ML20135E601

Draft AEOD/C96-XX, Nonpower Reactor Survey

ML20135E601
Person / Time
Issue date:	12/31/1996
From:	Brockman K, Jerome Murphy, Ross D NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
Shared Package
ML20135E568	List: ML20135E564 ML20135E601
References
NUDOCS 9612110359
Download: ML20135E601 (90)

Text

_ ._, ._ .- . . - . . - . _ _ _ _ . - . --

(

s l e

AEOD C96-xx i

i l

l

• l l

4 NON-POWER REACTOR SURVEY December 1996 1

l i

j D. F. Ross, Chair J. Murphy K. Brockman A. Mohseni i

j i i

i i

e Safety Programs Division U.S. Nuclear Regulatory Commission 9612110359 961209 PDR ORG NEXD PDR

.. - -_ _ .=. .

4 CONTENTS EXEC UTIV E S UMMA RY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ... v 1 I n t rod u ct io n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I 1.1 Background . . . . . . . . . . . . . . . . . .......................... I 1.2 Selected Instances of Core Damage Events . . . . . . . . . . . . . . . . . . . . . ... 4 2 Review of Selected Safety Analyses . . . . . . . . . . . . ...... ............... 9 2.1 Reactivity Related Analyses . . . . .............. ............... 9 2.2 Loss-of-Coolant Accident (LOCA) and Loss of Flow Analyses . . . . . . . . . . 12 2.3 Inlet Flow Blockage Analyses ............................... 13 2.4 Other . . . . . . ..................... .................... 14 2.5 Summary ........... .............. . ................ 14 l

3 Review of Selected Operating Events as Related to Safety Analyses ...... ... 16 l 3.1 Reactivity Related Events .. ..... .. .. .... .. .. ... .... 16  !

3.2 Loss-of-Coolant Accident and Loss of Flow ...................... 19 3.3 Fuel Handling . . ... ........... ........... ...... ..... 20 3.4 Radiation Protection Events . .. . . . . .... ...... ... ... 20 3.5 Design Basis Control . .. .. ...... ...... .... . . ..... . 21 3.6 Operating Experience Feedback . .. ....... .......... ..... 26 3.7 Safety Culture . . . . . . . ..... ....................... ... 28 4 Conclusions, Recommendations, and Observations . . . . . . . . . . . . . . . . . . . . . . . 34 l

4.1 Conclusions . . . . . . . . ....... . ...... ................... 34 4.2 Recommendations . . . . ......... .......................... 34 d.3 Observati o ns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 5 References .... .............. .. .. ....................... 38 TABLES 1 Reactivity Control, Coolant Leaks, and Fuel-Handling Events at MTR-Fueled Reactors 2 2 MW ............................... ... 3 l 2 Notice of Violation .. ................. ............. .......... 32 APPENDIX Operating Events 111

4 EXECUTIVE

SUMMARY

Occurrences at non-power reactors (NPRs) in 1993 involving loss of multiple scram functions and reactivity control problems raised questions in the U.S. Nuclear Regulatory Commission's Office for Analysis and Evaluation of Operational Data (AEOD) about NPR safety performance. Because of the potential for these events to be precursors to more serious events, AEOD initiated a study to provide an independent assessment of the safety performance of these reactors, to assess the adequacy of the feedback of operating experience

, within the non-power reactor community, and to identify recommendations for improvement if needed. This study included review of operating events, inspection findings, National Organization of Test, Research, and Training Reactors (TRTR) feedback to the NPR community, feedback of lessons learned, NRC enforcement actions, and visits to representative NPR facilities. Individual facility design and safety analyses were reviewed as

! necessary to ensure understanding of the safety significance of the operating experience and the importance of root causes, corrective actions, and lessons learned. The study did not include an evaluation of the design bases for the facilities nor their major design features. A panel (hereafter, the Panel) was formed by the AEOD office director to evaluate the

]

information collected for the study and prepare this report.

The Panel took a fresh look at the safety problem associated with NPRs and reviewed the history of NPR core disruptive events. The Panel noted that reactivity events, as personified by BORAX, SPERT, and SL-1 had displayed the highest accident potential. It was also noted that the NPR class of reactors tend to have much higher individual rod worth, as contrasted with power reactors. The Panel reviewed the accident analysis assumptions in a v

4 7

subset of the NPRs that were considered to have the highest accident potentials, namely, the MTR-type fueled reactors that opcrate at, or above,2 MW. As could be expected considering the different licensing eras, large variations exist in the Safety Analyses Reports (SARs). Of significance was the fact that the reactivity potential was not uniformly considered. The evaluation of the safety culture and radiation protection practices were based on all classes of non-power reactors, since the issues were generic.

In developing conclusions, the Panel reviewed a set of reports (Appendix) on NPR performance that were assembled for the study. These reports were sorted into one of seven categories, according to seven categorical divisions which the Panel determined best described the areas covered by the study. The majority of the events were reactivity related.

There is considerable inherent safety in the NPR community of reactors and, given proper reg'!atory attention and focusing on improved operational practices, adequate safety can be sustained. The Panel did not see that fundamental design changes are warranted.

However, the panel did see a need for improvement in procedural measures and in basic nuclear safety training for the operations and maintenance staff, and ensuring compliance with current rules and regulations.

The Panel observed a patum of indifference with respect to the proper operation of the reactor protection system. These facilities should have a startup check sheet that instructs the operators to verify integrity of connections and operability of recorders. Also, an operator should know not to conduct fuel movements while the reactor is critical; yet, it happened.

The Panel was of the view that action is warranted in this area, in terms of training, procedural compliance, rigorous startup checks, post-maintenance checks, and, vigorous vi

b 4

e inspection and enforcement. It is not that these are new requirements; they are common-sense items that all should follow. However, increased inspection and enforcement actions may be needed in order to ensure the necessary degree of excellence in operational performance.

None of the recent operating events resulted in fuel damage, radiation releases or, except in one event, personnel exposures above 10 CFR 20 limits. No adverse effect on public health and safety was seen. However, complacency was apparent in some events, and lessons learned from NPR operating experience can be used by both the NRC and facility licensees to chance safety performance and to reduce the likelihood of more significant events in the future. Expanded feedback of operating experience could improve safety performance, as only half of the operating events described in this report were reported back to other licensees i

via public or private means. There needs to be some explicit tutorials to the NPR operators )

1 on the consequences of planned events, such as the oscillatory behavior of SPERT-IV, and unplanned events, such as the excursion-related fatalities at SL-1. ,

Non-power reactors have numerous intrinsic safety attributes. They have been operating 4

for many years (most, if not all are 25 or more years old) without causing harm to the public.

i Any one, or even all of these incidents, does not indicate an immediate safety question.

However, most of these facilities are located at institutions of higher learning. Their duty is 4

not only to teach their students the basic science and engineering associated with the students' course of study, but also to inculcate the safety culture attendant to the reasonable use of the technology. The sense of complacency and inattention to detail that may be inadvertently transferred to the students could well be the most significant negative result of the events considered in this study.

vii

~ ~ - .,

1 Introduction

1.1 Background

Occurrences at non-power reactors (NPRs) in 1993 involving loss of multiple scram functions and reactivity control problems raised questions in the U.S. Nuclear Regulatory Commission's Office for Analysis and Evaluation of Operational Data (AEOD) about NPR safety performance. Because of the potential for these events to be precursors to more serious events, the Director, AEOD, requested from the Safety Programs Division (SPD), a study of these facilities in a memorandum dated June 17, l!F3. The study included review of operating events, inspection findings, National Organization of Test, Research, and Training Reactors (TRTR) feedback to the NPR community, feedback of lessons learned, NRC enforcement actions, and visits to representative NPR facilities. One to two day visits were made to research reactors at the Armed Forces Radiobiology Research Institute, Georgia Institute of Technology Neely Nuclear Research Center (NRRC), General Atomics, Massachusetts Institute of Technology Nuclear Reactor Laboratory (MIT), Oregon State University Radiation Center and TRIGA Reactor (OSU), University of Arizona, University of Illinois Nuclear Reactor Laboratory, University of Missouri Research Center (Columbia)

(MURR), University of Texas at Austin Nuclear Engineering Teaching Laboratory (UofT),

and the test reactor at the National Institute of Standards and Technology (NIST), to understand unique reactor features, research programs, and operational performance. During facility visits, site tours were undertaken; interviews were conducted with reactor operators, reactor management, and radiation protection management; operator logs and safety evaluations were reviewed; and operating events were discussed. A Panel was used to 1

a evaluate the material assembled during the study to assess the safety performance of the facilities and to identify lessons learned. The Panel consisted of:

. Denwood Ross, Deputy Director, AEOD, Chair

. Joseph Murphy, Special Assistant, Office of Nuclear Regulatory Research

. Kenneth Brockman, Deputy Director, Division of Reactor Safety, Region IV

. Aby Mohseni, AEOD The first three members have all had experience in the operation, licensing, or regulation of non-power reactors, while Mr. Mohseni has expertise in characterization of the consequences of reactor accidents.

The Panel decided to focus on the relation between the operating events (or conditions) and the accident analysis appropriate to the reactor experiencing the event. Therefore, salient portions of the accident analyses were extracted and captured in Chapter 2 of this report. The Panel organized Chapter 2 according to classes of hazards:

. Reactivity related (some events involved degradation of the Reactor Protection System [RPS])

Loss of Coolant (LOCA)/ Loss of Flow j

. Inlet Flow Blockage (there was one event)

. Other categories (such as fuel handling; radiation protection)

Section 2 provides a brief summary of the safety analysis practices for these categories.

The Panel organized Chapter 3 in seven categories which the Panel determined best described the areas covered by the study. For each category, the operating experience was I

l 2

l

considered along with the related safety analysis discussion from Chapter 2. For completeness, the operating experience summaries are included as an Appendix.

Selected events that were reviewed are enumerated in Table 1. These events occurred primarily at NPRs whose power is greater than 2 MW and, include the various types of scenarios discussed in Chapter 2, namely: reactivity events, LOCA events, and fuel-handling events.

Table 1 Reactivity Control, Coolant Leaks, and Fuel-liandling Events at MTR-Fueled Reactors 2: 2MW Facility 90 91 92 93 94 95 96 Total Georgia Technical Institute of 1 1 Technology Massachusetts Institute of Technology 1 1 4 6 National Institute of Standards and 3 [1] 1 5 Technology Rhode Island (1) 1 University of Michigan 1 2 4

[1]

University of Missouri 1 2 1 2 1 7 (Columbia)

University of Virginia 2 (1) (1) (1) 5 Total y 4 1 3 8 3 8 2 29 For these 7 higher powered MTR-fueled reactors:

Reactivity Control Event Average = 0.5 events / year / reactor (Reactor Coolant Leak Event Average = 0.09 events / year / reactor) *

[ Fuel Handling Event Average = 0.04 events / year / reactor) *

• Calculation based on 6.5 years of operating experience (as of 8/13/96) 3

l l

l l

1.2 Selected Instances of Core Damage Events i

The Panel reviewed the ways that these types of reactors can get into trouble. Based on l operating experience and testing of the past, it is well-known that step or ramp injections of reactivity, carried to the extreme, can cause core damage. Also, in this prior history there I

have been several instances of partial core melting, usually limited to parts of a single bundle, l

caused by a coolant inlet flow blockage. Some brief descriptions of such events follow l

below.

l Recounting this historical experience is intended to place into context the hazards of this  !

l class of reactors, relative to the large power reactors, whose risk has been subject to much i

more exhaustive characterization (e.g., NUREG-1150, " Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants," and TMI-2). On one hand, NPRs are i smaller in power and generally do not run for months at a time. This reduces the fission product inventory. The MTR-plate type fueled reactors have a fuel melt temperature on the order of 1200 'F, and this means the less volatile elements (e.g., Lanthanum) stay in the solid form. The lower power reactors have less tendency to melt following a Loss-of-Coolant Accident (LOCA).

On the other hand, the non-power reactors have higher worth individual rods, are generally not housed in a robust containment (although it is suitable for the purpose); do not have the rigorous operator training programs as do power reactors; have much less of an exclusion radius; and, in some instances lack equipment redundancy and diversity. On balance the public risk associated with NPRs is still much less than that of large power reactors. The following discussion should illustrate this point.

4 i

t WTR l On April 3,1960, there was a fuel element failure at the Westinghouse Testing Reactor at Waltz Mills, Pa. (f.ef.1). This was a modified MTR type fuel system. There was I a release of fission products to the Primary Coolant System (PCS), and some gaseous fission products released to the atmosphere.

