ML20153C038

Svc Water Sys Failures & Degradations in Lwrs, Case Study Rept

ML20153C038
Person / Time
Issue date:	08/31/1988
From:	Lam P, Leeds E NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
Shared Package
ML20153C025	List: ML20153C021 ML20153C038
References
TASK-AE, TASK-C801 AEOD-C801, NUDOCS 8808310189
Download: ML20153C038 (300)

Text

,

a

, 7 i .

AE00/C801

^

CASE STUDY REPORT SERVICE WATER SYSTEM FAILURES AND DEGRADATIONS IN LIGHT WATER REACTORS August 1988 4

Prepared by: Peter Lam Eric Leeds 1 ,

l J .

1 i

i l

)

Office for Analysis and Evaluation of Operational Data U.S. Nuclear Regulatory Commission 8808310109 090829 PDR ORG NEXD p I

l .

t I

I TABLE OF CONTENTS l

Lant E X E C U T I V E S UMA R Y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii 1 INTRODUCTION ........................................................ 1-1 2 SERVICE WATER SYSTEM FUNCTION AND DESCRIPTION ....................... 2-1 3 OPERATIONAL EXPERIENCE REVIEW ....................................... 3-1 3.1 System Fouling ................................................. 3-1 3.1.1 Sediment Deposition ..................................... 3-2 3.1.2 Biofouling .............................................. 3-8 3.1.3 Corrosion / Erosion ........................ .............. 3-11  !

3.1.4 Other Types of Service Water System Fouling . . . . . . . . . . . . . 3-14 3.1.5 Foreign Material or System Fouling by Debris Intrusion .. 3-18 3.2 Design Deficiencies and Single Failure Vulnerabilities ......... 3-19 3.2.1 Single Fail ure Vulnerabili ties . . . . . . . . . . . . . . . . . . . . . . . . . . 3-~20 3.2.2 Service Water System Design Deficiencies ................ 3-28 3.3 Serviw O ter System Events Involving Flooding ................. 3-31 3.4 Service Water System Degradation., Due to Equipment Failures .... 3-36 3.5 Service Water System Problems Involving Personnel and Procedural ,

Errors'......................................................... 3-44 3.6 Service Water System Seismic Deficiencies .............. ....... 3-46 4 ANALYSIS OF OPERATIONAL DATA ........................................ 4-1 4.1 Cause of System Degradations and Failures ...................... 4-1 4.2 Frequency of System Failures ................................... 4-2 4.3 Frequency of System Degradations ............................... 4-3 5 EVALUATION OF OPERATIONAL DATA ...................................... 5-1 5.1 Qualitative Discussions on Safety Significance ................. 5-1 l l

5.1.1 Causes and Consequences of Systems Failures and ,

Degradations ............................................ 5-1 5.1.2 Engineering Insights and Observations ................... 5-1 j 5.1.2.1 System Fouling ................................. 5-1

, 5.1.2.2 Heat Exchanger Performance Degradation ......... 5-2 4 5.1. 2. 3 Degradation of System Piping ................... 5-3 5.1.2.4 Design Deficiencies ............................ 5-5 5.1.2.5 Single Failure Vulnerabilities ................. 5-5 5.1.2.6 System Flooding ................................ 5-6 5.1.2.7 System Degradation Caused by Equipment Failures 5-7 5.1.2.8 System Problems Caused by Personnel and i Procedural Errors .............................. 5-8 l 5.1.2.9 Seismic Deficiencies ........................... 5-8

iii l

i

[

TABLE OF CONTENTS (Continued)

. Eate 5.2 Quantitative Esti m tes of Reactor Accident Risks ............... 5-9 5.2.1 Results of Probabilistic Risk Assessment ................ 5-9 5.2.1.1 Oconee-3 Study ................................. 5-9 5.2.1.2 Crystal River-3 Study .......................... 5-10 5.2.1.3 Browns Ferry-1 Study ........................... 5-10 5.2.1.4 B ry o n - 1 S t u dy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-11 5.2.2 Estimates Based on Operating Experience ................. 5-11 6 CONCLUSIONS ......................................................... 6-1 7 RECOW4ENDATIONS ...................................c................. 7-1 8 REFERENCES .......................................................... 8-1 APPENDICES APPENDIX A Selected Operating Events Involving Service Water System Failures or Degradations APPENDIX B Generic NRC Activities Involving Service Water Systems l APPENDIX C A Partial List of Safaty Related Components Cooled by the Service WAtor Gysta fnr Selected Plants APPENDIX 0 Service Water Sgston Events involving Sediment Deposition I

APPENDIX E Service Water Sp tem Events Involving Biofouling APPENDIX F Service Wates System Events Involving Corrosion and Erosion APPENDIX G Service Wster System Evints Involving Foreign Material and/or Debris Intrusion APPENDIX H Service Water System Events Involving Parsonnel and Procedural Errors APPENDIX I Service Water System Events Involving Seismic Deficiencies

- j I

1 iv

l LIST OF FIGURES Figure Title , Pag 1 Simplified Flow Diagram of a PWR Essential Raw Cooling Water System ...................................................... 2-3 2 Simplified Flow D1agram of a BWR Emergency Equipment Cooling ,

Water System ................................................ 2-4 3 Partial Schematic of the Low Pressure Service Water System at Oconee Units 1 and 2 ..................................... 3-5  !

4 Simplified Flow Diagram of Selected Loads on the Low Pressure Service Water System at Oconee Unit 1 or 2 ......... 3-6 5 Simplified Flow Diagram of the Emergency Service Water System at Oyster Creek ............................................. 3-15 6 Simplified Flow Diagram of the Intake Cooling Water System at Turkey Point ............................................. 3-18 7 Partiel Schematic of the Low Pressure Service Water and Condenser Circulating Water Systems at Oconee ............... 3-22 8 Simplified Flow Diagram of the Salt Water System at Calvert Cliffs Unit 2 ............................................... 3-25 9 Simplified Flow Diagram of the Salt Water Cooling System at San Onofre Unit 1 ........................................... 3-40 10 Simplified Flow Diagram of the Plant Service Water System at Hatch .................................................. 3-43 LIST OF TA8LES Table T,itle Paje, l

1 Service Water System Single Failure Vulnerabilities .............. 3-21 2 Service Water System Design Inadequacies ......................... 3-30 3 Service Water System Events Involving Actual or Potential Flooding ......................................................... 3-33 4 Service Water System Events Involving Equipment Failures ......... 3-38 5 Complete Loss of Service Water System Function ................... 4-4 I

l 1

O EXECUTIVE

SUMMARY

A comprehensive review and evaluation of service water system failures and degradations observed in operating events in light water reactors from 1980 to 1987 has been conducted. The review and evaluation focused on the identification of causes of system failures and degradations the adequacy of corrective actions implemented and planned andthesafetysIgnificanceofthe operating events. TheresultsofthisrevIewandevaluationindicatethatthe service water system failures and degradations have significant safety implica-tions. These system failures and degradations are attributable to a great variety of causes, and have adverse impact on a large number of safety-related systems and com)onents which are required to mitigate reactor accidents.

Specifically, tie causes of failures and degradations include various fouling p

mechanisms (sediment deposition, biofouling, corrosion and erosioningfailure,calcium

single failures and other design deficiencies; flooding multiple equipment failures; personnelandproceduralerrors;andseismicdefI'ciencies. Systems and compo-nents adversely impacted by a service water system failure or degradation include the component cooling water system, emergency diesel generators, emer-gency core cooling system pumps and heat exchangers, the residual heat removal system, containment spray and fan coolers, control room chillers, and reactor building cooling units.

The frequencies of service water system failures and degradations as observed in operating events are relatively high: 1.8 x 10 2 per reactor year for system failure and 4.1 x 10-1 per reactor year for system degradation. The

, reactor core melt frequency due to a loss of service water system is determined to be in the range of 10 3 to 10 5 per reactor year, based on the estimates derived from this operating experience review. These estimates are consistent with values obtained in several comprehensive probabilistic risk assessments and indicate that the safety significance of service water system failures and degradations is high.

Since 1980, a number of generic comunications have been issued by both the Nuclear Regulatory Comission (NRC) and various industry groups to alert li-censees to the various problems affecting service water system performance.

Appendix B contains a listing of generic NRC activities involving service water systems. Despite these comunications (e.g., IE Bulletins and Informa-tion Notices, industry group reports, and vendor comunications), generic service water system problems continue to be reported by many licensees.

The high safety significance associated with service water system failures and 1 degradations warrants corrective actions to reduce both the frequency and po-tential consequences of operating events involving such failures and degrada-tions. To this end, AE00 has developed several recomendations which are sum-marized below and are further discussed in the report. The recomendations are:

(1) Conduct, on a regular basis, performance testinc of all heat exchangers which are cooled by the service water system anc perform a safety function to verify heat exchanger heat transfer capability, vil l 1

The performance testing should be conducted in accordance with ANSI /ASME Standard OM2-1982 "Requirements for Performance Testing of Nuclear Power PlantClosedCoo1IngWaterSystems,"andshouldexplicitlydetermineboth i the heat exchanger flow and thermal capacity. Currently there is no regula-

tory requirement on the periodic testing and verification of heat exchanger ,

thermal capacity. This recommendation is consistent with General Design t Criterion 46 (G0C 46), "Testing of Cooling Water Systems," delineated in ,

Appendix A to 10 CFR Part 50.

(2) Require licensees to verify that their service water systems are not vulnerable to a single failure of an active component.

2 Licensees should review the design, installation and operation of their servicewatersystemstoensurethatthesystemIsnotvulnerabletoa single failure of an active component. In the past seven years, single failure vulnerabilities of service water system have been reported at seven different plants. This recommendation is in compliance with the single failure criterion stated in GDC 44, "Cooling Water," in Appendix A l to 10 CFR Part 50. '

(3) Inspect, on a regular basis, important portions of the pipina of the service water system for corrosion, erosion and biofoulina.

The most dominant cause of service water system degradations observed in i operating events is corrosion and erosion of system components (27.9% of the 276 operating events reported involve corrosion and erosion). Further-more, the extent of corrosion and erosion of system piping often progressed to throu h-wall leakage before detection. A failure of the service water system p ping (a passive component) is usually not considered in designing  :

the serv ce water system. Currently, there is no regulatory requirement ,

for periodic inspection of the service water system piping for corrosion l Additionally, biofouling of relatively stagnant portions of and erosion.

i service water system piping has been observed to lead to significant sys-tem degradations. Periodic inspection of these portions of the service water system piping would allow early detection and control of biofouling.

(4) Reduce human errors in the operation, repair and maintenance of the service water system. l This can be accomplished by improving the training of reactor operators and maintenance personnel; developing detailed procedures for the repair, esintenance and recovery of the service water system; and implementing i tighter administrative controls in the operation and maintenance of the  !

service water system. As observed in the operating events reviewed, a l 1 significant number of service water system degradations involve personnel

and procedural errors. This corrective action would help reduce the l 4 incidence of these operating events. '

I 1

I a

viii

o I l i

i a

i.

i 1 INTRODUCTION l l

l i

i This study represents a systematic and comprehensive review and evaluation of (:

! service water system failures and degradations observed in operating events at

! light water reactors (LWRs) from 1980 to 1987. Several sources of operational l data were utilized in the review. First, a search of operational events re-ported in licensee event reports (LERs) was conducted using the Sequence Coding l i and Search System (SCSS) to identify operating events involving service water  ;

j system failures and degradations. Secondly, NRC Bulletins, Information Notices

! and Reports to Congress on Abnormal Occurrences were reviewed. Third, techni-

' cal study reports by the Office for Analysis and Evaluation of Operational j Data (AE00) were examined. Fourth, an industry component failure data base  ;

was searched to identify significant component failures in the service water j system. Fifth, selected preliminary notifications, 50.72 reports and inspec-j 1 tion reports were examined. Finally, several plant sites (e.g., Turkey Point,  !

Calvert Cliffs, Diablo Canyon, and Catawba) were visited for indepth discussions  !

J with licensees.  !

i l The review identified a total of 980 operational events in which the service t water system was involved. The majority of these events (704 events) were f evaluated to be of limited safety significance. These 704 events involved l minor equipment failures, orinsignificant degradation of a valve, pump, heat l

exchanger, monitor instrumentation, or radiation-monitoring equipment. The

! remaining 276 events were assessed to have potential generic safety signifi-le cance, and were further evaluated. Of these 276 operating events 29 events i involving significant degradation or failures of the service water system are described and discussed in detail in the report.

l {

} This report is organized as follows: Chapter 2 presents a brief description i i of service water systems at both pressurized water reactors (PWRs) and boiling I

water reactors (BWRs). Chapter 3 describes reactor operational experience I

involving significant service water system degradations and failures. Chap- l ter 4 gives an analysis of the operational data which includes a determination

of the frequency of service water system failures and degradations. Chapter 5

) contains qualitative and quantitative discussions of the safety significance of l operating events reviewed, and engineering insights and observations of generic l service water system problems. Chapter 6 summarizes the study conclusions and, i

finally, AE00 recommendations for corrective actions are presented in Chap-ter 7.

i l

i 1

l l

l l

l 1-1

e 4

I l

1

) 2 SERVICE WATER SYSTEM FUNCTION AND DESCRIPTION f The service water system transfers heat from systems and components to the ,

4 plant's ultimate heat sink. It is an open-cycle system which takes suction  !

i from the ultimate heat sink, e.g., the ocean, bay, river, lake, pond or cooling  !

l towers, removes heat via heat exchengers from the various structures, systems  !

and components it serves, and discharges the water back to the ultimate heat <

, sink. l 4

l The service water system's safety function is to supply coolinc sater to l l safety-related systems and components required for the safe shutdown of the .,

1 plant and to mitigate the consequence of design basis accidents. It may also  !

l related systems and com-j ponents during normal modes of plant operation. It supply cooling water to safety-relat!

class I specifications, and can be powered by either offsite power sources or i 1

onsite emergency generators.  ;

i  !

i The service water system is known by different names at various light water  !

]

reactor plants. In pressurized water reactor (PWR) plants, it may be referred i to as the essential service water (ESW) system, the emergency equipment cooling l water (EECW) system, the essential raw cooling water (ERCW) system, the salt j I water cooling (SWC) system, the nuclear service water (NSW) system, or others. ,

{ In boiling water reactor (BWR) i

equipment cooling water (EECW) plants, it may be referred to as the emergencysystei the plant service water (PSW) system, the residual heat removal service water  !

(RHRSW) system, or others, i The design and operation of the service water system as well as the systems and

! components for which cooling is supplied vary significantly among operating i

! plants. For example, there is a large variation in the number and types of (

service water pumps, the design and o>eration of traveling screens, cross-  !

l connect arrangement and capabilities netween trains and units, and the vari- I i ety of systems and components, both safety-related and nonsafety-related, for  !

which service water cooling is supplied. As an illustration, Figures 1 and I 2 show a simplified schematic for the service water system at a selected PWR i plant, and at a selected BWR plant, respectively. The service water system i shown in Figure 1 consists of eight service water pumps, four per unit in a l two-unit site, four traveling screens, four strainers, associated piping and l

! valves. The service water system pumping station is located within the plant ,

intake skimmer structure. Supply water for the pumps enters the pumping sta-  !

tion through traveling water screens which filter debris and organic matter. '

The traveling screens are backflushed into a trash trough by screen wash pumps.

Organic matter or debris too small to be trapped in the traveling screens will ,

{ be retained by strainers in each loop header. The strainers are self-cleaned l 1 by a motor-operated knife edge cleaner. The system shown has two independent, l l seismic category I flow paths, loop I and loop II, per unit, which supply  !

2 cooling water to the following systems and components: l l \

I  ;

2*1

1. component cooling heat exchangers,

2. containment spray heat exchangers,

3. emergency diesel generator heat exchangers,

'4 . shutdown cooling heat exchangers,

5. safety injection pump coolers,

6. control room air conditioning systems,

7. reactor coolant pump motor coolers,

8. control rod drive cooling water heat exchar.gers, ,

9. various air conditioning and ventilation systems,

10. station control air compressors,

11. containment ventilation system.

Additionally, the service water system shown supplies a backup water supply to the auxiliary feed pumps for steam generator feedwater if the normal preferred source is unavailable. The service water system also provides an alternative source of water to the fire protection system in safety-related areas when the primary source of fire protection water is not available.

During normal plant operation, the system loads include the compe ent cooling heat exchangers, reactor coolant pump motor coolers, control rod drive cooling i water heat exchangers, various plant air conditioning and ventilation systeses, ,

and the air compressors. The diesel generator and containment spray heat ex-changers, as well as some of the cir conditioning and ventilation systems, are only supplied when those systems receive a start signal.

The service water system shown in Figure 2 represents the emergency equipment  !

cooling water system at a BWR/4 plant on a three-unit site. It has 12 RHRSW  ;

pumps, eight of which can be utilized by the EECW system. Four of the 12 RHRSW i pumps are dedicated to the EECW system while another four pumps can be valved '

into the system if needed. The remaining four RHSW pumps are aligned for RHRSW system requirements. The pumps take suction at the intake pumping station. ,

The system consists of a north and south header with two pumps normally aligned to each header. Either header is capable of supplying 100% of the cooling requirement. Each supply header has a self cleaning cone strainer at the intake structure to screen out debris to prevent clogging of the system.

The ECCW system shown supplies cooling water to the following equipment:

1. core spray room coolers,

2. residual heat removal room coolers,

3. core spray pump bearing coolers,

4. residual heat removal pump seal coolers, i

5. diesel generator engine coolers, l The EECW system also provides a backup cooling water supply to the control room air conditioners, the reactor building closed cooling water system heat ex- l changers, and the control and station service air compressors and'after coolers.

2-2

p--- -

5 r,

1 J l COMP.  !

CML l l

TURB. HX l l h(2 #U *-

pp C

r4 C l UNIT 2 ECUIPMENT l g (SAME AS UNIT 11 g f DISCHARGE _I- '12 - OfSCHARGE i HEADER A 'r' r TO S/G'S l R ?" _,Te,. ?" M e b " HEADER m l 8 I 1A 1B COMP. COMP. l l COOL COOL l WATER WATER g HX HX CONT CONT A B S'"" 5 """ l l H Hx , , l l 1A 18 g l TO DISCHARGE HE, 'RS l h eMn Cl 8

fy ,'

_ _ eMa vfNT hCl 8

^

8^

, 7y l

l DIESEL DIESEL l AIR AIR GEN. GEN. l COND. - - COND. jg.g 23 3 9 l 1A 1B I l

ROOM ROOM 0]I hD]I[D l. --- ,

l

~ l A g IN TAK E INTAK E l SCREENS SCREENS l

$ TRAINERS STRAINER $

' l I

FROM -

l l ULTIMATE A 8 HEAT g l g

SINK l l 1 TO DISCHARGE HEADERS 1A l 28 STRAINERS g

l STRAINERS I 1 u-_J 1 l D1,) D DIESEL DIESEL l GEN. GEN.

1A A 2A-A l

_. L a wA, \

"d d BA"5 5" A e i

TO DISCHARGE HEADERS l Figure 1 Simplified Flow Diagram of a PWR Essential Raw Cooling Water System 2-3

fnow nAW COOtmeG WAf ta 10 N C P"'88'880 1 f TO CONTROL ANO UU" O STAl#0N St#VtCE AWI CouPM550nS g mod;*ns s1 porn l I

l l 10 CONinOL m j nOOM Amt

- CO.consomMG l l l

~ ~'"'

=L I, = = l 1 wnCW I

i

_- ,nA . - _ _

i

. i

+ TO CORE SPnAY TO nHft

_ ,A A,eo ,C - , . oe.1 o ..

. .~. . _ _

,0 -

l CootsNO COOLNeG COOLin PuuP 1A ANO st AniedG A8eO ANO 10 SEAL + l sc StAL A8dO AseOROOM LDAOS tDAOS nOOM COOttnS setou - CoottRS nCW COOLEnS e= cme.C+

COOu

- dg l l i

TO Cone SPnAY +

l Puur se Aeso 10 l DEAftleeG A8dO 3 N

a sNome O nOOu COOtans 1 i Cooten

1. l l u I m I

"*"" I i

' C=Aeso rno. 4 SOUTHMEAOfn RAW StftWICE WestR 1

fthdt 1 Met meest nMit dL n a JL i As A C """E*,u'u,.

( (As (s (as (a (er (C3 (Ci (om (ei (Os I m1 . - ,,A,.O.e i 4

Figure 2 Simplified Flow Diagram of a BWR Emergency Equipment Cooling Water System i

i

l l

i 3 OPERATIONAL EXPERIENCE REVIEW A comprehensive review of operational experience involving service water system failures and degradations in light water reactors has been conducted. The re-view covers the period from January 1,1980 through June 30, 1987. Several sources of operational data were utilized in the review. First, a search of operational events reported in licensee event reports (LERs) was conducted using the Sequence Coding and Search System (SCSS) to identify operating eve- " involv-ing service water system failures and degradations. Secondly, NRC 1 -

Information Notices and Reports to Congress on Abnormal Occurrences were reviewed.

Third, technical study reports by the Office for Analysis and Evaluai.1on of Operational Data (AE00) were examined. Fourth, an industry component failure data base was searched to identify significant component failures in the service water system. Fifth, selected preliminary notifications, 50.72 reports and inspection reports were examined. Finally, Turkey Point, Calvert Cliffs, Diablo Canyon, and Catawba were visited for indepth discussi v s on service water system problems.

A total of 980 operational events in which the service water system was involved were identified by the review. The majority of these events (704 events) were evaluated to be of limited safety significance. These 704 events involved minor eouipment failures, such as insignificant degradation of a valve, pump, heat exchanger, monitor instrumentation, or radiation-monitoring equipment. The remaining 276 events were assessed to have potential generic safety significance, and were further evaluated. Appendix A gives a brief description of these 276 operating events. Of these 276 operating events, 29 events involving significant degradation or failures of the service water system are described and discussed in detail in this Chapter.

3.1 System Fouling Frequently reported service water system common-mode failure mechanisms are fouling through sediment deposition (silt, mud and clay accumulation), bio-fouling, corrosion / erosion, foreign material, and other, more plant-specific types of fouling (e.g., pipe coating degradation and calcium carbonate buildup).

The service water system is especially vulnerable to fouling because the water in many cases is raw, untreated cooling water from the plant's ultimate heat sink, as the treatment of water is often restricted by federal, state or local environmental regulations. The cooling water is pumped through a relatively complex path of piping and various components, such as heat exchangers, valves, strainers, and pumps where obstructions and numerous changes in flowpaths allow potential fouling agents to settle throughout the system.

The service water system operational data associated with each of the afore-mentioned fouling mechanisms is presented in the following subsections: 3.1.1 Sediment Deposition, 3.1.2 Biofouling, 3.1.3 Corrosion / Erosion, 3.1.4 Other Types of System Fouling, and 3.1.5 Foreign Material.

3-1

l 3.1.1 Sediment Deposition Service water system degradation caused by sediment deposition has been reported by licensees at fifteen different sites during the period of this study. Ap- 1 pendix 0 contains a listing of these operating events. These events involved l various service water system component and instrumentation degradations caused  !

by sediment deposition. They include: silt buildup around service water pump I suction bells degrading pump performance, silt and mud clogging cooling coils I in fan cooler units and safety injection pump lube oil coolers, rilt plugging i of various pressure and flow transmitter sensing lines and small diameter piping supplying service water pump cooling, pump bearing surfaces scored by silt which leaked through worn packing, valves which wauld not fully open and/or close due to silt buildup and various heat exchanger and room cooler tube fouling from )

silt and mud accumulation. j Three of the most significant events occurred at McGuire-1, Oconee and Bruns-  :

wick-2. These events are discussed in the following paragraphs. I Nuclear Service Water System Degradation at McGuire-1 In October 1985, in response to NRC's concerns over the potential fouling and degradation of heat exchangers serviced by the nuclear service water (NSW) system, the licensee conducted a performance test of the containment spray heat exchangers. The performance test data indicated that the overall heat transfer -

degraded (7.35 x 105 BTV/

coefficientoftheheatexchangerswassignificantigFassumedintheMcGuire hr 'F as opposed to the value of 2.94 x 108 BTV/hr-FSAR). An inspection of the 1A containment spray heat exchanger revealed a fairly uniform silica deposit (silt) completely covered the heat exchanger tubes.

Several cleanings using various chemical and hydraulic techniques were employed  ;

by the licensee to clean this heat exchanger. A test of the heat exchanger on 1 January 28, 1986 indicated that a value of 2.03 x 106 BTV/Hr 'F had been achieved through cleaning (Ref. 1), l The licensee also conducted a series of flow balance tests for the 1A NSW train on December 17, 1985, and January 27, 1986, and January 28, 1986. Flow balance testing was also conducted for the IB NSW train on January 30, 1986. Flow rates through the essential heat exchangers (required to mitigate accident consequences during safety injection and containment spray) measured during these tests were compared to the corresponding values specified in the FSAR. The data for the December 17, 1985 test indicated that FSAR specifi e d flow rates could not be attained for the following equipment:

1. Containment spray heat exchanger (4% degraded).

2. Control room chiller heat exchanger (10% degraded).

3. Charging pump oil cooler (46% degraded).

4. Spent fuel pump room air unit (27% degraded). ,

5. Containment spray purrp room air unit (56% degaded). j 1

After the cleaning evolutions of the 1A containment spray heat exchanger were l completed, the licensee performed another flow balance test of the 1A NSW train i on January 27, 1986. Even after the cleanings, the following FSAR flow rates l could not be attained:

l 3-2 l l

l

__ _ _ _ _ _ _ _ . _ _ _ _ _ . . _ , ~ _ . - _ _ _

1

1. Containment spray heat exchanger (2% degraded).

2. Control room chiller heat exchanger (0.5% degraded).

3. Diesel generator cooling water heat exchanger (8% degraded). l

,4 . Spent fuel pump room air unit (30% degraded). I

5. Containment spray pump room air unit (56% degraded).

6. Safety injection pump motor air unit (15% degraded).

Degradation cf the charging pump cooling flows recorded during the flow balance test conducted in December 1985, were attributed to faulty flow indication which required instrument replacement.

As a result of the January 27, 1986 flow balance test, the licensee declared i the 1A NSW train to be inoperable pending resolution of the degraded flow con- l ditior s and correction of the faulty charging pump oil cooler flow indicator.

After reviewing the results of the December 1985, and January 27, 1986 flow balance tests, NRC inspectors noted that the tests were performed with the Unit 2A NSW train secured, which was not conservative with respect to the design basis accident. Worst case conditions would assume that the 2A NSW train was providing ui.t cooldown during the operation of the 1A NSW train to mitigate accident conditions. This would reduce the net positive suction head for the 1A NSW pump. The licensee stated that a flow balance test would be conducted on January 28, 1986, to reflect this worst case configuration.

In conjunction with resolution of the degraded flow conditions reflected in the 1A HSW train flow baluce testing, the licensee had the reactor vendor perform an analysis to determine new acceptable minimum values of NSW flow through the containment spray and component cooling water heat exchangers. The licensee was considering throttling the flow to these two large heat exchangers to pro-vide increased flow through the smaller essential heat exchangers. The vendor calculation demonstrated that reducing service water flows through the contain-ment spray and component cooling water heat echangers would not cause peak containment pressure to exceed the design value cf 15 psig during a design basis accident.

On January 28, 1987, a third 1A NSW train flow balance test was performed. The result of this test indicated that flow values through all heat exchangers were within the new acceptable values established by the vendor calculation.

However, after addressing the NRC's concerns about the adequacy of the flow tests in regard to the worst case conditions, the licensee determined that the NSW system preoperational test configuration had not tested the system under the design basis accident configuration. On March 11, the licensee informed the NRC that the NSW systerr, for both units had never been tested under the requisite accident conditions prior to January 28, 1987.

In summary, the examination of the 1A NSW train at McGuire Unit.1 revealed three l significant deficiencies: the reduced heat transfer capability of the 1A con- '

tainment spray heat exchanger; degraded NSA flow rates through essential heat exchangers required to mitigate accident consequences during safety injection and containment spray actuation; and that NSW preoperational testing at both McGuire units had not fully tested the syst2m under design basis accident conditions.

3-3 1

i Low Pressure Service Water System Fouling at Oconee Units 1, 2, and 3 On February 6, 1986, prompted by service water system problems discovered at the licensee's McGuire Unit 1, the NRC requested that the licensee examine all three Oconee units' service water systems for fouling problems. On February 15, with Unit 1 shutdown for an outage, a test of the Unit I low pressure injection (LPI) coolers (which are cooled by the low pressure service water system) deter-mined that the 1A LPI cooler exhibited only 53% of its design heat transfer capability. The 1A cooler was cleaned on March 30, but could not be re-tested immediately because the unit was in cold shutdown and an adequate heat load was not available. It was later tested on August 7, and found to have 74% of its required heat transfer capability (Ref. 2). The Unit 2 2A and 2B LPI cools.cs were also tested on August 18, and were found to have 57% and 100% of their required heat transfer capability, respectfully (see Figs. 3 and 4).

The Unit 3 reactor building cooling units (RBCU) coolers (which are als) cooled L;> the low pressure service water system) were tested on September 10, 1986, a d the results indicated a severe lost, of cooling capability (the 3A and 3C coolers had approximately 35% of design heat transfer capability under normal conditions). The Unit 1 RBCU coolers were also tested, and the resu',ts indi-cated the actual heat transfer capabilities of the 1A,18, and 10 caolers to be 85%, 89% and 95%, respectfully, of their design values. While Unit 3 was shut down, a visual inspect $on of the Unit 3 RBCU coolers revealed air-side touling of the coolers and the coolers were subsequently cleaned.

A performance test of the Unit 3 LPI coolers conducted on December 29, 1986 revealed that the 1A and 1B coolers had a performance capability of 60 and 63%  ;

of design, respectfully. An inspection of the Unit 3 LPI coolers found a thin layer of fouling uniformly distributed throughout the shell side of the coolers.

On March 25, 1987, based on the degradation of the RBCU and LPI coolers, the licensee established a 50% maximum power level limit for Unit 3 to compensate for the degraded operability of the RBCU and LPI coolers.

The licensee attributed te impaired coolire capability of the RBCU and LPI coolers at all three units to service-induced fouling from the low pressure service water (LPSW) system. The water source for the LPSW system is Lake Keowee, and the water is supplied directly to the system loads without process-ing. The licensee reported that the RBCU and LPI coolers at all three units had been operated for 12 to 13 years without any cleaning of the LPSW side of the coolers. Sediment deposition (silt and/or mud) built up over the years of oparation and fouled the coolers.

On March 30, 1987, the Unit 3 RBCU coolers were again tested and the test i results indicated a performance capability fo; the 3A, 38, and 3C Rf100 coolers of 20%, 43%, and 28% of design under emergencv conditions, respectfully. Unit 3 was shut down on March 31 due to excessive main turbine bearing vibration.

Upon subsequent evaluation during the plant shutdown, the licensee determined that Unit 3 RBCU and LPI cooler performance was unacceptable to support full power operation. On April 1, 1987 the licensee completed operability evalua-tions for the Unit 1 and 2 RBCU and LPI coolers. Due to the degraded capa-bilities of these components, Unit I was limited to 91% of full power and Unit 2 was limited to 66% of full power.

3-4

SUCTION FROM LAKE KE0 WEE VIA CONDENSER CIRCULATING WATER CROSSCNER PtPING LPSW "B" UNE 3

igi PUMP A

SENTINEL REUEF STRAINERS 70 LPSW FROM L2 PUMP MD P ypgg 7, LPSW "A" LINE 4 f A 'O' c SENTINEL RELIEF SUC110N FROM ad

)

LAKE KE0 WEE TO UNIT 2 VI A CONDENSER TDEFWP FRW HPSW h J CIRCULATING WATER JACKET j CROSSOVER PIPING TO UNIT I

- TDEFWP JACKET U 0 C UNIT 3 L2 LJ Vm VM N

l If If If If If LPSW "A" LPSW "B" LPSW "A* LPSW "B" COMP >NENT HEADER HEADER HEADER HEADER CMLER$ TO UNIT 1 TO UNIT 1 TO UNIT 2 TO UNIT 2 g

Figure 3 Partial Schematic of the Low Pressure Service Water System at Oconee Units 1 and 2 3-5

4 RCP LPSW A1

• • A~

HEADER- _

R8CU RBCU R8 eCU X

C FANS ,

RP RCP

et l -

l LPSW H DER C ER ,

. A i y m

G i COOLER 7+g i -clo-1 4

m COOLER 1A

}

LPSW TO ,

i COMPONENT ,

COOLERS D 5 CHARGE- DISCHARGE-

' HLADER HEADER

@ V V i

Figure 4 Simplified Flow Diagram of Selected Loads on the Low Pressure Service Water System at OConee Unit 1 or 2 I _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ - _ _ _ _ - _ - _ _ _ _ _ _ _ _ _ - - - _ - _ - - _ _ _ _ - - _ _ - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - - _ _ _ _ -

1 .

l l

The Unit 2 2A LPI cooler, the Unit 3 RBCU and LPI coolers were cleaned and tested in early April 1987. Based on the improvement in the various cooler performance after cleaning, the licensee determined that Units 2 and 3 could operate at 100% full power. The licensee planned to clean and test the Unit 1 RBCU and LPI coolers during the unit's refueling outage. In response to these problems, I the licensee also developed a detailed plan to implement a periodic inspection I and cleaning program for safety-related components cooled by raw water.  !

In regard to the other safety-related loads cooled by the LPSW system, the i licensee stated that periodic preventive maintenance is performed that would I detect and correct problems caused by fouling. Specifically, the high pressure l injection pump motor coolers are equipped with flow gauges and a monthly f!ow test is performed. If the coolers fail the flow test, the cooling coils are  !

replaced. The licensee reported that the piping supplying these coolers has also teen changed from carbon steel to stainless steel to help prevent the buildup of corrosion prnducts. The motor-driven feedwater pump motor coolers  !

are also flow tested monthly and the cooling coils are replaced when necessary. ,

The turbine driven emergency feedwater pump oil coolers are opened, inspected l and cleaned every refueling outage. '

An inspection of the licensee's actions to correct the 9BCU and LPI cooler j fouling problems was conducted by NRC inspectors on April 27 through May 1, 1 1987. One of the inspection activities was a review of plant Technical Speci-fications requirements to determine the extent that surveillance testing could i be used to detect system or component fouling. Based on the review of the sur-veillance procedures, the inspectors concluded that the RBCU arid LPI cooler fouling problems experienced at Oconee demonstrated that none of the existing surveillance tests used prior to April 1987 were useful for detecting the foul-ing that resulted in the degraded heat transfer capability of the coolers.

