ML20148L567

Forwards for Review & Comment,Copy of Preliminary Accident Sequence Precursor Analysis of Operational Event Which Occurred at Arkansas Nuclear One,Unit 1 on 960519

ML20148L567
Person / Time
Site:	Arkansas Nuclear
Issue date:	06/17/1997
From:	Kalman G NRC (Affiliation Not Assigned)
To:	Hutchinson C ENTERGY OPERATIONS, INC.
References
NUDOCS 9706190289
Download: ML20148L567 (19)

Text

'

, , # ueg ,

p UNITED STATES g j NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. SceeH001 o $  ;

\,,,,*

j June 17,1997 L

Mr. C. Randy Hutchinson [8' 3 O i Vice President, Operations ANO 1 l

Entergy Operations, Inc. l l 1448 S. R. 333 i

[ Russellville,.AR 72801

SUBJECT:

- REVIEW 0F PRELIMINARY ACCIDENT SEQUENCE FRECURSOR ANALYSIS OF ]

OPERATIONAL EVENT AT ARKANSAS NUCLEAR ONE, UNIT 1 l

Dear Mr. Hutchinson:

Enclosed for your review and comment is a copy of the preliminary Accident Sequence Precursor (ASP) analysis of an operational svent which occurred at Arkansas Nuclear One, Unit 1, on May 19,1996 (Enclosure 1), and was reported in Licensee Event Report (LER) No. 313/96-005. This analysis was prepared by our contractor at the Oak Ridge National Laboratory (0RNL). The results of this preliminary analysis indicate that this event may be a precursor for 1996. In assessing operational events, an' effort was made to make the ASP models as realistic as possible regarding the specific features and response l of a given plant to various accident sequence initiators. We realize that i licensees may have additional systems and emergency procedures, or other l features at their plants that might affect the analysis. Therefore, we are l providing you an opportunity to review and comment on the technical adequacy of the preliminary ASP analysis, including the depiction of plant equipment and equipment capabilities. - Upon receipt and evaluation of your comments, we will revise the conditional core damage probability calculatf ons where l necessary to consider the specific information you have provided. The object of the review process is tr provide as realistic an analysis of the significance of the event as possible.

In order for us to incorporate your comments, perform any required reanalysis, and prepare the final report of our analysis of this event in a timely manner, you are requested to complete your review and to provide any comments within .

30 days of receipt of this letter. We have streamlined the ASP Program with the objective of significantly improving the time after an event in which the I final precursor analysis of the event is made publicly available. As soon as our final analysis of the event has been completed, we will provide for your- --

information the final precursor analysis of the event and the resolution of '

your comments. In previous years, licensees have had to wait until

! publication of the Annual Precursor Report (in some cases, up to 23 months

! after an event) for the final precursor analysis of an event.and the resolution of their comments.

We have also enclosed several items to facilitate your review. Enclosure 2 l

contains specific guidance for performing the requested review, identifies the

( criteria which we will apply to determine whether any credit should be given j in the analysis for the use of licensee-identified additional equipment or 9706190289 970617 -i RE CENTER COPY

, PDR ADOCK 05000313 e l S PDR

l specific actions in recovering from the event, and describes the specific

information that you should provide to support such a claim. Enclosure 3 is a l copy of LER No. 313/96-005, which documented the event.

l Please contact me at 301-415-1308 if you have any questions regarding this request. This request is covered by the existing OMB clearance number (3150-0104) for NRC staff followup review of events documented in LERs. Your response to this request is voluntary and does not constitute a licensing requirement.

Sincerely, jfM George Kalm

• ~

enior Project Tsnager Project Directorate IV-1 Division of Reactor Projects III/IV i Office of Nuclear Reactor Regulation '

Docket No. 50-313

Enclosures:

1. ASP Analysis

2. Guidance for Lic. Review

3. LER No. 313/96-005 cc w/ enc 1s: See next page l

l l

t

K. .

l June 17, 1997 specific actions in recovering from the event, and describes the specific l

information that you should provide to support such a claim. Enclosure 3 is a copy of LER No. 313/96-005, which documented the event.

i Please contact me at 301-415-1308 if you have any questions regarding this request. This request is covered by the existing OMB clearance number (3150-0104) for NRC staff followup review of events documented in LERs. Your response to this request is voluntary and does not constitute a licensing requirement.

Sincerely, Orig signed by George Kalman, Senior Project Manager Project Directorate IV-1 Division of Reactor Projects III/IV Office of Nuclear Reactor Regulation Docket No. 50-313

Enclosures:

1. ASP Analysis

2. Guidance for Lic. Review

3. LER No. 313/96-005 cc w/encls: See next page DISTRIBUTION:

Docket File JRoe PUBLIC EAdensam (EGAl)

PD4-1 TGwynn, RIV CHawes ACRS GKalran 0GC WBeckner Document Name: AR196005.LTR OFC PM/PD4-1 LA/PD4-1 NAME GKgdn:sp CHawesUiB DATE (( k7 b/l'l/97 COPY YES/N0 YES/N0 0FFICIAL RECORD COPY 1300!*5

Mr. C. Randy Hutchinson Entergy Operations, Inc. Arkansas Nuclear One, Unit 1 cc:

Executive Vice President Vice President, Operations Support

& Chief Operating Officer Entergy Operations, Inc.

Entergy Operations, Inc. P. O. Box 31995 P. O. Box 31995 Jackson, MS 39286-1995 Jackson, MS 39286-199 Wise, Carter, Child & Caraway Director, Division of Radiation P. O. Box 651 Control and Emergency Management Jackson, MS 39205 Arkansas Department of Health 4815 Uest Markham Street, Slot 30 Little Rock, AR 72205-3867 Winston & Strawn 1400 L Street, N.W.

Washington, DC 20005-3502 Manager, Rockville Nuclear Licensing Framatone Technologies 1700 Rockvill.e Pike, Suite 525 Rockville, MD 20852 Senior Resident Inspector U.S. Nuclear Regulatory Commission P. O. Box 310 i London, AR 72847 1 1

Regional Administrator, Region IV l U.S. Nuclear Regulatory Commission  :

611 Ryan Plaza Drive, Suite 400 ,

Arlington, TX 76011-8064 <

County Judge of Pope County Pope County Courthouse Russellville, AR 72801 1

j . ,

i LER No. 313/96-005 l:

~ -- ~~ ~ ~ ~

.LER No. 313/96-005 d

1

) Event Description Reactor Trip and Subsequent Steam Generator Dryout i Date ofEvent May 19,1996 i

j Plant: Arkansas Nuclear One, Unit 1 i

- Summary ]

1

! Arkan=an Nuclear One, Unit 1 (ANO 1) was operstmg at 100% power when the plant exponenced an

j. automatic trip on high reactor coolant system (RCS) pressure that resulted from reduced main feedwater i (MFW) flow. Following the scram, six of eight Main Steam Safety Valves (MSSVs) lifted on the B Once

Through Steam Gen

rator (OTSG). One of these safety valves stuck open when pressure was reduced, and i' about 18 min aner the trip, the operators, in accordance with the plant emergency operstmg procedures, isolated the faulted B OTSG fmm its MFW source and its steam outlet. With the pressure and temperature decreasing on the secondary side of the OTSG, the OTSG was allowed to " dry out" because the RCS 4

temperature was maintamed relatively constant. About 5 h and 41 min aAer the trip, the stuck open safety

valve was gagged closed. After that, the B OTSG was refilled and the plant was returned to normal hot 4

i ahuidawn conditions. The estimated conditional core damage probability (CCDP) for this evemt is 1.1 x 10 ,

4 i Event Description 1 1

l According to the beensee event report (LER) (Ref.1), the plant was operating at 100% power when a degradation of the power supply to the turbine hydraulic control valve for MFW pump (MFWP) A caused j a rapid decrease in pump speed. A menad decrease in pump speed resulted in the pump going to mmimum j speed. The Integrated Control System (ICS) rd to the change in feedwater flow by increasing the e speed on MFWP B. Ihe lower beat-removal rate resulting from the reduced feedwater flow caused by

) MFWP A going to nummum speed in turn caused the pressure in the reactor to increase. The increasing pressure,in turn, csused the reactor to automatically trip on high pressure,just before the operators attempted to manually trip the reactor. At this time, MFWP A was at minimum speed, the feedomer cross over valve was closed (normal position) because no MFWP trip signal was present, and MFWP B was at maximum .

speed and in its "Diagnostz-Manual" mode and not responding to additionalICS signals. Followmg the trip, A OTSG had a low water level inventory and B OTSG a high water level inventory. However, because of

a back pressure wave indwad by closing the main turbine stop valves, the sensed water level in the B OTSG i indicated low, thereby actuating the Emergency Feedwater (EFW) system. MFWP B tripped on high I discharge pressure approximately 14 s aAer the reactor scram and MFWP A responded to ICS damand signals 5

when its control circuit fault cleared; however, because the demand signal was very high, MFWP A tripped l ce mekanical overspeed about 37 s aRer the reactor trip.