The reactor was in the process of being uprated from 20 MW to 60 MW. Some low flow boiling tests had been done in order to explore the limits of operation. While the reactor was at 30 MW, the primary flow rate was deliberately reduced, but no boiling was l

observed. The power was then raised to 34 MW and leveled off. However, the power level started to drop; the shift supervisor ordered rods to be withdrawn to and power raised to 40 MW. En route to 40 MW, there were radiation alarms; soon thereafter the reactor was scrammed. l Apparently, at one location, there was a poor metallurgical bond between the fuel matrix  !

and cladding such that most of the heat generated had to be conducted through only one side of the fuel, instead of both. As a ~ ult, there was localized melting. The molten material, in turn, blocked the flow channel. Among other things, it was noted that the operations staff should not have continued to increase power following the initial downturn in power. Rather, a questioning attitude might have prevented failure altogether, 5

1 ORR, MTR, ETR Several test reactors have suffered fuel damage due to inlet flow blockages, dating back to the mid-50s (in the MTR). The MTR actually had two such events. In 1954, some fuel buckled and there was some local melting. Then, in 1962, one plate partially melted due to some rubber seal material becoming lodged in a coolant channel.

According to Thompson (Ref. 2), the ETR also had an incident of fuel melt as a result of flow-restriction in 1961. A plastic sight-glass had been left in the reactor tank.

Eighteen plates, in six elements, melted.

There was an incidence in ORR (Ref. 3) on July 1,1963. The reactor was at 24 MW at the beginning of cycle startup. A large neoprene gasket had become lodged in the upper end box of a fuel element. The procedure which was followed called for an inspection of the core for foreign objects as part of the startup sequence. However, the affected bundle could not be seen easily. During the power ascent past 9 and 12 MW, there was some slight increase in noise on the nuclear channels. In retrospect, it was concluded that boiling was occurring at this juncture. At 24 MW the n: tron noise increased considerably; so did the radiation monitors. Power was reduced to 12 MW. Radiation levels further increased, and the reactor was scrammed. Water radioactivity had increased by factors of about 200.

Subsequent examination showed one plate in one element had some melting, corresponding to about 30 to 50 percent of the fueled area, or about 3 to 5 gm of fuel. About 150-200 mci of iodine was reletsed at the stack. Several direct causes were noted: the gasket in the system; failure to detect this during visual examination; and, failure to recognize boiling. The WTR event is also discussed by Thompson (Ref. 2).

6

There were no personnel exposures and a minor release to the site, even though one element melted. The cleanup cost was about one million dollars.

BORAX A series of experiments was performed on the Borax reactor in 1954 to investigate subcooled reactivity transients (Ref. 4). The final runaway experiment was a rod ejection in the amount of 4 percent reactivity. The resulting reactor period was 2.6 msec, and about 135 MW-sec of energy was released. Most of the fuel plates melted, and the reactor l

1 tank failed. It is possible that some of the damage was a result of a subsequent steam explosion (with the molten aluminum).

SPERT l l

The SPERT program consisted of several facilities designed to explore reactivity transients. Silver (Ref. 5) provides a status report. In 1962, the first destructive test on SPERT 1 was done. A 3.5$ insertion was accomplished, with a resultant period of 3.2 msec. After the first power peak decayed, apparently there was a secondary reaction of water and molten aluminum (i.e., steam explosion) which produced a large pressure pulse. The core was destroyed.

SPERT IV was a large pool facility investigating instability from reactivity transients for ;

pool-type reactors. Tests were done with forced flow as well as stagnant conditions. Further information was provided on SPERT-IV by Silver in 1965 (Ref. 6). In SPERT-IV, the effects of various water heads and forced flow were investigated in the context of reactivity transients. The most significant result was the observation of oscillatory reactor power behavior following an initial burst. With increasing flow rate, both the frequency and 7

amplitude of the oscillations increased. It appears that under some conditions a 4$ insertion (above critical) can produce oscillations at 2 Hz, with divergent amplitudes.

SL-1 An unplanned reactivity event occurred at the SL-1 reactor in January 1961 (Ref. 7). It was estimated that 2.4 percent excess reactivity was inserted, producing a 4 msec period. Fuel was probably vaporized in the center of the fuel plate. The total energy generated was on the order of 130 MW-sec. The steam formed resulted in the acceleration of water from the core and deceleration at the lid of the pressure vessel, which in turn lifted the vessel 9 feet. Piping was sheared along with the lid shielding. About 20 percent of the core was destroyed. About 5 percent of the gross fission products were ejected from the vessel.

Apparently the steam pressure was about 500 psi. Three operators on top of the tank at the time were killed.

Within the first hour of the event the dose rate just outside the building was 250 mrem, and was more than 500 rem near the reactor floor (Ref 8). According to Thompson (Ref. 2) 14 people received occupational doses in excess of 5 rem. Four days after the event, the dose at the guard house (about 200 feet from the reactor building) was about 25 mrem per hour. At 2000 feet in all xctions the dose rate was less than two mrem / hone 'a MI, about 100 curies of I-131 was released to the environment over a several day period.

8  ;

l

2 Review of Selected Safety Analyses General The Panel reviewed the safety analysis sections of a sample of the NPR community of reactors; specifically those for a selected set of seven reactors that had MTR-type fuel elements and operated at 2 MW or higher. Summary comments on these safety analyses follow.

2.1 Reactivity Related Analyses The Georgia Tech (5 MW) reactor considered a sudden reactivity insertion of 1.5 percent with the reactor critical, and asserted it was a highly improbable event (Refs. 9 and 10). A fuel loading event might produce as much as 2.5 percent addition, which could produce fuel melting. An arbitrary sequence involving fuel melting and vessel rupture would produce about 135 MW-sec energy. The internal containment pressure would be between 2 and 11 psig. This scenario was, however, considered incredible.

The University of Michigan (2 MW) reactor considered a 1.6 percent reactivity addition, which would take the fuel to 900 'F (Ref. I1). (Melting is above 1200 *F). A 1.8 percent addition would result in incipient melting. Oscillations were not postulated.

MIT (5 MW) aaa'y7-i a spectrum of reactivity insertion accidents, including the uncontrolled withdrawal of the regulating rod and the step reactivity insertion resulting from the instantaneous failure of the highest worth experiment allowed in the reactor (Refs.12 and 13). These events involve a maximum reactivity insertion of 1.8 percent. The analyses were based on correlation with data obtained at the SPERT facilities, and indicated the resulting fuel temperatures would be well below clad melting temperature.

9

At the NIST (20 MW) reactor, the licensee analyzed the startup accident that might result from control rod withdrawal (Refs.14,15, and 16). The shims were postulated to be withdrawn steadily until the reactor was scrammed by a high power trip. The initial power level was at 10[E-4] MW, the reactivity insertion rate was 5x10-4 Ak/sec, and the high power trip was set at 30 MW (150 percent of full power). The energy of the j l

excursion was 4.8 MJ, and the peak power was 43.3 MW. The energy required to (adiabatically) bring only the metal of the fuel element structure within the core to the melting i 1

point was calculated to be 34 MJ, a factor of seven times that calculated for the startup accident. Therefore, no core damage should result. Dropping a fuel element into a critical l

core was not considered credible. Broken shim arms, beam tube collapse, and the cold water accident were all considered and shown to be less severe than the startup accident.

For the NIST reactor, the maximum ramp reactivity insertion rate is 2.6 percent AK/sec.

The ramp insertion was assumed to take place while the reactor was at full power (20 MW).

The reactor was tripped at 30 MW. With maximum ramp insertion, the energy excursion was 7.1 MJ, well below the 34 MJ required to melt the metal of the fuel element structure.

For the Rhode Island Nuclear Science Center Research Reactor (2 MW)

(Refs.17 and 18), the startup a~ident, as analyzed, was the most limiting credible reactivity insertion accident for the Low Enriched Uranium core. The two most i

limiting accidents for this type of reactor were analyzed. Maximum reactivity insertion was l l

assumed with the reactor in cold and clean conditions, reactor power at the source level, and the regulating rod withdrawn. The maximum reactivity insertion was the sequential withdrawal of all safety blades at the maximum rate. It was assumed that the period scram 10

4 l failed, and a delay of 0.5 seconds occurred before the safety blades were free to drop. The reactor would trip on the high neutron flux scram (120 percent of full power). The analysis resulted in a maximum fuel temperature of 88.1 C.

1 The licensee also presented a more conservative analysis with the added assumption that the reactor did not trip on the high neutron flux scram. Reactor power would rise until negative reactivity from the void and temperature coefficients of reactivity compensate for the positive reactivity from the withdrawing safety blades. This scenario would result in a peak clad temperature of 148.5 C (still well below the melting temperature of 582 *C). The licensee also determined that if the reactor did not trip automatically, the fuel would operate in nucleate boiling with no damage until a trip was manually initiated.

i No reactivity insertion excursions for the 10 MW reactor at the University of Missouri (Columbia) were found (Ref.19). According to the AEC 1966 Safety Evaluation Report, the preliminary analysis at 10 MW indicated that the reactor could withstand a 0.8 ,

percent step input without fuel damage.

The University of Virginia (2 MW) reactor considered two reactivity insertion rates, 10(E-4) a k/k/sec and 2 x 10(E-4) a k/k/sec (the second corresponds to the simultaneous withdrawal of all three shim rMcT (Ref. 20). A reak power of 3.5 MW was obtained for both reactivity insertion rates. It was found that for the most severe credible reactivity insertion, the transient peak power would remain below the safety limit for the 744 gpm true value of total coolant flow. There was no credible nuclear excursion possible with the University of Virginia reactor that could exceed the safety limits for the fuel. According 1

! to the Safety Analysis Report, there was reasonable assurance that fission product activity I

11

would not be released from the fuel to the environment as a result of a reactivity insertion event.

2.2 Loss-of-Coolant Accident (LOCA) and Loss of Flow Analyses  ;

i Georgia Tech considered a LOCA which, absent operation of the Emergency Core Cooling System, would provide some fuel melting (Refs. 9 and 10). At a containment leak rate of 0.5 percent / day, Part 100 doses would be realized near the containment. For loss of  !

flow, it was assumed that the reactor would scram on low flow rate, and that there would be no fuel failure.

The University of Michigan (2 MW) considered a core uncovery following a leak (162 gpm) with no makeup (Ref. I1). The core would uncover in 4 hrs; no core damage was calculated. l Loss of flow was not a concern at MIT. Additionally, no pool drainage event which would lead to a LOCA was identified as a concern (Refs.12 and 13).

The University of Missouri (Columbia) (10 MW) considered that a 20 percent flow reduction was required to produce core boiling (Ref.19). No releases ensued. A complete flow loss in the Pool Coolant System would boil the core dry, with some melting. The 1

assumptions were: 10 percent melt; 25 percent release of halogens,75 percent of nobles, and I percent of others; fission product release to the containment immediately, and the containment leaks at a rate of 1 percent per day. The offsite doses to the thyroid and whole body were well within Part 100.

The University of Virginia considered a core uncovery from a double-ended guillotine (DEG) break in the outlet coolant pipe, which uncovered the core in about 20 minutes ,

l 12

l (Ref. 20). Two independent core spray systems were assumed not functioning. Core melt was not indicated. Even given an instantaneous LOCA and only one core spray functioning, the core was not predicted to melt. l 2.3 Inlet Flow Blockage Analyses Georgia Tech did not analyze inlet flow blockage; presumably, the consequences of a LOCA would bound this event (Refs. 9 and 10).

MIT (5 MW) postulated the blockage of five channgis, with four melted fuel plates (Refs.12 and 13). Iodine would be reduced by absorption in the water (factor of 10). About i

.075 percent of the iodine inventory would be available for release to the environment, at a leak rate of 1 percent per day. Thyroid and whole body doses would be well within Part 100. l NIST (20 MW) considered an object blocking all flow through a single fuel element i leading to the failure of a fuel element (the Design Basis Accident [DBA]) when the reactor  !

was at 20 MW (Refs.14,15, and 16). The highest power element (730 kW) was assumed to l 1

melt. It was assumed that 100 percent of the blocked elements's cladding would melt and l l

release fission products that woald escape f.om the primary water into the containment building. It is assumed that 100 percent of aoble gases and 50 percent of iodines escape into confinement. At the site boundary, within the confinement building, the whole body dose was 0.012 rad for the first 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />,0.035 rad for 2-24 hours, and 0.058 rad for the next 29 days.

At the nearest site boundary outside of the confinement building, exposure from the exhaust plume would result in a whole body dose of 0.021 rad for the first 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />,0.038 rad for 2-24 hours, and 0.002 rad for the next 29 days.

13

For the University of Missouri (Columbia), the AEC 1974 Safety Evaluation Report considered a flow blockage that resulted in the melting of 4 fuel plates (the DBA) (Ref.19).

The fuel elements are designed to prevent large flow blockages from occurring. Doses frs this event were within Part 20 limits. Exposure calculations were adequately conservative and the resultant exposure from the DBA would be only a small fraction of Part 100 criteria.

Furthermore, a total meltdown was postulated following a prolonged period of operating at 10 Mw and the radiological consequences were evaluated. It was assumed that 100 percent of the nobles and 25 percent of the halogens would remain airborne and be available to leak from the containment which is initially at 2 psig. Under atmospheric inversion conditions the whole body dose was less than 20 rad and the thyroid dose was 280 rad at the 500 ft exclusion radius for the first two hours. These are just within Part 100 criteria.