Loss of RHR Service Water Following a Reactor Scram at Brunswick ';

On January 16, 1982, with the Brunswick Unit 2 reactor operating at 32% power, a main turbine trip on low condenser vacuum caused a subsequent reactor scram.

A group 1 isolation occurred when the mode switch was placed in the shutdown position with the steam flow switches indicating greater than 40% flow. This i caused the closure of the main steam isolation valves (MSIVs). The operators 1 manually started the reactor core isolation cooling (RCIC) system to provide core cooling. The operators then attempted to initiate normal suppression pool cooling using the residual heat removal (RHR) system. However, low suction header pressure lockout signals in each loop prevented the operators from starting either RHR service water loop's pumps (two pumps per loop) and the system was declared inoperable. The inoperability of both RHR service water loops renders the shutdown cooling and suppression pool cooling modes of the i system inoperable. The group 1 isolation signal was reset, the MSIVs opened, a '

condenser vacuum established and a reactor feed pump started to reestablish feedwater flow to the vessel. After repair and testing, the B and A RHR service l water trains were returned to service after 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> and S hours of the event, l respectfully (Ref. 3). I An inspection of the suction header pressure switches associated with each RHR service water loop revealed that the sensing line to each switch was partially 1-7

l  !

l l 1

plugged with sediment. This prevented the switches from sensing the actual header pressure, resulting in the low suction header pressure iockout signals. l In addition, the licensee discovered a leak of operating fluid from the A loop

' switch diaphragm. Consequently, even if the switch sensing line had been clear allowing the switch to detect actual header pressure, the lack of operating fluid in the switch diaphragm housing might have prevented the A loop switch ,

from accurately sensing header pressure.

The inspection also revealed that the power supply circuit breaker switch that I supplies the B loop pressure switch was in the off position. Thus, the B loop l switch was also inoperable even if it could detect actual header pressure. The  :

licensee stated that previous to the event a freshwater flush of the B loop was 1 performed in accordance with plant procedures. However, an apparent breakdown l in communications between the operators resulted in the failure to reset the l pressure switch circuit breaker following completion of the flush. l The A loop pressure switch was eventually replaced, the sensing lines for both switches were cleared and the switches were calibrated. The switches were then 1 checked for proper operation, the RHR service Lter pumps were successfully )

started and the system was returned to service. The licensee also took actions '

to improve maintenance procedures for the switches.

3.1.2 Biofouling l Licensees at 11 sites have reported fouling and clogging of service water systems caused by biological organisms during the period of this study. A list of these events is presented in Appendix E. Asiatic clams (Corbicula j fluminea), blue mussels (Mytilus edulis), and American oysters have been 1 the most frequently reported biofouling organisms at nuclear power plants. <

However, other aquatic life has also fouled plant service water systems, e.g., 1 barnacle fouling at San Onofre 1. In early 1981, prompted by the shutdown of ,

Arkansas Nuclear One, Unit 2, on September 3, 1980, because service water flow i through the containment cooling units was partially blocked by extensive biofouling (Asiatic clams), the NRC issued Bulletin 81-03, "Flow Blockage of  !

Cooling Water to Safety System Components by CORBICULA SP. (Asiatic Clam) and HYTILUS SP. (Mussle)." The bulletin required all nuclear power plant licensees to assess the potential for biofouling of safety-related component systems at their fa' liities and to describe actions taken to detect and mitigate flow blockage as a result of fouling by Asiatic clams and marine mussels.

1 Licensees have reported that marine growth had blocked pump suctions, caused fluu restrictions in small diameter piping, clogged heat exchanger tubes, ,

caused heat exchanger divider plate damage, and prevented complete valve re-  !

positioning. Several licensees have also reported that biofouling has reduced the ability of the service water system to adequately remove heat from certain safety-related components including: RHRheatexchangers,safetyinjection pump lube oil coolers, containment cooling units, containment spray heat ex-changers and diesel generator engine coolers. Among these reported events, the event at Arkansas Nuclear One, Unit 2, involved significant <iegradation of multiple safety systems.

A detailed description of the Arkansas Nuclear One, Unit 2, event is presented below:

3-8

l Biofouling of the Service Water System at ANO-2 On September 3, 1980, Arkansas Nuclear One (ANO), Unit 2, was shut down after failing to meet.the plant Technical Specification requirements for minimum  ;

service water flow rate through the containment air coolers (Ref. 4). After plant shutdown, Arkansas Power and Light Company (AP&L), the licensee, deter-mined that the inadequate flow was due to extensive plugging of the coolers by Asiatic clams (Corbicula species).

The Unit 2 containment air coolers are redundant to the containment spray sys- .

tem and function both during normal operation and following a LOCA to remove I heat from the containment. The coolers have two separate sets of cooling coils. During normal opecation chilled cooling water is pumped through one of the sets of coils with the other set isolated. On an engineered safety fea-tures actuation signal (ESFAS), the chilled cooling water is isclated and service water is pumped through the second set of cooling coils.

In order to detemine the cause for the low service water flow in the contain-ment coolers, the licensee disassembled the service water pipino on the supply and return side of the coolers. On the inlet side, clams were found in the three-inch service water headers that supply the coolers as well as in the cooler inlet water boxes. The piping on the return side was found clean, and ne clams were found in the outlet of the coolers. Clams were removed from the I "A," "C," and "D" containment coolers. The "B" containment cooler had been l removed from service on March 17, 1980, and was blank flanged; it has since returned to service. The clams found in the containment coolers were comprised of some live clams but most of the debris was shells. The average size of the clams was about 15 to 16 mm (approximately 5/8 inch). The service water, which is taken from the Dardanelle Reservoir, is filtered before it is pumped through the system. The strainers on the service water pump discharges were examined and found to be intact. These strainers have a 3/16 inch mesh, much smaller than some of the shells found, which indicates that clams had been growing in the system.

The ANO-2 plant Technical Specifications require that the flow rate of the i service water through the containment air coolers be verified monthly. l Apparently, during previous surveillance tests of the containment cooling units i at the ANO-2 facility, Asiatic clam larvae were present in the service water and were pumped with the water into the containment coolers. On completion of the surveillance test, the service water was left stagnant in the coolers. The growth of the larvae resulted in the flow blockage evidenced by the data obtained I from the August 29, 1980 surveillance test. j 1

Following the discovery of Asiatic clams in the containment coolers of Unit 2, the licensee examined other equipment cooled by service water in both Units 1 and 2. Inspection of other heat exchangers in the Unit 2 service water system i revealed some fouling or plugging of additional coolers (seal water coolers for l both redundant containment spray pumps and one low pressure safety injection pump) due to a buildup of silt, corrosion products, and debris (mostly clam shell pieces). The high pressure safety injection (HPSI) pump bearing and seal coolers were found to have substantial plugging in the \-inch service water supply lines. The plugging resulted from an accumuiation of silt and corrosion products.

3-9

1

! Clam shells were found in some auxiliary building room coolers and in the aux-iliary cooling water system (ACWS) which serves non-safety-related equipment l in the turbine building. The ACWS is a continuously running system as con-trasted to the service water system in which most components are isolated during normal power operation.

The examination of the Unit 1 service water system revealed that the "C" and "0" containment coolers were clogged by clams. Clams were found in the three-inch inlet headers and in the inlet water boxes. However, no clams were found in the "A" and "B" coolers. This fouling was not discovered during surveil-lance testing because there was no flow instrumentation on these coolers. Fur-ther investigation revealed that the service water strainer serving the "A" and "B" coolers and the one serving"the "C" and "D" coolers were intact. Since the strainer serving the "C" and "0 coolers had been broken in the past, the licensee reasoned that the clams found in the "C" and "D" coolers did not grow in the system but were swept in during the interval the strainer was broken.  !

l The service water system in Unit I was not fouled other than stated above, and  !

the licensee attributed this to the fact that the service water pump suctions I are located behind the main condenser circulating pumps in the intake struc-ture. It was thought that siit and clams entering the intake bays would be swept through the condenser by the main circulating pumps and would not accumu- '

late in the back of the intake bays. In contrast, Unit 2 does not have main circulating pumps in its intake structure. Condenser heat is rejected through a cooling tower via a closed cooling system. As a result of lower flow rates of water through the Unit 2 intake structure, silt and clams could have a tendency to accumulate more rapidly in Unit 2 than in Unit 1. The intake bays of Unit 1 and Unit 2 are normally scheduled to be cleaned each refueling outage, however, AN0-2 was in their first fuel cycle. During the 1980 September outage, the Unit 2 intake bays were cleaned and an estimated 150 to 500 cubic feet of clams and silt were removed. Clams have also been found in the emergency cool-ing pond at ANO.

As a first step in correcting the fouling problem, AP&L manually cleaned out the shells and debris from the service water headers supplying the containment air coolers. They then flushed and back flushed the service water system.

This included a one-half hour flush of the containment air coolers with 770C (1709F) water obtained from the auxiliary boiler. The licensee stated that exposure to water at this high temperature will result in 100 percent mortality in a matter of minutes for any clams that were still in the system.

Thermal backwashing has been determined to be an effective technique for kill-ing bivalves. Studies have reported that 30 minute exposures to temperatures of 43'C or higher kills virtually all Asiatic clams. Time-temperature mor-tality tests on blue mussels indicate that exposure to temperatures of 41'C or higher causes 100% mortality in approximately 10 minutes (Ref. 5). Thermal backwashing has been successfully employed at Pilgrim, Millstone and San Onofre.

At Unit 2, the licensee has begun to monitor the flow through the containment coolers on a biweekly basis any time the plant is in operation. The data has been trended to ensure flow degradation is detected. Service water flow 3-10

. 1 through the HPSI pump seal and bearing coolers is being checked quarterly.

During Unit 2's 1981 spring refueling outage, provisions for flow rate measure-ments were added to a number of components cooled by service water. Also, much

, and return piping was replaced ofthesmallcarbonsteel,servicewatersupply%-inchlineswerereplaced with 316 L stainless steel piping. Many and with one-inch lines. The service water pump bays and pump discharge strainers ,

were cleaned and additional components were inspected and flow tested. l During Unit l's January 1981 refueling outage the licensee added flow orifices I and inoicators to the service water supply headers for the containment coolers.

The plant Technical Specifications were also changed to require biweekly measure- ,

ments of service water flow rate through these coolers. Isolation valves were l added to the service water supply lines for a numoer of components to facilitate  !

the installation of flow rate measuring devices at a later date. The service j water pump bays and pump discharge strainers were cleaned and additional J components were inspected.

The service water chlorination schedule at both plants has been changed to coincide with the performance of surveillance tests. Normally isolated compo-nents are laid-up with chlorinated water. In addition, the fire protection system for both units is being flushed periodically even though no fouling has been observed in the system.

l 3.1.3 Corrosion / Erosion The operational data concerning both corrosion and erosion of service water 1 system components and piping is presented in this section. Although corrosion and erosion can be independent failure mechanisms, they often work in tandem to ,

cause equipment degradation. For example, corrosion of a valve seat will cause  !

the seat material to be more susceptible to the abrasive action of any sus-pendti solids (e.g., silt) entrained in the service water. A review of LERs also found that licensees commonly cited both corrosion and erosion as "root causes" when reporting a single event involving service water system equipment degradation. ,

Corrosion and erosion of service water systems has been reported by licensees at twenty-three different plants during the period of this study. Appendix F contains a list of these operating events. Service water system corrosion and erosion problems have been reported at plants using sea water, brackish water, and fresh water for the system's water source. The plants at which these failure mechanisms have been reported use the full range of ultimate heat sinks, i.e., river, lake, bay, open ocean, cooling ponds and cooling towers.

Thus, the degradation of service water systems by corrosion and/or erosion is a generic concern.

The most commonly specified cause for corrosion / erosion of service water sys-tems at LWRs was the nature of the system's water source. Suspended solids in the water source (e.g., silt or fine sand particles) was most frequently cited as the cause of the erosion of system components. The corrosive nature I of the water source was another commcnly cited cause of service water equipment l degradation. This has been reported at plants using both sea water (e.g., San Onofre) and fresh water (e.g., North Anna) for the service water system.

3-11

l l

Components (e.g., valves, pumps, or heat exchangers) as well as system piping were reported to be degraded by corrosion and/or erosion. Of a more signi-ficant nature, a number of events occurring at nine different sites (North Anna, Salem, Indian Point Unit 2, Robinson, Calvert Cliffs, Millstone, Crystal River, Kewaunee and Peach Bottom) were reported in which actual thinning and pitting of service water piping resulted in service water leakage. Licensees have commonly reported that piping erosion is usually found immediately down-stream of throttled valves and at 90 degree pipe elbows.

Service water leakage has resulted in substantial flooding at several plants during the period of this study, which are discussed in more detail in Sec-tion 3.3, "Service Water System Flooding." In general, corrosion of component internals has resulted in seized valves, pipe wall thinning and pitting (par-ticularly at weld joints), heat exchanger tube leaks and clogging, safety injection pump inoperabililty due to plugged lube oil cooler tubes and clogging of instrument sensing lines. Erosion has degraded service water system opera-tion by causing leaks through piping, valves and pump seals, allowing service water to enter lube oil coolers.

The majority of licensees have attempted to mitigate and/or prevent corrosion and erosion of service water system components and piping by replacing degraded components with components that are more metalurgically suited to the system environment. Carbon steel piping has been replaced with stainless steel.

Fittings corroded by salt and brackish water have bet.n replaced by brass and bronze fittings, and valve seats and discs have been replaced with higher quality components. Protective pipe coatings, e.g., coal tar, are also widely used to protect service water system piping. Some plants have begun frequent systematic inspections of particularly vulnerable equipment and regularly replace certain components. Several plants (e.g., North Anna and Turkey Point) have installed elaborate water treatment systems to reduce the corrosive nature of the plant's service water.

Microbiological 1y induced corrosion (corrosion caused / aided by the bacteria present in the cooling water) was also reported at several plants, including Grand Gulf, H. B. Robinson, Palo Verde Unit 2, and North Anna. IE Information Notice No. 85-30, "Microbiological 1y Induced Corrosion of Containment Service Water System," discusses the events involving microbiologically induced cor-rosion reported at H. B. Robinson and Palo Verde. The microorganisms which have been responsible for this type of corrosion have been observed in a variety of environments including soils, sediment, fresh water, salt water and brackish water. There are six different classifications of microorganisms con-taining over 30 species that can contribute to corrosion problems, depending on the geographic location and environmental conditions at the plant site. The licensee for North Anna, a plant which utilizes a fresh water lake as its ulti-mate heat sink, has taken multiple corrective actions to try to mitigate the effects of extremely corrosive service water and microbiological 1y induced corrosion. A detailed description of the service water system problems and subsequent corrective actions taken at North Anna is given below:

Corrosion of the Service Water System at the North Anna Flant On April 21, 1981, with both North Anna units operating at 100% power, a pin-hole leak in the "B" service water supply header to the Unit 1 and Unit 2 3-12

charging pumps was discovered (Ref. 6). Although the exact cause of the throughwall leak was unknown, over the years of plant operation the licensee had become aware that corrosion was evident in the service water system piping.

The leak was isolated, the affected piping was replaced. The licensee cont-racted the Energy Research Center of Lehigh University to determine the exact nature of the problem and potential solutions.

The Lehigh of combination study' aggressive water" and bacterial reduction of the mild carbondetermined the steel service water piping. The service water system at North Anna is an open loop system which uses Lake Anna water as its source. An analysis of the Lake Anna water indicated that the water has a very low dissolved solids content and that the total alkalinity and hardness levels are very low. Thus, the water has an affinity to dissolve metal piping. All of this contributes to the water being very corrosive. The Lehigh study estimated that 80% of the corrosion present in the service water system can be attributed to the "aggressive" (corrosive) nature of the water. The Lehigh study also provided positive indication of three types of bacteria in the service water which cause cor-rosion. These are sulfite reducers, ensheathed iron bacteria and filamentous iron bacteria. The study indicated that 20% of the corrcsion present in the service water system can be attributed to bacteria.

From 1981 through 1982, the licensee reported a total of six separate events in which throughwall leaks developed in both the 3-inch and 4-inch service water supply and return lines to the charging pumps and instrument air compressors.

In 1982, the licensee conducted a study to assess the effect of the corrosion on the service water system piping. Approximately 130 locations on the system piping were measured for wall thickness using ultrasonic methods. The data indicated that the 3-inch and 4-inch supply and return lines to the charging pump lube oil coolers had suffered the worst erosion. The piping which sup-plies the instrument air compressors was also severly affected. Pitting and general corrosion were found throughout the system, however, the damage was not as extensive as that affecting the charging pumps and instrument air coolers.

Subsequent surveys conducted in 1983 and 1984 determined the service water corrosion rates ranged from 8 to 14 mils per year.

The licensee's corrective actions include replacing the 3-inch and 4-inch car-bon steel piping serving the charging pump coolers and instrument air com-pressors with stainless steel piping. The licensee also instituted chemical treatment programs to help protect the remaining carbon steel piping against corrosion. The licensee also installed a water treatment system (a Calgon system) to reduce the corrosive nature of the service water.  !

In 1984, the licensee initiated a major effort to completely clean and refur-bish the North Anna service water system. The project, which was completed in February 1987, utilized a hydrolaser (a high pressure jet of water) to remove corrosion products, biological depositions, and clay and silt sludge. The licensee estimates that 26 tons of waste material were removed from the plant's service water system. After cleaning, chemical additives were applied to inner surfaces of the system to inhibit further corrosion buildup. Sections of service water tp tem piping were also replaced during the system refurbishment.

The licensee 5 presently installing a remote electronic sensing system to monitor the s uvice water system for further buildup in corrosion products.

1 3-13

[ _ _ _ - - _

i 3.1.4 Other Types of Service Water System Fouling This section presents operational experience in which service water systems were degraded by two different types of fouling mechanisms: pipe coating failure and calcium carbonate. Two events are discussed in detail: the emer-gency service water system pipe coating and liner failures at Oyster Creek which caused blocking of the system containment spray heat exchangers resulting in a forced unit shutdown; and the fouling of the component cooling water heat exchangers at Turkey Point Unit 3 by calcium carbonate in the intake cooling water system.

Many plants use pipe coatings and liners in their service water systems to pre-vent corrosion of the piping and equipment internals (e.g., Millstone Unit 2, Crystal River Unit 3, and others). IE Information Notice No. 85-24, "Failures i of Protective Coatings in Pipes and Heat Exchangers," discussed several problems I experienced at Palo Verde involving delamination and peeling of the interior epoxy lining in the spray pond piping. The failure of the epoxy coating at i Palo Verde resulted in the complete blockage of the diesel generator governor l oil coolers. The Palo Verde event, and Oyster Creek event which in discussed )

talow, are two operating events in which significant fouling of the service  !

water system components occurred. )

The calcium carbonate fouling experienced at Turkey Point appears to be the result of a unique system design combined with the geological conditions at the plant site. This type of fouling was not reported at any other operating LWR.

Emergency Service Water Pipe Coating Failure at Oyster Creek On July 10, 1985, during operability testing with the Oyster Creek plant oper-ating at power, the differential pressure (D/P) across the emergency service water (ESW) system II containment spray heat exchangers was noted to have increased from 3 psid to 8 psid (Ref. 7). Both of the ESW system II contain-ment spray heat exchangers were subsequently opened and examined to determine if baffle plate damage had occurred. Examination revealed that the heat exchanger inlet tubesheets were blocked with fragments of ESW pipe lining material. The baffle plates, however, showed no signs of damage. The heat exchangers wa-c cleaned and the operability of ESW system II was tested by running the system from July 19 through July 20, 1985. An examination of the heat exchangers revealed significant tubesheet fouling had again occurred.

Both heat exchangers were cleaned and system II was run again until the heat exchanger baffle D/P reached the operability limit on July 21. The ESW sys',em II was then declared inoperable. .

1 On July 21, 1985, because of the problems experienced with ESW system II, an ,

operability test of the ESW system I was conducted. By the next morning (July 1 22), the system I containment spray heat exchanger baffle plate D/P had ap-proached the operability limit (see Fig. 5). To comply with plant Technical Specifications, the reactor was placed in cold shutdown on July 22 and ESW piping inspection and heat exchanger cleaning was commenced.

3-14

i l

ESW PUMP 1-4 I

i CONTAINMENT SPRAY HEAT EXCHANGER 1-4 CONTAINMENT SPRAY HEAT EXCHANGER 1-3 l ESW PUMP 1-3 FROM - M

^

BAY w BAY A

l D A CONTAINMENT SPRAY _

CLEAT EXCHANGER 1-2 l ESW PUMP 1-2 CONTAINMENT SPRAY l

HEAT EXCHANGER 11 E\

V ESW PUMP 1-1 l

Figure 5 Simplified Flow Diagram of the Emergency Service Water System at Oyster Creek

(

l The licensee reported that the heat exchanger high D/P in both ESW trains was primarily caused by accumulations of pipe lining material fragments blocking i the inlet tubesheets. Some marine debris was also found in both systems. The ESW system piping at Oyster Creek is lined with an internal coating of coal tar to help prevent corrosion of the piping. The licensee believes that the pipe coating degradation occurred during the last extended plant refueling outage when the system was drained. While drained, the piping was exposed to repeated I thermal cycles due to outside temperature changes. Apparently, the thermal cycling caused small cracks in the coating allowing corrosion to develop under the coating. The corrosion caused the separation of the coating from the pipe I wall. Additionally, the pipe coating exper'enced damage during the coupling  !

and decoupling of piping spool pieces. It is believed that these pieces of pipe coating broke away from the piping causing the fouling problems. l l

A visual inspection of the internal pipe surface was performed at selected sections of each piping run to determine the extent of damage. The damage was limited to the piping immediately downstream of the ESW pumps. These sections of piping were subsequently cleaned by hydrolazing the surface. Approximately 50 feet of piping in each system was cleaned and the damaged coating in the I affected areas was removed. l The accumulation of marine growth was attributed to operational problems with the intake structure screen wash system. The screen wash nozzles were found to be clogged. Additionally, the flappers designed to brush remaining debris from the screens into the trough were excessively worn, allowing debris to be car-ried over to the pump side of the intake screens and into the ESW piping.

The screen wash nozzles were cleaned and adjusted to improve performance and the flappers were replaced. In order to prevent recurrence, the screens and flappers are inspected monthly as part of the plant's preventive maintenance program.

Calcium Carbonate Fouling at Turkey Point Unit 3 On June 16, 1987, a review of component cooling water (CCW) heat exchanger per- l formance test data from December 1986 revealed that Unit 3 had operated outside l of the temperature limitations placed on the intake cooling water system for I the CCW heat exchangers for approximately 17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> on December 11, 1986 (Ref.

8). The plant was operating at 100% power at the time. The review of the data indicated that CCW heat exchanger cleaning performed in November 1986, was not as effective as the licensee had assumed. A review of the CCW heat exchanger performance tests for Unit 4 indicated a degradation in performance, however, Unit 4 did not exceed the licensee's temperature limitations.

The CCW system heat exchangers are cooled by the intake cooling water (ICW) system (see Fig. 6). The ICW system is an open system which utilizes a cooling canal of salt water for its ultimate heat sink. The cooling canal at Turkey Point consists of miles of canals which are separated from the open ocean. Due to the geological conditions at the Turkey Point site, the canal water used by the ICW system contains a high level of calcium carbonate which comes from the limestone and coral in the cooling canals. This high level of calcium carbonate fouls the CCW heat exchanger tubes necessitating frequent tube cleaning, espe-cially in the summer months. The licensee has found that the CCW heat exchangers  !

have required cleaning as frequently as twice a week in order to maintain an acceptable level of performance.

3-16

4 i

ggSTRAINER

=

TPCW HX'B' 1

> = x _

w s'ay^ a  ! e w

,cw --

I \

PUMP A ' TPCW HX'A

) =

ICW -

TO CANAL I

FROM CANAL CCW HX*A' g STR ER 8

,g i N PUMP C - I _.

CCW HX*8' g STRyER ,

", g TPCW = Turtune Plant Cochng Wates CCW HX*C" CCW = Component Cooling l Water y 7 TO BE l _

' HX = Heat Exchenes, MANUAL BYPASS MLVE (LOCKED OPEN) a I

}

(

Figure 6 Simplified Flow Diagram of the Intake Cooling Water System at Turkey Point i

t Based on tests performed in 1985 and 1986, the licensee had previnusly devel-oped a program to routinely evaluate the CCW heat exchanger perfo,mance. The data collected was used to plot the average heat exchanger tube rasista.1ce based on measured ICW pump flow and ICW inlet temperature. This esta was in turn used to develop CCW heat exchanger rate of fouling curves. The rate of fouling curves placed limits on ICW inlet temperature based on the number of CCW heat exchangers in service (the system consists of 3 CCW heat exchangers) and were also used to determine the frequency for cleaning the CCW heat ex-changers. After cleaning the heat exchangers, the curves were reset back to their original values based on an expected level of heat exchanger cleanliness.

However, the licensee's review conducted on June 16, 1987 determined that the CCW heat exchanger cleaning had not achieved the results anticipated. This caused the plant to exc0ed the licensee's temperature limits as described above.

Previous to this event, the licensee relied on hydrolazing or rodding to clean the CCW heat exchangers. The licensee found that hydrolazing is only partially effective, achieving approximately 50% recovery from the conditions which ex-isted prior to cleaning. Rodding, which is much more time consuming, provided better results than hydrolazing.

In response to this event, the licensee has implemented several corrective-actions to prevent recurrence. The licensee monitors CCW heat exchanger performance by conducting weekly system heat balances. The plant operators ensure that the CCW heat exchanger performance is within the plant's design basis by monitoring ICW water temperature in relation to the fouling curves every four hours. A modification has been completed on Unit 3 which installed on-line mechanical tube cleaning capability for the CCW heat exchangers. The cleaning system (Amertap) introduces sponge rubber balls into the cooling water supply line of each heat exchanger. The normal process flow will force the balls through the heat exchanger tubes, wiping them clean. Screens in the discharge line collect the balls and a centrifugal pump circulates the balls back into the heat exchanger. A ball collector is used to allow addition or retrieval of the cleaning balls. A similar modification is planned to be implemented on Unit 4 during the unit's next refueling outage. The licensee has also implemented a program to test the heat exchanger performance following each cleaning to assure consistency and provide proper data for the CCW heat exchanger trending curves.

3.1.5 Foreign Material or System Fouling by Debris Intrusion Service water system degradation caused by foreign material and debris has been reported by licensees at ten different sites during the period of this study.

Appendix G contains a list of these operating events. One plant (San Onofre Unit 2) had to reduce power on two separate occasions in 1983 (Refs. 9 & 10) because of excessive debris buildup on the traveling screens causing inadequate salt water cooling system flow rates. In both events, the licensee reported that an unusually high surf condition caused a breakup of offshore sea grass formations resulting in an overloading of the plant's traveling screen system. j Other licensee reports indicated system degradation, such as the loss of one l pump, low pump discharge pressure, damage to or excessive clogging of traveling j screens and strainers, or stuck open check valves. The types of debris l 1

3-18 l l

l encountered included rope found wrapped around a pump impeller, eels found lodged in a pump suction, pieces of wood lodged in a check valve, marine debris (grasses and seaweed) clogging traveling screens and other, non-specified, "debris."

The licensees for BWRs indicated that, in the majority of cases (85%), service water system degradations caused by foreign material were discovered as a direct result of routine surveillance and operability testing and during post-maintenance testing. It it important to note that the majority of BWRs are equipped with emergency service water systems which are not generally operated during normal plant operation (e.g. , RHR service water). Therefore, at these plants, service water system degradation caused by foreign material would be expected to be detected during testing. In most of these cases, the various licensees reported that service water system pumps failed during test-ing due to debris fouling the pump impeller. In several cases, the low pump discharge pressure was attributed to debris causing partially stuck open check valves. The remaining 15% of the reports indicated that control room alarms (high pump bearing temperature, low discharge pressure) alerted the operators that a problem existed.

The majority of the reports (75%) from PWRs indicated that system degradations caused by foreign material occurred during system operation and were immedi-ately apparent to the operator through various control room indications. Oper-ators were alerted to fouling through temperature alarms on lube oil coolers, service water system low pressure alarms and the alarms associated with a re-dundant pump auto-start due to low system pressure. In several instances, system fouling was identified during routine checks of system parameters such as pump bearing temperatures, system flowrates, and the D/P across strainers and screens. The remainder of the reports indicated that the service water system fouling was detected during routine surveillance and operability testing and during post-maintenance testing.

Licensees did not typically report how the foreign material and debris passed through traveling screen and strainers to enter the service water systems. In the several instances in which this information was reported, licensees stated that dislodged and/or broken traveling screens allowed various debris to enter ,

the system. Two licensees indicated that the debris must have entered the I system while traveling screens and filters were bypassed for maintenance.

None of the events reported concerning service water system degradation caused by foreign material or debris intrustion were judged to be of suffi:ient sig-nificance to warrant an individual event description.

3.2 Design Deficiencies and Single Failure Vulnerabilities Various design deficiencies involving the service water system have been reported by licensees at 15 different plants since 1980. Seismic deficiencies .

have been placed in a separate category (See Section 3.6) for discussion. The l most significant service water system design deficiencies reported were found to fall into two categories: potential single failure vulnerabilities of the system; and inadequate system flow to provide adequate cooling during a postulated design basis accident.

3-19

3.2.1 Single Failure Vulnerabilities Actual single failures of the service water system and potential single failure vulnerabilities involving the service water system and loads supplied by the service water system were reported at seven plants. The term "single failure" refers to the concept wherein a single component (i.e., a valve, pump, heat exchanger) failure could cause the entire system function to be lost. Table 1 provides a listing of these reports.

Actual instances in which a single component failure caused a loss or the immi-nent loss of the service water system or a vital load supplied by the service water syster,were reported at three plants; Oconee 1, Calvert Cliffs 2, and Surry 2. The remaining operating events in Table 1 involve potential single failure vulnerabilities at four plants, Indian Point 3, Turkey Peint 3, Susque-hanna 1, and Hatch 1. The operating events involving actual single failures and potential single failure vulnerabilities are described below.

Loss of Low Pressure Service Water Systems at Oconee On October 1, 1986, Duke Power Company (the licensee) twice attempted an elec-trical load shed surveillance test of circuits on Oconee Unit 2, which was shut down for refueling at the time. During both tests, the low pressure service water (LPSW) system was lost. Investigation revealed a questionaole design feature which was also applicable to Units 1 and 3. Therefore, the LPSW sys-tems for all three units were considered inoperable and on October 2,1986, orderly shutdowns of Units 1 and 3 (both operating at 100% power at the time) were commenced (Ref. 11).

At Oconee, the condenser .:irculating water (CCW) system takes suction from Lake Keowee and supplies water to the main condensers. The CCW pumps at Oconee per-form safety-related functions which include: supplying a source of water to the LPSW system, the cooling water pump for the standby shutdown facility (SSF) emergency diesel generator (EDG), a supply to the SSF auxiliary service water (ASW) pump, and the primary source for cooling the turbine-driven auxiliary feedwater pump for long-term cooling. The LPSW system supplies cooling water for the decay heat removal function of the low pressure injection system and other safety-related equipment. The LPSW system pumps take suction on the up-stream side of the condenser from the CCW system crossover lines between Oconee Units 1, 2, and 3.

Each of the four CCW pump motors for each Oconee unit is capable of being pow-ered from either of two emergency hydro generators. However, the Oconee plant is designed to accommodate a loss (shedding) of the CCW pumps and still provide LPSW pump suction through a siphon arrangement. The siphon is necessary be-cause of a high point in the CCW piping just downstream of the CCW pumps and upstream of the LPSW pump suction. This high point may be as much as 25 feet above the level of Lake Keowee (depending upon lake level) (see Fig. 7).

On October 1, 1986, while Unit 2 was in a refueling outage, the Unit 2 load shed test was performed. At Oconee, a load shed of non-essential loads is initiated when emergency power is required via the underground feeder from Keowee Hydro Station. The load shed protects this power path from overload.

3-20

Table 1 Service Water System Single Failure Vulnerabilities Plant Name Date Reference Consequences Comments Turkey Point 3 02/14/86 LER 250/86-08 Potential loss of Single failure of one temperature intake cooling control valve causes loss of cooling water. to safety loads.

i Surry 2 08/20/81 LER 281/81-55-1 All HPI service A carbon steel cap screw on one pump I water lost. failed, binding the impeller. The redundant pump shorted as a result of water leakage from the failed pump's cap screw falling onto the pump.

Calvert Cliffs 2 07/20/82 LER 318/82-34 Loss of cooling Loss of saltwater flow caused by fail-to service water ure of a butterfly valve in the common

> heat exchangers. discharge header.

Hatch 1 04/11/80 LER 321/80-39-2 Potential single Plant service water and RHRSW pump motor i

failure of PSW cocling supply regulated by single 1

and RHRSW puups. pressure regulator.

3 Susquehanna 1 10/15/82 LER 387/82-24-1 Potential loss Single failure of one valve in the of service water emergency service water header to the flow to diesels. diesels.

Oconee 1 10/01/86 LER 269/86-11 Loss of emer- Loss of siphon flow from the emergency gency cooling condenser circ. water system to the low

! water sy tem. pressu.e service water system. -

Indian Point 3 03/01/86 NUREG/CR-4565 Potential single Probabilistic study revealed several failure of service single failure vulnerabilities of serv-water system. ice water system including single switch controlling all service water pumps.

1 1

i

f f LAKE KEOWEE l N " " " "I UNIT 2 UNIT 1 CM NMP CM NMP EL 791" (DISCHARGE 11 OF 4i FLANGE) 11 OUT OF 41 EL 800" s

w A WA w &

LA "

" ' F' UNIT 3 v'

VACUUM NM PUMPS PUMPS 1

C

& ~ . ~

h LPSW II OUT OF 31 PUMP i

SAFETY RELATED HXs MAIN MAIN CONO.

COND. Y l I

>

b vm u

vm I EMERGENCY / N FROM UNIT 1 UNIT 3 UNIT 2 NORMAL J k GRAVITY l NORMAL DISCHARGE II DISCHARGE DISCHARGE EL 73(y l

Figure 7 Partial Schematic Of the low Pressure Service Water and Condenser Circulating Water Systems at OcOnee i

I

When the load shed test was initiated, the condenser circulating water pumps were deenergized. Normally, gravity allows the flow of water from the Lake Keowee intake structure through the condenser and discharging to the Keowee

'tailrace into Lake Hartwell. The elevation difference and a siphon configura-tion are used to cause the condenser circulating water to continue to flow.

