ML20205P884

AEOD/E704, Discharge of Primary Coolant Outside of Containment at PWRs While on RHR Cooling, Engineering Evaluation Rept

ML20205P884
Person / Time
Issue date:	03/31/1987
From:	Israel S NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
Shared Package
ML20205P752	List: ML20205P749 ML20205P799 ML20205P884
References
TASK-AE, TASK-E704 AEOD-E704, NUDOCS 8704030398
Download: ML20205P884 (18)

Text

I go ,

i AE0D/E704 ENGINEERING EVALUATION REPORT

• Discharge of Primary Coolant Outside of Containment at PWRs while on RHR Cooling by the Office for Analysis and Evaluation of Operational Data March 1987 Prepared by: Sanford Israel

• Note: This report supports ongoing AEOD and NRC activities, and does not represent the position or requirements of the responsible NRC program offices.

8704030398 870326 PDR ORG PEXD

TABLE OF' CONTENTS Page SlVMMARY . . . . . . . . . . . . . . . . . . . . . . . . . . . ... . I

1.0 INTRODUCTION

. . . . . . . . .. . . . . . . . ... . . . . . . . 2 2.0 DISCUSSION . ........................ 2' 4

2.1 Description of Operating Events . . . . . . . . . . . . . . . . 2

^

2.2 Analysis and Evaluation . . . . . . . . . . . . . . . . . . . . 10 3.0 FINDINGS AND CONCLUSIONS . . . . . . ... . . . . . . . . . . . 14 4.0 SUGGESTIONS . . . . . . . . . . . . . . . . . . . . . . . . . . 15

5.0 REFERENCES

. . . . . . . . . . . . . . . . . . . . . . . . . . 16 i

1 I

I

(

l 1

I i

)

... - . _ . , , , , _ . - . . _ - . . _ _ . _ . - , e-,_ _

.?,

SUMMARY

In 1985, the Office for Analysis and Evaluation of Operational Data (AE00) issued a case study report on the loss of decay heat removal (RHR) systems at presserized water reactors (PWRs). That case study report evaluated the causes of operating events involving the loss of RHR cooling and evaluated the human-factor aspects of precluding that type of event from progressing into a severe core damage accident in the one- to two-hour time frame available for recovery.

, A similar AE00 engineering evaluation on operating experience involving the

inadvertent draining of a boiling water reactor during shutdown cooling was issued in 1986. That latter report evaluated the RHR system configuration and

• the human factor elements that contributed to draining the pressure vessel.

Those studies prompted a review of inadvertent discharge of primary coolant outside of containment at PWRs while on RHR cooling to assess the causes of 3

these events and their significance. A total of seven operating events which occurred at different PWRs in the last nine years were . identified and evaluated.

The major causes of these operating events, involving the discharge of primary

coolant outside of containment, are problems associated with deficiencies in operating procedures and personnel errors. The RHR system is a multi-function j system that is capable of moving coolant in and out of the primary system by changing valve positions in the RHR suction and discharge lines. During shut-down, while on RHR cooling, maintenance, test and other activities can create a busy working environment that is conducive to personnel errors if procedures

are not carefully written or followed to preclude inappropriate sequential valve operations, or if the operators are not attentive to the various

! evolutions in progress. If not terminated, these operating events, involving

! the inadvertent discharge of primary coolant outside of containment, could progress into loss of RHR cooling events.

l These operating events were judged to have a low core damage likelihood, but have the potential for offsite releases if the event and/or the pathway outside of containment is not isolated in a timely fashion. Consequently, it is suggested

! that an IE information notice be issued to alert licensees to the occurrences of these events and to highlight the significant operational aspects that 1

can reduce the likelihood and severity of these events. The important areas 1 are: 1) an unambiguous sequence of valve manipulations in RHR testing, j maintenance, and operation procedures regardless of the plant configuration;

2) avoiding RHR maintenance and testing evolutions while the primar  ;

drained down for steam generator repair or other activities; and 3)yadequate system is recovery procedures which address isolation of'the coolant pathway outside of containment. '

i i

1 l

1

. i

. . i

1.0 INTRODUCTION

4 1_

In 1985, the Office for Analysis and Evaluation of Operational Data issued a case study report (AEOD/C503, Ref.1) on the loss of decay heat removal ,

systems at pressurized water reactors. That report evaluated the causes of l operating events involving the losses of RHR cooling and investigated the human i factor aspects of precluding that type of event from progressing into a severe

! core damage accident in the one- to two-hour time frame available for recovery.

