130 hours0.0015 days <br />0.0361 hours <br />2.149471e-4 weeks <br />4.9465e-5 months <br /> and 0200
hours.
The verification con-
sisted of insuring nitrogen and
instrument air supply valve line-
ups were correct as we 11 as *
verifying that, if required, the
nitrogen bottles would in fact
supply the seal.
PT-10 Reactor Coolant Leakage
walkdown completed satisfactory.
Containment
in-leakage
calculated to be 13.4 gpm. The
nitrogen bottle pressures to the
refueling cavity floor seal were
verified to be 1500 psig and 1800
psig.
The ~hart recorder in the control
room which plots -input from
RMS-162,
manipulator
crane
radiation monitor, indicated the
measured radiation _levels to be
approximately 5mr/hr.
Isolated instrument air to con-
tainment for PT-16.4, Containment
Isolation Valve Leakage.
The operator recalled that during
the event, the incore room sump
high level alarm did annunciate.
The setpoint for this alann is
18 inches.
He recalled the incore instrument
rqom sump high level alarm being
i 11 umi nated.
Additfona lly, he
noted *attempts to start the
incore room sump pump failed.
' .
Time
(EST
Hours)
0852
0855
0857
0911
0921
Data Source
CRO Log
- Chart Recorder
SS Log
SS Log
8
HP Supervisor Log
SS Log
Item
Valved instrument air back into
containment after noting contain-
ment sump level increasing and
discovered that one back-up
nitrogen bottle to the refueling
cavity floor seal was empty and
th*e other was at 1500 psi g but
did not appear to be* supplying
the refueling cavity floor seal.
The chart recorder in the control
room which plots input from
RMS~162, manipulator crane radia-
tion monitor,
indicated the
measured radiation levels increas-
ing to approximately 35mr/hr.
This increase occurred between
0830 and 0900.
Received a report of re*fue 1 i ng
cavity floor seal inflatable
seal leakage. Instrument air to
containment had been isolated to
support operations work.
Instrument air restored to
containment.
Water level in the reactor cavity
has dropped.
General area around
the cavity was up to lOOmr/hr.
Work on RWP No. 88-RWP-1507 was
stopped until water- level is
raised by operations.
bottle to the refueling cavity
floor seal ring was completely
depressurized.
The second bottle
gage indicated 1500 psig, however
the regulator was mi sadjusted.
-The sea 1 was repressuri zed and
preparations are *in progress to
res tore 1 eve*1 in the ref ue 1 i ng
cavity using primary grade (PG)
water.
..
Time
(EST
Hours)
0958
1005
1105 *
1105
Data Source
SS Log
CRO Log
SS Log
Chart Recorder
SS Log
9
HP Supervisor Log
Item
Received a report from HP that
water is leaking around concrete
- access plug_to the incore instru-
ment sump room 1 oca ted in the
containment basement.
Leak rate
is estimated at four gpm.
Con-
tainment sump pump is keeping up
- with the leakage.
Incore sump
pump motor control breaker ther-
mal overlo.ads tripped.
Possible
cause, pump motor submerged.
The fuel transfer tube isolation
valve open approximately five
turns to raise refueling cavity
level.
Chart recorder for RMS-162, manip-
ulator crane radiation monitor,
recorded radiation levels begin
a decreasing trend.
Startin'g
at 1000 hours0.0116 days <br />0.278 hours <br />0.00165 weeks <br />3.805e-4 months <br /> at approximately
35mr/hr and ending at 1100 hours0.0127 days <br />0.306 hours <br />0.00182 weeks <br />4.1855e-4 months <br />
with approximately lOmr/hr.
( It
- should be noted that this decreas-
ing trend coincides with the
refi 11 of the refueling . cavity
from the spent fuel pool1
Secured filling the refueling
cavity through the fuel transfer
tube. Spent fuel pool was lowered
approximately eight inches.
Water 1 evel in the cavity has
returned to normal.
- Indicates event is entered at the approximate time frame.
III.
SUBSEQUENT LICENSEE ACTIONS
A.
Refill of the ~eactor Cavity From the Spent Fuel ~ool
Following the event the licensee, in order to recover level in the
refueling cavity, opened the fuel transfer tube isolation valve
five turns.
This occu~red approximately two hours after the event
and the valve remained opened for approximately one hour.
This
resulted in an eight-inch drop in spent fuel pool water level.
The following day, May 18, the valve was opened again. This time,
the level in the spent fuel pool was reduced five inches. The AIT
was provided information which indicated that a one-inch decrease
in spent fuel pool water level was equal to approximately 1440
gallons.
U_sing the above information, the inspectors determined
that approximately 18,700 gallons of water was transferred from the
spent fuel pool to the refueling cavity to partially make up for
the water lost during the seal leak.
The AIT questioned the licensee*s* level recovery method and
requested a copy of the procedure which was used.
The licensee
indicated that there was no operating procedure which addressed
this evolution.-
During the time period between the two cavity
fills, the spent fuel pool was refilled with PG water.
After,
refilling, the spent fuel pool was sampled to verify boron
concentration to be greater than 2000 ppm.
The AIT expressed
concern that the above method of refilling the cavity was performed
without assurance that the seal could meet its intended design
function and without procedures.
The AIT also noted that additional water was added to the refueling
cavity from the refueling water storage tank just prior to refuel-
ing the vessel in order to establish proper refueling level.
B.
Deviation and Human Performance Evaluation System Reports
Two days after the event, May 19, 1988, an STA *prepared* Deviation
Report (DR) Sl-88-422.
Within the report possible causes leading
to the event were identified.
They ~ere human error, procedure/
drawing error and/or design.
The Corrective Action section of
the report dated June 13, 1988, indicated
11 no corrective action,
management informed - Surry Human Performance Evaluation System
(HPES) report 88-012, unresolved for human error.
Implementation
of design change similar to Unit 2, Engineering Work Request (EWR)85-200.
11
This DR was subsequent~y reviewed by the Site Nuclear
Safety Operation Committee (SNSOC) on July 7, 1988.
HPES report 88-012 was forwarded to the SNSOC cha*; rman* on June 13,
1988.
As in the case of the DR, the HPES report concerned itself
primarily with human error surrounding the event.
The conclusion
reached in this report was that during the time frame of 0100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br />
to 0830 hours0.00961 days <br />0.231 hours <br />0.00137 weeks <br />3.15815e-4 months <br /> on May 17, 1988,
11an*unauthorized, non-recorded valve
isolation occurred on the norinal air supply to the cavity seal
ring r.esulting in partial loss of cavity level .