This mode of operation of the CCW system is referred to as the emergency con-denser circulating water (ECCW) system. For this test, the condenser gravity drain to the Keowee tailrace was blocked because this was not part of the test.

After about an hour, the LPSW pumps began to cavitate and stopped pumping. One LPSW pump was stopped by the control room operator, and a second LPSW pump was observed to have low discharge pressure and cycling electrical current. Vari-ous high temperature alarms for the components cooled by LPSW were rece*vad in the control room. CCW flow was restored by restarting a CCW pump and one plant was restored to its normal power condition without plant damage or system up-sets. Prior to the occurrence, two LPSW pumps were operating with approxi-mately 13,000 gpm per pump. The CCW crossover header, which provided suction for the LPSW pumps, was being supplied by the Unit 2 CCW pumps at the time.

In the evening of October 1, 1986, the test was repeated, but this time the gravity drain feature was also tested. The results were the same as in the first test, i.e., loss of LPSW system function due to loss of LPSW pump suc-tion. At 9:00 a.m. on October 2, 1986, evaluation of the tests revealed that the operation of this design feature (the ECCW system) was questionable for Units 1 and 3, and that this resulted in inoperability of all LPSW systems for Oconee. As a result, an orderly shutdown of the two operating units was begun as required by plant Technical Specifications. Both units reached cold shutdown conditions on October 3, 1986.

The licensee's analysis of the event showed that the loss of suction to the LPSW pumps was caused by a loss of the siphon. The CCW pump dischar0e flange is normally nine feet below the surface of Lake Keowee when the lake is at full i

level. However, because of drought conditions, the lake level was about six feet below the flange at the time of the load shed test. During operation at these reduced lake levels, minor water leakage of the flange had been observed.

This leakage was insignificant during plant operation. However, with the CCW  ;

pumps off (shedded), air inleakage at this flange caused the high point it, the CCW system piping to drain and resulted in a loss of siphon flow.

Siphon flow, if initiated, could not be sustained in the system as originally designed and built, during low lake level conditions because of air inleakage at the CCW pump discharge flange. It appears that previous surveillance tests were not of sufficient duration to determine that siphon flow was sustained. I Since the large volume of water contained in the CCW lines provided LPSW flow l for about an hour before the loss of LPSW suction, it appears that load shed l testing personnel, in the past, may have been misled into thinking siphon flow I had been sustained.

As mentioned previously, the Oconee CCW system is designed to also provide I for the cooling water pump of the SSF EDG and a supply for the SSF ASW pump. '

The SSF was designed to be e backup means to achieve and maintain the plant in a hot shutdown condition. Analysis performed subsequent to the above load shed test showed that if siphon flow were lost in the CCW system pipe, the CCW system I

3-23 ,

i

. , , . .- ----,..r --.. wr--- -.

could not provide an adequate heat sink for SSF operation to meet its design basis of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of operation. In addition, when the CCW pumps are not operat-ing, the CCW system should provide emergency gravity-siphon CCW system flow to the main condensers to recover condensate for DHR following certain postulated events until the' DHR system is in operation. The gravity flow is possible because the CCW system discharge from the main condenser is shifted to an alternate pipe that discharges downstream of Lake Keowee dam at an elevation well below the CCW system '.ntake. This feature of the CCW system also was disabled by the loss of siphon.

In order to prevent recurrence, the licensee modified the discharge flange on all CCW pumps to prevent air inleakage when the lake level is below the dis-charge flange. The LPSW pumps were successfully testea for several hours with the CCW pumps off and the lake level below the discharge flange. The emergency CCW gravity-siphon flow to the main condensers and the SSF EDG cooling water pump also were successfully tested under the above conditions. In addition, the SSF cooling water pump was modified to take a separato and independent suction from Lake Keowee.

The licensee inspected each continuous vacuum priming (CVP) line at the CCW system intake for blockage. Unit 3 lines were clear and vacuum was established on Unit 3 intake high point vents. Unit 1 and Unit 2 lines were found blanked off with blind flanges which prevented the CVP pumps from developing adequate vacuum on the CCW system intake high point vents to overcome air inleakage at the pumps. These flanges had apparently not been removed at the completion of the original system hydrostatic testing. The flanges were removed and a vacuum was established on Unit 1 and 2 intake high point vents.

Successful testing was performed on the condensate steam air ejector, the tur-bine bypass valves (TBV), and the siphon effect. By October 23, 1986, all three units were returned to service.

Further corrective actions planned by the licensee include: (a) develop a pro-  ;

gram to include CCW system piping in a routine inspection, (b) review the val- j idity of the testing program to ensure that systems and components are tested ,

adequately, and (c) review plant Technical Specifications to determine if any l revisions are necessary, i Loss of Salt Water Flow to the Service Water Heat Exchangers at Calvert Cliffs Unit 2 On July 20,19C2, at 1:07 p.m. , with the Calvert Cliffs Unit No. 2 operating at l 35% power, salt water flow to the unit's two safety-related service water heat exchangers (SRWHX) was interrupted when a single, nonsafety-related butterfly valve in the common SRWHX discharge header to the salt water discharge canal failed and system flow caused the valvo disk to rotate to the closed position (Ref. 12). The noise from the sudden valve closure was heard in the control room, and shortly thereafter, the operators reduced power to lessen the heat load on the service water system. The service water heat exchangers serve both safety-related (during accident conditions) and non-safety-related (during normal plant operation) loads (see Fig. 8). During accident conditions, the 3-24

,l iT I lll ' E

_ lw r

m o

w nn L

V o

n o

n nnn

,l f

2 "",w$

w s

2' 2

e

o. o _ D t

_. _ i mv ou a X- _#_ U n

yn cn na _ f s

eo n_ Va atr cn a: _ f i

wa e= _ t.

l C

t

- ' r

_ , e

- v

_ l a

- _ C

_ t a

_ m

_ e D t s

}

=

X S y

n e r

_ e nn sis t t V utv.

n em W a

L @ t mo w

l t

a

_ tw Ya S

- nm e

_ 0 - h X- [- t f

o

_ - m n_ V

_ n a r

g s

_ s =

= i a

_ *s ,

D

_ w

= o

- a l F

r a

me iI 1I L t d e

=

i f

i l

ru sf

- i p

m S

- rL O

II f

l

/ 8

- N I' l

- 1J e

- r gr -

o,

= i F

u g

f '~

f,\ ( _~

=

g

service water system provides cooling to all three containment air coolers and the plant's emergency diesel generators. At 1:30 p.m., the licensee was able to partially restore service water cooling by aligning salt water flow to nne SRWHX and discharging to the emergency salt water overboard line. A power decrease was initiated at 2:05 p.m.

No high temperature alarms were received on equipment cooled by the service water system. The peak outlet temperature for No. 22 SRWHX was 110'F. During the next day, the licensee verified that no additional damage had occurred from the sudden valve closure and water hammer shock wave. The failed butterfly valve (25W197) was replaced and salt water cooling flow was restored to both of the two service water and component cooling water heat exchangers at 10:40 p.m.

on the second day after the event.

The failed butterfly valve, 25W197, is a Henry Pratt Co., Triton XR-70 manually actuated 30-inch Butterfly valve. The valve failed when two taper pins that connect the valve operator stem to the valve disk sheared. A third pin, the single pin that connects the disc to the bottom stub shaft, remained intact and fluid forces on the valve disk caused it to rotate to the closed position. The replacement valve was installed 90' rotated in the same plane from its original ,

position in an attempt to reduce the flow induced closing rotational forces on j the valve disk.

The licensee's final corrective action to prevent recurrence was to remove )

valve 25W197 internals to allow unrestricted discharge to the bay.

Complete loss of Charging Pump Service Water at Surry Unit 2 l

On August 20, 1981, while Surry Unit 2 was operating at 100% power, both charg-ing pump service water pumps failed. Initially, the B charging pump service water pump seized when thr: carbon steel impeller cap screw failed. This allowed the impeller to slide off the pump shaft, binding the shaft. The re-dundant A charging pump service water pump then failed to automatically start on low system pressure. The operators attempted to manually start the pump, but the pump tripped on overload. Repetitive attempts to start the pump failed. Investigation revealed that water from the failed B pump had fallen I onto the A pump (located directly underneath the B pump), shorting the motor stator windings. In accordance with plant Technical Specifications, the plant operators commenced a power rampdown in preparation for a plant shutdown.

Approximately four hours into the event, the B charging pump service water pump ,

was returned to service and the plant was returned to full power operation. I The A charging pump service water pump was returned to service approximately 12 l hours later (Ref.13).

The licensee determined that the B pump impeller cap screw had failed because l of the corrosive nature of the service water. The licensee's immediate corree- l tive action was to replace the impellar cap screw and return the B pump to service. The A pump's motor stator and bearings were then replaced. A tempo-rary mechanical shield was placed over the A pump to prevent water from the 8 pump from splashing on the A pump. The licensee also inspected the impeller cap screw on the A pump as well as the Unit 1 charging pump service water pumps to ensure their integrity. The licensee's long term corrective action included replacing the charging pump service water pumps at both units with pumps more suitable to the brackish service water environment.

3-26

Potential Loss of the Intake Cooling Water System at Turkey Point On February 14, 1986, while Turkey Point Unit 3 was operating at 100% power and Unit 4 was in a scheduled refueling outage, Unit 3 was shut down due to the concern that the intake cooling water (ICW) system would be unable to meet flow requirements during a design basis accident. The licensee identified two poten-tial single failures of the ICP :yrte.n: (1) the potential failure of control valve CV-2202 (shut) would result in a loss of all cooling to the component cooling water (CCW) heat exchangers and, (2) the potential failure of CV-2201 (open) could result in the ICW system not being able to provide required flow to the CCW heat exchangers during a design basis accident (see Figure 6). The CCW system provides cooling to the following safety related equipment; safety injection pumps, RHR pumps and heat exchangers, normal and emergency containment coolers and the containment spray pumps (Ref. 14).

Pneumatically controlled v71ve CV-2202 is the outlet control valve which regu-lates the ICW flow through the CtW heat exchangers. The u.fety function of CV-2202 is to remain open (or open further in response to increasing CCW tem-peratures) during a design basis 3ce. dent to allow ICW flow to the CCW heat exchangers. If CV-2202 failed in the closed position, all IC1' system flow to the CCW heat exchangers would be lost.

Pneumatically controlled valve CV-2201 is the outlet control valve which reg-ulates the ICW flow through the turbine plint coolirg water (TPCW heat exchangers.

In addition to its normal control function, CV-2201 receives a closure signal in the event cf a safety injection signal and t loss of voltage (i.e., loss of offsite pows r) to ensure adequate ICW fim: is directed to the CCW heat exchangers.

In the even* cf a loss of its air so;giy, since CV-2201 is normally open ouring plant operation, it can be posti.iated that the valve will fail in the open posi-tion. Failure of CV-2201 to close could result in inadequate ICW flow to the CCW heat exchangers in the event of a design basis accident.

The licensee has taken several corrective actions to present the potentici single failure of the ICW systems at both units. The manual bypass valve around CV-2202 has been locked open to er.sure adequate ICW flow to the CCW heat exchangers in the event that CV-2202 fails closed. The licensee has determined '

t%t this bypass flowpath is capable of accommodating the required ICW flowrate )

without reliance on CV-2202. As an interim action, the licensee stationed an i

operator at CV-2201 who is in radio cor:.T.unication with the control room to iso- '

late CV-2201 if the valve fails to close during a demand situation. On a longer term basis, plant Technical Specifications and operating procedure modifications have been proposed.

Potential Lor of Emergency Service Water Cooling to the Diesel Generatorr. at l Susquehanna On October 15, 1982, during an outage from startup testing at Susquehanna, the licensee determined the potential existed for an unanalyzed accident to result f'or a single failure of a spray pond bypass valve rendering the emergency  ;

ret,':e water (ESW) system cooling to the emergency diesel generators (EDGs) i ix.;weable (Ref.15). At Susquehanna, the normal plant alignment is such that I all four EDGs are cooled by the A ESP loop. Redundancy is provided by an au-t)matic transfer to the B ESW loop upon failure of the A loop pumps to start.

The licensee determined that if the A ESW pumps started as designed, but the A 3-27

I loop spray pond valve failed to open (single failure), cooling to the EDGs would be lost because the automatic trcnsfer to the 8 loop would not occur.

This deficiency was not previously identified because the original configura-tion of the ESW system was such that the spray pond bypass valves were normally open. However, because of waterhammer problems experienced during operation, l

the ESW tystem configuration had been changed several months earlier to have the spray pond bypass valves normally closed and to sutomatically open the valves on demand.

To prevent the pessibility of a single failure of a spray pond bypas valve from

, causing a loss of all cooling to the EDGs, the licensee installed a low flow .

. detector in the ESW system which will cause an automatic transfer to the B ESW loop is low flow is sensed in the A ESW loop.

Potential loss of Cooling Water to all Plant Service Water and RHR Service 2 Water Pumps at Hatch Unit 1 On April 11, 1980, while Hatch Unit 1 was operating at power, the licensee discovered that neither the plant service water (PSW) nor the residual heat removal (RHR) service water pumps' cooling water supply met the single failure '

criterion. The cooling water supply to the PSW and RHR service water pumps is contrclied by a single pressure regulator. Failure of this pressure regulator would result in a loss of cooling water to the PSW and RHR service water pump motor coolers. Upon discovery of this potential single failure vulnerability of tha PSW and RHR i.ervice water systems, the licensee took immediate action ,

to make the pressure regulator k passive device and monitor the cooling water i supply te the pumps manually. The licensee then modified the systs to resemble the configuration of the PSW and RHR service water systems at Hatch

Unit 2, creating a redundant cooling water supply for the pumps.

3.2.2 Service Water System Design Deficiencies i Ten plants reported inadequate service water system flow for various modes of accident and post-accident system operation due to design deficiencies.

Table 2 provides a list of these reports. A brief summary of five of these reports, which are representative of the types of design deficiencies reported, is presented as follows:

1. On August 20, 1981, with Sequoyah Unit 1 operating at 100% power, the li-censee determined that under worst case conditions, the essential raw cooling j water (ERCW) system would not provide the necessary flow to the following j l safety-related equipment: the diesel generators, containment spray heat t exchangers, charging pump room coolers, charging pump oil coolers, safety injection pump room coolers, safety injection pump oil coolers, and contain-ment spray and RHR room coolers (Ref. 16). This was caused by a design error in which the ERCW component cooling water heat exchanger outlet valve I was allowed to go 100% open upon receiving a safety injection signal. l 2 Flow requirements for the ERCW system require that the valve only opens 35%.

s  :

2. On November 30, 1985, with Davis-Besse Unit 1 in cold shutdown, the li- '

l censee (Toledo Edison Company) determined that only one of the two

)

j 3-28

O Tat'e 2 Service Water system Design Inadequacies Plant Name Date Reference Consequences Comments Sequoyah 1 08/20/81 LER 327/81-101 Service water sys- In worst case scenerio, the service ten would not pro- water system would provide inadequate vide adequate flow. flow for EDGs, cont spray, HPI, SI, ,

RHR room coolers and other loads.  !

North Anna 1 03/28/85 LER 338/85-04-1 Potential common 50 ft of service water supply and mode loss of ser- return piping between the pumphouse vice water system. and safeguards area do not meet tornado protection requirements.

Palisades 08/19f82 LER 255/82-24-1 Potential loss of Service water pump runout could occur all service water as a result of CCW HX outlet valves flow during a loss failing to open during a loss of

{

e of offsite power. offsite power.

Davis-Besse 1 11/30/85 LER 346/85-22 Only one of two Design deficiency involving service trains of contain- water cooling to CAC HXs.

ment air cooling available post LOCA.

Fermi 2 06/24/86 LER 341/86-17 Emer. equip. cool EECW system capacity inadequate to water capacity in remove drywell cooler heat loads adequate for DBA. during small break LOCA.

Susquehanna 1 09/10/82 LER 387/82-12-1 Potential to over Caused by service water pump start load class IE elec sequence.

trical system.

Oconee 1 10/15/86 LER 269/86-12 Standby shutdown SSF was of insufficient volume facility had insuff. to accomplish function during cooling DBAs.

Palisades 09/30/86 LER 255/86-36 Inadequate service Testing of service water pumps t;ater system flow. revealed flow below FSAR requirements.

Caused by inadequate system design and unraodified pump impellers.

u.-___ ___ _ ._ -_ _ _ _ _ _ _

Table 2 (Continued)

Plant Name Date Reference Consequences Comments Byron 1 05/01/84 IE IN 86-11 High potential Loss of service water system presents core melt high potential core melt probability.

probability.

Farley 1 11/12/80 LER 348/80-67 Potential loss of Water for lubricating and cooling of

both service water each train's pumps supplied by trains. opposite train.

Farley 2 11/12/80 LER 364/80-01 Potential loss of Water for lubricating and cooling of both service water each train's pumps supplied by trains. opposite train.

8 I

T i

4

independent trains of containment air cooling (CAC) would be available to provide the required cooling during post-loss-of-cooling-accident (LOCA) conditions (Ref. 17). The arrangement of the CAC units at Davis-Besse is such that one CAC unit receives cooling water from one service water sys-tem train while the two remaining CAC units receive cooling from the redundant strvice water train. The licensee determined that pump net positive suction head and/or system flow balance problems may exist in the service water train feeding the two CAC units.

3. On June 24, 1986, with Fermi Unit 2 in cold shutdown for refueling, the licensee (Detroit Edison Company) determined that the emergency equipment cooling water (EECW) system capacity may not be adequate to remove drywell cooler loads during a postulated small break accident (SBA) inside the drywell (Ref. 18). The licensee datermined that the drywell portion of the EECW sy: tem will not automatically isolate during an accident. During a postulated SBA, the added heat load of the components in the drywell could limit the EECW system effectiveness at removing the heat generated by equipment required during and after the accident.

4. On September 30, 1986, with Palisades in cold shutdown, flow testing of the service water pumps revealed that the pumps were incapable of meeting the flow and head requirements specified in the FSAR (Ref. 19). An evalua-tion determined that during a design basis accident, the failure of even one service water pump (the system consists of three pumps) would result in insufficient cooling to the criti a1 system loads (component cooling heat exchangers and diesel generators, among others).

5. On November 12, 1980, as a result of maintenance activities on the Farley Unit 1 service water lubrication and cooling system, the licensee determined that the water for lubrication and cooling of the A train service water pumps was provided by the B train service water header and the B train service water pumps by the A train service water header. Examination of the Unit 2 service water lutrication and cooling system revealed an identical problem. This lack of complete train separation results in the potential for a failure in one train to adversly affect the redundant train.

The licensee attributed this situation to a design error in the piping layout for the service water lubrication and cooling system. A design change was implemented at both units to ensure complete train separation for both service water system trains (Refs. 20 and 21).

3.3 Service Water System Events Involving Floodina During the period examined in this study, seven licensees have reported events in which service water system leaks caused localized flooding. Four licensees

have reported conditions which could potentially result in service water system flooding. A list of these events is presented in Table 3. Three of theJe events were selected for discussion. The first of these events, which occurred at Indian Point Unit 2 on October 17, 1980, led to the issuance of IE Bulletin No. 80-24, "Prevention of Damage Oue to Water Leakage Inside Containment."

Another event, which occurred at Salem Unit 2 on June 23, 1983, resulted in flooding of the plant's service water bay and the third event, which occurred at Zion Unit 2 on May 21, 1987, caused the flooding of the plant's oil storage tank room. A description of these operating events is presented below.

3-31

I

~

, s t

1 Table 3 Service Water System Events Involving Actual or Potential Flooding ,

Plant Name Date Reference Consequences Comments i

l San Onofre 1 05/13/82 LER 206/82-15 Potential loss of Maintenance procedure did not specify o.w saltwater adequate precautions.

1 cooling pump.

} - >

Haddam Neck 02/05/86 LER 213/86-09-2 Potential flooding Flood protection equipment was inade-  !

l j of 2 of 4 service quate to prevent potential flooding of:

j water pumps. the pumps.

Surry 2 07/28/82 LER 281/82-39 Potential loss of The valve pit was flooded, shorting 2

service watar pump. the valve motor. Flooding caused when l draining the condenser waterboxes for 1 cleaning.

t

[ Indian Point 2 10/17/80 IE Bulletin 80-24 Flooding of 100,000 gallons found'in containment 4

N containment. from service water leakage. Reactor pressure vessel wetted.

]

i 4 Salen 2 06/23/83 LER 311/83-32 Loss of all service 6 feet of water in the service water water. bay due to failed gasket in piping.

I Gasket failure attributed to poor t i installation.'

i

Sequoyah 1 01/15/85 LER 327/85-05 Potential loss of ERCW piping downstream of EDC coolers I Soth EDGs dta to not seismically qualified. Failure l flooding. could result in localized flooding  ;

of EDGs.

Davis- Besse 1 06/18/84 LER 346/84-09-2 Both pump rooms Both AFW pump rooms could be flooded j potentially in the event non-seismic turbine floodable. plant cooling water piping serving

! the AFW coolers ruptured. ,

Quad Cities 1 10/23/80 LER 254/80-28 Potential loss of Leak on a RHR service water pump i EDG. flooded the 1/2 EDG cooling water i pump motor. Existing sump pump system inadequate to handle i

flooding.

Table 3 (Continued) .

Plant Name Date Reference Consequences comments Quad Cities 06/17/85 LER 254/85-08 1/2 EDG cooling Broken vent line on RHR service water water pump pump flooded vault with service water inoperable. pump and 1/2 EDG cooling water pump.

Browns Ferry 1 0D/22/81 LER 259/81-47 Loss of 3 RHRSW RHRSW pump air vacuum valve failed

! pumps and 3 EECW tc seal and the A RHRSW pump room pumps. ficoded. Rer.dered A1, 2, 3 RHR SW/EECW pumps inoperable.

Trojan 03/09/87 LER 344/37-06-1 Potential loss of Service water strainer pit drain line EDGs and AFW pumps. did not have check valve to prevent backflow.

] Zion 2 05/21/87 PNO-III-87-73 Loss of long term Service water flooded EDG fuel oil i

EDG operability. storage tank room due to maintenance i' personnel error.

U i

a I

1 1

4 1

0 0

Conta 4 ment Cooler Leaks and Rea. a Cavity Floodina at Indian Point Unit 2 On f,ctober 17, 1980, upon containment entry at Indian Point Unit 2 to repair a malfunctioning power range nuclear detector, it was discovered that a signifi-cantamountofwater(approximately 100,000 gal) was collected on the contain-melt floor, in the containment sumps, and in the cavity under the reactor pres-sure vessel. This collected water probably caused the detector malfunction, and the water in the cavity under the reactor pressure vessel is believed to have been deep enough to wet several feet of the pressure vessel lower head, causing an unanalyzed thermal stress condition of potential safety significance (Ref. 22).

The majority of the source of the water was attributed to significant, multiple service water leaks from the containment fan cooling units directly onto the containment floor. These coolers have a history of such leakage which could not be detected by supply inventory losses since the supply system (service water system) is not a closed system.

The flooding also resulted from the following combination of conditions:

(1) Both containment sump pumps were inoperable, one due to blown fuses from an unknown cause and the other due to binding of its controlling float; (2) The two containment sump level indicating lights which would indicate the water level range present in the containment were stuck and may i. ave been for several days, leaving the operator with no operable instrumentation to measure water level in the containment; (3) The moisture level indicators in the containment in the containment did not indicate high moisture levels, apparent)j hecause they were designed to detect pressurized hot water or steam leaks ann vere not sensitive to 'the lower airborne moisture levels resulting from relatively small cold water leaks; (4) The hold-up tanks which ultimately received water pumped from the containment sump also received Unit 1 process water and lab drain water.

These other water sources masked the effect of cessation of water flows from the Unit 2 sump; (5) The two submersible pumps in the cavity under the reactor pressure vessel were ineffective since they pumped onto the containment floor for ultimate removal by the (inoperable) containment sump pumps. There was no water level instrumentation in the cavity under the reactse pressure vessel, nor was there any indication outside the containment when these pumps are running.

To prevent recurrence, the licenseo installed redundant sump level annunciated alarms in the control room and installed an annunciated alarm in the control room to indicate if either submersible pump in the reactor cavity activates.

The licensee also repaired the service water leaks, installed guide bushings on the sump pump control floats to prevent their binding, and repaired the contain-ment sump water level indicators. Finally, the licensee replaced the contain-ment fan unit cooling coils.

Flooding of the Service Water Bay at Salem Unit 2 On June 23, 1983, with Salem Unit 2 shutdown in mode 5, an equipment operator performing routine surveillance discovered a large leak in the No. 2 service water bay. Upon receiving the report of flooding, the control room operators attempted to isolate the leak. Suspecting that the No. 21 service water header flexible coupling had failed, the operators shut the header supply valve, 225W20.

J 3-34

Due to an accumulation of approximately 6 feet of water in the bay and an appar-ently continuing rise in the level, all operating service water pumps were then stopped to protect the pump motors. The leak was isolated manually and the flooding was stopped before reaching the service water pump motors. After iso-lating the No. 2 service water bay, service water was reestablished to both ser-vice water headers approximately one hour after the event had begun by opening the service water header cross-connect valves and using the No. 22 service wa-ter header pumps to provide service water flow to both service water trains.

(Ref. 23). Investigation revealed that the leak was due to a failed expansion gasket joint downstream of check valve 225W5, a 24 inch valve on the No. 21 service watee header. The joint connection had recently been reassembled fol-lowing cleaning of the No. 21 service water header. The licensee stated that installation and proper tightening of the connection was difficult due to physical obstruction of access to the rear of and underneath the flange. The failure was, therefore, likely due to the inadequate installation of the gasket.

Previous to this event, the original sump pumps in the service water bay had failed and had been replaced with temporary pumps until a design change to install improved pumps could be implemented. The temporary pumps required manual operation by the operators upon receipt of a high sump level alarm.

Apparently, the alarm did not provide adequate warning to the control room operators.

The licensee's corrective actions included installing a new gasket, reconnecting I the joint, and testing the service water system. The design change for improved, permanent sump pumps and alarm funct. ions for the service water bay was expedited.

Floodina of the Diesel Fuel Oil Tank Rooms at Zion Unit 2 l On May 21, 1987, with Zion Unit 2 in a refueling outage and no fuel in the reactor vessel, licensee personnel discovered water leaking through the doors of the Unit 2 diesel fuel oil storage tank rooms (575 foot elevation) into the turbine building (560 foot elevation). Both 2A and 2B diesel generators were out of service for maintenance work at the time. Investigation revealed that I roughly 11 feet of service water had accumulated in the 2B fuel oil stort.ge l tank room and that approximately 8 feet of water had accumulated in the 2A l room (Ref. 24).

The event was primarily caused by maintenance errors. Initially, a work request had been written on April 21, 1987, to open a service water check valve located in the 2A diesel fuel oil storage tank room for inservice inspection (ISI) purposes. Because of problems encountered in isolating the check valve from i service water flow, a separate work request was generated to open a parallel l check valve located in 28 diesel fuel oil storage tank room for inspection.  :

However, the work request did not identify the correct room where the valve to be tested was located and, at Zion, check valves do not have tag numbers.

These problems, combined with shift changes and the involvement of contractor personnel, inspection staff and operators, led to the bonnets being removed i from both check valves (one check valve in each diesel fuel storage tank room). l Only the 2A storage tank room check valve was inspected and its bonnet re-l installed. Operations personnel then aligned service water to provide cooling to the diesels and initiated flow in preparation for surveillance testing.

Opening of the service water supply to both diesels led to a len through the I

3-35

l check valve in the 28 storage tank room. The water level increased in the tank j room until it began to rise above the level of the floor jamb of the personnel '

access door to the turbine building at which point it began to flow out of the room onto the turbine building basement floor. Water also spilled into the 2A storage tank room via the connecting door between the 2B and 2A rooms and prob-ably through the common floor drain lines. Upon discovery, flow to the perti-nent portion of the line was terminated and the room doors opened. The li-censee estimates the amount of water in the 28 and 2A storage rooms as apprcxi-mately 105,000 and 76,000 gallons, respectively.

The licensee identified the following equipment as requiring inspection prior to returning to service: the diesel fuel oil transfer pumps associated with the 2A and 2B diesels, diesel fuel oil contained in both the 2A and 2B storage tanks, local controls for two service water cross-tie valves, and the 20 conden-sate and condensate booster pumps. The condensate pumps required inspection because water sprayed on the pumps when the 28 storage room door was opened.

To prevent recurrence, the licensee has required that all work performed by the maintenance contractor be checked by the licensee's maintenance staff. In addi-tion, quality control personnel were requit M to review all work in progress that was performed by maintenance contractor personnel with particular attention to out of service equipment maintenance and work preparation and documentation.

3.4 Service Water System Degradations Due To Equipment Failures Since 1980, random equipment failures affecting the service water system had been reported by almost every licensee of an operational LWR, The majority of the events reported involved relatively rout!ne failures which had little impact on the immediate operability of the system. For example, these types of fail-ures included a sticking float in a service water flow indicator, a seal leak on a chiller, or a valve that would not fully stroke. The most significant service water system events involving equipment failures are listed in Table 4.

Four events in which equipment failures resulted in the complete inoperability of the service water system at four different LWRs occurred during the period examined in this study. One of the events was the subject of an indepth AEOD case study report, "San Onofre 1: Loss of Salt Water Cooling Event on March 10, 1980," AEOD/C204, issued in 1982. Descriptions of these operating events are presented as follows.

Loss of Salt Water Coolino Event at San Onofre Unit 1 At 9:15 p.m. on March 10, 1980, while San Onofre-1 was operating at 100% power, the shaft on the inservice south salt water cooling (SWC) pump sheared due to fatigue from excessive vibration. The north SWC pump started automatically as ,

designed, but its discharge valve, which is designed to open automatically when l the pump starts, did not open. The discharge valve failed to open due to a l failed aie supply solenoid 0-ring. The solenoid 0-ring is believed to have J failed due to abrasive action of desiccant which had migrated through the in- l strument air system to the valve. As a result of the discharge valve failure, '

the north SWC pump was also inoperable at 9:15 p.m. The control operator man-  !

, ually started the auxiliary SWC pump from the control room at 9:20 p.m. At l 9:25 p.m. the control operator and the watch engineer were made aware by the assistar.t control operator that the auxiliary SWC pump was not providing any I

3-36

Tabte 4 Service Water System Events Involving Equipment Failures Plant Name Date Reference Consequences Comments San Onofre 1 03/10/80 LER 206/80-06 Complete loss of One pump shaft sheared (vibration),

salt water cooling 2nd pump discharge valve failed system. (mech. failure) and the aux. pump lost suction due to inadequate prime.

4 i Salem 1 03/16/82 LER 272/82-15 Loss of all service One redundant train of CCW and ser-water and compo-- vice water pumps tagged out for nent cooling. maintenance. Loss of one vital bus

! (short) caused loss of all service water and CCW for about 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

Catawba 1 11/25/85 LER 413/85-68-1 Loss of both Torque switches for a supply valve nuclear service and a discharge valve in each i

i water trains. train were sec at the low end of i' the allowable tolerance. Valves R$ failed in mid position.

I' Catawba 2 07/08/86 LER 414/86-31-1 Both EDGs Both EDGs inoperable due to dif-inoperable. ferent mechanical problems causing both service water trains to be i

inoperable.

j Hatch 1 08/22/80 LER 321/80-103 Both strainers for Coupling failure on B backwash drive

plant service mechanism and tripped breaker on A I

water clogged. backwash drive mechanism.

l i Hope Creek 1 05/12/86 LER 354/86-18 Loss of 2 of 4 ser- Mechanical failure of strainers.

i vice water system strainers.

Hatch 2 08/13/82 LER 366/82-85-1 Loss of A and C RHR Cavitrol trim (anticavitation SW pumps. device) failed. AE recommended replacement of device every 1 2 years.

4

O Table 4 (Continued)

Plant-Name Date Reference Consequences Comments Susquehanna 1 05/24/86 LER 387/86-21 Forced shutdown of All 4 ESW pumps declared inoperable both units. due to cavitation damage. Damage caused by operating pumps at less j than designed flows.

Surry 1 09/29/86 LER 280/86-29 Potential loss of With one service water pump out for all high pressure maintenance, the remainiag service

, injection pumps. water pump became airbound due to a leak on a strainer blowdown line.

l Service water flow to the charging l pump service water subsystem was lost.

i l , Surry 1 03/23/87 LER 280/87-07 Loss of 2 of 3 Inadequate service water flow due e control room to seal leaks on chillers.

E chillers.

1

+

1 l

1 3

a

coolant flow. The SWC system was rendered inoperable due to the unavailabil-

. ity of the flow paths associated with the north SWC pump, the south SWC pump, and the auxiliary SWC pump (Ref. 25).

Shortly after 9:30 p.m. , the watch engineer and a plant equipment operator cross connected the discharge salt water flow from the screen wash pumps to the discharge piping at the r. orth SWC pump. This connection provided sufficient cooling to the bottom CCW heat exchanger to stop the increase in the CCW supply temperature (from 66'F to 82'F in ten minutes), and brought the CCW temperature down to a new equilibrium value of 70'F (Ref. 25). The high temperature alarm setpoint is 97'F.

At 9:56 p.m. the control room operators successfully restored the auxiliary SWC pump and aligned it to deliver flow to the top CCW heat exchanger. Because that heat exchanger was not receiving CCW flow at the time, the auxiliary SWC pump flow had no effect on CCW temperature. In anticipation of a unit shutdown, the watch engineer directed a load reduction from full power beginning at 10:00 p.m.

After reducing the unit load from full power by about 3 HW, and after discussing the situation with the supervisor of plant operations, the watch engineer stopped the load reduction. At 10:13 p.m. , the top CCW heat exchanger was placed in service, thereby enabling the auxiliary SWC pump flow to remove heat from the CCW system. At 12:05 a.m. on March *1, 1980, the discharge valve on the north SWC pump was 5.ade operable, thereby concluding the event. Throughout the event the unit we' maintained at or near full power.

The SWC system supplies cooling water to the CCW heat exchangers (see Fig. 9),

which in turn cool the following safety-related equipment: RHR pumps, RHR heat j exchangers, reactor coolant pump oil coolers, charging pump oil coolers, excess letdown heat exchanger, seal water heat exchanger, and recirculation heat exchanger.

To prevent recurrence, the licensee took the following corrective actions:

(1) The licensee reviewed the plant's limiting conditions for operation (LCOs) and emergency operating instructions. As a result, the licensee revised the instructions to clearly specify time constraints during which required action must be taken. Licensed operators received additional training emphasizing in the need to fully and promptly implement the requirements specified in the emergency operating instructions. The training stresses the requirement to promptly shut down the reactor when it is operating outside an LCO.