1 A similar AE00 engineering evaluation (AE0D/E609, Ref. 2) on inadvertent drain-ing of boiling water reactors during shutdown cooling was issued in 1986. ' That

, latter report evaluated the RHR systems configurations and human factor i

elements that contributed to draining of the BWR pressure vessel. Prompted by

{ these studies, a generic evaluation of operating events' involving the inadver-j tent discharge of primary coolant outside of containment at PWRs while on RHR cooling was conducted. These events are potentially more significant than-the simple loss of RHR cooling and draining of the pressure vessel because of the i pathway for radioactive releases outside of containment.

2.0 DISCUSSION i

1 2.1 Description of Operating Events i

l Seven events which involved the inadvertent loss or discharge of primary j coolant outside containment were found to have occurred at seven pressurized water

] reactors. These events are described in the following paragraphs.

l Davis-Besse 1 j On July 11, 1977 with the reactor at hot shutdown, a surveillance test was

! performed on one decay heat removal (DHR) train. At the time the DHR train was taking suction from the borated water storage tank (BWT) and discharging to

the BWT through miniflow lines (Ref. 3). While realigning the flowpath from i the recirculation mode (from and return to the BWT) to the nomal shutdown path I (from the reactor hot leg back to the reactor cold legs), the isolation valve j in the suction line from the hot leg was opened before the isolation valves in

the recirculation line cold legs were closed. This alignment allowed water to

] flow from the RCS to the BWT (Fig. 2.1).

The pressurizer water level dropped from 85 to 50 inches before the control room operator realized the mistake and reclosed the RHR suction valve from the i hot leg. When the pressurizer level dropped below the low level setpoint, the I makeup valve to the RCS fully opened automatically. Since the CVCS makeup i pumps also feed the reactor coolant pump (RCP) seals, seal flow decreased from

)' 8 to about 3 gpm. The component cooling water (CCW) flow to one'of the RCP seal coolers was operating at 45-46 gpm which was below the low flow setpoint.

I The RCP tripped automatically on low CCW flow and low seal injection flow. The I large flow rate of the makeup pump caused the makeup tank pressure to decrease 1

from 10 psig to 1 psig. At that time, the control room operator tripped the

! makeup pump to protect it from loss of net positive suction head (NPSH).

Subsequently, a second RCP was manually tripped by the control room operator to j protect the pump seals and to stay within limits for single RCP operation.

1 i

i i

l'

~ _ _ _ __ _ _ _ . _ _ _ _ _ __ _. _ .__ _ _ _ _ _ _ _ __ _ _ _ ._ _ _

I i -

)

i

]

I TO RCS

( - COLD LEG

^ u U -4><3--

1 1 FROM RCS HOT LEG l -

DECAY HEAT PUMPS X I i

MINIFLOW LINE BORATED i

j j

WATER STORAGE TANK B J2 TO RCS i

E e

\

f 7 '

- COLD LEG 1

l i

/

^

TG /

i

! Figure 2.1 SIMPLIFIED DIAGRAM OF DECAY HEAT REMOVAL SYSTEM AT DAVIS BESSE i

\

y .

~

St. Lucie Unit 1 On June 11, 1980, with the plant operating at 100 percent power, an electrical short caused the isolation of component cooling water to the reactor coolant pumps (Ref. 4). The reactor coolant pumps were subsequently manually shutdown and the reactor was cooled down by natural circulation. About 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> into the event, forced shutdown cooling flow was reestablished using RHR pump 18. About 90 minutes later, RHR pump 1A was started taking suction from the RWT and discharging into the comon RHR header. The isolation valves in the common recirculation line were opened so that RHR' train IA was operating in its -

miniflow mode (Fig. 2.2). RHR pump 18 should have been isolated at this point from the miniflow line by the closed gate valve in the comon RHR Leader.

