ML20138M011

Ack Receipt of Final Case Study Rept Overpressurization of ECCS in Bwrs. Schedule for Resolution of Issue Consistent W/Results of Present Assessment.Generic Ltr Should Be Sent to Affected BWR Licensees.Ltr Will Be Prepared by Dec 1985

ML20138M011
Person / Time
Issue date:	10/18/1985
From:	Harold Denton Office of Nuclear Reactor Regulation
To:	Heltemes C NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
References
NUDOCS 8510310478
Download: ML20138M011 (4)

Text

"*%

~'^ UNITED STATES 3 - n NUCLEAR REGULATORY COMMISSION h

,j WASHINGTON, D. C. 20555 e

\*****/

OCT 181985 MEMORANDUM FOR: C. J. Heltemes, Jr., Director Office for Analysis and Evaluation of Operational Data FROM: Harold R. Denton, Director Office of Nuclear Reactor Regulation

SUBJECT:

FINAL CASE STUDY REPORT - OVERPRESSURIZATION OF EMERGENCY CORE COOLING SYSTEMS IN BOILING WATER REACTORS We thank you for your final case study report regarding Overpressurization of Emergency Core Cooling Systems (ECCS) in Boiling Water Reactors (BWR) dated ,

September 9, 1985. It is our understanding, based on discussion with your staff, that only minor changes have been made to the draft report we previously reviewed and commented on.

As we stated in our April 12, 1985 letter, we concur with your findings that the potentially serious safety implication of the overpressurization of the ECCS warrants action to prevent recurrence of similar events. Action toward resolution of this issue is discussed below.

As you know, Interfacing Systems LOCA at BWRs has been identified by NRR as Generic Issue 105. On June 11, 1985, it was given a high priority ranking and resources to resolve the issue were assigned. A task manager in the Reactor Systems Branch of NRR has been assigned to lead the review. The Task Action Plan for resolution of this issue was published on August 21, 1985. A large portion of the work required to resolve this issue will be performed under a technical assistance contract. Funding has been allocated for the contract and a request for a proposal has been issued. We expect the contract work to begin in October, 1985 and end in June, 1986. The plan calls for completion of a report with the conclusions and recommendations of the study available for CRGR review by December, 1986. Closecut of the issue is anticipated by April, 1987.

The costs and benefits (risk reduction) associated with imposing current require-ments for leak testing high pressure / low pressure isolation valves on BWR plants licensed prior to 1980 will be specifically examined as well as other actions recommended in the case study report.

We believe that the schedule for resolution of this issue is consistent with the results of our present assessment of the safety significance of this issue; and that acceleration of the schedule is not justified by the intersystem LOCA probabilities presented in the case study report.

'h l

l L

_ . MISC PDR PDR o( s i

1 j Our assessment indicates a core melt frequency of 6.3 X 10-6/RY due to BWR intersystem LOCA. This is at least two orders of magnitude less than the core melt frequency which, by current standards, would indicate a need for imediate or short term corrective action. We recognize that in this instance, releans from a LOCA in ECCS piping would constitute a containment bypass release and would result in greater off-site consequences than those norrally attributed to core melt accidents. However, we do not believe they would be great enough to offset the relatively low core melt frequency.

However, we do believe that it would be appropriate at this time, to send a generic letter to the affected BWR licensees which makes them aware of the staff estimates of the risks and costs associated with BWR Intersystem LOCA events, the corrective actions identified in the case study report, and current staff plans for resolution of Generic Issue 105. We plan to prepare such a generic letter by December, 1985.

The staff contact for this activity is R. Wessman (x28432) in the Operating Reactors Assessment Branch, f

/ ~

Harold R. Denton, Director Office of Nuclear Reactor Regulation

, r; l

l l

______j

OCT 16 m35 Our assessment indicates a core melt frequency of 6.3 X 10-6/RY due to BWR i intersystem LOCA. This is at least two orders of magnitude less than the core melt frequency which, by current standards, would indicate a need for immediate or short term corrective action. We recognize that in this instance, releases from a LOCA in ECCS piping would constitute a containment bypass reiease and would result in greater off-site consequences than those normally attributed to core melt accidents. However, we do not believe they would be great enough to offset the relatively low core melt frequency.

However, we do believe that it would be appropriate at this time, to send a generic letter to the affected BWR licensees which makes them aware of the staff estimates of the risks and costs associated with BWR Intersystem LOCA events, the corrective actions identified in the case study report, and current staff plans for resolution of Generic Issue 105. We plan to prepare such a generic letter by December, 1985.

The staff contact for this activity is R. Wessman (x28432) in the Operating Reactors Assessment Branch.

OrWad W 4 H. R. Oevites Harold R. Denton, Director Office of Nuclear Reactor Regulation i

DISTRIBUTION 4 Central File w/ incoming GHolahan cc: P. Lam NRC PDR w/ incoming RWessman W NSIC w/ incoming ORAB Reading MCaruso HSmith

[ ' 1. Hodges Cherney W. Millstead Denton/Eisenhut S. Newberry I

PPAS C. Cwalina Marie /HThompson G. Thomas Debbie /DCrutchfield j 3RAB:Drf F :0RAB:DL B- E :DL AD/RS .

MCaruso:mk RWessman Holahan MHodges 10/g/8 ~ 0/ g/85 10/7/85 10/@/85 9(p4.- '

/ , -

l AD)/fjp A )(_/ D/DL D R D/NI)f)

WMinn~ersl D 'Tield

) HThom@oson Qi t HDefvt'bn 10/g/85 10/f/85 10/g/85 1C' g/85 10/g/85 3

- jid y Qg& y b

+ (y 4 3 t

1. o, UNITED STATES

/ 8 ,

o NUCLEAR REGULATORY COMMISSION a

$ E WASHING TON, D. C. 20555 4, .....,o FROM: C. J. HELTEMES, JR. ORIG. DUE DATE: 10/10/85 TICKET N0: 859233 T0: DOC DATE: 09/09/85 HAROLD R. DENTON NRR RCVD DATE: 09/12/85

• • YELLOW **

FOR SIGNATURE OF:

DESC:

CC:

OVERPRESSURIZATION OF EMERGENCY CORE COOLING SYSTEMS IN BOILING WATER REACTORS DENTON/EISENHUT

-- CASE STUDY REPORT (FOR INFO AND APPROPRIATE PPAS ACTION)

REFERRED T0: DL DATE: 09/12/85 CONTACT:

H. THOMPS0 f

/

PLEASE REVIEW THE DUE DATE IEEDIATELY:

IF THE DUE DATE DOES NOT ALLOW ADEQUATE REQUESTS FOR REVISION OF YELLOW TIME TO RESPOND TO THIS TICKET, YOU MAY TICKET DUE DATES MAY BE MADE, WITH REQUEST A REVISED DUE DATE. THE REQUEST JUSTIFICATION, THRU THE WEEKLY WITS MUST INCLUDE A VALID JUSTIFICATION AND UPDATE UP TO ONE WEEK AFTER ASSIGN-BE MADE THROUGH YOUR CORRESPONDENCE CO- MENT BY NRR MAIL ROOM. THE NEW DUE

,jRDINATORTOTHENRRMAILROOM(LISA DATE, IF APPROVED BY NRR MAILROOM, MULLEY OR HAZEL SMITH)

WILL BE USED TO TRACK DIVISION COR-RESPONDENCE COMPLETION SCHEDULES.

PLEASE D0 NOT HAND CARRY CORRESPONDENCE PACKAGES TO DIRECTORS OFFICE WITHOUT FIRST GOING THRU THE NRR MAIL ROOM.

l

• ps'"!c g b.nenhJ

'E e.

" ,% UNITED STATES h e% . b NUCLEAR REGULATORY COT.;f.11SSION WASHING TON, D. C. 20555 M

SEP O9 B3E MEF0PANDUM FOR: Harold R. Denton, Director Office of Nuclear Reactor Regulation FROM:

7 C. J. Heltemes, Jr. , Director Office for Analysis and Evaluation of Operational Data C

SUBJECT:

$ CASE STUDY REPORT -- OVERPRESSURIZATION OF EMERG CORE COOLING SYSTEMS IN BOILING WATER REACTORS d The Office for Analysis and Evaluation of Operational Data has fi'nalized its 4 tion of a BWR emergency core cooling system. case study of operating

$ The final report addresses the peer review comments provided by NRR, IE, the Regions, NSAC and INPO on o liminary sing the root report, andofcontains causes several the reported specific recommendations aimed at addr failures.

final report for your information and appropriate action.We have enclosed a copy of our the high pressure reactor coolant or feedwater system piping of an emergency core cooling system, was seriously degraded. In when all of the events a testable isolation check valve failed to be fully closed required.

of a normally Five of the closed events also pressure motor-operated involvedisolationa simultaneous

/ injection inadvertent valve. peningo Four of these five events occurred with the plant operating cooling system.

It is AEOD's view that these operating experiences, when taken together, represent a trend with potentially serious safety implications.

indicates that the likelihood of an interfacing loss-of-coolant accidentOur analysis between the reactor coolant system and an emergency core cooling system is significantly greater than had been previously assessed.

Such an accident would required toinvolve mitigate thethe discharge of high energy reactor coo accident.