Secondary side steam pressure in the A OTSG remamed below the MSSV setpoints h-= nee of the reduced

inventory in the steam generator that resulted from the lowcr feedwater flow rate due to the MFWP A speed i

d ENCLOSURE 1 me 4- - - m- er--- -

4 l

i l

1 LER No. 313/96-005 4

~ ~

l decrease, conversely, the high inventory in the B OTSG (caused by MFWP B going to mammum speed) ~~

resulted in a high earnadary side steam pressure Consequently, six of the eight MSSVs on the B OTSG

opened to reduce pressure. These valves opened prior to the A and B MFW pump trips. The operators noted

approximately 64 s aAer the reactor trip that one of the MSSVs had failed to reclose following the pressure 3 rodarhan, thus causing an accelerated RCS cooldown rate. Operators maanally initiated high pressure

i

:jectien (HPI) about six min aAer the reactor trip in accordance with the plant's Emergency Operating i

Procedures (EOPs) when the water level in pressurtzer dropped below 30 in. Following that, also in 1 accordance with EOPs, the faulted OTSG (B) was isolated from its foodwater source and steam outlet about i 18 min aAer the trip. 'ne earnadary side of the OTSG contmuod to " blow down" through the open MSSV;

! however, the operators controlled the RCS cooldown rate by maintaining the RCS temperature above $20*F.

3 This blowdown is also referred to as "drymg out" the OTSG, and the lack of steam in the OTSG results in

{ the OTSG shell cooling dowa below the RCS % 4are (Ref. 2). This tube-to-shell temperature differential

! is governed by Plant Technical Specifications and is limited to 60'F for ANO 1. Durmg this transient, j 2 however, the shell-to-tube temperature differential increased to 74'F. The vendor, Framarnme Technology, 1 Inc., and the licensee both analyzed the 74'F tsunperature difference and concluded no excessive stresses

, were indacad on the OTSG or the reactor pressure vessel.

i With the steam header B isolated, the normal supply for sealmg steam for the gland seals on the main turbine l' was not available, and because the backup stearn supply (the auxiliary boiler) was also unavailable due to i control system problems, eenlms steam was eventually lost. As .a result , about 35 min aner the trip, the vacuum in the main enaA a- was lost. However, heat removal was still possible mAer the main condenser became unavailable by dischargmg steam though an atmospheric dump valve, which the operators did until

j. the auxiliary boiler was available. At this time, the vacuum in the main naaha- was reestablished and th'e main eaaA amar was again used for heat removal.

l- Plant maintenance crews successfully gagged closed the MSSV approxunately 5 h and 41 min aAer the l

reactor trip. Using EFW, operators then began refilling B OTSG and cleared the main steam line isolation i signal. The main steam isolation valve for B OTSG was opened about 2 h later and the main feedwater isolation valve about an hour aner that. At that time, normal foodwater was established to the OTSG and the j plant was restore

• to a normal hot shutdown condition.

i 1 l Additions Event-RelatedInformation 'l

! l j A short circuit in a digital speed sensing probe for MFWP A reduced voltage in the feedwater control system l 24 voit power supply. This, in turn, decreased control oil pressure for the MFWP turbine steam admission i valve, causing the valve to partially close. The closing of the steam admission valve decreased the speed of f

MFWP A, thereby decreasing foodwater flow. The reduced feedwater flow in turn caused the ICS to demand

maximum MFW; however, the MFW control system is.41y interpreted this as a failure (invalid signal) 1 ,

in the ICS, and transferred MFWP B control to the " Diagnostic Manual" mode. This effectively kept MF?!P B operating in response to the last valid sensed signal (high demand). When the reactor tripped, a . esent i e reduction signal to the feedwater control system. However, MFWP B did not respond since it was in ]

" Diagnostic Manual." h foodwater block valves closed in response to the rapid flow reduction signal. As

a result, the system pressure increased rapidly, and MFWP B tripped on overpressure.

I I

i 4 4

]

l LER No. 313/96 005 l The MFW system at ANO 1 consists of two variable-speed turbine driven pumps which take their common suction downstream of foodwater heaters E2A and E2B and discharge to the OTSGs. Either MFWP can

! discharge to both OTSGs by routmg thmugh the nonnally closed foodwater cross-over valve located before the feedwater flow control valves (Ref. 3,4). Typically, these pumps are used to supply foodwater to the OTSGs from about 3% power to full power The system also has an auxdiary motor driven pump This pump is used to supply feedwater to the OTSGs during plant startup and shutdown below 3% power. The auxiliary pump takes a suction from the MFWP suction header and discharges to the MFWP A discharge

! beader ui).m of the cross-over valve. The MFWPs are rated at 60% full-load capacity each and the auxiliary foodwater pinnp is rated at 5% full-load capacity.

The MSSV that did not reclose failed to resent because the lockmg device cotter pin was not engaged with the release nut. This allowed the reicue nat to travel down the spindle of the valve and block the manual lift

+

top lever from returmng to its normai position. This phenomenon has been h=nted in an NRC '

Informrtion Notice 84 33, as well as in other industry studies. Investigations indicate that either the failure of the cotter pin or the insuflicient slot engagement by the cotter pin allows the release nut to rotate down the spindle while the MSSV is lifted. The NRC Augmented Inspection Team (in Sections 3.2 and 6.3 of Ref. 2) sent to investigate this event found that of the 16 MSSVs on ANO 1:

one stuck-open, . . . h =naa of a stesn-nut wilmd to facilitate manual liAing of the valve, not being properly pinned in place so that dunng lift and/or blowdown of the valve the nut traveled down the stem and contacted ,

the liRing device. This contact precluded the valve from rescateg.;

. . 6 of the 15 other MSSVs in Unit 1 had less than desirable cotter pin engagement . . .;

2 of the remauung 9 had marginal (i.e., coner pin) engagement. (i.e., and the renammg 7 valves had acceptable cotter pin engagement);

. . . despite marginal engagement none of the nuts could be rotated by hand. l Hence, the above shows that preventing the release nut from rotating could prevent the valve from reclosing after it had opened The NRC's Augmented Inspection Team determined that the licensee's procedures for installing the cotter pins were inadequate Moreover, the Inwnear in their own inspection (Ref.1, Section D) found that-l Cotter pins for two other valves were found not engaged in the release nuts. These valves were deteramed to have been operable since the release nuts could not br rotated due to the cotter pin ends being engaged on the  !

l nuts. Six valves had the pins partially engaged at the : p end of the release nut slot. Seven valves were found with the cotter pins fully engaged. l I

Based on the above,it was determmed that this was a singular incident.  !

1 f*

3

- - _ - - - - - _ - _ _ _ - _ _ _ _ _ . - - _ _ _ _ . _ _ - . ~ . - - r , . ,

,e 4 l

LER No. 313/96 005 Modeling Assumptions This event was examned as the combination of two individual events. De first is the reactor trip and subseqamt loss of main feedwater tran==t (LOFW). The second is the potential for a steam generator tube rupture (SGTR) as a result of the " drying out" of B OTSG. The LOFW is a relatively simple and straightforward transient with few complicatmos other than operator burdens in the recovery process. The potential for a SGTR, however, is neither simple nor straightforward. Both are discussed below.

g The LOFW transient began with the reactor trip, continued through the subsequent OTSG dryout, and .

concluded with MFW recovery. De transient concluded when the main feedwater isolation valve 'was l opmed which, accordmg to Ref. 2, Attachment I, was .m imately 9 h and 36 min aAer the trip. The event 1 was modeled as a high pressure reactor trip initiating event with subsequent LOFW (IE-TRANS and MFW-SYS-TRIP set to TRUE for this portion of the analysis). MFW was assumed recoverable; however,it should

! be noted that both MFWPs were tripped (one on =~haaW1 overspeed and the,other had tripped on high j discharge pressure, but also had an undetermmed failure in its control system) and were not used in lieu of EFW prior to the OTSG isolation. AAer that, in the long-term aAer the OTSG isolation, EFW was also used to supply the on line OTSG. When the isolation was cleared, the B OTSG was refilled using EFW. MFW was not used until the OT.SGs were supplied via the startup valves about 9 h and 42 min aAer the trip (Ref.