! Using pump 1A to inject water and maintain near shutoff head pressure on the RCS, the pressurizer was filled to what was believed to be a water-solid

condition by continuing to charge via the charging pumps. RCS pressure rose from about 110 psig to about 200 psig shortly after pump 1A was started.

i l Although the constant level indicated that the pressurizer was solid, the 3

continued charging flow at 88 gpm did not cause the pressure to rise above 200 psig as it should have if the RCS were solid. Letdown had been secured

previously while filling the pressurizer. Indications of a steam void in the i

reactor vessel head were no longer evident after the pressurizer became water solid and the RCS pressure increased.

During the period that RHR pump 1A was operating with some recirculation

through the miniflow line to the RWT, the lack of a pressure increase in

response to charging flow was investigated. RWT level increased about 4500 gallons during this period of investigation. After the shutdown cooling

) system warm up, the RHR pump 18 "miniflow" manual isolation valve had been shut; however, on a subsequent check, after it was discovered that the RWT level increased, the pump 1B miniflow isolation valve was found one-half turn open. It was immediately closed. About 90 minutes after its startup, pump 1A was secured from operation in the injection mode and "miniflow" was isolated.

The continued charging at 88 gpm caused a slight rise in RCS pressure. Letdown in excess of charging flow was established, and a steam bubble was drawn in the j pressurizer with the level in the indicating range.

i l

Maine Yankee

! On March 24, 1984, with the plant at 280 psig and 140*F, the operators were i performing an RHR recirculation evolution to equalize the boron concentration 4

in the low pressure safety injection lines prior to starting up the plant I (Ref. 5). At the time of the event, the RHR system was providing normal decay j heat removal with the system alignment indicated in Fig. 2.3. The RHR was drawing water from a reactor hot leg and' discharging back into the reactor cold

legs. While the RHR was in this lineup, the operators initiated recirculation l

i of coolant in(which procedures the safetydid notinjection require RHR lines to in be accordance isolated from with thethe plant system primary heatup).

These activities were prompted by a night order which scheduled startup i operations and included a separate checklist of activities to be completed.

The order scheduled the start of low pressure safety injection (LPSI) recircula-i tion prior to the checkoff for securing the RHR system. Using the checklist in i

l mm-- - - - . - . e-r,-,-~,-nwen-w -~r-,ov,-r- e-- ---c--,, . ,-

-o- ev a-- m -,-,--,-w-mme- cw--s- ---.---wm ,e-+ - -

---

swr-- w -,re~~~ev- --

w - -we---

-- . - . _ _ . - .- - - - . _ _ ~. - _ _ _ - _. _ ..

a

~

t l .

i i

i 1

l 1

1 i

! FROM RCS , m TO RCS HOT LEG 1_GI

, f '

" COLD LEGS

! 1A l,

1 DECAY HEAT 3 REMOVAL l PUMPS qy MINIFLOW LINE jg REFUELING WATER j -

TANK TLG ' D COLD LEGS i

i

v. g

A h

4 i

Figure 2.2 SIMPLIFIED DIAGRAM OF DECAY HEAT REMOVAL SYSTEM AT ST. LUCIE l

I i '

t .

TO RCS COLD LEGS ,'

Ak Ak Ak i

J Z ZZ

! "-c Ak A

i l

OT LEG DECAY HEAT M "'

9- "'

h-l REMOVAL \

PUMPS l

REFUELING

! WATER i STORAGE TANK l

i 1

/ :9 i

I x :9:

Figure 2.3 SIMPLIFIED DIAGRAM OF DECAY HEAT REMOVAL SYSTEM AT MAINE YANKEE

4 .

~

the night order, the operators opened valves which established a flow path from the RCS to the RWST. RCS pressure dropped and the pressurizer level decreased j to a level approximately 800 gallons below the low level indication.

Upon verification of the offnomal conditions, the operators immediately isolated the RCS. Subsequently, the licensee revised the plant heatup

, procedures to provide separate guidance for securing the RHR system prior to l

LPSI recirculation initiation. In addition, the licensee instituted improved

~

administrative procedures regarding implementation of night orders.