Although none of the coerating events has yet resulted corrective in an actual measures are ne pipe failure, our assessrent concludes that generic nore serious consequences.eded to prevent recurretices irvolving potentially 450WWO'f M

H. Denton We are aware that since our preliminary report was issued, NRR has identified interfacing loss-of-coolant accidents AEOD atfully BWRs as Generic supports Issue the high No. 105 and has priority given it a high priority ranking. However, we are concerned that the fre-ranking established for this issue.

ouency of the recent events may indicate that a recurrence Wecould occur at an therefore operating BWR plant at some time during the next few years.beli be expeditiously pursued in order to cuickly reestablish the safety margins Additionally, we g

originally intended to prevent interfacing LOCAs in BWPs.

would urge NRR to give prompt consideration to early implementation of one or 4

I more low cost and relatively effective corrective actions su 1

If you or your staff have any questions regarding the enclosed report, please contact Peter Lam of my staff. Dr. Lam can be reached at 492-4438.

o Mr Sh C.g) Heltemes, W. , Director Office for Analysis and Evaluation of Operational Data

Enclosure:

As stated cc w/ enclosure D. Eisenhut, NRR R. Bernero, NRR J. Knight, NRR T. Speir, NRR H. Thompson, NRR G. Holahan, NRR D. Beckham, NRR S. Newberry, NRR t J. Page, NRR

~

G. Thomas, NRR E. Jordan, IE S. Schwartz, IE D. Allison, IE R. Baer, IE E. Rossi, IE F. Gillespie, RES V. Stello, DEDROGR J. Sniezek, DEDROGR .

P. Polk, OCM M. Sinkule, Region II P. Boehnert, ACRS i

i I

CASE STUDY REPORT

• OD/C502 OVERPRESSURIZATION OF EMERGENCY CORE COOLING SYSTEMS IN BOILING WATER REACTORS i

s September 1985 Prepared by: Peter Lam Office for Analysis and Evaluation

'*' of Operational Data U.S. Nuclear RegLlatory Commission

• This report documents results of a study completed to date by the Office for Analysis operational andsituation.

Evaluation of Operational Data with ~ regard to a particular The findings and recomendations do not necessarily represent the position or requirements of the responsible program office nor the Nuclear Regulatory Comission.