(2) The licensee has undertaken a major overhaul of the plant's preventive main-tenance program. The licensee hired an engineering consultant to prepare a detailed computerized maintenance program.

(3) The plant's entire instrument air system was blown down. New desiccant was installed, as has a new air filtration system including instrumentation to measure the pressure drop across the filters.

(4) The inservice testing program was upgraded. SWC pump testing now includes thrust bearing vibration measurement, t

)

3-39

INTAKE FROM OCEAN SALT WATER SCREEN SOUTH COOLING PUMPS NORTH WASH PUMP S A E TURBINE PLANT COOLERS ~ ~

AND ORCULATING WATER PUMP DeSCHARGE POV6 POV5 2 k HNIC NIC

\/ N '

OUT IN AuxeuARy w COMPONENT CROSS tie SALT WATER i

o i t COOUNG MATER MOV 720A '

v ', POV-11 COOUNG PUMP NIC OfSCHARGE TOP \#

F'

} INTAKE FROM TO OCEAN

& COMPONENT COOLING NIC OCEAN HEAT EXCHANGER IN GOUT COMPONENT MOV N i r COOUNG WATER

& COMPON OOUNG TO . HEAT EXCHANGER N/C - NormeRy Closed MOV - Moeor Opereced valv.

Pov - %.r 0,.r d vs (Aie Opos.esol I Figure 9 Simplified Flow Diagram Of the Salt Water Cooling System at San Onofre Unit I t

(5) The auxiliary SWC pump's priming system was modified in an effort to improve its reliability. Furthermore, the licensee has included the auxiliary SWC pump in their inservice testing program.

Inoperable Emeraency Service Water System At Susquehanna On May 22, 1986, with both Susquehanna units at power, an overcurrent alarm for the C emergency service water (ESW) pump was received in the control room.

Investigation revealed the pump motor was running at low current and the pump discharge check valve was closed. Suspecting a sheared pump shaft, the licensee declared the C ESW pump inoperable and entered the applicable LCO. On May 23, upon disassemb1) of the C ESW pump, the licensee found that the bottom portion of the pump suction bell had separated from the pump body and had fallen into the pump pit. The cause of the breakage was attributed to pump cavitation. On May 24, an inspection by an underwater diver found similar but less severe dam-age to the A ESW pump suction bell. The A ESW pump was declared inoperable.

Since the condition of the remaining B and D ESW pumps was not known, both pumps were also declared inoperable. Subsequently, on May 24, a controlled shutdown of both units was performed (Ref. 26).

A subsequent visual inspection found that both the B and D ESW pumps had cavita-tion damage similar to the A and C ESW pumps. Since the cavitation damage did not penetrate the suction bell wall of either the B or D ESW pump, both pumps were declared operable on May 28, 1987. Following receipt of the necessary spare parts, the A and C ESW pumps were repaired, retested and declared operable on June 6. The B and D ESW pumps were then removed from operation, repaired, retested and declared operable on June 10. The repairs included replacing the impellers and suction bells of all four pumps as well as other miscellaneous parts.

Due to their similar design, the licensee also inspected the residual heat re-moval service water (RHRSW) pumps. Cavitation damage was found on the impeller liners on A and B RHRSW pumps for Unit 1 and the liners were replaced. No dam-age was found on the Unit 2 RHRSW pumps.

Inspection of the suction bells and impellers from all the ESW pumps revealed that the cavitation originated on the high pressure side of each impeller vane at its suction end, which is indicative of impeller suction recirculation cavi-tation. This type of cavitation is caused by operating the pumps significantly below their design flowrates. Operation at lower flow creates mismatches of the flow angles within the pump and causes water to recirculate back towards the suction. The recirculating currents cause local pressure zones which are below the vapor pressure of the water. This causes vapor bubbles to form which subsequently collapse when a higher pressure zone is reached, eroding the mate-rial in that location. The cavitation erodes the suction bell wall at a faster rate than the erosion of the impeller. Once the suction bell wall is pene-trated, erosion of both the suction bell and impeller is accelerated as water is drawn through the suction bell penetrations.

The current system operating configuration requires the ESW pumps to be run at flows significantly below their design flow of approximately 6000 gpm. Each ESW loop is flow balanced for two operating pumps with all diesels aligned.

3-41

However, all four diesels are normally aligned to the A loop of ESW in order to meet single failure criteria (the diesels can only auto transfer from A loop to B loop). One pump in either loop can supply the required flow for all its loads if the diesels are not aligned to that loop. With the diesels aligned, neither loop can provide design flow to its loads with only one pump in operation. When the loop supplying the diesels is run with two operating pumps, each pump de-livers approxirrately 3500-3900 gpm. Pump operation in this range is likely to -

cause suction recirculation cavitation. The loop of ESW that is not serving the diesels (usually the B loop) is normally run with only one pump at approxi-mately 1000-1500 gpm. This operation also causes suction recirculation cavitation.

Besides repairing the ESW pumps, the licensee's corrective action included per-forming flow balances for both ESW loops to verify design flow to all loads during operation. Operational and system design changes as well as modifica-tions to the pumps are being considered. The licensee is conducting periodic inspections to ensure pump integrity.

Loss of Plant Service Water Flow due to Plugged Strainers at Hatch 1 ,

On August 22, 1980, with the Hatch Unit I reactor operating at 99% power, high pressure alarms on the inlet of both plant service water (PSW) strainers were received in the control room. High temperature alarms on various equipment served by the PSW system were also received, indicating that the flow of plant service water was being restricted. The operators declared both divisions of PSW inoperable, entered the applicable LC0 and commenced a plant shutdown (Ref. 27).

Subsequent investigation revealed both PSW strainers were partially plugged (see Fig. 10). Apparently, a coupling failure on the B backwash drive mecha-nism prevented adequate cleaning of the B strainer. The power supply breaker for the A strainer backwash drive mechanism was found in the tripped position, Therefore, neither strainer mechanism was being adequately cleaned and this resulted in the eventual clogging of the strainers. Both Unit 2 strainers were inspected but no abnormalities were observed.

The licensee's corrective actions included repairing the broken coupling on the B strainer backwash drive mechanism and resetting the A strainer backwash drive mechanism breaker. Both strainers were then backwashed and both divisions of PSW returned to service.

Loss of Vital tus Leads to loss of all Service Water and Component Cooling Water at Salem lnit 1 On March 16, 1982, while Salem Unit 1 was shutdown in Mode 5, the 1A vital bus undervoltage annunciator alarmed and the control room operators observed that the 1A vital bus was de-energized. Power was lost to No. 11 component cooling pump and the Nos. 15 and 16 service water pumps. Because the redundant compo-nent cooling pumps and service water pumps had been previously tagged out for

. maintenance, this resulted in a complete loss of the component cooling water l 1

(CCW) system and service water system. The licensee declared all charging l l

l l

I 3-42 i

-. - - _ - . - - _ - _ _ .- - . . - a

..__m _m e

I I I I I num PuesP pesa PuesP RH4 Asso CS RCsC PU88P Ostvwell MALS $(ALS PUesP etOOes ROOes AnEA CsesLLEn A- T AAEA COOLEste COOLERS COssetsusans PUEL POOL TOrP.svs M X ' "

t t -

-i X easEnces Cv AsAas uP

• COssTmOL mOOes A/C SACKUP I k f J k X -m  :

',',','- - CO=TnOLetDe i x _ _ .LO.

4 T 4 I TO--- ----

steest PuesP nesse PuesP sesem AasO Cs sePCs PuesP CnD PuesP d' OUTSsOE 3EALS SEALS PuesP seOOes stOOes AstEA stOOes AstEA

• s- ~O- AstEA COOLists COOLEms COOLEns

" 1 I I I I Tusteessa

. OmsO. -

= - -0.

Tuste ELDS

, , , , , _ _ _ m =

A TO TUste SLOG Os9CH fos, e* COssTetOL SLOG I

CenC manTim TusssettpsLL I I q

- E; C .. wAT PuesePs

"'"J" r TO Yuste P-

- COO _

les

,s y,*"a'

,,,,sAs.,,,,

130 ACTO.

SLOG T.ost.

LO.

DLOG

'< AstEA =e y TO Tome

• COOusse j ) * *, " , , cessemA COOLERS STATOst osases COOLERS Ost IMC FL tetATen EXCHAs GEng ALTemesATOst G W W C '"

j Orc 18 l3 O/o 2C l l Ote 2A tustensE MOG CosettrO waren STAsspew caseTs m l Ost SEL 8" N

) OEsetRATOst WN PU*'P l

l TO .AD.A.T.

cL*" X",

n=5AL.

OsLUTsOss COssOtseSAfg ComotesATE puesPg 900STEst PbesP m Ost COOLEns us i I FIGURE 10. SIMPUFIED FLOW DIAGRAM OF THE Pt. ANT SERVICE WATER SYSTEM AT HATCH.

t pumps, boron injection flow paths, residual heat removal (RHR) loops and emer-gency diesel generators inoperable because of the loss of CCW and service water cooling. The licensee immediately suspended all plant activities and action was taken to immediately restore the 1A vital bus to service. Investigation 1

determined that a wire to the bus undervoltage relay had shorted to the feeder

! breaker cubicle door, causing the 1A vital bus feed breaker to trip without automatic transfer to the alternate power source. The faulty wire was replaced and service water flow was restored within one hour of the event. This re-stored operability of the emergency diesel generators (which are cooled by service water). The CCW system was subsequently returned to service within two hours of the event initiation (Ref. 28).

3.5 Service Water System Problems Involvina Personnel and Procedural Errors This section discusses events in which personnel errors and procedural dofi-ciencies have resulted in the loss of service water cooling to safety-related components. A list of these operating events is presented in Appendix H.

Events in which personnel or procedural errors have led to service water system flooding or seicmic deficiencies are discussed in Sections 3.3 and 3.6.

The impact on safety-related components observed in events involving personnel error ranges from the disabling of a single component (e.g., a heat exchanger, pump, or strainer), to the loss of a system fiowpath, to a complete loss of plant ac power. A description of selected events is presented below.

Loss of All Service Water Coolina at Palisades On January 8, 1984, while the Palisades plant was shut down for a refueling out-age with the plant completely de-fueled, a low pressure alarm was received on the isolator column of switchyard breaker 25R8. At that time, the plant was receiving station power from the switchyard 345 kv "R" bus through the plant j start-up transformer. Because of difficulties experienced along the power line 1 to breaker 25R8, the Regional Power Control requested the R bus be removed from  ;

service in order to isolate and repair breaker 25R8. The plant procedure for 1 removing R bus from service requires that the plant be shut down with station f power supplied by both diesel generators or through the main and station power l transformers. At that time, both the main transformer and one of the diesel j generators (generator 1-2) were out of service. Contrary to plant procedure, i a decision was made to de-energize the R bus even though only one diesel gener-ator was available to supply station power (Ref. 29).

Diesel generator 7.-1 was started at 12:27 p.m. Bus 1C was subsequently loaded to the diesel generator at 12.30 p.m. and at approximately 12.48 p.m., the ap-propriate breakers were opened to de-energize the R bus. As a result of de-energizing the R bus, all plant service water cooling was lost and the plant j security system power was left without offsite power. Without offsite power, l the loss of all service water cooling was due to (1) service water pump 1B was l tagged out since December 1983, and (2) service water pumps 1A and 1C were i powered from diesel generator 1.-2, which was inoperable.

l

, At approximately 13.36 p.m., treaker 25R8 had been isolated and the appropriate breakers were closed to re-enArgize the R bus. The R bus was not supplying l 3-44 i

power, however, because the necessary supply breakers to buses 1C, 10 and 1E were open while diesel generator 1-1 was running. At 13.37 p.m., an operator reported smoke in the vicinity of 1C bus. It was quickly detr.rmined that the smoke was coming from diesel generator 1-1 and the diesel was tripped i ; ally.

Overheating of the diesel caused a gasket to rupture on the jacket water heat exchanger. Tripping the diesel resulted in the loss of all plant ac power.

All onsite telephone and radios were rendered inoperable. Additionally, the control room fire detector alarm panels became inoperable.

Since the R bus was already energized, attempts were made to restore ac power by closing the supply breakers to buses IC, ID and IE. Although unsuccessful on the first attempt, the breaker to bus 10 was closed on the second attempt, restoring partial ac power to the plant at 14.25 p.m. This restored power to the plant security systems and radios.

The operators had difficulty restoring power to buses 1C and 1E because the 1C bus supply breaker was locked out by an automatic transfer interlock and the IE bus was locked out due to the safety injection load shed relay actuation.

At 16.18 9 m., 1E bus was energized resulting in partial restoration of the plant ph',ne system. However, bus 1C was not re-energized until 3.50 a.m., on January 9, 1984 because of problems with the supply breaker.

The licensee divided this event into eight significant sub-events for analysis and to determine corrective actions. In regard to the loss of service water system cooling, the licensee performed a review of the management control equip- .

ment for plant conditions not covered by plant Technical Specificatie-s, The i review included addressing the electrical system requirements during cold shut-down and providing administrative controls for tracking equipment status during cold shutdown and refueling operations. In regard to the operators violating plant procedures, the licensee took actions to train personnel on the need for strict compliance with operating procedures.

Loss of the Residual Heat Removal Service Water System at Brunswick Unit 1 On January 19, 1984, while Brunswick Unit I was operating at 100% power, the plant operators attempted to initiate suppression pool cooling to support an operability test of th9 high prassure coolant injection system. Because the B loop of the residual heat removal service water (RHRSW) system was out of service for maintenance, the operators attempted to start the A loop RHRSW pumps (pumps A and C). The RHRSW system is used to reject the heat added to the suppression pool by the high pressure coolant injection turbine to the ultimate heat sink. The operators started pump C, which ran for approximately five seconds before tripping on low suction pressure. The RHRSW systam pump low suction pressure trip setpoint is 20 1 2 psig. The setpoint works in conjunction with a five-second pump motor trip time delay relay which allows establishing adequate pump suction pressure during pump startup. After a check j of the loop suction pressure indicated satisfactory suction pressure (60 psig),

the operators started pump A. Pump A also ran for five saconds before tripping on low' suction pressure. Another attempt was made to start pump C, but the pump again tripped on low suction pressure. The inoperability of both RHRSW loops rendered the suppression pool cooling and shutdown cooling modes of the RHR system inoperable (Ref 30).

3-45 0

l

_a = , m_.m4 m - m . . - , .. m .~ ._._~..m - - - . . _ - - . -

l.

! l l The licensee's subsequent investigation determined that the RHR SW pump trips l l

. were the result of an air pocket in the A loop suction header piping. The  :

entrapped air was sensed by the pressure switch as a low pressure condition  !

i and the pumps tripped as designed. It appears that inadequate venting of the suction header piping was the result of personnel error and a design inadequacy

' in which the suction header vent line was positioned 135 degrees from top dead j center of the piping. The licensee found that the same vent line orientation j existed for the A loop of the RHR SW system at both Brunswick units. However, i the B loop vent line was oriented at top dead center of the suction piping at i both units. l l The licensee restored the A loop of the RHR SW system within 15 minutes of the

pump trips. The licensee's immediate corrective activa was to initiate a prn-i gram to vent the A loop suction piping at both units on a weekly basis to en- ,

sure the loops were adequately vented. Long term corrective action was to de-velop and implement a piping modification to re-orient the A loop vent lines at j both units. j 3.6 Service Water System Seismic Deficiencies  !

l A number of utilities (involving at least 14 different plants) have reported  !

seismic deficiencies involving service water systems. A list of these events ,

by plant name, event date and reference is presented in Appendix 1. Most of 4 these deficiencies were identified as a consequence of implementing actions j described in the following NRC correspondences:

J l 1. IE Bulletin 79-02: Pipe Support Base Plate Designs Using Concrete Expansion '

t Anchor Bolts.  !

2. IE Bulletin 79-14: Seismic Analyses for As-Built Safety-Related Piping I Systems.  ;

! 3. Generic Letter 81-14: Seismic Qualification of Auxiliary Feedwater Systems. l l The majority of the LERs describing service water system seismic deficiencies (59%) were reported in 1980 and 1981, immediately following the issuance of these  !

NRC generic communications. However, seismic deficiencies involving service water systems were also discovered and reported at four different plants during l l ,

1986.

The most common seismic deficiency identified involved inadequate piping support.

1 Approximately 40% of the reports identified some type of error in the original piping support design. These errors included designers not recognizing concen-i trated loads, problems with the computer analyses coaducted, modifications made

{ after the system's initial design that were not incorporated in the piping sup-i port scheme and others. The second most commonly reported cause for inadequate j piping support were construction-related problems. The problems involving con-struction included improper piping support installation and improperly located piping supports. Overall, the majority of the licensees reported that the ser-vice water system seismic deficiencies occurred during the design and construc-tion of the plant. To a much lesser extent, inadequate seismic mounting of 4 service water pumps and service water control system components (e.g., relays 3 and valve motors) that were not seismically qualified were also reported.

4 i

3-46 C_ _,.__-_ _ _ __._.___ _ . . _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _

Two recent events which are representative of the types of seismic deficiencies reported are described in detail as follows:  :

Imergency Service Water System Seismic Deficiencies at Oyster Creek On December 11, 1985, while the Oyster Creek plant was in a refueling outstage, a review of the engineering baseline data for a proposed chlorination system modification determined that the 1-inch and 3-inch chlorination line tie-ins to the emergency service water (ESW) system were not seismically qualified (Ref. 31).

3 If the chlorination system piping ruptures during a seismic event, the ESW backflow through the piping could not be isolated. On December 13, 1985, an analysis of the ESW piping was performed in response to an NRC inspection con- I ducted in May 1985, which found 20 ESW seismic frame-type piping supports had ,

excessive gaps. The piping analysis conducted by the licensee found that these gaps could cause excessive loading on the adjacent supports. The deficiencies L in the ESW system piping supports rendered the system inoperable for a seismic event.

At Oyster Creek, the ESW system provides cooling water to the containment spray

heat exchangers. The containment spray heat exchangers remove the heat generated in the primary containment during the design basis loss of coolant accident (LOCA). The ESW system consists of two independent trains, each with two full capacity pumps located at the intake structure and two heat exchangers located  ;

in the reactor building along with the necessary interconnecting piping. Each ,

ESW train has a 1-inch and 3-inch tie-in to the chlorination system.  !

The licensee stated that design deficiencies were the cause of both the seismic inadequacy of the chlorination line tie-ins and the piping supports. The li- I consee's corrective actions included performing an engineering evaluation which '

resulted in revising the minimum acceptable ESW flow rate through the heat ex-changers from 2370 gpm to 2800 gpm. The licensee stated that increasing the flow rate through the heat exchangers will assure that the ESW system can fulfill its designed safety function in the event of a rupture of the chlorina-tion piping tie-ins. The licensee also repaired the 20 piping supports to reduce the excessive gaps to acceptable design limits. One additional support was also strengthened.

Seismic Deficiency of the ESW Pump Automatic Start Relays at Susquehanna  ;

I On June 2,1986, during a design review, the licensee initiated an investiga-tion to determine if the four emergency service water (ESW) pump automatic i start relays were seismically qualified as required in the plant's Final Safety j On June 3, the licensee determined that the relays were Analysis Report (FSAR).

! not seismically qualified, citing a Wyle Laboratory test report (Ref. 32). The l Wyle report found that the contacts of similar relays chattered during seismic

tests conducted at their Huntsville Laboratory. During the time the seismic j qualification of the relays was in question, both Susquehanna units were shut down (mode 4).

4 The relays are part of the ESW pump automatic start circuitry which is designed to start the pumps after a diesel generator initiation signal and following a j 40 to 50-second time delay. The time delay is to prevent placing an extra start-ing load on the diesels. At Susquehanne, the ESW pumps supply cooling water to

! 3-47 l

the emergency diesel generators as well as other safety-related loads. If the pumps fail to start on demand the diesel generators would eventually trip on high temperature. For example, the possibility existed that during a safe shut-down earthquake with a loss of offsite power, the relay contacts would remain open, preventing the automatic start of the ESW pumps. However, since the non-seismic relays only affected the automatic start circuitry, the control room operators would be able to manually start the pumps.

The licensee replaced the relays with seismically qualified components on June 12, 1986, prior to restarting the units.

i i

i i

(

I 1

)

i 3-48 n , , - - . , - - , , . , - - - - - - - - - - - , - , , . ~ . , - - -

^

I 4 ANALYSIS OF OPERATIONAL DATA 4.1 Cause of System Dearadations and Failures This study identified a total of 980 operational events in which the service water system was involved. As indicated in Chapter 3, 276 of these 980 operat-ing events were assessed to have potential generic safety significance, and were further evaluated. A brief description of these 276 events is presented in Appendix A. The failures and degradations of service water systems observed in the 276 operating events are grouped into six general categories which identify the dominant degradation mechanism of the operating events. The six general categories are: (2) fouling due to various mechanisms; (2) single failure and other design deficiencies; (3) flooding, (4) equipment failures; (5) personnel and procedural errors; and (6) seismic deficiencies. These categories are shown below: ,

Degradation Description Number of Events Percentage

1. Fouling due to:

Sediment Deposition 26 9.4 Biofouling 28 10.1 Corrosion / Erosion 77 27.9 Pipe Coating Failure /

Carbonate Deposition 3 1.1 Foreign Material / Debris Intrusion 27 9.8  !

2. Single Failures and other Design Deficiencies 18 6.5

3. Flooding 12 4.4

4. Equipment Failures 10 3.6

5. Personnel and Procedural Errors 46 16.7 >

1

6. Seismic Deficiencies 29 10.5 Total 276 100.0 From the above tabulation, fouling represents the most frequently observed cause of service water system degradations and failures. A majority (58%) of the op-erating events reviewed involve system fouling. Among the fouling mechanisms observed, corrosion and erosion is the most commonly' observed (27%), followed by biofouling (10.1%), foreign material and debris intrusion (9.8%), sediment de-position (9.4%), and pipe coating failure and calcium carbonate deposition (1.1%).

Engineering insights and observations regarding some of these fouling mechanisms and their impact on equipment are given in Sections 5.1.2.1 through 5.1.2.3.

The second most frequently observed cause of service water system degradations

! and failures is personnel and procedural errors (16.7%), followed by seismic deficiencies (10.5%); single failures and other design deficiencies (6.5%);

flooding (4.4%); and significant equipment failures (3.6%). Engineering in- i sights and observations regarding these failures and degradations, and their I adverse impact on equipment are given in Sections 5.1.2.4 through 5.1.2.9.

l 4-1 i

i i .

4.2 Frequency of System Failures l Over the review period from 1980 through 1987, there were a total of 12 operat-ing events in which a complete loss of service water system function occurred.

These operating events, which have been described in detail in Chapter 3, oc-curred at Oconee 1, Susquehanna 1, Oyster Creek, Brunswick 1 and 2, Palisades, Salem 1 and 2, Hatch 1, San Onofre 1, Calvert Cliffs 2, and Catawba 1. A brief ,

summary of these events is given below and in Table 5.

At Oconee 1, a complete loss of low pressure service water system occurred dur- '

ing two electrical load shed surveillance tests on October 10, 1986 due to in-adeauate siphon flow to the low pressure service water pumps. At Susquehanna 1, all four emergency service water pumps were declared inoperable on May 24, 1986 when the pumps were damaged by cavitation due to pump operation at less than designed flow. At Oyster Creek, both trains of the emergency service water system were declared inoperable on July 22, 1985 when coal tar enamel used to coat the system piping was found to have plugged the system heat exchangers.

At Brunswick 1, a complete loss of the RHR service water system occurred on January 19, 1984 when one loop was out for maintenance and all pumps in the

, redundant loop tripped on low suction pressure due to entrapped air in the suction header piping. At Palisades, all plant service water cooling was lost on January 8,1984 when two service water pumps lost their power supply due to noncompliance with plant procedures and the third service water pump had been tagged out for maintenance. At Sales 2, a complete loss of service water ,

cooling occurred on June 23, 1983 when all six operating service water pumps were stopped by plant personnel to protect them from six feet of accumulated water in the service water bay due to a failed gasket. At Salem 1, the service water system was lost on March 16, 1982 when a vital bus was de-energized lead-ing to the loss of two service water pumps while the redundant pumps were tagged  :

out for maintenance. At Brunswick 2, both RHR service water loops were inoper-able on January 16, 1982 when all the pumps (two per loop) could not be started

, due to low suction header pressure lockout signals caused by sediment deposi-i tion in the sensing lines of the pressure switches. At Hatch 1, the plant

service water system was declared inoperable on August 22, 1980 when both sys- ,

j tem inlet strainers were found partially plugged. The inlet strainers became plugged after the failure of both backwash drive mechanisms. At San Onofre 1, i a complete loss of the salt water cooling system occurred on March 10, 1980 i when one pump shaft sheared due to vibration, a second pump discharge valve failed mechanically, and the auxiliary pump lost suction due to inadequate priming. At Calvert Cliffs 2, a complete loss of salt water flow to both heat j exchangers occurred on July 20, 1982 when a butterfly valve in the common dis-  !

charge header failed closed. The failure was caused by the shearing of two i pins connecting the valve disc to tha operator stub shaft. At Catawba 1, both 1 i trains of the nuclear service water system were inoperable on November 25, i 1985 when a train B supply isolation valve failed to fully open in an inserv-

! ice test, and a train A discharge isolation valve failed to fully open after pump start.

1 From 1980 to 1987, approximately 650 years of domestic light water reactors j operation were accumulated. Therefore, the frequency of reported loss of j service water system function events is:

12 events = 1.8 x 10 2/ reactor year,

' 650 reactor years i

1 l 4-2

4.3 Frequency of System Dearadations In addition to the 12 operating events involving a complete loss of service wa-ter system function, 264 operating events reviewed involve degradations of the service water system. A complete list of these operating events is presented in Appendix A. Of these 264 operating events, 19 events involving significant service water degradations have been described in detail in Chapter 3. With 264 operating events involving service water system degradations in over 650 reactor years of operation, the frequency of service water system degradation events is:

264 events = 0.4/ reactor year.

650 reactor years 1

4-3

1 o .

Table 5 Complete Loss of Service Water System Function Plant Name Reference Date Description Oconee 1 LER 269/86-11 10/01/86 A complete loss of low pressure service water system during electrical load shed surveillance tests due to inadequate siphon flow to the service water pumps.

Susquehanna 1 LER 387/86-21 05/24/86 All 4 ESW pumps were declared inoperable due to recirculation damage. Damage was caused by operating pumps at less than designed flow.

Oyster Creek LER 219/85-18 07/22/85 A complete loss of emergency service water system. The heat exchangers were plugged by coal tar enamel used to coat the ESW piping for corrosion protection.

Brunswick 1 LER 325/84-01-1 01/19/84 A loss of all RHRSW. One loop was out for maintenance and entrapped air in suction header piping caused low pressure trip of all pumps in another loop. This led to both RHR shutdown cooling and suppression pool cooling inoperable.

Palisades LER 255/84-01 01/08/84 A loss of all service water cooling. During planned loss of offsite power for maintenance, two service water pumps lost their power supply due to plant personne: not following plant procedures. The third pump was tagged out for main-tenance. All service water cooling was lost.

Sales 2 LER 311/83-32 06/23/83 A complete loss of service water system. Six feet of water was accumulated in the service water bay due to a failed gasket in the piping. The gasket failure was attributed to inadequate installation.

Salem 1 LER 272/82-15 03/16/82 A loss of all service water and component cooling. Redun-dant CCW and service water pumps were tagged out for maintenance. A loss of one vital bus (short) caused the loss of all service water and CCW for about I hour.

Table 5 (Continued)

Plant Name Reference Date Description Brunswick 2 LER 324/82-05 01/16/82 A loss of both RHRSW loops rendered shutdown cooling and suppression pool cooling modes of RHR inoperable. The loss of both RHRSW loops occurred when all 4 pumps could not be started due to low suction header pressure lockout signals caused by sediment deposition in the sensing lines in the puressure switches.

Hatch 1 LER 321/80-103 08/22/80 A declared loss of all plant service water cooling. Both divisions of plant service water system were declared inoperable when inlet strainers were partially clogged.

This was caused by the coupling failure on "B" backwash drive mechanism and the "A" backwash drive mechanism breaker

! trip.

i l , San Onofre 1 LER 206/80-06 03/10/80 A complete loss of salt water cooling system. One pump shaft j j, sheared due to vibration, a 2nd pump discharge valve failed mechanically, and the auxiliary pump lost suction due to

inadequate prime.

! Calvert Cliffs 2 LER 318/82-34 07/20/82 A complete loss of salt water flow to both heat exchangers i occurred when a butterfly valve in the commeon discharge header failed closed. The failure was caused by the shearing

! of two pins connecting the valve disc to the operator stub i

shaft.

i j Catawba 1 LER 413/85-68-1 11/25/85 Both trains of nuclear service water system were inoperable for 43 minutes when a train B supply isolation valve failed to fully open (stopped at intermediate position) in an inservice test, and a train A discharge isolation valve i failed to fully open (stopped at intermediate position) after pump start.

I i

l

5 EVALUATION OF OPERATIONAL DATA 5.1 Qualitative Discussions on Safety Sianificance 5.1.1 Causes and Consequences of System Failures and De0radations As observed by operational experience, the service water system is vulnerable to a great variety of mechanisms and its failure and degradation have adverse impact on a large number of safety-related systems and components. For example, based on the operating events described in Chapter 3, the service water system at different plants had failed or had been degraded due to (1) fouling by sediment deposition, biofouling, corrosion and erosion, pipe coating and calcium ce,rbon-ate, and foreign material and debris intrusion; (2) design deficiencies includ-ing single failure vulnerabilities; (3) flooding; (4) multiple equipment fail-ures; (5) personnel and procedural errors; and (6) saismic deficiencies. As estimated in Chapter 4, service water system failures occurred with a frequency of 1.8 x 10 2 per reactor year, and service watsr system degradations occurred with a frequency of 0.4 per reactor year.

Safety-related systems and components adversely impacted by the failure and degradation of the service water system are described in Chapter 3 and Appen-dix A. They include the following equipment at various plants: component cooling water system heat exchangers, containment spray heat exchangers, emer-gency diesel generators, low pressure injection system coolers, the retidual heat removal system, containment fan coolers, safety injection pumps, charging pumps oil coolers, reactor building cooling units, spent fuel pump room air f

cooler, and control room ventilation system.

t 1 Three important observations emerge from the above discussions: (1) a variety of failure mechanisms have been observed to cause service water system failures and degradations, (2) these failures and degradations occurred rather frequently,

namely at a frequency of 1.8 x 10-2 and 0.4 per reactor year, respectively, and (3) many safety-related systems and components were adversely impacted by the i failures and degradations of the service water system. Qualitatively,these j observations indicate that tne failures and degradations of the service water i system as observed in operating events have great safety significance. A quan-titative estimate which confirms this conclusion is presented in Section 5.2.

Engineering insights and additional observations are presented in the next section.  ;

5.1.2 Engineering Insights and Observations 5.1.2.1 System Fouling The most frequently reported service water system degradation mechanism is sys-tem fouling through sediment deposition (silt, mud and clay accumulation), bio-fculing, corrosion / erosion, foreign material and debris intrusion and other l more plant-specific types of fouling such as pipe coating degradation and cal-cium carbonate buildup. These failure mechanisms are insidious because it 5-1

l

- - _ _ _ , . ~ , _ - - . _ _ _ _ _ , -,_

l . i l

1

! often takes months (if not years) before the fouling buildup becomes apparent I to the licensees through the surveillance techniques currently in use. In some cases, this may be partially attributed to the system design, i.e., normal op-erational loads ree . ire only a fraction of the system capacity required during a design basis act. In other cases, it was found that the surveillance technique'; use . 4in plants were incapable of detecting certain types of fouling. For .- igular testing af the differential pressure (D/P) across the low pressu . .

n coolers at k nee did not detect silt buildup which severely degrac lers' heat transfer capability. In several events, the fouling bet ent only after system performance was compromised during an on-demand si' . . For the most significant service water system fouling events discussed i.i Chapter 3, the licensees did not become aware of the severity of t'ie service water system fouling problems until (1) a system f ailure during an on-demand situation occurred (Brunswick), (2) system fouling was so severe tMt limited plant operations or plant shutdown was required (0conee, McGuire, ANO, and Oyster Creek), (3) operation outside the plant design basis occurred  ;

(Terkey Point), or (4) through-wall piping leakage required safety systems to '

be ded ared inoperable (North Anna). It should also be noted that the severe service water system degradation that occurred at two of the plants (Oconee and McGuire) was not detected until the NRC raised concerns with the licensee over the operability of these systems.

5.1.2.2 Heat Exchanger Performance Degradatior.

Four of the operating events discussed in the service water system fouling sec-tion (the events at McGuire, Oconee, ANO 2 and Turkey Point) involved severe degrtdation of various safaty-related heat exchangers. In each event, the licensees had operated for extended periods without inspecting the heat ex-changers cooled by service water for fouling (0conee had operated for almost 13 years without inspecting the LPSW side of the heat exchangers). Furthermore, these licensees were unaware of the degradation of the heat transfer capability of these safety-related heat exchangers despite having performed var!cus sur-veillance tests to ensure the operability of these systems. For example, at

, Oconee, the licensee verified proper LPSW flow through the RBCU coolers each refueling outage. Although flow through the Unit 3 RBCU coolers remained ade-quate, sediment deposition on the cooler tubes had degraded the coolers' heat transfer capability to an average of only 30% of design. The licensees for ANO-2 and Turkey Point also relied on differential pressure measurements across the heat exchangers as a measure of system operability and to detect fouling.

On April 16, 1986, the NRC's Office of Inspection and Enforcement issued to all Regional Offices Temporary Instruction (TI) 2515//7,'"Survey ot .icensee's Response to Selected Safety Issues" (Ref. 33). The Regional 0$f'.ces were asked to have resident inspectors at certain plants complete questios aires for sev-eral issues, one of which involved biofouling of cooling water heat exchangers.

Resident inspectors 6t 74 operating nuclear power plants responded to the questionnaires. The following is a list of several of the questions pertaining to cooling water heat exchangers and the percentage of negative responses:

QUESTION NEGATIVE RESPONSES

1. Does the licen de perform periodic inspection of service water systeias? 14%

5-2

2. Is instrumentation present to detect degraded periormance? 16%

3. Is flow instrumentation present? 18%

4. Does the licensee routinely record system instrument readings? 20%

5. Does the licensee routinely compare system instrument readings against design parameters? 28%

Inspectors at a number of plants had negative responses for the majority of thesc questions. These plants included Davis-Besse, FitzPatrick, Millstone 1, Indian Point 2, Browns Ferry, Big Rock Point, LaSalle, Braidwood, Cook, Point Beach, Palisades, Rancho Seco and Trojan. Information regarding heat exchanger performance testing in regard to determining heat exchanger thermal capacity, fouling factors or the overall heat transfer coefficient was not requested in the questionnaire. However, it appears likely from the responses to the ques-tionaire that a significant number of licensees do not perform heat exchanger performance testing.