2, Auehment 1), and EFW was not secured until almost 10 h aner the reactor trip (Ref. 2, A** h-t 1).

l.

! The ANO 1 model used in conjuncten with the Integrated Reliability and Risk Analysis System (IRRAS) ,

l (Ref. 5) already includes the motor-driven auxiliary feedwater pump as a supplement to the MFW when the l MFWPs have tripped off or have failed.

I SDIE )

The typical accident analysis for core damage examme< loss of coolant aculente (LOCAs), of which the i small-break LOCA (SLOCA) is a subset. The SGTR,in many aspects,is similar to the SLOCA. De SGTR is --niaad for its resulting affect on core integrity. According to NUREG-0844 (Ref. 6):

. . . concerns which were raised relative to steam generator tube degradation stem from the fact that the steam generator tubes are a part of the reactor coolant system (RCS) bounda.) and that tube failures result in a loss ofprunary coolant. . . .

\ .

The leakage c(pnmary coolant into the secondary has two major safety implications. The first is the potential for direct release of radioactive fission products into the environment, and the second is the loss of cooling water which is needed to prevent core damage An exteded uncontrolled loss of coolant outside cor.tamment would result in the depletion of te initial RCS inventory and enurgency core coohng system (ECCS) water without the capability to recuculate the water.

The licensee and the Framatame Technologies, Inc. exammed this event by focusing on the differential temperature (dt) experienced by the OTSG durms the dryout, and they correlated that temperature to a pounds compressive force (Ref. 2, Section 4.2). The maxunum At occurred approximataly 2 h and 44 min i

! 4 4

...____m. . _ _ _ . _ . _ . . _ _ _ _ . _ . _ _ . . _ _ _ - _ . _ _ . _ _ .

~ _ _ _ _ . . _ _ . _

e.

o j ,

i 4

4 LER No. 313/96-005 i

after the trip (Ref. 2, Attmehmaat 1). The stresses induced by the corWia= high At dunng the OTSG dryout were probably greater than those praared by the transient induced diffwential pressure (Ap);

however, if the scope of the analysis follows the increased stress due to the maxunum At, the underlying assumption still concerns tube integrity, and the analysis will ultunately result in a=='antum of tube rupture er leakege. He saalysis will follow the SGTR aAer that. NUREG-0844 correlates the tranr.ent-induced Ap with the probability for tube rupture herefore, in the absence of a simple correlation available to reconcile the stresses inAred by the tw.ure increase, the transient was analyzed using the Ap increase rather than the Atincrease.

About 18 min aAer the plant had shut down, the OTSG was isolated and allowed to blow down through the stuck.open MSSV. While the secondary side pressure was decreasing, the primary side (RCS pressure) was kept nearly constant (Ref. 2,4). This resuhed in the OTSG tubes being exposed to an increasing As which i

stopped increasing only when the safety valve was gagged closed. The OTSG Wary side pressure i decreased to 20 psig (Ref. 7), while the pnmary side pressure was stabilized near the normal operating pressure (Ret 2,7) of 2155 psig (Ref. 4). This means the tubes of the B OTSG were subjected to a maximum

Ap of 2135 psid. NUREG-0844 (Ref. 6) assesses the probability of SGTR given a transient inAred Ap on i the OTSG tubes. Section 3.1.2.1 of NUREG-0844 (Ref. 6) indicates that the conditional probability for one

or more tube ruptures on a steam generator during a transient may be calculated by the followmg equation.

C, = C, [ (aP3 - APJ / (J. - AP )] 8 1

Where C, is the conditional probability for one or more tube ruptures during transient "T' C, is the conditional probability for one or more tube ruptures during a postulated main steam ,

line break (MSLB) accident -. ,

AP, is the peak differential pressure across the tubes during transient "I" AP, is the normal operstmg pressure differential across the tubes AP, is the peak diffesential pressure across the tube during a postulated MSLB accident. ,

G

- . . . . . - - - c. . - - _ . - . - - - _ - . - -- _. . ~ . . . . . - _ -

l l

i i

LER No. 313/96-005

• ' ~ - - - - - - - , . . . , _._,_ _,,,

For this event: C, = 0.05 (Ref. 6)', aPi = 2135 psid (Ref. 2,4,7) *, aP, = 1245 psid (Ref. 4) ', and aP, = 2600 psid (Ref. 6).

When these values are inserted into the equabon, C i - (0.05) (890/1355)2 = 0.0216. For this peruon of the ,

analysis, IE-SGTR was set to TRUE. Further, it should be noted that according to Ref. 3 (Section 3.1.2.5), l following the failure of HPI during an SGTR, the operators have about 30 min to lower the RCS pressure j below the MSSV setpoints before core damage results. Therefore, this recovery action was =wb lM by j adding a basic event, RCS-XHE-DEP HPI, to the IRRAS model for ANO 1. Based on the operator burden  ;

I . given the time constraint of 30 min, a failure probability of 0.1 was assigned to RCS-XHE-DEP-HPl. l l

l EVENT MODEL l l

The analyses for LOFW and SGTR were combined to analyze the entire event as follows:

[P(SGTR) x est=nated CCDP for SGTR] + ((1 - P(SGTR)] x wi-rd CCDP for LOFW)) l 1

Analysis Results i

The estimated CCDP for this event is 1.1 x 104. This estimation was derived from the equation mentioned in the previous section and is calculated as follows:

[P(SGTR) x estimated CCDP for SGTR] + ((1 - P(SGTR)] x estimated CCDP for LOFW))

where 1

probability of tube rupture = 0.0216 l

1-probabilityof tube rupture = 0.9784 l

l . CCDP due to SGTR = 4.61 x Od 4

CCDP due to LOFW = 6.37 x 10 i  !

' From Secnos 3.1.2.1 of Ref. 6," tae staff has assumed se overall conditional probabdity of 0.05 that one or more asbes will be eulesrobie to rupture during pamW accedsat somditions."

• From Section 4.2 of Ref. 2 ~nw prunary system pressure and tempermane stabilired meer the normal operanas range. " From Ref.  !

7 *the ====m shell presane recorded was - 20 pois . . ' Normal operstag pressure is 2155 pois accordag to Sectica 43,1 of Ref.

4. Therefore, d,= 2155 peig 20 peig - 2135 paid.

• 5ectice 103 of Ref. 4 andicates abe the normal OTSO outlet pressure at 100% ponier is 910 peig and Secnon 43.1 indicates normal

[ RCS opermang precsure is 2155 peig. Therefore,6P,= 2155 psig 910 peig = 1245 paid.

5 6

l i

+ ,,

6 . -

j ,

LER No. 313/96-005

__r i The Anmmant core damage sequence, highlighted as sequence number 9 on Figure 1, contributes I

approxamately 89% to the estimated CCDP for SGTR. The dommant sequence involves

- SGTR initiating event occurs,

= the reactor is successfully tripped,

• EFWis successful,

• HPIis successful, d

j . the operators fail to depressurize the RCS below the MSSV setpoint ,

j interestmgly, the LOFW contributes less than 6% to the estunated total CCDP.

l Definitions and probabilities for selected basic events are shown in Table 1. The conditional probabilities and sequence logic associated with the highest probability seq- are shown in Table 2. Table 3 describes system Dames associated With the dominant sequences Minimal cut sets associated with the <tamiamat sequences are shown in Table 4. Since the LOFW transient contributed less than 6% to the total CCDP, infonnation regarding the analysis was not included in Tables I through 4.