Callaway Unit 1 l

On July 17, 1984, with the plant water solid at 380 psig and 180*F in Mode 5, a surveillance test was performed on RHR pump "A" (Ref. 6). RHR train "B" was providing nomal decay heat removal with the system alignment indicated in i Fig. 2.4. In this mode, RHR train "B" was drawing water from the hot-leg and

, discharging into the reactor cold legs. A cross-connect valve between the two trains was closed. RHR train "A" was tested in a recirculation mode, drawing.

water from the refueling water storage tank-(RWST) and discharging fluid back

to the RWST through the RWST suction line. After the surveillance test was completed, RHR pump "A" was secured and the cross-connect valve was opened per the surveillance restoration procedures. This action opened a pathway from the

~

i primary system to the RWST. A reactor operator noticed a drop in RHR flow to the reactor coolant system (RCS) and a drop in RCS pressure and informed the i shift supervisor to trip RHR pump "B", which was immediately carried out.

I The operating crew initially believed that a pressure spike had lifted the RHR relief valves, causing loss of RHR flow. However, further evaluation by the j operators noted the valve lineup which allowed primary coolant to discharge through the RHR system to the RWST. The RWST recirculation line was subse-quently isolated. There was a one percent increase in the RWST level because l of discharged primary coolant.

i H. B. Robinson On January 2,1985, with the plant on shutdown cooling, the operators per-i formed a surveillance test on the containment spray system components which was observed by an NRC inspector (Ref.7). Portions of the test procedure j required the auxiliary operator (AO) to cycle the manually operated containment

spray isolation valves SI-891A and SI-8918. Because the area containing those j valves was contaminated, the A0 did not bring the relevant procedure to the l valve location. During subsequent valve manipulations, the A0 inadvertently cycled open normally " locked-closed" valve SI-891C (safety f rjection and i residual heat removing system cross-connecting valve) instead of cycling closed normally " locked-open" valve SI-891A (in the containment spray system). The relevant RHR system configuration is shown in Figure 2.5.

Upon realizing that flow was initiated, the A0 shut the valve and relayed his

! concerns to the control room. The senior reactor operator (SRO) did not

! censult the procedure available in the control room and thus failed to ensure

that the A0 was operating the correct valve. The SR0 believed that the initia-tion of flow was an expected outcome of pressurization of the system, and i .

i

_ ,___ _,._.. _,_.m.-_ _ _ _ _ . _ _ . . , , . . _ _ _ _ . _ , _ _ _ _ . _ _ _ , _ . _ _ _ _ _ _ _ _ . . . _ . - _ _ _ _ . . _ . , _ _ _ _ , . _ . _ . _ .

1 .

l i g l ,

i i

j ,

I

! TO RCS COLD LEGS l FROM RCS

?4 Q 7

] HOT LEG

QC

^

4 RHR . X PUMPS RECIRCULATION LINE REFUELING

] WATER i J

l i

yj(

f STORAGE TANK TO RCS B COLD LEGS

) FROM RCS.

l " 's"" :A : 0 .

l i

m 9, I

i 1

i

! Figure 2.4 SIMPLIFIED DIAGRAM OF RESIDUAL HEAT REMOVAL SYSTEM i l AT CALLAWAY i

\  ! -

4 I

l  : ~T ~R6S~

COLD LEGS).

Ak AN l

ZZ

,1 I  %

X

~

'SAFiTV l

INJECTION j Al 1f PUMPS 4k  :-

l FROM RCS .

. RHR f HOT LEG \

4, ,- PUMPS 891C 1 I l

1. EFDEEIMG WATER STORAGE FBI TANK W

O

)

i l

l Figure 2.5 SIMPLIFIED DIAGRAM OF RESIDUAL HEAT REMOVAL SYSTEM j _

AT H.B. ROBINSON

~

1 directed the A0 to proceed with opening the valve. When valve SI-891C was l fully opened, the pressurizer level decreased 9 percent in one minute. Since the control board operators were carefully monitoring the reactor coolant system heatup, the dropping pressurizer level was noticed almost imediately and the SR0 was notified by the control board operator. Assuming that the drop

in pressurizer level was due to the performance of the surveillance test, the

! SRO announced over the paging system to " Shut the valve." The A0 responded quickly and the pressurizer level decrease was teminated.