11
In addition, the
statement was made that
11the potential hazards that can be created
due to this activity cannot be understated.
11
Finally, the report
stated that
11 unfortunately no specific corrective actions can be
generated from this office
11 *
11
The cover letter indicated that "HPES evaluation could not deter-
mine specifi"c causal human factors that would have contributed
to the event and that the report was being submitted to SNSOC for
information and to assure that appropriate management personnel
were aware of the results."
The AIT reviewed the DR and HPES reports.
The DR dtsposition was
considered superficial in that it failed to recognize other
important factors such as:
possible design deficiencies in the seal;
the fa i1 ure of the "J" seal and operability concerns regarding
refueling activities;
the failure of the back-up nitrogen system to supply the
seal;
inadequate procedures to operate the air and-nitrogen systems;
inadequate drawings to indicate system configuration; and
the generic implications associated with the same seal
- arrangement used on Unit 2.
The HPES report was considered to be inconclusive in that the only
"Human Performance" indicator identified was a "non-authorized,
non-recorded valve manipulation."
The AIT considers other "Human
Performance" indicators pertinent to the event which were not
discussed to be:
-
.0
no identification tags on IA or nitrogen system valves;
0
no drawings depicting IA or nitrogen system configuration.
The AIT also noted that repairs to valve 1-IA-849 were conducted
without procedural guidance.
On August 16, 1988 following the Independent Offsi te Evaluation
Review (IOER) group investigation of the event, a second DR,
Sl-88-0873, was written.
The deviation description identified that
the "J" seal portion of the refueling c;avity.floor seal would not
preclude leakage from t~e refueling cavity as stated in the Updated
Final Analysis Report (UFSAR) 9.12-3 and *in Surry's response to !EB
84-03, dated October 9, 1984.
The DR indicated that "the "J" seal
design is inadequate and would allow leakage greater than the
. available make-up source from on_e low head safety injection (LHSI)
pump* if the inflatable seal failed."
This second DR appeared to be
more complete in its identification and analysis of the deviation.
r
12
C.
Incore Instrument Room Cleanup
The failure of the refueling cavity floor seal resulted in borated
water being deposited in various locations in containment but
primarily in the incore instrument room located below the reactor
vessel.
The water that accumulated*was calculated to have achieved
a level of approximately five to six feet above the floor.
The borated water remained in the room for approximately 30 days.
The incore detector guide thimbles were retracted from the vessel
and- radiological conditions precluded entry.
Once refueling was
completed with the guide thimbles reinserted, radiation levels
were low enough to allow access.
The room was pumped out and the area washed down with purified
water.
There were no special tests performed or wall smears taken
to determine actual water levels.
Following the clean-up effort,
the room was inspected and the results determined to be satisfac-
tory.
The room was sealed and preparations were made to return to
power.
D.
Lack of Engineering Review and Subsequent Fuel Reload
Following the event, even though DR SI-88-422 indicated a probable
cause of the deficiency to be design related, no eng*ineering
evaluation of the *seal design or failure modes were performed.
This oversight was apparently caused by the station
I s be 1 i ef
that the leak was small and over a long period of time, and that
the event stemmed from human error.
As a result, the licensee
did not question the design or its ability to perform its intended
function.
Therefore, no corrective actions or compensatory
measures were implemented by the licensee prior to refueling the
reactor vessel.
The AIT and the licensee determined that the ability to make up for
a refueling cavity floor seal leak exceeded the capacity of one
LHSI pump.
Jt is uncertain how much of the "J" seal was actually
displaced, thus the anticipated leak rate could-be much higher.
The most significant concern is that refueling operations were
conducted (all the fuel was reloaded) without confirming that the
seal would perform its intended design function.
E.
IOER Evaluation of the Event
The IOER group received HPES report 88-012 on July 14, 1988.
Their
subsequent review deemed the report to be inconclusive and due to
the concerns raised, an investigation into the event was initiated.
13
On August 17, 1988; the IOER group forwarded to plant management
their findings regarding their investigation of the refueling
cavity floor seal failure at Surry Unit 1.
This investigation
report included a summary of events surrounding the failure of the
seal, the implications of the event, and finally, identification
of concerns and proposed actions in the areas of administrative
controls, technical issues, and ~perations response.
The report identified the most important*question as being "wh~ the
passive
11J
11 seal did not prevent catastrophic leakage and would the
resulting leakage exceed the capacity of the make-up capability
provided?"
Addi ti ona lly, it was stated that "this con*cern focuses
on the potential for uncovering a suspended fuel assembly and the
time necessary to relocate an assembly into a safe position." It
should qe noted*that both the licensee's UFSAR and response to IEB
84-03 state that the passive "J" seal will prevent this from
occurring.
In line with their investigation, the IOER group initiated a
detailed design review of the
11 J
11 seal.
They concluded that "the
lack of a positive backing plate on the seal can allow the upward
displacement of the bulbous portion of the seal due to forces
exerted underneath it. These forces result from the flow of water
past the seal due t"o s_urfa-ce imperfections or seal deterioration."
Additionally, it was stated that "the calculated buoyancy of the
seal in borated water with an air hole in the center is very near
the buoyancy point."
The report went on to further discuss the refueling cavity floor
seal installation procedure, MMP-C-RC-37.
MMP-C-RC-37 requires the
stand-off supports be set at 1 3/16 inches. Calculations performed
by the licensee show that for a 30% compression (which results from
the stand-offs being set at 1 3/ 16 inches) there wi 11 be about
3/8-inch of surface contact between the "J" seal and mating
surface.
Due to the lack of a backing plate, there is nothing
to guartl against a reduction in this surface contact.
In addi-
tion, it was stated that "if the seal were not r~gularly replaced,
res i 1 i ency is lost and the abi 1 ity of the sea 1 to accommodate
surface imperfections is lost."
As previously stated, the final portion of the investigation report_
i dent i fi ed several_ conce.rns and proposed actions in the areas of
administrative controls, technical issues and operations response.
-
.
In the area of administrative controls the following concerns were
identified:
"A station deviation report was not immediately submitted to
initiate a review of the event and to ascertain reportability.
11
"HPES report 88-012 was submitted without fully assess.i ng the
event or the ramifications of the event."
., .
14
-
11The UFSAR states that the "J" sea 1 wi 11 prevent 1 eakage in
the event of a failure of the inflatable seal.
This design
basis was reiterated in response to IEB Significant Operating
Experience Report, 84-03, 85-01 and internally to IEIN 84-93."
To resolve these concerns the proposed actions included:
"Submit a station deviation report to document evaluations and
determine reportabi 1 ity."