2.4 Other MIT considered external events, such as seismic, and decided that the facility would not be damaged for credible events (Refs.12 and 13).

The University of Virginia postulated failures in fueled experiments (Ref. 20). Nominal doses resulted for both occupational and non-occupational personnel.

2.5 Summa 7 The differences in the form and content of hazard analyses as indicated by the review of this, admittedly, small sample, is that they reflect evolution which has occurred in licensing since 1956. Indeed, some facilities were licensed before the definitive experiments of SPERT, or the SL-1 event, or some of the noteworthy inlet flow blockage events. Also, there was not a standard form and content for hazard analysis. Therefore, wide variations should be 14

i expected. The Panel believes that comprehensive modernization and updating of the safety analyses for each of the reactors in the NPR community is not necessary in view of the ensemble of safety analyses of similar reactors, together with experimental information described in Chapter 1. This compilation of the analysis for each reactor is not a basis for e

backfitting a consistent analysis.

l Two points do remain as the Panel's first recommendation:

Panel Recommendation #1: The NRC should assure that:

a. If the likelihood of an unanalyzed event is determined to be much higher than previously thought (viz, the inlet flow blockage at UVA) then the licensee should demonstrate that this credible scenario does not have consequences which exceed those of the event previously considered bounding

and, 4

b. When the facility is due for license renewal, the safety analysis should be reviewed in depth, taking into account the lessons of the last 10 years and updated I as needed.

a a

i  :

5 4

15

3 Review of Selected Operating Events as Related to Safety Analyses General Operating experience for a broad class of reacto s was examined, and the experience  :

mapped into the seven areas discussed in Sections 3.1 through 3.7. Some operating events mapped into more than one area. For example, an event involving inoperdble conditions of the RPS might map both into the Reactivity area and the Safety Culture area.

For each of the seven sections below, after summarizing the operational experience, the information was evaluated and the Panel's views and recommendations presented. All recommendations are consolidated in a single place in Chapter 4.

3.1 Reactivity Related Events There have been numerous incidences of problems with reactivity control at the larger research reactors. At MIT, the reactor was operated with 2 of 3 power safety level channels .

inoperable and with four of six period and power safety level channels improperly connected to the low voltage protection system (March 1989). The reactor was operated at low power with two inoperable flux channels (March 1995). It also was operated with a power tilt with l one control rod in the core (July 1995). The core was taken critical with one control rod slipping as it was withdrawn ( A"pt 1995).

NIST experienced shim rods not fully inserting on manual scram (three instances in 1990) that appear to have been corrected with bearing replacement.

At the University of Michigan, operations staff removed a fuel element from the core while the core was at low power (8 kW) (June 1992).

l 1

16 l 1

The University of Missouri (Columbia) had seven failures of the regulating blade between 1988 and 1996. While not affecting the ability to automatically shut down the reactor, these failures impaired the reactivity control function and led to a reactor trip.

The University of Virginia operated for 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> with both power level scrams, the intermediate range scram, the low primary coolant flow scram, the loss of power to pump scram (and others) inoperable because of errors during maintenance (April 1993). The manual scram remained available.

An examination of these events indicates no inadequacies in the basic designs of the systems. There have been no known failures to scram on demand, although it appears likely that manual scram would have been required if an initiating event requiring scram had developed during the 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> the University of Virginia had its automatic scram disabled.

Those equipment failures that occurred should have been expected and covered by routine maintenance activities. The basic problems appear to have derived from human error, inadequate training, complacency in operation and management, and inattention to maintenance needs.

The safety significance of these events must be considered in terms of the basic physics of reactors of these types. The safety analyses referenced earlier, as well as the experimental tests of MTR-type reactors in transients conducted at the BORAX and SPERT facilities in the late '50s and early '60s, suggest significant reactor damage in a transient would not occur unless the plants were experiencing a reactor period of less than 5 milliseconds. To achieve a i

period this small in plants of this type would require a reactivity insertion of considerably I greater than 1 percent (perhaps as much as 1.4 percent to 1.5 percent). This is well beyond 17 i

e the normal capability of these facilities. Thus, these events should not be regarded as precursors of serious accidents. No fuel damage has been experienced and there has been no release of radioactive material to the environment.

The events illustrate not that the systems are deficient, but that the tests and maintenance, procedures, and training are in need of improvement. This is especially 1

important in light of the accident potential from large reactivity transients.

Accordingly, the Panel's recommendations are:

1 Panel Recommendation #2: The NRC should review its requirements for startup checks, on a plant-specific basis, and implement license amendments where needed. This same philosophy should apply to tests and maintenance on the RPS, in order to assure that the system is returned to operable status, after test or maintenance.

Panel Recommendation #3: The NRC should ensure that a training course is developed by the NPR community or by individual licensees, for use by reactor operators and their supervisory chain. The purpose of this course would be to instill an understanding of hazards of this family of reactors during postulated transients and accidents. Inasmuch as AEOD has already developed a course along these lines for power reactors (R-800,

" Perspectives on Reactor Safety"), AEOD should provide advice and assistance. The course would be most effective if given by the NPR community itself. Every operator and supervisor should, in the fullness of time, be required to take the course. The j l

course should also be mandatory for NRC staff who work in the licensing and inspection areas.

18

l 3.2 Loss-of-Coolant Accident and Loss of Flow  !

Relatively minor pool leakages have occurred at the Rhode Island Atomic Energy  !

I Commission Nuclear Science Center (1995) and at the University of Virginia (1993-94). )

There have also been small primary to secondary leaks in the heat exchanger at the University of Virginia (1995). These leaks have been on the order of 100 gallons per day or smaller.

Two safety concerns were considered. First, for research reactors at or above 2 MW in i

power, if the loss of coolant led to core uncovery, fuel damage could result. Second, the I water draw-down will also lead to increased radiation levels above the core as the thickness of i

4 the water shield is reduced. However, these pools contain tens of thousands of gallons of water. Draining at the rates experienced (or even many times those rates) should be easily ,

l detectable and correctable.

The more likely way in which fuel may be damaged in reactors of this type appears to be from loss of core cooling due to inlet flow blockage or from loss of forced flow when operating at high power. The recent event at the University of Virginia (March 1996) in I

which a paper towel on top of a fuel element lead to 200 kW (i.e.,10 percent of rated power)

]

l power fluctuations is illustrative of the potential effect of minor blockage. The lessons learned years ago from the SPERT-IV experiments and the earlier incidents at higher powered research and test reactors (referenced earlier) should not be forgotten or discarded. Core inlet blockages from things as simple as paper towels or gaskets can lead to damaged fuel. The significance of inlet flow blockage is reflecte veral of the accident analyses submitted by these licensees. ,

1 i

19 l

l Because of the potential safety significance of core flow blockages, the Panel adoptea i the following recommendation:

o Panel Recommendation #4: The NRC should review the plant-specific procedures for 1)  !

preventing extraneous material from entering the pool or cooling systems for the plants listed in Table 1, and 2) licensee inspections of the core prior to start-up or closure of  !

s the facility. If the procedures are deficient (or do not exist) then improvements should [

t be sought. j l

3.3 Fuel Handling i At NIST (June 25,1991) A new fuel element dropped off the handling tool and landed i on the top grid of the core.

f This single event was not enough to warrant a specific recommendation in this area.  !

i However, the NRC should consider the safety significance of a fuel drop accident, but on a l

medium priority basis.  !

3.4

(

Radiation Protection Events  :

Several past notices of violation NOV) (Table 2; end of this chapter) were considered to determine the significance of radiation protection incidents. Based on this, only one event I resulted in 10 CFR 20 dose limits being exceeded. In addition to the review of past violations, the results of site visit survey observations and experiences were reviewed.

As Low as is Reasonably Achievable (ALARA) practices were good at most facilities.

However, there have been instances of complacency towards radiation safety. In one case, a facility allowed the use of normat street clothes during refueling, despite several personnel contamination events within the past year. Members of the refueling crew were also observed 20

t d -

4  !

to have materials in their shirt pockets while moving fuel, creating the potential to drop  ;

i 1 l foreign material on top of the core. The observations indicated that sample handling and fuel l' l

movement were the most probable sources of personnel exposure and contamination. One ,

I researcher received an 8.9 rem dose to his fingers. In another event two operators received 9.2 and 11.5 rem to their hands in an experiment, and left the area without surveying  !

i  ;

themselves thereby subsequently contaminating the control room. In another case, radioactive  !

l l particles of gold were found on the pants of two operators during the past year.

! There are differences in radiation protection practices from licensee to licensee. These include posting of radiation areas and eating and drinking in radiation areas. Poor planning

} and a lack of adherence to established procedures contributed to the unplanned exposure i

events.

4 1

Sample handling and shipping practices were also reviewed. While no overexposure i

i resulted, there were some poor practices in mislabeling packages.

1 4 Given that these are largely institutions of higher learning, it is particularly important i i that a higher degree of management attention L given toward improving radiation protection  !

1 i

practices. More guidance is not needed; rather, adherence to existing practices is needed. )

i 1

3.5 Design Basis Control A lack of design control contributed to the occurrence and consequences of several events and selected summary information is provided below:

At the University of Michigan during a routine maintenance period (November 1992),

the shim range-control rod interlock system was removed from the reactor control system for a modification that had been reviewed and approved by the facility Safety Review Committee.

21

l Subsequent post modification testing was inadequate to identify that the power level deviation interlock was inoperable due to a wiring error.

At the University of Missouri (Columbia) (1988 to 1996), a series of seven operational failures of the regulating blade necessitated manual reactor scrams. The primary contributors ,

to these occurrences were the inadequate corrective actions developed in response to the continuing problem. The continual recurrence of this problem indicated that the licensee did not maintain control of the facility.

During maintenance activities at the University of Virginia (April 1993), two mixer-driver modules were changed in the scram logic drawer. This resulted in the inoperability of both power-level scrams, the intermediate-range scram, the low primary coolant flow scram, the loss of power to the primary pump scrams, the range switch scram and the key switch scram for a period of 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. All of these scram functions were required by the Technical Specifications (TS).

The exchange was made during troubleshooting activities that were being conducted to determine the cause of a spurious reactor shutdown earlier in the day. Although the two new mixer-driver modules appeared to be identical, they had been altered internally by the facility staff. A system verification (the minimally proper post modification testing) was not performed after the exchange due to an inappropriate decision by the shift supervisor. The loss of scram function (s) were not self-revealing, so only a proper scram system check would have revealed the inoperabilities.

A shim rod failed to fully insert into the TRIGA reactor at the United States Geological Survey (January 1996) during a normal shutdown. Shim rod 2 had been replaced during a 22

i i

routine control rod inspection conducted in December 1995. Prior to the installation of the  :

new shim rod, the fuel-follower control rod had been measured and found to be about l

l 2 inches shorter than the rod it was replacing Calculations at the time ofinstallation i indicated that the new rod was of sufficient length to remain below the top of the bottom grid

. plate when retracted to its uppermost configuration. In fact, the rod did not remain below the top of the grid plate, but instead, " caught" on the plate's edge, thereby hanging up several inches above the fully inserted position. The 10 CFR 50.59 evaluation of this modification was not adequate to identify this potential.

All reactors (power and non power) are licensed to operate as utilization facilities under Title 10 and in accordance with the Atomic Energy Act (AEA) of 1954, as amended'. The AEA stated that utilization facilities for research and development should be regulated to the minimum extent consistent with protecting the health and safety of the public. The NRC has promulgated these concepts in 10 CFR 50.40,50.41, and in other parts of Title 10 that deal with non-power reactors.

I The licensed thermal power levels of non-power reactors are several orders of magnitude lower than power reactors, thereby resulting in the accumulation of a proportionally smaller inventory of fission products in the fuel. This has been one of the  !

bases upon which the NRC has determined that less stringent and less prescriptive measures l are required to adequately protect the safety of the public, workers, and the environment.

I

' The AEA was written to promote the development and use of atomic energy for peaceful purposes and to control and limit its radiological hazards to the public. These purposes are expressed in paragraph 1104 of the AEA.

23

Also, since potential hazards vary widely among non-power reactors, the regulations have also i been implemented in different ways between various non-power reactors.

The issue of what standards to use in evaluating accidems at a research reactor was discussed in an Atomic Safety and Licensing Appeal board (ASLAB) decision issued on May 18,1972, for the research reactor at Columbia University in New Yorl: City. ASLAB stated that "as a general proposition, the Appeal Board does not consider it desirable to use the standards of 10 CFR Part 20 for evaluating the effects of a postulated accident in a research reactor inasmuch as they are unduly restrictive for that purpose. The Appeal Board strongly recommends that specific standards for the evaluation of an accident situation in a research reactor be formulated." The staff did not find it necessary to conform to that recommendation to develop separate criteria for the evaluation of research reactor accidents, since the majority of research reactors have been able to adopt the conservative 10 CFR Part 20 criteria (Ref. 21).