I Arkansas Nuclear One Unit 2 On April 10, 1985, while the reactor was in cold shutdown, a contractor employee incorrectly drained the reactor coolant side of the non-regenerative i heat exchanger in the purification system (Ref. 8). The evolution was supposed to drain the component cooling water side as part of the procedure for flushing the component cooling water system. Approximately 3,200 gallons of reactor l

coolant was drained from the RCS with a portion released to Lake Dardenelle.

j The contractor employee was authorized to make the hose connection, but was

! not supposed to manipulate any valves. An operator performing a plant walkdown i noted water on the floor in the auxiliary building and the hose to the heat l exchanger was subseouently isolated.

! Yankee Rowe On June 27, 1986, with the plant in cold shutdown, the operators were switching 4

over to an alternate method of shutdown cooling because of a shaft seal failure j on the operating shutdown cooling pump (Ref. 9). The alternate method of j shutdown cooling is to use the low pressure surge tank (LPST) cooling pump and j cooler which are connected in parallel with the normal shutdown cooling train.

j There were approved procedures for switching over to the alternate method of 4 shutdown cooling. During the process of carrying out the procedure, the

! operator did not fully shut an isolation valve from the comon purp suction

! line from the LPST before opening a line connecting the LPST cooling train to i the primary system. Consequently, the pressurizer level indication dropped from 300 inches to below scale and the primary system pressure dropped from 100 i to 10 psig. A control room operator immediately secured the LPST cooling pump

and an auxiliary operator isolated the flow path to the LPST.

I '

! The control room operator started all three charging pumps which quickly

restored pressurizer level and system pressure. The operations staff involved i in the event were subsequently counseled about the need for strict procedural l compliance and the utilization of practical systems knowledge when performing plant evolutions.

I 2.2 Anaylsis and Evaluation

The residual heat removal (RHR) system is a multiple function system in j most pressurized water reactors. In addition to providing shutdown cooling for normal plant cooldown, it provides the low pressure safety injection l function of the emergenc recirculationfunction(ycorecoolingsystem(ECCS),andthelowpressurerecirculation fr

! later mitigation stage of a loss-of-coolant accident (LOCA). In some 1

.__ , _ . _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ ~~ . _ _ . . . _ _ . _ _ _ ___. _ I

1

! plants, the RHR system pumps also provide elevated pressure suction flow to the high pressure pumps and/or containment spray pumps during the recirculation

phase. During refueling operations, the RHR system pumps are used to i~ transfer fluid back and forth between the refueling water storage tank and the

j. refueling cavity (above the core) as circumstances warrant.

l While the multiple function design of the RHR provides high operational i flexibility and utilization of the system, it also provides opportunity for j personnel errors to cause system valving misalignment. This study focused on l the unanticipated discharge of primary coolant outside of containment while on normal RHR operation due to such misalignments. Such an event represents <

an uncontrelled loss of primary coolant outside of containment. The importance i of such events stems from both the loss of coolant and the coincident

! containment bypass. The combination of these characteristics increases the j potential severity of any offsite doses that might arise if an event sequence  ;

! were to evolve which resulted in core uncovery. '

l

An evaluation of the operational occurrences cited in the previous section  !

j indicates that the root causes of these events fall into two categories: '

j personnel errors and procedure deficiencies. Personnel errors included wrong valve operation, unauthorized activity, and valves not being fully closed.

i Assuming correct procedures, manipulation of the wrong valve could be caused by 4 poor labeling or operator cognitive error. These root causes have been discussed previously in NRC- and industry-sponsored studies. Labeling is important not only from a simple identification standpoint, but also from a-

! personnel error minimization (human factors) standpoint. The ability to easily 1 and quickly differentiate valves in different systems or even within the same i system / train reduces the potential for personnel errors. Operator cognitive j errors can stem from a variety of causes such as fatigue, distracting environ-1 ment, and inattention to detail.

Lapses in concentration can be avoided or can be quickly corrected by good j cormnunications feedback from cownrkers or reading relevant instruments to be

< aware of system conditions. Some of the events cited involved prompt operator  :

i response because of expeditious feedback from other personnel or monitoring of

! instruments. The issue of operator cognitive errors does not easily lend

! itself to simple remedies because it is a multi-faceted human performance  :

j issue. The work environment can be adjusted to minimize fatigue and dis-r tractions and training can be provided to sensitire the operators to specific situations. High motivation and excellence in attention to detail are more i difficult to address and are related to employee-management involvement at all ,

j organizational levels.