~

... s 45OTl'70%D vyr

, iii LIST OF FIGURES Figure Title Page 1 A Typical Testable Check Valve . . . . . . . . . . 7 2 Simplified Flow Diagram for Division A of LPCI/RHR at Vermont Yankee . . . . . . . . . . . . 8

~~~ #I 3 Simplified Flow Diagram for the High Pressure Coolant Injection System at Cooper . . . . . . . 10

._~f = 4 Simplified Flow Diagram for the High Pressure

_- Core Spray System at LaSalle-1 . . . . . . . . . 11 1 5 Simplified Flow Diagram for Loops B & C of

_3 LPCI/RHR at LaSalle-1 . . . . . . . . . . . . . 13

- 6 Simplified Flow Diagram for the High Pressure

__~ l .

Coolant Injection System at Pilgrim . . . . . . 15

~

~

7 Simplified Flow Diagram for Division 8 of

"~ 7- '

m. LPCI/RHR at Hatch-2 . . . . . . . . . . . . . . 17

((T' 8 Simplified Flow Diagram for

_.1 Core Spray System I at Browns Ferry-1 . . . . . 19

.g .

'A.

. . _ , LIST OF TABLES

'[ ' Table Title Page d

E 1 -

Summary of Operating Events . . . . . . . . 6 L

f t

ii TABLE OF CONTENTS Page ABSTRACT . . . . . . . . . . . . . . . . . . . . . . . . . . 1 EXECUTIVE

SUMMARY

1.

..................... 1 2.

INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . 4.

OPERATIONAL DATA REVIEW 3.

.................. 5 ANALYSIS OF OPERATIONAL DATA . . . . . . .20. . . . . . . .

3.1 Testable Isolation Check Valve Failures . . . . .20. .

3.2 Inadvertent Opening of an Injection Valve . . . . . . 21 3.3 Overpressurization Frequency

............22 4.

EVALUATION OF SAFETY SIGNIFICANCE

. . . . . . . . . . . . 24 4.1 Precursors to an Interfacing LOCA . . . . . . . . . . 24 s 4.2 Potential for Pressure Boundary Rupture . . . . . . . 24 4.3 Probability of an Interfacing LOCA

. . . . . . . . . 26 4.4 Accident Scenarios 5.

.................27 GENERIC EVALUATIONS BY OTHER NRC 0FFICES . . 29 AND INDU

6. CONCLUSIONS 7.

.......................30 RECOMMENDATIONS 8.

.....................31 REFERENCES . . . . . . . . . . . . . . . . . . . . . . ..34.

B l 1

- ...~ - -

i ABSTRACT A generic review and evaluation of operational events involving actual and potential overpressurization of emergency core cooling systems in boiling water reactors has been conducted. Eight events, each entailing the failure of a testable isolation check valve on the injection line of of Five anthe emergency core eight events cooling system, were identified and evaluated.

involved an additional failure of the second and final isolationFour inadvertent opening of a nonnally closed motor-operated injection valve.

barrier--the

! of these five events occurred during power operation, thus leading to an actual Each of these overpressurization of an emergency core cooling system.

4 operational events is considered a precursor to an interfacing loss-of-coolant accident between the reactor coolant system and an emergency core cooling i

system. Such an accident would involve the sudden discharge of reactor coolant l at operating pressure and temperature outside the primary containment and would y

also likely disable one or more of the safety systems required to mitigate the accident. Collectively, these operating events indicate a trend which has serious safety implications--that the likelihood of an interfacing loss-of-coolant accident is higher by two to several orders of magnitude than had been previously assessed. This trend provides a strong indication that g' prompt corrective actions should be taken to prevent a recurrence of these y,

5 reported multiple failures. Several recommendations have been developed to j eliminate the root causes af these occurrences.

i.i n

b nu n

?A 1

?

e

_. a . .

EXECUTIVE

SUMMARY

In an engineering evaluation report issued in May 1984 by the Office for Analysis and Evaluation of Operational Data (AE0D) regarding a stuck open testable isolation check valve on the low pressure ccolant injection line at Hatch-2, the safety significance of the event was assessed to be high because the mispositioned valve substantially increased the likelihood of an inter-i facing loss-of-coolant accident (interfacing LOCA) involving the Suchreactor an coolant system (RCS) and the residual heat removal (RHR) system.

, accident would involve the discharge of high-pressure, high-temperature reacto i coolant into the low-pressure RHR system, would likely disable at least one The j train of the RHR system, and would certainly bypass the pneumatic pressure reversal caused by maintenance errors.

.l 14, 1984, a

,  ! Three months after the issuance of the above AE00 repo

. 4 failed open in an almost identical way as at Hatch-2.

I

valve, together with an inadvertent opening of a normally closed Themotor-oper 3 injection valve, led to an overpressurization of the core spray system.

-g core spray system was pressurized to near operating reactor pressure and i Paint on sections of piping vaporized and actuated a smoke temperature.Steam from the relief valve on the core spray system, which opened j detector. A h to relieve the overpressurization, discharged into an open drain line.

d~r h roving fire alarm.

fire watch spotted steam escaping from the drain lin Q contaminated 13 workers responding to the fire alarm.

-! 2 3 Prompted by these events, and to consider the need for generic corrective actions, AE00 took another look at operational data dating back to 1975, U broadening the search scope to testable isolation check valve failures in all

-y emergency core cooling systems as well as the reactor core isolati

-d 3 system in boiling water reactors (BWRs).This review resulted in identifying a total the BWR/3 to BWR/5 product lines.

ri hi .

of eight events including the events at Hatch-2 and Browns Ferry-1, all FE" involving the failure Among of a these testable isolation check valve events, five events involved an emergency core cooling system. additional failure of the second and final isola Four inadvertent opening of a normally closed motor-operated injection valve.

of the five events occurred during power operation, A fifththus leading event to anwhile occurred overpres-surization of an emergency core cooling system.

the plant was in cold shutdown, resulting not in an overpressurization of t associated emergency core cooling system but a rapid draining of the reactor vessel.

Among the eight observed failures of the testable involved causes related to the check valve itself; and one invo whose cause remains unknown. closed motor-operated injection valve (inadv personnel errors connitted during surveillance testing of the safety system l

j i

To varying degrees, each of the eight operational events should be considered

, as a precursor to an interfacing LOCA involving the RCS and an emergency core cooling system. Such an accident would involve the sudden discharge of reactor coolant at operating pressure and temperature outside the primary containment, and would also likely disable one or more of the safety systems required to mitigate the accident. Collectively, these operating events indicate a trend with serious safety implications--that the likelihood of an ir'erfacing LOCA as a result of multiple independent failures (a stuck open testab.e isolation check valve together with inadvertent opening of a normally closed motor-operated injection valve) is higher by two to several orders of magnitude than 7: had been previously assessed by analysis. This trend provides a strong indication that corrective actions should be taken on an expedited basis to i prevent a recurrence of the aforementioned multiple failures.

.i AE00 has developed several recomendations which are briefly described below

( and will be further discussed in the report. These recommendations appear to g involve minimum costs and, if effectively implemented, can significantly reduce u the reactor accident risks associated with such multiple failures. The il recommendations are:

71 0 (1) Disable the nonsafety-related air operator of the testable isolation check h

valve on the injection line in the safety systems involved.

n j Disabling the air operator would eliminate about 40% of the causes for testable 4 isolation check valves being stuck open. This option involves three essential s elements. First, the disabling of the nonsafety-related air operator should be 1 conducted in a way not to pose any mechanical interference with the operability

5 of the check valve in lifting on demand or in providing isolation protection.

'1 Secondly, it would be necessary to conduct surveillance testing of the isola-S tion check valve by flow testing during cold shutdown in accordance with ASME M Section XI, IWV-3520. Finally, it would be desirable to retain the position n indication of the check valve in the control room after the air operator is a disabled to ensure early detection of an unseated chack valve disk.

U O (2) Perform leakage testing of the testable isolation check valve prior to e plant startup after each refueling outage or following maintenance, repair or

.Eri replacement of the valve, as an alternative to Recommendation 1.

This corrective action would detect the most serious degradation in testable

~

isolation check valves yet observed from operating experience (i.e., being

= stuck open with reversed indications caused by maintenance errors associated with the air operator). This action is similar to the required leakage testing of isolation check valves, which do not have position indication in the control room, between the primary coolant system and the low pressure injec~ tion system piping in pressurized water reactors in the Event V Orders issued by the NRC in 1981. It is also consistent with the requirements currently being developed by the Office of Nuclear Reactor Regulation in the review of the Inservice Test Programs in accordance with 10 CFR 50.55 a(g)(4).

(3) Reduce human errors in maintenance and surveillance testing activities.

This would favorably impact about 50% of the testable isolation check valve failures and 100% of the motor-operated injection valve failures. The use of a two-person team in conducting maintenance and surveillance of the isolation

barriers between the RCS and emergency core cooling systems should be consid-ered. This short term action, when supplemented by an eventual long term improvement and/or standardization of maintenance and surveillance procedures and upgrading in training and qualification of personnel, would provide a diverse and redundant means to guard against errors of commission and omission observed in the operating events. This approach would also conform to the guidelines on independent verification stated in Item I.C.6 of NUREG-0737,

" Clarification of TMI Action Plan Requirements."

(4) Study reducing the frecuency of surveillance testing of the isolation barriers of the emergency core cooling systems during power operation.

This option involves complex and interrelated issues regarding system isolation and injection capabilities of the safety systems. It would also require

, changes in the current plant technical specifications. On one hand, reducing the frequency of surveillance testing at power would reduce, in almost direct proportion as demonstrated by operational data, the probability of inadvertent opening of normally closed motor-operated injection valves on safety systems.

On the other hand, a reduction in the frequency of surveillance testing at power, if not compensated by improved maintenance procedures and practices, would reduce the reliability of the associated safety systems during accidents.

These two competitive aspects should be promptly evaluated to establish a well-founded testing frequency. The goal of this recommendation is consistent with those developed by an interoffice, interdisciplinary, NRC Task Group on Technical Specifications, documented in NUREG-1024, " Technical Specifications--

Enchancing the Safety Impact," for providing better assurance that surveillance testing.does not adversely impact safety. This recommendation is also consis-tent with the long term Technical Specification Improvement Program currently being conducted by the Office of Nuclear Reactor Regulation.

W e

- -4_ j

1. INTRODUCTION In May 1984, AEOD issued a report (Ref. 1) evaluating the failure (stuck open) of a testable check valve on a low pressure coolant injection (LPCI) line of the residual heat removal (RHR) system which occurred at Hatch-2 on October 28, 1983. The safety significance of the event was tied to the increased likelf-hood of overpressurizing the low-pressure RHR system from inadvertent opening of a normally closed motor-operated injection valve, which in turn led to an increase in the likelihood of an interfacing LOCA. Such an accident (which is predicated on a rupture failure of the low-pressure system piping when it is overpressurized) would involve a sudden discharge of high-pressure, high-temperature reactor coolant outside the primary containment that would also likely disable the low-pressure RHR system.

