ML20056E499

Forwards ECCS Operating Experience Info Obtained from Licensee Event Repts to Help Assure That Utils Will Remain Aware of Operating Experience Info

ML20056E499
Person / Time
Site:	Comanche Peak
Issue date:	08/04/1993
From:	Padovan L NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:	Meyer J TEXAS UTILITIES ELECTRIC CO. (TU ELECTRIC)
References
NUDOCS 9308240143
Download: ML20056E499 (28)

Text

• AUG 4 1993 $WI

. Mr. John Meyer, Chairman ASME OM-15 Working Group Texas Utilities Electric Company Mail Zone 006 P.O. Box 1002 Glen Rcse, TX 76043 -

SUBJECT:

PRESSURIZED-WATER REACTOR EMERGENCY CORE COOLING SYSTEM OPERATING EXPERIENCE The American Society of Mechanical Engineers (ASME) Operation and Maintenance (OM)

OM-15 Working Group is developing a draft standard on pressurized-water reactor (PWR) emergency core cooling system (ECCS) testing. This includes establishing test methods, test intervals, parameters to be measured and evaluated, acceptance criteria, and corrective actions. You earlier agreed to put ECCS operating experience into the standard to help make utilities aware of specific ECCS problems. Operating events suggest utilities might not have integrated this information into their ECCS testing programs.

Enclosure A contains ECCS operating experience information obtained from licensee event reports. This information focuses on events where improved ECCS testing might prevent ECCSs becoming degraded or unable to perform their intended safety functions. Enclosure A does not include operating experience the standard already addresses. Section 5 of Enclosure A has suggestions to improve ECCS testing based on lessons learned from the.

events.

Utilities using the standard would address this ECCS operating experience information on a '

periodic basis. This helps assure that utilities will remain aware of this operating experience information. We should use the ASME codes, standards, and guides process as an effective and long-lasting way to communicate with the nuclear industry. Please contact me at (301) ,

492-4445 if you have questions.

Originalsigned by L. Mark Padovan, Reactor Systems Engineer Reactor Systems Section E and B&W Reactor Operations Analysis Branch Division of Safety Programs Office for Analysis and Evaluation of Operational Data

Enclosure:

As stated Distribution w/ enclosure See attached pg h ,

• See previous concurrence: m ROAB ROAB .. AB LPadovan:mmk WJones JRosenthal ')#hg 6/09/93*

9309240143 930B04 6/14/93*

[93 #(

l PDR ADOCK 05000445

_ = rg__ PDR

W John Meyer Distribution w/ enclosure:

PDR Central File ROAB R/F LPadovan WJones JRosenthal GHolahan VBenaroya EJordan Dross i

LSpessard KBrockman SRubin PBaranowsky l KRaglin,1TC l AChaffee, NRR GMarcus, NRR ,

RBaer, RES l MTaylor, EDO l l

l l

n ,

l Multiple Addressees j l

helps assure that utilities will remain aware of this operating-experience information. This may be more effective than a single, inforr.ation-only NRC generic communication. We should use the ASME codes, standards, and guides .

process as another way to communicate with the nuclear industry. Please j contact Mark Padovan at (301) 492-4445 if you have questions, or want to l comment on the ASME standard. +

I Gary M. Holahan, Director '

Division of Safety Program  ;

Office for Analysis and aluation l of Operational Data  ;

Enclosure:

As stated j Distribution w/ enclosure: l PDR Central File  !

ROAB R/F DSP R/F  !

LPadovan i WJones JRosenthal i VBenaroya ,

i EW EJordan s

/

Dross "

,,,e, el5pessard x '

/

/KBrockman i E fSRubin \

j PBaranowsky KRaglin, TTC \

AChaffee, NRR \

. GMarcus, NRR j MTaylor, ED0 l Ig[(\(PlewTi~If&O RSavio, ACRS 1

l

\/ DQueener, NOAC[

f\VChexal,EPRI/

/ t/o I

i/ h ROAB h ROAB Mg C:ROAB . DSP D:DSP LPadovan:mmk WJones' JRosenthal VBenaraya GHolahan 6/ *)/93 6/g/93)&,/ 6/ /93 6/ /93 6/ /93 d

fi

I t

i i

ENCLOSURE A i

PRESSURIZED-WATER REACTOR EMERGENCY CORE COOLING SYSTEM OPERATING EXPERIENCE

i L

t CONTENTS  !

r I

1 INTR O D U CTI O N . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I 2 OPERATING EXPERIENCE REVIEW . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 I 2.1 Inadequate Instrumentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 ,

2.1.1 Improper Orifice Plate Flow Coefficients . . . . . . . . . . . . . . . . . . . . . 2 2.1.2 Incorrectly Installed and Deformed Orifice Plates . . . . . . . . . . . . . . . . 3 2.1.3 Incorrect Flow Tmnsmitter Calibration ...................... 4  :

r 2.1.4 Inadequate Instrumentation Setpoints . . . . . . . . . . . . . . . . . . . . . . . . 5 2.1.5 Inadequate Response Time Testing of Instruments With Pressure Dampening Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 2.2 Incorrect Pump Net Positive Suction Head in the Recirculation Mode . . . . . . . . 8  ;

2.2.1 Insufficient Net Positive Suction Head . . . . . . . . . . . . .. . . . . . . . . . . 8 j 2.2.2 High Pump Suction Pressure Problems ...................... 8 l 2.3 Pump Minimum Flow Recirculation Line Problems . . . . . . . . . . . . . . . . . . . 8 2.4 Pump Gas Binding Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 2.4.1 Accumulator Nitrogen Binding . . . . . . . . . . . . . . . . . . . . . . . . . . 10 2.4.2 Hydrogen Binding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 ,

2.5 Insufficient Pump Cubicle Cooling . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.6 Inadequate Engineered Safety Features Actuation System Testing ......... 13  ;

r 2.7 Incorrect Emergency Diesel Generator Electrical Loading .. ............ 14 2.8 Inadequate Testing Frequency . . . . . . . . . . . . . . . . . ............. 17 3 FI N D I N G S . . . . . . . . . . . . . . . . . . . . . . .. . ................ 18 ,

t I

4 CONCLUSIONS . ............... ....................... 18

.l 5 SUGGESTIONS ........................................- 18 6 REFERENCES .......................................... 21 FIGURES  !

t Figure 1 ................................................ 7 4

Figure 2 ................................................ 9 111 <

l 4

i.

1 INTRODUCTION The following contains operating experience information associated with pressurized-water reactor (PWR) emergency core cooling systems (ECCSs). I focused on events where improved ECCS testing might prevent ECCSs becoming degraded or unable to perform their intended safety functions. ECCSs include a borated water supply, low, intermediate, and high head injection pumps, passive safety injection (SI) accumulators (core reflood tanks),

heat exchangers, and associated flow paths. I did not Mclude information on the following decay heat removal systems or methods:

• auxiliary or emergency feedwater

• steam generator heat removal

• feed and bleed heat removal

• containment air cooling I included information on the containment spray system if the containment spray pumps could affect high head SI when the pumps simultaneou2ly take suction from the low head SI pump discharge.