None of the plant Technical Specifications reviewed required licensees to perform any type of heat exchanger performance testing. As illustrated by the events at McGuire, Oconee, ANO 2, and Turkey Point, monitoring system flows or the D/P across safety-related heat exchangers does not provide an adequate indication of the operability of the system heat exchangers. Licensees for each of these plants now conduct regular heat exchanger performance testing. At Turkey Point, the '<icensee instituted a program to conduct weekly heat exchanger performance testing of the CCW heat exchangers. It appears that periodic safety-related heat exchanger performance testing, the frequency dependent on the environmen-tal conditions existing at each individual plant site, should be performed to ensure that the heat exchangers are capable of performing their intended safety function.

5.1.2.3 Degradation of System Piping Three of the operating events discussed in the service water system fouling sec-tion involved severe degradation of the system piping and pipe lining, and plug-ging of small diameter piping. Service water system piping degradation and plugging led to the loss of safety system function at Brunswick (RHR) and North Anna (HPI) and Oyster Creek (containment spray). The mechanisms for each event were different in that sediment plugged pressure sensing lines at Brunswick, corrosion and erosion caused service water system piping leakage at North Anna, and thermal cycling of the drained service water piping caused cracks and sub-sequent failure of the piping liner at Oyster Creek.

Service water system degradation caused by corrosion / erosion was reported by licensees for 16 PWR sites and three BWR sites. This distribution of events between PWRs and BWRs appears to be related to the operational characteristics of the service water systems at each type of plant. At PWRs, the service water systems are usually contir.uously running systeme, as opposed to BWRs, where the safety-related service water systems are designed to provide sufficient cool:ng water for safe shutdown of the unit following a loss of preferred power and, therefore, are only operated on demand. The majority of corrosion / erosion reports indicated that the piping erosion was typically discovered imediately downstream of a throttling device (either a throttled valve or an orifice) and 5-3

at 90 degree piping elbows. It should also be noted that corrosion / erosion and microbiologically induced corrosion have been reported by licensees for

, plants using the full range of possible water sources (fresh, salt, brackish, etc.) as the cooling medium for their service water systems.

Other than the flooding event at Indian Point Unit 2 due to multiple piping leaks caused by corrosion and erosion, most of the piping damage reported has been relatively small through-wall piping leaks. Reports of leaks in heat exchanger tubes have resulted in mixing of the service water with pump and diesel lube oil systems rendering these components inoperable.

A study conducted by AE0D .in 1984, "Erosion in Nuclear Power Plants," AE0D/E416, also examined erosion of service water system piping. The study was performed in response to the rupture of an extraction steam line at Oconee Unit 2 on June 23, 1982. The purpose of the study was to identify the scope of degrada-tion related to erosion and assess potential generic implications. The study found that service water systems appear to be ideal candidates for erosion and warrant monitoring for degradation and potential impact on safety-related l equipment. One of the major conclusions from the study was the following: l "Erosion events appear related to the specific water source with suspended solids (raw water, radwaste, etc.), the use of throttling devices such as valves and orifices, or a combination of the effects of water with sus-pended solids and a throttling device. Service water systems appear to be candidates for monitoring to detect degradation."

In regard to microbiological 1y induced corrosion, several general methods have l been employed with varying degrees of success at different plants. These in-  !

clade application of piping protective coatings in conjunction with cathodic j protection, and various water treatments. If these measures are not practical, '

areas of low flow rates and stagnant conditions can be periodically flushed and/or cleaned during outages to help mitigate the biological activity of var-ious organisms.

Plant service water systems are ty; cally equipped with some type of piping liners to prevent corrosion of the system piping. Cement, coal tar and epoxy ,

coatings are commonly used as piping liners. The pipe liner failures at Oyster l Creek and Palo Verde and subsequent impact on plant operations and loss of safety system operability may have been prevented if periodic inspections of i the piping internals had been conducted. Although licensees at many plants I perform periodic inspections of the service water system piping internals, it j appears that a significant number of licensees do not perform this type of inspection.

Service water system piping degradation caused by corrosion / erosion, microbio-logically induced corrosion or pipe liner failures can be detected through periodic inspection of the system piping. General Design Criterion 45 of 10 CFR Part 50, Appendix A requires that the cooling water system be designtJ to permit appropriate periodic inspection of the system heat exchangers and piping to assure that integrity and capability of the system. Periodic inspec-tion of service water system piping for degradation and pipe liner integrity may provide a prudent measure of protection.

5-4

Relatively few events have been reported in which small diameter piping and instrument tubing have been plugged by sediment to the extent that it disabled the component. The event at Brunswick, while illustrating the significance of instrument sensing line plugging, appears to be an event of relatively rare occurrence.

5.1.2.4 Design Deficiencies As oiscussed in Chapter 3.2, licensees for nine operating plants discovered that the service water systems at their facilities could not provide the l

cooling flow necessary during various modes of required accident and post-accident system operation. In addition to these plants, NRC inspectors discov-ered similar concerns at two additional plants, Indian Point Unit 3 and Cooper Station. At Indian Point, the NRC conducted a Safety System Outage Modifica-tion Inspection during Hay, June and July of 1987 (Ref. 34). The inspectors determined that the licensee had failed to verify that the worst case system alignment had been selected to determine the service water pump NPSH. An NRC Safety System Functional Ir.spection (SSFI) conducted at Cooper in May and June, 1987, determined that the service water system may not be capable of providing adequate cooling to the emergency diesel generators and to other essential loads durirg worst-case accident scenarios (Ref. 35). Additionally, the licensee for McGuire discovered, in early 1986, that the nuclear service water system preoperatitmal test configuration had not tested the system under the design basis configuration. At each of these plants, it appears that the re-quisite testing was not adequate to ensure that the plant's service water systems cculd perform its design function.

At Oconee, the licensee attempted to perform a load shed test which tested the low pressure service water (LPSW) system in accordance with the design condi-tions. During the test (see Chapter 3) suction to the LPSW pumps was lost and thus, the system was unable to perform its design function. This event is safety significant because the LPSW system provides cooling for a number of safety systems including the high pressure injection pump motor cooling, emer-gency feedwater pump motor cooling, reactor coolant pump motor cooling, decay heat removal system heat exchangers, and component cooling system heat exchangers.

General De ign Criterion (GDC) 46 of 10 CFR Part 50, Appendix A, discusses testing o. LWR cooling water systems. GDC 46 states, in part, l l

"The cooling water system shall be designed to permit appropriate periodic  !

pressure and functional testing to assure...(3) the operability of the system as a whole and, under conditions as close to design as practical, the performance of the full operational sequence that brings the system into operation for reactor shutdown and for loss-of-coolant accidents, l including operation of the protection system and the transfer between l normal and emergency power sources." i Operational data reviewed in this study appears to indicate that the service water system at a number of plants has not been proven capable of performing its safety function under design basis conditions and as specified in GDC 46, 5.1.2.5 Single Failure Vulnerabilities Actual instances in which a single failure caused the loss or the imminent loss of the service water system or a vital load supplied by the service water 5-5

l 1

system were reported at three plants. All three of these plants had been op- l erating for years before the events occurred. Potential single failure vul-nerabilities of the service water system and/or the loads supplied by the l service water system were discovered at an additional four plants. Two of these plants (Turkry Point and Indian Point Unit 3) had operated for over a decade before the single failure vulnerabilities were identified and cor -ected.

The single failure vulnerability reported involved the actual or potential fail-ure of a single valve in a common header causing either a complete loss of service water system flow or the loss of service water flow to a dependent safety system. Four plants reported this type of vulnerability: Calvert C;;ffs, Indian Point Unit 3, Turkey Point Unit 3, and Susquehanna. Only Calvert Cliffs actually experienced a loss of system cooling flow, the other plants discovered the single failure vulnerabilities before an actual failure occurred.

l The licensee for Hatch also reported a single failure mechanism which may have l generic applicability. The licensee discovered that a single pressure regulator l controlled cooling water flow to all the RHR service water and plant service l water (PSW) pumps (Ref. 36). The failure of this single pressure regulator  !

would result in the loss of cooling to the RHR service water and PSW pumps. '

This type of single failure mechanism (i.e., the dependency of multiple safety system pumps on the operability of a single instrument) was also discovered at ,

Pilgrim involving the dependency of all four RHR pumps' cooling water supply I on a single flow instrument. The Pilgrim situation resulted in the issuance of IE Bulletin No. 86-01, "Minimum Flow Logic Problems Which Could Disable RHR I Pumps."

The event at Surry Unit 2 also appears to have generic applicability. At Surry, the B charging service water pump cap screw failed allowir.g the impeller to slide off the shaft and bind the pump (Ref 37). The redundant A charging ser-vice water pump failed when leakage from the B pump wetted the stator windings shorting the A pump. At plants where service water pumps are located in the I same pump room, spraying pump seal leakage could result in wetting the adjacent pumps or pump controllers and lead to common-mode service water pump failure. 1 The single failure vulnerability of the service water systems at Oconee appears to be the result of a plant unique system design. The loss of LPSW experienced at Oconee was the result of utilizing a siphon flow arrangement to the LPSW pumps from the circulating water system.

These :.ctual and potential single failures are contrary to the single failure criterion in GDC 44, "Cooling Water," which states that cooling water systems must be capable of performing their design function assuming a single failure.

5.1.2.6 System Flooding  ;

l The events in which service water system leakage resulted in flooding were the  !

result of a variety nf causes. The Zion Unit 2 event, in which both diesel fuel I oil storage tank rooms were flooded, was the result of multiple personnel and I administrative errors in the performance of required inservice inspection test-ing which eventual 1y resulted in the failure to replace a check valve bonnet mistakenly removed for the test. In the Salem event, the licensee believed that 5-6

1 t

l improper installation of an expansion gasket joint (because of physical obstruc-tions) resulted in eventual failure of the gasket and flooding of the service l water bay. The flooC ng event at Indian Point Unit 2 was the result of a number of causes including multiple service water system piping leaks due to corrosion /

errosion, inoperable containment sump pumps, and inoperable sump level indicators.

'Although no one single root cause stands out as a major source of service water l system flooding events, these events illustrate the type of damage which can I result from service water system flooding. Licensees should be aware of the concern associated with the potential for service water system leakage to result I in extensive flooding. Proper training of maintenance and operations personnel I in regard t0 the potential flooding hazards associated with the service water l syster.is necessary. It is also important to ensure that redundant leak detec- I tiori devices such as sump level indicators and annunciators and sump pump acti- l vation annunciators are operable and periodically monitored to identify service '

water system leakace before extensive flooding occurs.

5.1.2.7 System Degradation Caused By Equipment Failures 4

Concurrent mu'tiple equipment failures resulting in th: ..omplete loss of service j water system cooling was reported at three plants, San Onofre 1, Susquehanna 1, i and Hatch 1. Each event appears unique in and of itself: different pieces of I equipment were involved at each plant and the licensees' responses were differ-ent in each case.

The event at San Onofre involved the concurrent failure of three separate pieces ,

of equipment: (1) the south salt water cooling pump shaft sheared, (2) the north '

salt water cooling pump discharge valve failed to oper, and (3) the auxiliary salt water cooling pump air priming system failed. The event was examined in detail in AE00 case study AE00/C204 which found several distinct problems which contributed to the event. AE0D/C204 identified deficiencies in the SWC inserv-ice inspection test program, desiccant contamination of the instrument air sys-tem, and a failure of the operators to immediately shut down the plant in accordance with the Technical Specifications.

At Susquehanna, common-mode failure of the plant's ESW pumps was caused by impeller suction recirculation cavitation, a phenomena which occurs by operat-ing the pumps significantly below their design flowrates. The damage to the ESW pumps (which was also found to have occurred to the RHR service water pumps, but to a lesser degree) is still under investigation by the licensee and is currently being studied by AEOD for generic implications. The licensee ap-pears to have acted conservatively in performing a plant shutdown as soon as it became evident that more than one ESW pump was affected.

The Hatch event, in which plant service water was lost when the system strainers I became clogged, occurred because of a broken coupling on the backwash drive mech- l anism for the B strainer along with a tripped power supply breaker fce the back- l wash drive mechanism on the A strainer. An evaluation of the event performed in  ;

1982 (Ref. 38) noted that at H uch there are no bypass lines around the strainers. l The evaluation also suggested the installation of an alarm triggered by a cettain i differential pressure across the strainers, rather than relying on the present system which alarms on high pressure on the inlet to the strainers. This way the alarm would be triggered when the strainers began to get plugged instead of when the strainers were already plugged.

5-7 l

5.1.2.8 System Problems Caused by Personnel and Procedural Errors Personnel errors and procedural deficiencies were cited as causes in 16.8% of the events involving the service water system selected for review. The most common personnel errors reported involved mispositioned service water system valves and these errors contributed to 70% of the total erros. Hispositioned valves were most frequently reported to have occurred during system maintenance and testing activities. Hispositioned valves were caused by maintenance person-nel in approximately 67% of the events while operations personnel were faulted in only 17% of the events. This appears to indicate a need to impress upor:

maintenance personnel the importance of repositioning valves following mainte-nance and testing. Valve line-ups, commonly performed on safety systems, should also be routinely performed on the service water system because of the system's importance to plant safety. Many licensees have installed locking devices on particularly important service water system valves to prevent inadvertent mispositioning. This may be a prudent measure to administratively control this type of problem.

Procedural deficiencies were cited as the cause of 7% of the events. The Pali-sades event, in which operators mistakenly de-energized the power source to the only operable service water pumps causing a loss of cooling to the diesel gener-ators and subsequent loss of plant ac power, illustrates the dependence of plant systems on service water cooling. At Palisades it took approximately 50 min-utes from the time the service water pumps were de-energized to rupture a gas-kat or, the diesel generator jacket water heat exchanger. This event also illustrates the importance of operators adhering to procedures and being aware of plant status.

5.1.2.9 Seismic Deficiencies Service water system seismic deficiencies have been identified by licensees at 14 different plants during the review period. The majority of the licensees (73%) identified the seismic deficiencies as a direct result of implementing actions described in the following NRC corre,spondence:

(1) IE Bulletin 79-02, "Pipe Support Plate Designs Using Concrete Expansion 1 Anchor Bolts," l (2) IE Bulletin 79-14, "Seismic Analysis for As-Built Safety-Related piping I Systems , and '

(3) Generic Letter 81-14, "Seismic Qualification of' Auxiliary Feedwater Systems."

l The majority of the LERs describing service water system seismic deficiencies (59%) were reported in 1980 and 1981, immediately following issuance of these generic communications. However, seismic deficiencies involving service water systems were also discovered and reported at four different plants during 1986.

The event at Oyster Creek is an example of a licensee modifying an existing ,

seismically qualified system with a chlorination system (to prevent and mitigate I biofouling) and neglecting to ensure that the modification meet all seismic i 1

5-8 t

l l

l o 4

l requirements. The event at Susquehanna illustrates the need to ensure that electronic components (as well as system piping) require seismic qualification.

'5. 2 Quantitative Estimates of Reactor Accident Risks 5.2.1 Results of Probabilistic Risk Assessments Accident scenarios initiated or compounded by a loss of P.e service water sys-tem have been studied in several probabilistic risk assessments. For example, the probabilistic risk studies conducted for Oconee-3, Crystal River-3, Browns Ferry-1, and Byron-1 examined the failure of the service water system and its associated consequences in various degrees of detail. The common conclusion in these studies is that a loss of the service water system contributes signifi-cantly to reactor accident risks. This conclusion is supported by the engineer-ing insight that the service water system provides cooling of important safety-related systems and components which would fail or become unavailable in a relatively short period of time (e.g., the component cooling water system, emer-gency diesel generators, emergency core cooling system pumps and heat exchangers, containment spray and fan coolers, and the residual heat removal system). Thus, a service water system failure, which is both an accident initiator and multi- i pie failures of vital mitigating systems, enters into a number of dominant acci-dent sequences. The highlights of the results of the probabilistic risk assess-ments for Oconee-3, Crystal River-3, Browns Ferry-1, and Byron-1 are given below:

5.2.1.1 Oconee-3 Study l The results of a probabilistic risk assessment for Oconee-3, sponsored by the Nuclear Safety Analysis Center (NSAC) of the Electric Power Research Institute (EPRI) and Duke Power Company (Ref. 39), indicated that a loss of the low pres-sure service water (LPSW) system is the most important internal initiating event.

As summarized in a B&W Owners Group Safety and Performance Improvement Program Risk Assessment Review (Ref. 40):

"The most important of the internally initiating events is a loss of LPSW.

The dominant type of core-melt sequence for loss of service water involves a failure of the HPI pumps when their motors are not cooled. i Under these circumstances, the reactor-coolant pumps must be tripped, and injection for their seals must be re-established to prevent leakage. The backup for the HPI pumps is the component cooling (CC) system. Following a subsequent CC failure, or given a loss of all station power, the oper-ators would activate tha makeup pump in the SSF. Because of its limited capacity, the SSF makeup pump must be initiated within about 30 minutes to prevent seal leakage that exceeds its capacity. The relatively slow rate of leakage could eventually cause the loss of so much reactor cool-ant that it would be impossible to sustain circulation in the reactor-coolant system and steam generator cooling. The mean annual frequency of this type of sequence was calculated to be 1.3 x 10 5."

"A feature that was important to core-melt sequences induced by external events and was critical in internally-initiated sequences is the large number of necessary components that require cooling from the LPSW system.

Although its reliability is enhanced by the fact that it is normally operating, the service water system is subject to failure by transfer 5-9

to the closed position of either of two single manual valves in the dis-charge flowpath (Note: These two valves are now locked open). This failure mode could be difficult both to diagnose and to remedy. The presence of backup cooling capabilities diminishes the importance of service water losses for many failure modes, and a loss of service water emergency procedure has been developed to aid diagnosis and recovery."

5.2.1.2 Crystal River-3 Study A review of the preliminary results of a probabilistic risk assessment for Crystal River Unit 3 by the B&W Owners Group Safety and Performance Improve-ment Program (Ref. 40) indicated that the largest contributor to reactor acci-dent risks is a loss of service water. The review stated "The initiating event of loss of the Nuclear Services Closed Cycle Cooling (NSCCC) system has the largest contribution to core-melt risk I of all of the initiators in the Crystal River 3 PRA. This is not al-together surprising in view of the fact that the NSCCC system provides the only means of cooling for the motor-driven EFW pump and one HPI pump, primary cooling for another HPI pump, and backup cooling for the third l HPI pump. The sole sequence type in which this initiator appears in the core-melt sequences is the loss of makeup sequence. This sequence consists of an initiating event followed by some combination of failures resulting  !

in a total loss of makeup flow. If flow is not restored within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />,  !

primary inventory will have decreased through reactor coolant pump seal  !

leakage to a point where adequate core cooling can no longer be maintained and core uncovery begins. Since all of the makeup (HPI) pumps are depen-dent upon the NSCCC system for either primary or backup cooling, the loss of the NSCCC system is the dominant initiator for this sequence. The mean

. annual core-melt frequency for sequences with this initiator is 1.2 x 10 s per year."

5.2.1.3 Browns Ferry-1 Study The results of a probabilistic risk assessment of Browns Ferry-1, as a part of the NRC Interim Reliability Evaluation Program (IREP, Ref. 41) indicated that the service water system > at the plant contribute significantly to the reactor accident risks. The IREP report for Browns Ferry-1 stated:

"The single most important engineering insight relating to risk is the dependence of Browns Ferry Nuclear Plant Unit 1 on the residual heat removal (RHR) system for long-term decay heat removal....Six of the eight dominant sequences identified involve failure of the torus cooling and shutdown cooling modes of the RHR system. These sequences account for approximately 73% of the sum of the dominant sequence frequencies....

thus, the RHR system is the most risk-critical system at Browns Ferry Nuclear Plant, Unit 1."

"Since the RHR service water system provides cooling to the shutdown cooling and torus cooling modes of the RHR system, it contributes to every event tree through its effect on RHR unavailability."

"The emergency equipment cooling water system contributes to every event tree through its contribution to RHR system seal coolers and room coolers necessary for shutdown cooling or torus cooling."

5-10

1 5.2.1.4 Byron-1 Study i The importance of the service water system at Byron Unit 1 was examined by the l licensee and NRC staff (Refs. 42 and 43) and the results were discu, sed in a NRC Information Notice issued in 1986, IE IN 86-11 (Ref. 44). The Information Notice stated:

"In May 1984, the Byron Unit 1 licensee, Commonwealth Edison, submitted l to the NRC a probabilistic risk assessment (PRA) to -jusHfy extending l allowable outage times for certain equipment from 3 days to 7 days. The i NRC reviewed the study and determined that loss of both ESW pumps on Unit l 1 was not considered as an accident-initiating event. At present, Byron i Unit 1 is operating and has two ESW pumps--one operating and one on standby. If the operating train failed and the standby train would not start, the component cooling water system (CCW) would heat up. The nuclear steam supply system vendor, Westinghouse, has estimated that the l

heatup of the CCW would trip the CCW pumps in 6 minutes. CCW is essential for cooling the reactor coolant pump (RCP) seals, either directly or via the charging pumps, which also are cooled by CCW. Without cooling, the ,

RCP seals may possibly fail (the NRC Office of Nuclear Reactor Regulation I currently has the subject of RCP seal failure under study in its Generic l Issue 23) and cause a loss-of-coolant accident (LOCA). Assuming that case in the PRA, the ECCS pumps needed to mitigate the ensuing LOCA, also would fail without CCW. Thus, loss of ESW could result in a core melt.

On re-evaluation of the study under the assumption that loss of ESW is a LOCA initiating event, the core melt frequency was estimated at 0.001 per year. This result also assumed that additional pumps, such as the ESW pumps for Unit 2, would not be available to mitigate the LOCA at Unit 1.

To lower the estimated core melt frequency, the licensee committed to make at least one of the Unit 2 ESW pumps available to Unit 1 by means of a crosstie piping arrangement in the event of either of the Unit 1 ESW pumps becoming inoperable. The availability of the Unit 2 ESW pump reduces the core melt frequency estimated from this sequence of events by a factor of 25, and the overall core melt frequency by a factor of 5.

These estimates reaffirm the perceived weakness of the two-train system and the desirability of making the Unit 2 ESW pump available."

5.2.2 Estimates Based on Operating Experience A general expression for estimating the reactor core melt frequency due to a loss of service water system may be constructed as TRW, where T = Frequency of a service water system failure, 1 R = Failure probability of a timely recovery of the service water system, I and l W = Failure probability of equipment necessary for maintaining reactor core inventory or core heat removal, given a non-recoverable loss of l the service water system.

This expression is useful for the quantitative discussion of the results of operating experience review. Based on operating experience and as indicated in Chapter 4, the frequency of a service water system failure, T, is found to 5-11

. _ - - - _ -\

be 1.8 x 10 2 per reactor year (12 operating events involving a service water system failure in 650 years of light water reactor operation). Among these 12 operating events, five events involve difficulties in the recovery of the serv-ice water system. These five events occurred at Oconee 1 (LER 86-11), Salem 2 (LER 83-32), Susquehanna 1 (LER 86-21), Calvert Cliffs 2 (LER 82-34), and Catawba 1 (LER 85-68-01). Hence, the failure probability of a timely recovery of the service water system, R, is of the order of 10 1 The failure probability of equipment necessary to maintair. reactor core inven-tory or core heat removal given a non-recoverable loss of the service water For system, W, can assume a range of values depending on the circumstances.

example, if it were certain that the reactor coolant pump seal and the high pressure safety injection pumps would fail in a relatively short time due to the loss of service water cooling in a PWR, W would assume the value of unity.

If the non-recoverable loss of service water cooling to the RHR pumps or heat exchangers occurs in a BWR while RHR cooling is required, W would also be unity.

However, substantial uncertainty exists in the realistic assessment of the value of W because of possible heroic action by plant personnel; variation of equipment design and dependence on service water cooling; the availability of equipment not necessarily intended for mitigating the accident, but can be utilized; or other mitigating factors. For example, it is not totally certain that a catastrophic failure of the reactor coolant pump seal would occur from a loss of service water cooling (the NRC is currently evaluating this issue in Generic Issue 23). It is also not entirely certain how long it will take for ECCS pumps to f ail after a loss of room cooling or pump cooling. To reflect these uncertainties, a range of values from unity to 10 2 is assigned to W.

Therefore, TRW = (1.8 x 10 2 /RY) (10 1) (1 to 10 %)

= 10 3 to 10 5/RY.

This range of values for TRW, the reactor core melt frequency due to a loss of service water system, is consistent with those derived from comprehensive probabilistic assessments for selected plants. As stated in Section 5.2.1, the core melt frequency due to a loss of service water system was determined to be 10 3/RY for Byron 1,1.3 x 10 5/RY for Oconee 3, and 1.2 x 10 6/RY for Crystal River 3. These values indicate that the safety significance of the loss of service water systems is high. Therefore, the occurrence of service water system failures and degradations observed in numerous operating events represent a significant safety concern.

5-12

e i

l l

6 CONCLUSIONS ,

The service water system failures and degradations observed in operating events i and discussed in this study have significant safety implications. These serv- '

ice water systems failures and degradations are attributable to a great variety of causes, and have adverse impact on a large number of safety-related systems and components which are recuired to mitigate reactor accidents. S)ecifically, the causes of failures and cegradations include various fouling meclanisms (sediment deposition, biofouling, corrosion and erosion, pipe coating and cal-cium carbonate, foreign material and debris intrusion); single failures and design deficiencies; flooding; multiple equipment failures; personnel and pro-cedural errors; and seismic deficiencies. The safety-related systems and '

I components adversely impacted by a service water system failure or degradation include the component cooling water system, emergency diesel generators, emer-gency core cooling system pumps and heat exchangers, the residual heat removal system, containment spray and fan coolers, control room chillers, and reactor  ;

building cooling units.

Frequencies of service water system failures and degradations as observed in operating events are relatively high: 1.8 x 10 2 per reactor year for system failure and 4.1 x 10 2 per reactor year for system degradation. The reactor core melt frequency due to a loss of service water system is determined in the range of 10 3 to 10 3 per reactor year, based on the results of comprehensive probabilistic risk assessments and estimates derived from this operating exper-ience review. These values indicate that the safety significance of service water system failures and degradations is high.

In view of the high safety significanca associated with the nccurrence of serv-ice water system failures and degradation observed in operats ] events, prompt consideration should be given to implementing corrective actions to reduce both the frequency and potential consequences of a service water system failure or degradation. Several corrective actions proposed by AE00 are delineated in the next chapter.

l 6-1

i t

7 RECOMENDATIONS (1) Conduct, on a regular basis, performance testing of all heat exchangers, which are cooled by the service water system and perform a safety function, to verify heat exchanger heat transfer capability.

The performance testing should be conducted in accordance with ANSI /ASME Standard OM2-1982, "Requirements for Performance Testing of Nuclear Power Plant Closed Cooling Water Systems," and should explicitly determine both the heat exchanger flow and thermal capacity. Currently there is no reg-ulatory requirement on the periodic testing and verification of heat ex-changer thermal capacity. Performance testing in regular intervals would provide early detection of fouling of heat exchangers, which had been ob-served as a significant contributor to service water system degradation and which is not readily detected by flow measurements.

A majority (58%) of the service water system degradations observed in op-erating events involve fouling of the system by corrosion and erosion, sediment deposition, biofouling, foreign material and other fouling mecha-nisms, and the components fouled in the service water system are most fre-quently the heat exchangers. As indicated by operating experience, heat exchanger fouling is not readily detected by flow measurements alone.

Therefore, performance testing of the heat exchangers.is an effective corrective action to provide early detection of service water system degradations. This recommendation is consistent with General Design Criterion 46 (GDC 46), "Testing of Cooling Water Systems," delineated in Appendix A to 10 CFR Part 50.

(2) Require licensees to verify that their service water systems are not vulnerable to a single failure of an active component.

Licensees should review the design, installation, and operation of their service water systems to ensure that the system is not vulnerable to a 3 single failure of an active component. In the past seven years, single 1 failure vulnerabilities of service water systems have been reported at  !

seven different plants. A single failure of an active component, which  ;

is the failure of the active component leading to a system failure, has '

I high safety significance because of the large reactor accident risks attributable to the loss of service water cooling. This corrective action would help reduce the potential for service water system single failures. This corrective action is in compliance with the single fail- j ure criterion stated in G0C 44, "Cooling Water," in Appendix A to 10 CFR Part 50.

(3) Inspect, on a regul*r basis, important portions of the piping of the service water system for corrosion, erosion and biofouling.

The most dominant cause of service water system degradations observed in l operating events is corrosion and erosion of system components (27.9% of j l

7-1 l l

_ _ -, . , . _ , _ _ _ _ _ , _ - - . _ . . --m_.. . , . . , , , _ . , . _ - . _ _ _ . . , . , - . . - _ , _ , _

l l ,.

l the 276 operating events reported involve corrosion and erosion).

- Furthermore, the extent of corrosion and erosion of system piping often progressed to a through-wall leakage before detection. A failure of the service water system piping (a passive component) is usually not considered in the design of the service water system against single failure. Cur-rently, there is no regulatory requirement for periodic inspection of the service water system piping for corrosion and erosion. Additionally, bio-fouling of relatively stagnant portions of service water system piping had been observed to lead to significant system degradations. Periodic in-spections of these portions of system piping would allow for early detec-tion and ,)reventive measures. This recommendation consists of two elements:

- Identify the portion of piping of the service water system the failure of which would lead to a system failure or significant degradation, and

- Conduct periodic inspection of the identified piping for corrosion, erosion and biofouling.

(4) Reduce human errors in the operation, repair and maintenance of the service water system.

This can be accomplished by improving the training of reactor operators and maintenance personnel; developing detailed procedures for the repair, maintenance and recovery of service water system; and implementing tighter administrative controls in the operation and maintenance of the service water system. As observed in the operating events reviewed, a significant )

number of service water system degradations (16.7% of 276 events reviewed) involve personnel and procedural errors. These errors led to mispositioned valves, de-energizing the wrong equipment, inadvertent isolation of compo-nents, mispositioned breakers, mispositioned switches, and mislabeling of valves. Therefore, a reduction of these errors would help reduce the in-cidence of significant degradations of the service water system.

7-2

\

. i j

8 REFERENCES

1. U.S. Nuclear Regulatory Commission, Inspection Report No. 369/85-38, 370/85-39, McGuire Nuclear Station, Units 1 and 2, June 27, 1986.  ;

2. Licensee Event Report 87-04, Duke Power Company, Oconee 1, Docket No. 50-269, dated March 31, 1987.

3. Licensee Event Report 82-05, Carolina Power & Light Company, Brunswick 2,

, Docket No. 50-324, dated January 18, 1982.

4. E. V. Imbro and J. M. Giannelli, "Report on Service Water System Flow Block-age by Bivalve Mollusks at Arkansas Nuclear One and Brunswick," AE0D/C202, U.S. Nuclear Regulatory Commission, February 1982.

5. "Improving the Reliability of Open-Cycle Water Systems, Volume 1,"

NUREG/CR-4626, September 1986.

6. License Event Report 81-24, Virginia Power Company, North Anna 1, Docket No.50-338, dated May 18, 1981.

7. Licensee Event Report 85-18, GPU Nuclear Corporation, Oyster Creek, Docket i No. 50-219, dated Ju'ly 22, 1985. 1

8. Licensee Event Report 87-20, Florida Power & Light Company, Turkey Point 3, Docket No. 50-250, dated July 16, 1987.

9. Licensee Event Report 83-89, Southern California Edison and San Diego Gas & ,

Electric Company, San Onofre 2, Docket No. 50-361, dated July 30, 1983. j

10. Licensee Event Report 83-103, Southern California Edison and San Diego Gas & l Electric Company, San Onotre 2, Docket No. 50-361, dated July 30, 1983.

I

11. U.S. Nuclear Regulatory Commission, "Report to Congress on Abnormal Occur-rences," NUREG-0900, Vol.9, No 4, dated October-December 1986.

l

12. Licensee Event Report 82-34, Baltimore Gas & Electric Company, Calvert Cliffs 2, Docket No. 50-318, dated July 20, 1982.

13. Licensee Event Report 81-55-1, Virginia Power Company, Surry 2, Docket No.

50-281, dated August 20, 1981.

14. Licensee Event Report 86-08, Florida Power & Light Company, Turkey Point 3, Docket No. 50-250, dated February 14, 1986.

15. Licensee Event Report 82-24-1, Pennsylvania Power & Light Company, Susque- ,

hanna Units 1 & 2, Docket No. 50-387, dated April 6, 1984.

1 1

8-1 1

- - .- - - - . - . . . . ...-- -_- . - , . --1

I l

i Licensee Event Report 81-101, Tennessee Valley Authority, Sequoyah 1, j 16.

Docket No. 50-327, dated August 20, 1981. j

17. Licensee Event Report 85-22, Toledo Edison Company, Davis-Besse 1, Docket  !

No. 50-346, dated November 30, 1985.

18. Licensee Event Report 86-17, Detroit Edison Company, Fermi 2, Docket No.

50-341, dated June 24, 1986.  ;

19. Licensee Event Report 86-36, Consumer Power Company, Palisades, Docket No.

50-255, dated September 30, 1986.

20. Licensee Event Report 80-69, Alabama Power Company, Farley 1, Docket No.

50-348, dated November 12, 1980.

21. Licensee Event Report 80-01, Alabama Power Company, Farley 2, Docket No.

50-364, dated November 12, 1980.

22. U.S. Nuclear Regulatory Commission, Inspection and Enforcement Bulletin No. 80-24, "orevention of Damage Due to Water Leakage Inside Containment,"

dated November 21, 1980.

23. Licensee Event Report 83-32, Public Service Electric & Gas Company, Salem 2, Docket No. 50-311, dated June 23, 1983.

24. U.S. Nuclear Regulatory Commission, Preliminary Notification Report, PNO-III-87-73, Docket No. 50-304, dated May 22, 1987.

25. Harold L. Ornstein, "San Onofre Unit 1 Loss of Salt Water Cooling Event on March 10,1980," AE0D/C204, U.S. Nuclear Regulatory Commission, dated July 1982.