Acronyms l ANOI Arkansas Nuclear One, Unit 1 CCDP conditional core damage probability ECCS emergency core cooling system EOP err.ergency operating procedures EFW emergency feedwater HPI high pressureinjection ICS integrated control circuit IRRAS integrated reliability and risk analysis system LER bcensee event report -

LOCA loss ofcoolant accident LOFW loss of feedwater MFW main feedwater MFWP main feedwater pump MSLB main steamline break MSSV main steam safety valves OTSG once through steam generator PORV power-operated reliefvalve RCS reactor coolant system

. SGTR steam generator tube rupture SLOCA small-breakloss of coolant at

%s includes hardware failures causing the failure to / r.  % and operator failure to initiate RCS depressunzanon-l w c---

1 i

LER No. 313/96-005

)

l References

1. LER 313/96-005, Rev. O, " Automatic Reactor Trip and Engineered Safety Features Actuations

- Caused by Failure of a Speed Sensing Probe in the Control Circuitry of a Main Feodwater Pump Turbine and Failure of a Main Steam Safety Valve to Re-Seat " June 18,1996,

2. NRC An., ~Ma_W Team Report No. 50-313,-368/9619, June 12,1996. )

3. ANO 1 Probabilistic Risk Assessment -individualPlant Examination Submittal, April 1993. ,

4. ANO 1 Safety Analysis Report, Amendment 13, September 25,1995.

5. U.S. Nuclear Regulatory Commission, " Systems Analysis Programs for Hands-On Integrated Reliability Evaluations (SAPHIRE), Version 5.0," NUREG/CR-6116 (EGO-2716), Volumes 1-10, j July 1994.

6. U.S. Nuclear Regulatory Commission,"NRC Integrated Program of Unresolved Safety Issues A 3, l A-4, and A 5 Regarding Steam Generator Tube Integrity," NUREG-0844, September 1988.

7. Personal communication, P. D. Obilly, U.S. NRC with T. Reis, U.S. NRC.

l I

I l -

I I i 8 I

l l LER No. 313/96-005 l . . _

Il 5585858888558585888888 j --....~..exeeseeesenna ti i E r

g il i Ill i 3-111 i 3

! $e-III 5.s lll  ! dof ill i jf ill i j 8

iIlEl hi !

l i

l Fig. I Dommant core damage sequence for LER 313/96-005.

1 9

l l

l

o. .

I LER No. 313/96-005

-.- . - - . . ~ . -_-.-.. _ _ _ _ _ . -_ __ _ .__ _ . _ _ _

Table 1. Definitions and Probabilities for Selected Basic Events for LER No. 313/96-005 Event manne Description Base Current Type Modired probability probability for this event ILSOTR Steam Generator Tube Rupture 1.6 = 10* 1.0 = 10'* TRUE Yes ,

latisting Event i HP14KV OO MST Makeup Storage Tank Stop 3.0 = 10 3.0 = 104 No Check Valw Fails to Seat 1.2 = 104 4

HPI-MDP-CF-ABC High Pmesure injection (HPI) 1.2 = 10 No Motor-Drian Pumps Fail to 1 Run due to Comunon Cause 1 HPI-MDP-FC-1C HPI Train C Fails 3.9 = 10 4 3.9 = 10* No HPI-MOV4C-SUCA Train A Suction Isolation 3.1 = 104 3.1 a so" No Motor Operated Valve Fails 3.1 e 10 4 HPI-MOV CC-SUCC Train C Suction Isolation 3.1 = 104 No Motoroperated Valve Fails l

d HPI-MOV-CF-SUCT HP! Suction teolation Motor- 2.6 = 10 2.6 = 10' No  !

Operated Valves Fail due to i Comunon Cause HPI-XHE-NOREC1 Operator Fails to Restare HPI 8.4=104 8.4 = 10 4 No System Aner Failure 4 4 No PCS-PSF-HW Hardware Failures Caumng 1.0 = 10 1.0 = 10 Failure to Dep essurize d

PCS-XHE-XM SO Operator Fails to Imtiate RCS 4.0 = 10 4.0 = 10' No Depressurization 4

RCS XHE-DEP-HPI Operator Fails to Depressurize 1.0 = 10 1.0 = 10 4 NEW Yes the RCS Within 30 Min AAer HP1 Failure 4

RPS-NONREC Non recoverable RPS Failures 2.0 = 10 2.0 = 10 ' No RPS-REC RecoveraNe RPS Failures ' 4.0 = 104 4.0 = 10.s  ; No RPS-XHE-XM-SCRAM Operasor Fails to Manually 1.0 = 104 1.0 = 10-8 No Trip the Reactor 10

, . - - . . _ .. . . - - - . . - . - . - . . - ~ . .._ . - . - . - - . - . - - . . . - - - - . - .

i LER No. 313/96-005 l

l l

l Table 2. Sequence Conditional Probabilities for LER No. 313/96-005

)

1 Event Sequence Conditional Percent Logic tree number core damage contribution'

. name probability j (CCDP) ,

1 SGTR 9 4.1 x 10d 88.9 /RT,/EFW,/HPI, RCS.SG 1

l SGTR 10 2.8 x 10 ' S.9 /RT,/EFW, HPI i

SGTR 22 2.0 x 10 5 4.4 RT Subtotal (SGTR) 4.6 x 10d $$5/ Min Ms N nadd @ dyMi ? S ^* " ' l

• Seromet conwibutme to the subsotal CCDP Table 3. System Names for LER No. 313/96405

~-

System name Description l

EFW No or Insufficient Emergency Feedwater (EFW) System Flow HPI No or Insufficient Flow From the High Pressure Injection (HPI)

System RCS-SG Failure to Iower RCS Pressure to < OTSG Relief Valve (MSSV)Setpoint RT Reactor I ails to Trip During Transient 1

l i

e

! 11 o

l  :

? . .

. i i

I f

l LER No. 313/96-005 l l

l

\ - - . - - - . . . . . - - - - . _. - -__ - _ _ _ _ _ . __

I i

l l Table 4. Conditional Cut Sets for Higher Probability Sequences for LER No,313/96-005 Cut set Percent ' Conditional Cut sets l number contribution probability" ,

)

l _ 1

&#U&dM ^j@ m $....$.. n$ *dNI?hdi wp SGTR Sequence 9 4.1 x 10d l 1

1 97.5 4.0 x 10d PCS XHE XM-SO 2 2.4 1.0 x 10-8 PCS-PSF-HW j .,

N ., x .

o ..s.  : a a

SGTR Sequence 10 2.7 x 10.s ,

, gj .pyg; ;;j. 3..y , ,

gg q g g- . . .

~

l l 80.2 2.2 x 10-8 HPI-MOV-CF SUCT, HPI-XHE-NORECl, RCS-XHE-DEP-HPI I l

t l 2 3.7 1.0 x 10 4 HPI-MDP-CF-ABC HPl-XHE-NOREC1.RCS-XHE-DEP-HPI 3 3.6 1.0 x 104 HPbMOV.CC-SUCA,HPI-MDP-FC 1C HPI XHE-NOREC1, RCS-XHE-DEP-HPI l

4 3.5 9.8 x 104 HPI4KVMMST, HPI-MDP-FC-IC, HPI-XHE-NORECl, RCS-XHE-DEP-HPI l 5 2.9 8.1 x 104 HPI-MOV-CC-SUCA HPI-MOV-CC-SUCC,HPI-XHE-NOREC1, l RCS XHE-DEP-HP1 i

6 2.8 7.8 x 104 HPl4KVMMST, HPI-MOV CC-SUCC, HPI-XHE-NOREC I, t

RCS XHE-DEP-HP1 l~ SGTR Sequence 22 2.0 x 104 s a ldk MN# d $ h jii;6' i'l h[ ,^

I 98.0 2.0 x 10 8 RPS-NONREC l

2 1.9 4.0 x 104 RPS XHE-XM-SCRAM, RPS-REC l l

• Re conditional probeixlity for each cut set is determined 'ay smitiplying the probability of the initiating event by the probabihties of the basic events in that =W 1 cuteet. Tbc probabilities of the initiating and basic events are given in Table 1. Initiating ewats begin i wi'h the designator,IE.

l l l

1 I 12 l

y_ _ ._ _ _ . _ _ . _ _ . _ _ . _ _ . _ _ _ _ . _ . . -. _ _ _ _ _ _ _

GUIDANCE FOR LICENSEE REVIEW 0F PRELININARY ASP ANALYSIS ,

The preliminary precursor analysis of an operational event that occurred at i your plant has been provided for your review. This analysis was performed as a part of the NRC's Accident Sequence Precursor (ASP) Program. The ASP  ;

Program uses probabilistic risk assessment techniques to provide estimates of  ;

operating event significance in terms of the potential for core damage. The l types of events evaluated include actual initiating events, such as a loss of off-site power (LOOP) or loss-of-coolant accident (LOCA), degradation of plant conditions, and safety equipment failures or unavailabilities that could increase the probability of core damage from postulated accident sequences.

