ML20056H447

Provides Update of WOG Activities & Discussion of Proposed Strategy for Resolution of Salem Rod Control Sys Failure Event,Per GL 93-04

ML20056H447
Person / Time
Site:	Salem
Issue date:	09/03/1993
From:	Newton R, Walsh L WESTINGHOUSE OPERATING PLANTS OWNERS GROUP
To:	Thadani A NRC
References
GL-93-04, GL-93-4, OG-93-75, NUDOCS 9309090333
Download: ML20056H447 (10)

Text

t Westinghouse Owners Group

- tn. ==

Asateaws % 0*ago M W G=e'w3 'W '

.F*cn !W ImptW.F%

-, em %

• Me P pme 4 *.gnt s=%...- .

.m s.we im a cc. wo w  % em %

mea *:0 ithW 4 Mwer hc*w"D ces & 5 eC*rd Weccese ieC*'C % k.090 f 4C*rc Dower C.;- c, ;n W Vw *M Numer Au% sae 0:P=:rM Gec'PC 4 3as WecSmmn PAW:lievee NUCes Esc *ft C4C e- W w -<n e . --% w c. s,- u m no w we tw %

w sco w uun m m e.e.e scre w -

wn.2 s t.m s-.oe ose .w m an w 0G-93-75 September 3,1993 Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555 Attention: Mr. Ashok C. Thadani Director Division of Systems Technology Office of Nuclear Reactor Reseamh

SUBJECT:

Westinghouse Owners Group l Status Report: WOG Strategy and Activities For the Generic Letter 90 Day Response For the Salem Rod _ Control System Failure Event l

l 1

REFERENCE:

NRC Generic Letter 93-04, " Rod Control System Failure and i

Withdrawal of Rod Control Cluster Assemblies,10 CFR 50.54(f),"

issued June 21,1993. l I

I The purpose of this letter is to provide the Nuclear Regulatory Commission with an update of ,

the Westinghouse Owners Group (WOG) activities and a discussion of the proposed strategy l

for resolution of the Salem Rod Control System Failure event for the 90 day response to 52C  ;

Generic Letter 93-04.

i ncu,rravt } j l

000023 9309090333 930903 P  !

PDR TOPRP EMVWEST E:

C PIrR {.

k l

The WOG intends to show that General Design Criterion (GDC) 25 continues to be met for affected Westinghouse plants. The basis for this is a single logic cabinet failure does not  ;

result in different CRDM commands within a group of rods. Furthermore, the probability of a single failure in conjunction with another mechanism resulting in movement of less than a full group of rods is extremely low. In addition, existing rod motion surveillance testing provides assurance that such a condition would be detected. A three-dimensional safety analysis was also gcformed to demonstrate that the DNB design basis will not be exceeded even if large asyminetric rod withdrawals are assumed to occur.

Outline of WOG Strategy The 90 day response to NRC GL 934)4 requires that licensees provide their determination as to whether or not they continue to satisfy GDC 25 (or its equivalent for some older plants).

GDC 25, " Protection system requirements for reactivity control malfunctions," of Appendix A to 10 CFR 50 states that specified acceptable fuel design limits shall not be exceeded for any single malfunction of the reactivity control systems.

The overall strategy of the WOG is to demonstrate, that movement of less than a full RCCA group is not credible due to a single failure in the Rod Control System. This has been evaluated by conducting Rod Control System testing in the Salem training center, examining the existing Rod Control System Failure Modes and Effects Analysis (FMEA), and conducting an equipment survey to determine the frequency and significance of control system circuit card failures. The resuhs of these activities are ptovided in this letter. In addition, the WOG has confirmed that there is no safety signi& mace for any asyugrscic RCCA withdrawal by using three-dimensional safety analyses.