Less than three months after AE00's report on the Hatch event was released, a similar but more serious event occurred at Browns Ferry-1 (Ref. 2). On August 14, 1984, during power operation at Browns Ferry-1, a held open testable check valve coincident with an inadvertently opened injection valve led to an actual overpressurization of the low-pressure core spray system. The causes for failure of the testable check valve were very similar to those involved at Hatch-2. Prompted by the similarity and seriousness of the Browns Ferry event, AE0D initiated an expedited generic review of events involving actual and potential overpressurizations of BWR emergency core cooling systems. This report provides additional operational data uncovered by this review together with the evaluation results regarding event frequency, root causes and safety significance of these events. Finally, several AE00 recommendations for corrective actions are provided.

I

2.

OPERATIONAL DATA REVIEW After the Bro,<ns Ferry event on August operating experience dating back to 1975 involving actual and poten overpressurizations of e.mergency core isolation cooling system in BWRs. core cooling systems as well as the reacto BWR/3 to BWR/5 product lines. The operating BWRs reviewed are in the This search identified a total of eight operating events, including the events at Browns Ferry-1 and Hatch-2.

involvedline.

injection the failure of a testable isolation check valveAll on a safety sy schematic of a The events typical testablewhich were check valvefound areintabulated is given Figure 1. A in Table 1.

I

' Among the eight events, five involved an additional independent failu second and final isolation barrier, the inadvertent opening of a normally I

closed motor-operated injection valve upstream of the testable isolati valve.

4 leading to the overpressurization of an emergency ,

A fifth cor event occurred while the plant was in cold shutdown, resulting not in an .

2 overpressurization of the safety system involved, but a rapid decrease of The operating events identified by the search are paragrapns. .

f Vermont Yankee (LER 75-24)

On December 12, 1975, surveillance with testing was the conducted being plant at 99".

onpower, Loop"A"monthly operability V-10-25A LPCI injection valve to an open(see Fig. 2).

signal from its remote control switch. Initially, injection valve V-10 To determine if the motor-operated valve failure was caused by excessive differential pressure across the valve disk or a specific mechanical or electrical malfunction personnel first manually cracked open V-10-25A. p fully cycled fully open and closed. Then the valve was succe,sslant personnel testable isolation check valve V-10-46A downstream of t valve (V-10-27A was,not seating properly, and the supposedly closed m upstream of the injection valve was partially open. With a par-tially ope)n flow path between the RCS and RHR sy se, into the low RCS water at operating pressure and temperature-flowed designressure High system piping, pressure in pressurizing the line itcaused in excess ofa its mixture pressure. of steam from each of the three RHR scharged sheet-to-shell flange area. system relief valves and the RHR heat exchanger tube began leaking as a result of the elevated pressure conditionsThe gaske.

not reported at the time of the event in 1975.The erlyexact was cause part of the surveillance test sequence, but - -

The as had faile partial opening of the motor-operated valve also was not known by plant .

The the tirreexact causes for the faulty position indication of the event. e at also Following successful pre.ssure and operability testing i of the subsystems declared operable, involved in the overpressurization event, the subsyst

>isl. i a ' t !I t ,',  ? 1 +fi I.$f-! i} !! . t?

n me _

r _

f t s a t n z S o i 0Cdi r 0R es u s s 0 finse s s s e e o o 5 oar e o e s Y Y N N rp

- e t sop Y N Y r un u p borS r e e ,l l t eo l

v oaah o O NCWtP n

ig n

ig s n n g r si si n o t

s c rt rt e i r e i

g os os v t r T o re re s rT rT l EI L E E a e e Cl c c V s T l P a - - y -

u eHn - - a li eg -

li eg n a yI n o l g no no o C l C n gi en nL nL hP ont Ri o o it tL sic t sI c n rrn sS e Rs rC rC j

of euu He eP eP Mo PdF RT PH I

n PL d

e s t t o u u l be be C t t l a t l a t t y s ai n ai n n l u nr e nr e e

_ l t op t op t t

_ a a iog rg iog rg rg m t r S t rn n pi en d d t rn en d en o epn vi e e npi vi e vi d n s s epn dn s dn N t ae ae o o tnnp ae ae o ae nnp np l l np l np IIO I O C C IIO IO C IO s

• t n n e o n n v

E e i

t o o g

v c s s s n

l a

u r n r r V

r t d g

o o o o i t t n e r r r 1 t a k b s nern n r e r r e r c e aii e i s E g E E l e e s O ccAp ds ar r r b p h u t ii Oe na p e k o eo eo rf n n c nt a O C a r bfi ;i iBy n ia ct na ct na T

f n C

n a uu rL B a Lr ar ar P L sdo n o o w nat s l

ad e dp e ne ep ne ep y

i o e dI oas ee t eO tO tO r

t n s e l ra rne n t n n a k o ideep een i sr ir ir a l n o rnrpy h pi a ui m o U L DaPOB TOL M ai ai m s RA MA MA u I S

e l

b s a u n n n n n n n n t t e e e e e e e e s a p p p p p p p p e t O O O O O T S O O O d R R me ev H

R H R

H R R tl / / /

so yv I I S S I I I S C C C C C C C C S n P P P P P P P P I L H H H L H L L t

nr ee 9 7 0 8 0 cw ro 9 9 2 4 8

9 0

9 0

0 eP 1 P

t 5

/

7 1

/

2 8

/

3 8

3 8

3 8

3 8

4 8

/ / / / /

ne 2 1 5 7 4 9 8 4 et 1 2 0 1 1 2 2 1 va / / / / / / / /

ED 2 1 0 6 9 9 0 8 1 0 1 0 0 0 1 0

. e L i L 1 e 3 l 3 -

k n

0 O 0 y

/ / / r t a 5 6 5 2 r2 n Y4 4 11 16 10 8 l e3 a 2 0 - 1 - 0 1 4 I F0 l t - - e- e- e- m- 2- -

P n5 r7 l 2 l 3 l3 i 3 3 s4 o7 e7 l8 l 8 l8 r8 h8 n8 m p a a a g c w rR oR SR SR SR l R tR oR e[ oL af aE aL iE aE rE VL CL LL LL LL PL HL BL I

. . _ . . . . ~

7-r ,

Disc Position Indicator Actuator Travel Indicator j

'n i

( _ _ _ -- ,

I /

/

I * *A /

Hinge Pin /

j l

Actuator Shaft Actuator

-G i

/57A l[ 1 e, -

F/

s.

je T~

Flow i g-m ci.

7 .

j-)

/ '

Dt Stellite Disc 6

Drains integral Stellite Seat Solenoid Valve Figure 1 A Typical Testable Check Valve I

l

i l I Testable MOV MOV Check Valve V-10-27A V-10 25A V-10-46 A LO m A QJ t m Reactor 7' 8 Vessel l" dE Relief

% Valve Recirc Pump 3 r Containment Boundary To DRW 24" Relief Valve N To DRW MOV RHR j

MOV V-10-65A V 10-13C Pump 1C 3..

LO M 20" e Relief Valve To From p DRW +Suporession RHR MOV LO LO Pump 1A 1" V-10-13A LO N M M 20" RHR Heat P gg

'" Exchanger P

.ra-E 141 A j L j I

Cross Tie From Loop B Water Supply Figure 2 Simplified Flow Diagram for Division A of LPCl/RHR at Vermont Yankee l j

Cooper Station (LER 77-04)

On January 21, 1977, with the plant operating at 97% power, plant personnel were in the process of performing high pressure coolant injection (HPCI) system turbine trip and initiation logic surveillance testing (see Fig. 3). When the motor-operated injection valve M0-19 was opened as required by the surveillance test, feedwater flowed backwards in the injection line, pressurizing the HPCI system close to operating pressure. It was not reported whether the low-pressure suction piping of the HPCI system was pressurized in excess of its design pressure (150 psi) during the event. However, from a review of the system configuration it can be concluded that the low-pressure piping was likely overpressurized. There is a small 1-inch relief valve (about 20 gpm capacity) installed on the 16-inch suction piping. Its 20 gpm capacity, specified in accordance with the ASME code (Ref. 3) to relieve pressure resulting from thermal imbalances or pump flow variations, is not sufficient to hold system pressure below design for the low-pressure system piping in the event of a significant feedwater backflow. Due to the small relief valve capac-ity, it is likely that, when both the injection valve (M0-19) and the check valve (AO-18) were open, the Cooper HPCI pump suction piping was overpressurized.

This conclusion is also supported by other similar operating events involving HPCI overpressurization (e.g., the Pilgrim event discussed in this report and f the HPCI gland seal condenser leak at Browns Ferry-2 on November 29,1974).

The licensee determined that the HPCI testable check valve (AO-18), downstream of the injection valve, had been stuck open during the test allowing feedwater to backflow into the system when the injection valve was cycled open. The testable isolation check valve was disassembled following shutdown of the reactor about two weeks later and, was found to be blocked open by a 14-1/2-inch long sample probe which had wedged under the edge of the valve disk. This prevented the check valve from fully closing. It was determined that the broken probe had come from a sample point on a 24-inch feedwater line upstream of the HPCI injection line junction. The length of time that the check valve had been stuck open was not determined.

LaSalle-1 (LER 82-115)

On October 5,1982, with the plant operating at 20% power, quarterly surveil-lance testing on the high pressure core spray system (HPCS) was being conducted.

The testable isolation check valve IE22-F005 and its associated bypass valve IE22-F354 failed to indicate completely closed after they were opened for the test (see Fig. 4). Both the testable isolation check valve and its bypass valve are situated on the HPCS injection line inside primary containment. The HPCS system was declared inoperable. The motor-operated HPCS injection valve was closed and deactivated.

During the surveillance test, the check valve bypass valve IE22-F354 was first opened to equalize the pressure on both sides of the testable check valve disk.

The testable check valve was then tested open by operating a remote handswitch.

This handswitch energized the actuator solenoid valve to allow instrument air to be supplied to one side of the piston cylinder of the valve's air operator, causing the piston cylinder to move a rack and gear assembly against spring tension. The rack and gear assembly movement rotated the actuator rod which lifted the valve disk off its seat. When the handswitch was returned to its

4 Containment Boundary Feedwater if a L- I Testable MO-20 Check Valve -

AO-18 Reactor

& Vessel

w ^

o Wt .

LO j

Motor Operated Injection Valve M

N n

'8 3 4..

s l

O HPCI 10" Steam Line

HPCI Pumps - Fro m 1 r Suppression Pool

/ LO HPCI Turbine

~

Relief 1~

Valve (, l I 16 4 MO-58 A L v

To Reactor 7 in Bldg Floor -

Drain '

- From Fro m on- CST CST 1A 1B LO LO MO 17 4

Figure 3 Simplified Flow Diagram for the High Pressure Coolant injection S i ystem at Cooper t 1

l l

I Containment Boundary l l Testable Check Valve 1E22-F005 . Motor Operated Reactor Injection Valve Vessel + 1E22 F004 1E22 F024 1E22.F038

, 12" r ,

p2 12" 16" i LO J L y, . .

16" wa High Pressure Core Spray Pump j 1E22 F354 Relief Valve 3 k L 3..

24"

. . _ . . MOV 1E22-F015 Suppression Pool 9

'a u m w w w a m m o w s o w /// w ///h 1E22.F002 MOV 1E22.F001 From Condensate Storage Tank Figure 4 Simplified Flow Diagram for the High Pressure Core Spray System at LaSalle-1

closed position, to the piston cylinder.the solenoid valve was deenergized, cutting off air return the rack and gearThis shouldto assembly have allowedposition.

its normal the spring (tension) to should have rotated the actuator rod back to its original positionThis, in the valve However, thedisk disk to did reclose by itsreseat.

not completely own weight and differential sure.

pres , allow The failure of testable check valve IE22-F005 to reclose the licensee.

lubricant on the actuator piston cit was determined that the failure was cau dried actuator spring assembly, and (3) ylinder, (2) insufficient preload on the

' valve 1E22-F354 the stuck open testable check valve bypass Together, these problems prevented the piston cylinder of th check valve air operator from returning to its fully retracted position .

? LaSalle-1 (LER 83-066) i On June 17, 1983, j

t testing of the HPCS system in progress, HPCS ance testable iso eck valve

'3 IE22-F005 after and being tested its associated open. bypass valve IE22-F354e closed failed to indica C

n isolated by deactivating the normally closed motor-operate valve 1E22-F004 ection M

5- The licensee determined that the failure of the testable is to reclose was caused by:

w j@

i prevented a pressure differential from developing across t of the 5

testable With check respect to thevalve; and (2) possible thermal binding of the ch latter cause eck valve disk.