! Not fully closing valves may be caused by inattentiveness (lack of recognition),

i inadequate merkings (lack of indication), or inadequate training (lack of

knowledge). It would appear that adequate "close" indication on a valve

< coupled with adequate operator training to obtain confirmatory indications i (verbal and instrumentation) whenever an actifon is perfomed would help reduce these types of errors. From a human factors standmint, it is well known that l l an indication of valve position (open or closed) siould be the same for all  ;

{ similar valves and should be unambiguous. As discussed above, the problem of j inattentiveness is complex and may not be amenable to simple remedies.

{ i

t t.

Several technicaloforthe events were administrative caused .by) problems procedure Procedures inadequacies involving imprecise (i.e., either valve alignment sequences caused some of the events. Errors occurred because the initial system valve alignment was offnormal, and the procedure in force did -

not take that into consideration. A similar situation arose at Maine Yankee

. when a night order, listing several plant evolutions to be completed on a i shift, was misinterpreted with respect to the order in which the activities

. were to be performed. Consequently, an MR system valve misalignment resulted I because procedures were performed out of their nomal sequence. In order to i preclude inadvertently discharging coolan: to the RWST, the procedures (in use l at any given tine) should clearly state that the discharge line from the RHR to i the RWST (including cross-over lines) must be isolated prior to opening the RHR i suction line from the reactor coolant system or vice versa, a

j All of the operating events evaluated involved a discharge of between 2,000 j and 5,000 gallons of primary water outside of containment. The flow rates

! involved also varied considerably depending on the specific situation. The

esents resulting from leaking valves probably had flow rates less than i ene gpm while valve misalignment resulting in pumping coolant from the reactor

! coolant systen to the RWST could achieve flow rates exceeding 1,000 gpm. The l variation in the time to discovery appears to be related to flow rate. High i flow rate events were caught much sooner then low flow rate events. The i

majority of the events were detected within one hour of their inception by the  !

i reactor operators monitoring pressurizer level. The ensuing corrective '

i actions taken by the operator were based on training rather than' specific l j procedures. t I

A characteristic of these operating events is that no automatic mitigation j occurred. The safety injection actuation signal is blocked at about 1900 psi 1

when a plant is cooled down. Thus mitigation or response requires manual 1

operator action. Discussions with the plant operating staffs involved with i

several of the operating events studied indicate that the pressurizer low level I alarm is the most likely feature to alert the operator that an unintended ,

j discharge of primary coolant outside of containment is in progress. However, i the event reports indicate that the majority of the events in progress were

! detected by incidental observation of a low pressurizer level by control room j operators rather than by alanns. Some plants also have high level alarms in i the RWST and others have low flow alarms on the RHR system.

It appears that procedures for coping with the loss of reactor coolant while on j RPR cooling have been or are being eleveloped by some utilities because of prior industry and NRC staff studies rer ted to the loss of RHR cooling. These pro-l cedures do not immediately terminate the event, but rather provide a diagnostic format for identifying the current plant configuration and subsequent actions i to recover from specific situations.

I j The mode of occurrence does not fall into a specific pattern - sore events 1

occurred during plant cooldown, others during plant heatup, while others

, occurred after the plant had been in the refueling mode for an extended period 1

of time. The majority of the events were associated with a surveillance test, i ard some occurred during planned activities that involved the RHR system.

j Multiple activities are conmonplace under plant shutdown conditions when major i

. l l

4 maintenance or refueling activities are normally scheduled. Thus, the l

opportunity for these unintended events to occur is ever present during

shutdown operation.  ;

t Recovery from a loss of reactor coolant event is not automatically initiated i because the ECCS are generally isolated when the plant is on RHR cooling. The l high pressure pumps are generally disabled by racking out the breakers in the i motor control center or by the pull to lock switch in the control room. These j reduced system operability conditions were imposed because of concern for 2 overpressurizing the reactor coolant system when water solid on the RHR system.

l Thus, the capability to respond to a LOCA could be inhibited or delayed because j of the layup of the high pressure injection system, especially for those plants j that rack out power to the ECCS pumps in the motor control centers.

l The major corrections implemented by the affected licensees are in the areas of i administrative and technical procedures. Specifically, operating and test procedures related to the RHR system were modified to minimize the potential

! for undesirable valve alignments that could result in inadvertent discharge of i the reactor coolant outside of containment. These modifications clearly esta-

! blish the correct order for opening and closing specific valves and also alert the operator about the proper valve alignment prior to initiating the

! procedure.