"Sta ti on personne 1 should be reminded of the requirements
for submitting deviation reports.
11
"HPES evaluators should be reinstructed on the necessity of
performing detailed evaluations, submitting deviation reports
for operational events beyond human factors and the need to
have a thorough review of reports prior to issuance.
11
In the area of technical issues the following concerns were noted:
"The potential flowrate past _the "J" seal in its current
design, may exceed the capacity of a single LHSI pump."
"Based on leakage experienced and discussion with the vendor
it appears the design of the**seal ring-is not an acceptable
app 1 i cation."
"Evaluate the residue of boric acid that accumulated on the
reactor vessel walls which was* not removed."
"The vendor recommends the inflatable seal should have
increased strength provided by fiber reinforcement.
In
addition, the sealing surface contact surface area should be
increased."
To resolve th~se concerns the proposed actions included:
"Determine the maximum fl owrate that can occur and compare
thi_s to _the make-up capability of a LHSI pump."
'!Investigate possible seal ring design improvements that can
be implemented."
"Evaluate the impact of boric acid residue on the carbon steel**
reactor vessel exterior walls."
"Review the design of the nitrogen *-back-up system and imple-
ment improvements as required."
"Review vendor recommendations for need."
In the area of operations the following concerns were noted:
11 How did IA to the inflatable seal become isolated.
It was
indicated that the local IA supply valve was found c*losed,
however logs indicate the problem occurred when IA was valved
out to support Type C LLRT on penetration 47.
11
110perators did not enter the appropriate procedure for a loss
of refueling cavity level.
11
11The fue 1 transfer gate va 1 ve was opened to restore l eve 1
in the refueling cavity.
G*iven the potential for further
leakage and a potential failure of the gate valve to close,
spent fuel pool level could have been significantly reduced.
This action was not based on procedural guidance, is an
unadvisable method and contradicts the requirements of
Technical Specification (TS) 5.4.D.
11
"AP-22
11Fuel Handling Abnormal Conditions
11 and AP-27
11Loss of
Decay Heat Removal Capability
11 provide inadequate guidance to
operations personnel on a rapid loss of refueling cavity water
level."
To resolve these concerns the foilowing action was identified:
"A review of current procedure controls for a loss of refueling
cavity level should be performed.
11
F.
IOER Evaluation Presented to Station Management and NRC
After identification of the above concerns by the IOER group, the
engineer who prepared the IOER report submitted a station DR in
accordance with procedure. That DR, Sl-88-0873, which is discussed
in section III B of this report, identified a design problem
associated with the "J
11 seal portion of the refueling cavity floor
sea 1.
After receiving the DR, the station safety committee
requested and received a presentation on the IOER concerns which
resulted in the DR.
This presentation was made at the Surry Power
Station on Thursday, August 25, 1988.
On that day, one of the NRC
residents walked into the meeting near the end of the presentation,
but was not aware of the problem at that point~
The safety committee concluded that some of the information pre-
- sented was incorrect and requested the IOER engineer to provide
additiona 1 information to justify some of the IOER concerns.
On
Friday, August 26, 1988, the Assistant Station Manager for Licens-
ing and Safety provided information on the IDER presentation to the
NRC residents; however, a copy of the IOER report was not provided .
~
I
.* . . .
16
-
This Manager indicated that design deficiencies identified in the
report were under review and would be addressed the following
week.
The resident inspectors became aware of the IDER report on
August 30, 1988.
The Station Manager provided the residents a copy
of the report on August 31, 1988.
The licensee made a 10 CFR 50.72
report of the rapid decrease in refue1ing cavity water level on
September 1, 1988.
G.
Justification for Continued Operation
On September 2, 1988, the licensee provided a Justification for
Continued Operation (JCO) of Unit 1 as requested by the NRG.
This JCO relied on and transmitted the licensee's engineering
evaluation, Technical Report PE-0005 dated September 1, 1988,
of the potential effects of borated water flooding of the incore
instrument room as related to the then *present and continued safe
operation of the facility.
The licensee's engineering.evaluation assumes that initial leakage
past the "J" seal would have been collected by the drip pan.
This
leakage would have then been carried away via drain piping to the
containment sump.
However, as 1 eak fl ow increased beyond the
capacity of the drip pan, the flow path would .have been primarily
down the exterior of -the reflective insulation~ over the neutron.
- shield tank a"nd into the incore instrument room.
In addition, the
licensee indicated a small amount of leakage could have flowed onto
the reactor vessel nozzle reflective insulation and flowed and/or
splashed along the reactor coolant piping into the loop rooms.
The licensee's analysis states that all equipment in the loop
rooms is qualified for chemical spray.
Therefore, the subject
leakage/flooding would in no way prevent any equipment in the loop
rooms from performing their design functions.
Within the incore instrument room, 11 critical components were
identified.
Of these, three are constructed of austenitic* stain-
less steel which is not adversely affected by wetting with borated
water;
These three are the reflective i nsul ati on, the reactor
coolant piping, and the incore instrumentation guide tubes.
One component received spray but was probably not submerged.
Its
exposed surface is a 347 stainless steel sheath and other non-
stainless steel components are hermetically sea~ed in thi~ sheath.
Four of the components were coated with design bases accident
qualified paint which is not adversely affected by boric acid.
These were the supply and return lines for the neutron shield tank
coolers, the containment mat liner plate, the neutron shield tank
and the incore instrumentation guide tuQe supports.
'
17
One component, the Gamma Metrics Excore Neutron Detector is
composed of a signal cable and jun*ctfon box.
The junction box is
unprotected carbon steel with SS cabling attached.
This junction
box is sealed with a silicon 0-ring.
(It is not clear whether
this junction box is above or below the six foot water level.)
Even if the junction box was submerged, it should have only
suffered a loss of some 0.001 inch of its 3/8 inch thickn~ss.
The
cabling consists of a solid copper coaxial conductor insulated
with Kapton tape encased in a flexible stainless steel hose and
covered by woven glass fiber.
The remaining two components were briefly wetted, protected by
geometry, and would have suffered less than 0.001 inch material
1 ass.
These two were the reactor vesse 1 (primarily the flange)
and the reactor vessel sliding supports.
These latter supports
were also protected by a lubricant.
.
.
The licensee concluded in its JCO that
11As a result of these
investigations (described above), the flooding of the incore
instrument room with borated water wi 11 * have no adverse effect on
continued safe operation of the plant.
11
The AIT concluded, following an evaluation of. the JCO that the
1 i censee had adequately addressed the potenti a.1 degradation of
safety-re 1 ated instrumentation and equipment from exposure of
corrosive borated water.
IV.