yw partially open after being cycled. Darling checkovalve and byp remain 3 was traced to insufficient return spring tension in the While bypass valveT j:~f y closed without any assistance as reactor pressu j Following an analysis of the event, the licensee submitted e. a req to conduct cold shutdown. surveillance testing of testable check valve 1E22 F005 uest to the NPC only during d LaSalle-1 (LER 83-105) e On September 14, 1983, the plant staff was in the process of performi ng a routine RHR system relay logic surveillance test while shutdown.

n cold the plant w drywell spray valves 1E12-F0168 and "B"1E12-F017B RHR loop was open lined up with both inadvertently open, the "C" loop the LPCI openvalve IE12-F0278 open, the t the manual valve 1E12-F0928 on the LPCI loop "B" RHR loop infection valve IE12-F042C open (see Fig ,and "B" . 5). Unaware that testable isolation check valve IE12-F0418 w stuck as also open, the plant loop injection staff opened (as required by the test precheck) the "B" R valve IE12-F0428.

decrease in reactor vessel water level was observed.When the injection valve w

• quickly isolation at from

+12.5+50 inches to 0 inches, causing a Group VI ent inches. primary contain be operable while the plant is in shutdown or refueling modeAutom The operator quickly secured the valve line-up, stopping the water .

level decrease Mpst of

. mom ~. -

~.

Containment Soundary F0178 F016B Drywere Spray  ;  ; '8" F041C F042C

& 2a ,4

---

Reactor F0418 /J F0428 Vessel F092B l

LO l

{ F050B

> F053B l

- },.' x ,,

1 1 From '

i

- Recirc Pump ^

l F0488

/ l F0278 Relief Valve 3 Wetwell Spray < -y' d g F0248 k l n  ;

Test Return N -

r, au ' ] F0038 "E -

~ _ _.

~

~ " "

--- -Sucoression Pool- . . . -

p"s F0268 Cross Tie to Loop A 9 F054B ii tT i$

/////////////////////////:V///////////////jo, Pump Discharge rw 2 ,

F004C p s.

O s

y n y Relief j.? RHR Pump C L' Valve ' v3g F0478

.i.: F0048 24" h Y L

O Cross Tie from RHR RHR Loop A Water Supply w 2 Pump B r,

From RCS-_ wG2 Q RHR Heat LT2 Exchanger 18 Recirc rm v, Figure 5 Simplified Flow Diagram for Loops B and C of LPCl/RHR at LaSalle-1

)

l l

the water lost from the reactor vessel went to the supprE% ion pool, while some went to the drywell.

The cause of the draindown was determined to be the stuck open testable isola-tion check valve IE12-F0418 and the inadvertently open manual isolation valve 1E12-F0928 on the loop "B" LPCI injection line. Thus, when the injection valve was opened during the test, an open flow path between the reactor ressel and the suppression pool and drywell was established which allowed bNkflow of reactor water into the drywell and wetwell. The isolation cNck valve also provides the first isolation barrier between the high-prmure RCS and the low-pressure RHR system when the plant is operatine a. power.

The manual valve IE12-F0928 should have been closed but was inadvertently left open due to a temporary procedure change implemented prior to the logic surveillance test. The testable isolation check valve was stuck open due to two causes. First, it was held open by its attached air operator as a result of a misalignment of the interfacing gears between the check valve and the air operator. The misalignment resulted from maintenance errors on the air opera-tor that were made earlier in the outage. During the maintenance, a score mark on the spline shaft of the check valve was used instead of a " timing" mark for aligning the gears. The gear misalignment resulted in the air operator i holding the check valve disk in the open position and inhibiting disk movement in the closed direction during the draindown. Additionally, the packing gland on the check valve shaft was found to be too tight, inhibiting free movement of the valve disk. Finally, the valve position indications were reversed following the maintenance, which led the operator to believe that the check valve was closed when in fact it was open.

Pilgrim (LER 83-48)

On September 29, 1983, during HPCI system logic testing while the plant was at 98% power, the low-pressure suction piping of the HPCI system was overpres-surized to near operating reactor pressure. The' event occurred when two HPCI pump discharge motor-operated valves, M0 2301-8 and M0 2301-9, were simulta-neously opened as a result of personnel errors (see Fig. 6). The errors occurred because more than one surveillance test was being conducted at the same time, and test prerequisites and initial test conditions were not ensured for all steps in the test procedures. Since the testable isolation check valve (A0 2301-7) downstream of the discharge valves was partially stuck open at the time, the overpressurization occurred when the pump discharge valves were opened. The overpressurization of the suction piping (which is designed for 150 psi) ruptured the gland seal condenser gasket on the HPCI turbine. This in turn caused a mixture of water and steam to spray from the condenser onto a limit switch. The water spray resulted in a 250 V de battery ground and a large amount of water on the HPCI room floor. Smoke detector alarms also were set off by vapor from the heated paint on the icw-pressure piping. An HPCI high suction pressure alarm cnd lube oil high temperature alarm were also actuated during the event.

The exact cause for the testable check valve being partially open was not determined. There was some evidence that a rusted linkage between the valve stem and the attached air operator had contributed to the valve being partially open. In the short term, the licensee repaired the linkage and returned the valve to its correct position. The licensee decided to replace the check valve

Containment Boundary HPCI Steam Supply l_ $

7 Reactor Testable MO Vessel

+ Check Valve 2301 9 HPCI Turbine i

- i r ,'

L

\

r I. AO MO p

},:

2301 7 2301-8 H PE.

Pump %

j /

14" H

4 16" i

LO h V 18 Relief Valve A - .

M" Feedwater Line B es 3.. =g e

Ei t t

3:! U u '

$2 To CRW

~

C3 M t1 N LO 2301 22 MO MO l 2301 36 N 2301 35 3 From Suppression Pool >j  %' yj 16..

4

' #* MO 2301 6 From Condensate - -

Storage Tank -

t_ 16" i

Figure 6 Simplified Flow Diagram for the High Pressure Coolant injection System l

l l

16 -

with a new design as a lcrg term solution. To prevent a recurrence of the personnel at the plant.errors, instructions for verbal communications were to be implemented Hatch-2 (LER 83-112)

On October 28, 1983, with the plant in cold shutdown, the testable isolation check valve F0508 on the 24-inch "B" LPCI injection line of the RHR system was found open and could not be closed (see Fig. 7). It was determined that the valve was being held open by its attached air operator. The licensee's investigation revealed that the air supply lines to the air operator had been

~

connected June backwards during a prior maintenance on the valve performed on 7, 1983.

The resultant pneumatic pressure reversal caused the air opera-tor to hold the check tested. The mispositioned valve open even though the check valve was not being check valve was not detected for a four-month period, during which the plant operated at close to full power. The failure to detect the mispositioned valve was attributed to a second error involving the

- reversal.of June 7, 1983 the electrical leads for the valve position indicator following the maintenance.

the belief that the valve was actually closed.This had apparently been done by plan Inadequate post-maintenance j testing also contributed to the error not being detected.

During the four-month period when the testable check valve was held open, the normally closed motor-operated LPCI injection valve, F0158, upstream of the check valve, remained closed. Asd a result, inadvertent overpressurization of the LPCI/RHR system did not occur ouring this period.

Immediate corrective actions taken by the licensee following discovery of the maintenance errors were to correctly reconnect the air supply lines to the check valve indicator.

the position air operator, and to correctly reconnect the electrical leads to and restored correct valve position indications.This placed the check valve in its c The licensee also counseled plant maintenance personnel on the importance of performing equipment maintenance correctly. For the long term, the licensee was to consider adopting an alternative testing method for the check valve which would not require the use of the air operator.

Browns Ferry-1 (LER 84-032)

On August 14, 1984, while at 100% power and during the performance of a six-month surveillance test of the core spray system logic the normally closed motor-operated inadvertently opened. injection valve (FCV 75-25) on core spra,y system I was When the valve opened, reactor coolant at operating pressure and temperature backflowed into the low-pressure core spray system, pressurizing the system piping close to full reactor pressure. The backflow also heated portions of the system piping to about 400*F.

piping was damaged by heat which also actuated a smoke detector. Paint on sections of Steam from the relief valve on the core spray system, which opened to relieve the over-pressurization, discharged into an open drain line. Steam escaping from the i drain line was spotted by a roving fire patrol who initiated a fire alarm. A I mixture system I.of hot water and steam sprayed from the seals of pump "A" of core spray

- Thirteen workers were contaminated by the sprayed water / steam 1

mixture while responding to the fire alarm. The overpressurization, which lasted about 13 minutes, was terninated when plant personnel reclosed the

17 -

Containment l Boundary Retief Y Valve JL

= To Suppression Reactor 1" Pool Via RHR Vessel MOV Testable Motor-Operated Test Line MOV Check Valve injection Valve AO I yov

=

dL F0508 F0158 Recirc i 24" th2 MOV i

77 F0178 Pump g ..

F1228 i MOV MOV FN88 F0038 MOV FN78 From From Suppression Suppression Pool poot t

AO AO F0650 , F0658 g MOV MOV

.2 F004D F0048 2 r%

r, Cross Tie pg RHR Heat from Div-  ? Exchanger A Supply 8001B

[

r, F034D pgg t

F031D F0318 t r1 e m RHR RHR Pump D Pump B Figure i Simplified Flow Diagra:n for Division 8 of LPCl/RHR at Hatch 2

injection valve. A simplified flow diagram of the plant's core spray system I at the plant is given in Figure 8.

An investigation by the licensee following the event determined that the nor-mally closed testable isolation check valve (FCV 75-26), downstream of the

- injection valve, had also been open during the event. With the check valve I open, a flow path between the high-pressure RCS and the low-pressure core spray l system piping was created when the injection valve was inadvertently opened.

The cause for the open testable check valve was traced to a pneumatic pressure reversal in the air actuator. The reversal was caused by an earlier mainten-

-- ance error in installing a plunger with reversed air ports in the air actuator i pilot solenoid valve. A review of plant maintenance records indicated that the t valve likely had been held open since December 1983. The valve misposition j was not detected for the ensuing eight-month period because of a second error

- committed during the same maintenance. The valve position indications were altered following the maintenance such that the valve misposition was not evident.

ej A review was also conducted to determine the cause for the inadvertent opening L of the injection valve during the surveillance test. The test procedures

specified that the valve motor operator circuit breaker be opened prior to the test so that the valve would have no motive power and would remain closed 2 during the logic test. It was determined, however, that the licensed operator assigned to perform this step had failed to open the breaker. He had mistaken

,i~

'~

a " power on" light to mean that the breaker was open. Thus, when the test c e, signal was applied during the logic test, the injection valve opened.

=

7

+

• 12-h i

h a

{

__ _ _ . _ . _. _ _ . _ . _ . . ~ . _ _ _ . - _ _ _ _ __

19 -

l Containment Boundary L  :

Relief Valve Reamr Vessel g Testable Motor Operated J Check Valve injection Valve 10" FCV 75 26 FCV 75 25 FCV 75 23 1" To CRW 12" , 34-LO n HCV 75-27 L

HCV HCV X7518 75 10 75-537A l75 537C Core Spray Core Spray Pump C Pump A k

FCV FCV 75 11 10" 75-2 10" From HCV 75-1 14..

Suppression Pool XI.O  %

I PHCV HCVl f J L 7512 ,

75 3 J L From Condensate Storage 14" N' 10" Tank

Figure 8 Simplified Flow Diagram for Core Spray System I at Browns Ferry 1 I

.- .-. - = ..

3 l j 3. ANALYSIS OF OPERATIONAL. DATA i 3.1 Testable Isolation Check Valve Failures The failures of the testable isolation check valves in the operating events