The control of the design basis of non-power reactor facilities is not as prescriptive as with power (commercial) reactors. Safety Analysis Reports (SARs) are not required to be updated on a periodic basis as is the case with power reactors (10 CFR 50.71[e]). Instead, the requirement for non-power reactors is to submit an SAR as part of the initic i  !!...--

application and to submit revisions to the SAR in conjunction with any license renewal.

Licensees are, however, encouraged to maintain current SARs on file with the NRC. As with power reactors, non-power reactor licensees are required to review all facility changes and modifications for their potential to result in unanalyzed safety questions. Changes which do not result in such conditions can be implemented by the licensee under the allowances of 24

4

10 CFR 50.59. A report which summarizes the changes made under the allowances of 1

10 CFR 50.59 is required to be submitted annually (Ref. 22).

l

The events within this study do not directly support the need to revise the regulations 4

concerning the maintenance of a current SAR. The relative simplicities of non-power reactor

SARs and the few number of significant changes that are made to non-power facilities obviate i

the need for a prescribed periodic update of SARs. In addition, the requirement that licensees

{ submit an annual report to the agency summarizing all changes made to the facility under the allowances of 10 CFR 50.59 assures that the information needed by the NRC to fulfill its statutory obligations will be available.

1 This does not relieve licensees from maintaining the information necessary to properly a

f and safely operate the facility. All data, procedures, and reference documents needed to

j. conduct safety evaluations, submit licensing requests, and provide proper and effective l training must be maintained and controlled.

, At least two events (those at the University of Virginia and the United States Geological i

( Survey) directly indicate that current evaluations by non-power reactor licensees are not l

thorough enough. Non-power reactor licensees are not relieved from the requirements of l

f 4 10 CFR 50.59.

i However, the two events noted above do not, in and of themselves, support an overhaul

1 i of the 50.59 process. They do suggest that the NRC may need to be more attentive to the l

{ effectiveness and the comprehensiveness of licensee evaluations. In addition, the lessons that l

i have been learned from Millstone, indicate that a special sensitivity is needed in this area.

1 Inspection activities similar to those currently being undertaken by power reactor Project 1

4 i

. 25 i

.. __ __ . . . -_- __ _ _ - - . . - _ _ _ _~._ _ ______

Managers should be initiated. Additionally, appropriate enforcement actions should be taken if 10 CFR 50.59 evaluations are found to be significantly lacking.

All of the events discussed in this report which had repetitive occurrences could have been precluded by a more detailed and insightful root cause analysis of the initial (or subsequent) cvent.

The NRC should inspect and enforce requirements, especially in response to operational events. Compliance and safety are not mutually exclusive, but instead form a symbiotic, r mutually supportive relationship. Licensees must operate within their licensing domain and 1 the NRC must ensure compliance with its regulations. The relative safety significance of individual events should be captured by the degree of enforcement sanction which is imposed, not by whether an action is taken. '

The Panel, even in consideration of the above important points, did not prepare a specific recommendation in this area. What is needed is for both the regulators and the l

t regulated, to comply with existing rules and practices, and more guidance is not needed.

3.6 Operating Experience Feedback Reporting requirements are interpreted such that precursors that do not violate TS are  ;

not reportable, such as: ream vul e leaks below TS limits, operation with inoperabk mactor  !

scrams not listed in TS, unexpected control rod withdrawal, high core excess reactivity below TS limits, or power fluctuations caused by debris on the core. Licensees, however, have often  :

reported important events or conditions that fell below the legal th:eshold of the reporting requirements in their TS. -

I 26 l

l 1

l The "TRTR Newsletter" does an outstanding job in highlighting NRC inspection emphasis and problems identified, and calls attention to some important events so that othe.:

can learn more by contacting the facility directly. However, reported operating experbnce was often transmitted to NPR licensees through the TRTR Newsletter without identifying the facility name in the articles, even though the information was available to the public in the I NRC Public Document Room. Many informal communications occurred between licensees.

Industry conferences, generally held on an annual basis, addressed selected operating experience. These processes disseminated information on a portion but not all of the events noted in this report. There were events documented at some facilities that were not i

disseminated to the NRC or others in the TRTR community. Furthermore, some licensee event reports lacked sufficiently detailed root causes or corrective actions to be of use to others.

The Panel believes that NPR facilities can learn from each others problems despite their  ;

i design differences. Yet, the study found differences of opinion in the NPR community toward systematically sharing operating experience. While some NPR personnel expressed a desire to increase the sharing of operating experience, a few appeared reluctant to share their 1

problems publicly or even pri'=h. The vehicle; are in place to effectively learn from i operating experience; however, they could be used to a greater extent. A more public, expanded exchange of operating experience has the potential to further improve NPR safety performance.

Some positive mechanism must exist in order for the improvements to come about.

Hence, the Panel recommendation is divided into two parts:

27

Panel Recommendation #5:

a. The NRC should review the reporting criteria for events and make such modifications as are needed to assure that important events are reported on a timely basis; and,

b. AEOD should include in its annual report an assessment of the prior year's NPR experiences, or else publish them in a separate annex to its report. This work product should be disseminated widely to the NPR community.

3.7 Safety Culture Safety culture deficiencies contributed to the occurrence and consequences of several events some of which have also been discussed in previous sections of this report. Examples (not inclusive) are:

At the University of Michigan (November 1992) during a routine maintenance period, the shim range-control rod interlock system was removed from the reactor control system for a modification that had been reviewed and approved by the facility Safety Review Committee.

Subsequent post modification testing was inadequate to identify that the power level deviation interlock was inoperable due to a wiring error. Additionally, the startup check list that was conducted after the modification was done by a trainee and there was no engineering or quality assurance oversight. The review by the Safety Review Committee was inadequate, and the decisions associated with the subsequent startup checklist were ineffective in demonstrating the operability of the system.

At the University of Missouri (Columbia) (1988-1996), a series of seven operational failures of the regulating blade necessitated manual reactor scrams. The primary contributors 28

to these occurrences were the inadequate corrective actions developed in response to the I continuing problem. The continual recurrence of this problem indicated that the licensee did not pursue the root cause of the problem.

During maintenance activities at the University of Virginia (April 1993), two mixer-driver modules were changed in the scram logic drawer. This resulted in the inoperability of both power-level scrams, the intermediate-range scram, the low primary coolant flow scram, the loss of power to the primary pump scrams, the range switch scram and the key switch scram for a period of 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. All of these scram functions were required by the TS.

The exchange was made during troubleshooting activities that were being conducted to determine the cause of a spurious reactor shutdown earlier in the day. Although the two new mixer-driver modules appeared to be identical, they had been altered internally by the facility J

staff. A system verification (the minimally proper post modification testing) was not performed after the exchange due to an inappropriate decision by the shift supervisor. The i

loss of scram function (s) were not self-revealing, so only a proper scram system check would j have revealed the inoperabilities. The myopic consideration of the potential effects of these s.aintenance activities is evidence that a broad safety perspective was not present.

A shim rod failed to fully insert into the TRIGA reactor at the United States Geological Survey (January 1996) during a normal shutdown. Shim rod 2 had been replaced during a routine control rod inspection conducted in December 1995. Prior to the installation of the new shim rod, the fuel-follower control rod had been measured and found to be about 2 inches shorter than the rod it was replacing. Calculations at the time of installation indicated that the new rod was of sufficient length to remain below the top of the bottom grid 29

plate when retracted to its uppermost configuration. In fact, the rod did not remain below the top of the grid plate, but instead, " caught" on the plate's edge, thereby hanging up several inches above the fully inserted position. The 10 CFR 50.59 evaluation of this modification was not adequate to identify this potential condition. The method by which this modification was implemented reflected a less than satisfactory safety culture.

While the events at the Massachusetts Institute of Technology (March 1990, December 1993, and January 1995) all share the fact that they deal with the control of reactivity, they also bring insights to the overall safety culture in place at the facility, in the 1990 event of an improperly calculated established critical position (ECP), the console operator and reactor supervisor did not check a trainee's ECP calculation, placed excessive reliance on the ECP to identify criticality, and did not closely monitor indications as the reactor was approaching criticality.

In the 1993 event, the reactor automatically scrammed while a technician was investigating why one of two low-range neutron flux power level safety channels had failed.

The facility was operated without a capability to test the circuitry without removing the input signal cable.

In the 1995 c c...t, Jm reactor was operraed for a short period of time without a core low flow scram. An operator had addressed a core temperature pin oscillation on a recorder during a shutdown by inadvertently turning off the core flow and temperature recorder instead of just the temperature pin. Although the restart procedure contained a step to restart any instrument which had been secured, the operators did not have a list itemizing which instruments had been secured.

30

I l

Having a self-critical approach to assuring the maintenance of an appropriate safety culture at any nuclear facility and within the NRC is a goal whose merit is without question.

The Panel, in reviewing the technical issues took into consideration a broad perspective of the factors related to reactor safety and radiological consequences at non-power reactors. As has been noted, the safety significance of events which were reviewed at these non-power reactor facilities is minimal. "In non-power reactors, a scram does not challenge the safety of the reactor or cause any undue strain on any systems or components associated with the reactor" (Ref. 23). Additionally, the previously mentioned findings of the ASLAB (Columbia University,1972) support a conclusion that the radiological consequences of a non-power reactor event are also limited.

The Panel concluded that more regulations are not needed. Instead, the issue is whether l

the agency's inspection program, as implemented, is enforcing an appropriate level of compliance. In light of the lessons being learned from the agency's review oflicensing and I compliance issues at Millstone and other power reactor facilities, the need for a more compliance-oriented regulatory philosophy must be considered. Operational safety and regulatory compliance are not exclusive concepts. The Panel believes that, as with power reactors, non-power reactor licensees should be required to comply with the requirem:nm vi the regulations, their licensing bases, and the technical specifications. The agency's inspections and entercement posture should be so focused. The Panel, therefore, has the following recommendation:

31

i i

Panel Recommendation #6: The NRC should review its enforcement philosophy i concerning non-power reactors. Compliance with the regulations, licensing bases, and ,

technical specifications is an essential component of safety regulations. l Table 2 Notices of Violation University of Missouri (Columbia): Several NOVs which collectively were categorized as a severity level II with $4000 civil penalty (1986). The violations resulted from the licensee (

failing to adequately assess the hazards of radiation exposure associated with the handling of thulium-170 pellets. The oversight led to an unplanned extremity overexposure of 115 rem to j an individual's hands.

University of Virginia: Several NOVs which collectively were categorized as a severity level  ;

III with $2500 civil penalty (July 1987). The licensee failed to perform surveys necessary to  :

identify a high radiation area and to take appropriate action to provide written procedures for the installation, operation, modification, and surveillance of experimental facilities, resulting in an individual's exposure of up to 270 mrem, and had the potential for more significant  ;

exposure.

Texas A & M: Several NOVs which collectively were categorized as a severity level III with i

$5000 civil penalty for failure to provide dosimetry to personnel and to establish proper controls and failure to use and wear personnel monitoring equipment in high radiation areas j (March and April 1987). ALARA principles were not employed when working in high .

radiation areas.  ;

i University of Missouri (Rolla): NOV severity level IV for bypassing frisker station when  !

leaving the reactor bay area (October 1987). Several individuals occasionally ate, drank, or i smoked in the bay area.

University of Texas: NOV muity level IV for failure to have available records to document the results of radiation surveys performed to determine dose rates (June 1990).

i l

Massachusetts Institute of Technoloav: NOV severity level IV for failure to conduct quarterly l inspections of radiation safety activities from 1988 to 1991 (January 1991). In this period, the {

licensee did not conduct or record refresher training for health physics technicians. Also the l licensee failed to record radionuclides on a shipment burial manifest for a December 1990 i waste shipment.

University of Maryland: Two NOVs severity level IV and one NOV severity level V for  :

failure to perform adequate radiation surveys necessary to determine that individuals were not )

exposed to airborne concentrations in excess of 10 CFR 20.102 (October 1992). '

32 i

i University of Michican: NOV severity level IV for failure to follow health physics procedures in accordance with their TS (August 1993).

Georgia Institute of Technolocy: NOV severity level IV for failure to make a proper evaluation of the extent of neutron radiation present following a survey underestimating the l dose rate by a factor of 100 (August 1994).

NOV severity level 111 with $5000 civil penalty (December 1917 and January 1988). Failure to follow or have approved procedures during a topaz irradiatian resulting in a contamination event.

l i -

l l l

l 33

4 Conclusions, Recommendations, and Observations General This chapter contains conclusions; resummarizes the specific recommendations from  !

Chapters 2 and 3; and then offers some historical perspectives on NPR safety from the former AEC Chairman Thompson as written in his textbook more than 30 years ago (Ref. 2).