This preliminary analysis was conducted using the information contained in the '

l plant-specific final safety analysis report (FSAR), individual plant

! examination (IPE), and the licensee event report (LER) for this event.

Modeling Techniques

The models used for the analysis of 1995 and 1996 avents were developed by the i Idaho National Engineering Laboratory (INEL). The models were developed using the Systems Analysis Programs for Hands-on Integrated Reliability Evaluations (SAPHIRE) software. The models are based on linked fault trees. Four types l of initiating events are considered

(I) transients, (2) loss-of-coolant accidents (LOCAs), (3) losses of offsite power (LOOPS), and (4) steam generator tube ruptures (PWR only). Fault trees were developed for each top event on the event trees to a supercomponent level of detail. The only support system currently modeled is the electric power system.

The models may be modified to include additional detail for the systems /

components of interest for a particular event. This may include additional equipment or mitigation strategies as-outlined in the FSAR or IPE. =

Probabilities are modified to reflect the particular circumstances of the  !

event being analyzed.  !

Guidance ft,r Peer Review Comments regarding the analysis should address:

I e Does the " Event Description" section accurately describe the event as it occurred?

e Does the " Additional Event-Related Information" section provide accurate additional information concerning the configuration of the plant and the operation of and procedures associated with relevant systems?

e Does th "Modeling Assumptions"'section accurately describe the modeling done for the event? Is the modeling of the event appropriate for the events that occurred or that had the potential to occur under the event conditions? This also includes assumptions regarding the likelihood of equipment recovery.

ENCLOSURE 2

_ - _ _- _ _ _ _ . _ _ r

l l

l Appendix H of Reference I provides examples of comments and responses for i previous ASP analyses.

Criteria for Evaluating Cosnients _ _ _ _ _ . . _ . __ __

Modifications to the event analysis may be made based on the comments that you provide. Specific documentation will be required to consider modifications to the event analysis. References should be made to portions of the LER, AIT, or other event documentation concerning the sequence of events. System and component capabilities should be supported by references to the FSAR, IPE, plant procedures, or analyses. Comments related to operator response times and capabilities should reference plant procedures, the FSAR, the IPE, or applicable operator response models. Assumptions used in determining failure probabilities should be clearly stated.

Criteria for Evaluating Additional Recovery Measures Additional systems, equipment, or specific recovery actions may be considered for incorporation into the analysis. However, to assess the viability and effectiveness of the equipment and methods, the appropriate documentation must be included in your response. This includes:

normal or emergency operating procedures.*

piping and instrumentation diagrams (P& ids),*

electrical one-line diagrams,'

l results of thermal-hydraulic analyses, and l

operator training (both procedures and simulator),* etc.

Systems, equipment, or specific recovery actions that were not in place at the time of the event will not be considered. Also, the documentation should ,

address the impact (both positive and negative) of the use of the specific recovery measure on:  ;

the sequence of events, .2 the timing of events, the probability of operator error in using the system or equipment, and other systems / processes already modeled in the analysis (including i operatoractions).

For example, Plant A (a PWR) experiences a reactor trip, and during the subsequent recovery, it is discovered that one train of the auxiliary feedwater (AFW) system is unavailable. Absent any further information regrading this event, the ASP Program would analyze it as a reactor trip with one train of AFW unavailable. The AFW modeling would be patterned after information gathered either from the plant FSAR or the IPE.

However, if information is received about the use of an additional system (such as a standby steam generator feedwater system) in recovering from this event, the transient would be modeled as a reactor trip with.one train of AFW unavailable, but this unavailability would be

!

• Revision or practices at the time the event occurred.

i. -

_ . . _ . - . _ . . . _ _ . _ _ . _ _ _ _ . . _ _ _ _ _ . . _ . . _ _ _ . . . ~ _ _ _ . _ . _

I mitigated by the use of the standby feedwater system. The mitigation effect for the standby feedwater system would be credited in the ,

analysis provided that the following material was available: '

' '~

~ ~

- stand y feedwater system characteristics are documented in the FSAR or accounted for in the IPE, procedures for using the system during recovery existed at the time of the event, the plant operators had been trained in the use of the system prior to the event, a clear diagram of the system is available (either in the FSAR,  !

IPE, or supplied by the licensee),

previous analyses have indicated that there would be sufficient time available to implement the procedure successfully under the I circumstances of the event under analysis, l -

the effects of using the standby feedwater system on the operation i and recovery of systems or procedures that are already included in the event modeling. In this case, use of the standby feedwater system may reduce the likelihood of recovering failed AFW equipment or initiating feed-and-bleed due to time and personnel constraints.

Materials Provided for Review The following materials have been provided in the package to facilitate your i review of the preliminary analysis of the operational event.

e The specific LER, augmented inspection team (AIT) report, or other pertinent reports.

I e A summary of the calculation results. An event tree with the dominant ,

i sequence (s) highlighted. Four tables in the analysis indicate: (1) a j summary of the relevant basic events, including modifications to the l

_ probabilities to reflect the circumstances of the event, (2) the ._

dominant core damage sequences, (3) the system names for the systems cited in the dominant core damage sequences, and (4) cut sets for the 4 dominant core damage sequences. l

' Schedule i Please refer to the transmittal letter for schedules and procedures for submitting your comments.  !

References ,

4

1. L. N. Vanden Heuvel et al., Precursors to Potential Severe Core Damage Accidents: 1994, A Status Report, USNRC Report NUREG/CR-4674 (ORNL/NC AL -

232) Volumes 21 and 22, Martin Marietta Energy Systems, Inc., Oak Riogo National Laboratory and Science Applications International Corp.,

December 1995.

I i

~

.k

. Entergy operations. Mc

-:-:- ENTERGY =x w ..

l c.n :: -

June 18,1996 1CAN069603 U. S. Nuclear Regulatory Commission Document Control Desk Mail Station PI-137 Washington, DC 20555

Subject:

Arkansas Nuclear One - Unit 1 Docket No. 50-313 License No. DPR-51  ;

Licensee Event Report 50-313/96-005-00 Gentlemen ,

In accordance with 10CFR50.73(a)(2)(iv), enclosed is the subject report concerning an automatic reactor trip.

Very truly yours, bh%

Dwight C. Mims Director, Nuclear Safety DCM/tfs enclosure 200032 i

4

. ENCLOSURE 3

-9666260161,_960618 9o PDR ADOCK 05000313 S PDR

- - .- -. . - .. _ . - _ . _ . _ . - - ~ _ . ._.. _ . _. . - __- - .= - - -. . -.

l l .

U. S. NRC

, June 18,1996 ,

1CAN069603 Page 2 l

cc: Mr. Leonard J. Callan

~

. Regional Administrator . . - - - - - ..

U. S. Nuclear Regulatory Commission ,

Region IV 611 Ryan Plaza Drive, Suite 400 Arlington, TX 76011-8064 l

l l Institute ofNuclear Power Operations -

700 Galleria Parkway 1 Atlanta, GA 30339-5957

. l

. l l

l i

I i

l i l l

1 l

l

\

4 0

4 1

- - - ...- ~. . - ._. . _ . ~ -

bRG FORM 366 U.S. NUCLEAR REGULATORT COMMIS$10m APPROYED BY QMB ' 0. 3150+0104 1

. (5 92) EXP!RES 5/31/95 ESTIMATED BURDEN PER RESPONSE TO COMPLY WITH THIS INFORMAfl0N Ca LECTION RE0utST: 50.0 NRS.

LICENSEE EVENT RBPORT (LER)

FORWARD CCMMENTS REGARDlWG BURDEN ESTIMATE TO THE INFORMATION AND RECORDS MANAGEMENT BRANCH (MNBB 7714), U.S. NUCLEAR REGULATORY COMMISSION, WASHlWCTON, DC 20555-0001, AND To THE PAPERWORK REDUCTION PROJECT (3150 0104), OFFICE OF MANAGEMENT AND BUDCET, WASHikCTON. DC 20503.