26. Licensee Event Report 86-21, Pennsylvania Power & Light Company, Susque-hanna 1, Docket No. 50-387, dated May 24, 1986.

27. Licensee Event Report 80-103, Georgia Power Company, E. I. Hatch 1, Docket No. 50-321, dated August 22, 1980.

28. Licensee Event Report 82-15, Public Service Electric & Gas Company, Salem 1, Docket No. 50-272, dated March 16, 1982.

29. Licensee Event Report 84-01, Consumer Power Comp'any, Palisades, Docket No.

50-255, dated January 8, 1985.

30. Licensee Event Report 84-01-1, Carolina Power & Light Company, Brunswick 1 Docket No. 50-325, dated January, 1984. l

31. Licensee Event Report 85-23, GPU Nucl car Cr.poration, Oyster Creek, Docket i No. 50-219, dated December 11, 1985.

32. Licensee Event Report 86-24, Pennsylvania Power & Light Company, Susquehanna 1, Docket No. 50-387, dated .*11y ' 1986.

I 8-2 l

l

J

33. U.S. Nuclear Regulatory Commission Internal Memorandum, "Survey Results )

of Temporary Instructions 2515/77," from E. Jordan to R. Baer, dated March 20, 1987.

34. Letter from S. Varga (NRC) to J. Brons (PASNY), "Safety System Outage Mod-ification Inspection (Design), Docket No. 50-286/86-013," dated September 8, 1987.

35. Letter from D. Crutchfield (NRC) to G. Trevors (NPPD), "Safety System Func-tional Inspection Report No. 50-298/87-10," dated September 1987, i

36. Licensee Event Report 80-39-02, Georgia Power Company, E. I. Hatch 1, Docket No. 50-321, dated April 11, 1980.

37. Licensee Event Report 81-55-01, Virginia Power & Light Company, Surry 2,  !

Docket No. 50-281, dated August 20, 1981.

38. J. A. Haried, "Event Involving Service Water System at Nuclear Power Plants,"

NUREG/CR-2797, dated November 1982.

39. "Oconee PRA, A Probabilistic Risk Assessment of Oconee Unit 3," NSAC/60, June 1984.

40. Blake Putney, "Risk Assessment Review of B&W Plant Transient History, Phase 1," SAI Corporation, (ated October 31, 1986.

41. "Interim Reliability Evaluation Program Analysis of the Browns Ferry, Unit 1, Nuclear Plant," NUREG/CR-2802, August 1982.

42. "Safety Evaluation Report Related to the LC0 Relaxation Program for the Byron Generating Station (TAC No M57242)," Memorandum from T. P. Speis (NRC) to H. L. Thompson, Jr. (NRC), January 15, 1986.

43. "Analysis of Allowed Outage Time at the Byron Generating Station,"

NUREG/CR-4404, June 1986.

44. U.S. Nuclear Regulatory Commission Information Notice 86-11 "Inadequate Service Water Protection Against Core Melt Frequency," February 25, 1986.

l l

l l

l 8-3 l

APPENDIX A

~

Selected Operating Events Involving Service Water System Failure or Degradation Record # Plant Name Reference Date Consequence Comments 1 San Onofre 1 LER 206/80-01 01/10/80 Potential loss of salt Salt water cooling system water cooling system. not seismically qualified.

Pipe support installation error.

2 San Onofre 1 LER 206/80-06 03/10/80 Complete loss of salt One pump shaft sheared j

water cooling system. (vibration), 2nd pump

' discharge valve failed (mechanical failure) and the auxiliary pump lost suction due to inadequate prime.

3 San Onofre 1 LER 206/80-08 03/18/80 Potential loss of one South pump had two loose 2, salt water pump. and corroded concrete

'. anchors attaching the pump to the foundation.

j 4 San Onofre 1 LER 206/81-09 06/09/81 Partially blocked salt Gooseneck barnacles water heat exchanger. caused valve malfunction on discharge of HX.

Protracted cold shut-down prevented normal heat treatment to i

remove barnacles.

5 San Onofre 1 LER 206/82-15 05/13/82 Potential loss of one Maintenance procedure salt water cooling pump. did not specify adequate precautions.

6 San Onofre 1 LER 206/84-08 07/30/84 Potential loss of salt Corrosion of structure's water system pump house. steel reinforcement.

?

1

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 7 San Onofre 1 LER 206-84-12 10/10/84 Inoperability of both Personnel aligned shut-j RHR trains. down cooling to an RHR HX without saltwater cooling i

l flow. RHR quickly restored.

8 Haddam Neck LER 213/86-09-2 02/05/86 Potential flooding of 2 Flood protection equip-of 4 service water pumps. ment was inadequate to prevent potential flooding of pumps.

9 Indian Point 2 LER 247/81-08 04/01/81 Service water system 15 welds did not meet a

pipe wall thinning. seismic minimum i

requirements.

10 Indian Point 2 LER 247/81-10 05/06/81 Reduction in service Yalve seat rings dis-water pumping lodged on two pump

> capacity. discharge check valves.

A Lonc tern corrosion of seat rings believed to be material problem.

]

11 Indian Point 2 LER 247/81-21 08/29/81 Service water Leak discovered downstream d piping leak. of fan cooler motor cooler in piping elbow.

J j 12 Indian Point 2 LER 247/82-26-1 06/18/82 Low service water Three pumps affected.

i pump head. Excessive wear of pump impellers.

13 Indian Point 2 LER 247/82-31 08/11/82 Service water Two flexible hose sec-piping leaks. tions replaced due to pin hole leaks.

14 Indian Point 2 LER 247/83-10 04/01/83 Inoperable service water Rope four.d wrapped around pump. pump impeller.

l

APPENDIX A (Continued)

Reference Date Consequence Comments Record # Plant R.me Turkey Point 3 LER 250/86-08 02/14/86 Potential that intake Assuming failure of one 15 temperature control valve cooling water flow requirements for coincident with loss of DBA cannot be met. offsite power, ICW can't provide required flow during DBA.

LER 261/83-03 04/10/83 Unit shutdown. Service water system 16 Robinson 2 caused a leak and degre-l dation of containment boundary.

17 Robinson 2 LER 261/83-06 04/27/83 Inoperable service Failure of pump

water pump. attributed to debris in the impeller / casing 1

assembly.

LER 272/80-49 08/30/80 Loss of a centrifugal Pump declared inoperable

$ 18 Salem 1

' charging pump. when leak in service water supply to lube oil cooler discovered.

Salem 1 LER 272/81-71 07/20/81 Loss of fan cooler High pressure sensing 19 line of flow transmitter unit.

was clogged with silt from service water cooling flow.

Sales 1 LER 272/82-83-108/31/81 Loss of a centrifugal Service water leak on 20 charging pump oil cooler.

charging pump, L

Salem 1 LER 272/81-90 09/22/81 Loss of component Dissimilar metal weld 21 between valve and carbon cooling water heat j steel heat exchanger exchanger.

cracked.

i LER 272/81-119 12/6/81 Loss of charging pump. Service water leak on the 22 Salem 1 return line of the oil

' cooler.

i 1

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 23 Salem 1 LER 272/82-15 03/16/82 Loss of all service Redundant CCW and SW pumps water and component tagged out for maintenance.

cooling. Loss of one vital bus (short) caused loss of all service water and CCW for about 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

24 Salem 1 LER 272/82-41 06/26/82 Loss of a charging pump. Service water leaked into the gear oil through the gear oil cooler.

25 Salem 1 LER 272/82-69-1 08/31/82 Loss of a charging pump. Service water leak into the pump lobe oil cooler outlet piping.

26 Salem 1 LER 272/82-91-1 11/30/82 Several degraded welds. Service water leakage 4

2 through a weld into

$. a component cooling water heat exchanger.

27 Salem 1 LER 272/83-26 05/30/83 Service water flow was Inlet valve plugged less than required by with shells and debris.

technical specifications.

28 Salem 1 LER 272/84-08-1 03/09/84 Nine welds exhibited Pitting corrosion deter-pitting corrosion. mined to be caused by the low velocity brackish water in con-tact with stainless steel piping.

29 Surry 1 LER 280/82-100 09/22/82 Loss of service Air bound one service water pump. water pump while using air to clear sensing i lines to the service j water strainer D/P gauges.

a l

j .

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 30 Surry 1 LER 280/82-124 12/14/82 Loss of one train of Service water inlet service water system. valve to heat exchanger inadvertently de-

) energized. Operator tagged wrong breaker.

i 31 Surry 1 LER 280/83-32 07/18/83 Insufficient service Debris stuck open the water pump flow. check valve allowing backflow.

32 Surry 1 LER 280/86-24 08/13/86 Clogged chillers. Chillers clogged by unfiltered service water 1

l flowing through the i

j chiller tubes.

1 33 Surry 2 LER 281/80-29 10/12/80 Inoperable service Eel caught in pump water pump. impeller. Redundant l pump available.

]

u' Material entrained 34 Surry 2 LER 281/80-40 11/14/80 Low service water pump i

discharge pressure. in service water j deposited on the pump impeller.

l 35 Surry 2 LER 281/81-10 02/09/81 Low pump discharge Eel ledged in service water pressure. pump impeller.

j 36 Surry 2 LER 281/81-26 04/29/81 Loss of service water Maintenance personnel j

j pump. splashed water or operable

' pump while removing a valve in the redundant pump flowpath.

]! All service water lost A carbon steel cap screw i 37 Surry 2 LER 281/81-55-1 08/20/81 to charging pumps. on one pump failed,

] Plant shutdown performed. binding the impeller to i

' the casing. The redundant pump shorted as a result l

J of water from cap screw

falling onto the pump.

i

o APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 38 Surry 2 LER 281/82-09 01/28/82 Loss of one charging Debris caused inadequate pump. service water flow to the charging pump lube oil cooler.

39 Surry 2 LER 281/82-39 7/28/82 Flooded service water The valve pit was flooded valve pit. shorting the valve motor.

Flooding caused when draining the condenser waterboxes for cleaning.

40 Indian Point 2 IE Bulletin 10/17/80 Flooding of 100,000 gallons found in 80-24 containment. containment from service water leakage. Reactor pressure vesse! wetted.

41 Surry 2 LER 281/83-44 09/29/83 Loss of service water Pump discharge valve 2, pump. found closed with pump di in standby.

42 Surry 2 LER 281-85-02-1 02/15/85 Isolated seal cooler. Service water was isolated to the seal cooler when operators shifted coolers without following procedure.

43 Indian Point 3 LER 286/83-06 10/17/83 System not seismically Steel plates holding the qualified. seismic restraint collars on the service water pumps

{

were not in place.

44 Zion l' LER 295/85-39 10/15/85 Cross-tie between units Service water cross-tie unavailable. valve between Units 1 and 2 was inadvertently closed.

45 Zion 1 LER 295/86-01 01/12/86 One AFW pump inoperable. 2 service water valves to 1 AFW pump lube oil cooler were unknowingly closed for 20 days.

I

~

APPENDIX A (Continued) l Record # Plant Name Reference Date Consequence Comments 46 Zion 2 LER 304/82-09 04/09/82 Loss of cooling to The service water supply both AFW pumps. valve to both AFW pump lube oil coolers failed to open because of accumulation of silt.

47 Zion 2 LER 304/83-45 12/13/83 Loss of one fan cooler. Service water leak in one cooling coil of one fan cooler found.

I 48 Zion 2 LER 304/84-13 05/03/84 Multiple internal All fan cooler units pitting of fan cooler affected.

t coils.

i

) 49 Kewaunee LER 305/83-05-1 02/16/83 Loss of one EDG. Service water outlet valve of the EDG oil 2

cooler stuck closed.

O Leak on the CCW HX 50 Kewaunee LER 305/83-27-1 10/26/83 Loss of one CCW heat exchanger. caused by sand erosion due to turbulence on outlet side of temper-l ature control valve.

) 51 Kewaunee LER 305/84-18-1 09/28/84 Several fan cooler Service water side of units less than designed several cooler units flow. were found partially plugged with silt.

52 Salen 2 LER 311/81-64 08/06/81 Leaks on the fan cooler Leaks at welds from units. service water erosion.

53 Salem 2 LER 311-81-99 09/03/81 Inoperable fan cooler Low service water flow 4

unit. indication through cooler caused by flow transmitter clogged with silt.

I

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 54 Salem 2 LER 311/81-117 11/10/81 Low service water flow Caused by silt in the through cooler. flow transmitter sensing line.

4 55 Salem 2 LER 311/82-17-1 02/28/82 Low service water flow Flow transmitter was through cooler. plugged with silt.

I 56 Salem 2 LER 311/82-28-1 05/04/82 Low service water flow Flow transmitter was through cooler. plugged with silt.

57 Salem 2 LER 311/82-41-1 05/16/82 Low service water flow Oysters restricted through cooler. service water flow.

Continuous chlorina-tion program begun to

' prevent reinfestation.

58 Salem 2 LER 311/82-46 05/27/82 Low service water flow American oysters clogged

.3, through cooler. tube bundle.

ok 59 Salem 2 LER 311/82-49 06/17/82 Low service water flow American oysters clogged 7

through cooler. tube bundle and a valve.

60 Sales 2 LER 311/82-50 05/17/82 3 fan cooler units American oysters clogged

' inoperable. cooler unit valves.

61 Salem 2 LER 311/82-58 07/02/82 Low flow through fan American oysters plugged cooler units. a valve.

Salem 2 LER 3.11/82-65 07/20/82 No flow through fan Rod end bearing assembly 62 cooler unit. on service water valve to cooler failed.

63 Salem 2 LER 311/82-70-1 08/09/82 Leak on fan cooler unit. Silt particles eroded a cooling coil.

64 Salem 2 LER 311/82-73 08/13/82 Leak on fan cooler unit. Silt particles in service water caused erosion.

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 65 Salen 2 LER 311/82-74 08/13/82 Leak on fan cooler unit. Silt particles in service water caused erosion.

i 66 Salem 2 LER 311/82-77-1 08/18/82 Leak on fan cooler unit. Silt particles in the service water caused erosion.

1 67 Salem 2 LER 311/82-80 08/21/82 Leak on fan cooler unit Erosion of coppen nickel t cooling coils caused by silt in service water.

68 Salem 2 LER 311/82-83-2 08/12/82 Low service water flow American oysters clogged the cooler.

through cooler unit.

69 Salem 2 LER 311/82-86 09/15/82 Service water pump Service water pump motor bearing oil cooler i inoperable.

j failed due to accelerated 1

corrosion and erosion.

3-um 3

70 Salen 2 LER 311/82-91 09/06/82 Leak on fan cooler unit. Erosion of copper nickel l

j cooling coils by silt laden service water.

71 Salem 2 LER 311/82-92-1 09/08/82 Leak on fan cooler unit. Erosion by silt in service water.

i 72 Salem 2 LER 311/82-96 08/31/82 Low service water flow Silt buildup in through fan cooler unit. cooling coil.

73 Salen 2 LER 311/82-98 09/01/82 Low service water flow Silt buildup in through fan cooler unit. cooling coil.

74 Salem 2 LER 311/82-99 09/02/82 Low service water flow Silt buildup in cooling through cooler. coil.

75 Salem 2 LER 311/82-100 09/15/82 Leak on fan cooler unit. Erosion caused by silt in service water.

76 Salem 2 LER 311/82-101 09/16/82 Leak on fan cooler unit. Erosion of cooling coils by silt in service water.

APPENDIX A (Continued) l Record # Plant Name Reference Date Consequence Comments 77 Salen 2 LER 311/82-105 09/08/82 Low service water flow Silt buildup in cooling through fan cooler unit. coils.

78 Sales 2 LER 311/82-109 09/23/82 Leak on fan cooler unit. Silt in service water caused erosion of cooler coils.

79 Salem 2 LER 311/82-113 10/05/82 Leak on fan cooler unit. Silt in service water caused erosion of cooler coils.

80 Salem 2 LER 311/82-115 09/28/82 EDG inoperable. Silt in service water caused leak in the l EDG oil cooler.

4 81 Salem 2 LER 311/82-117 09/29/82 Low service watcr flow American oysters plugged 3F through fan cooler unit. cooler.

E$

i 82 Salen 2 LER 311/82-119 10/08/82 Leak on fan cooler unit. Silt in service water i caused erosion of coils.

! 83 Salen 2 LER 311/82-120 10/11/82 Leak on fan cooler unit. Erosion of cooling coils caused by silt in service water.

J 84 Salen 2 LER 311/82-1f: 10/18/82 Leak on fan cooler unit. Silt in service water caused erosion of cooling

' coils.

i 85 Salen 2 LER 311/82-128 10/31/82 Leak on fan cooler unit. Silt in service water caused erosion of cooling coils.

86 Salen 2 LER 311/82-130 10/31/82 Low service water flow Silt buildup in cooling to fan cooler unit. coils.

87 Salen 2 LER 311/82-135 11/21/82 Leak on fan cooler unit. Silt in service water caused erosion of cooling coils.

i - . _ _ _ _ _ - - - - - _ _ - - _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ . __

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 88 Salen 2 LER 311/82-136 11/24/82 Leak on fan cooler unit. Silt in service water caused erosion of cooling coils.

89 Salem 2 LER 311/83-32 06/23/83 Complete loss of service Six feet of water in the water system. service water bay due to failed gasket in piping.

Gasket failure attributed to inadequate installation.

90 Salen 2 LER 311/85-01 01/28/85 EDG inoperable. Service water valve in-stalled incorrectly. EDG tripped during retest following valve replacement on high jacket water temp.

91 Cook 1 LER 315/82-43 02/23/82 ESW loop inoperable. ESW pump discharge valve 37 shaft binding. Caused by CI buildup of corrosion products.

92 Cook 1 LER 315/82-48 06/23/82 Loss of CCW train. Heat exchanger ESW dis-charge valve would not close due to buildup of corrosion products.

93 Cook 1 LER 315/82-95 10/08/82 Containment spray heat ESW supply valve to heat exchanger inoperable. exchanger found closed.

Valve closed during maintenance and not returned to proper position.

94 Cook 1 LER 315/83-14 02/02/83 Loss of one service Two valves would not

' water pump. close fully.

95 Sequoyah 1 LER 327/81-78 07/30/81 Two EDGs inoperable. With one EDG out for maintenance, removed relief valves for operable EDG's ERCW heat exchanger by

mistake.

APPENDIX A (Cot *.inued)

Record # Plant Name Reference Date Consen,uence Comments i

96 Sequoyah 1 LER 327/81-97 08/21/81 Missing pipe protecticn Service water piping structure. could be damaged in

the event of a main q steam line break. '

97 Sequoyah 1 LER 327/'31-101 08/20/81 Service water system In worst case scenario, the  ;

j would not provide service water sys'm  ;

adequate flow. would provide inadequate 1 flow for EDGs, contain- i ment spray, HPI, M, and RHR rnos coolers and

' other loads.

98 Sequoyah 1 LER 327/82-27 03/07/82 Low ERCW flow through Fresh water clams in

, heat exchanger. piping (15 gallons i

of class).

i T M 99 Sequeyah 1 LER 327/85-05 01/15/85 Potential loss of both ERCW piping downstream l ' EDGs due to flooding. of EDG coolers not 1 seismically qualified.

f Failure could result I in localized flooding of EDGs.

100 Sequoyah 2 LER 328/85-06 04/06/85 Inoperability of CS pump. Air control valve for ERCW to containment spray pump room cooler placed in wrong position following surveillance.

101 Beaver Valley 1 LER 334/80-65 09/12/80 Potential for loss of Overstress condition exists all service water. exists at one location on each of the two reactor plant river water supply lines.

102 Beaver Valley 1 LER 334/80-68 09/17/80 Inoperable charging pump. Two check' valves installed backwards for river water supply to pump oil cooler.

APPENDIX A (Continued)

Record # Pirat Name Reference Date Consequence Comments 103 Beaver Valley 1 LER 334/82-19 05/21/82 Potential for contain- lhrough wall leak in i ment leakage during DBA. expansion joint.

l 104 North Anna 1 LER 338/80-02 01/07/80 Potential loss of Incorrect valve weights service water makeup used in support calculations

]i liae. for SW makeup line from

! the screen wash pumps. *

$ 105 North Anna 1 LER 338,30-16-1 01/16/80 Potential loss of Pipe hangers overstressed i

service water makeup for SW makeup water screen

' line. pump discharge lines. 1 1 '

l 106 North Anna 1 LER 338/81-24 04/21/81 Potential loss of all Through wall leax in service HPI pumps at both units. water supply header to both l' Unit 1 and 2 charging pumps I caused by sulfate reducing i T bacteria.

l North Anna 1 LER 338/81-46 05/27/81 Potential loss of all Service water supply

, 107 HPI pumps at both units. header leak to both units charging pump coolers  !

caused by sulfate reducing i

tacteria.

! 108 North Anna 1 LER 338/81-71 08/27/81 Potential loss of all Study done at Lehigh HPI pumps at both units. University cited cause I of leaks due to corrosion caused by aggressive water l! and bacterial reduction of mild steel piping.

I See Record #108.

109 North Anna 1 LER 338/81-83 12/02/81 Potential loss of all

] HPI at both units.

• 110 P,rth Anna 1 LER 338/82-06 03/05/82 Potential loss of all See Record #108.  ;

j HPI at both units.

1 i 111 North Anna 1 LER 338/82-81 12/03/82 Potential loss of all See Record #108.

l HPI at both units.

i i t_-.__ _ . _ _ _ _ _ _ _ _ . __ _ _ . __ _ _. . . .

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 112 North Anna 1 LER 338/83-48-1 07/09/83 Potential loss of all Licensee changed out HPI at both plants. piping to charging pump lube oil coolers with stainless steel piping on 12/16/83.

113 North Anna 1 LER 338/85-04-1 03/28/85 Potential common mode 50 ft of service wate-loss of service water supply and return piping l system. between the pumphouse and

! safeguards area do not meet tornado protection requirements.

I i 114 North Anna 2 LER 339/83-07 02/01/83 Potential loss of all Continued leakage from HPI to both units. service water system piping.

T

$: 115 North Anna 2 LER 339/83-14 01/13/83 Potential loss of all See Record #114.

HPI to both units.

4 l 116 Trojan LER 344/84-02 01/27/84 Loss of B train safety SI pump lube oil cooler injection pump. found packed with sedi-ment preventing service

! water flow through cooler.

117 Trojan LER 344/84-21/1 10/11/84 Inadequate service water Valves controlling flow through CCW heat service water flow exchangers. through all CCW heat exchangers positioned so that inadequate flow passed through coolers.

118 Farley 1 LER 348/80-69 11/12/80 Potential loss of both Inadequate train service water trains. separation. Water for lubrication and cooling of each train's pump l

i supplied by opposite train.

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments l

i 119 Farley 2 LER 364/80-01 11/12/80 Potential loss of all Same as Unit 1.

service water during Train A provides loss of offsite power. cooling to Train B and vice versa.

1 l 120 Farley 2 LER 364/82-28 06/09/82 Potential loss of swing A and B. train service l

charging pump, water valves to the swing charging pump were mislabeled.

121 Farley 2 LER 364/83-34 08/26/83 Insufficient cooling Service water valves to i flow through coolers. coolers closed during maintenance and not I reopened upon completion.

122 McGuire 1 LER 369/85-30 10/09/85 Loss of A train of the The local valve position I

3' nuclear service water indicator was reversed, I l$ system. thus the valve was

)

indicating open when

it was actually closed.

I 123 McGuire 1 LER 369/86-06 03/11/86 Servic) water flow to Inadequate testing of both some equipment was lower units nuclear service water systems. Sediment fouled l than fSAR requirements.

containment spray heat exchangers.

124 McGuire 2 LER 370/85-01 01/23/85 Potential loss of Service water valve j service water cooling to partially open. Not component. locked open as required.

125 Catawba 1 LER 413/85-68-1 11/25/85 Potential loss of both forque switches for a l nuclear service water supply valve and a I trains. discharge valve in each train were set at the low 1

end of the allowable tolerance. Valves failed in mid position.

l .

4 APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 126 Catawba 2 LER 414/86-31-107/08/86 Both trains of nuclear Both EDGs inoperable due l

service water system to different mechanical i

inoperable. problems causir.g both service water trains to be inoperable.

j 127 Palisades LER 255/84-01 01/08/84 Loss of all EDGs. During planned loss of off-1 site power for maintenance, operators did not realize that there would be no ser-vice water flow for EDG cooling. EDG overheated and tripped in 50 minutes.

h 128 Palisades LER 255/82-24-1 08/19/82 Potential loss of all Service water pump runout l service water flow could occur as a result of j

i T during a loss of offsite CCW HX outlet valves 5 power. failing open during a loss

] of offsite power.

1 i

i 1

j 129 Palisades LER 255/86-24 08/04/85 Loss of two containment Service water flow to two air coolers. coolers was inadequate because the valves had

! been mistakenly throttled.

I 130 Maine Yankee LER 309/80-13 05/07/80 Potential loss of high Charging pumps improperly pressure injection lined up with service j pumps. water cooling.

i 131 Robinson 2 IE Information 11/19/84 Through wall leaks in Microbiologically l Notice 85-30 service water piping induced corrosion of stainless steel piping.

2 I to containment chillers.

132 Calvert Cliffs 1 LER 317/80-32 07/01/80 Lcr.3 of one service Corrosion buildup on water heat exchanger. valve actuator caused valve to seize.

i

133 Palo Verde IE Information 01/01/84 Leaking welds in Microbiological 1y Notice 85-30 essential spray pond induced corrosion.

l Piping.

APPENDIX A (Continued)

Record # Plar.t Name Reference Date Consequence Comments 134 Calvert Clirfs 1 LER 317/80-52 09/17/80 Loss of one service Tube leak on heat water heat exchanger. exchanger.

135 Calvert Cliffs 1 LER 317/81-29 04/01/81 Service water piping Inadequate piping supports did not meet seismic for service water requirements. subsystem.

136 Calvert Cliffs 1 LER 317/81-63-106/17/81 Loss of one CCW heat Service water outlet valve exchanger. on component cooling water heat exchanger failed due to rust.

137 Calvert Cliffs 1 LER 317/84-05-1 05/03/84 2 of 4 CCW heat Wall thinning and through exchangers inoperable. wall leakage on two CCW HXs.

3' 138 Calvert Cliffs 2 LER 318/82-34 07/20/82 Complete loss of Loss of salt water flow

, t$ salt water cooling caused by failure of valve 4

system. when hinge pins sheared.

Calvert Cliffs 2 LER 318/82-35 07/01/82 Loss of one service HX drain plug broken

) 139 water heat exchanger. off. Corroded pipe nipple and valve. Plant

'. is replacing fittings with brass and bronze fittings to prevent corrosion.

I 140 Calvert Cliffs 2 LER 318/85-09 10/15/85 Loss of one service Service water HX fouled with

water HX while redun- gallons of shells. Licen-dant train out of see reevaluating system service. maintenance anti-biofouling system.

141 Millstone 2 LER 356/80-18-1 05/08/80 Service water system Hangers inadequate for l

not seisuically several service water qualified. piping runs.

i 142 Millstone 2 LER 336/80-38 11/16/80 Loss of one service Loss of strainer caused water strainer. by corrosion.

1

O APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 143 Millstone 2 LER 336/81-23 06/13/81 Leak on C service water Corrosion probably occurred pump discharge header. as a result of coating failure of the carbon steel pipe.

144 Millstone 2 LER 336/82-10 04/01/82 Loss of a service water Piping leak in a service train. water header. Caused by coating failure and sub-sequent corrosion of carbon steel piping.

145 Mills *7ne 2 LER 336/82-53 12/28/82 Loss of service water Both A and G HXS aligned to system redundancy. same header.

T 146 Millstone 2 LER 336/83-31 12/22/83 Service water system Schedule 40 pipe installed

$$ act seismically in lieu of standard pipe.

qualified. Pipe adequate, however, 5 piped hangers inadequate.

147 San Onofre 2 LER 361/83-72 07/06/83 2 heat exchangers Marine growth clogged inoperable. salt water system traveling screens.

148 San Onofre 2 LER 361/83-89 07/30/83 Salt water strainers Debris clogged salt water clogged. Rapid power system traveling screens.

reduction required.

149 San Onofre 2 LER 361/83-103 07/30/83 Salt water strainers Debris clogged traveling clogged. Rapid power screen system.

l reduction required.

150 San Onofre 3 LER 362/83-41 07/06/83 Clogging of screens Revising procedure to results in exceeding preclude concurrent fouling LCO. of both CCW trains during excessive debris buildup in single intake structure.

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 151 ANO 2 LER 368/80-72-1 09/03/80 Low flow through Asian clam o'uildup in hcat exchanger. service water side of containment building cooler.

152 ANO 2 LER 368/81-35 10/05/81 Inoperable safety Corrosion products from injection pump due to carbon steel oiping clogged insufficient service cooler. Piping replaced water flow. with stainless steel.

153 ANO 2 LER 368/82-03-1 01/20/82 Inoperable LPSI pump Asiatic clan shells lodged due to low service in cooler obstructing flow.

water flow.

154 Oconee 1 LER 269/80-04 02/16/80 Loss of one pump. Erosion caused by constant Y Redundant pump flow of lake water through 0; operable. the high pressure service water pump motor cooler caused tube leakage.

155 Oconee 1 LER 269/80-22 07/07/80 Loss of one service Erosion and corrosion of water pump. high pressure service water pump motor cooler tubes.

156 Oconee 1 LER 269/80-26 08/11/80 Loss of one service Erosion of high pressure water pump. service water pump motor i cooler tubes caused leak into pump motor casing.

157 Oconee 1 LER 269/81-14 07/17/81 Loss of control power Loss of control power to l

j to both A and B pumps. both HPSW pumps when

+ control breakers were inadvertently left open.

158 Oconee 1 LER 269/86-02 02/03/86 LPSW not seismically Valves and piping not qualified. seismically qualified.

l l

1 1

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Commer.ts 159 Oconee 2 LER 270/80-24 11/04/80 Loss of one HPI pump. Isolation of low pressure service water to pump resulted in high bearing temp. Pump declared inoperable.

160 Oconee 2 LER 270/81-01-1 01/20/81 Loss of one HPI pump. No flow of LPSW to the HPI pump.

161 Crystal River 3 LER 302/83-22 05/16/83 Service water leak on Leaks on outlet piping of outlet of two heat two nuclear service HXs.

exchangers. Deterioration of inner PVC liner led to corrosion /

erosion of piping.

4 162 Crystal River 3 LER 302/84-11 05/12/84 Loss of independence Discharge check valve on T of emergency seawater one of the nuclear service 3 pumps. seawater pumps stuck open due to corrosion.

l j 163 Crystal River 3 LER 302/85-24-2 10/28/85 Service water piping Pedestals and piping

and pedestals overloaded. supports not sufficient to 1 withstand operating loads.

Cracked pedestals found.

4 164 Rancho Seco LER 312/81-16-2 03/12/81 Loss of one HPI pump. Partial plugging of lube t

oil cooler caused by i

excessive carrosion product buildup. Epoxy coated the cooler heads to prevent i

' recurrence.

165 ANO 1 LER 313/80-10 03/07/80 Service water piping 28 hangers were determined not seisnically to be inoperable per IE l

qualified. Bul1etin 79-14.

166 ANO 1 LER 313/80-11-9 04/01/80 Service water piping 46 hangers declared

not seismically inoperable per IE

qualified. Bulletin 79-14.

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 167 ANO 1 LER 313/81-01-101/17/81 Service water piping Additional piping supports not seismically required.

qualified.

168 ANO 1 LER 313/83-05 03/28/83 Potential to lose 2 Upper oil reservoir piping of 3 pumps during altered for maintenance.

seismic event. Piping inadequately supported.

169 Davis-Besse 1 LER 346/82-28 06/11/82 Valve froze open. Swing check valve in service water return line from CCW HX froze open due to corrosion products.

170 Davis-Besse 1 LER 346/84-09-2 06/18/84 Both pump rooms Both AFW pump roomc could potentially floodable. be flooded in the event non-T seismic turbine plant cooling Z water piping serving AFW coolers ruptured.

171 Davis-Besse 1 LER 346/85-22 11/30/85 Only one of two trains Design deficiency involv-of containment air ing service water cooling cooling available post to CAC heat exchangers.

LOCA.

172 Oyster Creek LER 219/81-05 01/06/31 Loss of one emergency Clogged pump suction service water pump. strainer discovered during operability check of installed meter.

173 Oyster Creek LER 219/81-17 04/15/81 One loop of contain- Associated emergency ment spray inoperable. service water loop inoperable when strong winds concentrated sea lettuce in the intake canal overwhelming trash removal system.

174 Oyster Creek LER 219/81-24 06/08/81 Two ESWS pumps Grass clogging problems inoperable. in the intake structure.

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 175 Oyster Creek LER 219/85-18 07/22/85 Loss of containmer.t Containment spray heat ex-spray system caused by changers plugged by coal loss of emergency tar enamel used to coat the service water. emergency service water piping for corrosion protection.

176 Oyster Creek LER 219/85-23 12/11/85 Service water piping Def.eiencies in the ESW not seismically qual- piping could render system ified. inoperable during a seis-mic event.

177 Oyster Creek LER 219/86-21 08/28/86 Piping not seismically ESWS piping not seismically qualified. qualified.

178 Millstone 1 LER 245/82-02 01/15/82 Loss of one service B ESWS pump inoperable i

water pump. after failing to meet minimum discharge pres-27 sure requirements due to pg i

marine fouling of impeller.

179 Millstone 1 LER 245/82-14 06/14/82 Loss of one ESWS pump. D ESWS pump discharge pressure low due to marine growth fouling of impeller. Mussels and i

class also found in the suction volute.

180 Dresden 3 LER 249/85-06-1 02/22/85 HPIC system inoperable. Service water flow to l

HPCI room cooler inadver-tently valved out. All important service water i valves to be locked open.

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 181 Quad Cities 1 LER 254/80-28 10/23/80 Potential loss of EDG. Leak on a RI'R service water pump flooded the 1/2 EDG cooling water pump motor. Existing sump pump system inade-quate to handle flooding.

182 Quad Cities 1 LER 254/81-09 04/07/81 Loss of one RHR service RHR service water pump water pump. did not meet flow requirements. Pieces of driftwood found in pump.

183 Quad Cities 1 LER 254/82-30 09/05/82 Loss of D RHR service Burnt packing on pump.

water pump. Packing tightened too T much because abrasives in E*, river water causes pump

' leakage.

184 Quad Cities 1 LER 254/83-29 07/11/83 Loss of 8 service Pump inboard bearing

water pump. surfaces pitted and imbedded with dirt.

i Water leakage through packing contaminated bearing oil reservoir

' with sediment.