,j discussed in Section 2 can be grouped into three general cause categories as shown below:

j Cause Description Number of Events

A. Causes related to problems associated with

the attached air operator' l

] o Maintenance errors involving pneumatic 2 j ,

pressure reversal l o Maintenance errors involving an incorrret 1 l timing mark / gear misalignment o Rusted stem-to-actuator linkage 1 o Insufficient spring preload and dried 1 l lubricant

! B. Causes related to problems associated with i the check valve o Loose part obstruction in valve disk / seat area 1

~ o Open bypass line and thermal binding 1 i of the valve disk 1

C. Unknown Causes 1 4

i

, From the above tabulation, it can be seen that the dominant cause of inadver- '

j tently open testable isolation check valves is related to the nonsafety-related

attached air operator. Five out of the eight events reviewed involved a j mechanical interference of the air operator which prevented the valve from fully closing. Additionally, the cause of each of these five failures could be attributed to an air operator maintenance problem involving either an error of comission (e.g., pneumatic pressure reversal, ti.ning mark misalignment) or an I

error of omission (e.g., rusted linkage, insufficient preload). The dominant source of (partially) open che:k valves could therefore be eliminated if the

! attached air operator were removed or disabled. To disable the air operator, l its motive power could be removed by either disconnecting the air supply to the j operator or by removing electrical power to the operator solenoid air pilot

valve. However, either or even both of these approaches (which disable but do not remove the air operator) would not have eliminated all of the air-operator

related occurrences discussed in Section 2. The events involving mechanical j interference (e.g., rusted stem-to-actuator linkage of dried lubricant) would

! still have occurred. Therefore, disablin j

prevented three of the eight (about 40%)open g the air operator check would have valve events. ,

l i

1

Only two out of the eight open check valve occurrences clearly involved pro-blems associa'ed with the valve itself. In contrast to the actuator-related occurrences, only one could be even partially attributable to a maintenance This event involved insufficient return spring problem on a valve or actuator.

tension in an open bypass valve (a maintenance problem) in conjunction with thermal binding of the check valve intervals (an operations / design related pro-blem).

One of the two remaining events involved a loose part obstructing full closure of the check valve disk while the other was related to unknown causes.

From this review, it would appear that improved controls over testable check T valve maintenance activities, together with improved post-maintenance testing

- and/or leakage test'ing, could reduce the instances of open orHowever,partially open not all check valves used to isolate emergency core cooling systems.

F of the known or potential valve failure mechanisms would be eliminated if such a improvements were implemented.

8 En It should also be pointed out that the diversity of the causes involved in these failures would imply differences in the reclosure capability of an open check valve if a large negative differential pressure were to develop across h the disk (which might occur in the event of a low-pressure piping rupture Q

b upstream of the valve). At one end of the spectrum would be the event at t=j Cooper in which a broken sample probe was physically preventing valve closure.

4% In this case, it is likely that the valve would remain stuck open even in the M presence of a large differential pressure. The event at LaSalle which involved mechanical interfeence resulting from improper reassembly of the actuator-g to-valve gear sys;em would also fall into this category. At the other end of a

• the spectrum would be the event at Pilgrim in which a rusted linkage between the attached air operator and the valve stem was inhibiting full valve closure.

i ' In this case, the valve would be expected to reclose in the presence of a large

3 differential pressure. Even so, if a valve disk was held in a substantially a open position, it is not cartain that the valve disk would withstand the dynamic loadings associated with reclosure.

3,,

El In sumary, in approximately 250 reactor years of BWR operathn by the time of the most recent event, eight events involving an open testable isolation check g valve have occurred. Therefore, the likelihood of a testable isolation check u

-M valve being open is of the order of 8 events /250 reactor years = 3 x 10E-2/

? reactor year.*

3.2 Inadvertent Opening of an Injection Valve

=

The motor-operated injection valves in the BWR low-pressure safety systems dis-cussed in the operating experiences are designed to automatically open to permit delivery of coolant to the core during an accident once the appropriate system pumps are running and reactor pressure has been adequately reduced.

These injection valves are also interlocked to prevent a spurious valve opening from possibly causing an overpressurization of the low-pressure. piping of these systems if reactor pressure is high and the safety system pumps are not 10E-2 denotes 10~2 .

I

running. However, if an injection valve were to spuriously open or an injection valve disk were to lose its integrity while the reactor coolant system was at full pressure with the pumps not running, only the (closed) downstream isolation check valve, or an automatic closure of the upstream (outboard) motor-operated throttling injection valve (on the low-pressure safety systems) would prevent an overpressurization of the low-pressure system piping.

There are potentially four credible ways that a normally closed motor-operated injection valve can allow an inadvertent open flow path. They are:

(1) instantaneous rupture of the valve disk, (2) inadvertent opening due to a spurious signal caused by a hardware malfunction, (3) inadvertent opening due '

to a personnel error in conducting a surveillance test, and (4) intentional, but inappropriate opening by personnel action during a surveillance. A review of the operating events discussed in Section 2 indicates that the most likely reasons for a normally closed motor-operated injection valve to be opened when it should not be are those described by (3) and (4) above (i.e., incorrect personnel actions during a surveillance). In fact, each of the four overpres-surization events discussed previously (i.e., Vermont Yankee, Cooper, Pilgrim and Browns Ferry-1) occurred because an injection valve was incorrectly opened during surveillance testing while the downstream check valve was not fully closed.

The one other event that involved a significant consequence was the draindown event at LaSalle-1. It also involved the incorrect opening of an injection valve caused by operator actions. It may also be said that there could have been other unreported incidents involving incorrect opening of an injection valve caused by a personnel error during surveillance testing. This would appear to be the case since such a personnel error would not have been reportable unless it had led to a significant consequence. In other words, an event involving the incorrect opening of an injection valve during a surveillance test while the downstream check valve was fully closed would not have resulted in a signif-icant consequence and likely would not have been reported. Therefore, there probably have been more incorrect injection valve opening events than those found for this evaluation.

Finally, the two other injection valve inadvertent opening modes (instantaneous disk rupture and spurious opening due to hardware fault) would appear to be much less likely based on the absence of any reported operational events.

e 3.3 Overpressurization Frequency Overpressurization of an emergency core cooling system outside containment would only occur if both the testable isolation check valve and a normally closed motor-operated injection valve were open while the reactor coolant system was at high pressure.

Over a nine-year interval up to the end of 1984, five events involving the failures of both a testable isolation check valve (not being fully closed) and an injection valve (being inappropriately opened) have occurred at five dif-ferent plants (Vermont Yankee, Cooper, Pilgrim, LaSalle-1 and Browns Ferry-1).

Four of these events occurred while the reactor was at power. As a result, in i these four events, an unexpected overpressurization of an emergency core cooling system occurred.

Approximately 250 years of domestic BWR operation were accumulated by the time of the most recent event. This then would result in a probability of 4 events /

250 reactor years ev 2 x 10E-2/ reactor year for an overpressurization event in which reactor coolant (Vermont Yankee and Browns Ferry) or feedwater (Cooper and Pilgrim) at operating pressure and temperature flowed into an emergency core cooling system piping network outside containment. This probability appears to be several orders of magnitude higher than that which has been previously estimated by analysis (Refs. 4, 5, 6 and 7). Past analyses generally have forecasted a value in the range of 10E-5 to 10E-6 per reactor year. Thus, based on the observed operational events, the likelihood of an overpressurization is substantially higher than that which has been previously assessed.

D r

l_

I l ,!

!i 4 EVALUATION OF SAFETY SIGNIFICANCE 4.1 Precursors to an Interfacing LOCA To varying degrees, each of the eight operating events discussed previously

• could be considered a precursor to an interfacing LOCA between the RCS and an

' emergency core cooling system. All of the events involved, at the least, a partially open testable isolation check valve which significantly degraded the isolation barriers between the high-pressure RCS and the low-pressure piping of an emergency core cooling system. Additionally, more than half of the events

- (five out of eight) included a second failure involving the inadvertent opening of the normally closed upstream motor-operated injec' tion valve. For fcur of these five events, opening of the injection valve removed the final isolation

• barrier between the high-pressure RCS (or the high-pressure feedwater line) and an emergency core cooling system. The combined failures resulted in an unexpected overpressurization of the low-pressure piping of an emergency core e cooling system.

In the Vennant Yankee event, the overpressurization caused a steam / water 2

mixture to be discharged from the RHR system relief valves and leakage from the RHR heat exchanger tube sheet-to-shell flange area. For the event at Pilgrim, j feedwater backflowed through the HPCI injection line. The overpressurization 1 caused the HPCI gland seal condenser msket to rupture, allowing hot water to

! spray into the HPCI equipment rocm.  :: hough no equipment damage or release was reported for the very similar event at Cooper, it is likely that the event consequences were not dissimilar to the Pilgrim event. For the Browns Ferry event, high-temperature steam and water discharged from a core spray pump seal as a result of a core spray system overpressurization.

An actual pipe failure (rupture) has not occurred as a result of any of the four overpressurization events. However, as will be discussed in the following section, there is not a high degree of assurance that such a failure will not occur. Therefore, each of the overpressurization events may be viewed as a j significant step towards the occurrence of an interfacing LOCA. ~

4.2 Potential for Pressure Boundary Rupture The pressure boundaries associated with the piping, pumps and valves of the

%. various emergency core cooling systems discussed in this report are designed, fabricated, installed, and tested in accordance with NRC requirements, including the applicable ASME codes and ANSI standards. The NRC's require-ments, as embodied in these industry codes and standards, involve inherent conservatisms in the maximum allowable stresses from (primary) internal pres-i sure loads. Typically, for newer plants, the maximum allowable stress would be equivalent to the lesser of one-third the ultimate (rupture) stress or two-thirds the yield stress for ASME Class I components, or the lesser of one-quarter-the ultimate stress or two-thirds the yield stress for ASME Class 2 and 3 components.

Additionally, the maximum calculated primary stress for a typical piping system (based on the stated design pressure) would likely be significantly less than the maximum allowable stress permitted by the Code. Thus, there would normally be a significant factor (in the range of two to three) between the design pressure

' and the pressure at which rupture of a pipe or a large component might actually occur. For example, a TVA engineering evaluation of the affected core spray

system piping and its supports indicated that the overpressure transient did not adversely affect system integrity (damage short of actual failure), and that the piping system was acceptable for continued use. A similar observation can also be made regarding the Pilgrim event, when the HPCI suction piping (150 psig design) was likely pressurized to close to. operating reactor pressure, yet inspections after the event revealed no pipe damage.

A large overpressurization without piping failure cannot always be ensured, however, for the following reasons. First, the presence of undetected flaws in the piping, its tees, fittings or welds can make the difference between piping failure and nonfailure when a pipe is stressed beyond its design stress. A flaw could exist as a result of an undetected error in the design, fabrication or installation of the piping system. It could also be caused by operational transients the piping system might have experienced previously. An example would be pipe failures associated with waterhamer events. There have been numerous waterhamer events i., which the piping system was stressed by hydro-dynamic pressure loads beyond its design pressure without resulting in any pipe rupture. However, the waterhammer at Maine Yankee in January of 1983 actually resulted in a feedwater line rupture. The piping failure was determined to have occurred at a point in the piping where a pre-existing flaw was located.

Had the flaw not existed, it is likely that the pipe failure would not have occurred during the waterhamer, even though the piping was stressed beyond its design limits. Hence, overpressurization of a low-pressure piping system with a pre-existing flaw present might result in a sufficiently high local stress to cause a piping failure.

Secondly, components in the low-pressure systems such as pump seals, heat exchanger tubes, Oermocouple wells, gaskets and blind flanges might fail due to an overpressurization and lead to a large break area. In fact, the RHR heat exchanger tube sheet-to-shell flange gasket at Vermont Yankee and the HFCI turbine gland seal condenser gasket at Pilgrim failed as a result of overpres-surizations. E~ven though these gasket failures led to a relatively small loss of reactor coolant at Vermont Yankee and Pilgrim, there is no assurance that multiple failures of such low-pressure components leading to a larger break area would not occur. Thirdly, there is some small likelihood that a severe waterhamer could result from an overpressurization event. A waterhamer might occur if the discharge piping of the emergency core cooling systems were not entirely filled with water. Since the discharge piping of these systems are normally required by Technical Specifications to be filled with water, and there are elaborate procedures in place to vent and fill the discharge piping at specified intervals, the likelihood of a waterhammer is small. However, the high local stresses caused by a severe waterhamer have been known to cause pipe failures.

Based on the above considerations for piping system failure, a range of values of 10E-2 to 10E-3 is judgmentally assigned to the rupture probability of an emergency core cooling system when it is pressurized to twice its design pressure. This range of values is judged reasonable as it reflects (in decreasing order of importance) the uncertainties associated with undetected 1

flaws being present, the multiple failures of low-pressure components such as l

' gaskets Mr pump seals leading to a large break area, and the potential occur-rence of a severe waterha.rcer. A value as high as 0.1 has been considered t

l - 1

plausible for rupture prob 6flity of an emergency core cooling system when it is pressurized to about twice its design pressure (Ref. 8).

i The above range also reflects a general consensus that a pipe rupture is more likely when a system is pressurized in excess of twice its design pressure than when it is operating within its design pressure limits. Even when operating within the design envelope, there is a very small (but finite) probability for a pipe, pump casing or valve body to instantaneously rupture. As discussed later in this report, even if the low value 10E-3 is used for the system i rupture probability, the safety insignificance of the operating events would still be deemed high.

4.3 Probabilitf of an Interfacing LOCA [

In Section 3, the probability of overpressurizing an emergency core cooling j system by the RCS or the feedwater system was estimated from operating data to ,

, be of the order of 4 events /250 BWR reactor years, 2 X 10E-2/BWR reactor year.

This prcbability can be compared with the results of previous comprehensive risk studies for an interfacing LOCA between the RCS and an emergency core l

cooling system. Such a comparisen would require the ' exclusion

• of the HPCI f t

overpressurization events at Cooper and Pilgrim by the feedwater system. In '

these two events, the RCS was not directly involved in the overpressurization. l t

Even if the feedwater pumps had been tripped, it would not be expected to be involved due to the expected seating of the inboard feedwater check valve (see Figs. 3 and 6). Then the probability of overpressurizing an emergency core cooling system by the RCS is of the order of 2 events /250 BWR reactor years,  !

1 X 10E-2/BWR reactor year. l The failure probability of an emergency core cooling system pipe (or large }

pressure boundary component) when it is pressurized to about twice its dasign pressure may be assumed to be in the range 10E-2 to 10E-3, as previously Ie k

E Even though the Cooper and Pilgrim events were not included in the estimation of the interfacing LOCA probability, they are still considered precursors to such an interfacing LOCA. If the inboard feedwater check valve whose normal l

position is full open during plant power operation should be stuck during the overpressurization event, RCS coolant would be involved. Since this additional ,

failure (of the inboard feedwater check valve) reduces the likelihood of these HPCI overpressurization events leading to an interfacing LOCA, they are not included in the estimated preability. However, these events are important operating events because of the occurrence of multiple failures and the poten-tial adverse impact on other vital safety equipment.

B

=- =..--- -w z.x :. -

= --

.- . . . = -- - -_

, discussed. The probability of a BWR interfacing LOCA involving the RCS and an emergency core cooling system would be:

P LOCA

" E Press X P pagj

Where

P LOCA

= Probability of an interfacing LOCA between the RCS and an emergency core cooling system, P

Press

= Probability of pressurizing an emergency core cooling system to twice its design pressure, ,

! Pp ,9j = Probability of a large rupture of a system '

pressure boundary when pressurized to twice its design pressure.

From operating data, P

Press

= 1 X 10E-2/ reactor year, and from previous discussion, l Pp ,4) = 10E-2 to 10E-3, then P

LOCA

= 1 X 10E-4 to 1 X 10E-5/ reactor year.

This interfacing LOCA probabi'ity for a BWR is higher, by two to three orders

of magnitude, than that which had been assessed in previous comprehensive risk i studies (Refs. 4, 5, 6 and 7). These studies have estimated the probability of

! a BWR interfacing LOCA between the RCS and an emergency core cooling system to be approximately 10E-7 per reactor year.

4

4.4 Accident Scenarios 1

j If an emergency core cooling system pipe outside containment were to rupture i,

• • because of an open check valve and an open injection valve, break isolation would depend on tne break location and the, operability of isolation valves.

Specifically, successful isolation would depend on the reclosure capability of the testable isolation check valve in the presence of actuator or valve disk

! interference, the capability of the check valve disk to withstand the dynamic reclosure loadings, and the capability of the motor-operated isolation valves to close under adverse environmental conditions. Therefore, successful isola-tion of such a pipe break outside containmerit would involve many uncertainties.

If the break cannot be isolated, a number of accident scenarios are plausible.

They would involve many interrelated and complex issues, including the role and adequacy of reflooding the core and removing the decay heat with other safety i systems. the rate of depletion of the water inventory in the condensate storage tank or the suppression ment, flooding or steam)on pool, vitalthe extent of in.the equipment adverse environmental reactor building, and impact the (impinge-role of human intervention. An in-depth evaluation of these issues is beyond the scope of this study. In any case, regardless of the specific accident

28 -

scenario postulated, a blowdown of the RCS inventory through a large break into the reactor building during power operation would be a very serious accident, well beyond the current plant licensing bases. The reactor coolant lost would bypass the containment and also would likely disable one or more of the safety systems which could be used to mitigate the accident.

OP 4

O

5. GENERIC EVALUATIONS BY OTHER NRC 0FFICES AND INDUSTRY Prompted by some of the recent events, the generic issues associated with the degradation of high-pressure / low-pressure system isolation barriers, overpres-surization of emergency core cooling systems, and the related accident risks are currently being evaluated by the NRC and the nuclear industry. A brief summary of recently completed or currently ongoing activities in this area is given below.

o An engineering evaluation of the safety significance of the open testable isolation check valve event which occurred at Hatch-2 was issued by AEOD on May 31, 1984 (Ref. 1).

o The Office of Inspection and Enforcement issued an information notice for the events at Pilgrim, Hatch-2 and Browns Ferry-1 on September 28, 1984 (Ref. 2).

o The Office of Inspection and Enforcement is currently evaluating the safety issues related to the isolation of the RCS from low-pressure systems (Ref. 9).

o The Region I staff conducted, prior to reviewing the final AEOD case study report, a series of inspections at operating plants to better understand

' the existing design features and administrative controls that are in place to prevent overpressurizing the emergency core cooling systems.

o The Office of Nuclear Reactor Regulation / Division of Human Factors Safety will include the insights gained from the Hatch event in the generic maintenance evaluation program (Ref. 10).

o The Office of Nuclear Reactor Regulation has identified the issue as Generic Issue 105, " Interfacing System LOCA at BWRs," and assigned it a high priority status (Refs. 8 and 11). An action plan for the resolution of the generic issue is being developed.

o The Office of Nuclear Reactor Regulation is currently assessing various requirements for leakage testing of check valves on discharge lines of emergency core cooling systems as a part of an ongoing review of the pump and valve Inservice Test Programs in accordance with 10 CFR 50.55 a(g)(4),

o The industry's events analysis program has issued evaluation reports to the industry on every post-1980 event discussed in this case study report except the first two LaSalle events (LER 82-115 and 83-066/03L).

4

. 6. CONCLUSIONS The BWR operating events discussed in this study represent a trend with significant safety implications. Specifically, the events indicate that the probability for simultaneous failures of independent and diverse isolation barriers between the high-pressure RCS and the low-pressure piping of an emergency core cooling system of a BWR is significantly higher, by several orders of magnitu'?, than that which had been commonly believed. That is, the operating events indicate a probability of overpressurization of an emergency '

core cooling system of approximately 2 X 10E-2 per reactor year. This is three to four orders of magnitude higher than the 10E-5 to 10E-6 per reactor-year probability assessed by past comprehensive probabilistic safety studies.