The events fell into the following eight categories based on their proximate causes:

• inadequate instrumentation

• incorrect pump net positive suction head (NPSH)

• pump minimum flow recirculation line problems a pump gas binding problems

• insufficient pump cubicle cooling

• inadequate engineered safety features actuation system (ESFAS) testing

• incorrect emergency diesel generator (EDG) electrical loading

• inadequate testing frequency j The U.S. Nuclear Regulatory Commission's (NRC's) Accident Sequence Precursor (ASP)

Program determined several events associated with ECCSs had conditional core damage probabilities (CCDPs) ranging from about 6 x 10' to 6 x 104 The NRC considers events with CCDPs of 10' to be important. Section 5 contains my suggestions for incorporating operating experience into the ASME ECCS testing standard to enhance it.

2 OPERATING EXPERIENCE REVIEW Operatine Exocrience Information Sources I searched the NRC's Generic Communication Index for bulletins, generic letters (GLs), and information notices (ins) related to ECCS. I took this approach since existing generic communications identify ECCS problems applicable to multiple plants. Also, the NRC determined these events were safety significant enough to issue the communications. The scarch identified 153 generic communications. I deleted items relevant to boiling-water reactors. I also excluded items the ASME standard could not address (e.g., inteq;ranular l

1 i l

i stress corrosion cracking), or which other ASME standards covered. I restricted ins to 1985 or later since they were available on the NRC's Nuclear Documents System (NUDOCS) and contamed recent operating experience.

I also included information from licensee event reports (LERs) and 10 CFR 50.72 reports.

A NUDOCS search on " emergency core" located 197 LERs for 1992. I narrowed the search using the word " test," and ended up with 101 LERs. I then looked at the abstracts of the 101 LER list and found 15 potentially applicable to my evaluation. I had Oak Ridge National I.aboratory (ORNL) search the NRC's Sequence Coding and Search System (SCSS) for LERs back to 1984. I asked for searches on PWR ECCS problems detected through testing, and ECCS problems caused by testing. ORNL did 7 different searches identifying 1314 candidate LERs. I found only 5 LERs that were applicable to my evaluation after looking at about 400 of the LER abstracts. I thus did not look at the remaining 900 LER abstracts. I also reviewed the NRC's ASP Program status reports for years 1988 through 1992 looking for high safety significant ECCS related events. I arranged relevant operating experience information into several categories based on the proximate event causes. These are given in the report sections below.

2.1 Inadequate Instrumentation i 2.1.1 Improper Orifice Plate Flow Coefficients T_ roian On March 14,1991, Trojan personnel concluded that centrifugal charging and SI header flow -

rates could exceed maximum Technical Specification (TS) flow limits (Reference 1). Total centrifugal charging and Si header flow rates could be 580 gpm and 675 gpm, respectively.

Maximum TS total flow rate values are 560 gpm for the centrifugal charging pumps (CCPs) and 650 gpm for the SI pumps. The CCP flow rate is also outside the pump vendor's maximum recommended flow rate, while the SI pump flow rate is at the maximum recommended flow rate.

The utility summed the individual injection line flow rates to get total header flow.

However, they used improper orifice plate flow coefficients to determine individual injection line flow rates. The utility used the 1989 ASME MFC-3M, " Measurement of Fluid Flow in Pipes Using Orifice, Nozzle, and Venturi," formulas to determine the flow coefficients. This  ;

standard indicates it does not apply to pipe under 2-inches nominal diameter. A nominal CCP injection line size at Trojan is 1.5 inches, and a SI injection line is 2 inches. They did not have any valid orifice plate coefficient data for pipes less than 2-inches nominal diameter.  :

Apparently this affected 2-inch lines also.

At Trojan, flow rate problem symptoms included:

• CCP and SI pump header flow indicators showing higher flow rates than the sum

- of the four individual injection line flow rates 1

2 '

i

_~ l

l 1

~

l l

l

• individual injection line flow was below that used for accident analysis in some cases  :

The utility determined Trojan's ECCS might not perform as assumed in safety analyses.

Minimum and maximum flow limits assure proper injection line flow balancing, and prevent  !

pump runout. Imss-of-coolant accident (LOCA) analysis assumes the lowest resistance j injection line flow spills into containment. Unknown, increased line flow rate results in j more flow spillage and less flow to the reactor coolant system (RCS), affecting licensing-  ;

basis analysis. In Trojan's case, peak clad temperature remains within the 10 CFR 50.46 l limit of 2200* F for small break LOCA, but mass and energy released to containment increases 2 percent. This results in a 0.2 psi increase in containment pressure.

To correct the situation, the utility developed calculations for determining total uncertainties j associated with using.  ;

i

• header flow orifices and associated test instruments

• individual injection line flow meters when used with the header flow meter to i determine individual injection line flows They then balanced CCP and SI pump flows using newly determined flow limits. Trojan personnel decided to use the > 2-inch header flow measurements for total flow, and bmnch line flow measurements for balancing individual injection line flow rates. The utility also evaluated all other cases using TS-related orifice plates in pipes < 2 inches nominal  !

diameter.  ;

Using CCP and SI pump header flow measurements to confirm total flow, and branch line  !

flow measurements for balancing individual injection line flow rates would correct the above  !

problems. Suggestion I A in Section 5 relates to this event.

Salem Units 1 and 2  ;

l On April 9,1990, the utility determined SI pump flow rates were greater than TS allowable  ;

values (Reference 2). One issue involved ECCS injection line flow measuring orifice plate  :

constants (K-factors). The utility removed and tested the orifice plates, and found their [

K-factors differed from the original data sheets for the plates. Engineering calculations j showed the flows to be higher than expected. The utility validated new orifice plate K-factors through testing, and replaced the high-pressure injection (HPI) and SI flow orifices.

Verifying ECCS orifice plate K-factors are correct would prevent this problem. Suggestion i IB relates to this event.  !

i 2.1.2 Incorrectly Installed and Deformed Orifice Plates NRC Information Notice 90-65  :

f NRC IN 90-65, "Recent Orifice Plate Problems," (Reference 3) describes problems with l installing orifice plates backwards, and orifices deforming in the direction of flow. This 3 l

. i I l 1

i resulted in flow indication reading lower than the actual flows in HPI and residual heat I removal (RHR) systems. These problems occurred at Farley, Salem, Brunswick, Waterford,  !

Surry, and North Anna, in May 1989 Salem personnel found high head cold leg SI flow l metering orifices installed backwards. Indicated flow rate increased 15 percent after the licensee correctly installed the orifices. Waterford had low indicated flow in a HPI l recirculation line due to a reversed flow orifice. In August 1989 NRC and Surry personnel j found three reversed flow orifices after the utility completed a corrective action program for j flow orifices. The utility found nine flow orifices installed backwards at North Anna in t j September 1989. j i Brunswick employees found several flow restricting orifices in the RHR and HPI systems  !

deformed in the direction of flow. The orifice plate thickness designs did not consider the i deforming effects of flow and differential pressure across the plates. The licensee i determined the stress on the plates was several times the allowable material yield stress. At  !

Indian Point Unit 2 on April 3,1991 (Reference 4), the utility found they had interchanged three orifice plates, and had reversed one plate.  ;

Verifying installed beveled edge orifice plates are in the correct orientation (direction) would )

prevent this problem. Checking for flow and differential pressure induced deformation in (

orifices used as flow restrictors to limit flow rates is also prudent. Suggestion 1C relates to j this event. j i

N_RC Information Notice 93-13 i i

NRC IN 93-13, " Undetected Modification of Flow Characteristics in the High-Pressure l Safety injection System," (Reference 4) discusses a situation at Arkansas Nuclear One  !

(ANO) Unit 2 involving low and imbalanced HPI system flow rates. On September 23,  :

1992, the licensee found total indicated HP1 system flow was lower than actual flow. The  !

utility found they had installed a flow orifice backwards. I give more details and discuss  !

other problems the utility found in section 2.5 below. This event also suggests verifying installed beveled edge orifice plates are in the correct orientation. Suggestion IC relates to  ;

this event also. j 2.1.3 Incorrect Flow Transmitter Calibration l Ginna and Browns Ferry Unit 1 f

On June 19, 1989, the utility found original calibration data for SI system flow transmitters did not correlate accurately with the installed flow orifice plates (Reference 5). Ginna started operating in 1970. The utility discovered the problem during SI pump post ,

modification testing. The "B" and "C" Si pumps had problems meeting design flow rates to  !

the RCS as indicated on an S1 flow indicator. The utility declared the pumps inoperable. l They then throttled the "B" and "C" Si pump minimum flow recirculation valves to 50 gpm to give the required design flow rates to the RCS.

i On June 21,1989, the utility started the monthly SI pump tests. The "C" SI pump minimum  !

flow recirculation flow rate was 70 gpm. This was contrary to the TSs required 50 gpm  :

i 4  ?

maximum flow rate. They reset the recirculation flow rate to 45 gpm. They restarted the pump about an hour later and found the pump minimum flow recirculation flow rate was 56 gpm. They once again reset it to 45 gpm. They started the "B" and "C" SI pumps again in about an hour to verify recirculation flow rates. The "B" SI pump recirculation flow was 50 gpm and the "C" SI pump recirculation flow was 55 gpm. They utility shut down the plant to resolve the problems.

The utility determined the plant designer gave the utility incorrect calibration data. The utility verified the installed orifice plates were correct. The utility had to recalibrate the flow transmitters to match the installed orifice plates. Utility analysis determined that even with the problems, the SI system met design flow rates to the RCS. ,

At Browns Ferry Unit 1 on January 27,1988, the utility identified a similar problem with the RHR service water pump flow instruments (Reference 6). The instruments indicated 4500 gpm flow while actual flow was about 3400 gpm. The utility originally calibrated the flow transmitters using General Electric instrument data sheets. They did not verify the calibration data against the manufacturer's orifice flow calculation data sheets. The two are not compatible for correct flow instrument calibration. Assuring that ECCS flow transmitter calibration data correlate accurately with installed flow orifice plates would prevent this -

problem. Suggestion IB also relates to these events.

2.1.4 Inadequate Instrumentation Setpoints NRC Information Notice 89-68 NRC IN 89-68, " Evaluation of Instrument Setpoints During Modifications," (Reference 7) shows utilities do not always properly evaluate system operating and design characteristics when modifying instmmentation and control (I&C) systems. Sometimes utilities do not do setpoint calculations correctly to verify original safety system design objectives are being met for modified instrument loops. Instrument modifications could reduce the margin between the instrument nominal setpoint and the TS limit. The modifications could also change the system response time. These changes could degrade the ability of the system to meet its design requirements. l The licensee at Oyster Creek made instmment setpoint margin values arbitarily after modifying I&C loops in late 1988. These margins did not account for all potential error contributors to the measurement loop total uncertainties. This might cause I&C technicians to leave calibrated instruments channels at their calibration band upper limits. This could allow setpoints to exceed their TS limits without being detected. Oyster Creek had several '

instrument loops that had a history of exceeding TS limits due to this. Accounting for all potential error contributors to the measurement loop total uncertainties when calculating  ;

instrument setpoint margin values would prevent this problem. Suggestion ID relates to this j event.

At Indian Point Unit 2, the NRC found that the utility was not trending directional changes in instrument accuracy that occurred between successive calibrations. Sometimes instmment accuracy and drift changes in one direction. The utility calculated loop setpoint margins 5

~

using the square root of the sum of the squares (SRSS) method to combine uncertainty j attributes. This method works only when loop component uncertainty attributes have random directions. Using the SRSS method to determine setpoint margin will result in a j nonconservative value if the attributes change in one direction only. The resulting incorrect setpoint margin could keep the instrument from initiating a required safety function when needed. Trending the direction of changes in ECCS instrumentation accuracy would prevent i this. Using the SRSS method to determine uncertainty attributes for setpoint margins if I instrument accuracy and drift changes in only one direction is not correct. Suggestion IE -

relates to this event. l NRC Information Notice 91-75 NRC IN 91-75, " Static Head Corrections Mistakenly Not Included In Pressure Transmitter Calibration Procedures," (Reference 8) addresses static head correction problems on safety related pressure transmitters. The problems occur when the utility installs transmitters at ,

different elevations than assumed in safety analysis. On July 3,1991, the utility discovered they did not apply a static head correction of about 25 psig when they calibrated pressurizer pressure transmitters at Vogtle Units I and 2. This affected all four pressurizer pressure channels on each unit. The error impacted high and low pressurizer pressure reactor trip setpoints, low pressurizer pressure SI setpoint, and the initial pressure used for safety analysis. The utility determined their small break safety analysis had inadequate margin in ,

this condition, but had conservative assumptions that overcame the lack of static head 6 correction. They recalibrated all eight transmitters. They also found 58 other instruments that were not head corrected. None of these were safety significant. The static head l correction problems existed since initial startup of each unit. Utilities found similar l problems at McGuire (Reference 9), ANO Unit 2 (Reference 10), Dresden (Reference 11), and Davis-Besse (Reference 12). Considering static pressure effects when developing or revising procedures and calibrating ECCS pressure transmitters will help prevent this condition from occurring. Suggestion IF relates to this event. .

t i

i 2.1.5 Inadequate Response Time Testing of Instruments With Pressure Dampening Devices NRC Information Notice 92-33 NRC IN 92-33, " Increased Instrument Response Time When Pressure Dampening Devices Are Installed," (Reference 13) shows how instrument response times can increase when  ;

utility workers put pressure dampening devices (snubbers) in instrument sensing lines. At  :

Oyster Creek on September 25,1991, the utility had to shutdown the plant when pressure sensors did not meet TS required response times. Snubbers in the instrument sensing lines caused instrument response time increases. Utility instrument response time testing was not 4 adequate to detect the delays caused by the snubbers. This happens when they do instrument i i

response time testing directly at the pressure sensing instruments. Figure I shows this testing configuration. Including existing ECCS pressure sensing instrument snubbers in the  !

test configuration when they test instrument response times fixes this problem. Suggestion l 1G relates to this event. i l

6  !

- i

t

/

TEST GAUGE

. PRESSURE SENSING DEVICE  !

- e i

TEST PUMP ,

8

--- --_ j{ SNUBBERS .

HIGH SIDE BLOCK VALVE  : 1 *'  : LOW SIDE BLOCK VALVE

• l -

i EQUALIZA' TION BLOCK VALVE -

> a TO PROCESS I CONNECTION ,

l Figure 1 Incorrect pressure sensing instrument test configuration 7

t

~~

. l 2.2 Incorrect Pump Net Positive Suction Head in the Recirculation Mode ,

2.2.1 Insufficiect Net Positive Suction Head NRC Information Notice 88-74 i NRC IN 88-74, "Potentially Inadequate Performance of ECCS in PWRs During i Recirculation Operation Following a LOCA," (Reference 14) describes two instances of  ;

inadequate HPI and SI pump NPSH. These occurred at the Oconee and Turkey Point plants.

Inadequate NPSH in the recirculation mode can occur because of high flow rates downstream of the low-pressure injection (LPI) pumps. This can make the HPI system inoperable. 1 These high Dow rates can happen when containment spray pumps and HPI pumps take suction simultaneously from the LPI pump discharge. This takes place when the pumps are

- in piggy back type operation during the recirculation phase of operation following a small break LOCA. Taking a systems integration testing approach to assuring the HPI pumps get enough NPSH when the HPI and containment spray pumps are piggy backed off the LPI pumps will correct this problem. This should include testing for conditions where operators throttle LPI discharge valves. Suggestion 2A relates to these events.  !

2.2.2 High Pump Suction Pressure Problems ,

Sgquoyah Units 1 and 2 l On August 30,1991, the utility determined they potentially could loose post accident [

containment sump inventory outside containment at Sequoyah Units I and 2 (Reference 15). D. C. Cook Nuclear Plant personnel previously identi6ed this scenario at their plant ,

also. RHR pumps take suction from the containment sump during the recirculation phase of l operation following a small break LOCA. The RHR pumps provide suction pressure and 2

Dow to the CCPs and the SI pumps. High RHR pump discharge pressure to the CCP and SI [

pump suctions could cause the volume control tank (VCT) outlet check valve to close (see  !

Figure 2). This isolates the CCP miniflow return line. Miniflow pressure then increases i until the seal water heat exchanger relief valve lifts, discharging containment sump inventory  !

to the VCT. VCT excess inventory is directed to the holdup tanks. Both the VCT and the holdup tanks are in the auxiliary building outside containment. The inventory loss does not ,

adversely impact Sequoyah since the utility has analyzed ECCS performance for reduced l CCP injection due to miniDow line loss. However, we want to avoid this scenario since it  ;

might also impact control room habitability or affect other plants. Thus, assuring that both [

minimum and maximum suction pressures to the CCPs and the SI pumps are correct during i testing corrects this situation. Suggestion 2B relates to this event.  ;

2.3 Pump Minimum Flow Recirculation Line Problems }

NRC Information Notice 87-59 NRC IN 87-59, " Potential RHR Pump loss," (Reference 16) gives information about problems with ECCS pump minimum Dow (miniDow) recirculation lines. The IN shows l g (

HIGH 1-EAD INJECTION COLD LEG REClRC Seal Water HX A#f["'c[7${w' c uta Letdown  ;

- N

/ RCP  : Return Seal o

>4 e f;; m WCT:: "

. Leak Det n

, Qe$ "

g g Aux Bldg sump PRIWTR Supply A

r' and Accum Fill

% ,l9 CHECK V

[9 N

BAT: OO m llI; ; a ll) DON > Cold Leg 1 e 4 M '

N+ = => Cold Leg 2 g

[ , .

Boric p '

= =+ Cold Log 3 m

rd 1 " Acid = 4 Cold Log 4 g: 1  :: 4I Pmps g, ,

k'HX 4 ' 2*)

C- , r 4 BIT

)HTRS E

dPRT%

4 6 .  ; V; <OT > 4: Drain / Sample RWST*

n

• \ - '

-+ Seal in]

H

, .' +T+ 3 Chg Pumps :T;  ; g; ;g;  : Regen HX "s*e-vt-4__ - --m+- +w ===e~ -- "4--T.e - tteWewg-erw-_5=et=--re--+=--w-==-T-Ne= -w e-e v4****Lww-M*s et w-w- ----*r'se-==r-e-4 m. -w'-P-" -4 _=--+---'-ee- - L 6--'- . -N'"*--4-'W - * * * - - - - m-- -e ---- - ---- --- -+

these concerns might apply to all ECCS pumps with miniflow lines. Westinghouse identified the potential for deadheading one of two RHR pumps in systems having a common miniflow recirculation line for both pumps. A small break LOCA causes a SI signal which starts ECCS pumps. The pumps circulate coolant through the common miniflow line until the RCS i depressudzes to a point below pump shutoff head. The pumps deliver flow to the RCS at this point. Miniflow line flow resistance causes the pumps to operate close to their shutoff head during recirculation. A stronger pump can deadhead a slightly degraded pump in this condition. Some pumps can remain deadheaded for only about 10 minutes before becoming ,

damaged. However, estimated times to damage pumps is uncertain. Verifying that pump operation near shutoff head does not cause deadheading of the weaker pump corrects this problem. Suggestion 3A relates to this.

Westinghouse also had concerns that pump miniflow recirculation lines might not have adequate capacity, even for single pump operation. Miniflow line capacity might be only 5 percent to 15 percent of pump design flow. Some pump manufacturers advise miniflow line capacities of 25 percent to over 50 percent of best efficiency flow for extended operation.

Utilities verifying ECCS pump miniflow recirculation line flows meet pump manufacturers' criteria would prevent this problem. Suggestion 3B relates to this.

1 2.4 Pump Gas Binding Problems 2.4.1 Accumulator Nitrogen Binding NRC Information Notice 89-67

NRC IN 89-67, " Loss of Residual Heat Removal Caused by Accumulator Nitrogen,"

! (Reference 17) describes an event at Salem Unit I where both RHR pumps were lost for about 50 minutes. On May 20,1989, the reactor was in Mode 5 (cold shutdown) after refueling with the reactor head installed. Utility personnel were full flow testing RCS ,

accumulator check valves. An operator mistakenly let an accumulator isolation valve remain open too long. About 1800 cu.ft. of accumulator nitrogen entered the RCS. In about 10

minutes, a control room operator saw RHR flow was zero, and pump motor current had dropped. The operator stopped the pump, and staned a second RHR pump. This pump also  !

showed gas binding characteristics. The operator then realized the pumps were gas bound, and began venting the system. Venting was slow because of vent line size, difficulty in locating a vent valve, and the need to remove a vent pipe cap. Core temperature increased from 92* F to 122' F before the operators could restart a RHR pump. Event consequences '

could have been more severe if the utility had followed the common practice of testing the valves during shutdown prior to refueling.

Operators failed to realize nitrogen could be injected into the RCS during accumulator check i valve full flow testing. Utilities should determine if it is appropriate to test the check valves with fuel in the reactor vessel. Utilities also can reduce accumulator nitrogen pressure or remove the reactor vessel head to minimize the effects of nitrogen injection into the RCS dudng testing. Suggestion 4A relates to this event.  !

10 ,

- w

1 I

l 2.4.2 Hydrogen Binding NRC Information Notice 88-23. Supolement 3 NRC IN 88-23, Supplement 3, " Potential For Gas Binding of High-Pressure Safety Injection Pumps During a Iess-of-Coolant Accident," (Reference 18) describes events at Sequoyah  ;

Units 1 and 2 involving HPI pump gas binding. On August 2.2,1990, unit 2 operators '

staned the "B" charging pump. They saw the pump motor amperage and flow rate fluctuate, and stopped the pump. Utility personnel determined that hydrogen accumulated in the '

suction piping of the pump and in the RHR crossover piping to the charging header. The NRC's ASP program estimated this event had a CCDP of about 6 x 10* (Reference 19).

L On September 16, 1990, operators found a hydrogen bubble on the suction side of the unit 1  :

charging pumps. Hydrogen was collecting in the piping between the "A" RHR pump and the  ;

charging pumps at a rate of 0.5 cu.ft. per hour. Hydrogen was coming out of solution partially due to localized reductions in pressure because of piping elevation differences and  !

eccentric pipe reducers (including orifices). The utility vented the piping every 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> as ,

immediate corrective action. ,

Hydrogen collecting in the piping between the RHR pump and the charging pump suction '

header creates the potential to gas bind both charging pumps. This occurs during switchover from high-pressure injection to high-pressure recirculation. IN 82-23, Supplement 3, shows high-pressure recirculation loss is the dominant risk contributor to core damage frequency at Sequoyah. Suggestion 4B relates to this event, t i

Comanche Peak Unit 1 and Haddam Neck On March 26,1991, the Comanche Peak utility identified two hydrogen voids in chemical and volume control system piping (Reference 20). One void in a 3-inch diameter boric acid tank gravity feed line could affect the HPI pumps during a SI. HPI pump suctions transfer from the VCT to the refueling water storage tank (RWST) during a SI. The RWST is lower in pressure than the VCT. Transfer to the RWST causes a lower HPI pump suction header pressure which could result in the hydrogen void expanding into the suction lines of the pumps. The utility indicated the void could potentially damage or gas bind the pumps.

The second hydrogen void was in a 2-inch diameter alternate bcration line. The NRC's ASP i program estimated this event had a CCDP of about 6 x 105 (Reference 21). The dominant l core damage sequence involves a small break LOCA, auxiliary feedwater and HPI success, and high-pressure recirculation failure.

Previous HPI pump gas binding events occurred at Comanche Peak on October 11, 1990 (Reference 22), and Haddam Neck on July 9,1990 (Reference 23). The utility at Comanche Peak incorrectly designed and installed solenoid operated vent valves between HPI pump suction piping and the VCT to prevent gas build up. VCT hydrogen could have bound the pumps, and failed the high-pressure or recirculation functions, if the HPI pumps had to

, provide injection or recirculation flow. Haddam Neck had a similar situation. The NRC's '

ASP Program determined Haddam Neck's event had a CCDP of about 6 x 10' '

(Reference 19).

11

Utilities periodically checking ECCS systems for cas buildup and venting the sptems would avert this problem. His is in addition to periou TS required pump casing and discharge ,

piping venting. Suggestion 4B also relates to these events.

2.5 Insufficient Pump Cubicle Cooling i

Beaver Vallev Unit 1 On December 3,1991, the utility determined they had potentially degraded safe shu*down [

capability at Beaver Valley Unit I due to inadequate HPI pump ventilation (Reference 24). j Each HPI pump cubicle did not have enough ventilation flow to maintain motor temperatures within required environmental qualidcation (EQ) limits. A manual isolation damper, common to all three HPI pumps, failed in a partially closed position. The utility repaired the damper and put it in its proper position.  ;

On November 27,1991, the licensee determined that HPI pump cubicle ventilation flows ,

were inadequate for two of threa HPI pumps. A balance damper failed in a panially closed position when a damper blade set screw became loose. The utility repaired and repositioned I it to allow adequate exhaust flows. They also did an engineering review of the cubicle 1 ventilation original design calculations. They found the calculations assumed the utility  !

would supply temporary ventilation to the HPI pump cubicles during an accident. This  ;

would maintain the ambient temperature of the HPI pump cubicles below the 120* F HPI  !

pump motor EQ limit. Temperatures in the cubicles could reach 170 F without temporary [

ventilation. The utility never made this requirement part of the Beaver Valley Emergency i Operating Procedures. The utility calculated that they would have to increase the 2000 scfm .

cubicle ventilation flow to 3000 scfm. This would keep the cubicles below 120* F during accident conditions. However, the utility concluded that increasing the flow would be '

unacceptable because it would reduce exhaust flow from other areas. They also concluded they could not revise the emergency operating procedures to require adding temporary l

ventilation since an unreviewed safety question would exist.

The utility reviewed all heat loads and required heat removal capacity in safety related areas to reassess the ventilation system design basis. They then revised their test program to verify heat removal flow rates on a periodic basis. They also developed a ventilation balancing test to identify similar damper failures. The NRC's ASP Program determined Beaver Valley's ,

event was a potentially significant event that was impractical to analyze (Reference 21).

Testing ECCS cubicle ventilation systems periodically to make sure they are adequate under >

accident conditions without having to add additional temporary ventilation would preclude this situation. Suggestion 5 relates to this event.

t a

12  ;

i 2.6 Inadequate Engineered Safety Features Actuation System Testing ,

NRC Information Notice 93-38 NRC IN 93-38, " Inadequate Testing of Engineered Safety Features Actuation Systems,"

(Reference 25) describes several instances where utilities did not test all circuits necessary to assure they are operable. The IN focuses on ESFAS testing problems with containment spray and containment isolation systems. These are not ECCSs, but similar ESFAS testing i problems might exist with ECCSs. >

At South Texas Units I and 2 on September 15,1992, utility personnel discovered they were ,

not testing containment spray ESFAS circuitry correctly. They opened logic relay contacts to prevent containment spray system inadvertent actuation during testing. They then closed the ,

r logic relay contacts after testing. However, their procedure did not require them to verify the contacts are closed and the circuits are continuous. Contact failure could cause the circuits to be inoperable. The licensee tested the circuits and revised their procedures to correct this problem.

. A similar situation happened at McGuire Units 1 and 2 on February 16, 1993. The licensee did not do a continuity check for containment spray logic relay contacts opened during testing. They also did not do a continuity check for a reactor protection system channel test relay contact opened during testing. They revised their procedures to fix this problem. At Catawba Units 1 and 2 on February 16,1993, the utility found they were not doing continuity ches b for normally deenergized contacts. After finishing testing, verifying that i ECCS relaidi

• SFAS logic relay contacts are closed and the circuits are continuous would '

keep this situation from occurring. Suggestion 6A relates to these events.

Troian On December 11,1991, Portland General Electric workers realized they we not correctly testing all ESFAS functions associated with manual ECCS initiation (Reference 26). They  :

did not test the following:  ;

r

• initiating manual containment isolation would cause containment ventilation ,

isolation (CVI) and containment isolation (including overlap testing to all solid-state protection system (SSPS) master and slave relays)

• initiating manual containment spray would cause CVI (including overlap testing to all SSPS master and slave relays)

• initiating manual S1 would cause  !

- reactor trip

- SI

- EDG start

- safeguards sequence ,

- auxiliary feedwater pumps start 13

9 i

l i

i l

i

- phase A containment isolation

- CVI

- control room isolation

- feedwater isolation

- automatic SI block permissive The utility also identified that they were not testing the following manual block switches and ,

perraissive status lights:

• manual block switches

- source range block reset

-intermediate range block

- power range block

- pressurizer pressure SI block reset

- steam line S1 block reset

• permissive status lights

- source range nuclear instrumentation system trip blocked  :

-intermediate range nuclear instrumentation system trip blocked

- power range nuclear instrumentation system low-setpoint trip blocked

- pressurizer SI blocked

- steam line Si blocked i

- automatic Si blocked  !

- power above P-6

- at power trips blocked P7 ,

- single-loop low-flow trip blocked P8  !

- power above P10  !

- pressurizer SI block permissive P11

- low-low T_ P12 ,

-impulse pressure below P13 The utility revised testing procedures and tested the above ESFAS manual actuations, block switches, and permissive status lights. Correctly testing all ESFAS functions associated with manual ECCS initiation will keep this problem from occurring. The OM-15 standard should give specific examples of ESFAS functions related to ECCS for clarity. Suggestion 6B ,

relates to this event. .

2.7 Incorrect Emergency Diesel Generator Electrical Imading NRC Information Notice 93-17 NRC IN 93-17, " Safety Systems Response To Loss-of-Coolant and loss-of-Offsite Power,"

(Reference 27) describes a situation at Surry involving deficient EDG loading logic. The logic could have caused EDG overloading if safety system electrical loads automatically 14  ;

'I

- l l

started, and a delayed loss of offsite power (LOOP) occurred. EDG loading logic is normally designed to respond correctly to a LOOP, LOCA, or simultaneous LOOP and ,

LOCA. However, it might not respond correctly to other possible event sequences, failing to i re-energize vital loads or improperly overloading and failing EDGs. A LOCA with delayed l LOOP can occur by:

• the LOCA causing a turbine trip and subsequent power loss to the grid, followed by grid instability and associated LOOP seconds later

• the LOCA causing a turbine trip and subsequent power loss to the grid, followed by switchyard voltage degrading and actuating degraded voltage relays, causing a i delayed LOOP ,

• vital buses failing to transfer to the offsite power source, if plants use a unit l auxiliary transformer to normally supply safety bus power A LOOP with delayed LOCA can also occur. This happens when a LOOP occurs, and a primary system safety relief valve lifts and fails to correctly rescat. RCS inventory loss then creates a LOCA initiation signal. Testing EDG starting and loading logic during ECCS  !

testing to verify they will respond correctly to all credible LOOP and LOCA sequences fixes  ;

these problems. Suggestion 7A relates to this event.

NRC Information Notice 92-53 ,

NRC IN 92-53, " Potential Failure of Emergency Diesel Generators Due to Excessive Rate of  !

Imading " (Reference 28) describes incorrect EDG loading at several power plants. On March 17,1992, an NRC Electrical Distribution System Functional Inspection team found that EDG load sequencer logic at Calvert Cliffs Units 1 and 2 could load the EDGs faster than their design capability. This could cause voltage degradation or stall the diesels.  :

Certain loads such as the containment spray pump, and heat ag, ventilation, and air  !

conditioning could start at the same time other loads automatically sequence onto the emergency electrical buses. This problem occurs if a small break LOCA creates a slow containment pressure increase and a LOOP occurs. Salem Nuclear Generating Station, the Kewaunee Nuclear Power Plant, and the Palisades Nuclear Plant also had this problem.

Similar difficulties could also exist in EDG shutdown sequencers. Shutdown sequencers control EDG loading following a LOOP when no postulated accident occurs. The NRC's ASP Program preliminarily designated the Calvert Cliffs event to be potentially significant ,

but impractical to analyze (Reference 29). Suggestion 7A also relates to these events.  !

NRC Information Notice 91-13 NRC IN 91-13 " Inadequate Testing of Emergency Diesel Generators (EDGs)," (Reference

30) shows that utilities did not verify EDGs could carry maximum expected electrical loads. They did not verify load shedding logic operation, also. These events show utilities are not verifying EDGs can assume design basis electrical loading during an accident.

15 I

ne Yankee Rowe EDGs did not reach their TS required loading of 400 kW when connected in parallel to the grid. Generator frequency dropped to 58 Hz with a 385 kW maximum electrical output during subsequent testing using a resistor bank. The utility determined high ambient air temperature reduced engine power and cooling, even though air temperature was within design basis limits. The utility did not consider ambient air temperature during previous testing. The root cause was the engines being undersized. The manufacturer's 400 kW EDG rating also did not account for ambient air temperature effects. The utility replaced all three EDGs with bigger units. A similar situation occurred at Fort Calhoun.

Fort Calhoun's EDGs could reach design rating at high ambient air temperature, but could not maintain the design rating for an extended time.

Vermont Yankee workers did not compensate for the expected electrical power factor (pf) during testing. Their test required the EDGs to maintain a 2500 to 2750 kW load. This equals 2500 to 2750 kVA at pf = 1.0. The utility judged this met the FSAR 2471 kW maximum EDG loading. They subsequently found the worst case EDG loading could reach x 2751 kW. They also realized the EDG actually has a pf of .85 lagging, causing actual generator output current to be higher. Generator output current and kVA at pf = .85 are about 1.18 times those at pf = 1.0, assuming a constant voltage. Thus, utility testing did not show the EDGs could carry accident loads.

l The Millstone Unit 3 utility did not verify five nonsafety-related loads and two safety-related loads would shed. This condition existed from April 1986 to January 1990. The licensee subsequently found the load shedding circuits worked correctly.

Considering worst case conditions (frequency, voltage, pf, and the environment) when testing EDG load shedding and loading helps prevent these circumstances. Simulating worst case environmental conditions might be impmetical, but analysis can be used to remedy this.

Suggestion 7B relates to these events.

Indian Point Units 2 and 3 ,

On March 24, and May 8,1989, the utility determined that under certain circumstances, the EDGs could exceed their two-hour emergency load ratings (Reference 31) and (Reference -

32). At unit 2, a 1970 Westinghouse EDG static loading study showed each EDG load was less than 1950 kW with all three EDGs operating. A later Westinghouse dynamic EDG

• analysis found that an EDG could be loaded as high as 2025 kW for about 30 minutes during  :

the high-head recirculation phase. The EDGs could also experience loads as great as 2249 kW during switchover from injection to the low-head recirculation phase. The improved safety analysis methodology evaluates the loads dynamically, as they are sequenced on or off.

The old method evaluated final, static loads at the end of the recirculation switchover. A similar situation existed at unit 3. The utility determined control room operators could have taken actions to prevent any EDG overload. Suggestion 7B also relates to this event.

16 1

.- ]

2.8 Inadequate Testing Frequency i

NRC Information Notice 93-13 NRC IN 93-13, " Undetected Modification of Flow Characteristics in the High-Pressure Safety injection System," (Reference 4) discusses a situation at ANO Unit 2 involving undetected low HPI system flow rates. On September 23,1992, the licensee found low HPI l system flow rates through five system valves. The licensee determined the total flow rate through three injection paths with the lowest flows was less than that assumed in plant design i basis calculations. This happened when the utility replaced valve stem disc assemblies in -

early 1982 on a like for like basis. The replacement parts were not identical to the original assemblies. This resulted in an average 23 percent flow reduction through the injection paths. The licensee reworked the disks and did flow testing to fix the problem.

ANO Unit 2 TSs require flow balance testing after making system modifications that could .

affect flow. However, the TSs do not require periodic flow balance testing. The licensee did not realize the replacement parts were different from the originals, and thus did not do testing after replacing the disks. The utility decided to verify satisfactory HPI system flow  :

balance and capacity during each refueling outage as a result of this event. Performing SI system total flow and branch line flow testing to balance individual injection line flow rates every refueling outage helps prevent these circumstances. Suggestion 8 relates to this event.  ;

Byron Unit 2 On September 28,1990, the utility discovered the "A" Si branch line had no flow during l testing while the "B," "C," and "D" lines had high flow rates (Reference 33). An investigation found a closed loop "A" cold leg SI line throttle valve. The utility believed they closed the valve during the previous refueling outage in February 1989. They used the  ;

closed valve to isolate a downstream check valve for maintenance. This valve must be l throttled open to give balanced flow to the RCS cold legs. The utility attributed the problem  !

to difficulty in measuring the stem position of the valve. They then reset the valve and did ,

flow verification testing to be sure the throttle valves were in their correct positions.

Licensee safety analysis showed the SI system would deliver less water to the RCS than l assumed in accident analysis. However, peak fuel cladding temperature would stay below 10 '

CFR 50.46 limits. Performing SI system total flow and branch line flow testing every refueling outage helps prevent this situation from occurring. Suggestion 8 also relates to this .

event.

I l

Callaway_1 On June 28,1991, the utility discovered that an ECCS SI cold leg injection throttle valve had been mispositioned since May 5,1989 (Reference 34). The utility determined SI flow would exceed the SI flow upper limit of 655 gpm, rendering both SI trains inoperable.

Utility calculations showed the maximum flow rate would be 706 gpm. Utility people l mispositioned the valve following valve maintenance during a refueling outage. The NRC's 17

4 en 1

ASP Program determined Haddam Neck's event was a potentially significant event that was impractical to analyze (Reference 21). Performing SI system total flow and branch line flow I testing every refueling outage helps prevent this type of problem. Suggestion 8 also relates ]

to this event. '

3 FINDINGS -

Events continue to occur that cause ECCSs to become degmded or potentially unable to perform their intended safety functions. Some of these events fall into the following categories based on the proximate causes of the events-

• inadequate instrumentation

• incorrect pump net positive suction head

+ pump minimum flow recirculation line problems

• pump gas binding problems

• insufficient pump cubicle cooling ,

• inadequate ESFAS testing e incorrect EDG electrical loading

• inadequate testing frequency

• inoperable ECCSs due to testing The NRC's ASP Program determined several events had CCDPs ranging from about 6 x 10' to 6 x 10'.

i 4

4 CONCLUSIONS i

)

Operating events suggest utilities have not integrated ECCS operating experience information  !

3 into their ECCS testing programs. Including this information in the ASME standard will l l help make utilities aware of specific ECCS problems, and helps assure utilities will address  !

j the operating experience and will remain aware of it over time.

1 5 SUGGESTIONS  !

r j I suggest that the ASME OM-15 WG considers the items below when writing the OM-15  ;

< Standard on PWR ECCS Testing. l i

1. Lnad_gauate Instrumentation:

l i

I A. Improper Orifice Plate Flow Coefficients - Add requirements for the owner to i

use CCP and SI pump header flow measurements to confirm total flow, and use 4 l branch line flow measurements for balancing individual injection line flow rates. l I

IB. Incorrect Orifice Plate K-Factors and Flow Transmitter Calibration - Consider l adding specific I&C examples to OM-15 Section 7.2 on measurement uncertainty. I 18

--,-re- , ___ -_ --_ _ __ __ _ _ _ _ _ _ _ _

4

• l l

The examples should include verifying ECCS orifice plate K-factors are correct, and correlating SI system flow transmitter calibration data with the installed flow orifice plates.

IC. Incorrectly Installed and Deformed Orifi~: Plates - Add requirements for the owner to verify they installed beveled edge orifice plates in the correct orientation (direction). Orifice plate handle markirgs (e.g., orifice diameter, flange size, pressure rating, the word " inlet") face the inlet direction, and the orifice beveled edge faces the outlet direction. Also the owner should check for flow and differential pressure induced deformation in orifices used as flow restrictors to limit flow rates.

ID. Inadequate Instrumentation Setpoints - Utilities should make sure they account for all potential error contributors to the measurement loop total uncertainties when calculating instrument setpoint margin values.

IE. Inadequate Instrumentation Setpoints - Add requirements for the owner to trend the direction of changes in ECCS instrumentation accuracy and drift. Add requirements for the owner to not use the SRSS method to determine uncertainty attributes for setpoint margins if instrument accuracy and drift change in only one direction.

IF. Inadequate Instrumentation Setpoints - Add requirements for the owner to consider static pressure effects when developing or revising procedures and calibrating ECCS pressure transmitters.

IG. Inadequate Response Time Testing ofInstruments With Pressure Dampening Devices - Add requirements for the owner to include existing ECCS pressure sensing instrument snubbers in the test configuration when they test instrument response times.

2. Pumn Net Positive Suction Head in the Recirculation Mode: ,

2A. Insufficient Net Positive Suction Head - Utilities should address the effect of the containment spray pumps on HPI NPSH when the pumps simultaneously take suction from the LPI discharge. The ASME standard does not address containment spray systems unless they provide core cooling. The utility should simultaneously run the containment spray pumps during ECCS testing. Plant operators should then throttle the LPI discharge valves to positions required by operating procedures to make sure the HPI pumps have enough NPSH. ,

c 2B. High Pump Suction Pressure - Add requirements for the owner to verify ,

maximum suction pressures to the CCPs and the SI pumps are not excessive. This prevents loosing post accident containment sump inventory through the seal water heat i exchanger relief valve outside containment during the recirculation phase following a small break LOCA.

19

3. Pump Minimum Flow Recirculation Line Problems:

3A. Deadheading One Of Two Emergency Core Cooling System Pumps In Systems Having A Common MiniFlow Recirculation Line For Both Pumps - Add requirements for the owner to consider the potential for pump operation near shutoff head causing deadheading of the weaker pump.

3B. MiniFlow Recirculation Line Flow Capacity - Pump miniflow recirculation lines might not have adequate capacity. Some pump manufacturers advise miniflow line capacities of 25 percent to over 50 percent of best efficiency flow for extended operation. Add requirements for the owner to verify ECCS pump miniflow recirculation line flows meet pump manufacturers' criteria.

4. Pumo Gas Binding:

t 4A. Accumulator Nitrogen Binding - Add a suggestion that the owner considers the following when performing full flow RCS accumulator check valve testing:

• test the valves after refueling rather than during shutdown prior to refueling  ;

• determine if it is appropriate to test the check valves with fuel in the reactor vessel ,

• reduce accumulator nitrogen pressure or remove the reactor vessel head  :

This minimizes the effects of nitrogen injection into the RCS during testing, preventing RHR pump gas binding.