EQUIPMENT STATUS, FAILURES/MALFUNCTIONS, AND ANOMALIES
A.
!EB 84-03 Licensee Response and Modification
The licensee's response to !EB 84-03 dated October 9, 1984, indi-
cated an evaluation of the potential for and the consequences of a
refueling cavity floor seal failure had been performed.
Their r~sponse contained a brief design description detailing the
operation of both the inflatable seal, and the passive
11J
11 seal.
In addition, the licensee indicated that procedures require a
pressure drop test on the inflatable seal as well as a visual
inspection of the
11J
11 seal prior to installation.
Although not
stated, it appears this information was provided to assure the NRC
that even if seal degradation were occurring, it would be
discovered prior to seal use.
They indicated that at least one makeup path was available at all
times during refueling.
Therefore should the pres.surized seal
fail, any of the available makeup paths could be used to maintain
water level, while the passive
11 would preclude leakage.
..
18 -
-
They further explained that although a catastrophic failure is not
credible because of the design, should such a failure-occur, the
elevation of the spent fuel transfer system would prevent a fuel
assembly from being uncovered.
Additionally*, a barrier in the
spent fuel storage pool precludes the draining of the pool's water
to less than 13 inches above the fuel racks.
The licensee concluded that a complete failure of the refueling
cavity floor seal was not a credible event.
In addition, based
on their evaluation and seal design differences between the two
facilities (Surry and Haddam Neck) they believed the seal assembly
employed at Surry to be adequate.
Finally, as a result of the
IEB review, the licensee revised AP-22, Fuel Transfer Equipment
Malfunction, to provide opera-tor actions to be taken in the event
of a rapid decrease in refueling cavity water level.
The procedure delineated immediate operator actions which consisted
of the following:
0
0-
0
Providing makeup by several means,
Placing the fuel assembly in the safest position possible. If
a fuel assemble was jn the maniptJlator the p*rocedure required
returning it to the core, and
Instruction to. close the fuel transfer tube gate valve,
isolating_the-spent fuel pool from the refueling cavity~
.Additional procedural actions provided were:
0
.
0
0
Isolation of the leak or rupture,
Monitoring residual heat removal
(RHR) pumps for proper
operation and signs of cavitation, and
Rectification of the problem and resumption of norma} activi-
ties as directed by the SS.
In April of 1987 as part of an intended procedure upgrade program,
many of the corrective actions were deleted from Abnormal Procedure
AP-22.
The AIT determined that AP-22, which was available to
operators on May 17, 1988, was inadequate to deal with a decrease
in refueling cavity level.
It was also noted that there were no d1rections in the procedure
for inspection of the IA and/or back-up nitrogen supply systems
- either prior to or after the procedure upgrade .
19
The AIT concl~ded that the licensee was not in compliance with the
!EB 84-03 response.
A catastrophic failure was probable, operating
procedures were not adequate to address the event, and an LHSI pump
(3250 gpm) will not be able to maintain cavity water level.
The
AIT also identified an inadequacy in the licensee's administrative
control process that assures that commitments to the NRC are
maintained.
Sys tern Modification .
Subsequent to the issuance of !EB 84-03, the licens~e
performed a review of the facility's refueling cavity floor
seal.
After the review the licensee concluded that it would
be desirable to incorporate a back-up air supply for the
refueling cavity floor seal.
This would provide redundancy
and thus maintain the inflatable seal inflated in case of IA
failure.
On April 4, 1985, EWR 85-200 was approved to. support the
design and installation of a nitrogen back-up supply system
on Unit 2.
During this inspection the AIT determined that
a similar nitrogen back.:.up supply system was installed on
Unit 1.
It appears that the system was installed under a
temporary modification during the 1984 Unit 1 refueling
outage.
However, the licensee could not produce any documen-
tation which supported the finalized installation similar to
EWR-85-200 used on Unit 2.
Since the AIT, the 1 icensee has
provided information which indicates that the temporary
modification was closed out following the outage with no
followup action.
EWR 85-200 discussed several conclusions and recommendations.
A review of the available documentation indicates several
problems with the Unit 1 and Unit 2 nitrogen back-up supply
systems.
These problems are enumerated below:
EWR 85-200 recommended that check valves to prevent air
backflow and relief valves to prevent overpressurization
be installed.
Discussions with the licensee indicated
that these components are installed on Unit 2 but not on
Unit 1.
In either case (Unit 1 or Unit 2) it is diffi-
cult to ascertain specific system configuration due to
the lack of as-built drawings.
EWR 85-200 recommended that procedure MMP-C-RC-037,
Installation, Inflatfon and* Removal of Reactor Cavity
Inn~r Seal Ring, be revised to include steps for set.ting
and testing the pressure regulators, ana relief valve,
and steps to install and remove the nitrogen bottl e*s.
A
review of MMP-C-RC-37, used during the May 1988 Unit 1
refueling outage, indicates that none of these recom-
mendations had been implemented.
This procedure is
applicable to Units 1 and 2;
B.
20
EWR 85-200 recommended that the nitrogen bottles have
their pressure regulators set at 20 psig.
In addition,
it recommended that the existing IA pressure regulators
be reset to 25 psig versus 20 psig.
A review of
MMP-C-RC-037 used during the May 1988 Unit 1 refueling
outage indicated that the IA pressure regulator was still
set at 20 psig, per step 5.5.2.
Significance of Seal Failure
During this inspection it was determined that approximately three
feet of water was drained from the refueling cavity over a rela-
tively short period of time.
The AIT was provided information .that
the refueling cavity contained approximately 240,000 gallons of
water when filled to a depth of 26 feet.
The AIT calculated that a
three foot drop in cavity level would result in a loss of approxi-
mately 27,800 gallons of water.
The licensee stated in the AIT
exit on September 3, 1988, that the majority of water was drained
in approximately* four minutes.
Using four minutes as the time in
which the water was drained and 27,800 gallons as the quantity of
water drained, the AIT determined that the leakage through the
refueling cavity seal was approximately 6,950 gallons per minute.
The c!esign flow rate of one*LHSI pump as specified in the UFSAR
is approximately 3250 gallons per minute at a design discharge
pressure of 225 feet of water.
Therefore, one LHSI pump would not
. keep up with the calculated leakage identified above.
It was noted
from operator logs during the event that the LHSI pumps were not
available.
C.
Maintenance Activities
1.
The licensee, on May 16,1988, was conducting LLRT on contain-
ment penetration No. 47.
The testing was being conducted
in accordance with PT-16. 4,
11Conta inment I sol ati on Valve
Leakage," dated April 8, 1988.