1

) One licensee, whose event was associated with misinterpreted night orders, modi-

fied their administrative procedures regarding issuance of night orders and

also informed the operators and other relevant plant personnel that night i orders are guidance on what activities are to be accomplished and do not

} replace approved procedures for accomplishing each of the tasks. Discussions i with other utilities indicate that similar temporary orders are for guidance j only and do not supplant approved procedures.

The uncontrolled discharge of reactor coolant outside of containment while on

RHR cooling is a subset of the loss of RHR systen issue that was discussed in L

the AEOD case study report on decay heat removal problems (Ref. 1). If these i

} events are not terminated, they ultimately could result in reducing the water t i level of the reactor coolant system down to the hot leg elevation at which point the RHR pumps would cavitate. Assuming an initially filled reactor coolant system, this would require a loss of 30,000 to 40,000 gallons of water, which is significantly larger than the amount of inventory loss observed in the j operating events cited in Section 2 of this report. Thus, the likelihood of total loss of RHR from these events is small compared to likelihood of losing  :

RHR from other causes (130 events reported in Ref.1).

An assessment of core-damage likelihood from these events is uncertain because of the heavy dependence on operator action and the long times available to take i corrective actions. The events observed to date have all been terminated long l before RHR would be lost, even in absence of clear-cut emergency procedures and j operator training. Similarly, Ref. I has ihown that even w' th total loss of RHR, the operators were able to recover cooling before the coolant level j dropped below the top'of the core. The initiating frequency for inadvertent I

i i

j _____________-_.

I .

l discharge of reactor coolant outside of containment is on the order of IE-2*

per reactor year. The conditional probability that the operator does terminate

, the coolant loss before the RHR system is lost is dependent on the rate of coolant loss and the initial RCS inventory. If the event were to occur when

] the primary system is drained down to perform steam generator repairs, little i

time would be available to recover. No events occurred in this reduced l

! inventory mode. Assuming a filled primary system as the initiating condition,  :

an estimate of the probability that the operator would fail to terwinate the  !

event before loss of RHR is in the range of 0.01 based on a 30 minute time

] interval for takine action and the expeditious operator response in the previously cited events. The probability that the operator cannot provide adequate core cooling in the event that RHR is lost is less than 0.01 based on the operator I

success in the 130 events cited in Ref. I and the tist. available for action '

(greaterthan60 minutes). These different factors yield an estimated j core-damage likelihood for these sequences (assuming the primary system l 1s initially filled) of less than IE-5 per reactor year and it may very well *

! be less than IE-6 per reactor year. The likelihood that events may be ini . .

tiated from a reduced inventory condition is smaller than IE-2 per year based i on experience, but the human error probabilities leading to core damage would [

j be higher because of the reduced reaction time available. Taking the

different scenarios into consideration, the estimate for core-damace likelihood i for these events may range from about IE-5 per reactor year for those plants '

that do not prohibit RHR testing or maintenance while in a reduced primary i systen inventory mode and have inadequate operator training and reduced ECCS equipment availability, to less than IE-6 per reactor year for plants with il better administrative control and response capability.