FACILITY NAME (1) DOCKET NUMBER (2) PACE (3)

Arkansas Nuetaar One

• Unit 1 05000313 1 0F 7 TITLE (4) AUTOMAfic REACTOR TRIP AND ENJINEERED SAFETY FEATURES A;TUATIONS CAUSED BT FAILURE OF A SPEED SENSING PROGE IN THE CONTROL CIRCUITRY OF A MAIN FEED WATER PUMP TURBINE AND FAILURE OF A MAIN STEAM SAFETY WALVE 70 RE SEAT EVENT DATE (5) LER NUMBER (6) REPORT DATE (7) OTHER FACILITIES INVOLVED (B)

MONTH DAY YEAR YEAR SEQUENT *AL REVISION MONTH CAY YEAR NUMBER NUMBER 05 19 96 96 005 00 06 18 96 OPERATING THIS REPOP' IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR: (Check ory or sere) (11)

MODE (9) N 20.' r, 20.405(c) X 50.73(a)(2)(tv) 70.73(b)

P0HER 2* w a1)(1) 50.36(c)(1) 50.73(a)(2)(v) 70.73(c)

LEVEL (10) 100 20..Q (a)( * )(ii) 50.36(c)(2) 50.73(a)(2)(vil) OTHER

j. . 20.405(a)(1)(lii) 50.73(a )(2)( f ) 50.73(a)(2)(viil><A) Specify in 4 y 20.405(s)(1)(iv) 50.73(a)t2)(ii) 50.73(a)(2)(viii)(B) Abstract Below 20.405 f e)(1)(v) 50.73(a)(2)(lii) 50.73(a)(2)(x) anc in Text LICENSEE CONTACT FOR THIS LER (12)

NAME TELEPHONE NUMBER (Include Area Code)

TWs F. Scott, Nuclear Safety and Licensing Spectatist 501 858-4623 mm+ .--

CCMPLETE ONE LINE FOR EACH COMPOWENT FAILURE DESCRIBED IN THIS REPORT (13)

CAUSE SYSTEM COMPONENT

" OR MANUFACTURER CAU:4 SYSTEM COMPONENT MANUFACTURER

, p B JK ST L253 Y A SB RV D243 Y SUPPLEMENTAL REPORT EXPECTED (14) EXPECTED MONTH DAY YEAR YES ho SUBMIS$10N

(!f yes, cereplete EXPECTED SUBMISSION DATEi X DATE (1!) ,

A85 TRACT (Limit to 1400 spaces, i.e., approximately 15 singte spaced typewritten lines) (16)

ANO-1 experienced a reactor trip on high Reactor Coolant System (RCS) pressure. The pressure increase was caused by reduced Main Feed Water (M W) flow originating from a component failure affecting controls of one of the operating MFW pumps. After the reactor trip, the other MW pump tripped on high discharge pressure. Emergency Feed Water (ETW) cutomatically actuated. As expected, several Main Stear Safety Valves (MSSVs) opened following the reactor trip. One MSSV failed to re-seat. This led to the manual start of cne High Pressure Injection pump because of reduced pressurizer 2 m tl and manual actuation of Main Steam Line Isolation of the affected Once Through Steam Generator (OTSG). The 3SSV failed to re-seat because inadequate engagement between the valve release nut and a

,8 eetter pin used to lock it in place allowed the nut to rotate and engage the manual lift top lever. Secondary water inventory of the affec*ed OTSG was depleted via the open MSSV.

Isolation of the OTSG, which provides the primary source of main turbine gland sealing' steam, caused degradation of main condenser vacuum. RC1. temperature control was maintained by the Atmospheric Dump System on the other OTSG. The open MSSV was gagged shut. Water inventory was restored by E W. The first MW purp control anomaly was caused by a drop in power supply voltage due to e shorted speed sensor. The failed speed sensor was replaced.

Modifications wer made to fuse the speed sensors and correct the cause of the second MFW pump trip. A mod 2fication was made to the MSSVs (other than the one gagged) to minimize the possibility of futare inuweguate pin engagement.

est FORM 366A (5-92)

• , NRC FORM 306A. U.5. NJ5 LEAR REGUSAIDRY COMM3551Dh j (5'N). APPROUED BY OMB co. 3150 9104 .

EXPIRES 5/31/95 i j- EsTINATED BURDEN PER RESPONSE 70 c0MPty WITN TNil INFORMATION COLLECTION REQUEST: 50.0 NRs.

i FORWARD CCBIMENTS REGARDING BURDEN ESTIMATE TO LICENSEE EVENT REPORT (LER) THE INFORMATION AND RECORDS MANAGEMENT BRANCN

] TEXT CONTINUATION Q Q e,u.s g E RE A OR S 1

REDUCTION PRCJECT (3150 0104), OFFICE OF j__ MANAGEMENT AND SUDGET. WASHINCTON DC 20503.

j FACILITY W'*4 (1) DOCKET NUMBER (2) LER NUMSEn (6)

I PAGE (3)

YEAn SEQUENTIAL REVISION

] NUNSER WLPISER j

Arkansas thsteer One - Unit 1 005000313 005 2 0F 7  !

00 TEXT tif more anece is reautred use additional centes of Nec Fare 366A) (1r)

I j A. Plant Status At the time of this event,' Arkansas Nuclear One Unit 1 (ANO-1) was operating in steady-sate conditions {

, at approxim: ely 100 percent power with Reactor Coolant System (RCS) [AB] average temperature j approximatoy 579 degrees.

i B. Event Description An automatic reactor trip on high RCS pressure occurred at 0312 hours0.00361 days <br />0.0867 hours <br />5.15873e-4 weeks <br />1.18716e-4 months <br /> on May 19,1996, due to a j reduction in Main Feed Water GdFW) [SJ) flow.

At approximately 0311 hours0.0036 days <br />0.0864 hours <br />5.142196e-4 weeks <br />1.183355e-4 months <br />, control on pressure for the "A" Main Feed Water Pump (MFWP) turbine

{ decreas.:d causing pump speed and feed water flow to decrease. The feed water cross-over valve  ;

! remained in its normal closed position because no MFWP trip signal was present. The reduction in flow  !

l caused the Integrated Control System (ICS) [JA] to demand maximum flow from both MFW loops. The ICS maximum demand signal was incorrectly interpreted as failed by the MFWP control system. This j caused "B" MFWP controls to shift to the " Diagnostic-Manual" mode. While in this mode, the MFWP control system is being directed by what it considers the last valid signal and does not respond to

}

additional ICS signals. The controls for "B" MFWP remained in " Diagnostic-Manual" and mdegined the l pump at its maximurr. rpeed. RCS pressure began increasing due to the decreased heat remual from i degraded "A" MFWP flow. The Control Room Operator observed the increasing RCS pressure and j

attempted to manually trip the reactor. The manual trip was sensed 0.2 seconds following an automatic j trip on high RCS pressure at 0312, less than one minute after the condition was initiated. All control rods inserted with acceptable insertion times.

l i

} Approximately four seconds after the trip, Emergency Feed Water (EFW) [BA] actuated on a sensed low

! water level in "B" Once Through Steam Generator (OTSG) [AB). The "B" MFWP, which was holding at i full speed in the " Diagnostic-Manual" mode, tripped on high discharge pressure approximately 14 seconds i after the reactor trip when its associated MFW block valve closed as designed in response to the reactor  ;

i trip. The fault in the "A" MFWP control system cleared and the pump controls attempted to respond to

] the high demand signals bei.3 generated by the ICS. As a result, the "A" MFWP turbine tripped on

mechanical over speed approximately 37 seconds after the reactor trip. OTSG inventory was l subsequently maintained by EFW with both trains functioning properly.

Pressure in "A" OTSG did not reach the setpoints of the Main Steam Safety Valves (MSSVs) [SB]

because of the re.iuced water inventory as a result of the initiating control problems of "A" MFWP.

Steam pressure in "B" OTSG was sufficient to cause six of the eight MSSVs to nen. MSSVs lifting NRC PORM sd6A (s 92)

- - . - - . . . - - - ---...~. -..- - - - .- . - - . - - - .-- - ~.

Nec FORM 36 M U.5. NULLEAR REGU6ATDRV CCMM1551DN -

l t (F92) APPROVED BT OMB NO. 3150 0106  !

EMPIRES s/31/9s ESTIMATED BURDEN PER RESPONSE TO COMPLY WITN  !

. TNil INFORMAT10N COLLECTION REQUEST: 50.0 NAS. .

FORWARD CO MENTs REGARDING BURDEN ESTINATE T0 1 LICENSEE EVENT REPORT (LER) THE INFORMATION AND RECMD5 NANAGEMENT BRANCN TEXT CONTINUATION '

7sNN 'D$h' 'O$1 N bME j REDUCTION PRC!ECT (31500104), OFFICE OF '

MANAGEMENT AND BUDGET. WAININGTON, DC 20503.

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (63 PAGE (3)

TEAa SEQUENTIAL REV1810N NUMBER NLMBER Arkansas Nuclear (he - Unit 1 005000313 M 005 00 3 of 7 I TENT (If more spece la roovired une additional cooles of NRc Foru 166A) (Ir) following a reactor trip is an expected response for ANO-1. One of these valves, PSV-2685, failed to re-seat. This caused an accelerated cooldown of the RCS. When pressurizer level fell below 30 inches, one High Pressure Injection (HPI) [BQ) pump was manually staned in accordance with Emergency Operating Procedure (EOP) guidance at 0318 hours0.00368 days <br />0.0883 hours <br />5.257936e-4 weeks <br />1.20999e-4 months <br /> to assist the running Make Up (MU) [CB) pump in maintaining RCS inventory. The minimum pressurizer level of 12 inches occurred at 0319. The HPI pump was stopped at 0327.

At 0328, after trying unsuccessfully to re-seat the MSSV, Operators manually initiated Main Steam Line Isolation (MSLI) [JB] of"B" OTSG to stop the cool down transient. - Both actions, attempting to re-seat the MSSV and isolation of the OTSG, were performed using EOP guidance. At 0330, a Notification of Unusual Event (NUE) was declared based upon the uncontrolled depressurization of"B" OTSG and its EFW supply was manually isolated. The secondary side of"B" OTSG began to dry via the open MSSV.

During the blow down, the RCS cool down rate remained within analysis and Technical Specification limits. RCS average temperature remained above 520 degrees. Because of the lack of steam in "B" OTSG, the shell cooled to approximately 74 degrees below RCS temperature. This exceeded the tube-to-  !

shell temperature difference (tubes hotter) of 60 degrees recommended by the vendor. Both of these l conditions were evaluated by the vendor, Framatome Technology, Inc. (FTI), with regard to impact to the OTSG and reactor vessel. Effects of the transient were determined to be bounded by limits of existing analyses.

The isolation of"B" OTSG, which provides the only source, other than the startup boiler, of gland seal steam for the main turbine, resulted in degradation of vacuum in the main condenser. RCS temperature control was shifted through the Atmospheric Dump Valve (ADV) on "A" OTSG beginning at approximately 0348. Steam pressure was controlled by the modulating motor-operated ADV isolation valve per existing procedural guidance until the startup boiler was available to supply gland seal steam.

Gland seal steam was restored at 0445, and condenser vacuum was restored at 0549.

A gagging device was installed on the open MSSV at 0853. Restoration of water level in "B" OTSG using EFW began at 0916. The MSLI was cleared, normal feed water established to both OTSGs, and the plant restored to normal hot shut down conditions. The NUE was terminated at 1304 on May 19, 1996. ANO-1 remained in hot shutdown conditions while the transient was evaluated and repairs and testing were completed. The reactor was critical at 0440 on May 24,1996, and fbil power was reached at l 1933 on May 25,1996.

I C. Root Cause i

The cause of the idtiating event was a component failure in the "A" MFWP control system. Reduced j voltage on the turbine control system 24 volt power supply bus resulted from a short circuit in one of the

mRC #0Ra 3aA (s 92)

J f a k

r - ,. r. -- - --

.-- _ - . _ . . . . _ _ . . - . - . - - = .

' , , 70 FORM 366A U.5. huCLEAR REGULATORV COMMI5510h d*92) APPROYED BY OM8 NO. 3150-0106 EXP!RES 5/31/95 EstlMATED BURDEN PER RESPONSE TO COMPLY WITH THIS INFORMAfl0N COLLECTION REQUEST: 50.0 HR$.

FORWARD COMMENTS REGARDING BURDEN ESTIMATE 10 LICENSEE EVENT REPORT (LER) THE INFORMATION AND RECORDS MANAGEMEkT BRANCM TEXT CONTINUATION (MNBB m), u.s. NUCLEAR REcutATORY COMMiss10N, WASHINGTON, DC 20555 0001, AND TO THE PAPERWORK KEDUCTION PROJECT (3150 0104), OFFICE OF MANAGEMENT AND SUDCET, WASNikCTON, DC 20503.

"ACILITV NAME (1) DOCKET WUMBER (2) LER NUMBER (6) PAGE (3)

YEAR SEQUENTIAL REvls10N i NUMBER WUMBER '

Arkansas bucteer One - Unit 1 005000313 00 4 0F 7 TEXT t tf aare we 4 remi ed use additionet cT ies of upC Fore 366A) (IT) pump speed sensing probes. The speed probe provides speed indication and an interlock for the turning gear but is not used for speed control. It is a potted asrembly, and it has not been disassembled to evaluate the specific failure mechanism. According to the probe vendor, this was the first known instance i of this probe failing with a short circuit. Previous failures involved an open circuit condition. An open circuit would not have caused an adverse impact upon the MFWP control system. An upgrade to the feed pump control system was instalbd in 1995 for the purpose ofimproving system response to a MFWP trip.

The equipment design specifications required failure immunity and redundancy to ensure a highly fault tolerant system. Although separate fusing of non-critical components was not explicitly stated in the i design specification, failure to provide such protection was inconsistent with good design practice. This is consic: red m b: the root cause. l The probable cause for the second MFWP inapprop:iately transferring to manual was inappropriate equipment specification. Signal failure detection logic in the MFWP controls requires that the input exceed either a maximum or minimum value while changing in excess of a rate of change setpoint.

Recorded data indicate that input rates of change were less than half of the required rate. l Troubleshooting revealed that the final output device in the ICS, a signal limiter, was causing " ringing" l (noise) on the MFWP speed demand input which likely caused the measured rate of change to exceed the required value. The signal limiter, which was added several years ago, is inappropriate for this l

application. An evaluation of the post-modification testing following the 1995 upgrade concluded that a l

sound approach was applied and the testing provided reasonable assurance that the logic of the control '

system was functional. While more elaborate testing may have identified ti.e problem with the signal limiter, proper response to an actual ICS input was verified for the full range of the input signal. Testing also confirmed proper turbine response (entry into " Diagnostic-Manual") on rapid off-scale high and low movements of the test signal both with and without a reactor trip.

On the ANO-1 MSSVs, the spindle is a threaded extension of the valve stem that is located above the valve body. At the upper part of the spindle, a release nut is threaded on to the spindle. The release nut is prevented from rotating on the spindle by a lock (cotter) pin that is installed through a slot in the release nut and a hole in the spindle. The release nut slot is open at the upper end. The release nut serves as a leverage point for the top lever which is a part of the manual lift mechanism. During MSSV setpoint testing, the release nut is removed to allow installation of the test device. Because of incomplete engagement between the pin and the nut during the most recent installation activity, the nut vibrated and rotated down the spindle while the MSSV was open following the reactor trip. Contact between the i

release nut and the top lever prevented the valve from re-seating. The release nut was unable to tun i

because the entire valve spring load was wcdgng the top lever against the bottom of the release nut, preventing the valve from seating. The lift lev" rin was remosed and the top lever forced from under the l release nut in order to provide a clearance r n the top lever and release nut. Movement of the top lever allowed the release nut to turn. Tht. c m % and release nut were then removed from the spindle.

After removing the release nut, PSV-2685 - closed and gagged. The root cause for incomplete WRC FORM 366A (5 92)

, , hp6 FORM 366A

, u.5. NVCLEAR REGULATORT COMMISSION APPROUE9 BY OMB No. 3I50 0104 d 92)

EXPIRES 5/31/95 ES71 MATED BURDEN PER RESPONSE To c0MPLT WITN TNis INFORMATION COLLECTION REQUEST: 50.0 NRS.

l FORWARD COMMENTS REGARDING BURDEN E$ilMATE 70 l

LICENSEE EVENT REPORT (LER) THE INFORMATION AND RECORDS MANAGEMEhi BRAhCN TEXT CONTINUATION E,QoNoM$o,"h00104),,$^7,f,@

REDUCTION PROJECT (31 OFFICE OF MAbAGEMENT AND SUDCET, WASHINGTON, DC 20503.