Penetration 47 supplies IA
to a two-inch IA pipe header inside containment. This header
distrioutes air to various components including the inflatable
refueling cavity floor seal.
The purpose of the test being
conducted was to measure back leakage through check valve
1-IA-939.
See IA description in Appendix 38 and Figure 2.
~foblems aisociated with se~t leakage on 1-IA-849 prevented
the test from being completed.
1-IA-849 is one of two valves
required to be closed in order to isolate the penetration. -
To expedite repairs, a contractor was brought in but, due to
time constraints and a lack of spare parts, repair efforts
were schedu.led to_ continue -the following day, May 17, 1988.
- 21
On May 17, 1988, at about 0830 hours0.00961 days <br />0.231 hours <br />0.00137 weeks <br />3.15815e-4 months <br />, repair activities
commenced on 1-IA-849.
Operations, to support this effort,
had isolated IA to containment.
The NLO assigned to this work
entered the
11 C
11 loop room to verify the nitrogen bottles were
supplying the seal (see Figure 2) at which time he discovered
water cascading down the walls.
2.
Maintenance* History
Maintenance had been performed on both the
11J
11 seals and the
inflatable seal.
In May.of 1986, the
11 J" seals, associated
fasteners and retainers were rep laced under work request 333552.
This work was accomplished due to natural end of
life.
MMP-C-RC-37, Installation, Inflation, and Removal of the
Reactor Cavity Inner Seal Ring, dated April 12, 1988,
requires:
(1) a pressure drop test on the inflatable seal;
(2) a visual inspection of the seals; and (3) a visual
inspection of the
11 J
11 seal seating surface.
All of the.
aforementioned tasks are to be completed prior to seal
assembly installation.
The pressure drop test requires that. the i nfl atabl e seal be
inflated to 20 psig.
Following inflation, the air source is .
removed.
The acceptance criteria specifies that 20 psig be
maintained for 10 minutes.
The test performed during the 1988 Unit 1 refueling outage
failed to meet this acceptance criteria.
Once the seal was
inflated, and the air source removed; the pressure dropped to
16 psig in the first 5 to 6 minutes.
It then held at this
pressure for the remaining portion of the test~
The visual
inspection noted evidence of surface nicking and scraping.
Each of these deficiencies resulted in a Quality Control (QC)
rejection.
The licensee performed an evaluation of the noted deficiencies
under EWR 88-116.
The EWR indicated the calculated leak rate
for the seal to be six to eight scfh.
This was determined to
be well within the capacity of the .nitrogen bottles which are
designed for a 25 scfh leak rate over 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
It al so
concluded that the deficiencies noted during the visual
inspection were assumed to be caused by seal handling during
decontamination efforts.
Finally, the EWR concluded that even in the event of a com-
plete failure, deflation- of the inflatable seal, the. back-up
passive "J
11 seal will prevent excessive leakage.
22
The visual inspection performed on the
11J
11 seal seating
surface a 1 so resulted in a QC rejection.
This was based on
evidence of suspected boric acid and oii residue, fixed rust
- and loose metallic flakes.
In addition, a six-inch long
scratch was also identified.
The 1 icensee performed an eva 1 uation of these deffci enci es
under EWR 88-148.
While generating the EWR, it was expanded
to include pitting, denting, hammer blows, and discoloration
as well as a sharp edge apparently caused by metallic contact.
The resolution of the identified deficiencies included the
following:
0
0
0
0
The defects did not encompass the entire width of the
seating surface at any location around the circumference
of the flange.
The defects were found to be less than 1/32 of an inch
indepth with no sharp edges or burrs.
The hammer blows were observed to have characteristics
similar to the defects.
The hammer blows were also identified as being located
outside the actual seating surface and having no affect
on the sealing.
Given the known deficiencies discussed above, contribution to
the event from these items cannot be overlooked.
No inspec-
tion of the seal assembly. was performed following the 1988
refueling activities.
This was due to the licensee's belief
that the event stemmed from personnel errors, and the leak
being small over a long period of time.
The AIT concluded that the licensee's evaluation of the
capability of the nitrogen bottles to maintain a six scfh seal
leak rate was incomplete.
The evaluation never addressed the
nitrogen bottles as a "finite supply."
The operators had no
direction to monitor, record, and trend the quantity of
nitrogen remaining in the bottles and therefore, the likeli- *
hood of nitrogen pressure failure leading to seal failure was
much higher than concluded by the licensee.
D .. Refueling Cavity Floor Seal
1.
Refueling Cavity Floor Seal Design Appli-cation
The refueling cavity fl oar seal design at Su~ry is seismic
category 1 and safety related.
The seal is part of the
refueling cavity pressure boun*dary.
Refer to App*endix 3A and
Figure 1 for a description of the refueling cavity floor seal
design.
. '
23
In an attempt to determine root cause failure, the AIT con-
ducted a review of the available refueling cavity floor seal
documentation.
There is no design documentation available
to describe the mechanics of how the overall seal assembly
operated and no documentation available that verifies the
design adequacy by testing.
In conversations with the vendor Presray it was determined
that the licensee's design was unique in that the seal does
not have a backing plate (located in the area identified as
dimension B in Figure 1 of Appendix 3A).
This backing plate
would a 11 ow better contact between the
11J
11 seal seating
surface and its mating surface.
Initially, the vendor informed the licensee that with the
current design configuration, the
11J
11 seal could be easily
displaced.
This displacement was predicted to be a result of
both buoyancy factors and the action of water flowing under-
neath the seal.
Since the AIT inspection, the licensee has
concluded that due to design tolerances not being controlled,
the
11 J
11 seal could have a 1/8 inch gap between the seating
surface and its mating surface.
With this maximum gap, the
11J
11 seal is flow limiting but to some value in excess of
6000 gpm.
In either case,. the AIT concludes th*at the current design
application is inadequate and that this condition has existed
since initial installation.
There are no design margins
identified relating to th~ vertical and horizontal relation-
ship betwe~n the vessel flange and the cavity floor.
Thus, *
without periodic testing, it cannot be assumed that the seal
would meet its design bases.
Based on this evaluation, the
AIT concludes that the licensee must reevaluate the present design
of the seal ring.
In addition, the seal must be tested to
ensure continued compliance with the design bases.
2.
Equipment Vendor Involvement
The IOER group contacted Presray on August 1, 1988, and the
following items were discussed:
0
0
11 Presray stated that, in the current design configura-
tion, the
11 J
11 seals- could easily be displaced from the
seating *surface due to the action of water flowing
underneath it.
11
11Pr~sray stated that the design of the licensee seal ribg
is unique and in their opinion, requires design improve-
ments to hold the
11J
11 seal in place with a backing plate.