De WOG still considers that, based on the results from the testing program, an asymmetric RCCA withdrawal will not result from a single failure in the Rod Control System without some other failure or mechanism present. As part of the new failure acceument performed on the existing Rod Control System FMEA, other failures have been identified and included in the test program that could result in corrupted current orders that are not related to the failures observed at Salem. Based on preliminary information, it has been determined that the likehhood of these types of failures is considerably more remote than a Salem-type failure and, thus, would not be considered as a credible single failure for the purposes of addressing GDC 25. None of the failures identified affect the ability of the reactor protection system to physically trip the reactor.

ac2rrrte

• 5 3 l

Rod Control System current order timing adjustments are being evaluated to provide additional assurance that, even if corrupted CRDM current orders occur, they will consistently j result in no rod movement (single rod, group, or bank). This would preclude a Salem-type '

failure event from occumng. If these timing changes are recommended by the WOG, a reasonable amount of time should be allowed (e.g., the first refueling outage after January 1994) until the recommended current order tirrnng adjustments can be made. De basis for allowing this time period is that existing rod motion surveillance tests provide assurance that failures will be detected and the analysis program concluded that the:e was no safety significance for affected Westinghouse plants for a Salem-type rod withdrawal.

I The WOG will be providing a recommended generic response for the 90 day response l requirement that each individual licensee can use as a basis for their submittal. This package )

will provide a summary of the WOG programs and include possible recommendations that current order tumng adjustments be considered to provide additional assurance that asymmenic rod motion can not occur and startup survedlance testmg be psfenied to ensure i proper current order timing. It will also state that for any other failures identified by the j failure assessment the probability of occurrence is extremely remov, such that they should not be considered to be within the boundaries of GDC 25.

WOG Testing Program l

The Westinghouse Owners Group performed testing at the Salem Traming Center on  !

August 9 through 11 to determine why the control rod drive mechanisms (CRDMs) respond inconsistently to the corrupted current orders present during the May 27,1993 Salem Rod Control event, and to observe how the CRDMs respond to other postulated current order  :

failure modes. The test program results show that there are four mechanisms that can prevent j the control rods from stepping correctly when subjected to corrupted current orders. Dese I mechanisms are explained in more detail in Attachment 1. The CRDM response to the  !

Salem-style corrupted current orders is explained in more detail in Attachment 2. l Discusskm of Additional Failures The WOG Failure Assessment determined that there were other component failures that could result in corrupted current orden and therefore affect rod movement. Rese failures result in .

the same curreat orders being sent to all rods within a group. This requires that another i mechanism be present in addidon to a demand for rod motion before asymmeme rod motion can occur. It has been determined that only appmximately four single failures have the potential for rod movement of less than a whole group of control rods.

)

i NRCLETreL'S i

i ShP 3 *93 16:31 l

l Preliminary Results of WOG Survey All WOG utilities were requested to provide information concerning failures in the Rod Control System via WOG Letter WOG-93-Ill, dated June 25,1993. He survey is in l response to the WOG commitment made to the NRC to evaluate the equipment performance l history of the Rod Control System. The pnmary purpose of this survey is to identify: 1) any l events that could be similar to the Salem event (i.e., how many events have occurred where  !

less than a group of rods moved) and 2) how many circuit card failures have occurred that I could result in corrupted current orders and possibly rod movement of less than a group of I rods. Preliminary results summanzing the survey findings were issued to the members of the i Systems and Equipment Engineering Subcommittee via WOG Letter ESBU/WOG-93-151, l dated August 2,1993.  !

ne only operational event reported where less than a full group of rods moved was the event experienced at Salem in May 1993.

The failure reports provided by the utilities identifled 40 card failures which have the l potential to corrupt CRDM current orders. These were evaluated to determine if their failure could have resulted in movement of less than a full group of control rods. If the failure j description indicated that an urgent alarm occurred to inhibit rod motion, that rods were '

dropped, or that the Rod Control System completely ignored the commands for motion (the step counters did not change position, etc.), the failure was coridered to be incapable of resulting in movement of less than a group of rods.

The majority of card failures spute occurred during the time interval since 1985. This can be attributed to several factors. He first is that a large number of plants started commercial operation in the mid-1980s. The second is that the data collecdon process has also improved during the same time period.