• i These scenarios have the potential for significant offsite dose because the

! containment is bypassed as part of the initiating event. If the event were to i

proceed in an uncontrolled fashion to severe core damage and the containment J bypass is not manually isolated, the offsite doses cou d be higher than those

! for the loss of RHR events discussed in Ref.1. Thus, these events are judged j to be of moderate safety importance. t 3.0 FINDINGS AND CONCLUSIONS l

2 l 1. Seven operating events involving the inadvertent discharge of primary

coolant outside of containment while on RHP cooling occurred at seven >

PWRs in the last nine years. This corresponds to a frequency of about l 1E-2 per reactor year.

l 2. These events resulted from inappropriate valve operation that created a i pathway outside of the containment and Ssually to the refueling water '

storage tank. The inappropriate valve operation was caused by personnel '

errors and insufficient procedures. The personnel errors were primarily related to inattention or lack of training; while the procedural ,

deficiencies were related to omissions or lack of specificity in valve l i operations.

3. If not contro11ed, these events could progress into a loss of RHR l *lE-2 denotes 10~2

'l i

i

,,e' I cooling with containment bypass when the reactor hot legs become

' uncovered. Continued loss of coolant could result in a core uncovery and discharge of radioactive material outside of containment via the open

pathway (usually to the RWST).

i 4. There are no automatic plant responses to these types of events. In all of the events cited, the operators successfully teminated the discharge

outside of the containment by isolating the pathway. The operator

^

responses were generally not governed by procedures, but rather were based j on plant evolutions at the time of the event.

1 i

5. Existing procedures to cope with loss of coolant while on RHR cooling i appear to be diagnostic, i.e., to determine the plant's current configuration and the appropriate response to the particular situation i at hand.

t

! 6. Because these events occur during plant shutdown, at pressures less than

! 350 psi, the high pressure safety injection is usually disabled to pre- ,

clude inadvertent activation when the plant is water solid. Thus, the i j capability to respond to an uncontrolled LOCA may be diminished under these conditions, t

i 7. Although the estimated core-damage likelihood for these scenarios may be

! low, the potential pathway for radioactive material to bypass containment l makes this issue of moderate safety importance.

L i

1 4.0 SUGGESTION

} Because of the potential for offsite releases via the RWST and the lack of j specific procedures to deal with the operating events, we suggest that an >

i information notice (IN) be issued by the Office of Inspection and Enforcement to

] alert the licensees to the major causes of these events and other considerations l relevant and unique to these operating events. Specifically, important considera-

tions in the IN are the need for appropriate procedures for sequential valve i manipulations, the reduction of operator's available response time with a

! reduced primary system inventory, and the potential for discharge of radio- ,

I active material outside of containment. The need for appropriate procedures  ;

i for sequential valve manipulation is important to ensure that test, operation, f and maintenance procedures provide unambiguous directions on sequential valve I operations starting from any initial system configuration. Reduced primary i j system inventory reduces the operator's available response time. Scheduling i multiple plant evolutions while the primary system inventory is reduced l increases the likelihood of severe accidents and thus should be minimized if l

possible. The observed operating events involved the discharge of reactor i coolant outside of containment. The enhanced potential for offsite doses from 7 these events should be reflected in the emergency procedures by providing '

timely isolation of the pathways outside of containment.

b 1 1

I l l

\ l t l l i

5.0 REFERENCES

1. H. Ornstein, " Decay Heat Removal Problems at U.S. Pressurized Water Reactors," U.S. Nuclear Regulatory Comission, AE0D/C503, December 1985.

2. P. Lam, " Inadvertent Draining of Reactor Vessel during Shutdown Cooling Operation," U.S. Nuclear Regulatory Comission, AE00/E609, August 1986.

3. Licensee Event Report NP-32-77-6, Docket 50-346, Davis-Besse Unit 1 July 11, 1977.

4. IE Circular No. 80-15 " Loss of Reactor Coolant Pump Cooling and Natural Circulation Cooldown," U.S. Nuclear Regulatory Comission, June 1980.

5. Licensee Event Report 82-013. Docket 50-309, Maine Yankee, March 24, 1982.

6. Licensee Event Report 84-016 Docket 50-483, Callaway Plant, Unit 1. July 17, 1984.

7. U.S. Nuclear Regulatory Comission, Inspection Report No. 50-261/84-53 H. B. Robinson, March 6, 1985.

8. U. S. Nuclear Regulatory Comission, " Uncontrolled Release of Reactor Coolant to Lake Dardenelle," PNO-IV-85-16, April 11, 1985.

9. Licensee Event Report 86-010, Docket 50-029, Yankee Rowe, June 27, 1986.

l