4B. Hydrogen Binding - Add requirements for the owner to periodically check l ECCS systems for gas buildup and vent the systems. This is in addition to any.

periodic TS required venting of pump casing and discharge piping. ,

l

5. Insufficient Pump Cubicle Cooline: Add clarifying words to assure utilities test  ;

ECCS cubicle ventilation systems periodically to make sure they are adequate under accident conditions without having to add additional temporary ventilation. ,

6. Inadequate Engineered Safety Features Actuation System Testing: i 1

6A. Add requirements for the owner to verify that after finishing testing, ECCS l related ESFAS logic relay contacts are closed and the circuits are continuous if workers opened them for testing.

6B. Add clarifying information to help owners identify all ESFAS functions associated with manual ECCS initiation. The standard should include examples of overlap testing to all SSPS master and slave relays, and testing block switches, and permissive status lights.

1 1

20 l

I I

7. Lncorrect Emercency Diesel Generator Electrical Loading:

7A. Emergency Diesel Generators Do Not Respond to all LOOP and LOCA Sequences - Add requirements for the owner to test EDG starting and loading logic during ECCS testing to verify they will respond correctly to all credible LOOP and LOCA sequences. This includes EDG loading following a LOOP when no postulated accident occurs.

7B. Emergency Diesel Generator leading - Add requirements for the owner to  ;

consider worst-case conditions (frequency, voltage, electrical power factor, and the  ;

environment) when testing EDG load shedding and loading. Simulating worst-case environmental conditions might be impractical. The utility should use analysis to correct for this. Testing should verify EDG loading for all ECCS phases (modes),

also.

8. Inadequate Testing Frequency: Add requirements for the owner to do Si system total flow testing and branch line flow testing to balance individual injection line flow rates every refueling outage.

t i

6 REFERENCES

1. Portland General Electric Company, Licensee Event Report 50-344/91-104)l, ,

Trojan NucIcar Plant, August 15, 1991.

2. Public Service Electric and Gas Company, Licensee Event Report 50-272/90-14, Salem Generating Station Units 1 and 2, May 25,1990.

3. U.S. Nuclear Regulatory Commission, Information Notice 90-65, "Recent Ori6ce Plate Problems," October 5,1990.

4. Consolidated Edison Company of New York, Inc., Licensec Uvent Report 50-247/91-08-01, Indian Point Unit 2, November 27,1991.

k

4. U.S. Nuclear Regulatory Commission, Information Notice 93-13, " Undetected Modification of Flow Characteristics in the High Pressure Safety Injection System," February 16, 1993.

5. Rochester Gas and Electric Corporation, Licensee Event Report 50-244/89-07, Ginna Nuclear Power Plant, July 19, 1989.

6. Tennessee Valley Authority, Licensee Event Report 50-259/88-07-01, Browns Ferry Unit 1, March 21,1989. *

7. U.S. Nuclear Regulatory Commission, Information Notice 89-68, " Evaluation of Instrument Setpoints During Modifications," September 25,1989.

21

- - . - .~ .-

1 1

8. U.S. Nuclear Regulatory Commission, Information Notice 91-75, " Static Head Corrections Mistakenly Not Included In Pressure Transmitter Calibration ,

Procedures," November 25,1991. 1

9. U.S Nuclear Regulatory Commission, Inspection Report 50-369/91-19, McGuire j Nuclear Station, August 29,1991.

10. Arkansas Power and Light Company, Licensee Event Report 50-368/90-02-01, .

Arkansas Nuclear One Unit 2, January 31,1990.  !

i

11. Commonwealth Edison Company, Licensee Event Report 50-237/87-34, Dresden Nuclear Power Station, October 16,1987.

12. Toledo Edison Company, Licensee Event Report 50-346/86-39, Davis-Besse Nuclear -

Power Station, September 4,1986.  ;

13. U.S. Nuclear Regulatory Commission, Information Notice 92-33, " Increased -

Instrument Response Time When Pressure Dampening Devices Arc Installed," April  !

30,1992. l

14. U.S. Nuclear Regulatory Commission, Information Notice 88-74, "Potentially Inadequate Performance of ECCS in PWRs During Recirculation Operation Following [

a LOCA," September 14, 1988.

[

15. Tennessee Valley Authority, Licensee Event Report 50-327/91-23, Sequoyah Nuclear .

Plant Units 1 and 2, September 30,1991.

16. U.S. Nuclear Regulatory Commission, Information Notice 87-59, " Potential RHR Pump Loss," November 17, 1987.

17. U.S. Nuclear Regulatory Commission, Information Notice 89-67, "Imss of Residual Heat Removal Caused by Accumulator Nitrogen," September 13, 1989.  !

18. U.S. Nuclear Regulatory Commission, Information Notice 88-23, Supplement 3,  ;

" Potential For Gas Binding of High-Pressure Safety Injection Pumps During a Loss--  !

of-Coolant Accident," December 10, 1990. ,

19. U. S. Nuclear Regulatory Commission, " Precursors to Potential Severe Core Damage Accidents: 1990 A Status Repon," NUREG/CR-4674, Vol.14, August 1991.

20. Texas Utilities Electric Company, Licensee Event Report 50-445/91-12, Comanche -[

Peak Unit 1, April 25,1991.  !

21. U.- S. Nuclear Regulatory Commission, " Precursors to Potential Severe Core Damage i Accidents: 1991 A Status Report," NUREG/CR-4674, Vol.16, September 1992. l,

22. Texas Utilities Electric Company, Licensee Event Repon 50-445/90-35, Comanche Peak Unit 1, November 13, 1990. .

22

t

23. Connecticut Yankee Atomic Power Company, Licensee Event Report 50-213/90-08, ,

Haddam Neck, August 1,1990.

1

24. Duquesne Light Company, Licensee Event Report 50-334/91-32, Beaver Valley j Power Station Unit 1, January 2,1992. j

25. U.S. Nuclear Regulatory Commission, Information Notice 93-38, " Inadequate Testing j of Engineered Safety Features Actuation Systems," May 24,1993.

26. Portland General Electric Company, Licensee Event Report 50-344/91-37, Revision 2, Trojan Nuclear Plant, January 30,1992.

27. U.S. Nuclear Regulatory Commission, Information Notice 93-17, " Safety Systems j Response to less of Coolant and Loss of Offsite Power," March 8,1993.

28. U.S. Nuclear Regulatory Commission, Information Notice 92-53, " Potential Failure  ;

of Emergency Diesel Generators Due to Excessive Rate of Imading," July 29,1992.

t

29. U. S. Nuclear Regulatory Commission, " Precursors to Potential Severe Core Damage  !

Accidents: 1992 A Status Report," NUREG/CR-4674, Vol.18, Preliminary.  ;

30. U.S. Nuclear Regulatory Commission, Information Notice 91-13 " inadequate Testing of Emergency Diesel Generators (EDGs)," March 4,1991.  ;

31. Consolidated Edison Company of New York, Inc., Licensee Event Report 50-247/89-  !

06, Indian Point Unit No. 2, April 24,1989.

32. Consolidated Edison Company of New York, Inc., Licensee Event Report 50-286/89-10, Indian Point Unit No. 3, May 30,1989.

33. Commonwealth Edison, Licensee Event Report 50-455/90-07, Byron Unit 2, October  ;

26,1990. )

34. Union Electric, Licensee Event Report 50-483/91-03, Callaway Plant Unit 1, July 26,  ;

1991. l i

l 1

j 23

.