Based on these evaluations, it was not possible to rule out the potendal movement of less than a group of zods for six of the failures had rod motion in either direction been demanded.

Two of these six failures were included because the reporting plant could provide no spectfic data on why the cards were replaced. For the remaining four failures, one group of a rod bank did not move. With the limited amount of root cause data provided, it could not be ruled out that some of the rods might have started to move if additional motion demands had been made. Dree of the six card failures reported had the potential to allow movement of less than a group of rods were associated with shutdovm banks C, D, and E, and thus, would have been detected prior to starmp (criticality).

mumu

5EP a 3a istai --- .

When the six reported card failures or replacements that could have possibly resulted in the  !

movement of less than a group of control rods are added to the actual event that occurred at l

Salem, there have been, conservatively, seven potential or actual events in 250 million card l hours of critical operation. ne resultant failure rate is on the order of 3 x 10 * / critical hour.

It should be noted that the use of critical card hours is conservative because the cards could have been energized over the entire year (including shutdown hours). However, critical card hours are used as this is the most vulnerable time for a card failure and because the Rod Control System logic cabinet is energized when the reactor is critical.

Analysis Program Summary The results of the Analysis Subcommittee Program which analyzed asymmetric RCCA withdrawals using a three-dimensional code (WCAP-13803) were tr= mindt o the NRC via WOG-93-142, dated August 10,1993. The conclusion of the aralysis program was that the generic analyses and their plant-specific application demonstrate that DNB does not occur for a worst-case asymmetric rod withdrawal for all affected Westinghouse plants.

He single failures (approximately four) that have the potential for rod movement of less than a whole group of control rods can only occur during controlled rod movements.

Westinghouse is currently assessing the applicability of current licensing basis analyses to bound the effects of controlled asymmetric rod motion of a few steps.

Possible Corrective Action The Salem Training Center results showed that in order to achieve consistent CRDM operation when subjected to Salem-type corrupted current orders it is possible to ensure that the CRDMs do not move the rods, This can be accompHowi by ensuring that in the fC se -

mode the lift current is raised to the full current well before the movable gripper current is raised to full current. His causes the lift coil to raise the movable gripper assembly prior to the movable gripper engaging the drive rod and results in the movable gripper engaging the next higher drive rod groove. This also prevents the top of the drive rod lands from impacting the stationary grippers. It is also possible to retard the point when lift current is reduced to zero to ensure that the stationary gripper engages the rod prior to the point when the movable gripper assembly drops. Tests were run in the Salem Training Center to verify that normal rod motion occurred in the absence of any c.ouuy-d signals when these timing changes were implemented. De final timing adjustments will be based on actual plant data for mechanism response times. Any recommended timmg changes can be implemented by plant personnel by repositioning diodes on Logic Cabinet decoder cards.

.N h

J Upcoming Meeting ne WOG Steering Commit:ee has arranged for a meeting with the NRC Staff on Monday, September 13.1993, in Rockville begmmng at 100 pm. The purpose of the meeting is to provide additional discussion regarding the strategy outhned in this letter and obtain NRC feedback.

i Summary The WOG intends to show that GDC 25 continues to be met. De basis for this is that:

1) A single failure does not, in and of itself, result in different CRDM commands within i

a group of rods. Therefore, a second mechanism must be present before movement of less than a group of contml rods can occur.

2) The probability of asyuuwde RCCA movement is extremely low. Only one operational case has been observed and only six other card failures were identified that could have resulted in asymrrenic rod movement if the other mehammis were present.

3) In the remote case that avement of less than a group does occur, it will be detected before any core design criteria are exceeded. Routine rod trotion surveillance tests j demonstrate that asymmetric rod motion will not occur. Plant operators a:e trained to monitor rod movement and will detect any abnorrral movement prior to exceeding the normal rod deviation limits. Alarms are present to assure that operators are aware of abnormal rod configurations. l

4) Westinghouse is currently assessing that the present heensing basis analyses demonstrate that the DNB design basis is maintained for all aspwsic rod motion of a few steps.  ;

i h

natcunua 9

i'

~

The Rod Control System current order tmung adjustments that are being evaluated l 5) would provide additional assurance that asymmetne rod movement will not occu addition, the three-dimensional safety analyses performed by the WOG concluded that the DNB design basis would not be exceeded for large asymmetric rod withdrawals, thus, allowing a reasonable implementation time period should this be recommended.

Additional supporting information will be provided at the September 13 meeting.

l l

\,

Very Truly Yours,

/ Wsde Lawrence A. Walsh, Chairman ~

l R ger A. Newton, Chairman Westinghouse Owners Group Regulatory Response Group -

Westinghouse Owners Gmup j

1 l

Attachments .

1 cc: WOG Steering Committee (IL, IA) l WOG Primary Representatives (IL, I A) i William T. Russell, NRC (IL, I A) l C.K. McCoy, Georgia Power (IL,1 A) l LP. O'Hanlon, Virginia Power (IL, I A) l NJ. Liparulo. E (IL,1 A) l ,

j. K.J. Voytell, W (IL, I A) f i

i

$\

i.

J i

i I marrw j

i

A'ITACHMENT 1 to OG-93-75 i

Daecription of Mechanisms that Can Prevent Correct Rod Motion with CRDMs Subjected to Corrupted Current Orders Inability of stationary gripper to release - If the lower side of the stationary gripper is placed in contact with upper side of a drive rod land, the grrpper rnay not swing free when the stationary coil is doenergized. This situation develops when the lift coil energizes and raises the rnovable gripper assernbly while both the stationary and movable grippers are engaging the drive rod. The position of the rod (on bottom /off bottom) is important because it detemtines whether the CRDM grippers are carrying the weight of the drive rod and rod control cluster assembly (RCCA), which reduces the upward force when the lift coilis energized. Also important is the condition of the gripper and drive rod lands (surfaces that are not used during normal CRDM operation).

Inability of movable gripper to release - If the lower side of the movsble gripper is placed in contact with upper side of a drive rod land, the gripper may not swing free when the movable coil is dw ized. e "Usis situation develops when the lift coil releases the movable gripper assembly while both the movable and stationary grippera are engaging the drive rod. 'Ihe position of the rod is not a factor because the weight of the rod is carried by the stationary gripper. "Iho surface condition of the gripper and drive rod lands is a factor.

Race conditions - Normal current orders allow sufficient time for electromagnetic fitat to e build up arxi decay in the CRDM coils and for mecharrical components to complete their motion in a water medium that applies hydraulic damping. If the current orders are corrupted j such that the time between operations is changed, race condidons can be created that become  ;

dependent on the electrical and mechanical tolerances of within an individual CRDM.

1 i

Inability to complete one cycle before starting another cycle - Normal current orders ensure that the CRDM has completed all of its mechanical motion befcre the start of the next motion l

cycle. If the current orders ec corrupted such that the orders are changing at the end of the I 780-rrmi-~xi cycle, mecha:dcal actions from one cycle can occur during the beginnmg of the next cycle, and We on rod speed, can interfere with rod motion. Demanded rod l

speed is the critical vuiable, since speed determines the amount of deed time in,a the 780-millisecond rod steps.

• l r

J

, u

+

s

)

NRCUHTERA 4

1. s i

l'

• l

""~ '

Ep 3 .g3 g 3, I

ATTACHMENT 2 to OG-93-75 (Page 1 of 2)

Effect of Salem-Style Corrupted Current Orders on CRDM Operation With the corrupted current orders present and the rods on the bottom. the following seq of events occurs:

Prior to the command for motion, the CRDM stationary coil is energized at reduced current and the drive rod and RCCA are resting on the fuel assembly top nor.zle. Th stationary gripper engages a groove in the drive rod, but the gripper may or may not be in contact with either surface of the drive rod land.

When rod motion is demanded, the stationary coil current is raised from reduced to full current, while at the same time, movable coil current is raised from zero to ful current.

After a short delay while flux builds up in the movable coil, the movable gripper engages the drive rod.

. Shortly into the 780 mtDisecond movement cycle, the lift coil current is raised fr zero to full current. The stationary gripper is still at full current and both the stationary and movable grippers are engaging the drive rod. After the lift coil flux bmids up, the drive rod is rapidly raised apprad=Wy 1/4 inch, at which point the upper side of the drive rod land impacts against the lower :urface of the statio gripper. The hard-faced gripper may mark the upper surfa:e of the drive rod Note that this potential scarring is only possible when the wuuptsi signals are present and does not occur during normal operation. The stationary and movab1: grippers hold the drive rod under tension.

• Later in the cycle, the stationary coil current is lowered from full to zero current.

After a short delay, the stationary grippers should release the drive rod and the dr rod should be held only by the movable gripper. However,if the weight of the dr rod and RCCA is resting on the fuel assembly (i.e., the rod is on the bottom and CRDM is unloaded), the stationary gripper is held under tension against the upp of the crive rod land. Repeated cycling with the curuguid current orders may cause roughness of the contacting surfaces contributing to the inability of the station grrpper to disengage the drive rod. If the stationary gripper remains eng coil is unable to lift the drive rod and the rod will not step out. If the stationary grippers are able to release, the rod will move out 5/8 inch.

n e w ri a ,

' ' sE P 3 '93 1G ATTACHMENT 2 TO OG-93-75 (Page 2 of 2)

. Later in the cycle, the stationary coil current is raised from zero to full current and, almost immediately afterwards, the lift coil current is lowered from full to zero current. If the stationary gripper never released, the tension is released at this point and the stationary gripper no longer contacts the upper side of the drive rod land.

With the corrupted current orders present and the rods off the bom tue following sequence of events will txcur:

. Prior to the command for motion, the CRDM stationary coil is energized at reduced current and the drive rod is being held in place by the stationary gripper. Scecifically, the stationary gripper continues to engage a gmove in the drive rod and the upper surface of the gripper is in contact with the lower side of a drive rod land.

. When rod motion is demanded, the CRDM stationary coil current is raised from l reduced to full e.rrrent, while at the same time, movable coil current is raised from i zero to full current. After a short delay while flux builds up in the movable coil, the  !

movable gripper engages the drive rod. j

. Shordy into the cycle, the lift coil current is raised from zero to full current. 'Ihe stationary gripper is still at full current and both the stationary and movable grippers l are engaging the drive rod. After the lift coil ilux builds up, the drive rod is rapidly raised approximately 1/4 inch, at which point the upper side of the drive rod land impacts against the lower surface of the stationary gripper. The hard-faced gripper marks the upper surface of the drive rod land. The grippers hold the rod under tension. However,if the rod is off the bottom, the tension is reduced by the weight of the drive rod and RCCA counteracting the lift coil upward force. (The upward force I of the lift coil is approximately 400 lbs.: the downward force of the drive rod and RCCA, oyywximately 275 lbs.) j 1

. Later in the cycle, the stationary coil current is lowered from full to zero current.

After a short delay, the stationary grippers release the drive rod and the drive rod is held only by the movable gripper. The rod moves up 5/8 inch. l 1

- Later in the cycle, the stationary coil current is raised from zero to full cummt and, almost immeAintely akwmuls, the lift coil current is lowered from full to zero current. If the CRDM is carrying the weight of the drive rod and RCCA, it is possible for the lift coil to allow the movabic gripper assembly to drop back down 5/8 inch before the stationary grippers have engaged the next drive rod groove. If this happens, the rod will not complete an outward step. lhis effect s.ca during lab tests:

however, in the plant when hydraulic damping is present, this mechanism is less likely to occur.

NRC1ETIEMO

_ _ - _ - - . - - __-