4.1 Conclusions This study identified some important lessons learned on NPR safety which need to be included in the licensing and regulatory process. It appeared to the Panel that, even though this class of reactors is significa,aly more safe than the power reactor community class, there may not be sufficient oversight on event management, reporting, and followup, either by the licensee management or by the NRC. The Panel recommendations are intended to help close this gap.

4.2 Recommendations In Chapters 2 and 3 the Panel reviewed selected NPR safety analyses and recent operating events or conditions, made a number of observations, and arrived at six specific recommendations:

Panel Recommendation #1: The NRC should assure that:

a. If the likelihood of an unanalyzed event is determined to be much higher than previously thought (viz, the inlet flow blockage at UVA) then the licensee should demonstrate that this credible scenario does not have consequences which exceed those of the event previously considered bounding; and, 34

v

b. When the facility is due for license renewal, the safety analysis should be reviewed in depth, taking into account the lessons of the last 10 years, and updated as needed.

Panel Recomrnendation #2: The NRC should review its requirements for startup checks, on a plant specific basis, and implement license amendments where needed. This same philosophy should apply to tests and maintenance on the RPS, in order to assure that the system is returned to operable status, after test or maintenance.  :

Panel Recommendation #3: The NRC should ensure that a training course is developed by the NPR community or by individual licensees, for use by reactor operators and their supervisory chain. The purpose of this course would be to instill an understanding of j i

hazards of this family of reactors during postulated transients and accidents. Inasmuch as AEOD has already developed a course along these lines for power reactors (R-800,

" Perspectives on Reactor Safety"), AEOD should provide advice and assistance. The course would be most effective if given by the NPR community itself. Every operator and supervisor should, in the fullness of time, be required to take the course. The course should also be mandatory for NRC staff who work in the licensing and inspection areas.

Panel Recommendation #4: The NRC should review the plant-specific procedures for

1) preventing extraneous material from entering the pool or cooling system for the plants listed in Table 1, and 2) licensee inspections of the core prior to start-up or closure of the facility. If the procedures are deficient (or do not exist) then improvements should be sought.

35

4 1

Panel Recommendation #5:

a. The NRC should review the reporting criteria for events and make such I modifications as are needed to assure that important events are reported on a i timely basis; and,

b. AEOD should include in its annual report an assessment of the prior year's NPR

-l t

experiences, or else publish them in a separate annex to its report. This work  ;

1 product should be disseminated widely to the NPR community.

Panel Recommendation #6: The NRC should review its enforcement philosophy  :

concerning non-power reactors. Compliance with the regulations, licensing bases, and technical specifications is an essential component of safety regulations.  !

i 4.3 Observations l

The Panel during its review renewed its acquaintance with the Thompson and Beckerly textbook which was written more than 30 years ago as material for the MIT summer course  !

on reactor safety (Ref. 2). In Chapter 6 (Volume 1) of Ref. 2, there were found a number of i conclusions and recommendations which reminded the Panel that in some cases if the lessons of history are ignored, the problems will recur. The following quotations from that chapter

' illustrate the point: ,

"(5): Accidents usually occur because of multiple and often apparently unrelated causes.

It is not enough to place reliance on one simple safety barrier or procedure;  ;

(6): Procedural control is at best a poor substitute for design ingen'iy in setting up the l first line of defense. That is to say, procedural controls should not be relied upon  !

as the only, or even primary, safety barriers. Whenever possible interlocks and positive mechanical barriers should be designed into the system to prevent unsafe actions...

36

(10): It should be impossible to withdraw by hand or other means in an unpremeditated manner control rods, the withdrawal of which could lead to criticality. This can be prevented by appropriate interlocks or by other design methods.

(11): In the US it has become common practice to provide a shutdown margin sufficient to allow for the failure of a single control rod.

(21): Experiments and tests must be carefully and conservatively planned. Plans should be written out, appropriate calculations made, appropriate instrumentation prepared, and personnel roles reviewed and rehearsed for the tests....

(22): The goal of reactor instrumentation should be to supply inform: tion to operators and control units which correctly represents the true picture of the core under all conditions and at all times.

(38): The effectiveness of shutdown systems should always be checked as a part of the startup procedures."

The Panel thought that most of the 42 recommendations in the Thompson text would be useful in the training of NPR operators and their supervision, and also thought the above listed recommendations merited explicit listing in this report.

I i

i 1

4 37

5 References

1. Kosmeyer, R.B., Westinnhouse Testina Reactor Incident, Nuclear Safety, Vol. 2 No. 2 (December 1960).

I

2. Thompson, T.J. and Beckerly, J.G., The Technology of Nuclear Safety, Vol 1, j MIT Press (1%4).  ;

'3. Colomb, A.L., and Sims, T.M., ORR Fuel Failure Incident, Nuclear Safety, Vol. 5, i No. 2 (Winter 1963-64).

4. Dietrich, J.R., Exocrimental Investination of the Self-limitation of Power During Reactivity Transients in a Subcooled. Water-moderated Reactor. AECD-3668. .

5.

Silver, E.G., SPERT Pronram Status Report, Nuclear Safety, Vol. 5, No. I (Fall 1963).

6. Silver, E.G., Status Report on SPERT Pronram. Including PBE, Nuclear Safety, Vol. 6,  !

No. 3 (1965). ,

t

7. SL-1 Project, Idaho Test Station, Final Report of SL-1 Recovery Ooeration, ID)-19311 (July 27,1962).  ;

8. Mosey, D., Reactor Accidents, September 1989,

9. Georgia Institute of Technology application to the NRC, December 1994. '

10. U.S. Nuclear Regulatory Commission Order Modifying Licensee Georgia Institute of r Technology, June 1995.  ;

11. Safety Evaluation Report related to the renewal of the operating license for the training and research reactor at the U.?nsity of Michigan; NUREG-1138, Docket No. 50-2, July 1985. '

12. Massachusetts Institute of Technology Safety Analysis Report (MITR-II);

October 22,1970.

13. U.S. Nuclear Regulatory Commission Docket No. 50-20 MIT Notice of Issuance of  !

Amended Facility License, July 1975.

14. Final Safety Analysis Report on the National Bureau of Standards Reactor, Addendum 1, November 1980, U.S. Department of Commerce, NBS.

15. Final Safety Analysis Report on the National Bureau of Standards Reactor - NBSR9, July 1996. ,

38 i

16. SER Related to the License Renewal and Power Increase for NBSR (NUREG-1007),

September 1983, U.S. Nuclear Regulatory Commission.

T

17. Issuance of Order Modifying License No. R-95 to Convert from High to Low-Enriched Uranium (Amendment o.17), Rhode Island Atomic energy Commission, March 17, 1993.

18. SAR for the Low Enriched Fuel Conversion of Rhode Island Nuclear Science Center Research Reactor, November 1991.

19. University of Missouri Research Reactor Facility (Columbia), Submittal in Reply to Questions by the AEC Letter February 23,1973; October 1973; MURR Addendum 4 Hazards Summary Report.

20. Safety Evaluation Report related to the renewal of the operating license for the I University of Virginia Open-Pool Research Reactor; NUREG-0928; Docket No.50-062; September 1982.

21. U.S. Nuclear Regulatory Commission, " Guidelines for Preparing and Reviewing l Applications for the Licensing of Non-Power Reactors," NUREG-1537, Part 2, February l

1996, p. xiv.

22. U.S. Nuclear Regulatory Commission, " Guidelines for Preparing and Reviewing l Applications for the Licensing of Non-Power Reactors," NUREG-1537, Part 2, February ;

1996, p. xix.

4

23. U.S. Nuclear Regulatory Commission, " Guidelines for Preparing and Reviewing i Applications for the Licensing of Non-Power Reactors," NUREG-1537, Part 2, February

, 1996, p. 4-5.

39

m.-mememe.m.r ww m A4Ad-Mm A

• h5866A d%ef sNrIS n-s,- ie " ^ ^ - -" - -"""-"'"*

" -'" e rM &cA4 Mhh M elmM G.aM MAMNA.Mem endSah.4 "MM w$ ' I t

r e

l e i I

1 l

I t

e i

l 4

I k

6 6

t i

i h

e i

I 1

i 4

e i

e i

j 1

I i

1

$ 7' -

g1:mhw'up a y-vma+n &MM'-8TPe-T*--^2-^*'e -W 9 mg--m-T3y^ev-r-rg- --ew a va-9m wwrw---- ew w-e 9---m-+ == ewe en EL w e'm--e- "w m-g- -ywm+w-e--4

l i

e i

i 1

APPENDIX 1 c

f 1

I I

l l

1

.- ._ ._. - - - ._ = . _ . - .- . _ - - _ . - . - . - . - - - - . - . .

1 l

MTR Reactivity Control Event Facility: Massachusetts Institute of Technology (5 MW)

Event Date: March 20,1995 Event

Description:

The reactor was operated at up to 70 kW for flux measurement experiments with two inoperable low-range neutron flux channels that were required by Technical Specifications for i natural circulation operation below 100 kW (also see December 7,1993 event). The actual l scram setpoints were found to have been 420 kW and 230 kW. Three period channels, a l

5.5 MW high-range channel, and two primary coolant outlet temperature scrams (that could have scrammed the reactor had reactor power approached 100 kW) were operable at the time.

Cause of Event:

Although the low-range amplifiers were set in accordance with facility procedures, the amplification factor was found to be in error.

Licensee Corrective Actions:

As a corrective action, the amplification factors of the low-range amplifiers were to be ,

verified on an annual basis.

1 ,

l l

l l

l l

l f

I

f MTR Reactivity Control Event l l

Facility: Massachusetts Institute of Technology (5 MW) [

Event Date: August 9,1995 Event

Description:

l The reactor was taken critical above its Estimated Critical Position (ECP) and operated, when j a shim blade position indication was incorrect after the blade mechanism slipped during l withdrawal.  !

On August 1,1995, a rebuilt shim blade mechanism, magnet and shim blade were installed in  :

shim blade position #4, tested satisfactorily and the reactor operated normally for 5 days. On i August 9,1995, the reactor was started up after installation of the Boiling Coolant Chemistry (

Loop (BCCL) experiment. The ECP of 22.98 cm (9.05 inches) was reached, but the reactor i was still subcritical. Each blade was verified to be coupled to its magnet drive per procedure.

The Director of Reactor Operations attributed the reactivity difference to the BCCL  !

experiment and startup was continued, with critical blade position being reached at 9.73 j inches. Operation was continued until the reactor was shutdown on the morning of August  ;

10,1995. At that time blade #4 indication was 10.8 cm (4.25 inches) with the blade fully inserted.

{

Cause of Event:  !

Examination found the blade mechanism slipped intermittently when the blade was l withdrawn, but no slippage occurred during insertion. Since the drive position indication was  !

coupled with the drive mechanism, the position indication in the control room showed a .

withdrawal even if no actual blade withdrawal occurred. Ex-core tests showed consistent slippages of 10 to 15 cm (4 to 6 inches) during withdrawals. The drive mechanism had a vespel nut rotated on the lead screw, driving the blade in or out. Upon disassembly of the  ;

drive mechanism, the vespel nut pin was found to be worn and scoring marks were found on  :

the inside of the vertical shaft. The licensee speculated that the pin was improperly r positioned outside its slot and that the friction between the pin and the vertical shaft held the  ;

vespel nut in place until the pin wore and slipped. Although slippage could occur in either  !

direction, the licensee noted that because of the shape of the vespel nut, a downward i movement of the vertical control blade shaft would create a greater friction force on the vespel nut and pin, reducing the likelihood of slippage while driving the blade in. l l

f 2

-l

l t i

j ,

4 i

4 Licensee Corrective Actions: i The blade drive mechanism assembly procedure was modified to include a step for two person  ;

verification to ensure the vespel nut and pin were properly rotated, seated, and locked at maximum depth. (See July 19,1995 event.) ,

I i

l l

1 i

1 e

k e 1

1 1

)

i l

l e

i

MTR Reactivity Control Event Facility: National Institute of Standards and Technology (20 MW) l Event Date: April 17,1990 and September 18,1990 Shim arms did not fully insert on a manual scram because of bearing problems.

[

Background:

During routine shutdowns, shim arms are driven to 12*, at the shock absorber edge, and then manually scrammed, cutting off current to the clutch, allowing it to disengage,  ;

and the shim to fall if the clutch is not released, a rundown signal associated with the scram  ;

drives the shims in. The manual scram circuit is independent of the nuclear logic scram.]  ;

April 17.1990 Event

Description:

During a routine shutdown. Shim No. I failed to drop from 12 upon a manual scram. The scram was reset and the shim was driven to the lower limit.

Surveillance tests had been normal two weeks before and the shim had scrammed normally from 12' five times previously, j Cause of Event:

The Shim No. I clutch plate appeared difficult to turn by hand and the mechanism did not seem to turn freely during bench inspection. Upon disassembly, the ball nut assembly had some specks of " dirt" but no sign of excessive wear. The lower taper bearing seemed a little rough.  :

I Licensee Corrective Actions: l l

The two bearings were replaced and the mechanism was cleaned and tested several times.

Five degree rod drop tests were performed satisfactorily. The reactor was restarted within a few hours with aC indications normal.

September 18,1990 Event

Description:

After a routine shutdown, Shim No. 4 returned to about 1.9 , above its normal position of

< 1. The lower limit switch setting was at 2.5*. Otherwise, the shim operated normally and met all release and drop requirements. During 1989. the same phenomenon had been observed on Shim No. 2.

l l

4

.. . . . . _ _ . ~ . . . . _ _ _ _ _ _ _ .__. __ _ _ _ _ _ _ _ _ _ _ _ . _ . - . _ . . . _ _ _ _

! i l'

i ,

Cause of Ever.t:

After investigation and testing, the Shim No. 2 problem was traced to the inner bearing of the l shaft, which was replaced. The licensee intended to replace the bearings on the remaining three shims at the next shim arm replacement, and stainless steel bearings were ordered to replace the carbon steel bearings. Shim No. 4 symptoms were similar to Shim No. 2.

l Licensee Corrective Actions:

The licensee replaced the bearing-seal assemblies on Shim Nos.1,3, and 4 with stainless steel l bearings.  ;

l

[

i l

l 4

I 5 l l

- _ . . _ _ _ _ _ - _ . . _ l

j l

MTR Reactivity Control Event Facility: National Institute of Standards and Technology (20 MW9 Event Date: September 18,1990 Event

Description:

On the same day that Shim No.4 remained above its normal position after a scram

. because of a bearing problem, Shim No. I failed to release completely upon manual scram because of a relay failure.

Shim No. I failed to release completely upon manual scram from 12*, falling to about 9',

after a routine shutdown for maintenance and an attempted restart that could not override xenon. From there it drove in to about 6 at which time the manual scram button was ]

depressed for a second time and held, resulting in the shim dropping to the bottom. During this period of time, it was noticed that the current to the clutch of Shim No. I did not cut off even after the reactor keys were removed. The manual scram button was depressed for a third time, and the current did cut off.

Cause of Event: i J

The problem was traced to a mercury-wetted-contact relay in the manual scram circuit of Shim No.1, the contacts of which failed to break completely.

Licensee Corrective Actions: 1 i

The relay was replaced and the shim operated normally. All other similar relays in the system were checked and found to operate normally.

l 6

l

- - - . - - - - - - - - - . _ _ _ - - - - - . . - .1 i

. t l

MTR Reactivity Control Event Facility: National Institute of Standards and Technology (20 MW)

Event Date: September '10,1993 Event

Description:

The reactor was manually scrammed because of power fluctuations cause by an unlatched fuel element.

Following refueling the day before, a routine reactor startup was made with required steps to 0.1 MW,1 MW, and 10 MW. '.Vhen the operator noticed power fluctuations on all three power channels, he immediately reduced power to 1 MW and when the fluctuations continued, he shut down the reactor.

Catise of Event:

A check of the entire core revealed that a fuel element was unlatched.

Licensee Corrective Actions:

The fuel element was removed from the core and inspected; the element was intact but appeared more discolored than normal. All other fuel elements were double checked and a '

replacement fuel element inserted. Primary flow was continued for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, stopped for 30 minutes, then restarted again while nuclear instrumentation was monitored, and the fuel element was rechecked again before restart. The reactor restart had an additional stop at 5 MW and 2 days at 20 MW before increasing power.

Special instructions were issued to operators on fuel handling, monitoring, and testing and response to instrument fluctuations. The detent in the grid under the unlatched position was examined with a boroscope and found to be acceptable. The orientation of the latching bar on all elements was later reverified and found not to be fully rotated in three instances. As a result, a special tool was developed that could only be rotated in the locking direction and used to confirm that the latching bar was in the proper orientation in following refuelings.

l l

I 7

i Fuel-Handling Event l I

1 Facility: University of Michigan (2 MW) l l  ?

Event Date: June 8,1992 l

Event Description. ,

i The assistant manager (an SRO) sent two other operators to move fuel, while he performed l

the operational checks of control room instrumentation done every 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. While the reactor was still critical at 8 kW in automatic control rod control, an operator yelled " coming out" j and pulled the next designated fuel element out of the core. This was contrary to fuel handling procedures and Technical Specification (TS) requirements that the reactor be l suberitical by at least 0.025 sk/k during fuel loading changes. The reactor became subcritical when the fuel element was withdrawn and the control rod that had been in automatic control audibly switched to meaual control. Another operator yelled "stop" and went into the control i room and began driving the rods into the core. The facility's radiation monitoring equipment indicated that there had been no release of radioactivity as a result of this event. The operators determined the event was not reportable to the NRC. While the assistant manager searched for the project director, who was unavailable, the rest of the operators continued with the final fuel movement without considering positive reactivity insertions as possible consequences or developing any corrective actions based on the implications of the event.

The next day, the assistant manager and the project director again concluded the event was not reportable to the NRC. On June 16,1992, the Safety Review Committee recommended l the NRC be r.otified of the event and the licensee notified the NRC on the following day. l 1

Cause of Event:

Subsequent analyses determined that replacing the same fuel element into the same position ,

could have added 0.054 Ak/k to the core, while a fresh undepleted fael element could have i

added 0.01 Ak/k. Both possibilities were within the SAR's analyzed reactivity addition of 0.016 Ak/k that could occur withoat fuel damage. The NRC Augmented Inspection Team report concluded that this event had no safety consequences. However, the report expressed a safety concern that the movement of fuel while the reactor was critical was an unplanned event which violated the facility's procedures and TS.

1 i

l 8

i i

NRC Actions: i The NRC dispatched an Augmented Inspection Team to investiga Level Ill violations, for violating TS for thel reactor to one ents, and be suberitical ld and violating the procedure to have all rods fully in l Occurrence in a $1,200 civil penalty being proposed. The NRC reported this as an A to Congress.

1 l

I e

4 9

MTR Reactivity Control Event Facility: University of Virginia (2 MW) l Event Date: June 13,1994  ;

i Event

Description:

l The reactor was operated for 3 days without an automatic Gas Cooled Mineral Irradiation Facility scram because of operator error.  ;

l An automatic scram (not required by Technical Specifications), intended to keep material irradiated in the facility's Gas Cooled Mineral Irradiation Facility from self-annealing if carbon dioxide gas coolant flow to th e mineral bed was interrupted at the reactor was bypassed to prim!t a surveillance of the low pool water scram circuits. Nonetheless, the reactor supen dar signed off that the scram was not bypassed on the mineral irradiation facility checklist for the following 3 days when starting up the reactor. The supervisor had taken a shortcut and misread a control room annunciator alarm as verification that the switch was on-line, rather than visually checking the switch position a short distance away in the i reactor room. Another operator, performing the checklist the fourth day, verified the switch l position and discovered that the scram was bypassed.

l Cause of Event:

Failure to follow a procedural step led to the unavailability of the scram.

Licensee Corrective Actions:

The licensee shut down the reactor for 5 days for operator interviews during event l investigation and operator training. The reactor supervisor was removed from licensed duties l involving operation of the reactor and management of the reactor staff.

l 10

MTR Reactivity Control Event Facility: University of Virginia (2 MW)

Event Date: April 28,1993 Event

Description:

During maintenance activities, two mixer-driver modules were changed in the scram logic drawer of this MTR-fueled 2 MW pool reactor, which resulted in the inoperability of both power-level scrams, the intermediate-range scram, the low primary coolant flow scram, the loss of power to the primary pump scram, the range switch scram and the key switch scram (all TS-required protective scrams) during 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> of reactor operation.

A test of the reactor trip system had been successfully performed earlier that morning, as required by procedure. The exchange was made during troubleshooting to determine the cause of a spurious reactor shutdown earlier in the day. Although the two new mixer-driver modules appeared to be identical, they had been altered internally by the facility staff. A system verification was not performed after the exchange because the operator and his supervisor had decided that the exchange of mixer-driver modules as well as the earlier temporary switching of solid state relays did not require any checks. The console operator had all the normal alarms, instrumentation, and manual shutdown capability available to him.

The loss of the scram function was not self-revealing, so that only a check of the scram system with the reactor shutdown would have found these inoperable trips. During the period the reactor was operated with some scrams inoperable, no operational parameters were exceeded, no safety limits were violated, and no damage was caused to the reactor or other electronic components in the console.

Cause of Event:

A peer review of the event on behalf of the NOTRTR found the root and immediate causes to have been "the lack of a focal point for controlling operations at the facility compounded by the failure to recognize that a modification had been made with no subsequent checks or tests to verify operability of the safety system functions." The peer review found the licensee had neither a requirement to make a determination that a change did not involve an unreviewed safety question nor an adequate restart checklist.

NRC Actions:

This event resulted in a reactive inspection from NRC Region 11 a Severity Level 11 violation for operating without five safety system channels required by Technical Specifications and failing to verify that the safety system channels were operable following maintenance as 3

11

required by TS, and a $2,000 civil penalty. The NRC reported this Abnormal Occurrence to Congress.

i e

f i

i i

i 12

a MTR Reactivity Control Event Facility: University of Missouri (Columbia) (10 MW)

't Event Date: March 20,1995 Event

Description:

A reactor startup was halted after a source range channel was not operating properly because l

of a degraded cable.

The licensee discontinued a reactor startup when the control rods were at 10" (with an estimated critical position 16.9" after there was no significant change in source range counts from the 900 counts per second measured initially, instead of the expected 30 to 50 percent increase). The reactor was shutdown.

The source range channel was not part of the reactor safety system, but provides improved l l monitoring oflow neutron flux levels at startup to ensure that suberitical multiplication and j criticality can be observed. The period scrams associated with two intermediate range l

, instruments were operable.

4 Cause of Event:  ;

1 Subsequent response-testing of the startup channel by driving the movable fission chamber l over the length of its travel found that the source range counts increased as it was driven in, but did not decrease as expected when it was withdrawn. This was attributed to a brittle cable near the detector.

Licensee Corrective Actions: l

, The source range cable was replaced and the startup checklist was modified to include an upper limit on source range operability to identify a degraded condition when higher than normal response was indicated.

l i

13

l MTR Reactivity Control Event j Facility: University of Missouri (Columbia)(10 MW)

March 16,1993 Event

Description:

While operating at steady state power of 10 MW, a reactor scram occurred as a result of a spurious trip from a reactor outlet pressure transmitter. The reactor outlet pressure transmitter '

was one of two that not only initiated a scram, but also caused primary isolation valves to close, the primary pumps to secure and the anti siphon valves to open, as protective actions in the event of a loss of coolant accident. i Cause of Event:

The scram setpoint of a Primary Coolant Low Pressure transmitter was found to be 2.5 psi below the Limiting Safety System Setpoint of 75 psia required by Technical Specifications.

Tests on this transmitter found that its indications were non linear because of apparent binding or sluggish response of the meter movement, although this could not be verified during bench testing. This was the first failure of a meter relay trip unit since they were replaced in 1988, as noted below.

Licensee Corrective Actions:

The meter movement was replaced and the transmitter was tested and found to be operating properly.

September 7,1993 l Event

Description:

Testing revealed that a primary coolant flow scram setpoint of slightly greater than 1400 gpm was lower than the 1625 gpm Limiting Safety System Setting required in Technical Specifications because of a relay latching problem. The relay action was very sluggish and accompanied by relay chattering.

The licensee noted that the reactor safety system was capable of performing its safety function if an actual low flow condition had occurred because four safety system channels that provide scrams for low primary coolant flow (a second primary coolant flow transmitter, two heat exchanger differential pressure sensors, and a core differential pressure sensor) were operable.

14

e--

i

I i

] MTR Reactivity Control Event

' \

l Facility: University of Missouri (Columbia) (10 MW) (cont.)

. Event Date: September 7.1993 (cont.)

i Cause of Event:

The licensee found that a capacitor had failed in the amplifier of the alarm trip unit. The capacitor provided a positive feedback path for the amplifier and ensured positive latching of the amplifier circuit to prevent relay " hang up" around the alarm point.

i Licensee Corrective Actions:  :

As a precautionary measure, the feedback capacitors in each of the other identical alarm trip units in use were replaced. l After a series of failures, on July 3,1978, September 22,1980. October 20.1980. April 20 l 1981, and March 5,1987, the trip units had been replaced with new equipment of the same j design because of reduced capacitance of electrolytic capacitors used in a common application in the meter relay trip circuits, which occurred despite trending annual capacitance measurements.

l I

i 15

-MTR Reactivity Control Event Facility: University of Missouri - Columbia (10 MW)

A series of seven operational failures of the regulating blade that necessitated manual reactor scrams were reported from 1988 to 1996, because of deficient preventative maintenance and corrective actions. The regulating blade was uscd to automatically control reactor power, but was not part of the reactor safety system defined in TS. The 0.0017 Ak worth of this blade was not considered in any safety analysis as contributing to the reactor shutdown margin of 0.02 Ak with any one shim blade fully withdrawn. When a reactor scram or rod run-in occurred, the regulating blade automatically shifted to manual control to prevent'it from trying to maintain power by shimming to ensure termination of a transient. An inoperable regulating blade mechanism also made the Technical Specification rod run-in associated with the regulating blade inoperable.

September 21,1988 Event

Description:

With the reactor operating in the automatic mode, a high power rod run-in occurred after reactor power reached approximately 10.9 MW. The operator returned to the licensed power level of 10 MW, found that the regulating blade failed to operate in either the automatic or manual mode, and shutdown the reactor.

Cause of Event:

The unexpected increase in reactor power was caused by positive reactivity from slowly decreasing primary temperature after the cooling tower fans had been shifted to fast speed, while the regulating blade did not respond automatically to the power levelincrease until the trip set point for the rod run in was reached. The reactor was operated for approximately 15 minutes with the regulating blade inoperable because of a loose set screw in the gearbox.

Licensee Corrective Actions:

A spare gearbox was installed and tested. The licensee also added a semiannual preventative maintenance requirement for the regulating blade drive mechanism that included disassembly and visual inspection of the gears and gear set screws.

16

1 MTR Reactivity Control Event Facility: . University of Missouri - Columbia (10 MW)

Regulating Blade Problems (cont.)

November 28,1988 Event

Description:

The reactor was manually scrammed from full power in the automatic mode, after an alarm annunciated after reactor power decreased to 95%. The reactor had operated for less than three minutes with the regulating blade inoperable.

Cause of Event:

The regulating blade gearbox output shaft was found to have sheared because of a misalignment between the gearbox and the coupling.

Licensee Corrective Actions:

1 The licensee considered changing the Technical Specifications so that a failure of the regulating blade was not automatically a deviation from the LCO and would allow for a 1 timely reactor shutdown as an action statement, to alleviate the generation of a licensee event report.

June 3,1989 J

Event

Description:

The reactor was shutdown from full power in the automatic mode, after an operator found that the drive chain had fallen off the drive gear for the regulating blade rotary limit switch l

assembly, which provided position alarms as well as the rod run-in function.

Cause of Event:

The drive chain had fallen off the drive gear for the regulating blade rotary limit switch assembly.

17

Licensee Corrective Actions:

The chain was reinstalled and the rod run-in functions were tested. The licensee added a quarterly visual inspection of the drive chains for the position indication transmitter and rotary limit switch assembly on the regulating blade drive mechanism.

18

j

> l 1

4 MTR Reactivity Control Event l Facility: University of Missouri - Columbia (10 MW) (cont.)

Regulating Blade Problems (cont.)

4 November 24,1992  ;

1 Event

Description:

J The reactor was manually scrammed from full power in the automatic mode, after a 1 downscale alarm annunciated when reactor power reached 95%.  !

i 1 Cause of Event:  !

The set screw engaging the regulating blade motor shaft to the gearbox had come loose, making the regulating blade inoperable for seven to eight minutes. l l

Licensee Corrective Actions: j

} The licensee filed a flat on the motor shaft and used Loctite on the screws as a corrective action.

l April 26,1994 Event

Description:

l With the reactor operating at full power in the automatic mode, the shift supervisor noted that  !

! the wide range chart was showing a downward trend. Manual operation of the regulating blade switch revealed that the regulating blade mechanism motor was responding, but the  !

gearbox shaft was not, as reactor power steadily decreased due to xenon buildup. The l regulating blade had been inoperable for a total of six to seven minutes. Tightening the loose  !

set screw returned the regulating blade to operability. The missing set screw was replaced.

Full reactor power was recovered approximately ten minutes later.

5 Cause of Event:

The problem was identified as one loose and one missing set screw in the motor to gearbox coupling. The semi-annual regulating blade preventative maintenance procedure that had been performed twice since the November 24,1992 failure, had not been changed to include the use of Loctite on the set screws.

4 19

i Licensee Corrective Actions:

1 The licensee drilled the motor shaft to accept a pin to provide a more positive mounting of the coupling to the shaft.

i r

a l

l 1 I 4

1 20 l

l

1 l

w MTR Reactivity Control Event 1

Facility: University of Missouri - Columbia (10 MW) (cont.)

Regulating Blade Problems (cont.)

December 27,1995 Event

Description:

The reactor was manually shutdown after an operator heard a difference in the sound of the regulating blade operation when he was on the reactor bridge, even though a wide range monitor indicated that the regulating blade had been maintaining reactor power within its normal range. The regulating blade was found to drive in normally, but was slower than normal when driving out.

Cause of Event:

A technician found that the dowel pin had failed in the gearbox coupling to the drive motor resulting in a friction fit between the gearbox input shaft and the gearbox coupling that allowed the shaft to slip in the coupling when the regulating blade was driven out.

Subsequent shop investigation indicated that the dowel pin was missing and had presumably broken shortly before the operator noticed the difference in its sound of operation.

Licensee Corrective Actions:

The dowel pin and input shaft bearing were replaced, the mechanism tested, and regulating blade rod run-ins were checked. Since the TS LCO considered the facility in non-compliance, regardless of prompt operator action to shutdown the reactor whenever the regulating blade was found to be in a degraded condition, the licensee decided to develop a safety analysis to support a request for a TS change that would allow a timely reactor shutdown as an action statement for the failure of the regulating blade, consistent with ANS-15.1 and ANS-15.18, where special reports would not be required when a research reactor momentarily operates outside its LCOs if prompt remedial action is taken.

January 23,1996 Event

Description:

The reactor was manually scrammed after the regulating blade had been inoperable for approximately 5 minutes as a result of a seized bearing on the gearbox input shaft.

21

Cause of Event:

This bearing had been a replacement as a result of the December 27,1995 event, but may have lost its original lubricant during storage, judging from its unusual failure mechanism.

The licensee identified the maintenance procedure as deficient as it did not provide directions for lubrication or replacement of bearings, i

22

MTR Reactivity Control Event Facility: University of Missouri - Columbia (10 MW) (cont.) l Regulating Blade Problems (cont.)

Licensee Corrective Actions:

The licensee rebuilt the spare gearbox with new sealed (self-lubricating) bearings, placed it in l l

service, and changed the regulating blade drive preventative maintenance procedure to specify that the gearbox be replaced with a rebuilt gearbox every two years. The licensee continued preparing their TS revision to alleviate the generation of a licensee event report for conditions j which they considered did not pose a safety concern for the reactor or the public. j l

1

]

l l

23

. i i

MTR Reactivity Control Event .

I Facility: Massachusetts Institute of Technology (5 MW)

Event Date: March 8,1989 Event

Description:

The reactor was operated with two of three power level safety channels inoperable in violation of Technical Specifications and four of six period and power level safety channels improperly connected to the low voltage protection circuit.

Technical Specifications require that at least two nuclear safety (power level) channels be l

operable prior to the reactor being brought critical. Nuclear safety channel No. 4. one of -

three channels providing an automatic shutdown signal on high reactor power, had been ,

serviced during the maintenance period preceding the reactor startup and was considered out-of-service pending observation ofits performance during startup and power operation. The reactor was started up with stepwise increases in power to monitor the readings on the safety channels. While doing this, it was noted that safety channel No. 5 was not responding properly and the reactor was immediately shut down from 4 MW. The reactor had operated above 1 MW for 28 minutes.

One power level channel was operable and three redundant scrams on the core outlet temperature were operable.

Cause of Event:

It was found that the channel No. 5 high voltage power supply had been switched off unknowingly, even though the voltage had been checked and recorded as part of the instrumentation checklist.

Subsequent analysis of the low voltage protection circuit that causes an automatic shutdown in the event of a loss of chamber high voltage or lack of continuity on the chamber signal cables in any of the nuclear safety channels found that it was operational. However, it was found f

that the power supply for channel No. 5 had not been connected to this circuit and had been interchanged with another level channel.

24

Licensee Corrective Actions:

Safety channel No.4 was calibrated and returned to service. Safety channel No. 5 was properly interfaced with the low voltage protection channel. Four of six period (1,2,3) and power level (4,5,6) safety channels found to be improperly connected to the low voltage protection circuit were properly connected. The " low voltage protection" circuit was not a Technical Specification requirement. A requirement was instituted to document the proper i

interfacing of safety channel power supplies to the low voltage protection circuit whenever a detector or associated cabling was serviced.

i l

l l

l i

25

MTR Reactivity Control Event Facility: Georgia Institute of Technology (5 MW)

Event Dst i ebruary 15,1994 Event

Description:

During a facility visit during the survey, it was learned that the reactor had been operated for an hour at 500 kW with the high bismuth shield coolant temperature and high bismuth coolant l

flow " delayed" (equipment protection) scrams inoperable. This incident was not considered reportable because these scrams were not required by the facility Technical Specifications. l Cause of Event:

During a reactor startup. a senior reactor operator had failed to comply with a procedure step to turn on the recorder which measured shielding cooling and bismuth block cooling temperatures and provided those scrams, even though he had signed off the procedure step as completed.

Licensee Corrective Actions:

The operator had previously been involved in similar lapses of attention to detail, including a period scram at a power level above the licensed power level in 1987 Subsequently, the j operator was removed from duty. j l

l l

26

i I

- \

i l

1 i Reactor Coolant Leak Facility: University of Virginia (2 MW)

Event Date: November 1995 Event

Description:

An NRC morning report from Region 11 noted that the licensee detected leakage from the reactor pool at a rate of 100 to 120 gallons per day, as determined by pool level decrease.

Over a period of months, this decreased to about 40 to 50 gallons per day. Measured radioactivity levels in water samples from the pool are generally below 10 CFR 20 limits for release to unrestricted areas except for sodium-24.

l I

27

Reactor Coolant Leak I Facility: University of Virginia (2 MW)  !

Event Date: August - October,1995 i

Event

Description:

During the week of August 7,1995, the secondary side of the heat exchanger was cleaned. )

Some of the tubes had scaling and pitting, although there was no evidence of a leak. The i tubes were cleaned and the heat exchanger reassembled and the reactor was operated at 2 MW on August 17,18, and 22. On August 22, low levels of Na-24 were detected in the secondary

• water, indicating a possible primary to secondary leak.

i Cause of Event:

Leaking exchanger tubes ,

Licensee Corrective Actions:

The licensee closed the isolation valves between the primary and secondary systems and l restricted reactor operation to less than 200 kW on natural convection until the problem was evaluated and corrected. Eight tubes were plugged on October 25,1995, and a static pressure l test revealed no other leaks. A new surveillance requirement for weekly monitoring of the  ;

secondary water for radioisotopes was added to the Technical Specifications. i 6

l 28 t

i I

l l

l l

Reactor Coolant Leak l

l Facility: University of Virginia (2 MW)

Event Date: For months up to January 1994 Event

Description:

The reactor pool had a variable leak rate of up to 378.5 liters (100 gallons) per day into a retention pond outside the building. The leak was within the makeup capability. Because

- there was no leaking fuel, the pool water was within 10 CFR 20 limits for release to unrestricted areas.

Cause of Event:

Pool leak Licensee Corrective Actions:

The licensee shut down the reactor and analyzed water samples in the pool and pond weekly  !

for about 4 months while the leak was repaired by pumping liquid grout into several areas of the pool wall where moisture was observed and painting the top i m (3 feet) of the pool wall.

d i

29

~ -

4 1

]

Reactor Coolant Leak 1

I l

I Facility: Rhode Island Atomic Energy Commission Nuclear Science Center (2 MW)

Event Date: July 1995 Event

Description:

i The reactor pool leak increased from 1993 to 1995 from 1-2 liters per day to 5 gallons a day to 25 gallons a day. The leak water was collected in drain lines and pumped to a holding tank. After sampling, the water was discharged. Most of the leakage came from the area below the thermal column door on the main reactor floor level. This leakage had not been present for a few years but reappeared.

Cause of Event:

The most probably source of the leakage was from cooling tubes that were welded to the pool liner that made a u-shape into the concrete.

Licensee Corrective Actions: l The leak is the top priority for funding under the Department of Energy Grant Program.

30

i MTR Reactivity Control Event Facility: University of Virginia (2 MW)

Event Date: March 13,1996 l

Event

Description:

i i An operator manually shut down the reactor during a startup in response to 0.2 MW power i

! fluctuations on both linear and intermediate power channels. Power level had not exceeded  ;

the authorized maximum power level of 2 MW.  !

]

Cause of Event: )

The licensee subsequently found a paper towel lying on top of the core. Visual inspection of I the core and water sampling confirmed that no iues damage had occurred. The licensee theorized the paper towel had permitted wai ; to pass through it with some increased 1 resistance and attributed the power fluctua',ons to reactivity changes resulting from water

temperature changes by the affected fuel element.

Licensee Corrective Actions:  !

4 The licensee instructed the reactor staff to keep foreign materials away from the pool border, searched the pool for other debris (and found none), examined the areas around the pool and removed materials that could have been inadvertently dropped into the pool, and developed a

checklist to identify anything that could get into the pool and remove the item as necessary, l 4

I i

,i 2

O 4

i 1

31

. . . - . . - . . - - ~ . . . - . . - . - _ _ . - . - _ . . -- - ..

l i  !

l Fuel-Handling Event ,

Facility: National Institute of Standards and technology (20 MW)

Event Date: June 25,1991 -

Event

Description:

While remotely inserting a new fuel element into position in the core, the element fell off the tool and landed on the top grid about a foot below.

Cause of Event:

Not given in the brief information letter to the NRC.

Licensee Corrective Actions:

A special tool was made and the cler ent was retrieved. A thorough inspection showed the element was undamaged. The element was cleaned, minor external scratches polished, and reinserted into position.  !

l i

i 1

1 1

32

i i

MTR Reactivity Control Event Facility: Massachusetts Institute of Technology (5 MW)

Event Date: July 19,1995 Event

Description:

The reactor was operated above licensed power with a power tilt when on control blade i' remained fully inserted in the core.

1 At 1017 hours0.0118 days <br />0.283 hours <br />0.00168 weeks <br />3.869685e-4 months <br />, the reactor was started up by an operator-in-training, under the supervision of two licensed senior reactor operators, with two shim blade " blade in" indications (nos. 3 and j

4) known to be out of commission because of malfunctioning proximity switches. The startup I was halted by procedure after the control blade positions exceeded the Estimated Critical Position by 1.27 cm (0.5 inches) and the reactor was suberitical. Rather than following the procedure, which required the operators to contirm that the control blades were coupled to l their magnet drives, the two licensed senior reactor operators decided that the reason for the reactivity difference was that the reactivity contribution of a newly installed Boiling Coolant Chemistry Loop (BCCL) experiment had not been properly estimated. The reactor wa taken l critical at 4.32 cm (1.70 inches) above the ECP and run at low power for an hour.

Aftet power was increased to 4.8 MW, the supervisor noticed that the 4T across the core was higher than would be expected for that power level. A heat balance calculation was performed, which found that once equilibrium conditions were attained, the thermal power would be 5.04 MW, slightly above licensed power level, and reactor power was immediately ,

lowered to 4.5 MW.

Operation continued at 4.56 MW until 1720 hours0.0199 days <br />0.478 hours <br />0.00284 weeks <br />6.5446e-4 months <br />, when an operator performed a reshim, noticed that movement of control blade No. 4 caused no reactivity effect, and manually scrammed the reactor.

The NRC was notified of the TS violation of operation without all blades within 5 cm (2 inches) of the operating position.

Cause of Event:

The subsecuent i

event review found the main cause was the failure of licensed operators to follow written procedures for investigating a mismatch between calculated and observed ECPs.

33

Control blade magnetic currents were routinely lowered to about 60 milliampere (mA) }

i compared with the normal setpoint of 80 mA. to avoid electrical interaction between the magnet current circuitry and one of the period channels. It was determined that the minimum j current necessary to reliably pick up blade No. 4 was 64 mA.

?

l A

p 34

I 1

l i

i MTR Reactivity Control Event Facility: Massachusetts Institute of Technology (5 MW) (Cont.)

l Event Date: July 19,1995 Because the " blade in" indication was out of commission, there was no immediate indication that blade No. 4 was not attached to its magnet. It was not unusual for these proximity switches to fait due to the hostile environment. Blade No. 4 had not been picked up during a startup on July 11,1995, but this event had been properly diagnosed and corrected before the reactor was brought critical. However, this had not been communicated to all of the reactor operators, including those on duty during this event.

Licensee Corrective Actions:

No evidence of fuel damage or mechanical binding of blade No. 4 was found. l 1

i Power density and thermal hydraulic calculations determined that none of the core power l distribution limits had been violated during operation with blade No. 4 full in.

Although the two failed proximity switches were replaced, another failed since.

The reactor safety committee recommended development of a method for better communication among all operators, management action to ensure all personnel follow facility procedures, determination of the minimum current required to pick up each blade, development of a checklist to guide operators when the reactor is not critical within 1.27 cm (0.5 inches) of the ECP, development of a special procedure for verification that a blade was connected to its magnet when the " blade in" indication was out of commission, and management action to resolve electronic equipment problems (see MIT previous two events).

l l

l 35

MTR Reactivity Control Event Facility: University of Michigan (2 MW)

Event Date: March 24,1993 Event

Description:

The MTR-fueled 2 MW reactor exceeded its licensed power by 15 percent, operating at 2.3 MW, with a high power scram set above its TS limit for 11 minutes. The shift crew (two senior reactor operators) conducted a routine startup. At an indicated 1 MW power level (50 percent of full power), the crew conducted a calorimetric power determination which found that the reactor was actually at 1.156 MW. At that point the shift crew should have adjusted the linear power level setpoint used for automatic power control to 86 percent which, while in the automatic rod control mode, would have reduced actual power to 1 MW. However. the crew continued to raise power to 1 MW (100 percent indicated power). That resulted in the actual power being 2.3 MW,15 percent above the licensed limit. Approximately 10 minutes later, the Assistant Reactor Manager for Operations arrived in the control room, reviewed the calorimetric data, and immediately ordered the crew to return the reactor to 1 MW indicated power. The NRC Preliminary Notification noted that the crew had also failed to adjust the overpower reactor scram setpoint, a high power level scram would not have occurred at the TS limit of 2,4 MW, but at about 2.6 MW.

Cause of Event:

An NRC Special Safety inspection faund that the root causes of the event 'were a lack of management oversight of operations and poor communications between the shift supervisor and console operator (including reluctance by some operators to ask questions when uncertain, based on experience of being chastised by shift supervisors when questioning their actions);

deficient operator knowledge regarding the power level instrumentation; operator failure to review or use the startup procedure; an unclear procedural step covering the evolution (had it been used); and ineffectiveness of previous corrective actions from a July 22,1992 event.

Licensee Corrective Actions:

An NRC special Safety inspection noted that the licensee permanently removed the shift supervisor from licensed activities; required that neutron channel adjustments necessary to match thermal power be made at 1 MW prior to proceeding to 2 MW: revised the " Reactor startup" operating procedure to provide a smooth transition to the " Power Level Determination" operating procedure and bacr; conducted an unannounced oral and written examination of the reactor operations staff; and issued a memo emphasizing adequate review of procedures prior to their use.

36

l l

l e I

i l

1 NRC Actions:

The NRC performed a reactive team inspection and issued a Severity Level 111 violation and a

$3,750 civil penalty.

1 I

1 l

l l

t 37

o MTR Reactivity Control Event Facility: University of Michigan (2 MW)

Event Date: November 24,1992 Event

Description:

The reactor was operated without the power level deviation interlock operable which could have allowed continuous withdrawal of a control rod.

On November 24,1992, during a routine maintenance period, the shim range, control rod interlock system was removed from the reactor control system for a modi 6 cation that had been reviewed and approved by the facility Safety Review Committee on October 6,1992.

Following the wiring modi 6 cation, a reactor pre-start checklist was conducted to test the modi 6 cation that disabled the interlock that drops the reactor out of automatic control if the linear level neutron detection system indicated power 5 percent below the automatic control setpoint. The fact that this interlock was disabled was not discovered during the performance of this checklist. A senior reactor operator misinterpreted a rundown as the e> pected drop-out-of auto when a trainee apparently increased the setpoint too s!owly durint, the checklist.

Neither the electrical engineer nor any other member of the quality assuranco team observed the performance of the checklist step-by-step. Following " successful" completion of the checklist, the reactor was started up to approximately 5 kW to perform a shutdown margin and excess reactivity check. The control rod was withdrawn to 24 inches and the shim rods to criticality, but the reactor was never placed in automatic control. Following the reactivity measurement, the reactor was shutdown.

During the midnight shift on November 25,1992, the crew performed the prestart checklist, but could not successfully complete the drop-out-of-auto and rod insertion veri 6 cation. The Assistant Manager and the electrical engineer were notined, the procedure retried, the wiring mistake was discovered and corrected, and the checklist satisfactorily completed. The personnel who had conducted the original checklist were interviewed and a series of errors and misinterpretations resolved. At 9:00 a.m. November 25,1992, the Reactor Manager gave permission to startup the reactor for power operation.

The licensee noted that the worst possible consequence of operating with the power level deviation interlock out of service would be failure of the automatic control system followed by continuous withdrawal of the control rod. If the control rod was withdrawn from 0 to 24 inches, 0.00475 sk/k reactivity would be inserted, with a resultant period of 6 seconds. At a 10 second period, an automatic rundown of the shim-safety rods would occur. The reactor period scram setpoint is 5 seconds.

38 1

Cause of Event:

l Operator Error and unclear procedural guidance (not specifically stated by the licensee).

39

i MTR Reactivity Control Event University of Michigan November 24,1992 event (Cont.)

Licensee Corrective Actions:

The licensee changed the prestart checklist to ensure proper verification of the drop-out-of-auto and rod insertion. When a modification is made, the functional changes related to the modification will be tested and verified by the quality assurance team members directly responsible for the modification.

l l

40

I 4

MTR Reactivity Control Event Facility: Massachusetts Institute of Technology (5 MW)

Event Date: January 25,1995 Event

Description:

During a survey visit, it was learned that the reactor was operated without a core low flow scram for a short time (not considered reportable to the NRC). The operator worked around a core temperature pin oscillation on a recorder during a shutdown by inadvertently turning off the core flow and temperature recorder instead of just the temperature pin. After starting up, the reactor operator turned the recorder back on and the low flow signal scrammed the

~

reactor. The operators noted the occurrence in the operating log book.

Cause of Event:

Malfunctioning temperature recorder and operator error. Although the restart procedure contained a step to restart any instrument that had been secured, the operators did not have a list itemizing which instruments were secured.

Licensee Corrective Actions:

Since this occurred the day before the site visit, the licensee had not addressed corrective actions at the time of the visit.

I 41

_ _ ._ . . _ . _. . . _ _ _ _ _ . . _ _ _ _ _ _ _ _ . _ _ . . _ _ _ _ _ . - ~ _ .

4

. 4 MTR Reactivity Control Event Facility: Massachusetts Institute of Technology (5 MW)

Event Date: December 7,1993 Event Description The reactor automatically scrammed while a technician was investigating why one of two -l low-range neutron flux power level safety channels required by Technical Specification for j natural circulation operation below 100 kW had failed to 0 during operation at 50 kW.

Cause of Event: l The low-range amplifier circuit was found to have failed.

Licensee Correct.ve Actions:

The low-range amplifier circuit was replaced. Corrective actions also included modifying the-existing low-range amplifiers so they were no longer dual-range to allow all of the circuitry associated with each amplifier to be tested without removal of the input signal cable at the i rear of each amplifier.

l l

42 i

MTR Reactivity Control Event Facility: Massachusetts lastitute of Technology (5 MW)

Event Date: March 12,1990 Event

Description:

The reactor was automatically scrammed on a short period because of an error in calculating the Estimated Critical Position (ECP).

An ECP was calculated independently by a trainee, the console operator, and the reactor supervisor. Ilowever, the operator and the reactor supervisor relied on the trainee's use of critical data from a xenon-equilibrium condition, instead of the xenon-free condition that should have been used. The result was an ECP that was 11.04 inches vs. the correct 8.60 inches. As the startup progressed, the operator observed an mereasmgly short period, but attributed it to noise on the instrument channels. The operator and supervisor also failed to recognize the significance of several other indicators approaching criticality including the need to upscale both the startup channels and an audible count rate meter. The trainee had operated the reactor on the unusually short reactor period of 10.4 seconds, contrary to 1 operating procedures that allowed a minimum 30.0 second period, and an automatic safety system shutdown occurred at 340 watts. The Technical Specification limiting safety system i setting was a 3 second period.

The reactor supervisor reported the cause of the shutdown as instrument noise and obtained approval for a restart from the Reactor Superintendent. During the restart, the operator and supervisor again observed an increas:ngly short period. This time they recognized it as a true signal and immediately made the reactor suberitical in accordance with existing written procedures covering an error in the ECP calculation. The Reactor Superintendent was again notified, the reactor was shut down, and the Director of Reactor Operations was notified.

Cause of Event:

Human error was the cause of the event. The console operator and reactor supervisor had not checked the second portion of the trainee's ECP calculation, placed excessive reliance on the ECP as the means of identifying criticality, did not notice the indications that the reactor was approaching criticality, and attributed the short period indication to instrument noise.

l 43

Licensee Corrective Actions; Licensee management stressed the need for attention to details for safe operation, the importance of not relying on trainees, and the need to investigate all abnormal instrument readings to all operators. The reactor startup procedure was modified to require two independent calculations of the ECP by licensed operators. Electronics personnel were directed to investiga:: noise effects on the teactor startup instrument.

l l

1 l

44