In addition, the inflatable* seal should have a fiber
reinforcement to impr9ve strength and the surface contact
area (footprint) should.be increased."
...
V.
0
0
0
24
11The material used in the
11 J
11 seal should have improved
resiliency and should be subject to a frequent inspection
and replacement cycle.
11
11The original design intent was to use the "J" seal as
the primary seal with the inflatable seal as a backup and
f<;>r "housekeeping" concern*s."
"Presray stated that they manufactured and continue to
supply most of the refueling cavity seals used throughout
the industry. This is the only seal, to their knowledge,
that utilizes a "J" seal without a backing plate."
The AlT concluded that contact with the vendor was only
accomplished by the IOER group during their followup investi-
gation of the event.
This action was taken severa 1 months
after the event.
RADIOLOGICAL CONSEQUENCES
On May 17, 1988, a health physics (HP) technician providing co~tinuous
coverage for contract personnel noticed that the reactor cavity water-
1 evel had decreased and that the radiation levels had increased from
approximately 35mr/hr to IOOmr/hr.
The HP technician immediately
evacuated the Unit 1 containment operating deck (47 foot elevation) and
terminated the radiation work permit (RWP) under which the contract
per~onnel were working.
The purpose of RWP 88-RWP-1507 issued on May 12, 1988, was to allow work
on the upper internals package thermocouple lead conduit.
Appendix 30
indicates how the water level in the refueling cavity varied during the
event.
The AIT reviewed this RWP and concluded that the appropriate
precautions and requirements were adequately specified on the RW~ to
protect the health and safety of those personnel performing the work on
the Unit 1 containment operating deck.
Radiation exposures to personnel were reviewed as a result of this
event and noted that all exposures were well below NRC limits and the
licensee's administrative limits.
After the cavity water level was
restored, the RWP was reinstated for normal access.-
By reviewing the chart recorder for the Manipulator Crane Radiation
Monitor (Rl-RMS-162), the AIT determined that the remote read out in the
control room did not reach "the "Alert" setpoint of 35mr/hr during the
event.
The monitor was located above the reactor cavity. The setpoints
for the radiation monitor, Ri-RMS-162 had been changed to 35mr/hr for
the "Alert" setpoint and SOmr/hr for the "Alarm" setpoint*for refueling
operations.
The normal setpoints for routine operations are*12omr/hr on
11Alert
11-an 600mr/hr on
11Alarm
11
Rl-RMS-162 was calibrated on April 16,
1988, as required by TS prior to removing the Unit 1 reactor vessel
head.
25
The portable radiation survey instrument issuance log for May 17, 1988,
was reviewed.
During the time of the event it was noted that an
operator who entered the Unit 1 containment was issued a survey instru-
ment.
The survey meter was adequate (greater than lr/hr) to survey the
The key issuance log for high radiation areas
access was reviewed.
The HP technician assigned to the Unit 1 contain-
ment to provide coverage for various tasks accompanied the operator who
entered several high radiation areas and provided positive access
control over each entry as required by TS 6.4.
Radiation, contamination and airborne radioactivity survey results for
the 47 foot elevation and the -27 foot elevation were reviewed.
The
airborne radioactivity concentrations were all less than 25% of Maximum
Permissible Concentration (MPC).
Contamination levels on the 47 foot
elevation of Unit 1 containment remained unchanged as a result of the
event, i.e., 2,000 - 5,000 disintegrations per minute per one hundred
square centimeters ( dpm/100cm 2 ).
However, in the 1 ower containment,
-27 foot elevation, the contamination levels increased from 2,000 -
15,000 dpm/100cm 2 to 4,000 - 20,000 dpm/100cm 2 *
This slight increase
did not create a health and safety concern.
The personnel contamination log was reviewed for the period of
May 16-17, 1988, and the event was discussed with licensee represent-
atives.
No personnel contaminations were at.tributed* to this event.
The AIT was informed that the radioactive liquid that drained from the*
reactor cavity was contained in the incore instrument room sump or in
the containment. sump.
The water was 1 a ter pumped to the High Leve 1
Liquid Waste Tanks and processed as normal radioactive waste.
VI.
FINDINGS OF THE AIT
A.
Radiological Consequences
0
0
0
0
The failure of the Reactor Cavity Seal did not result in
any radiulogical releases to the environment which exceeded
regulatory limits.
Radiation doses received by individuals involved in the event
were all below regulatory limits.
The one operator who was
wetted by the refueling cavity water was surveyed and the
water in the sump was sampled and.counted for radioactivity.
No intakes of radioactivity or personnel contamination
resulted from the event.
Under normal refueling conditions had _the seal failed the
potentia 1 existed for significant personne 1 exposure had a
fuel assembly been in the transfer position (i.e., suspended
from the ref~eling bridge).
The licensee
1s UFSAR Chapter 14, _
11Safety Analysis,
11 does not
address the accident or consequences due to loss of refueling
cavity or- spent fuel pool water level.
..
B.
26
Failure Investigation
The.licensee did not perform a failure evaluation or investigation
following the event.
An investigation was commenced in July by
the IDER group of the event.
C.
Modifications
0
0
0
0
No documentation exits to support the design and/or
installation of the nitrogen system on Unit 1.
Check valves to prevent backflow and overpressure protection
devices installed in Unit 2 nitrogen system are not installed
in the Unit 1 system.
Procedure revisions to include pressure regulators and relief
valve settings and testing were not implemented for either
unit.
EWR-85-200 dated April 1985 for Unit 2 recommended procedure*
revision to change IA pressure regulator settings to 25
psi g versus 20 psi g.
The current revision for procedure
MMP-C-RC-037 used for both units still. indicates 20 psig.
- o.
Installation and Test of Refueling Cavity Floqr Seal
0
0
0
0
The inflatable seal failed t_o meet the acceptance criteria
established for the preinstallation pressure test during the
1988 Unit 1 refueling outage.
This test is required by
MMP-C-RC~37, Installation and Removal of reactor Cavity Seal
Ring.
Visual inspections performed for .seal degradation and of the
"J" seal seating surfaces, again a preinstallation requirement.
of MMP-C-RC-37 noted several deficiencies.
The licensee evaluated all of the aforementioned conpitions
as being acceptable under EWRs 116 and 148.
MMP-C-RC-37 provides .no guidance on:
Installation and/or removal of the nitrogen bot~1es; and
setting and testing of the relief valves and/or check
valves.
E.
Local Leak Rate Test
0
.*
Operation of system
(nitrogen and
IA)
valves and
regulato*rs outside the boundaries of PT 16.4 were performed
without procedures.
'*
0
0
27
Independent Veri fi cation was performed on nitrogen and IA
system valves and regulators without documenting actions.
No procedural method or documentation was implemented or
developed for the repair of valve 1-IA-849 performed on
May 16 and 17, 1988.
F.
Inadequate Instructions and Drawings
0
Current abnormal procedures for addressing a decrease in
refueling cavity level are inadequate.
The following concerns apply to the nitrogen and IA systems:
0
0
0
0
0.
0
0
limits and precautions to prevent overpressuri zati on and
rupture of the inflatable seal are not available to operators,
no provision to control valve positions (i.e., locks, tags),
no directions or setpoints for adjusting the pressure
regulators, pressure either high or low,
no method or procedure for establishing the preferred
regulator and nitrogen source, and
no lower setpoint limit of nitrogen bott1e pressure.
no logkeeping requirements when nitrogen bottle pressures
are monitored; and
no drawing to indicate system configuration for either system.
G.
Training
The following ar~ noted training findings:
0
0
0
the nitrogen back-up system was poorly understood in its
design, layout, operation, operational limits and precautions;
operational features of the refueling cavity floor seal design
were not understood by operations personnel; and
no training on emergency procedures to mitigate refueling
cavity floor seal failure had been implemented.*
. .
28
VII. GENERIC IMPLICATION OF SEAL FAILURE
Plants with designs similar to Surry have responded to Bulletin 84-03 as
Surry did, basically eliminating catastrophic seal failure as a credible
failure mode because of the passive
11J
11 seal function.
However, this
event indicates that a significant failure can occur even with the
passive seal.
The vendor has 'indicated that plants using the passive
seal design are not likely to have a similar failure because of a
backing plate which tends to maintain a more uniform seating surface
between the seal and its mating surface (as discussed in Section IV.D.
of this report).
The licensee could not locate documentation of any
acceptance tests (including initial preoperational tests) that verified
the passive
11J
11 seal assembly had ever been demonstrated or tested to
meet its design bases.
It is appropriate to require plants with similar
11J
11 seal designs to
verify through functional test that the original design intent of the
seal is maintained.
Tests after each installation need to be performed
to assure proper installation and integrity of the seals.
VIII. ROOT CAUSE DETERMINATION
The apparent root cause of the inflatable seal failure was due to
securing the IA supply to the seal for maintenance with a subsequent
lass of nitrogen pressure from the backup system. * The loss of nitrogen
pressure occurred because one bottle was somehow isolated in that the
regulator was misaojusted while the second bottJe (which was unisolated
with the regulator adjusted properly) bled down in some manner.
The
11J
11 seal root cause failure is much more difficult to de-termine
because there is no assurance that the
11 J
11 seal was ever completely
functional.
Therefore, a design application deficiency may have con-
tributed to the failure._ Also, dimension changes between the reactor
vessel flange (either vertical or horizontal) may. have contributed
to or caused the inability of the seal to perform its intended design
function.
Additionally, in May of 1986 the
11J
11 seal was replaced.
There are no specific procedures for replacing or repairing the seal.
Replacement and repairs were made using the associated design drawings.
This is another possible root cause of the seal failure if the replace-
ment was improperly performed and resulted in the
11J
II seals not being
installed in accordance with the original design.
IX. CONCLUSIONS
The overall conclusion of the AIT is that the root cause of the
seal assembly failure was a combination of inadequate administra-
tive controls, operator error, coupled with inadequate design
application, maintenance and testing of the
11 J
11 seal assembly.
The primary root cause of the.
11J
11 seal failure appears to be
design related.
Inadequate maintenance, testing, and installation
procedures may have contributed to the severity of the event.
Operator error was induced by inadequate operator aids an<f
training.
V
x.
29
Adequate functional testing of the
11J
11 seal would have discovered
the inadequacy of the initial design application and its ability to
perform its design function.
EX IT INTERVIEW
The findings and conclusion of this special inspection were discussed
on September 3, 1988, with those persons indicated in Appendix I.
No
dissenting comments were received .
,
1
I
.. .
APPENDIX 1 - PERSONS CONTACTED
Licensee Employees
- J. Bailey, Superintendent of Operations
- R. Bilyeu, Licensing Engineer
- D. Benson, Station Manager
H. Blake, Superintendent of Site Services
R. Bracey, Control Room Operator (Unlicensed)
- W. Cartwright, Vice President-Nuclear
B. Cox, Control Room Operator (Unlicensed)
- S. Eisenhart, Staff Engineer, Independent Offsite
Evaluation Review .
- E. Grecheck, Assistant Station Manager for Licensing and Safety
M. Hotchkiss, Shift Supervisor
R. Johnson, Ope_rati ans Supervisor*
T. Kendzie, Containment Coordinator
- J. Logan, Supervisor, Safety Engineering Staff
- G. Miller, Licensing Coordinator, Surry
- H.*Miller,_ Assistant Station Manager for Operations and Maintenance
- L. Morris, Supervisor, Health Physics and Radwaste
R. Mushenheim; Control Room Operator (licensed)
- G. Pannell, Director, Safety Evaluation and Control
W. Patterson, Human Performance Evaluation System
Coordinator, Surry Power Station
- -T. Shaub, Licensing Engineer*
J. Simpson, Shift Supervisor
K. Sloane, Shift Supervisor
- J. Smith, Supervisor, Independent Offsite
Evaluation Review
NRC.Employees
L. Nicholson, NRC Resident Inspector
- Attended exit interview*on September 3, 1988.
. .
./
CRO
cs
DR
EST
HPES
IOER
JCO
LHSI
PG
. RHR
RS
SNSOC
ss
TS
USS
UTS
w
APPENDIX 2 - ACRONYMS AND ABBREVIATIONS
Augmented Inspection Team
Abnormal Procedure
Control Room Operator
Containment Supervisor
Deviation Report
Eastern Standard Time
Engineering Work Request
Health Physics
Human Performance Evaluation System
Instrument Air
Independent Offsite Evaluation Review
Justification for Continued Operation
Low Head Safety Injection
Local Leak Rate Test.
Maximum Permissible Concentration
Non-Licensed Operator
Primary Grade
Periodic Test
Pressurized Water Reactor .
Quality Control
Refueling Supervisor
Radiation Work Permit
Station Deviation
Station Nuclear Safety Operations Committee
Shift Supervisor
Technical Specification
Updated Final Safety Analysis Report
Unit Shift Supervisor
Unit Test Supervisor
_
Westinghouse Electric Corporation
C.
APPENDIX 3 - DESIGN DESCRIPTIONS
(, '
,I
APPENDIX 3A - REFUELING CAVITY FLOOR SEAL
GENERAL DESCRIPTION
The refueling cavity floor seal (Ftgure 1) is intended to seal the open.ing
between the reactor vessel flange and the refueling cavity floor.
This allows
the refueling cavity to be filled with borated water so that refueling opera-
tions can be accomplished under water.
The seal assembly consists of two separate sealing devices; an active or
inflatable seal and a passive or "J" seal.
The inflatable seals are manufactured from a nitride rubber material and are
designed to seal against a hydrostatic head of 27 feet of water.
A design
operating pressure of 25 psig is specified under ambient conditions of 60°F to
120°F.
The design pressure is 50 psig.
Figure 1 shows the inflatable seal in both the inflated and deflated conditions
(inner seal deflated, outer seal inflated).
Compressed air or nitrogen is
introduced into the inflatable seal via air connections on the bottom of the
seal ring.
The seal ring contains two air passages which direct the air to the
s*ea 1.
The "J" seals provide a passive sealing function and are intended to minimize
and/or preclude leakage ,n case of. inflatable seal failure.
The "J" seals are
fabricated from a high grade, thread-type natural rubber compound.
They are
7/8-inch in diameter with a 3/8-inch hollow inner core.
When the assembly is
lowered into place, the seal_ supports are required to be adjusted to achieve a
1 3/16-inch gap (dimension "A", Figure I).
Permanently attached to the vessel flange and refueling cavity floor are drip
pans which collect leakage past the seals.
This leakage is directed to the
reactor coolant loop rooms, through the telltale drains to the containment
sump.
The drlp pans and associated small drain lines (3/4-inch) are capable of
handling small leakage by the ~eais.
, .
APPENDIX 38 -
INSTRUMENT AIR SYSTEM
DESCRI PT! ON
The containment IA. system (Figure 2) consists of two water-sealed, rotary
compressors and associated refrigerant air driers installed on the 11
16
11
elevation of the main steam valve buildings for Units 1 and 2.
The compressors
take a suction from the containment via a 3
11 penetration.
Containment trip
valves are provided on both sides of* the penetration.
Each compressor has a
minimum capacity of 24-scfm at 90 psig.
A shell and tube heat exchanger is
provided on each compressor to cool the seal water.
Cooling water for these
heat exchangers comes from the containment cooling chilled water system.
The
alternate supply of cooling water is the component cooling system.
A connec-
tfon to component cooling water is also provided for seal-water make-up.
One
compressor is in continuous service and automatically loads or unloads to meet
system demand.
The other compressor is on standby and starts automatically if
system pressure decreases to 85 psig.
Each compressor discharges to its own moisture separator and filter.
Water
removed from the air by the separators and air driers is directed to a sump,
where a small sump pump transfers the water to the liquid waste system.
Each
air compressor discharges to its own refrigerant air drier.
The piping allows
the air compressors to be cross-connected with the air driers as well as
allowing them to *bypass the driers completely.
Air exiting the driers has
a dewpoint of 35°F.
The air enters the containment through a containment
trip valve using containment penetration 47 for Unit 1_ IA .
'
'
APPENDIX 3C - NITROGEN BACK-UP SYSTEM
The nitrogen back-up system, as shown in Figure 2 (configuration based on
personnel interviews), consists of two portable nitrogen cylinders each con-
taining 301 cubic feet of nitrogen at approximately 2200 psig when full. These
bottles supply nitrogen to 2200/20 psig variable pressure regulators. Flexible
tubing connects the downstream pressure of the regulator through an isolation
valve to a junction from
the containment IA system.
This nitrogen pressure
supply is then supplied to the refueling cavity floor seal if IA pressure is
not available.
The pressure regulators on the nitrogen bottles should be set
at 20 psig and the IA pressure regulator should be set at 25 psig.
L .
-1
~I
APPENDIX 30 - UPPER CORE INTERNALS STORAGE
As shown on the attached drawing, Figure 3, the upper internals package
(item 1) rests in the storage area on a stand (item 2) which holds the inter-
nals up some 6" off the* bottom of the reactor cavity.
The total height of the
upper internals .package, including the 611 offset provided by the stand, is 26
1
When the refueling cavity water level is "normal" (item 3) the top of the upper
internals package is about 1
16
11 below the surface of the water.
On March 17, 1988, W contractor personnel were working on upper internals
thermo coup 1 e 1 ead conduit.
This work was being performed from the refueling
bridge positioned directly over the upper internals package storage location.
The water level had been reduced about one foot below (item 4) the normal level
thus reducing* the remaining shielding to six inches.
Due to the loss of
refueling cavity water through the refueling cavity floor seal, this shielding
water was r_educed an additional three feet.
Following the event the water
level could have dropped to approximately twenty-four feet.
Thus allowing
about two* feet six inches of the upper interna 1 s package to be out of the
water .
a*-ct *
- -1 .
- -~* **-*~*
- BEFORE COMPRESSION
Dimension
118
11
ltEI.ATML.£
SEAL
(Outer)
_...,..._.._.,~i-a-- Ori p Pans
Air Supply Line
SURRY REACTOR.CAVITY SEAL RING ASSEMBLY
Figure 1 *
REACTOR CAVITY LINER
EL 1e*-4*
~ <
r
!"',J
, .
'
I
1
1
- -
To
' Cav1 ty
Ring
Seal
'C' Loop Room
'
I
I
I
l
Flex Tubing
I
I
CONFIGURATION
BASED UPON
OPERATOR*
- I INTERVIEWS
r
INSIDE
CONTAINMENT
1-842
1-936
/
OUTSIDE
CONTAINMENT
UNIT 2 Air
Unit 1 Containment
Instrument Air
PS~ ~)PS
J
Unit 1 Containment
V1
Instrument Air System/Nitrogen Backup System
Figure 2
I
1-986
f'.
C r
\\', ..
~ -~ ;t .
-
Reactor Cavity
Water Seal
UPPER CORE INTERNALS STORAGE
Normal Water Level ~-
_
_
_
_
- -Reduced-Water-Level - ~
_ _
_
- 1:oii_ol_Iii1er~1~ - _-:-
-
Post Event
Water level
27' 6"
- 26' 6" -
,:-a6"' _ 0.,. _ --:. -=--
2~ .§_. -
Reactor Upper --4
(i)
Internals
)..._1-..~.,L_....L_~--L__.1..~__.___.~~~"l~
Pool Bottoa
Storage Stirfd R *
1~ter111ls Storage
\\1----------::J
Reactor
Figure 3