I 185 Quad Cities LER 254/85-08 06/17/85 1/2 EDG cooling water Broken vent line on RHR pump inoperable. service water pump flooded vault with service water pump and 1/2 EDG cooling water pump.

)

' LER 254/85-19 11/25/85 Loss of D RHR service D RHR SW pump did not 186 Quad Cities seet flow requirements.

water pump.

Pieces of wood found in pump impeller.

)

i i _

=_ . .- _ . - _ - _ _ - - .

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 187 Quad Cities 1 LER 254/86-24 08/11/86 Service water piping Cross-tie piping modifi-not seismically cation between Units 1 qualified. and 2 not adequately supported.

188 Browns Ferry 1 LER 259/81-47 08/22/81 Loss of 3 RHRSW pumps RHRSW pump air vacuum and 3 EECW. valve failed to seal and the A RHRSW pump room flooded. Flooding rendered A1, A2, A3 RHRSW/EECW pumps inoperable.

i 189 Browns Ferry 2 LER 260/83-84 12/29/83 Loss of one EECW pump. Debris from river clogged EECW pump strainer.

190 Monticello LER 263/80-19 04/14/80 Loss of RHR SW pump. Excessive sand and gravel T passing through traveling

% screens caused degrada-tion of pump wearing surfaces.

191 Quad Cities 2 LER 256/82-16 07/29/82 One RHR SW pump Excessive seal leakage inoperable. caused by abrasives found in river water used to cool pump seals. Seal leakage can lead to bearing oil dilution.

192 Vermont Yankee LER 271/80-12 03/28/80 Service water piping not Service water piping not seismically qualified. adequately supported.

I 193 Vermont Yankee LER 171/C'"15-106/08/83 Service water piping SWS copper piping installed not seismically during 1983 modification not qualified. adequately supported.

1 194 Peach Botton 2 LER 277/86-14 06/'.8/86 ESWS piping leak Leak on emergency SWS piping required plant on inlet to RHR room

! shutdown. cooler.

l

_ _ = . - .

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 195 Pilgrim LER 293/80-78 10/30/80 Potential loss of Installation of seismic service water system. anchor outside tornado protection area.

1% Browns Ferry 3 LER 2%/80-06 02/17/80 Loss of one RHR pump. Shells and mud found blocking flow through 3B RHR pump seal cooler.

197 Browns Ferry 3 LER 2%/80-15-105/12/80 Potential loss of 38 Sediment restricted cool-RHR pump. ing water flow to cooler.

198 Browns Ferry 3 LER 2%/80-16-105/13/80 Loss of i.ooling to 30 Flow test on heat EDG heat exchanger. exchanger indicated inadequate cooling water flow. Sediment fouled cooling water lines.

T E4 199 Browns Ferry 3 LER 296/80-31-1 08/09/80 Potential loss of 3B Shells and mud in RHR pump. emergency equipment cool-ing water system.

200 Browns Ferry 3 LER 2%/80-47 11/08/80 Loss of core spray Biofouling, corrosion, and room cooling. silt deposition caused flow restrictions to core spray room coolers.

Replacing all EECW carbon steel valves with stain-less steel vaives.

Browns Ferry 3 LER 2%/83-47 07/30/83 Insufficient cooling Seal cooler heat exchanger 201 to 3B RHR seal cooler. for RHR pump clogged with class and silt.

202 Browns Ferry 3 LER 2%/84-01-101/03/80 Loss of cooling to one EECW cooling water flow to EDG. EDG engine coclers blocked by clan shells.

Caused by less than adequate chlorination in past years.

APPEleIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 203 Hatch 1 LER 321/80-39-2 04/11/80 Potential single failure Plant service water and of PSW and RHRSW pumps. RHR SW pump motor cooling supply not single failure proof. Regulated by single pressure regulator.

j 204 Hatch I LER 321/80-45 05/10/80 Potential loss of 2 Motor bearing cooling of 4 pumps. water supply valves to a

the RHR SW Pumps A and j B were found closed.

Valves for all 4 pumps I

have since been locked open.

205 Hatch 1 LER 321/80-100 08/22/80 Service water piping Seismic piping supports

. not adequately supported. not installed as required.

h 4 Coupling failure on

] M 206 Hatch 1 LER 321/80-103 08/22/80 Both strainers for plant service water clogged. 8 backwash drive mechanism and breaker tripped on A I

4 backwash drive mechanism.

1 1

207 Hatch 1 LER 321/81-10 02/11/81 Piping to EDG coolers Piping supports not

not seismically adequate.

qualified.

h 208 Hatch 1 LER 321/81-25 04/02/81 Potential to lose all Plant service water

! PSW during seismic event. discharge controls not I seismically qualified.

l 209 Hatch 1 LER 321/81-81 07/29/81 RHR SW piping not RHR SW pipins in the_ '

i seismically qualified. intake structure is

' inadequately supported.

210 Hatch 1 LER 321/81-89 08/19/81 Loss of one plant Debris found lodged in l

j service water pump. pump. Pump was unable to maintain flow.

I i

l l

l l

APPENDIX A (Continued)

Reference Date Consequence Comments Record # Plant Name Hatch 1 LER 321/81-123 11/21/81 Loss of one pump. Inadequate cooling water 211 flow t.9 an RHRSW pump '

due to mud and sludge buildup.

I Hatch 1 LER 321/82-35 06/18/82 Potential loss of plant Manual valve for PSW 212 pump seal and prelube service water pump.

water found partially closed and not locked.

i Valve is normally locked open.

Hatch 1 LER 321/82-43 05/05/82 Inadequate cooling flow Debris lodged in pump 213 from RHRSW pump. impeller.

LER 321/82-46 05/10/82 Loss of 2 RHRSW pumps. Debris lodged in 2 RHR 214 Hatch 1 SW pump impellers.

a { RHRSW pump failed Silt buildup around 215 Hatch 1 LER 321/82-62 07/14/82 flow requirements. pump suction bell.

LER 321/83-69 07/04/83 RHRSW pump inoperable. RHRSW pump inoperable

! 216 Hatch 1 when miniflow valve found closed.

LER 321/83-117 12/03/83 Potential loss of EDG. EDG cooling water supply f 217 Hatch 1 valve found closed. Valve was manually opened.

i I

Palo Verde IE Information 05/01/84 Inoperable EDG. Pipe coating failure 218 clogged the diesel Jacket Notice 85-24 water cooler, air after i cooler and lube oil l

coolers.

LER 324/81-30-2 04/12/80 Loss of one RHR heat Accumulation of shells j 219 Brunswick 2 in heat exchanger caused exchanger.

baffle plate displacement and high D/P.

l .. - .

l l

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 220 Brunswick 2 LER 324/81-49 05/06/81 Oyster shells blocked Oyster shells blocked both A and B RHR HXs. 60 and 50% of the tubes on the A and B HXs. Also damaged HX divider plates.

221 Brunswick 2 LER 324/82-05 01/16/82 Loss of both RHRSW Loss of both RHRSW loops loops. rendered shutdown cooling and suppression pool cooling modes of RHR inoperable.

222 Brunswick 1 LER 325/80-21 03/04/80 Loss of 2 of 4 service Isolation valve for water pumps. suction pressure switch found shut.

223 Brunswick 1 LER 325/81-32 04/19/81 Damage to one RHR HX. Excessive D/P across Y baffle plate caused by o$

shells led to plate bowing.

224 Brunswick I LER 325/81-95-1 12/06/81 Loss of 2 of 4 RHRSW Open circuit breaker pumps. in the pumps motor l

coolers low suction l pressure permissive switch resulted in low suction header pressure lockout.

225 Brunswick 1 LER 325/84-01-1 01/19/84 RHR shutdown cooling and Loss of all RHRSW.

suppression pool cooling One loop out for modes inoperable. maintenance and entrapped air in redundant suction header piping caused low pressure trip of pumps.

i I

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 226 Duane Arnold LER 331/81-07 02/19/81 Loss of RHRSW Train 8. Sand larger than strainer mesh became lodged and could not be removed through backwash.

227 Fitzpatrick LER 333/80-62 07/17/80 Limited RHRSW cooling Orifice placed in RHR flow. SW piping limited flow to 7800 vs. 8000 gpa as required. ,

228 Fermi 2 LER 341/85-47 07/29/85 Loss of Division I Valve in return line RHRSW. for RHRSW deenergized closed instead of open.

229 Fermi 2 LER 341/86-17 06/24/86 Emergency equipment EECW system capacity T cooling water capacity inadequate to remove

@ inadequate for DBA. drywell cooler heat loads during small break LOCA.

230 Hope Creek I LER 354/86-18 05/12/86 Loss of 2 of 4 service Mechanical failure of water system strainers. strainers.

231 Hatch 2 LER 366/80-12-1 02/14/80 RHRSW and PSW piping Piping not adequately not seismically supported, qualified.

232 Hatch 2 LER 366/80-24 03/08/80 Loss of an RHRSW pump. Debris in pump suction.

233 Hatch 2 LER 366/80-136 09/30/80 PSW piping not seis- Piping support not mically qualified. installed as designed.

234 Hatch 2 LER 366/80-145 10/29/80 Service water pump head Wear caused by silt inside and flow inadequate. stan6y service water pump bowl assembly.

235 Hatch 2 LER 366/81-46-105/19/81 PSW pump inoperable. Wear of bowl section of pump caused by silt.

APPElmlX A (Continued)

Record # Plant Name Reference Date Consequence Comments 236 Hatch 2 LER 366/81-57 06/23/81 Loss of PSW Division II Supply valve to reactor supply. building found closed.

237 Hatch 2 LER 366/81-63 06/25/81 RHRSW pump inoperable. Debris found lodged in pump.

238 Hatch 2 LER 366/81-66 06/26/81 Inoperable standby Pump would not deliver i service water system required flow to diesel.

pump.

239 Hctch 2 LER 366/82-44 04/28/82 RHRSW pump inoperable. Debris in pump.

240 Hatch 2 LER 366/82-85-1 08/13/82 Loss of A and C RHRSW Cavitrol trim (anti-pumps. cavitation device) failed.

l 241 Pilgrim LER 293/81-49 02/28/81 Potential loss of Blue mussels clogged i T service water system. service water system.

o .

242 Hatch 2 LER 366/82-95 08/17/82 Loss of RHRSW Loop A Personnel closed A loop while Loop B out for strainer inlet valve maintenance. instead >f a B loop

) strainer inlet valve.

243 Hatch 2 LER 366/82-113 10/09/82 Inoperable RHRSW Pump. Discharge check valve was stuck open due to corroded flapper shaft.

244 Hatch 2 LER 366/82-132 12/03/82 Leak on RHRSW valve. Corrosion / erosion caused leak on RHRSW valve.

j 245 Turkey Point 3 LER 250/86-18 04/16/96 Intake cooling water Calcium carbonate buildup system heat exchangers fouled heat exchangers.

l i

fouled.

j 246 Susquehanna 1 LER 387/82-12-1 09/10/82 Potential to overload Caused by service water Class IE electrical pump start sequence.

j i

system.

i

)

4

. . __ _ _ _ _ _ _. -= .-

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 247 Susquehanna 1 LER 387/82-24-1 10/15/82 Potential loss of service Single failure vulner-water flow to diesels. ability of emergency service water system.

248 Susquehanna 1 LER 387/86-21 05/24/86 Forced shutdown of both All 4 ESW pumps declared units. inoperable due to recirculation cavitation damage. Damage caused by operating pumps at less than designed flows.

249 Susquehanna 1 LER 387/86-24 07/03/86 Pump auto start relays All 4 ESW pumps at both not seismically plants affected.

qualified.

250 Grand Gulf 1 LER 416/83-186 11/22/83 Loss of a standby Sediment in the supply /

T service water pump. return line to the pump M restricted flow.

251 River Bend 1 LER 458/85-34 11/13/85 Service water piping not Missing supplemental steel seismically qualified. support in piping tunnels affected safety related l

piping of the standby service water system.

c Oconee 1 LER 269/86-11 10/01/86 Complete loss of low Inadequate design and pressure service water testing of the low pressure system. service water system.

3 Oconee 1 LER 269/86-12 19/15/86 Standby shutdown Water supply to service facility had water system was of insufficient volume. insufficient volume to function during DBA.

254 Cyster Creek LER 219/87-04 01/12/87 2 emergency diesel Personnel inadvertently

^j generators inoperable. removed emergency service water pump from service.

=_-_--_ __-_ _ - ___.___ _ _ . . - . _.

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 255 Browns Ferry 3 LER 296/86-04 01/25/86 Loss of 2 RHRSW pumps. EDG taken out of service disables 2 RHRSW pumps.

256 Susquehanna 1 LER 387/86-24 07/03/86 Emergency service water Emergency service water pump relays not seismic. pump auto start relays were not seismically qualified.

257 Susquehanna 2 LER 388/86-16 10/24/86 Potential loss of both Valves for both ESW HXs low pressure ECCS. had controllers misaligned.

258 Grand Gulf 1 LER 416/86-29-6 08/26/86 Inadequate RHR room Microbiologically cooling. inducted corrosion

' caused room cooler degradation.

l 259 Turkey Point 3 LER 250/86-24 06/11/86 Loss of one intake Two pieces of wood cooling water pump. lodged in pump J, impeller.

=

260 Surry 1 LER 280/86-24 08/13/86 Loss of cooling to Clogged chillers due l control room and relay to unfiltered river i

room. water resulting from bypassing inoperable filters.

261 Surry 1 LER 280/86-29 09/29/86 Potential loss of all With one service water high pressure injection pump out for maintenance, pumps. the remaining service water pump became i'

airbound due to a leak on a strainer blowdown line. Service water flow to the charging pump service water sub-system was lost.

262 Surry 1 LER 280/86-30 10/29/86 Reduction in cooling to Marine growth in service i

control / relay rooms. water line blocked flow.

APPEM)IX A (Continued)

Plant Name Reference Date Consequence Comments Record #

263 Surg 1 LER 280/86-31 10/30/86 Loss of tooling to HPI Loss of all service water lube coolers. cooling to charging pump j

lube oil coolers for i

' 19 minutes. Caused by air binding of pumps when

placing strainer in service.

I 264 Surry 1 LER 280/86-32 11/04/86 Loss of noo:iv,.to . toss of service water chargiy 9tapa flow to the pump lube

' oil coolers when air was introduced into the system.

265 Surry 1 LER 280/87-05 02/21/87 Control room chillers Biofouling of suction had inadequate flow. strainers.

> Farley 1 LER 348/86-14-1 08/01/86 Loss of all HPI. Charging pump coolers 266 clogged with silt, mud g and class from the service water system.

11/30/86 Loss of B safety Personnel left SI pump 26/ Millstone 3 LER 423/86-56 cooler service water injection pump.

outlet valve closed.

Palisades LER 255/86-36 09/30/86 Inadequate service water Testing of service 268 water pumps revealed system flow.

flow below FSAR require-ments. Caused by inade-quate system design and unmodified pump impellers.

04/03/87 Insufficient service Inconsistency between 269 Millstone 2 LER 366/87-06 FSAR value for service water flow during DBA.

water flow and calculated flow for LOCA heat removal.

APPENDIX A (Continued)

Record # Plant Name Reference Date Consequence Comments 270 Trojan LER 344/87-06-1 03/09/87 Potential loss of EDGs Service water strainer and AFW pumps to pit drain line did not flooding. have check valve to prevent backflow.

271 Oconee 1 LER 270/87-04 03/31/87 Loss of cooling to LPI Biofouling of coolers system and reactor built up over 12 to 13 building cooling units. years. Coolers never cleaned.

272 Surry 1 LER 280/87-07 03/23/87 Loss of 2 of 3 control Inadequate service room chillers. water flow due to seal leaks on chillers.

273 Farley 1 LER 348/87-09 05/10/87 Loss of B RHRSW cooler. RHRSW cooler valved out

'l for maintenance and never restored.

2 Zion 2 PN0 III-87-73 05/21/87 Loss of long tern EDGs Flooding of EDG fuel h 274 operability, oil storage tank room due to maintenance personnel error.

275 Byron 1 IE Infomation 05/01/84 High potential core Loss of service water Notice 86-11 melt probability. system presents high potential core melt probability.

i 276 Indian Point 3 NUREG/CR-4565 03/01/86 Potential single failure Probabilistic study

' of service water system. revealed several single failure vulnerabilities of 'ervice water system.

1 l1

__-- _ _ _- - - - - - - - _ <-- _ - - " ~ - - - -

Appendix B l GENERIC NRC ACTVITIES INVOLVING SERVICE WATER SYSTEMS IE BULLETINS /INFORMATION NOTICES (IN) CIRCULARS IE BULLETIN 81-03: Flow Blockage of Cooling Water to Safety-Related Com-ponents by Corbicula sp. (Asiatic Clam) and Mytilus Sp. (Mussel). Issued April 10, 1981.

IE BULLETIN 80-24: Prevention of Damage to Water Leakage Inside Containment (October 17, 1980 Indian Point 2 Event). Issued November 21, 1980.

IE BULLETIN 79-14: Seismic Analyses for as-built Safety-Related Systems.

Issued July 2, 1979.

IE IN No. 87-06: Loss of Suction to Low Pressure Service Water System Pumps Resulting from loss of Siphon. Issued January 30, 1987.

IE IN No. 86-96: Heat Exchanger Fouling Can Cause Inadequate Operability of Service Water Systems. Issued November 20, 1986.

IE IN No. 86-11: Inadequate Service Water Protection Against Core Melt Frequency. Issued February 25, 1986.

1 IE IN No. 85-30: Microbiologically Induced Corrosion of Containment Ser- l vice Water System. Issued April 19, 1985.

IE IN No. 83-24: Failures of Protective Coatings in Pipes and Heat Exchangers. Issued March 26, 1985.

IE IN No. 83-46: Common-Mode Valve Failures Degrade Surry's Recirculation i Spray Subsystem. Issued July 11, 1983.

IE IN No. 81-21: Potential Loss of Direct Access to Ultimate Heat Sink.

Issued July 21, 1981.

IE IN No. 80-37: Containment Cooler Leaks and Reactor Cavity Flooding at Indian Point Unit 2. Issued November 1980.

IE IN No. 79-34: Inadequate Design of Safety-Related Heat Echangers.  ;

Issued December 27, 1979.

IE Circular 78-13: Inoperability of Service Water Pumps. Issued July 10, 1978. ,

B-1

GENERIC ISSUES

32. Flow Blockage in Essential Equipment Caused by Corbicula

36. Loss of Service Water

44. Failure of Saltwater Cooling System

51. Proposed Requirements for Improving Open Cycle Service Water Systems

52. SSW Flow Blockage by Blue Mussels

77. Flooding of Safety Equipment Compartments Through Floor Orains 130. Essential Service Water Pump Failures at Multiplant Sites ABNORMAL OCCURRENCES 81-7 Blockage of Coolant Flow to Safety-Related Systems and Components 86-20 Loss of Low Pressure Service Water Systems at Oconee AE00 TECHNICAL STUDY REPORTS AEOD/C105, "Report on Calvert Cliffs Unit 1 Loss of Service Water on May 20, 1980," issued on December 1981.

AE00/C204, "San Onofre Unit 1: Loss of Salt Water Cooling Event on March 10, 1980," issued July 1982.

AE0D/C202, "Report on Service Water System Flow Blockages by Bivalve Mollusks at Arkansas Nuclear one and Brunswick," issued February 1982.

AE00/E505, "Service Water System Air Release Valve Failures," issued March 29, 1985.

AE00/E416, "Erosion in Nuclear Power Plants," issued June 11, 1984.

AEOD/E412, "Adverse System Interaction With Domestic Water Systems," issued May 25, 1984.

AEOD/E411, "Failure of Anti-Cavitation Device in Residual Heat Removal Service Water Heat Exchanger Outlet Valve," issued May 22, 1984.

AEOD/E318, "Biofouling at Salem Units 1 and 2 " issued August 15, 1983.

AE00/E311, "Loss of Salt Water Flow to the Service Water Heat Exchangers for 23 Minutes at Calvert Cliffs Unit 2," issued April 25, 1983.

AEOD/E302, "Potential Loss of Service Water Flow Resulting from a Loss of Instrument Air," issued Jan. 31, 1983.

1 l

B-2

AE00/E215, "Salt Water System Flow Blockage at Pilgrim Nuclear Power Station by Blue Mussels," issued March 18, 1982.

AE00/E016, "Flow Blockage of Essential Equipment at and Caused by Corbicula ,

Sp. (Asiatic Clams)," issued March 28, 1982.

AE00/T341, "Corrosion of Carbon Steel Pipe in Service Water Headers," issued Dec. 19, 1983.

AE00/T305, "Flow Blockage in Essential Raw Cooling Water System Due to Asiatic Ciam Intrusion at Sequoyah Unit 1," issued March 28, 1983.

NUREG AND NUREG/CR REPORTS NUREG/CR-2797, "Evaluation of Events Involving Service Water Systems in Nuclear Power Plants." J.A. Haried, November 1982.

NUREG/CR-3054, "Closecut of IE Bulletin 81-03: Flow Blockage of Cooling Water to Safety"System Components by Corbicula Sp. (Asiatic Clam) and Mytilus Sp.

(Mussel). J.H. Rains, W.J. Foley, and A. Hennick, June 1984.

HUREG/CR-4070, "Bivalve Fouling of Nuclear Power Plant Service Water Systems."

VOL. 1 "Correlation of Bivalve Boilogical Characteristics and Raw-Water System Design." F.S. Neitzel and Four Co-Authors, December, 1984.

VOL. 2 "Current Status of Biofouling Surveillance and Control Techniques."

P.M. Daling and K.I. Johnson, March, 1985.

VOL. 3 "Factors That May Intensify the Safety Consequences of Biofouling."

C.H. Henager, Sr., P.M. Daling, and K.I. Johnson, April 1985.

NUREG/CR-4233, "Distribution of Corbicula Fluminea at Nuclear Facilities."

C.L. Counts III, November 1985.

NUREG/CR-4626, "Improving Relibility of Open-Cycle Water Systems."

VOL. I "An Evaluation of Biofouling Surveillance and Control Tech-Niques for Use at Nuclear Power Plants." D.A. Neitzel, K.I. Johnson, and P.M. Daling, September 1986.

I I

B-3 '

O APPENDIX C A PARTIAL LIST OF SAFETY RELATED COMPONENTS COOLED BY THE SERVICE WATER SYSTEM FOR SELECTED PLAN 15 (1) OCONEE 1, Low Pressure Service Water (LPSW) System,

a. Reactor Building Cooling Units

b. Low Pressure In ection Coolers

c. High Pressure I;jection n Pump Motor Coolers

d. Emergency Feedwater Puop Turbine Coolers (2) MCGUIRE 1, Nuclear Service Water (NSW) System,

s. Coolers for:

i Component Cooling Pump Motors 11 Centrifugal Charging Pump Motors iii Safety Injection Pump Motors iv Residual Heat Removal Pump Motors v Containment Spray Pump Motors vi Fuel Pool Cooling Pump Motors vii Nuclear Service Water Pump Motors

! b. Containment Spray Heat Exchangers

c. Diesel Generator Heat Exhanger ,

. d. Ccmponent Cooling Heat Exchanger

e. Centrifu al Charging Pump Bearing 011 Coolers

f. Centrifu al Charging Pump Gear Oil Coolers

g. SafetyIjectionPumpBearingOilCoolers

h. Control Room Air Conditioning Condenser

i. Auxiliary Feedwater Pump Motors  ;

j. Alternate Water Supply for Auxiliary Feedwater Makeup

k. Alternate Water Supply Fuel Pool Makeup i

(3) BRUNSWICK 2,ServiceWaterSystem(SWS),

a. Residual Heat Removal (RHR) System Heat Exchangers

b. RHR Pump Seal Cooling Heat Exchangers

c. RPR Pump Room Fan Cooling Units

d. Core Spray Room Fan Cooling Units

e. Emergency Diesel Engine Facilities

f. RHR Service Water Pumps i

i C-1 i

(

(4) ARKANSAS NUCLEAR ONE 2, Service Water System (SWS). ,

a. Emergency Diesel Generator Jacket Cooling Water Heat Exchangers j

b. Switchgear Roon Unit Coolers '

c. Control Room Emergency Condensing Units

d. Shutdown Heat Exchanger Room Unit Coolers

e. High Pressure Safety injection (HPSI) Pump Roon Unit Coolers

f. Containment Spray Pump Coolers

g. LowPressureSafetyInjection(LPS1)PumpCoolers i

h. HPSI Pump Coolers

1. Shutdown Cooling Heat Exchangers  ;

j. Charging Pump Room Coolers

k. Containment Cooling Unit Coils .

1. Emergency Feedwater Pump Room Unit Coolers

n. Electrical Equipment Unit Coolers

n. Hydrogen Purge System Supply / Exhaust Fans

o. Boric Acid Makeup Pump Room Unit Coolers .

p. Post-Accident Hydrogen Analysis Panels

> q. Alternate Water Supp]y for Emergency Feedwater Pumps (5) NORTH ANNA 1 Service Water System (SWS),

a. Component Cooling Water Heat Exchangers

b. Recirculation Spray Heat Exchangers

c. Main Control Room Air Conditioning Condensers <

d. Charging Pump Lubricating Oil Coolers i

e. Charging Pump Seal Coolers i

f. Service and Instrumentation Air Compressors  !

g. Pipe Penetration Cooling coils

h. Backup Supply to the Steam Generator Feed System L

i. Backup Supply to the Fuel Pit Coolers 1 j. Backup Supply to the Recirculation Air Cooling Coils l t

(6) OYSTER CREEK 1. Emergency Service Wattr (ESW) System.

]

a. Containment Spray Heat Exchangers j (7) CALVERT CLIFFS 2 Salt Water System.  !

I a. Service Water Heat Exchangers (

i b. Component Cooling Water Heat Exchangers '

c. Emergency Core Cooling System (ECCS) Pump Room Air Coolers [

l (8) SALEM 2. Service Water System (SWS).

l

! a. Reactor Containment Fan Cooler Units

! b. Component Cooling Heat Exchangers

c. Diesel Generator Units i 1 d. Charging Pump Lube Oil Coolers

) e. Safety Injection Pump Lube Oil Coolers j

f. Emergency Control Air Compressors  !

a C-2 .

i i

-- ., , . . , _ . . - . ,.-r , ,_m._._ , _m.

l .

(9) ZION 2, Service ater System (SWS).

a. Component Cooling Heat Exchangers

b. Containment Ventilation Coolers

c. Diesel Generator Coolers

d. Control Room Air aditioning Syster.i Condensers

e. Computer Room Air Conditioning System Condensers

f. Auxiliary Building Ventilation System Cooling Coils

g. Penetration Pressurization Air Compressor. Coolers

h. Containment Spray Pump Diesel Engine Coolers

i. Auxiliary Building Room Coolers

j. Auxiliary Feedwater Pumps (10) INDIAN POINT 2, Service Water System (SWS).

a. Containment Ventilation Cooling Coils

b. Containment Ventilation Fan Motor Coolers

c. Instrument Air Compressor

d. Diesel Generator Coolers

e. Control Room Air Conditioning System

f. Boiler Feed Pump Turbine Oil and Seal Oil Coolers (11) SAN ONOFRE 1, Salt Water System.

a. e tponent Cooling Water Heat Exchangers (12) SUSQUEHANNA 1, Emergency Service Water (ESW) System.

a. Emergency Diesel Generator Heat Exchangers

b. RHR Pump Seal Coolers

c. RHR Pump Motor Bearing oil Coolers

d. RHR Pump Room Unit Coolers

e. Core Spray Pump Room Unit Coolers

f. HPCI Pump Room Unit Coolers l

g. RCIC Pump Room Unit Coolers

h. Emergency Switchgear Cooling Condensing Unit

i. Reactor Building Component Cooling Water System

j. Turbine Building Component Cooling Water System

k. Makeup to Fuel Pool Residual Heat Removal Service Water (RHR SW) System. J

a. RHR Heat Exchangers l l

(13) HATCH 1, Plant Service Water (PSW) System.

a. Standby Diesel Generator Heat Exchangers l

b. Control Room Air Conditioning Units  ;

c. RHR Pump Seals I

d. HPCI Pump Room Area Coolers i

e. RHR Pump Room Area Coolers C-3

Residual Heat Removal Service Water (RHR SW) System.

a. RHR Heat Exchangers (14) PALISADES, Service Water Syslem (SWS).

a. Containment Air Coolers

b. Component Coolers Heat Exchangers

c. engineered Safeguards Room Coolers

d. aergency Diesel Generators

e. Control Room Air Conditioning Condensers

f. Air Compressnes

g. Emergency Safeguards Pump Seals (15) TURKEY POINT 3, Intake Cooling Water (ICW) System.

a. Compenent Cooling Heat Exchangers t

C-4

O I

(

Appendix D Service Water System Events Involving Sediment Deposition Plant Name Date Reference Consequences Comments Salem 1 07/20/81 LER 272/81-71 Loss of fan cooler High pressure sensing line of flow unit. transmitter was clogged with silt.

Salem 1 08/31/82 LER 272/82-69-1 Loss of a charging Service water leak into the pump pump. lube oil cooler outlet piping.

Surry 2 11/14/80 LER 281/80-40 Low service water Material entrained in service water i pump discharge deposited on the pump impeller.

1 pressure.

i Zion 2 04/09/82 LER 304/82-09 Loss of cooling to The service water supply valves ,

both AFW pumps. to both AFW pump lube oil coolers failed to open because of an i accumulation of silt.

i

~

Kewaunee 09/28/84 LER 305/84-18-1 Low flow through Service water side of several . 31 -

several fan cooler er units were found partially.

units. plugged with silt.

Sales 2 09/03/81 LER 311/81-99 Inoperable fan Low service water flow indication cooler unit. through cooler caused by flow transmitter clogged with silt.

Salen 2 11/10/81 LER 311/81-117 Low service water Caused by silt in the flow trans-flow through mitter sensing line.

cooler.

I Sales 2 02/28/82 LER 311/82-17-1 Low service water )w transmitter was plugged with 4 flow through . : i t.

cooler.

I Salen 2 05/04/82 LER 311/82-28-1 Low service water Flow transmitter was plugged with

! flow through cooler. silt.

]

1

j .

l.

I Appendix D (Continued)

Plant Name Date Reference Consequences Comments l

Salen 2 08/31/82 LER 311/82-96 Low service water Silt buildup in the cooling coils.

flow through fan cooler unit.

l Salem 2 09/01/82 LER 311/82-98 Low service water Silt buildup in the cooling coils.

low through fan l

cooler unit.

i Salen 2 09/02/82 LER 311/82-99 Low service water Silt buildup in the cooling coils.

flow through fan I cooler unit.

Sales 2 09/08/82 LER 311/82-105 Low service water Silt buildup in the cooling coils.

I o flow through fan 4 cooler unit.

i

- Sales 2 10/31/82 LER 311/82-120 Low service water Silt buildup in the cooling coils.

flow to fan cooler unit.

Cook 1 02/02/83 LER 315/83-14 Loss of one service Two valves would not close fully water pump. due to sediment buildup.

1, '

l Trojan 01/27/84 LER 344/84-02 Loss of B train Safety injection pump lube oil cooler l

safety injection found packed with sediment preventing j

pump. service water flow through~ cooler.

1 McGuire 1 03/11/86 LER 3%/86-06 Service water flow Inadequate testing of both units

} to some equipment nuclear service water systems.

4

was lower than, Sediment fouled containment spray l FSAR requirements. heat exchangers.

i i

l 1

1 _ _ _ __ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

Appendix D (Continued)

Plant Name Date Reference Consequences Comments Quad Cities 1 07/11/83 LER 254/83-29 Loss of B service Pump inboard bearing surfaces pitted water pump. and imbedded with dirt. Water leakage through worn packing

' contaminats.d bearing oil reservoir with sediment.

Browns Ferry 3 05/12/80 LER 296/80-15-1 Potential loss of Sediment restricted cooling water 3B RHR pump. flow to cooler.

Browns Ferry 3 05/13/80 LER 296/80-16-1 Loss of cooling to Flow test on heat exchanger indicat-

) 30 EDG heat ex- ed inadequate cooling water flow.

changer. Cooling water lines flushed.

Hatch 1 07/14/82 LER 321/82-62 RHRSW pump failed Silt build up around pump suction o flow requirements. on bell.

l>

Brunswick 2 01/16/82 LER 324/82-05 Loss of both RHR Loss of both RHRSW loops rendered

SW loops. shutdown cooling and suppression

! pool cooling modes inoperable.

Duane Arnold 02/19/81 LER 331/81-07 Loss of RHRSW Sand larger than strainer mesh i train B. became lodged and could not be removed through backwash.

Grand Gulf 1 11/22/83 LER 416/83-186 Loss of a standby Sediment in the supply / return line service water pump. to the pump restricted flow.

1 Farley 1 08/01/86 LER 348/86-14-1 Loss of all HPI. Charging pump coolers clogged with silt, mud and class from the service water system.

Oconee 1 03/31/87 LER 270/87-04 Loss of cooling to Biofouling of coolers built up over LPI and reactor 12 to 13 years. Coolers never building cooling. cleaned.

1 I

i i

Ap~endix E Service Water System Events Involving Biofouling Plant name Date Reference Consequences Ccaments San Onofre 1 06/09/81 LER 206/81-09 Partially blocked Gooseneck barnacles caused valve 3

salt water heat malfunction on discharge of HX.

exchanger. protracted cold shutdown prevented normal heat treatment to remove barnacles.

I Salem 1 05/30/83 LER 272/83-26 Service water flow Inlet valve plugged with shells was less than and debris.

required by tech

, specs.

1

^

Salen 2 05/16/82 LER 311/82-41-1 Low service water Oysters restricted service water flow through cooler. flow. Continuous chlorination pro-4 1

gram begun to prevent reinfestation.

Salem 2 05/27/82 LER 311/82-46 Low service water American oysters clogged tube bundle flow through cooler.

Sales 2 06/17/82 LER 311/82-49 Low service water American oysters clogged tube bundle

'. flow through cooler. and a valve.

Sales 2 06/17/82 LER 311/82-50 3 fan cooler units American oysters clogged cooler inoperable. unit valves.

Sales 2 07/02/82 LER 311/82-58 Low service water American oysters plugged a valve.

I flow through fan cooler units.

Salen 2 08/12/82 LER 311/82-83-2 Low service water American oysters plugged cooler.

i flow through fan

cooler unit.

. Salen 2 09/29/82 LER 311/82-117 Low service water American oysters plugged cooler.

i flow through fan cooler unit.