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PACE (3)

YEAR SEQUENTIAL REVIsl0N NWe8ER WUMBER Arkanses Nuclear One - Unit 1 00$000313 '

M 005 00 TErf fff = = 9&** is reedieed use additional cooles of N#C Fom s66A) (17) engagement was determined to be " personnel work practices; document use practices; documents not

, followed correctly." The procedure for release nut installation was not followed correctly by ANO-1 i Mechanical Maintenance personnel following the last surveillance testing of the MSSVs. A contributing factor to the MSSV failing to re-seat was determined to be an intdequate original design of the release nut. The release nut slot is approximately 0.40 inches high. This results in a very small area for the cotter pin and nut engagement to occur.

D. Corrective Actions The speed sensing probe and the speed monitor module that was damaged by the probe failure were replaced. A fuse was also added to the digital speed monitor circuit for fault protection of the control power supplies of both MFWPs as a reliability enhancement. Changes were also made to the control

[ setpoints to prevent undesirable transfers to the " Diagnostic-Manual" mode that isolated input signals I from the ICS.

The 15 ANO-1 MSSVs (excluding PSV-2685 that remained gagged) were inspected. Cotter pins for two other valves were found not engaged in the release nuts. These valves were determined to have been operable since the release nutt a>uld not be rotated due to the entter pin ends being engaged on the nuts.

l Six valves had the pins partially engaged at the top end or tne release nut slot. Seven valves were found l with the cotter pins fully engaged. A modification was installed to replace the 15 MSSV release nuts with l a " taller" nut with a slot dimension increased to 0.75 inches to significantly minimize the possibility of 1 l future instances of' inadequate cotter pin engagement. '

The ANO-1 maintenance procedure for release nut installation requires, " replace the release nut, flat side down, and temporarily install the cap and lever in order to adjust ti alease nut position. The bottom of )

the release nut should clear the top of the lever by 1/16 to 1/8 incheN. Remove the lever and cap. Insert a ,

new stairdess steel cotter pin through the release nut slots and spindle and spread the cotter pin ends." l These requirements came directly from the vendor technical manual. During discussions with the MSSV vendor, Dresser, it was discovered that the 1/8 inch dimension wa: not a functional or practical requirement because holes in the spir dl 3 es are not drilled in the same locations on all spindles prosided by l Dresser. The maintenance procedure was changed to indictite that the 1/16 inch was a minimum clearance. Reference to the maximum clearance was deleted. A caution regarding adequate cotter pin engagement was also added to the procedure.

, An inspection of the installed ANO-1 pressurizer code safety valves, ANO-2 MSSVs, and spare ANO 2 pressurizer code safety valves identified no concerns similar to those associated with the failure of PSV-2685.

mRC FORM 366A (5 92) 1 1

u.s. MucLEAR REGULATour compelssiou

• ' y(V2)c Foun zeeA, APPROVED ST CM8 No. 3150 0106 gxPIREs s/31/9s ESTIMTED BURDEN PER RESPONSE 10 COMPLY WITN TM18 INFORMATION COLLECTION REQUEST: s0.0 NRS. .

FORWARD COISIENTS REGARDING BURDEN ESTIMTE TO LICENSEE EVENT REPORT (LER) THE INFORETION AND RECORDS MNAGEMNT BRANCN TEXT CONTINUATION E,Q)',['i0YsDE1 N ENSM '

REDUCTION PROJECT (31$0-0104), OFFICE OF M NACEMENT AND BUDGET. WASHlWGTON, DC 20s03.

FACILITY NAME (1) 7j DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) ygAR SEQUENTIAL REvls!0N  ;

NUMBER NUMBER Arkansas puclear One - Unit 1 00s030313 N 00s 00 6 0F 7 j TEXT fif more annee is reauired une additional confes of NRc Form 366A) (17)  ;

The ANO-I Plant Manager has reviewed this event with Unit 1 Mechanical Maintenance personnel to emphasize the importance of procedural adherence. Similar discussions will be conducted with appropriate personnel from the Operations and Maintenance organizations of both units and Modifications l personnel. These discussions will be completed by September 15,1996. Additionalinitiatives previously j implemented to address procedure usage issues are being utilized to validate the ability to use procedures as written in complete compliance with site directives and administrative procedural requirements. This l includes observations of procedure usage by staff or craft personnel of all Maintenance disciplines to  ;

verify and validate proper use. ~ '

E. Safety Significance Performance of Operations personnelin bringing the plant to a safe and stable condition was competent, professional, and produced satisfactory results. One OTSG and both trains of EFW remained available -

throughout the event. No other safety-related equipment potentially used for reactor core cooling or any other system potentially used to mitigate the effects of the MFWP unavailability was affected by the sequence of events. The open MSSV had the effect of removing heat from the RCS until "B" OTSG reached dry-out conditions. Each of these considerations provided mitigation to the safety significance of the event.

Considering tfie conditions that occurred during and following the trip, an evaluation determined that the Conditional Core Damage Probability (CCDP) was similar to that expecttd for industry loss of MFW events. The CCDP was estimated to be above the screening criterion for low risk events but within the lowest range of events analyzed in NUREG/CR-4674, " Precursors to Potential Severe Core Damage Accidents," i.e., between IE-06 and IE-05. The impact of the atypical elements of this transient are mitigated by:

e the Auxiliary Feed Water Pump was available and utilized (although its inventory 5 2rce, the condenser hotwell, was temporarily in a limited capacity due to a partial loss of condense cacuum);

e the EOPs provided for the ability for EFW " trickle feed" to the OTSG that was rendered temporarily unisolable by the open MSSV; and .

e the RCS pressure reduction due to th~ e slight over-cooling transient was limited to several hundred pounds above the safety systems actuation setpoint, essentially eliminating any potential for safeguards l actuation induced primary safety valve lifting.  !

Although these mitigating factors possibly could be utilized analytically to reduce the CCDP below the i screening criterion for low risk events, as a minimum they provide confirmation that this event was within the lowest range of events that are analyzed in the Accident Sequence Precursor Program. Therefore, this g event is evaluated to have a low level of safety significance.

NRc FORM 3664 (s.92)

'Na'CFORM366A U.S. kVCLEAR REGULA10RV COMMI5510h APPROYEQ BY CMB ho. 3150 0104 (5-92) EXPIRES $/31/95 ESTIMATED BURDEN PER REIPONSE TO COMPLT WITH THis INFORMATION COLLECTION REQUEST: 50.0 hrs.

FORWARD COMMENTS REGARDING BURDEN EST! MATE TO LICENSEE EVENT REPORT (LER) THE INFORMATION AND RECORDS MANAGEMENT BRANCN (wwBB 7714), U.s. NUCLEAR RMLATOH MI5510W, TEXT CONTINUATION WASHINGTON, DC 20555 0001, AND To THE PAPERWORK '

- - - - - REDUCTION PROJECT (3150-0104), OFFICE OF MANAGEMENT AND SUDCET, WASHINGTON, DC 20503.

FACILITY NAME (1) DOCKET WUMBER (2) LER WUMBER (6) PACE (3) ,

( TEAR SEQUENilAL REVISION

, NUMBER WUMBER Arkanses Nuclear nne - Ikilt 1 005000313 -

96 005 00 TEXT (If more space is reaviced use additional cooles of NRC Fors 366A) (17)

F. Basis for Reportability  ;

The automatic reactor trip, automatic EFW actuation, manual HPI actuation, tad manual MSLI actuation l constitute events reponable in accordance with 10CFR50.73(a)(2)(iv) as Reactor Protection System or l , Engineered Safety Features actuations. This event was reported to the NRC Operations Center at 0402

on May 19, 1996, in accordance with 10 CFR50.72(a)(1)(i) for declaration of the NUE; 10CFR50.72(b)(1)(iv) for HPI injection into the RCS; and 10CFR50.72(b)(2)(ii) for the reactor trip and actuation ofEFW, HPI, and MSLI. Updates were provided at 0600,1324, and 2154. Termination of the NUE was reported during the 1324 update.

l l

! l G. . Additional Information l There was one previous similar event reponed by ANO as a Licensee Event Report (LER). A Main l Steam Safety Valve failing to re-seat because the cotter pin did not prevent the release nut from binding l

with the top lever was reported as pan of LER 50-313/89-018-00 (letter ICAN058915). The 1989 event was due to a missing pi1, not one with inadequate engagement. The corrective action for that event was a change to the maintenance procedure to require initials verifying pin replacement.

Energy Industry Identification System (EIIS) codes are identified in the text as [XX].

l l

l I

mRC FORM 366A (5-92)