Although none of the overpressurization events have led to a failure of low-pressure system piping, pumps or valves, there is not a high degree of assurance provided by the current design basis that such a failure would not occur. The absence of a pre-existing flaw in the overpressurized piping may have been the key factor which has prevented a pipe failure to date.

A large rupture of a low-pressure pipe outside primary containment of an emergency cooling system could result in plant conditions well outside the current design basis. Isolation of the break would depend on successful reclosure of either the isolation check valve or a motor-operated isolation valve. As evidenced by the operating events, full closure of the check valve may not be assured due to interference at the disk or from the attached air actuator. Closure of a motor-operated isolation valve also may not be assured because the harsh environment created by the break might disable the vital electrical equipment needed for valve closure. Clearly, successful mitigation of such a break outside containment would involve many uncertainties which sould be difficult to resolve.

The significantly higher-than-expected overpressurization probability, coupled with the uncertainties associated with pipe failure probability (e.g., flaw probability) and break isolation probability (e.g., valve interference, environmental effects), indicates that the reactor accident risks associated with an unisolated interfacing LOCA outside containment are significantly higher than previously thought. In view of the elevated risks, prompt consideration should be given to implementing relatively low cost, near term corrective actions. Several relatively low cost, but potentially effective corrective actiors proposed by AEOD are delineated in the next section.

e

. . . . . - . _ . . - . - . . - - . . . . . - - . . . ._ . .. . lf 1

a

7. RECOMMENDATIONS (1) Disable the nonsafety-related air operator associated with the testable isolation check valve in a way not to pose any mechanical interference

. with the operability of the check valve either in lif ting on demand or in providing isolation protection.

This may be achieved by either removing the air operator, removing the pilot solenoid valve or capping of one or more of its air lines, or disconnecting the power supply to the pilot solenoid valve. Such action would effectively eliminate the potential for an open isolation check valve caused by maintenance

~

error associated with the air operator. These errors were responsible for about 40% of the testable isolatien valve failures in the operating events.

This option wculd involve two additional elements:

o Adopt flow testing in accordance with ASME Section XI, IWV-3520 (Ref. 12).

This would be necessary to satisfy testing requirements of the isolation check valve when its attached air operator is disabled. Flow testing would be conducted during cold shutdown with a frequency at least as often as every refueling outage.

o Retain position indication of the isolation check valve.

- Position indication is a desirable feature which allows early detection

, of a mispositioned check valve, thereby enhancing the safety margins in i the prevention of an interfacing LOCA.

! The nonsafety-related air operator was first installed to allow surveillance testing of the isolation check valve to detect its failure to lift on demand.

However, such a failure mode has not been widely observed. Furthermore, flow l testing in accordance with ASME Section XI would detect such a failure. On the

, other hand, maintenance errors associated with the nonsafety-related air

operator have been shown from operating experience to cause about 40% of the I

isolation check valve failures in which the check valve remained undetected in

$ the open position for a period of time. Therefore, disabling the nonsafety-1 related air operator and adopting flow testing in accordance with ASME Section XI while retaining position indication of the check valve is judged to be an effective corrective action.

(2) Conduct leakage testing of the testable isolation check valve prior to plant startup aftEr each refueling outage or following maintenance, repair or replacement work on the valve, as an alternative to Recommendation 1.

This corrective action would detect the most serious degradation of testable isolation check valves yet observed from operating experience (i.e., being stuck open with reversed indications caused by maintenance errors associated with the air operator). For BWRs licensed after 1980, leakage testing requirements for check valves in the discharge lines of the emergency core cooling systems have been included in their plant Technical Specifications.

Therefore, this corrective action would apply only to l'WRs licensed prior to 1980. This proposed corrective action is consistent with the requirements currently being developed by the Office of Nuclear Reactor Regulation to be implemented in connection with the plant specific reviews of the first full (120-month) pump and valve inservice test programs in accordance with l 10 CFR 50.55 a(g)(4). This proposed corrective action is also similar to the leakage testing required by the Event V Orders issued by NRC in 1981 fo-

isolation check valves, which do not have control room position indication and which are located between the primary coolant system and the low pressure injection system piping in pressurized water reactors.

Although leakage testing could also be performed on the normally closed motor-operated injection valve, it would appear that such testing would be of limited safety benefit. Operating experience indicates that inadvertent opening of the valve due to human errors in surveillance testing rather than valve leakage has been the cause of overpressurizing emergency core cooling systems. Furthermore, there is continuous monitoring with a control room alarm on high pressure in the injection line upstream of the normally closed motor-operated injection valve to alert the operator of excessive RCS leakage past the valve.

(3) Reduce human errors in maintenance and surveillance test activities which have the potential to degrade the isolation valves between the RCS and low-pressure piping of the emergency core cooling systems.

Human errors during maintenance were responsible for about 50% of the reported testable isolation check valve failures. Human errors during surveillance tests also caused 100% of the reported motor-operated injection valve irtdver-tent openings. Effective corrective actions dealing with these errors would have a significant impact on preventing the recurrence of the overpressurization events.

Specifically, the use of a two-person team when conducting maintenance and surveillance tests of isolation barriers between the RCS and emergency core cooling systems should be considered. This short term action, when supplemented by an eventual long term improvement and/or standardization in maintenance and surveillance procedures and upgrading of training and qualification of personnel, would provide a diverse and redundant means of safeguarding against errors of omission or commission in conducting repairs or testing of such isolation barriers as observed in the operating events. This near term action also conforms to the guidelines on independent verification stated in Item I.C.6 of NUREG-0737, " Clarification of TMI Action Plan Requirements" (Ref. 13). Finally, a regulatory progran to reduce human errors is currently under development in the Division of Human Factors Safety, Office of Nuclear Reactor Regulation, as stated in the Maintenance and Surveillance Program Plan. However, AE0D believes that implementation of human performance

% mprovements i relating to the isolation barriers of emergency core cooling systems should not await the more protracted completion and implementation schedule of this program.

(4) Study reducing the frequency of surveillance testing of the isolation barriers of emergency core cooiing systems during power operation.

Reducing the frequency of surveillance testing of an emergency core cooling system at power would reduce, in almost direct proportion, the probability of inadvertent opening of a normally closed motor-operated injection valve. This is supported by the operational data discussed in Section 3.2. On the other hand, reducing surveillance testing frequency would reduce the system reliability for safety injection. This may be assessed both qualitatively and quantitatively. Qualitatively, the fundamental aim of surveillance testing is

~

to detect failures so that timely corrective actions can be taken for repair.

The lengthening of the interval of surveillance testing would increase the time I

- o

. interval in which failures would remain undetected. This would increase the likelihood that the system is not operable when required. Quantitatively, the adverse impact on system unavailability (probability thct an emergency core cooling system is inoperable) due to lengthening the surveillance interval is illustrated below.

Let q represent the unavailability of a component which is repairable and is periodically tested. Then according to a widely used constant failure rate model (Ref. 14), q can be expressed as:

q = CT + Ct, 2

= CT if t is less than 0.1, 7 T where C = component failure rate per hour, T = test interval in hours, t = average repair time per failure in hours.

This failure rate model indicates that the component unavailability, q, is often directly proportional to the testing interval T. For example, the unavailability of a component or a system with an annual surveillance testing interval is about 12 times higher than the same system with a monthly testing interval (if the repair time is of the order of days within the framework of the constant failure rate model).

Based on these discussions, it is recommended that a detailed and expedited evaluation be conducted, consistent with the current NRR Technical Specifica-tions Improvement Program, to assess the potential benefits versus penalties associated with reducing the frequency of surveillance testing of isolation barriers of emergency core cooling systems while at power.

This recommendation is consistent with those developed in NUREG-1024,

" Technical Specifications--Enhancing the Safety Impact," by an interoffice, interdisciplinary, NRC Task Group on Technical Specifications (Ref.15) to provide better assurance that surveillance tests do not adversely impact safety. This recommendation is also consistent with the long-term Technical Specification Improvement Program currently being conducted by the Office of Nuclear Reactor Regulation.

. 8. REFERENCES

1. " Stuck Open Isolation Check Valve on The Residual heat Removal System at Hatch Unit 2," AE00/E414, U.S. Nuclear Regulatory Commission, May 31, 1984

2. IE Information Notice 84-74, " Isolation of Reactor Coolant System from Low-Pressure Systems Outside Containment," U.S. Nuclear Regulatory Commission, September 28, 1984

3. " Rules for Construction of Nuclear Power Plant Components," ASME Boiler and Pressure Vessel Code,Section III, July 1, 1983. _

4 " Reactor Safety Study - An Assessment of Accident Risks in U.S. Commercial

- Nuclear Power Plants," NUPEG 75/014(WASH-1400), October 1975.

5. " Interim Reliability Evaluation Program: Analysis of the Browns Ferry, Unit 1, Nuclear Power Plant," NUREG/CR-2802, August 1982.

6. " Interim Reliability Evaluation Program: Analysis of the Millstone Point Unit 1, Nuclear Power Plant," NUREG/CR-3085, January 1983.

7. "Probabilistic Risk Assessment--Limerick Generating Station," U.S. Nuclear Regulatory Commission, Docket No. 50-352 and 50-353, 1983.

8. " Issue Summary Work Sheet: Generic Issue 105, Interfacing Systems LOCA at EWRs," Division of Safety Technology, Office of Nuclear Reactor Regulation, U.S. Nuclear Regulatory Commission, June 1985.

9. " Isolation of High-P. essure RCS from Low-Pressure Systems," memorandum from R. L. Baer, IE, to W. Minners, NRR, U.S. Nuclear Regulatory Commission, January 23, 1985.

10. "AEOD Engineering Evaluation E414," memorandum from H. L. Thompson, lr.,

NRR, to C. J. Heltemes, Jr., AE0D, U.S. Nuclear Regulatory Commissiun, '

July 11, 1984.

11. "Prioritization of Interfacing System LOCA at BWRs," memorandum from G. M. Holahan, NRR, to W. Minners, NRR, U.S. Nuclear Regulatory Commission, October 25, 1984.

12. " Rules for Inservice Inspection of Nuclear Power Plant Components," ASME Boiler and Pressure Vessel Code,Section XI, July 1,1977.

13. " Clarification of TMI Action Plan Requirements," NUREG-0737, November 1980.

14. " Fault Tree Handbook," NUREG-0492, January 1981.

15. " Technical Specifications - Enhancing the Safety Impact," NUREG-1024, November 1983.

. - . , .