1 i

i Appendix E (Continued)

Plant Name Date Reference Consequences Comments Sequoyah 1 03/07/82 LER 327/82-27 Low cooling flow Fresh water class plugged piping j through heat (15 gallons of class).

! exchanger.

Calvert Cliffs 2 10/15/85 LER 318/85-09 Loss of one ser- Service water HX fouled with gallons vice water HX while of shells. Licensee reevaluating SW l

other train out of maintenance and anti-biofouling service. system.

1 i ANO 2 09/03/80 LER 368/80-72-1 Low service water Asian clam buildup in service water flow thru heat I exchanger.

ANO 2 01/20/82 LER 368/82-03-1 Inoperable LPSI Asiatic clam shells lodged in i ni pump due to low cooler obstructing flow.

43 service water flow.

Oyster Creek 01/06/81 LER 219/81-05 Loss of one emer-- Clogged pump suction strainer gency service water discovered during operability check i pump. of installed meter.

Oyster Creek 04/15/81 LER 219/81-17 One loop of contain- Associated emergency service water loop inoperable when strong winds ment spray inoper-

able. concentrated sea lettuce in the j intake canal overwhelming trash re= oval system.

]

Oyster Creek 06/08/81 LER 219/81-24 Two ESWS pumps in- Grass clogging problems in the in-l operable. take structure found slight clogging in two pump suctions.

1 l Millstone 1 01/15/82 LER 245/82-02 Loss of one service B ESWS pump inoperable after fail-l water pump. ing to meet minimum discharge i

pressure requirements due to marine

' fouling of impeller.

! Appendix E (Continued)

Plant Name Date Reference Consequences Comments Millstone 1 06/14/82 LER 245/82-14 Loss of one ESWS D ESWS pump discharge pressure pump. low due to marine growth fouling of impeller. Mussels and class i

also found in the pump suction volute.

Browns Ferry 3 02/17/80 LER 296/80-06 Loss of RHR pump Shells and mud found blocking flow seal cooling. through 38 RHR pump seal cooler.

Browns Ferry 3 08/09/80 LER 2%/80-31-1 Potential loss of Shells and mud in emergency equip-38 RHR pump. ment cooling water system.

Browns Ferry 3 07/30/83 LER 296/83-47 Insufficient cool- Seal cooler heat exchanger for RHR ing to 38 RHR seal pump clogged with clams and silt.

! cooler.

b Browns Ferry 3 01/03/80 LER 296/84-01-1 Loss of cooling to EECW cooling water flow to EDG one EDG. engine coolers blocked by clam shells. Caused by less than I adequate chlorination in past years.

Brunswick 2 04/12/80 LER 324/80-30-2 Loss of one RHR Accumulation of shells in heat 3

heat exchanger. exchanger caused baffle plate displacement and high D/P.

l Brunswick 2 05/06/81 LER 324/81-49 Oyster shells Oyster shells blocked 60 and 50%

blocked both A of the tubes on the A and B HXs.

and B RHR HXs. Also dan. aged divider plates.

04/19/81 LER 325/81-32 Damage to one RHR Excessive D/P across baffle plate l Brunswick 1 caused by shells led to plate bow-i HX.

ing.

l 4

i

Appendix E (Continued)

Plant Name Date Reference Consequences Comments Pilgrim 02/28/81 LER 293/81-49 Potential loss of Blue mussels clogged service water service water system.

system.

Surry 1 10/29/86 LER 280/86-30 Reduction in cool- Marine growth in service water ing to control / line blocked flow.

relay rooms.

Surry 1 02/21/87 LER 280/87-05 Control room Biofouling of suction strainers.

chillers had i inadequate cooling flow.

T.

4 i

k 1

4 J

_ _ _ _ . _ . _ . _ _ . _ _ _ _ _ . _ _ _ _ _ _ . _ _ . _ _ _ _ _ _ . _ _ _ _ . _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ . _ _ . _ _ _ . _ _ _ _ _ _ - _ __ _ ___ _ _ _ _ _ _ _r ___ __ _ _ _ _ _ _ _____._

Appendix F Service Water System Events Involving Corrosion and Erosion Plant Name Date Reference Consequences Comments San Onofre 1 03/18/80 LER 206/80-08 Potential loss of South pump had two loose and l

one saltwater corroded concrete anchors attaching pump.

San Onofra 1 07/30/84 LER 206/84-08 Potential loss of Corrosion of structure's steel saltwater system reinforcement.

i pump house.

i Indian Point 2 04/01/81 LER 247/81-08 Service water pip- 15 welds did not meet minimum ing wall thinning. requirements.

Indian Point 2 05/06/81 LER 247/81-10 Reduction in ser- Valve seat rings dislodged on two vice water pumping pump discharge check valves. Long capacity. term corrosion of seat rings believed to be material problem.

] }{

I Indian Point 2 08/11/82 LER 247/82-31 Through-wall ser- Two flexible hose sections replaced vice water pipe due to pin hole leaks.

leaks.

i Robinson 2 04/10/83 LER 261/83-03 Unit shutdown. Service water system caused a leak and degradation of container:nt l

boundary.

l Salem 1 08/30/80 LER 272/80-49 Loss of a centrif- Pump declared inoperable when leak ugal charging in service water supply to lube oil pump. cooler discovered.

Salem 1 08/31/81 LER 272/81-83-1 Loss of a centrif- Service water leak on charging ugal charging pump oil cooler.

pump.

~

i Appendix F (Continued)

Plant Name. Date Reference Consequences Comments I Salem 1 09/22/81 LER 272/81-90 Loss of component Dissirailar metal weld between valve cooling water heat and carbon steel heat exchanger exchanger. cracked.

Salem 1 12/06/81 LER 272/81-119 Loss of charging Service water leak on the return pump. line of the oil cooler.

Salem 1 06/26/82 LER 272/82-41 Loss of a charging Service water leaked into the gear pump. Oil through the gear oil cooler.

Salem 1 11/30/82 LER 272/82-91-1 Several degraded Service water leakage through a welds. weld into a component cooling water heat exchanger.

i j ,i Salem 1 03/09/84 LER 272/84-08-1 Welds exhibited Pitting corrosion determined to be 4 pitting corrosion. caused by the low velocity brackish water in contact with the stainless

steel piping.

1 Zion 2 12/13/83 LER 304/83-45 Loss of one Service water leak in one cooling fan cooler. coil of one fan cooler found.

Zion 2 05/03/84 LER 304/84-13 Multiple internal All fan cooler units affected.

pitting of fan cooler coils.

l Salem 2 08/06/81 LER 311/81-64 Leaks on the fan Leaks at welds from service cooler units. water erosion.

Salem 2 07/20/82 LER 311/82-65 No service water Rod end bearing assembly on service flow through fan water valve to cooler failed.

cooler unit.

Salem 2 09/15/82 LER 311/82-86 Service water pump Service water pump's motor bearing inoperable. oil cooler failed due to acceler-ated corrosion and erosion.

l

4 Appendix F (Continued)

Plant Name Date Reference Consequences Comments Cook 1 02/23/82 LER 315/82-43 Emergency service ESW pump discharge valve shaft water loop binding caused by buildup of 3

inoperable. corrosion products.

Cook 1 6/23/82 LER 315/82-48 Loss of CCW train. Heat exchanger ESW discharge valve

{

would not close due to buildup of l

' corrosion products.

i l

! North Anna 1 04/21/81 LER 338/81-24 Potential loss of Through-wall leak in service water all HPI pumps at supply header to both Unit 1 and 2 both units. charging pumps caused by sulfate

' reducing bacteria.

t

,, North Anna 1 05/27/81 LER 338/81-46 Potential loss of Service water supply header leak to J, all HPI pumps at both units charging pump coolers both units. caused by sulfate reducing bacteria.

! North Anna 1 08/27/81 LER 338/81-71 Potential loss of Study done at Lehigh University cited all HPI pumps at cause of leaks due to corrosion both units. caused by aggressive water and bac-terial reduction of mild steel piping.

North Anna 1 12/02/81 LER 338/81-83 Potential loss of Same as stated above.

i all HPI at both units.

i j North Anna 1 03/05/82 LER 338/82-06 Potential loss of Same as stated above.

all HPI at both

units.

i North Anna 1 12/03/82 LER 338/82-81 Potential loss of Same as stated above.

all HPI at both I units.

1 1

l

• Appendix F (Continued)

Plant Name- Date Reference Consequences Comments I Nora t Anna 1 07/09/83 LER 338/83-48-1 Potential loss of Licensee changed out piping to all HPI at both charging pump lube oil coolers with -

units. stainless steel piping on 12/16/83.

J l North Anna 2 02/01/83 LER 339/83-07 Potential loss of See North Anna LER 338/81-71.

all HPI to both units.

, North Anna 2 01/13/83 LER 339/83-14 Potential loss of Same as stated above.

I all HPI to both units.

Robinson 2 11/19/84 IE IN 85-30 Leaks in piping to Micrcbiologically induced corrosion 4

containment of stainless steel piping.

l' chillers.

l l Calvert Cliffs 1 07/01/80 50-317/80-32 Loss of one ser- Corrosion buildup on valve actuator 2 vice water heat caused valve to seize.

exchanger.

?

! Palo Verde 01/01/84 IE IN 85-30 Leaking welds in Microbiological 1y induced corrosion.

! essential spray i pond piping.

Calvert Cliffs 1 09/17/80 LER 317/80-52 Loss of one ser- Tube leak on heat exchanger.

i vice water heat i

exchanger.

j Calvert Cliffs 1 06/17/81 LER 317/81-63-1 Loss of one CCW SW outlet valve on component cooling heat exchanger. water heat exchanger failed due to rust.

Calvert Cliffs 1 05/03/84 LER 317/84-05-1 2 of 4 CCW heat Wall thinning and through wall leak-4 exchangers age on two CCW HXs.

inoperable.

l Apper. dix F (Continued)

P1 ant Name- Date Reference Consequences Comments Calvert Cliffs 2 07/01/82 LER 318/82-35 Loss of one ser- HX drain plug broken off. Corroded vice water heat pipe nipple and valve. Plant is re-exchanger. placing these fittings with brass and-bronze fitting to prevent corrosion.

Millstone 2 11/16/80 LER 336/80-38 Loss of one ser- Leaky strainer on C SW pump caused by .

vice water corrosion.

strainer.

! Millstone 2 06/13/81 LER 336/81-23 Leak on C service Corrosion probably occurred as a re-water pump dis- sult on coating failure of the carbon charge header. steel pipe.

Millstone 2 04/01/82 LER 336/82-10 Loss of one ser- Piping leak in a service water header.

,, vice water train. Caused by coating failure and subse-E quent corrosion of carbon steel piping.

ANO 2 10/05/81 LER 368/81-35 Inoperable safety Corrosion products from carbon steel i injection pump due piping clogged cooler. Piping re-to insufficient placed with stainless steel.

service water flow.

~

Crystal River 3 05/16/83 LER 302/83-22 Leak on outlet Leaks on outlet piping of two nuclear of two heat service HXs. Deterioration of inner

• exchangers. PVC, liner led to corrosion / erosion of piping.

Crystal River 3 05/12/84 LER 302/84-11 Loss of indepen- Discharge check valve on.one of the dence of emergency the nuclear service seawater pumps seawater pumps. stuck open due to corrosion.

Rancho Seco 03/12/81 LER 312/81-16-2 Loss of one HPI Partial plugging of lube oil cooler pump. caused by excessive corrosion product buildup. Epoxy coated the cooler heads to prevent recurrence.

~

Appendix F (Continued)

Plant Name. Date Reference Consequences Comments Davis-Besse 1 06/11/82 LER 346/82-28 Service water Swing check valve in return line from valve froze CCW HX froze open due to corrosion open. products.

Browns Ferry 3 11/08/80 LER 296/80-47 Loss of core spray Biofouling, corrosion, and silt room cooling. deposition caused flow restrictions to core spray room coolers.

Replacing all EECW carbon steel valves with stainless.

! Hatch 2 10/09/82 LER 366/82-113 Inoperable RHRSW Discharge check valve was stuck open i pump. due to corroded flapper shaft.

Grand Gulf 1 08/26/86 LER 416/86-29-6 Inadequate RHR Microbiologically induced corrosion

,i room cooling. caused room cooler degradation.

cn Indian Point 2 08/29/81 LER 247/81-21 Service water Leak discovered downstream of fan piping leak. cooler motor cooler in elbow.

Kewaunee 02/16/83 LER 305/83-05-1 Loss of one EDG Service water outlet valve of the EDG oil cooler stuck closed.

Kewaunee 10/26/83 LER 305/83-27-1 Loss of one CCW Leak on the CCW HX service water l

heat exchanger. temperature controlled bypass line caused by sand erosion due to turbulence on outlet side of temperature control valve.

4 Salen 2 08/09/82 LER 311/82-70-1 Leak on fan cooler Silt particles eroded a cooling unit. coil.

Salem 2 08/13/82 LER 311/82-73 Leck on fan cooler Silt particles in service water unit. caused erosion.

Salem 2 08/13/82 LER 311/82-74 Leak on fan cooler Silt particles in service water unit. caused erosion.

Appendix F (Continued)

Plant Name Date Reference Consequences Comments Sales 2 08/18/82 LER 311/82-77-1 Leak on fan cooler Erosion caused by silt particles in unit. the service water.

Salem 2 08/21/82 LER 311/82-80 Leak on fan cooler Erosion of copper nickel cooling unit. coils caused by silt in service water.

t Salem 2 09/06/82 LER 311/82-91 Leak on fan cooler Erosion of copper nickel cooling unit. coils by silt laden service water.

Sales 2 09/ m/92 LER 311/82-92-1 Lean on fan cooler Erosion by silt in service water.

unit.

I Salen 2 09/15/82 LER 311/82-100 Leak on fan cooler Erosion caused by cilt in service unit. water.

O LER 311/82-101 Leak on fan cooler Erosion of cooling coils by silt in Salem 2 09/16/82 unit. service water.

i Salem 2 09/23/82 LER 311/82-109 Leak on fan cooler Silt in service water caused erosion unit. of cooler coils.

Sales .' 10/05/82 LER 311/82-113 Leak on fan cooler Silt in service water caused erosion unit. of cooler coils.

Salen 2 09/28/82 LER 311/82-115 EDG inoperable. Silt in service water caused leak in the EDG oil cooler.

i

! Salen 2 10/08/82 LER 311/82-119 Leak on fan cooler Silt in service water caused unit. erosion of coils.

10/11/82 LER 311/82-120 Leak on fan cooler Erosion of cooling coils caused by

) Salem 2 unit. silt in service water.

Salen 2 10/18/82 LER 311/82-122 Leak on fan cooler Silt'in service water caused erosion unit. of cooling coils.

Appendix F (Continued)

Plant Name Date Reference Consequences Comments Sales 2 10/31/82 LER 311/82-128 Leak on fan cooler Silt in service water caused erosion

unit. of cooling coils.

! Sales 2 11/21/82 LER 311/82-135 Leak on fan cooler Silt in service water caused erosion unit. of cooling coils.

I Salem 2 11/24/82 LER 311/82-136 Leak on fan cooler Silt in service water caused erosion unit. of cooling coils.

Beaver Valley 1 05/21/82 LER 334/82-19 Potential for con- Through wall leak in expansion tainment leakage joint.

during DBA.

Oconee 1 02/16/80 LER 269/80-04 Loss of one ser- Erosion caused by constant flow

,, vice water pump. of lake water through the high E pressure service water pump motor cooler caused tube leakage.

i Oconee 1 07/07/80 LER 269/80-22 Loss of one ser- Erosion and corrosion of high vice water pump. pressure service water pump motor cooler tubes.

I Oconee 1 08/11/80 LER 269/80-26 Loss of one ser- Erosion of high pressure service vice water pump. water pump motor cooler tubes l

l caused leak into pump motor casing.

t 07/29/82 LER 265/82-16 One RHRSW pump Excessive seal leakage caused by Quad Cities 2 abrasives found in river water used inoperable.

to cool pump seals. Seal leakage can lead to bearing oil dilution.

Peach Bottom 2 06/18/86 LER 277/86-14 ESWS piping leak Leak on emergency SWS piping on required plant inlet to RHR room cooler, 1 shutdown.

i

4 1

Appendix F (Continued)

Plant Name Date Reference Consequences Comments i

Hatch 2 10/29/80 LER 366/80-145 Service water pump Wear caused by silt inside standby head and flow service water pump bowl assembly.

inadequate.

Hatch 2 05/19/81 LER 366/81-46-1 PSW pump Wear of bowl section of pump inoperable. caused by silt.

Hatch 2 12/03/82 LER 366/82-132 Leak on RHRSW Corrosion / erosion caused leak on valve. RHRSW valve.

i e

e i

i s

i

L

~

1 1

Appendix G Service Water System Events Involving Foreign Material and/or Debris Intrusion I

! Plant Name Date Reference Consequences Comments Indian Point 2 06/18/82 LER 247/82-26-1 Low service water Three pumps affected. Excessive l wear of pump impliers.

pump head.

Indian Point 2 04/01/83 LER 247/83-10 Inoperable service Rope wrapped around pump impeller.

water pump. ,

! Robinson 2 04/27/83 LER 261/83-06 Inoperable service Failure of pump attributed to water pump. debris in the impeller / casing

assembly.

I j

Surry 1 07/18/83 LER 280/83-32 Insufficient ser- Debris stuck open the check valve vice water pump allowing backflow.

flow.

1 1 Surry 1 08/13/86 LER 280/86-24 Clogged chillers. Chillers clogged by unfiltered

! c) water flowing through the chiller se tubes.

Surry 2 10/12/80 LER 281/80-29 Inoperable service Eel caught in pump impeller.

water pump. Redundant pump available.

Surry 2 02/09/81 LER 281/81-10 Low service water Eel caught in pump impeller.

pump discharge pressure.

Surry 2 01/28/82 LER 281/82-09 Loss of one Debris caused inadequate service i charging pump. water flow to the charging pump lube oil cooler.

} San Onofre 2 07/06/83 LER 361/83-72 2 heat exchangers Marine growth clogged saltwater inoperable. traveling screens.

San Onofre 2 07/30/83 LER 361/83-89 Saltwater strainers Debris clogged traveling screen 1

clogged. Rapid system.

power reduction required.

' Appendix G (Continued)

Plant Name Date References Consequences Comments San Onofre 2 07/30/83 LER 361/83-103 Saltwater strainers Debris clogged traveling screen clogged. Rapid system.

power reduction required.

3 San Onofre 3 07/06/83 LER 362/83-41 Clogging of screens Revising procedure to preclude con-results in exceed- current fouling of both CCW trains ing LCO. during excessive debris buildup in i single intake structure.

Quad Cities 1 04/07/81 LER 254/81-09 Loss of one RHRSW RHR service water pump did not meet i pump. flow requirements. Pieces of drift-wood found in pump.

, Quad Cities 1 09/05/82 LER 254/82-30 Loss of D RHR$W Burnt packing on pump. Packing c) pump. tightened too much because abrasives na in river water causes pump leakage.

Quad Cities 1 11/15/85 LER 254/85-19 Loss of D RHRSW D RHRSW pump did not meet flow re-pump. quirements. Pieces of wood found in '

pump impeller.

Browns Ferry 2 12/29/83' LER 260/83-84 Loss of one EECW Debris from river clogged a EECW pump. pump strainer.

Monticello 04/14/80 LER 263/80-19 Loss of RHRSW pump. Excessive sand and gravel passing through traveling screens caused degradation of pump wearing surfaces.

Hatch 1 08/19/81 LER 321/81-89 Loss of one plant Debris found lodged in pump.

i service water pump.

Hatch 1 11/21/81 LER 321/81-123 Loss of one RHRSW Inadequate cooling water flow to a j pump. RHRSW pump due to mud and sludge buildup.

1 i

Appendix G (Continued)

Plant Name Date Reference Consequences Comments Hatch 1 05/05/82 LER 321/82-43 Inadequate flow Debris lodged in pump impeller.

from RHRSW pump.

Hatch 1 05/10/82 LER 321/82-46 Loss of 2 RHRSW Debris lodged in 2 RHR SW pump in-pumps. pellers. Maintenance activities and broken traveling screens.

Hatch 2 03/08/80 LER 366/80-24 Loss of a RHRSW Debris in pump suction.

pump.

Hatch 2 06/25/81 LER 366/81-63 RHRSW pump Debris found lodged in pump.

inoperable.

Hatch 2 06/26/81 LER 366/81-66 Inoperable standby Pump would not deliver required flow service water to diesel. Backup operable.

system pump.

4 Hatch 2 04/28/82 LER 366/82-44 RHRSW pump Debris in pump.

inoperable. ,

Turkey Point 3 06/11/86 LER 250/86-24 Loss of one intake Two pieces of wood lodged in pump cooling water pump. impeller.

Surry 1 08/13/86 LER 280/86-24 Loss of cooling to Clogged chillers due to unfiltered control room and river water resulting from bypassing relay room. inoperable filters.

Appendix H Service Water System Events Involving Personnel and Procedural Errors Plant Name Date Reference Consequences Comments San Onofre 1 10/10/84 LER 206/84-12 Inoperability of Personnel aligned shutdown cool-both RHR trains. ing to a HX without saltwater cooling flow. RHR quickly restored.

i Surry 1 09/22/82 LER 280/82-100 Loss of service Air bound service water pump while water pump. using air to clear sensing lines to the service water strainer D/P gauges.

Surry 1 12/14/82 LER 280/82-124 Loss of one train Service water inlet valve to of service water heat exchanger inadvertently system. de-energized and tagged.

1 Surry 2 04/29/81 LER 281/81-26 Loss of service Maintenance personnel splashed water pump. water on operable pump while i

=c removing a valve in the redundant a pump flowpath.

Surry 2 09/29/83 LER 281/83-44 Loss of redundant Pump discharge valve found service water pump. closed with pump in standby. '

Surry 2 02/15/85 LER 281/-02-1 Isolated seal Service water was isolated to cooler. the seal cooler when operators shifted coolers without follow-ing procedure. g Zion 1 10/15/85 LER 295/85-39 Cross-tie between Service water cross-tie valve units unavailable. between units 1 and 2 was inad-vertently closed.

Zion 1 01/12/86 LER 295/86-01 One AFW pump 2 SW valves to 1 AFW pump lube inoperable. Oil cooler were unknowingly closed for 20 days.

4

l Appendix H (Continued) i Plant Name Date Reference Consequences Comments Sales 2 01/28/85 LER 311/85-01 Inoperable EDG. Service water valve installed incorrectly. EDG tripped during retest following valve replace-ment on high jacket water temp.

Cook 1 10/08/82 LER 315/82-95 Containment spray ESW supply valve to heat heat exchanger exchanger found closed. Valve inoperable. closed during maintenance and i

not returned to proper position.

1 i Sequoyah 1 07/30/81 LER 327/81-78 Two EDGs inoperable. With one EDG out for maintenance,

' removed relief valves for oper-

! able EDG's ERCW heat exchanger.

Sequoyah 1 08/21/81 LER 327/97 Missing pipe protec- Service water piping could be

c tion structure. damaged in the event of a J> mainsteam line break.

Sequoyah 2 04/06/85 LER 328/85-06 Inoperability of Air control valve for ERCW to containment spray containment spray pump room i

pump. cooler placed in wrong position i following surveillance.

i Beaver Valley 1 09/17/80 LER 334/80-68 Inoperable charging Two check valves installed back-pump. wards for river water supply j to pump oil cooler.

1 Trojan 10/11/84 LER 344/84-21-1 Inadequate service Valves controlling service water water flow through flow through all CCW heat CCW heat exchangers exchangers positioned so that inadequate flow passed through coolers.

1 i

4 Appendix H (Continued)

Plant Name Date Re ference Consequences Comments Farley 2 06/09/82 LER 364/82-28 Potential loss A and B train service water valves of swing charging to the swing charging pump were pump. mislabeled.

Farley 2 08/26/83 LER 364/83-34 Insufficient cool- Service water valves to coolers ing flow through closed during maintenance and coolers. not reopened upon completion.

3 I

! Mcguire 1 10/09/85 LER 369/85-30 Loss of train A The local valve position indi-nuclear service cator was reversed, thus the

' water. valve was indicating open when it was actually closed.

Mcguire 2 01/23/85 LER 370/85-01 Service water valve Poor valve lineup.

open but not locked

p cpen as required.

w Palisades 01/08/84 LER 255/84-01 Loss of all EDGs. During planned loss of offsite power for maintenance, operators did not realize that there would be no service water flow for EDG cooling. EDG over-heated and tripped in 50 minutes.

Palisades 08/04/86 LER 255/86-24 Loss of two contain- SW flow to two coolers was inad-ment air coolers. equate because the valves had

[

been mistakenly throttled.

Maine Yankee 05/07/80 LER 309/80-13 Reduction in degree Charging pumps improperly I

of redundancy. lined up with service water cooling.

Millstone 2 12/28/82 LER 336/82/-53 Loss of service Both A and B HXs aligned to water redundancy. same header.

4

i

' ~

Appendix H (Continued)

Plant Name Date Reference Consequences Comments Oconee 1 07/17/81 LER 269/81-14 Loss of control Loss of control power to both power to both A and HPSW pumps caused because con-B HPSW pumps. trol breakers were open.

Oconee 2 11/04/80 LER 270/80-24 Loss of orie HPI Isolation of low pressure pump. service water to pump resulted in high bearing temp.

Oconee 2 01/20/81 LER 270/81-01-1 Loss of one HPI pump. No flow of LPSW to the HPI pump.

Dresden 3 02/22/85 LER 249/85-06-1 HPCI system inoper- Service water flow to HPCI room able. cooler inadvertently valved out.

05/10/80 LER 321/80-45 Potential loss of 2 Motor bearing cooling water Hatch 1 of 4 RHRSW pumps. supply valves to the RHRSW

=c pumps A and B were found closed.

em Valves for all 4 pumps have since been locked open.

Hatch 1 06/18/82 LER 321/82-35 Potential loss of Manual valve for PSW pump seal plant service water and prelube water found par-pump. tially closed and not locked.

Valve is normally locked open.

Hatch 1 07/04/83 LER 321/83-69 Inoperable RHRSW RHRSW pump inoperable when mini pump. flow valve found closed.

Hatch 1 12/03/83 LER 321/83-117 Potential loss of EDG cooling water supply valve EDG. found closed. Valve was man-ually opened.

Brunswick 1 03/04/80 LER 325/80-21 Loss of 2 of 4 Isolation valve for suction service water pumps. pressure switch found shut.

_ _ _ . _ = - - - ..

4 .

• I I

Appendix H (Continued) i Consequences Plant Name Date Reference Comments j Brunswick 1 12/06/81 LER 325/81-95-1 Loss of 2 of 4 RHR Open circuit breaker in the pumps l

SW pumps. motor coolers low suction pres-sure permissive switch resulted J

in low suction header pressure

) lockout.

a Brunswick 1 01/19/84 LER 325/84-01-1 Shutdown cooling Loss of all RHRSW. One loop and suppression out for maintenance and entrapped pool cooling air in redundant suction header inoperable. piping caused low pressure trip.

of pumps.

Fitzpatrick 07/17/80 LER 333/80-62 Inadequate RHRSW Orifice placed in RHRSW piping j flow. limited flow to 7800 vs. 8000

GPM as required.

i x l E Fermi 2 07/29/85 LER 341/85-47 Loss of DIV I RHR Valve in return line for RHRSW SW. deenergized closed instead of open.

I Hatch 2 06/23/81 LER 366/81-57 Loss of PSW DIV II Supply valve to reactor building j

supply to reactor found closed.

j building.

i Hatch 2 08/17/82 LER 366/82-95 Loss of RHRSW loop Personnel closed a loop strainer

A while loop 5 out inlet valve instead of B loop for maintenance. valve.

4 i

Oyster Creek 01/12/87 LER 219/87-04 2 EDGs inoperable. With 1 EDG out for maintenance, j

personnel removed D emerg. ser-

) ~

vice water pump from service violating tech specs.-

l i

! Browns Farry 3 01/25/86 LER 296/86-04 Loss of 2 RHRSW EDG taken out of service dis-i pumps. ables 2 RHRSW pumps.

1

)

I

1 Appendix H (Continued)

Plant Name Date Reference Consequences Comments Susquehanna 2 10/24/86 LER 388/86-16 Potential loss of Valves for both ESW HXs had con-

' hoth los pressure trollers misaligned.

EF T' .

j Surry 1 10/30/86 LER 280/86-3E Loss of cooling to Loss of all service water cool-HPI lube coolers. ing to charging pump lube oil coolers for 19 minutes. Caused by air binding of pumps when plac;ng strainer in service.

1 Surry 1 11/04/86 LER 280/86-32 Loss of cooling to Loss of service water flow to charging pumps. charging pump lube oil coolers when l

air was introduced into the system.

I at Millstone 3 11/30/86 LER 423/86-56 Loss of B safety Personnel left SI pump cooler

]'

J, injection pump. service water outlet valve closed.

i l Millstone 2 04/03/87 LER 336/87-06 Insufficient flow Inconsistency between FSAR value

' during peak temps. for service water flow and calcu-lated flow for LOCA heat removal.

4 Farley 1 05/10/87 LER 348/87-09 Loss of B RHRSW RHRSW cooler valved out for cooler. maintenance and never restored.

I i

o Appendix I Service Water System Events Involving Seismic Deficiencies Plant Name Date Reference Consequences Comments San Onofre 1 01/10/80 LER 206/80-01 Potential loss of Salt water cooling system not saltwater cooling seismically qualified.

system.

Indian Point 3 10/17/83 LER 286/83-06 System not seismic- Steel plates holding the seismic ally qualified. restraint collars on the service water pumps were not in place.

Beaver Valley 1 09/12/80 LER 334/80-65 Potential for loss Overstress condition exists at one of all service location on each of the two reactor water. plant river water supply lines.

North Anna 1 01/07/80 LER 33/80-02 Potential loss of Incorrect valve weights used in service water support calculations for service

-. makeup line. water makeup line from the screen

/. wash pumps.

North Anna 1 01/16/80 LER 338/80-16-1 Potential loss of Pipe hangers overstressed for service water dur- service water makeup water screen ing seismic event. pump discharge lines.

Calvert Cliffs 1 01/04/81 LER 317/81-29 Inadequate service Inadequate piping supports for water piping service water subsystem.

support.

e Appendix I (Continued)

Plant Name Date Reference Consequences Comments Millstone 2 05/08/80 LER 336/80-18-1 Service water sys- Hangers inadequate for reveral ser-l tem not seismically vice water piping runs.

J qualit.ad.

Millstone 2 12/22/83 LER 336/83-31 Service water sys- Schedule 40 pipe installed in lieu tem not seismically of standard pipe. Pipe adequate, i i however, 5 pipe hangers inadequate.

qualified.

i i Oronee 1 02/G3/86 LER 269/86-02 LPSW not seismic- Discovered through response to ge-ally qualified. neric letter 81-14. Valves and piping not seismically qualified.

Crystal River 3 10/28/85 lek 302/85-24-2 Service water Pedestals and pipir.g supports not piping pedestals sufficient to withstand operating 4

overloaded. loads. Cracked pedestals found.

• 7 ANO 1 03/07/30 LER 313/80-10 Service water pip- 28 hangers were determined to be

ing not seismically inoperable per IE Bulletin 79-14.

qualified.

i ANO 1 04/01/80 LER 313/30-11-9 Service water pip- 46 hangers declared inoperable per ing not seismically IE Bulletin 79-14.

' qualified.

LER 313/81-01-1 Service water pip- Additional piping supports required.

) ANO 1 01/17/81 ing not seismically qualiffed.

!, .t 4

s 1

k i

i

s Appendix I (Continued) i Plant Name Date Reference Consequences Comments

! ANO 1 03/28/83 LER 313/83-05 Potential to lose 2 Upper oil reservoir piping altered i of 3 pumps in for maintenance. Piping inadequate-seismic event. ly supported.

Oyster Creek 12/11/85 LER 219/85-23 Service water pip- Deficiencies in the ESW piping could ing not seismically render system inoperable during a qualified. seismic event.

Oyster Creek 08/28/86 LER 219/86-21 Piping not seismic- Inadequate design. ESWS not ally qualified. seismically qualified.

Quad Cities 1 08/11/86 LER 254/86-24 Service water pip- Cross-tie piping modification be-ing not seismically tween units 1 and 2 not adequately qualified. supported.

b Vermont Yankee 03/28/80 LER 271/80-12 Service water pip- Installation error.

ing not seismically qualified.

1 Vermont Yankee 06/08/83 LER 271/83-15-1 Service water pip- SWS copper piping installed during ing not seismically 1983 modification not adequately qualified. supported.

Pilgrim 10/30/80 LER 293/80-78 Potential loss of Installation of seismic anchor out-

service water side tornaUo protection point.

• 4 system.

Hatch 1 08/22/80 LER 321/80-100 Service water pip- Seismic piping support not installed

' ing not adequately as required.

supported.

i l

N I.

__m.__.__ m_ _ _ ___m. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ . _ __-- -

- - - - e _ _ - - _ _ _ _ . - - _ _ _ _ - _ _ _ . - _ _ _ _ - -----_.__--_-__.__.---.m.____-_-_.-__.____..-___m - _ _ _ _ _

Appendix I (Continued)

I i

Plant Name Date Reference Consequences Comments

Hatch 1 02/11/81 LER 321/81-10 Piping to EDG cool- Inadequate design, l

t ers not seismically qualified.

Hatch 1 04/02/81 LER 321/81-25 Potential to lose Plant service water discharge con-

all PSW during trols not seismically qualified.

i seismic event. Could cause both discharge valves j to close.

i j Hatch 1 07/29/81 LER 321/81-81 RHRSW piping in- RHRSW piping in the intake structure adequately sup- is inadequately designed.

j ported.

} Hatch 2 02/14/80 LER 366/80-12-1 RHRSW and PSW pip- Inadequate design.

ing inadequately j i supported.

i l Hatch 2 09/30/80 LER 366/80-136 PSW piping support One support not installed as i not installed. designed.

a I Susquehanna 1 07/03/86 LER 387/86-24 Pump auto start re- All 4 ESW pumps at both plants

! lays not seismical affected.

ly qualified.

l j River Bend 1 11/13/85 LER 458/85-34 Service water pip- Missing supplemental steel support i ing not seismically in piping tunnels affected safety

}

qualified. related piping of the standby I

service water system.

i

. Susquehanna 1 07/03/86 LER 387/86-24 Em.ergency service Emergency service water pump auto l water pump relays start relays were not seismically not seismically qualified as specified in the FSAR.

l qualified.

4 i

1 i

<. - _ _ __. _ - _ . . _ -_- . .__ ._ _ .- . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __