ML20210N675

Power Reactor EVENTS.January-February 1986

ML20210N675
Person / Time
Issue date:	09/30/1986
From:	Massaro S NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
References
NUREG-BR-0051, NUREG-BR-0051-V08-N1, NUREG-BR-51, NUREG-BR-51-V8-N1, NUDOCS 8610060612
Download: ML20210N675 (50)

Text

_______ _________ _ _

NUREGlBR-0051 Vol. 8, No.1 it A POWER REACTC>R EVENTS I, / United States Nuclear Regulatory Commission Date Published: SEPTEMBER 1986 Power Reactor Fvents is a bi-monthly newsletter that compiles operating experience information about commercial nuciar power plants. This includes summaries of noteworthy events and listings and/or abstracts of USNRC and other documents that discuss safety-related or possible generic issues. It is intended to feed back some of the lessons learned from operational experience to the various plant personnel, i.e.. managers. licensed reactor operators. training coor-dinitors, and support personnel. Referenced documents are available from the USNRC Public Document Room at 1717 H Street, Washington, D.C. 20sss for a copying fee. Subscriptions of Power Reactor Events may be requested from the Superintendent of Documents. U.S Government Printing Of fice. Washington, D.C. 20402, or on (202) 783-3238.

Table of Contents Page 1.0 SUMMARIES OF EVENTS.. . . . . ..~.. . . . . . . - . . . . . - 1 1.1 Reactor Coolant Pump Shaft Failure, Resulting in Reactor Trip and Emergency Feedwater initiation at Crystal River Unit 3 . ,., .. .. .. ... .. ... . . ... ... .. . ... . 1 1.2 Unlabeled Switch Results in inadvertent Actuation of Deluge Spray System and Subsequent Scrom at River Bend - l

. . . . . . . . . . . . . . . . . . 6 1.3 Hand Held Radio Causes Loss of Offsite Powerat River Bend . . . . . . . . . . . . 7 1.4 Insulation Firein Containment Drywell ExpansionGap at Dresden Unit 3 .. ..... .. . . ... . 9 1 1.5 Setpoint Drift on Target Rock Safety Relief Valves at Brunswick Unit 2.. .. .... .  !

...... . ~. 13 '

1.6 Dropped Fuel Assembly Due to Bent Guide Pin at Haddam Neck.. . .. .. . ..

. . . . . . . . . 14 1.7 Lightning Events at Nuclear Power Plants...... ...... .. . .... . , .... . ..~.... .. . . . . . . 17 1.8 References. . . _ . . . . . . . .. .

1

. . . . . . . . . . . . . . . . . . . . . . . . 21 2.0 EXCERPTS OF SELECTED LICENSEE EVENT REPOR TS. .

. . . . . . . . . . . . . 23 lLO ABSTRACTS / LISTINGS OF OTHER NRC OPERA TING EXPERIENCE DOCUMENTS..... 37 ..

3.1 Abnormal Occurrence Reports (NUREG-0090) 3.2 Bulletins and information Notices... .

...... . . . . . . . . . . . . 37 3.3 Case Studies and Engineering Evaluations.. ..

. . . . . . . . 39 3.4 Generic Letters..; _. . . . . . . . . . . 41 3.5 Operating Reactor Event Memoranda _. . . . . . . . __

. 46 3.6 NRC Document Compilation 1.. . ..

........................... 47

. . . . . . . . 48 Editor: Sheryl A. Massaro Office for Analysis and Evaluation of Opera'tional Data U.S. Nuclear Regulatory Commission Period Covered: January-February 1986 Washington, D.C. 20555 8610060612 060;>

f DR NUREG DR-0051 R png i

~. .. . - .. - _ - .

4 1.0 SUMARIES OF EVENTS 1.1 Reactor Coolant Pump Shaft Failure, Resulting in Reactor Trip and Emergency Feedwater Initiation at Crystal River Unit 3 On January 1,1986, Crystal River Unit 3* was shut down following a reactor trip and emergency feedwater (EFW) initiation resulting from a problem with j reactor coolant pump (RCP) A. Examinatibn showed tnat the RCP A shaft had failed i completely within the hydrostatic bearing due to fatigue propagation of cracks.

l The failure occurred rapidly, with essentially no warning to operators. It has i been determined that the reactor coolant flow rate decreased from the four pump value to the three pump value within 3 seconds following failure of the shaft.

The post-trip review indicated that the reactor tripped on a power / flow mismatch i signal about 5 seconds after the failure. l On January 1, 1986, Crystal River Unit 3 was operating at 92% reactor power while generating 830 MWe. At 11:34 p.m., a number of alarms relating to RCP A were received. These alarms, received within a 1.5-second interval, included loose parts monitoring, motor vibration high, air cooler leakage high, bottom oil level high, reactor coolant loop A flow low, and total reactor coolant flow low. Three seconds after the first alarms were received, the reactor tripped en nuclear overpower based on reactor coolant system (RCS) flow and axial power imbalance (flux / delta flux / flow). The motor for RCP A continued to run for

approximately 2 minutes until manually secured by the control board operator. .

Indication of RCP A motor current dropped from normal full load amperage to 30%  !

cf that value at the time of the initial event, and remained there until the i 2 motor was secured. The RCP A amperage indications, along with the rapid RCS flow degradation, indicated a separation between the RCP A motor and the pump.

Following the expected main turbine automatic trip, the turbine stop valve l closure caused a steam pressure spike resulting in a spurious low steam gener-

ator level indication. The low level indication caused an actuation of the i emergency feedwater (EFW) system.

! At 11:35 p.m. , both main condensate pumps tripped on high deaerator tank level.

The main condensate pumps were restarted and feedwater continued to be supplied via the main feedwater (MFW) system. Also at 11:35 p.m., one high pressure

. injection valvc was manually opened for 4.5 minutes, to aid in maintaining pres-surizer level. Three main steam safety valves (MSSVs) failed to reseat properly.

One of these valves shut after being manually lifted several times. The other two valves reseated when main steam pressure was lowered. The failure of these valves to properly reseat had no significant effect on RCS temperature.

i At 11:38 p.m., the control board operator attempted to secure the tFW system.

This action was taken because the McW system was providing satisfactory steam generator level control and EFW was not needed. When the control board operator 4

• Crystal River Unit 3 is an 821 MWe (net) M0C Babcock & Wilcox PWR located

! 7 miles northeast of Crystal River, Florida, and is operated by Florida Power Corporation.

1 1

---

,-.n---,---------. - , - - - . - - , - - - - - - - - ~ - - - - - - - - - - - - ,

J placed the control stations for the EFW control valves in " hand," in preparation for resetting the EFW actuation, one of the control valves immediately went from the fully shut to the fully open position. This valve opening caused EFW

! flow to be initiated to the B once-through steam generator (OTSG). Flow con-tinued for approximately 23 seconds while the EFW control valve was being shut j from the control station. The i9 proper operation of the EFW control valve had j no significant effect on RCS temperature.

The failure of RCP A was due to a complete failure (break) of the pump shaft )

i approximately 49 inches from the top of the shaft, in the hydrostatic bearing ,

journal area. Prompted by concerns over cause of the RCP A failure, an exten- '

l sive ultrasonic examination of the three other reactor coolant pump shafts was

performed. The ultrasonic testing (UT) inspection showed indications of suffi-i cient magnitude to warrant replacement of all RCP shafts. (See Figure 1.) All RCP shafts have been replaced and the u' nit has resumed operation.

The cause of the spurious EFW actuation was rapid spiking of the level trans-( mitters in response to an oscillatory pressure wave phenomenon following turbine i i

stop valve closure.

l The condensate pumps tripped on high deaerator tank level. When the main tur-l bine tripped, extraction steam to the feedwater and condensate heaters (includ-ing the deaerator) was terminated. This loss of steam caused the pressure in l

the deaerator to drop below the saturation pressure for water already stored there, resulting in spontaneous boiling of the water, which momentarily raised l

the level in the tank above the condensate pump trip setpoint. ,

i The cause of the failure of the MSSVs to fully reseat until th9 valve was l manually lifted or until steam pressure was manually lowered could not be i determined.

l The cause of the improper operation of the EFW control valve has not been determined. All attempts to reproduce the improper operation were unsuccessful.

f l The nuclear steam supply system vendor (Babcock & Wilcox) in conjunction with

! the pump manufacturer (Byron Jackson) and the motor supplier (General Electric)

conducted an investigation and failure analysis of the RCPs. The root cause of I the shaft failure on RCP A is still under investigation. It is known that a l

circumferential crack developed in the shaft and then laid dormant for a long

period of time. This crack became active and propagated through the shaft to l failure. It is believed that the propagation mechanism was the mechanical bend-ing load associated with pump operation.

l Investigations also revealed that all of the bolts which hold the impeller to j the pump shaft and the drive pins which transmit the turning force from the l

shaft to the impeller were either broken or cracked on RCP A, as well as some of the bolts and pins on the other pumps. In addition, cracks were detected in the pump thermal cover which surrounds the area in which cool seal injection

water mixes with the hot RCS water.

l Stress and fracture mechanics analyses were conducted on the RCP shaft, pump I cover, impeller-to-shaft bolts, and drive pins. Laboratory examinations in-l cluded fracture surface examination, determination of deposit chemical composi-tion, bulk chemical composition, mechanical properties, and hardness for the l RCP shaft. The bolts and pins were metallographically examined.

2

RCP-1B 360' CRACK

! [

[ ACME _ ACME. l 7 l THREADS 7 l THREADS f l f A l FlLLET ,

WELD  ;

k \\SLEEVE L

SLEEVE l PLIT RING SPLIT RING ROOVE GROOVE RCP-1 A FRACTURE RCP-1C Et 1D UT INDICATIONS R i: ijf ts t\ -:

J: m\ g (

, kM[

{ .-

7

3N!

g-N s s s N s s s N (

hhh l hM l'

k

/, o. p,m, : ,

i.

s A

}

(

Figure 1 Crack and Fracture Indications on Crystal River Unit 3 Reactor Coolant Pumps (Ref. 31 3

These analyses showed that the RCP A shaft experienced cracking in both axial and circumferential directions. The axial cracks were located in the lower 3/4-inch of the thermal barrier region where reactor coolant water mixes with relatively cool seal injection water. Cyclic thermal stresses are produced in this area and most likely contributed to the shallow axial cracking. The axial shaft cracking has been determined to be benign.

The A shaft circumferential crack was located in a groove directly below the ACME threaded region about 49 inches from the top of the shaft. Fatigue has been ascribed as the mechanism for initiating and propagating this crack. The source of the stresses for fatigue crack initiatiqn has not been clearly established.

The B shaft circumferential cracks were located close to an out-of-specification weld joining the journal bearing sleeve to the shaft. Alloy A-286 is considered as "non-weldable," and it is believed that this weld was a significant factor in crack initiation. Since this is an out-of-specification weld, and no other shafts were found in this condition, the RCP B shaft cracking is considered a unique problem with no generic implications.

The D shaft was metallographically examined and no circumferential cracking was found in the groove, which is about 49 inches from the end of the shaft. There is currently no explanation for the UT indications which were observed at this location.

The C shaft has only been examined with UT; no metallographic or surface exams have been performed.

The B, C, and D pump covers experienced fine, axial c. racking in the thermal barrier region. Fracture mechanics analysis indicates that these shallow cracks have arrested and will not propagate beyond their current depth. Although it was not inspected, the A pump cover is assumed to have experienced similar cracking.

The shaft-to-impeller bolts experienced cracking in RCP A and B. The drive pins experienced cracking in RCP A. The cap screws (bolts) failed in areas of high stress concentration, and the mechanism of crack initiation, while in doubt, may involve material properties, design inadequacies, manufacturing cracks, residual stresses, bending moments, or thermal cycling.

All RCP shafts have been replaced. One replacement shaft is of the design which failed and is constructed of the same material (Alloy A-286). The second re-placement shaft is of a design which does not have the groove located below the ACME threaded region, and it is also made of Alloy A-286. The other two shafts are designed without the groove and are made of Alloy A-479 XM-19 (Nitronic 50). Analytical efforts will continue until the root cause for the circumferen-tial crack initiation is determined.

The impeller-to-shaft bolt material was changed from Alloy A-286 to Inconel X-750 HTH. This alloy is widely used for reactor internals bolts applications, and possesses excellent resistance to intergranular stress cor-rosion cracking. In addition to the change in material, the bolts were re-designed with an elliptical radius under the head and a controlled thread root radius. These changes reduce the peak stress in the bolt, thus reducing the 4

possibility of stress corrosion and fatigue. Additionally, the locking device was changed from lockwire to locking pins to facilitate the UT method for veri-fying preload.

The drive pin material was changed from Alloy A-286 to A-479 XM-19 (Nitronic 50).

This material provides enhanced stress corrosion cracking resistance while pro-viding adequate strength.

The licensee is considering a design change to the condensate pump trip circuit to avoid the trip on the short duration deaerator tank level increase following a main turbine trip.

The MSSV that required manual lifting to reseat was disassembled and lapped.

That valve and the two MSSVs that required steam pressure reduction to fully reseat have been checked for proper setpoints.

The licensee has installed a temporary modification to the EFW actuation circuit which should prevent the spurious start of EFW following a main turbine trip in the future. Work is in progress on a permanent modification to correct this problem. Extensive trou'oleshooting could neither reproduce nor determine the cause of improper operation of the EFW control valve.

The licensee has taken appropriate action to upgrade their equipment capabilities and utilization with regard to monitoring shaft, performance inservice via a vibration monitoring system.

During this event, the reactor protection system functioned as designed to auto-matica11y shut down the reactor following the reduction in RCS flow. The EFW system automatically actuated on a low steam generator level indication, although EFW was not required. All RCS temperatures and pressures remained within the normal operating and post-trip windows through use of the MFW system. Therefore, the reactor core was adequately cooled throughout the transient. With the exception of the EFW control valve, no safety-related equipment failed to per-form as required during this event.

The Toledo Edison Company, which uses RCPs similar to those at Crystal River Unit 3, examined the RCP shafts at the Davis-Besse Unit 1 plant,* using the same team from Babcock & Wilcox that examined the Crystal River RCP shafts. On March 16, 1986, possible cracks were identified in the shafts of the Davis-Besse i RCPs. There are four pumps, two associated with each of the two steam gen-erators. One shaft was replaced with a spare shaft and the original shaft was sent to the Bab:ock & Wilcox Research Center for examination. Preliminary test results were unable to duplicate the crack indications previously observed through UT. Other non-destructive tests also failed to identify any evidence of cracking, and destructive examination of the shaft confirmed that no cracking l was present. Toledo Edison will continue a replacement program for the shafts.

Four bolts which connect the shafts to the pump impe11ers will also be replaced, t

since examination of the bolts in one pump showed one bolt to be sheared, two with cracks, and one with a possible crack. (Refs. 1-4.)

" Davis-Besse Unit 1 is an 860 MWe (net) MDC Babcock & Wilcox PWR located 21 miles east of Toledo, Ohio, and is operated by Toledo Edison Company.

1 5

4

[

l 1. 2 Unlabeled Switch Results in Inadvertent Actuation of Deluge Spray System and Subsequent Scram at River Bend i On January 7, 1986, with River Bend

• in startup operation, a fire protection >

l water deluge spray was inadvertently actuated by a construction employee. Water i from this actuation ran into two motor control centers (MCCs), through an un-i sealed penetration in the floor, and eventually into a load center on the next

lower elevation. The resulting short in the load center caused a transformer

[ to burn up, which caused the breaker feeding that lead center to trip. This j breaker also fed two additional load centers, the loss of which eventually caused

! a reactor trip on high intersiediate range monitors (IRMs). Investigation into I the event determined that the solenoid activation switch was unmarked and mis-l takenly thought to be a door latch. The event is detailed below.

At 8:47 a.m. on January 7, 1986, a fire protection water curtain (deluge spray) on elevation 141 of the auxiliary building was inadvertently actuated by a con-struction employee. The actuation occurred when the employee (an insulator)

. attempted to open a remote data acquisition cabinet (RDAC) panel to seal a con-duit, and mistook a solenoid actuation switch for a door latch. The water cur-tain ran for about 20 minutes and overloaded the floor drain system. Water i backed up on the floor and ran into the bottom of two MCCs that are mounted.

! directly on the floor. The water then ran down unsealed penetrations inside the 1

MCCs onto the top of heating, ventilation, and air conditioning (HVAC) ductwork underneath the floor of elevation 141. The penetrations are not required to have fire seals because in this area the penetrations do not go through a fire barrier.

i l The water ran along the top of the HVAC ductwork and cascaded onto the top of '

1 and into load center 1A. This caused a short which the load center transformer

! saw as a high current demand. This caused the transformer to burn up and the associated supply breaker to trip. The supply breaker also fed nonsafety-related i

load centers 1C and IS. The hydraulic pump which supplied the turbine bypass t valves tripped and caused the bypass valves to fail closed.

l As the main steam line drains were opened to reduce the increasing reactor pres-i sure (which peaked at 1015 psig), and rods were being inserted, the IRMs were

! down ranged to maintain onscale readings. Subsequent level changes and a sudden i cold feedwater injection caused a rapid increase in IRM readings to the scram i setpoint.

Investigation into the event revealed that the solenoid actuation switch name-tag was missing and that this was the first RDAC panel that the insulator had accessed. In an effort to prevent recurrence, all insulators have received training on doing work under the licensee's maintenance work requests. They

have also been instructed as to the purpose of the switches on the front of the

! RDAC panels. ,

! In addition, RDAC panels and any solenoid valve operating switch name plates that were missing were surveyed and replaced. The bottom edge of all MCCs and I -

• River Bend is a 936 MWe (net) MOC General Electric BWR located 24 miles north-northwest of Baton Rouge, Louisiana, and is operated by Gulf States Utilities.

6 l

i 1

! l

, load centers that are mounted directly on the floor on elevation 141 of the j cuxiliary building were sealed. All local fire detection supervisory pan'els with deluge system switches will be modified. A hinged plexiglass cover will be fabricated for these switches and installed at these local panels.

, Actuations of fire protection systems have the potential to subject equipment t to environmental conditions which may induce single or multiple failures. The consequences of actuations of these systems should be understood, and inadver-tent actuations should be minimized. Unanticipated consequences of the actuation of these systems may have direct adverse safety implications if safety-related ,

systems are affected, or may have indirect effects if nonsafety-related systems j are adversely affected and initiate plant transients. (Refs. 5 and 6.)

1.3 Hand-Held Radio Causes Loss of Offsite Power at River Bend l

i On January 1, 1986 at River Bend,* preferred station transformers A and C j tripped off the line. One hour later, preferred station transformers B and D

also tripped prior to A and C being restored. This resulted in a total loss of j offsite power (LOSP) to the station. The plant was shut down at the time, due

} to a reactor scram that had occurred approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> earlier. Investiga-tion of the event determined that hand-held radios most likely caused spurious

'. signals in the tone relaying transfer trip receivers of the preferred station

] transformers. The event is detailed nelow.

I On January 1,1986 at 9:41 a.m., with the unit in hot shutdown and cooling down i from a reactor trip which occurred about 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> earlier, preferred station a transformers A and C tripped. Recirculation pump A tripped, the operating con-i densate pump tripped, and the reactor water cleanup (RWCU) system isolated.

l Reactor protection system (RPS) bus A deenergized, initiating a half scram and

partial nuclear steam supply shutoff system (NSSSS) isolation. The partial

MSSSS isolation caused an instrument air isolation to the reactor building which

! caused the scram valves to leak, filling the discharge volume (SDV). This sub-i sequently resulted in an RPS actuation on high SDV level at 9:57 a.m.

i The preferred station transformer trips caused the Division I and III diesel l generators to start, the Division I emergency ventilation systems to autostart, cnd standby service water pumps 1SWP*P2A, B, C, and D to load sequence. Normal service water pump SWP-PIB and circulating water pump CW5-P1B were still running j but without bearing cooling water since bearing cooling water pump BCS-P1A had

lost power. At 10:01 a.m., the main steam isolation valves (MSIVs) automatically 1 isolated due to decreasing condenser vacuum.

l At 10:03 a.m., operators were dispatched and attempted to recover deenergized

! load centers. At 10:31 a.m. RPS bus A was reset. Later, panel ISCM*PNL01A was discovered deenergized due to a blown fuse in transformer 1SCM*XRC14A1.

This caused several control building and heating, ventilating, and air condi-tioning dampers to close, which caused the Division I control building chiller i to trip. The partial NSSSS isolation remained sealed in because of deenergized '

panel ISCM*PNL01A.  ;

l l l CRiver Bend is a 936 MWe (net) MDC Go.dral Electric BWR located 24 alles north-northwest of Baton Rouge, Louiiiana, and is operated by Gulf States 4

Utilities.

I l

b u _ _ _ . _ .... _ . _ . _ . _ . _ . _ _ _

l l

The RPS actuation was reset at 10:42 a.m. Two minutes later (about I hour after the initiating event), preferred station transformers B and D tripped. The station was now in a complete LOSP. The Division II diesel generator started and sequenced properly. An unusual event was immediately declared, and abnormal operating procedures (A0Ps) 004, 005, 0010, and 0042 were entered. Reactor water level was +80 inches on the shutdown range (normal operating level is

+36 inches), and pressure was at 240 psig.

At 11:14.a.m., the half RPS actuation was reset, and power to RPS bus B was restored. Ten minutes later, the preferred station transformers were energized, but the supply breakers to the plant could not be, closed. It was determined that breaker closure was locked out by the tone relaying transfer trip (fiber optic) system, which could not be reset. At 11:30 a.m., this backup system was disabled and the breakers were closed. All in-house loads were restored, the plant was stabilized, and the unusual event ended 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 10 minutes after initiation.

In an effort to determine the cause of the transformer trips, an investigation of the protective relaying was conducted and revealed that no protective relay-ing targets were initiated. It was further determined that the trip signals sent to the lockout relays could only have been initiated by a spurious signal in the backup pilot wire or tone relaying transfer trip circuits. Functional and diagnostic testing of both the pilot wire and tone relaying circuits showed that both systems were operating as designed at the time of testing.

As a result of this testing, two items were noted. First, spurious trips could be generated on the tone relaying system with hand-held radios in close proxim-ity (within approximately a 10- to 12-foot radius) of the transmitters / receivers.

Second, some of the tone relaying keying and rack power were supplied from two separate battery sources. Although no spurious trips could be simulated by testing, this type of connection could result in transients within the tone rela ~ying equipment. It was decided to correct the wiring in the field such that keying and rack power were supplied by the same battery source.

The two types of hand-held radios tested were the 4-W, 150-MHz Motorola and 5-W, 450-MHz Motorola. Both are commonly used on site by security and operations personnel. Both of these radios were keyed to transmit inside the control building of the switchyard, and both caused spurious trips on the tone relaying system. Also tested were 100-W, 50-MHz and 150-MHz Motorola mobile radios from just outside the switchyard control building with the doors open. The mobile radios did not initiate either a trip or loss of guard signal in the tone relay-ing system. After careful considcration, it was concluded with high probability that the LOSP was caused by radio frequency interference.

Also investigated was the difficulty in resetting the lockout relays. Because of the complexity of the tone relaying and pilot wire tripping circuitry, the resetting of the lockout relays must be performed in the proper sequence. It was determin'ed that operations procedures did not address the required sequence.

As a result of this event, several corrective actions have been completed.

These include:

(1) Installing shielding on the tone relaying equipment in tte switchyard control building. Shielding of the equipment in the plar.t is not required 8

because the equipment is enclosed in a reinforced concrete room having locked doors with a sign restricting the use of radios on each door.

(2) Rewiring the tone equipment so that the loss of guard with trip signals is required for tripping. At the time of the event, if one channel had a loss of guard and the other channel had a trip signal, the transfer trip would have been initiated. This wiring change provides increased security from spurious tripping.

(3) Changing de power supplies to tone relaying equipment so that the keying and rack power are both supplied from the same dc source.

(4) Installing sequence of event recorders in the switchyard and at the generator / transformers protective relaying panel.

(5) Installing additional drainage reactors at the plant end of the pilot wire shielding.

(6) Installing supervisory control and data acquisition (SCADA) system alarms to provide annunciation in the main control room for loss of channel signals on tone relaying equipment. Additional capabilities for monitoring trip squelch and loss of guard signals will be added upon receipt of alarm cards.

(7) Training personnel on the restricted use of radios. Signs have been posted in the switchyard prohibiting the use of radios in the control building.

Signs have also been posted on the doors of the room in the turbine building which houses the tone relaying equipment.

(8) Training operations personnel on resetting lockouts, including necessary procedural changes and the posting of operator aids.

(9) A procedure was developed for the periodic testing of the tone relaying equipment and the proper operation of the sequence of event recorders.

Reliability of offsite power sources is an important factor in determining the risk of an accident resulting from station blackout. Increases in frequency and duration of these losses will increase the probability of such an accident.

For this event, the spurious transformer trips increased the probability of a LOSP event. If the complex series of actions required to reset the system and restore offsite power are not adequately addressed in the procedures, the duration of such an event increases. (Ref. 7.)

1.4 Insulation Fire in Containment Drywell Expansion Gap at Dresden Unit 3 On January 20, 1986, while Dresden Unit 3* was shut down and defueled, welders cutting pipe for a pipe replacement program inadvertently ignited polyurethane on the outside of the containment drywell wall. When smoke appeared, workers in the building were evacuated. The fire was extinguished after several hours by flooding water through five penetrations in the surrounding concrete bio-logical shield. The presence of the polyurethane layer in the containment walls (Dresden Unit 3 is a 773 MWe (net) MDC General Electric BWR located 9 miles east of Morris, Illinois, and is operated by Commonwealth Edison.

9

was not considered in the licensee's fire protection reviews conducted for Dresden and similar units having Mark I containments. The event is detailed below.

At about 8:30 a.m. on January 20, 1986, with Unit 3 shut down and defueled, an air arc cutting activity began on containment pipe penetration No. 113 inside the reactor water cleanup system (RWCU) B heat exchanger room. At 9:05 a.m. ,

workers in the area observed smoke in the vicinity of the pipe penetration.

The Shift Engineer's office and the control room were notified about ten minutes later.

The Fire Watch for the air are cutting activity apparently discharged a dry chemical extinguisher on or in the vicinity of pipe penetration No. 113. Sub-l sequently, a Fire Brigade Leader arrived to investigate the fire, and determined l that the fire had been extinguished.

j At about 10:00 a.m., the station Fire Marshal was notified by the Shift Engineer of smoke in the Unit 3 reactor butiding. Minutes later, the reactor building

! ventilation system, which had been turned off to support standby gas treatment

! system testing, was turned on to remove smoke from the Unit 3 reactor building I and drywell. All personnel were evacuated from the. Unit 3 torus and drywell l areas, and air samples were taken to verify the quality of air for personnel j safety.

I l At 10:30 a.m., the Shift Engineer contacted the Fire Marshal and informed him

that the smoke was clear from the Unit 3 reactor building. Apparently, the Fire i Brigade Leader and Station Construction concluded that the problem was under i control because the Fire Watch had earlier discharged a dry chemical extinguisher 5

on or in the vicinity of the pipe penetration in the RWCU heat exchanger room, and smoke was being cleared from the reactor building and the drywell by the j reactor building ventilation system.

! At about 11:20 a.m. , personnel were allowed to reenter the drywell. Ten minutes i later, Technical Staff personnel discovered a hot spot in the drywell in the i vicinity of penetration No. 113. Workers complained of intense heat 4 to 5 feet l away from the drywell steel liner. At 11:55 a.m. , all personnel were again evacuated from the drywell because of the overheated drywell liner. A Construc-4 tion Staff person took pyrometer readings in the vicinity of pipe penetration

( No. 113 on the inside of the drywell liner (unexposed side) between 12:30 and j 1:15 p.m. The highest reading recorded was 440 to 450 degrees.

The heated drywell liner condition alerted the Fire Marshal to investigate what could be burning on the other side of the drywell liner. By referring to the Dresden Final Safety Analysis Report, he identified the presence of polyurethane j foam installed inside the drywell expansion gap between the steel liner and the concrete shell.

l I The outer surface of the steel drywell liner is enclosed in 8 feet of concrete.

. To accommodate expansion of the liner, a gap was provided between the concrete j and the liner. The sizing of the expansion gap was based on the maximum drywell

steel liner temperature following a postulated loss-of-coolant accident, r

The expansion gap was created by cenenting prefabricated polyurethane foam sheets which were installed over the entire liner exterior surface. Epoxy impregnated 10

l i

i

! fiberglass tape was applied over all joints in the foan and fiberglass panels <

! were installed over the foam panels.

! As a result of the Fire Marshal's review of the FSAR, he determined that hot slag (molten metal) from the air arc cutting activity on pipe penetration i No. 113 in the RWCU heat exchanger room had come in contact with and ignited l the polyurethane foam material in the drywell expansion gap. The typical j drywell pipe penetration detail (see Figure 2) shows a 2-inch gap between the j sleeve and the penetration pipe which provides a direct path to the polyurethane

foam material. Furthermore, the drywell expansion gap is not intended to be t l airtight. The fiberglass panels installed over the polyurethane foam material do not form a barrier that will exclude air from coming in contact with the

~

j polyurethane foam material.

Since the fire was determined to be in a concealed space that was impossible i for the fire brigade to reach, the Fire Marshal directed the Fire Brigade Leader

! to start applying water from a 1-inch rubber hose (supplied by the domineralized water system at 100 psi) to the 2-inch gap between the sleeve and the penetra-tion pipe on penetration No. 113. This action was initiated between 12:30 and 1:00 p.m. Since the Fire Marshal was not certain that water applied at this l penetration would extinguish the fire, additional water was supplied by the fire water system at penetrations above and adjacent to penetration No. 113.

1 At 1:30 p.m. the licensee decided to monitor the drywell liner temperature on the inside of the drywell. At 5:00 p.m., inside drywell liner temperatures were recorded at 140, 110 and 90 degrees F. At 5:30 p.m., the licensee's cor-

pcrate Fire Protection Engineers and the Fire Marshal considered the fire to be extinguished due to declining inside drywell liner temperatures. At 9

00 p.m., inside drywell liner temperatures were determined to be normal and the application of water to the drywell expansion gap was discontinued. No offsite fire department assistance was requested and no emergency event was declared by the licensee at any point during this event.

] Investigation into the extent of damage resulting from the fire revealed that I in several areas inside the drywell (a few square feet in area and several feet '

I apart), discolored paint was visible on the drywell liner. The drywell steel l liner is approximately 1-1/8-inch thick carbon steel.

I i It appears that this fire began some time after the air arc cutting activity began at pipe penetration No. 113. It burned with some intensity, and it is suspected that higher temperatures were reached inside the drywell expansion

, gap than might be expected from the paint discoloration. It is not known how I such polyurethane foam material was consumed by the fire or how far the fire j spread vertically or horizontally around the drywell. The 4.5-hour burn time  !

(from 8:30 a.m. to 1:00 p.m., when water was first applied through penetration i No. 113) indicates that substantial burning may have occurred.

Apparently, a substantial amount of water was applied to the drywell expansion gap to extinguish the fire. An initial upper-bound calculation by an NRC in-spection was about 500 gpa for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, or 240,000 gallons. However, according i to the licensee, only 30,000 to 35,000 gallons of excess water were removed from the torus basement and processed in the radwaste system after the fire. l Later, more refined calculations by the licensee indicated that about 34,000 gallons were used.

11

%.: =,.p.. ., e.: ex-s ..

...t...e.,....c.....

s p: . ,...r.,

s t.ji.:  ;. .N. : .;*:. .. .

, .n.... .o. ;. ..*: .. ... .

s ..

N

: Sleeve Drywell Liner l !.! *.* .' Penetration s , . ./.. ..*.*.. . t. .'.e'.

s..

s

. . . . , . ....v. ..-

Polyurethane l 3:!i

'&'.' * ;* 0 7.' .l s ., .

s >. c .e . ... . . ; ?. . . -

Concrete l ,l .!.. *. .. .'.'....* .Tl.

s ,...k..

s

..e. .

s

..s...e. . .

r.........3 ...

s s , . ..

s :

. , s s : .* .. .t : ' . t . .

s . ..e.. ... . . -

4 s ,i:. .'

s .

L*. .:.,' e. '

. . .g4;.%

x

. .: t..?::.

. . s.e .*.. '

.....g

' ' .s:. , . * ..

.;;r .:.

..z.....-

. . .s..

Figure 2 Typical Dresden 3 Pipe Penetration 12

~ _ .- --- . . _. -__ _. _ . _ _ _ _ _ . . , _ _ _ _ _ _ _ . . _ _ _ _ _ _ _ . _ . . _ _ _ _ _ _ _ . _ .__

Urethane foam material can ignite easily and burn vigorously, producing dense black smoke and a very black, viscous melt product which can burn with the in-tensity of a flammable liquid. Burning polyurethane materials also produce corrosive and toxic oxides of nitrogen, together with other toxic gases and corrosives that are harmful to metals. Because of the extent of actual damage at Dresden, corrective actions and plant locations where polyurethane or other combustible foam materials are installed in concealed spaces remain under inves-tigation by the licensee and the NRC. This event will be updated in a future issue of Power Reactor Events. (Refs. 8 and 9.)

1. 5 Setpoint Drift on Target Rock Safety Relief Valves at Brunswick Unit 2 During the 1985-1986 refueling / maintenance outage at Brunswick Unit 2,* testing of safety relief valves (SRVs) in accordance with technical specifications re-vealed that ten of the 11 valves tested exhibited symptoms of higher than allowed setpoint drift. The test results are attributed to pilot disc-to-seat sticking and high friction due to inadequate clearances in the labyrinth seal area. The depressurization function of the valves (part of the automatic depressurization system) was not affected. The event is detailed below.

During the unit's 1985-1986 refueling / maintenance outage, testing of the Target Rock two-stage SRV pilot valves (Model No. 7567F) showed that ten of 11 had incurred disc-to-seat bonding.

The licensee conducted diagnostic testing at Wyle Labs as part of the BWR Owners Group generic solution to Target Rock SRV setpoint drift problems. The drift was attributed to two unrelated phenomena. A major contributor was high friction due to inadequate clearance in the labyrinth seal area. This problem resulted in setpoint drift of greater than 3% in six Unit 1 SRVs and four Unit 2 SRVs during as-received testing at Wyle in 1985 and 1984, respectively.

The greatest drift caused by this phenomenon was 6.5% on Unit 1 and greater than 11% on Unit 2. Data from utilities using these type valves shows the fre-quency of high setpoint drift due to labyrinth seal friction is 0.144, while experience at Brunswick has been at a 0.455 rate. The amount of drift caused by labyrinth seal friction is such that the plant is below any safety limits.

A preventive maintenance program was implemented by the BWR Owners Group, General Electric, and Target Rock during the 1984 and 1985 test cycles at Wyle, which significantly reduced the labyrinth seal friction problem. Only one Unit 2 SRV exhibited setpoint drift of greater than 3% due to this problem during the cur-rent test cycle. It was measured at 4.5%.

The second contributor to this phenomenon is corrosion-induced disc-to-seat bonding, which affected one valve on Unit 1 and two on Unit 2 during the 1985 and 1984 testing at Wyle. The setpoint drift ranged from 6.2% to near 18%,

depending upon the degree of bonding. Industry data from two-stage Target Rock SRVs show a frequency of high setpoint drift due to bonding of 0.083, and past experience at Brunswick has been at a 0.136 rate. New pilot valve discs made of PH 13-8Mo are being installed, as per BWR Owners Group recommendations, to correct this problem. Six of the Unit 2 valves had these new discs installed while at Wyle during the present outage.

• Brunswick Units 1 and 2 are each 790 MWe (net) MDC General Electric BWRs located 3 miles north of Southport, North Carolina, and are operated by Carolina Power and Light.

13

l e

l

, To differentiate between these two phenomena, Wyle now performs a diagnostic i test in which the spring force is removed from the pilot disc and nitrogen is 1 introduced below the disc to lift it. If no bonding is present, 5 psig or less

nitrogen will lift the disc off the seat. If this does not occur, the nitrogen i' pressure is slowly increased to determine the force required to break the bond. ,

The test is terminated when the nitrogen pressure reaches about 200 psig or

when the disc lifts, whichever occurs first.

l During the 1985-1986 Unit 2 refueling / maintenance outage, testing of the SRV pilot valves at Wyle Labs showed that ten of 11 valves exhibited some degree of bonding of tSe pilot valve disc to the seat. This 0.909 rate is well above previous Brunsvick and industry experience. Setpoint drift varied from 1% to nearly 18T, per valve, with a calculated average of just under 13%. Four valves opened between 5 psig and 200 psig, while six others had not lifted when the test was terminated at 200 psig nitrogen. One valve opened at 5 psig and went through all testing with no indications of sticking or labyrinth seal friction.

The high rate of occurrence of stuck discs during this recent testing at Wyle may indicate some unusual conditions or events during the last Unit 2 operating cycle. Consequently, the operation of Unit 2 during the last refueling cycle is being studied. As a result of retubing of the main condenser, improvements in reactor water cleanup, etc., Unit 2 exhibited excellent reactor water chemistry during the operating cycle (chlorine levels below 5 ppb were normal, with infre-quent excursions to slightly higher levels) and appears to be an unlikely con-tributor to the problem.

SRV setpoint drift resulting from friction in the labyrinth seal area has been significantly reduced at Brunswick through implementation of the BWR Owners Group improved maintenance program. The affected SRVs at Brunswick Unit 2 were refurbished, recertified, and reinstalled. Pilot valve discs in six of the SRVs were replaced with discs manufactured of PH 13-8 Mo, as recommended by the BWR Owners Group materials selection panel. Six of the problem discs are under-going testing to investigate the cause and magnitude of the bonding.

Unit 1 operation was reviewed to identify any factors common to both units that might correlate Unit 2 experience with a Unit 1 increase, and none were identi-fled. Potential contributing factors will be monitored further for Unit 1, and SRVs will be removed for testing at the next Unit 1 refueling outage.

Increases in the pressures at which SRVs will actuate due to unanticipated bind-ing will lead to increases in pressures in the primary system in response to transients which are outside the design basis. This in turn may lead to over-pressurization of primary system components if the unanticipated binding is significant. (Refs. 10 and 11.)

1.6 Oropped Fuel Assembly Due to Bent Guide Pin at Haddam Neck On February 26, 1986, the upper internals package at Haddam Neck

• was removed from the reactor vessel in preparation for fuel movement. After the upper

• Haddam Neck is a 569 MWe (net) MOC Westinghouse PWR located 13 miles east of Meriden, Connecticut, and is operated by Connecticut Yankee Atomic Power Company.

14

internals was stored on its stand, it was discovered that a fuel assembly (R-01) had been raised above the core and dropped. The fuel assembly was resting on the top of the core, with its bottom sitting near core location M-13 and its top resting on the core support barrel above core location A-9 at approximately a 45- to 60-degree angle. The immediate action taken was to evacuate contain-ment, and begin water and air sampling to assess if there was any fuel damage.

Visual inspection concluded that the assembly was stable in its position. No radiation release occurred. A sling was installed around the R-01 fuel assembly later that day to ensure its stability. Fuel assembly R-01 and the impacted fuel assemblies (R-26 and R-45) were successfully moved to the spent fuel build-ing using a special procedure and lifting equipment. The event is detailed below.

About 11:45 a.m. on February 26, 1986, the plant was in a refueling mode. Dur-ing the process of lifting the upper internals in preparation for fuel move-ment, a fuel assembly was inadvertently raised above the core and dropped. The height of the drop was estimated as 2 to 4 feet.

The immediate corrective action was to evacuate the containment and begin water and air sampling to assess possible fuel damage. The Health Physics Technician on the charging floor immediately verified that there was no change in area radiation levels or airborne activity levels. No radioactivity change was noted in the water or the air, which indicated that there was no fuel pin failure.

There were no radiation releases during this event. The fuel assembly was eval-uated for stability. A sling was installed around the assembly to ensure that it would not move from its present location. A recovery team of Engineering and Maintenance personnel, with assistance from Westinghouse, was mobilized for fuel assembly recovery, damage analysis, and cause assessment.

The recovery team developed a program which included an R-01 fuel assembly recovery procedure, engineering examination and evaluation, failure and reload analyses, a repair program, loose parts examination, examinations of rod cluster and debris cleanup. (Parts of the assembly structure controlassemblies(RCCAs)Intothecore.)

had come loose and fallen From February 26 to March 2, 1986, the recovery team performed the above acti- '

vities and reviews associated with the recovery of the dropped fuel assembly.

Special maintenance / engineering procedures were developed and special lifting equipment was fabricated, tested and used to move assembly R-01 to the RCCA change fixture. After further examination, normal fuel handling equipment was i used to move assembly R-01 into the spent fuel pool.

When the normal fuel handling equipment failed to engage impacted assemblies R-45 and R-26, examination of these assemblies revealed that the upper nozzle or RCCA was bent. Special lifting devices and maintenance / engineering proce-dures were developed and both fuel assemblies were successfully moved into the transfer basket. UsIngnormalfuelequipment,theyweremovedintothespent fuel building. R-45 was placed in the storage rack with the use of a special device and special procedure; R-26 was placed in the storage rack using normal handling methods. These assemblies were further examined to determine whether they were reusable. The recovery of R-01, R-26, and R-45 did not result in further damage.

15

Other impacted areas were the core support barrel, which has a superficial mark about 100 inches long, and the core baffle former plate, which was impacted near core location M-13, which was partially torn.

The upper internals were inspected on February 27, 1986, and showed signs that one of the fuel guide pins was bent. It was concluded that the bent pin caused the fuel assembly to be lifted from the core with the upper internals package.

The pin is one of two which are attached to the upper core plate above each fuel assembly. The two pins guide the fuel assembly by sliding into mating holes in the fuel assembly top nozzle.

The bent pin was located in the northeast corner of core location R-7. Galling marks on the top nozzle guide holes on assembly R-01-indicated that the assembly had been pinched between the two fuel alignment pins. Similar marks on assear- I blies previously located in the R-7 location showed that the condition had existed since at least 1981, but had gone unnoticed due to the very small size of the distressed region of the fuel alignment pin hole lead-in chaefer.

In summary, the bent pin caused an interference fit between fuel assembly guide pin holes in assembly R-01 and the upper core plate alignment pins. This pinch-ing action by the alignment pins caused the assembly to be lifted along with the upper internals package.

An inspection of the alignment guide holes and an examination of every fuel assembly from the fuel cycle just completed was performed. Since no other assemblies exhibited galling or other signs of damage, it was concluded that no other assemblies were affected, and no other alignment pins on the upper inter-nalc were bent.

Additional examinations of the core baffle assembly (including baffle plates, former plates, and baffle plate bolts) characterized the impact damage. The lower core plate was examined and no abnormal conditions were noted. Analysis of the core baffle assembly was performed and confirmed its acceptability for continued operation.

Assembly R-01 was fully inspected in the spent fuel poc1 to determine the number and size of any loose parts. One hemispherical piece with a radius of approxi-mately 1/8 inch was identified as missing. This piece was located on the second former plate of the core baffle in an inaccessible area and in a stagnant loca-tion. Vacuuming performed prior to the removal of assembly R-01 picked up me-tallic fines but did not move this piece. It was concluded that this piece was in :tn acceptable location for continued operation.

The bent portion of the guide pin was cut off in accordance with plant require-ments and special repair procedures. Sufficient pin material was left to assure that it would remain attached to the plate and not become a loose part. Thermal hydraulics and structural analyses confirmed the acceptability of operating with just one alignment pin in location R-7. A design change was issued for the modification.

, The dropped fuel assembly and the impacted assemblies were damaged to the extent that they were not used during the present fuel cycle. The final disposition of these fuel assemblies will be determined at a later date. In addition, R-40

was discharged as a symmetrical partner to R-45. These assemblies were replaced j with four thrice burned assemblies. A new core reload analysis was prepared, i

16

i i The root cause for this event was a bent fuel alignment guide pin. The bend '

! occurred during or before 1981. A potential cause for such damage could have been a foreign object on the refueling cavity floor in the upper internals laydown

! area. Since 1981,; foreign materials cxclusion procedures have improved so that ,

! introduction of additional foreign objects in the refueling cavity is unlikely.

I Weight measuring during removal of the upper internals package will be evaluated l and improved if feasible. This could allow early detection of any fuel assembly 4

and upper internals interference. (The current measuring sensitivity is insuf-ficient to detect a problem such as this.)

The concern for a fuel assembly drop is that fuel assemblies might be suffi-ciently damaged to release the radioactive gases held within the fuel-clad gap.

! Under the reduced containment integrity requirements for the refueling mode, 1 l damage to a sufficient number of fuel pins could cause dose limits to be ex-  !

t coeded. This particular event was well within the bounding conditions of the  ;

l design basis fuel handling accident described in the Facility Description and  !

! Safety Analysis Report, since no release of gaseous fission products occurred.

j (Refs. 12 and 13.) '

{ 1.7 Lichtnine Events at Nuclear Power Plants 1

During the summer of 1985, several nuclear plante in the United States were j affected by lightning. In many cases the lightning caused the affected plant to trip; and in some cases, only an isolated system, such as the meteorological

system, was affected. As a result of these events, a search for and review of lightning events at nuclear plants was initiated by the NRC to determine the effects that lightning strikes have had on safety-related systems at operating

} nuclear plants. (Ref. 14.) Searches of the databases of operational events j from 1981 to the end of 1985 were performed. Sixty-two events involving light-j ning were identified. These 62 events occurred at 30 plant sites and involved

! 32 reactor units. The units affected and the number of events involved are

! summarized below:

i Plant Name Number of Events / Plant i

2 Big Rock Point, Brunswick 1, Byron 1,

! Catawba 1, Connecticut Yankee, Cooner, Davis-Besse, D.C. Cook 1, Duane Arnold,

! Fitzpatrick, Hatch 1, McGuire 2, Shoreham, j Summer 1, Turkey Point 3, Vermont Yankee, l Waterford 3 1 1

i Arkansas Nuclear one 2, Farley 2, Grand l

) Gulf 1, Maine Yankee, Peach Bottom 3, '

Pilgrim, Susquehanna 1, Susquehanna 2, l St. Lucie 2, Wolf Creek 2 i

l Yankee Rowe 3 j i i Browns Ferry 1, Crystal River 3 5 McGuire 1 TMI 2 6 ,

j The 62 events were reviewed to determine the systems that were primarily affected l l

by the lightning strike. The systems affected were: (1) offsite power system; i  !

i 17 ,

i

(2) safety-related instrumentation and control systems; (3) weather and meteo-rological systems; (4) radiation and effluent monitoring systems; and (5) the air intake tunnel halon system. A discussion of each of these systems and how they were affected by the lightning strike follows.

Offsite Power System. Of the 62 events, 29 were categorized as lightning-induced events affecting the offsite power system. In all 29 events, ex-cept for an occasional lightning arrester or insulator failure, very little equipment damage occurred. No safety-related systems or equipment were damaged.

Of these 29 events, seven led to a reactor trip due to lightning affecting the offsite power system. The effects on the offsite power system (e.g.,

partial loss, breakers tripping and reclosing, voltage surges) often caused problems in the onsite power systems, leading to the loss of some operating equipment (e.g., generator trip, reactor coolant pump trip, loss of trans-formers). The loss of operating equipment, in turn, would cause a reactor trip. The plant and equipment involved did not sustain serious damage and, except for the reactor trip system actuation, no safety-related system was affected. The plants that experienced reactor trips (due to the effects of lightning on the offsite power system) are all located in Pennsylvania or Massachusetts.

Six events resulted in inadvertent start of the emergency diesel generators.

This was caused by the lightning inducing voltage transients in the offsite power system which, in turn, actuated the instantaneous undervoltage relays of the safety-related buses associated with the diesel generators. The licensees of the affected plants have made design modifications to the undervoltage circuitry to correct the problem.

Voltage surges or spikes in the inplant electrical distribution systems, induced by lightning strikes on offsite transmission lines, were the cause of four events.

All but one of the 29 events involved a partial loss of offsite power (e.g.,

loss of a transmission line, trip of sections of the switchyard, transformer trip). In some cases the event occurred while the unit was at power, and the partial loss did not affect plant operation. In other cases the event occurred while the plant was shut down, and the partial loss had no sig-nificant effect on the unit.

At one unit that was shut down, a lightning strike caused the loss of all offsite power for half an hour. The lightning caused the complete loss of the grid. (Two fossil units connected to the ring grid also tripped.) The emergency diesel generators started and energized the vital buses as designed.

Safety-related instrumentation and control systems. Nine of the 62 events involved lightning-induced problems on inplant safety-related instrumenta-tion system and equipment. Examples of such problems are: blown fuses of inverters and control rod power supplies, inadvertent actuation of multiple channels of the main steam line radiation monitors and pressurizer pressure indications, and damaged electronic components.

18

Six of these nine events resulted in a reactor trip. One trip involved the i

spurious actuation of multiple reactor protection system channels of pres-surizer pressure indications; one trip occurred because the main steam line i radiation monitors actuated; one unit tripped from 100% power due to voltage spikes on the core protection calculator channels; and three events in-

) volved reactor trips due to power range neutron flux high negative rate, caused by control rods dropping into the core (lightning apparently caused surges in the distribution system and tripped multiple power supplies in the control rod drive system).

These events raise some concern regarding the adequacy of the protection l provided at these plants for mitigating the effects of lightning.

~

In all

cases where multiple channels of safety-related instruments were affected, the failures were to the " fail-safe" state and the plant was able to be safely shut down.

- Meteorological, weather, and environmental systems. Twelve of the 62 lightning events caused failures in systems isolated from the nuclear plant, such as meteorological, weather or environmental towers and stations.

Lightning strikes in the vicinity of these systems have failed instruments in the system by causing electronic component damage and blown fuses.

l Radiation and effluent monitors. Seven of the 62 lightning-induced events involved problems with radiation, or effluent or stack gas /offgas monitors.

The majority of the problems were due to voltage surges induced by the i lightning strikes. In all cases, the failures were associated with instru-1 ments confined to a particular location, and involved no serious consequence.

i

• Air intake tunnel halon system.

. Five events (all at the same plant) involved a spurious actuation or in-

) operability of the air intake tunnel halon system (and auxiliary and fuel handling building supply and exhaust fans) due to lightning flashes actuat-ing certain ultraviolet detectors located in the air intake structure.

J l Based on a review of these 62 lightning-induced events, the following findings and conclusions were developed:

(1) The plants that experienced the lightning events are located in the mid-western and eastern regions of the United States. The majority (55 of the events) involved units located east of the Mississippi River.

(2) There appears to be a direct correlation between the lightning strike den-i sity in a region and the number of lightning-induced events experienced

! by a nuclear unit in that region.

) (3) The data suggest that the total number of lightning-induced events experi-

] enced each year by the operating nuclear plants in the U.S. is about the

! same and is likely to remain so, without additional improvements in

! protection.

I (4) Systems affected by lightning strikes have been the offsite power systems,

onsite safety-related instrumentation and control systems, radiation i

19 ,

monitoring systems, weather and meteorological systems, and the air intake halon system at or.e plant.

(5) Of the 62 events studied, 29 were categorized as lightning-induced events affecting the offsite power system. Seven of the 29 events led to a reactor trip. The plants that experienced reactor trips are located in regions of low to medium lightning strike density, suggesting that the level of light-ning protection provided at these plants (or for the offsite power system) may be inadequate.

(6) Four events at two plants were due ta the sensitivity of inplant under-voltage relays on the offsite power system. The design modifications to the undervoltage circuitry at both plants are intended to correct the problem.

(7) In the 29 events affecting the offsite power system, no significant equip-ment damage was sustained. The effects of the lightning strike have in-cluded partial to full loss of offsite transmission lines, damage to light-ning arresters, trips of switchyard breakers, and voltage surges in offsite and onsite electrical systems. No safety-related systems or equipment were damaged.

(8) Nine of the 62 events resulted in problems to inplant safety-related in-strumentation and control systems. Problems such as spurious actuations of protection channels, blown fuses of power supplies and damage to elec-tronic components were caused by voltage spikes and surges induced by the lightning strike. Six of the nine events led to a reactor trip. In events where multiple channels of safety-related instrumentation or control systems were affected, the failures were to a safe state (i.e., the channels failed in such a manner that the protection or safety function was accomplished).

(9) Eleven lightning events involved failures in systems which are located in isolated locations, such as the meteorological, weather or environmental stations.

(10) Seven events at six plants involved problems with radiation or effluent monitors. The problems were primarily caused by voltage surges induced by lightning strikes in the vicinity of the plants.

(11) Five events, which occurred at one plant involved ultraviolet detectors used in the air intake halon system. Since 1983 no events have been reported, hence the problem has apparently been corrected.

In addition to the NRC review of lightning-induced events that led to the find-ings discussed above, in November 1985 the NRC issued Information Notice 85-86,

" Lightning Strikes at Nuclear Power Generating Stations," to alert licensees of some of the more significant problems experienced by nuclear plants.

20

r 1.8 References (101) 1. USNRC, Region II Inspection Report 50-302/85-44, February 11, 1986.

2. USNRC, Information Notice 86-19, " Reactor Coolant Pump Shaft Failure at Crystal River," March 21, 1986.

3. Letter from R. Widell, Florida Power Corporation, to J. Stolz, USNRC, re:

Crystal River Unit 3 Reactor Coolant Pump Shaft Failure Analyses, May 5, 1986.

4. Florida Power Corporation, Docket 50-302, Licensee Event Report 86-01-01, July 2, 1986.

(1.2) 5. Gulf States Utilities, Docket 50-458, Licensee Event Report 86-05, February 6, 1986.

6. NRC memorandum for W. Butler, NRR, from S. Stern, NRR, re: River Bend Site Visit and Follow-up, February 20, 1986.

(1.3) 7. Gulf States Utilities, Docket 50-458, Licensee Event Report 86-02, February 4, 1986.

(1.4) 8. Letter from J. Zwolinski, NRC, to D. Farrar, Commonwealth Edison Company, February 25, 1986.

9. NRC, Region III Inspection Report 50-249/86-06, February 25, 1986.

(1.5) 10. USNRC, Region II Inspection Report 50-324/86-01 and 50-325/86-01, March 5, 1986.

11. Carolina Power and Light, Docket 50-324, Licensee Event Report 86-01-01, May 7, 1986.

(1.6) 12. Connecticut Yankee Atomic Power, Docket 50-213, Licensee Event Report 86-12, March 27, 1986. l

13. USNRC, Region I Inspection Report 50-213/86-03, May 1, 1986.

(1.7) 14. USNRC, Office for Analysis and Evaluation of Operational Data, Engineering Evaluation E605, " Lightning Events at Nuclear Power Plants,"

April 1986.

These referenced documents are available in the NRC Public Document Room at 1717 H Street, Washington, DC 20555, for inspection and/or copying for a fee. (AE0D reports also may be obtained by contacting AE0D directly at 301-492-4484 or by letter to USNRL, AE00, EWS-263A, Washington, DC 20555.)

21

2.0 EXCERPTS OF SELECTED LICENSEE EVENT REPORTS On January 1, 1984, 10 CFR 50.73, " Licensee Event Report System" became effec-tive. This new rule, which made significant changes to the requirements for licensee event reports (LERs), requires more detailed narrative descriptions of the reportable events. Many of these descriptions are well written, frank, and informative, and should be of interest to others involved with the feedback of I operational experience. I This section of Power Reactor Events includes direct excerpts from LERs. In general, the information describes conditions or events that are somewhat un-usual or complex, or that demonstrate a problem or condition that may not be obvious. The plant name and docket number, the LER number, type of reactor, and nuclear steam supply system vendor are provided for each event. Further information may be obtained by contacting the Editor at 301-492-9752, or at U.S. Nuclear Regulatory Commission, EWS-263A, Washington, DC 20555.

Excerpt P_aage 2.1 Possible Emergency Diesel Generator Relay Actuation During Seismic Event at Montice11o...................... 24 2.2 Inadequate 10 CFR 50.59 Design Change Review Resulting in Design Deficiency in Emergency Feedwater System at Arkansas Unit 1......................................... 24 2.3 Inconsistency Noted Between Consolidated Controls Corporation Field Installed Wire Wrap Practice and Procedure at Davis-Besse Unit 1......................... 26 2.4 Error Found in Calculations Affecting Containment Hydrogen /0xygen Analyzer Internal Parts at Vermont Yankee.................................................. 27 1

2.5 Radioactive spill Due to Blown Fuse in Main Condenser Hotwell Level Control System at Peach Bottom Unit 3..... 28 2.6 Violation of Core Thermal Power Limit Due to Miscalibrated Feedwater Flow Transmitter at Dresden

Unit 2.................................................. 31 2.7 Discovery of Unauthorized Lifted Lead and Installed Jumper in Main Control Panel at River Bend. . . . . . . . . . . . . . 32 2.8 Unqualified Wiring Discovered at River Bend in Limitorque Operators Manufactured During 1960s and 1970s............................................... 33

, 2.9 Inability of Containment Purge and Exhaust Valves to be

Closed During Design Basis Accident, Due to Design Deficiency.............................................. 34 23

2.1 Possible Emeroency Diesel Generator Relay Actuation During Seismic Event Monticello; Docket 50-263; LER 86-01; General Electric BWR On January 6, 1986 with the plant at 97% power operation during coastdown, in-vestigation of NRC's IE Information Notice No. 85-82, " Diesel Generator Dif-forential Protection Relay Not Seismically Qualified," revealed that in the deenergized state of operation, emergency diesel generator high speed differen-tial relays (GE Model No.12CFD12B1A) are susceptible to actuation fron a seis-mic event of 0.75g magnitude. These relays are deenergized when the emergency diesel generator is not electrically connected to the essential safeguard bus.

This design deficiency could result in the lockout of the tie breaker between the emergency diesel generator and its essential safeguard bus. This would inhibit the emergency diesel generator from supplying the essential safeguard bus until the lockout is reset locally. With this information, and after a review of the applicable operational basis earthquake seismic spectra, it was decided to bypass the differential relays' trip function. This was completed on the same day. As an interin measure, a safety evaluation was performed that allows for the restoration of the differential relays' trip function for gener-ator protection during the monthly surveillance operation of the emergency diesel generators.

The final resolution will be to replace the existing differential relays with the GE type IJD seismically qualified relays.

2.2 Inadequate 10 CFR 50.59 Design Change Review Resulting in Design Deficiency in Emergency Feedwater System Arkansas Unit 1; Docket 50-313; LER 86-02; Babcock & Wilcox PWR During an NRC Safety System Functional Inspection (SSFI) on 1/14/86, it was communicated to the plant staff that a possible design deficiency in the emer-gency feedwater (EFW) system had been discovered by the NRC inspection team.

An engineering evaluation was initiated by the licensee, and on 1/15/86 the engineering evaluation concluded that for a very specific sequence of events, the EFW system would not meet single failure criteria. Based on the results of this evaluation, the NRC was immediately notified of the findings. During the time of this evaluation, the unit was proceeding to cold shutdown for an unrelated maintenance activity. The unit was shut down 1/15/86, and was subse-quently returned to power operation after completing the necessary maintenance activities and corrective modifications to the EFW system on 1/31/86. Testing of the modified EFW system was completed on 2/2/86.

The licensee had performed a review of the emergency feedwater system (EFW) in 1980 to improve the reliability of the EFW system and upgrade the system where necessary to ensure safety grade automatic initiation and flow indication. It was determined that upgrades to the installed EFW system would be required based on this review.

Part of the design changes proposed included modifications to the steam admis-sion piping and actuation systems from each once-through steam generator (OTSG) to the steam driven emergency feedwater pump (P-7A). Automatically actuated de powered steam admission valves were installed in the steam supply line to P-7A.

24

Previously installed ac powered steam admission valves in the steam supply lines from each OTSG were modified to receive closure signals from the emergency feed-water initiation and control (EFIC) system logic network for OTSG isolation if decreasing pressure is sensed for the respective OTSG. With the addition of the new de powered steam admission valves, which would be maintained normally closed, the ac powered steam admission valves were changed from the pre-design configu-ration of normally closed to normally open, thereby requiring an isolation actuation function.

The OTSG steam supply line isolation valves receive ac power from the emergency safety features electrical busses. To ensure redundancy and channel separation, one valve is supplied with red channel ac actuation power, and the other valve with green channel ac actuation power. The proposed design originally also included a check valve downstream of each motor-operated isolation valve in the steam supply lines. These features would have ensured that on a main steam line break (MSLB) event upstream of the main steam block valves (MSBVs), there would be no cross-connecting of the unaffected OTSG to the break, and an intact steam supply via the unaffected 0TSG would remain available to P-7A.

During the design change review, concerns were raised regarding the reliability of the proposed check valves. The proposed valve arrangement and check valve type were similar to that utilized in the Unit 2 emergency feedwater system original design. Unit 2 had experienced several reliability problems with the check valves, and the licensee design staff determined it prudent to exclude these check valves from the final design, thus eliminating a potential source of future operational and maintenance problems and safety concerns.

During the design review conducted by the NRC SSFI team at the plant during the week of 1/31/86, the inspection team determined the installed design failed to meet single failure criteria for a specific postulated design based event. The postulated scenario was as follows:

Given an MSLB on the A OTSG upstream of the MSBVs and a concurrent loss of red channel ac power:

(1) The motor-driven EFW pump (P-78) would be unavailable since it is powered from the red channel ac electrical bus.

(2) The A OTSG automatically act~uated isolation valve would fail to close since it is also powered from the red channel ac electrical bus.

(3) The A and B OTSGs would remain cross-connected through the steam supply lines to P-7A.

(4) Due to steam cross-feed to the break, sufficient steam flow would probably not be available to supply P-7A from the intact B OTSG.

The root cause of this event was an inadequate review of the EFW design change under the requirements set forth in 10 CFR 50.59 and represents a breakdown in the administrative controls established over design changes to the facility.

Following identification of the problems, the plant was placed in cold shutdown wnich negated the requirements for EFW system operability.

I 25 1

An engineering evaluation of this event conducted by the licensee personnel indicated that the original concerns with the reliability of the check valves that were omitted from the proposed EFW modification may be mitigated by estab-lishing routine preventive maintenance schedules. Therefore, it was determined to install the check valves in the Unit 1 steam supplies to P'7A during the maintenance outage, and initiate an augmented preventive maintenance program.

, 2.3 Inconsistency Noted Between Consolidated Controls Corporation Field Installed Wire Wrap Practice and Procedure Davis-Besse 1; Docket 50-346; LER 86-09; Babcock & Wilcox PWR On January 23, 1986, the licensee was observing a Consolidated Controls Corpora-tion (CCC) field engineer performing modifications in the steam and feedwater rupture control system (SFRCS) cabinets. The SFRCS was in a deenergized mode with the logic modules (a small card that has integrated circuits to control sys-tem functions) removed from the cabinets. These logic modules have 0.025-inch square posts that are used for terminations of wiring. The connections are made by a process called wire wrapping. The wire wrap is accomplished by wrap-ping an uninsulated portion of wire around the square posts using a special gun (similar to a drill). The CCC field representative was observed sliding an existing wire wrap connection down the square post to make room for a second termination. This practice was questioned, but the licensee was assured that

this was acceptable.

Subsequent investigation by the licensee reveaTed two standards (Military Stan-

) dard MIL-STD-11308, Connections, Electrical, Solderless Wrapped, and ANSI Stan-dard C83.72-1976, Solderless Wrapped Electrical Connections) that stipulated specific criteria for acceptable wire wraps. The requirement for a minimum strip force (the force required to displace the wire wrap connection a minimum l of one wire diameter) for the 30 AWG wire being used is 3 pounds in the ANSI Standard, and 2 pounds in the Military Standard.

The licensee subsequently performed pull testing on some wire wraps and deter-mined that wraps that had not been moved would not fail until 8 to 12 pounds of strip force was applied, which is well above the acceptance criteria. However, when the test was conducted on four wire wraps that had been applied to terminal posts and then pushed down further, the strip force required was sharply reduced.

One wrap pulled with 2% pounds, one with 2 pounds, and two with I pound of strip force applied. Two of the four would not have met the minimum Military Stan-dard requirements, and none would have met the ANSI requirements. The licensee therefore identified that moving a wire wrapped connection will require reter-l mination to ensure the minimum strip force criteria is satisfied.

It should be noted that the CCC field representative did not follow his own pro-cedure, and there was no station procedure to be used to check the work. CCC procedure QS-WR-104, Inspection of Solderless Wire Wrap Connections, specifi-cally prohibits the probing, by any means, of wire wraps. Disturbing an exist-

! ing connection to make room for an additional wire would'be contrary to this

, procedure.

l l Although none of the wire wrap deficiencies had been shown to be directly related to an actual failure in the SFRCS cabinets, had a failure in the 26' L

connection occurred, the SFRCS actuated equipment may not have been able to perform its safety function. Maintenance Procedure IC 2701.20, Instructions for Installation and Removal of Wire Wrap Connections, has been written to pro-vide the station with detailed instructions for proper wire wraps. The licensee also has begun a review of other major instrument systems to determine if other wire wrap problems exist.

2.4 Error Found in Calculations Affecting Containment Hydrogen /0xygen Analyzer Internal Parts Vermont Yankee; Docket 50-271; LER 86-02; General Electric BWR j The hydrogen / oxygen analyzer at Vermont Yankee is used to monitor primary con-tainment hydrogen and oxygen concentrations following a loss of coolant accident.

This analyzer is required to be qualified in accordance with Regulatory Guide 1.97 and Vermont Yankee's Environmental Qualification Program. Vermont Yankee's present Environmental Qualification Program requires this to be qualified for 1 year post-loss-of-coolant accident (LOCA).

During a review of the exposure calculations for the hydrogen / oxygen analyzer, it became apparent that the method used by the licensee to calculate the expo-sure was incorrect. The initial method used was to calculate the exposure based on a planar source model. This method was subsequently judged not to be con-servative. Additionally, a mathematical error was made. These mistakes resulted in a projected exposure that initially showed that no adverse effects from radiation would impact the analyzer parts.

Subsequent review and correction of the calculation resulted in an exposure level that exceeded the limit for using Viton and Teflon materials. A differ-ent method, using a hemispherical source to calculate the exposure was used to correct the calculation and to ensure its conservatism. Also the mathematical error was corrected. The integrated exposure at 30 days, using the new method and correcting the calculation error, is 1.3 x 107 Rads for the pump diaphragms and 1.7 x 107 Rads for the regulator diaphragms. This proved to be greater than the original exposure.

Using the revised results and the 1 year post-LOCA operability assumption, it was determined that the Viton material used for the pump and regulator dia-phragms would receive an exposure in excess of the qualification limits. As Viton is not acceptable for use in dynamic applications above 1 x 107 Rads, it was determined that these items would be replaced with diaphragms manufactured of Nordel/Nomex material and gaskets manufactured of Lexide material; both are qualified to 2 x 108 Rads. Additionally, the adjusti.ng vanes in the alarm units are manufactured of Teflon, which is n;.t acceptable for use above an ex-

[ posure of 1 x 105 Rads. These alarm units will be replaced with alarm units I that have stainless steel adjusting vanes. The 30-day dose for these new mate-rials is 1.3 x 107 Rads for the pump diaphragns and 1.7 x 107 Rads for the regulator diaphragms, which is below the dose this material is qualified for.

Following the discovery and subsequent correction of the calculations, it was determined that the hydrogen / oxygen analyzer need only function 30 days post-LOCA instead of the original assumption of 1 year. This is based on a General Electric report Nuclear Energy Division Operations (NED0) 22155, which states l

27 l

l

that approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after an accident the containment will have a stable atmospheric mixture and therefore the need to have an installed monitor for 30 days is a conservative approach.

2.5 Radioactive Spill Due to Blown Fuse in Main Condenser Hotwell Level Control System

! Peach Bottom 3; Docket 50-278; Special Report dated 3/27/86; General

, Electric BWR (This writeup is edited chiefly from NRC Inspection Report l 50-278/86,105)

On Sunday, February 16, 1986, Unit 3 was in cold shutdown with the condensate system on long path recirculation in preparation for plant startup after an l l extended outage of about 8 months. Condensate water was being pumped from the

hotwell via the A condensate pump through domineralizers and feedwater heaters back to the condenser hotwell. At about 1520, a fuse (F-190) in panel C-07A l blew, which caused repositioning of flow path valves resulting in condensate i flow being redirected to the condensate storage tank (CST). The CST internal i overflow line to the radwaste system had insufficient capacity to maintain CST l 1evel and resulted in filling of the CST and eventual overflow from the vent l at the top of the CST. A worker reported the overflow to the control room, and l the condensate pump was stopped approximately 5 minutes later. Flow was ob-served to stop spilling from the CST about 10 minutes after the pump was stopped.

The licensee estimates that most of the water spilled from the CST top vent drained into the dike structure, while some splashed out beyond the dike onto two adjacent trailers and the surrounding onsite area. The spilled water con-taminated an area (1500 square feet outside the dike), the 91-foot 6-inch eleva-

tion of the radwaste building (38,000 gallons spilled from the radwaste tank to i

l the floor) and storm sewer system which received water from the adjacent roadway and the CST dike.

After discovering the spill, the licensee took immediate steps to contain the water, control and clean up contamination, and measure radioactivity in air and water samples. The licensee sampled the water in the road adjacent to the CST within minutes after discovering the spill. At about 1700 (approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 10 minutes after discovering the overflow at 1550), the first samples were taken from the three catch basins on site. Two hours later (at 1900), the licensee started sampling a location thought to be the onsite sewer system re-lease discharge point to the river. At 0230 on February 17, 1986, the sewer discharge sample location was changed because of the difficulty of obtaining samples from the icy slopes at the river's edge, and the licensee started sam-pling the proper sewer line discharge without realizing they had previously sampled the wrong line.

l At approximately 2030 on February 16, 1986, the control room operators were l informed that the water level in the dike appeared to be dropping. A measure-

! ment of dike water level taken between 2100 and 2130 indicated that level had fallen from 24 inches to 14 inches. At 2330, the dike was reported to be empty.

Licensee inspection of the dike revealed two large holes in the blacktop surface.

One hole was about 3 feet in diameter and the other hole was about 2 feet in diameter.

l 28

l The Unit 3 CST is located outside the reactor building at the 135 foot elevation, and is a 30-foot diameter tank with a nominal 200,000 gallon capacity. A 4-inch internal overflow line directs overflow to a 25,000 ga11on waste collector tank in the radwaste building at the 91-foot 6-inch elevation. A seismic Class 1, watertight dike structure surrounds the CST to contain 200,000 gallons of water from a tank rupture. A gravity drained sump located within the dike contains two discharge paths with administrative 1y controlled locked closed valves. One discharge path goes to the waste collector tank and the other goes to the storm sewer system. Prior sampling of collected liquid determines the acceptable discharge path.

Final Safety Analysis Report (FSAR) Section 9.2.4.1 assumes that the maximum I spill from the CST is 200,000 gallons due to tank rupture. The design spill is protected against by the dike design. However, the February 16, 1986 event demonstrates that the maximum water inventory in the CST can be greater than 200,000 gallons. The CST filled to the internal overflow line (200,000 gallons),

continued to fill to the tank top (an additional 22,500 gallons) and spilled an undetermined amount from the top vent.

Initial measurements of gross gama activity of the water sampled during the evening hours of February 16, 1986, inside the dike and on the ground adjacent i to the dike were approximately 3N3 pCi/ml. A gamma scan of a dike water sample taken at 2315 on February 16, 1986, showed the following.

i Multiples of MPC Radionuclide Activity pCi/ml i Zn-65 2.52 N3 25 Co-60 9.75 N5 3.3 Cs-137 4.40 N5 2.2 Cs-134 3.91 N5 4.3 An NRC inspector reviewed the licensee's actions with regard to evaluation of the offsite consequences of the release, and determined the following:

(1) From the time of the release at approximately 1530 on Febrcary 16 until approximately 0230 on February 17, samples were taken from a storm drain system outfall that is not connected to the storm drain system that received

• radioactive contaminated water from the CST release. During this time, no i

~

samples were taken from the outfall of the contaminated storm drain system.

The inspector reviewed drawings of the storm drain system and examined the drain line discharging into the river near the rest and recreation (R&R) building. Drawing C-59, Rev. 5, dated 1/76, does not show the storm sewer ifne upriver that was sampled. This drawing was used by the licensee to trace the release to the river. Lack of adequate up-to-date drawings was a major contributor to sampling the wrong location during the release.

(2) Only one valid sample of storm drain discharge to the river was taken before 0630 on February 17, and this sample, which was taken at approxi-mately 0230, was not analyzed until about 0600.

(3) Analyses of samples taken for the purpose of determining concentrations of radionuclides in the storm drain system evaluated only nuclides that emit gamma radiation, and did not consider those nuclides that emit only beta radiation. The inspector examined sample results of gross beta radio-activity from the Unit 3 CST for 1985 and 1986, and calculated beta / gamma 29

ratios for selected sample data: Values ranged from 1.67 (2/26/85) to 0.1 (10/7/85). The data indicate that beta activity could be a significant fraction of the total radioactivity.

On February 17, 1986, by searching the maintenance record fil'es, the licensee determined that the holes in the dike were dug in February 1984 to perform main-tenance on heat tracing of the CST underground piping. Heat tracing is used to prevent CST supply and return piping from freezing.

The NRC inspector noted that the Shift Technical Adviser's (STA's) log indicated problems with instrumentation lines freezing during the period of January 22-24, 1984. On January 23, 1984, the Unit 3 CST level instrument rack was checked because of loss of Unit 3 CST level indications in the control room. Maintenance was called to help defrost the instrument line. On January 23, 1984, maintenance electricians set up a tent around the instrument line and placed two heaters inside the tent to thaw out the lines. It was later reported that the " ice plug" in the line had melted and all CST instrumentation was working.

On January 23, 1984, the STA prepared maintenance request form (MRF) #327AM40005 to determine why the heat tracing had failed. The MRF directed verification of the operation of heat tracing fed from heat trace control panel YO58, cir-cuit 17. There was apparent confusion regarding the correct circuit number, and the STA noted on the MRF that the instrument line piping on the CST was locally labeled as protected by circuit 19. The NRC inspector reviewed drawing E2026, Rev. O, and determined that the CST level instrument line heat tracing described in MRF #327AM40005 was on circuit 19.

On February 2,1984, a contractor dug two holes in the blacktop surface around the CST piping. One hole was around a 12-inch refueling water line, an 8-inch condensate pump suction line, and a 4-inch treated waste suction line. The other hole was around the 10-inch HPCI return line and the 20-inch core spray pump suction line. The insulation and heat trace wiring, circuit 17, was sub-sequently removed. However, it appears that the CST level instrument line, heat tracing supplied by circuit 19, was not worked on during February 1984.

It appears that subsequent work to correct the heat trace deficiencies was not performed, and MRF #327AM4005 was cancelled during the maintenance system con-version to the existing Computerized History and Maintenance Planning System (CHAMPS) program. This loss of work control allowed the heat trace system to remain inoperable and the partially performed work to remain unaddressed.

Routine test (RT) 6.0, Winterizing Procedure, requires an operator to inspect the CST and surrounding area and verify heat trace system operability. The step was completed as acceptable in December 1984 and November 1985, even though the heat trace alarm was lighted, the Unit 3 CST dike had two holes in it, and CST piping was not insulated. Discussions with operators who had completed the procedural steps revealed lack of knowledge of the heat trace alarm system.

The licensee operated for 2 years with the holes in the dike, CST piping without -

insulation, and possibly inoperable heat trace because of the alarm condition.

The 1984 and 1985 performance of RT 6.0 did not identify the holes in the CST .

di ke. The plant has apparently operated since original startup without adequate procedures for assessing the operability of the CST heat trace system.

30

Additional corrective actions taken or planned by the licensee include:

(1) The Mechanical Engineering Division is reviewing the Peach Bottom CST moat design for potential improvements in accordance with current design criteria.

1 (2) The Electrical Engineering Division has been requested to review the fail-ure mode and control circuit of the CST makeup and reject valves and to i

determine the feasibility of expanding the range between the CST high and low water level alarm setpoints. The range is presently very narrow and it is difficult to maintain water level within the band due to the number of plant activities involving the CST.

(3) A modification is being considered which would provide separate fuses for the 11 instruments on panel 30C07A that are protected by fuse F190.

(4) United Engineers is presently performing a study for the licensee to deter-1 mine potential liquid effluent release paths to the environs.

2.6 Violation of Core Thermal Power Limit Due to Miscalibrated Feedwater Flow Transmitter Dresden 2; Docket 50-237; LER 86-04; General Electric BWR On February 17, 18, 19, and 20, the unit operated an average of 0.44% above the licensed thermal power limit for 41 hours4.74537e-4 days <br />0.0114 hours <br />6.779101e-5 weeks <br />1.56005e-5 months <br />. The overpower event was traced to the 2C reactor feedwater pump flow transmitter. The following sequence of events led to the power overshoot. A maximum overshoot of 1.52% was obtained on February 18 at 1338 hours0.0155 days <br />0.372 hours <br />0.00221 weeks <br />5.09109e-4 months <br />.

On February 12, 1986 at 1900 hours0.022 days <br />0.528 hours <br />0.00314 weeks <br />7.2295e-4 months <br />, the 2C reactor feedwater pump was started to replace the 2B reactor feedwater pump, which was placed out-of-service due to seal damage. Withboththe2Aand$Creactorfeedpumpsoperable,theunit was placed on a normal return load ramp to full power starting from 45% rated core thermal power. Prior to the feecwater pump changeover, operating with the 2A and 2B combination, the generator cutput associated with rated thermal power vas 825 MWe. However, with the 2A and 2C combination, generator loads in excess bf 825 MWe were noted on February 17, 18, 19, and 20. On February 20, due to

.sealdamarp,the2Creactorfeedwaterpumpwasplacedout-of-service.

[Duringth*courseoftheinvestigation,todeterminethecauseoftheMWeoutput discrepanly,itwasdecidedtocheckthecalibrationofthethreefeedwaterflow

transmitters because of their large impact on calculated core thermal power.

,The 2C fej:dwater

.0n Februa flow,the

/ 24, 1986, transmitter output Instrument was discovered Mechanics calibrated tothe be non-conservative.

2C feedwater flow

<transmittleinacaordancewithDIP600-1. The as-found calibration data was evaluated ,co dete %ine the magnitude of the core thermal power overshoot. The i errant tdnsmitter was producing a signal that was approximately 1.5 milliamps '

noncons#rvative, which translates to a calculational error in reactor power equal .O 36 MWt. 'Using this value, operating data was assessed to determine the eatent and duration of the power overshoot on the days mentioned above.

Furt'Rermore, the overpower was confirmed to be an isolated incident because the 2C faedwater flow transmitter was last calibrated on January 31, in accordance 31 1

with DIP 600-1. Between this date and February 12, 1986, the 2C feedwater pump was used only for 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, at approximately 65% power.

In order to preclude recurrence of this event, a work request has been issued to install a protective barrier around the feedwater flow transmitter. A similar work request was issued for Dresden Unit 3.

2.7 Discovery of Unauthorized Lifted Lead and Installed Jumper in Main Control Panel River Bend; Docket 50-458; LER 86-03; General Electric BWR On 1/1/86, with the unit in hot shutdown, a jumper was found in main control room panel 1H13-P623. It was determined that the jumper was not being used as part of an ongoing test, and there was no apparent explanation for it being installed. The jumper was installed across the contacts on a reactor water cleanup (RWCU) isolation relay, and would have inhibited a Division I RWCU iso-lation. The jumper was removed without incident.

As a result of this event, Operations conducted an inspection of all control room panels. The inspection, and subsequent research by Maintenance, identi-fled one lifted lead not accounted for by plant records. This lifted lead was found in control room panel 1H13-P951 on 1/4/86, and would have prevented the automatic closure of containment building heating, ventilation, and air condi-tioning (HVAC) isolation valve 1HVR-A0V165 on a high radiation signal. It was immediately confirmed with Operations that the isolation valve was in the closed position, as required by technical specifications. The lead was relanded on 1/4/86, and applicable portions of the surveillance test procedure (STP) were successfully performed to test operability of the system.

Panel entry logs, maintenance work request records, clearance orders, and tem-porary alteration log and surveillance test procedure records were reviewed to determine what work had been performed in panels 1H13-P623 and 1H13-P951. The last identified work in panel 1H13-P623 had been the performance of STP-207-4218 on 12/27/85. The records in the procedure clearly identified, with verification, that the jumper had been removed. The Assistant Plant Manager of Maintenance confirmed by discussion with the responsible Instrument and Controls Technician that the jumper had been removed during the restoration of the test. The last identified work involving tha lifted lead in panel 1H13-P623 was the performance of STP-257-4201 on 11/12/85, which confirmed the lead to be landed. The inves-tigation of the two instance; resulted in no conclusive evidence as to why the jumper was installed in panel 1H13-P623, or why the lead was lifted in panel 1H13-P951.

To determine whether these problems were icalated or indications of a generic problem, Maintenance and Quality Assurance conducted independent inspections of randomly selected panels. Both inspections concluded that all circuit altera-tions were properly documented, and that no unidentified lifted leads or jumpers were noted.

In an effort to prevent recurrence, corrective actions were taken to establish additional administrative controls and practices for installing jumpers and lifting leads. On 1/7/86, a control room cabinet access and work monitoring 32

program was implemented. Control room panel locks were also changed to limit access to only authorized individuals.

On 1/7/86 and 1/8/86, meetings were held by the Assistant Plant Manager of Main-tenance with Instrument and Controls Foremen and Technicians to discuss the license violation and the proceduralized jumper and lifted lead program.

The requirements of CMP-0042, " Control Circuit Testing," were revised to include the use of a serialized tagging system for providing accountability for jumpers and lifted leads. Training was conducted by each Foreman for his Repairmen /

Technicians on the revised requirements of GMP-0042 and the events which led to it. Additionally, GMP-0042 is included in the req 61 red reading list for new Electrical Repairmen and Instrument and Controls Technicians.

A review of the system design confirmed that automatic isolation of the RWCU system was not disabled due to RWCU inboard isolation valves 1G33-F028, 1G33-F053, 1G33-F001 and 1G33-F040 remaining operable with the unauthorized jumper installed. Also, a review of the containment building HVAC system design confirmed that an automatic system isolation on a high radiation alarm was not disabled due to a redundant isolation valve 1HVR*A0V123 remaining operable with the lead lifted in panel 1H13-P951. Both systems were restored to meet the approved design configuration. For the reasons described above it is concluded that redundant safety features were still available to perform their intended safety function during this event.

2.8 Unqualified Wiring Discovered in Limitorque Operators Manufactured During 1960s and 1970s River Bend; Docket 50-458; LER 86-08; General Electric BWR On 1/7/86, with the unit in hot shutdown, an Equipment Qualification Engineer examined the wiring connecting the control components of a Limitorque valve motor operator being disassembled in the maintenance shop. The control com-ponents and wire were contained in a bag and were identified as parts of the operator being disassembled. The operator had originally been supplied for the now cancelled Unit 2 and was designated by its supplier, General Electric, as Master Parts List (MPL) No. 2E22-F011. The control wire was suspected of being unsuitable for the application because of its marking, which identified the wire as "NARAGANSETT NARAWIRE 14 TYPE TW 600 VOLTS TDLY." TW-type wire is a 60-degree C rated wire with PVC insulation of blue color and is generally used only for residential wiring. The wire to the limit switch compartment heaters in safety-related Limitorque valve motor operators are not electrically connected at the plant. A telephone conversation on 1/8/86 with Limitorque, the manu-facturer of the operator, confirmed that TW-type wire is unsuitable for the application, and is not environmentally qualified.

A subsequent engineering review identified that eight safety-related operators installed at the plant are of the same vintage as 2E22-F011. An inspection was performed, and all eight operators were found to contain at least some blue TW-type or unmarked red wiring. The operators were supplied by General Electric and are located in the auxiliary building outside primary containment.

The licensee contacted Limitorque in order to determine where the blue and red i

wires were installed. Limitorque acknowledged that it generally supplies its 33

- - .___ _ = - _ - - _. -

valve control components pre-wired, but stated that only units manufactured in

> the late 1960s and early 1970s had TW-type wire in red and blue. Thesubject eight operators were manufactured prior to the early part of 1978, which can be inferred from the valve test reports (provided by Anchor Darling, the manufac-turer of the associated valves) dated between 2/27/77 and 3/17/78. Procurement

of these operators predates by approximately 2 years the procurement of all other 3

safety-related operators installed at the plant. An inspection performed in

1985 on all 62 Limitorque valve operators located inside containment identified that only Rockbestos or Raychem wiring is used. Either wiring is acceptable per the installation specification. An additional five operators located outside

!' containment were inspected as the result of the condition reported here. No unqualified wiring was identified.

The valves were declared inoperable on 1/9/86, and Limiting Condition for Operation LCO-86-028 was initiated. Of the eight valves, seven (Mark i Nos. 1E122*MOVF001, 004, 010, 011, 012, 015, 023) are part of the high pressure core spray (HPCS) system, and one (Mark No. 10FR*MOV146, originally supplied as MPL No. 2E22-F012) is part of the suppression pool pumpback system. A design j change was issued on 1/9/86 to replace all internal control wiring in the subject eight operators with qualified Rockbestos wire. The wiring was completed on 1/11/86, and LCO-86-028 was cancelled the same day.

No actual safety consequences resulted from the condition reported here and the i

safety and health of the public was not endangered. However, since the capabil-ity of the TW-type wire under environmental conditions resulting from design basis events is not exactly known, it can be postulated that the safety function of the HPCS and the suppression pool pumpback systems may have been adversely affected. The loss of both systems as the result of exposure to design basis environments constitutes a condition not analyzed in the Safety Analysis Report.

j 2.9 Inability of Containment Purge and Exhaust Valves to be Closed During Design Basis Accident, Due to Design Deficiency Davis-Besse; Docket 50-346; LER 81-35-3X; Babcock & Wilcox PWR 2 (This is a 1/86 update to an LER submitted in 1981.)

i j On June 24, 1981, a review of the analysis of containment purge and exhaust

valve operation during a design basis accident had concluded that the four valves I (CV 5005, 5006, 5007, and 5008) could not be closed from their allowable open

limit of 65 degrees (with 90 degrees being fully open). These containment iso-lation valves are Henry Pratt Comapny butterfly valves, Model No. T-520-SR-1, Serial Hos. 30566-1, -2, -3, and -4. These valves are normally closed and are only open to purge. When they are open, they create a direct path from contain-l ment to the environment.

The cause of the failure of the valves to be closed is a design deficiency by the valve vendor, Henry Pratt Company. The opening of these valves had been limited to 65 degrees open by facility change request FCR 79-434. This limit was the result of a preliminary analysis. New analysis, reported in June 1984, identified that 65 degrees open was still too far open, and that limiting the valve to 55 degrees open would eliminate the potential for overstressing.

Further review of this new analysis determined that reducing the open limit would still not correct the problem. Even from the 55 degrees open position, the differential pressure across the valve would create forces in the valve 34 N - - - . .- - _ _ _ _ _ - _ - - , _ - - - _ _ - _ _ _ - _ - _ . - . _ _ _ _ - _ _ .

that could prevent it from closing, and could overstress the stub shaft should the valve have to close during a design basis accident. The analysis was con-ducted for valves with a pneumatic actuator, as those installed at Davis-Besse, and would differ for the same valve with a motor actuator.

At time of discovery of the initial event, these valves were normally kept in a closed position. They were designed to be open to purge containment atmosphere, which is normally done in the cold shutdown and refueling modes. Previously, technical specifications allowed purging to be done in the hot shutdown through power operation modes, provided that the accumulated time of operation was lim-ited to 90 hours0.00104 days <br />0.025 hours <br />1.488095e-4 weeks <br />3.4245e-5 months <br /> per year, which is approximately equivalent to 1% of a year's time. In addition, since the discovery of this event, these valves have been disabled in their safety position (closed) during all operation modes.

The initial corrective action was to ensure that these valves were disabled in their closed safety position. Per Davis-Besse's plant startup procedure, these valves are administrative 1y controlled so that they are closed with power fuses removed prior to entering hot shutdown to prevent their use in hot shut-down through power operation.

NOTE: The loss of containment integrity due to the loss of automatic closure for certain large-sized isolation valves in the containment ventilation system was an abnormal occurrence covered in the following NRC Reports To Congress on Abnormal Occurrences (NUREG-0090): Vol.1, No. 4 (October-December 1978),

Vol. 2, No. 2 (April-June 1979), Vol. 2, No. 4 (October-December 1979), and Vol. 5, No. 3 (July-September 1982).

35

t 3.0 ABSTRACTS / LISTINGS OF OTHER NRC OPERATING EXPERIENCE DOCUMENTS 3.1 Abnormal Occurrence Reports (NUREG-0090) Issued in January-February 1986 An abnormal occurrence is defined in Section 208 of the Energy Reorganization Act of 1974 as an unscheduled incident or event which the NRC determines is significant from the standpoint of public health or safety. Under the provi-sions of Section 208, the Office for Analysis and Evaluation of Operational Data reports abnormal occurrences to the public by publishing notices in the Federal Register, and issues quarterly reports of these occurrences to Congress in the NUREG-0090 series of documents. Also included in the quarterly reports are updates of some previously reported abnormal occurrences, and summaries of certain events that may be perceived by the public as significant but do not meet the Section 208 abnormal occurrence criteria.

Date Issued Report i

2/86 REPORT TO CONGRESS ON ABNORMAL OCCURRENCES, APRIL-JUNE 1985, VOL. 8, NO. 3 There were seven abnormal occurrences at NRC licensees during the report period. Three occurred at licensed nuclear power plants, and four occurred at other licensees (industrial radiographers, medical l institutions, industrial users, etc.).

3 The occurrences at the plants involved (1) management control defi-J ciencies at LaSalle Units 1 and 2; (2) inoperable steam generator low pressure trip'at Maine Yankee; and (3) management deficiencies at i Tennessee Valley Authority's Browns Ferry, Sequoyah, Watts Bar, and 4

Bellefonte facilities.

The occurrences at other licensees involved (1) therapeutic medical misadministration at the University Health Center of the Joint Radia-tion Oncology Center-Magee Women's Hospital, Pittsburgh, Pennsylvania; (2) therapeutic medical misadministration at the Milton S. Hershey Medical Center, Hershey, Pennsylvania; (3) exposures of radiographic personnel due to~ management and procedural control deficiencies at Western Stress, Evanston, Wyoming; and (4) diagnostic medical misad-ministration at Riverside Methodist Hospital, Columbus, Ohio.

Also, the report provided update information on (1) the nuclear acci-dent at Three Mile Island (79-3), first reported in NUREG-0090, Vol.

2, No. 1, January-March 1979; (2) emergency diesel generator problems (83-15), first reported in NUREG-0090, Vol. 6, No. 4, October-December 1983;-and (3) loss of main and auxiliary feedwater systems, first reported in NUREG-0090, Vol. 8, No. 2, April-June 1985.

37

Date Issued Report In addition, items of interest that did not meet abnormal occurrence criteria but may be considered significant by the public involved (1) two stuck contrcl rods during testing at Point Beach Unit 1, (2) inoperable diesel generator load sequencing at Duane Arnold, (3) truck-train wreck involving a spill of uranium concentrates near Fessenden, North Dakota, and (4) degraded containment integrity at Fermi Unit 2.

i 1

38 I

3.2 Bulletins and Information Notices Issued in January-February 1986 The Office of Inspection and Enforcement periodically issues bulletins and information notices to licensees and holders of construction permits. During the period,13 information notices and one information notice supplement were issued.

Bulletins are used primarily to communicate with industry on matters of generic importance or serious safety significance (i.e. , if an event at one reactor raises the possibility of a serious generic problem, an NRC bulletin may be issued requesting licensees to take specific actions, and requiring them to submit a wr tten report describing actions taken and other information NRC should have to assess the need for further actions). A prompt response by affected licensees is required and failure to respond appropriately may result in an enforcement action. When appropriate, prior to issuing a bulletin, the NRC may seek comments on the matter from the industry (Atomic Industrial Forum, Institute of Nuclear Power Operations, nuclear steam suppliers, vendors, etc.), a techni-que which has proved effective in bringing faster and better responses from licensees. Bulletins generally require one-time action and reporting. They are not intended as substitutes for revised license conditions or new requirements.

Information Notices are rapid transmittals of information which may not have been completely analyzed by the NRC, but which licensees should know. They require no acknowledgement or response, but recipients are advised to consider the applicability of the information to their facility.

Information Date Notice Issued Title 86-01 1/6/86 FAILURE OF MAIN FEEDWATER CHECK VALVES CAUSES LOSS OF FEEDWATER SYSTEM INTEGRITY AND WATER HAPNER DAMAGE (Issued to all nuclear power reactor facilities hold-ing an operating license or construction permit) 86-02 1/6/86 FAILURE OF VALVE OPERATOR MOTOR DURING ENVIRONMENTAL QUALIFICATION TESTING (Issued to all nuclear power reactor facilities holding an operating license or construction permit) 86-03 1/14/86 POTENTIAL DEFICIENCIES IN ENVIRONMENTAL QUALIFICATION OF LIMITORQUE MOTOR VALVE OPERATOR WIRING (Issued to all nuclear power reactor facilities holding an i operating license or construction permit) 86-04 1/31/86 TRANSIENT DUE TO LOSS OF POWER TO INTEGRATED CONTROL SYSTEM AT A PRESSURIZED WATER REACTOR DESIGNED BY BABC0CK & WILCOX (Issued to all power reactor facil-ities holding an operating license or construction permit) l 86-05 1/31/86 MAIN STEAM SAFETY VALVE TEST FAILURES AND RING SETTING ADJUSTMENTS (Issued to all pressurized water reactor facilities holding an operating license or construction permit) 39

i j

Information Date Notice Issued Title

86-06 2/3/86 FAILURE OF LIFTING RIG ATTACHMENT WHILE LIFTING THE i

UPPER GUIDE STRUCTURE AT ST. LUCIE UNIT 1 (Issued to

all power reactor facilities holding an operating license or construction permit) 86-07 2/3/86 LACK OF DETAILED INSTRUCTION AND INADEQUATE OBSERVANCE OF PRECAUTIONS DURING MAINTENANCE AND TESTING 0F DIESEL GENERATOR WOODWARD GOVERNORS (Issued to all power reactor facilities holding an operating license or construction permit) 86-08 2/3/86 LICENSEE EVENT REPORT (LER) FORMAT MDDIFICATION (Issued to all power reactor facilities holding an j operating license or construction permit) 86-09 2/3/86 FAILURE OF CHECK AND STOP CHECK VALVES SUBJECTED TO

! LOW FLOW CONDITIONS (Issued to all power reactor

facilities holding an operating license or construction

! permit) j 86-10 2/13/86 SAFETY PARAMETER DISPLAY SYSTEM MALFUNCTIONS (Issued to all power reactor facilities holding an operating license or construction permit) 84-69 2/24/86 OPERATION OF EMERGENCY DIESEL GENERATORS (Issued to Sup. 1 all power reactor facilities holding an operating license or construction permit) 86-11 2/25/86 INADEQUATE SERVICE WATER PROTECTION AGAINST CORE MELT l FREQUENCY (Issued to all power reactor facilities holding an operating license or construction permit)

86-12 2/25/86 TARGET ROCK TWO-STAGE SRV SETPOINT DRIFT (Issued to all power reactor facilities holding an operating license or construction permit)

! 86-13 2/21/86 STANDBY LIQUID CONTROL SYSTEM SQUIB VALVES' FAILURE 1

TO FIRE (Issued to all boiling water reactor facil-

! ities holding an operating license or construction 1

permit) 40 t

-. ~ . - . . . - . - - _ - . - - - , - . - . . - - . . . - ... . - _ . .

. - . - . .- . -- _. _ . - . - - _ = - _ _ _ _ _ _

3.3 Case Studies and Engineerina Evaluations Issued in January-February 1985 The Office for Analysis and Evaluation of Operational Data (AE00) has as a pri-mery responsibility the task of reviewing the operational experience reported by NRC nuclear power plant licensees. As part of fulfilling this task, it selects events of apparent safety interest for further review as either an engineering evaluation or a case study. An engineering evaluation is usually an immediate, general assessment to determine whether or not a more detailed protracted case study is needed. The results are generally short reports, and the effort involved usually is a few staffweeks of investigative time.

l Case studies are in-depth investigations of apparently significant events or l

situations. They involve several staffmonths of engineering effort, and result in a formal report identifying the specific safety problems (actual or potential)

illustrated by the event and recommending actions to improve safety and prevent i recurrence of the event. Before issuance, this report is sent for peer review i and comment to at least the applicable utility and appropriate NRC offices.

These AE00 reports are made available for information purposes and do not impose

( any requirements on licensees. The findings and recommendations contained in j these reports are provided in support of other ongoing NRC activities concerning i the operational events (s) discussed, and do not represent the position or

! requirements of the responsible NRC program office.

Special Date Study Issued Subject P601 1/86 TRENDS AND PATTERNS PROGRAM PLAN, FY86 - FY88 This report describes the AE00 Trends and Patterns Program Plan for the periodic analysis of sets of operational event i

data reported by commercial power reactor licensees. The sets of data covered by the plan are extracted from licensee l event reports (LERs) and the Nuclear Plant Reliability Data System. The phrase " trends and patterns" is used in this plan to describe a program for analyzing incidents of low

. individual significance for which frequency is the element which lends significance.

t l' The AE00 Trends and Patterns Program complements the ongoing engineering reviews of operating experience within AE00 and other NRC offices. Unlike an engineering review, which usually begins with the formulation of a specific concern,

! trends and patterns analyses usually assess operational data with limited prior formulation of a concern; the re-sults are driven by the data and the imbalances, nonunifor-mities, and changes in frequency of occurrence.

t l 41 l

Special Date Study Issued Subject The program's objec tives are: (1) to provide a perspective on the performance of the nuclear industry, including the performance of individual plants, through a systematic and broad assessment of reportable events; (2) to identify and investigate potential safety concerns associated with events and failures that are of low individual safety significance; and (3) to investigate operational experience in terms of the assumptions and bases used in regulatory analyses, including probabilistic risk a'ssessments.

The need and usefulness of trends and patterns data are becoming increasingly evident. The frequency of operational events and failures, and the changes in this frequency are a matter of concern and interest in a number of regulatory activities. Thus, reports from this program serve to pro-vide input to these activities, and also serve to identify the need for further technical studies and help to guide the allocation of staff resources.

Engineering Date Evaluation Issued Subject E601 2/4/86 DEFICIENT OPERATOR ACTIONS FOLLOWING DUAL FUNCTION VALVE FAILURES On February 8,1983, during power operations, a low pressure coolant injection (LPCI) system valve operability test was being performed at Dresden Unit 3 in accordance with the plant technical specifications because of an inoperable diesel generator. During the test, the LPCI suppression pool suction valve failed to open. The valve was then man-ually opened and electrically deactivated to ensure opera-bility of the LPCI. mode of the affected residual heat removal (RHR) system train. However, the subject valve serves both an emergency core cooling system (ECCS) and a containment isolation function. Accordingly, this action defeated the valve's capability to perform its containment isolation function. At the time, this adverse effect was not fully recognized by the plant operating staff.

The Dresden event, along with similar events at Brunswick and Peach Bottom were investigated to evaluate the under-lying cause(s), the potential safety significance and the generic applicability of events involving deficient opera-tor actions associated with dual function (i.e., ECCS/

containment isolation) valves. The study found that most light water reactors are equipped with a number of valves which perform both an emergency core cooling (or containment cooling) function and a containment isolation function. How-ever, operating experience shows that the proper and conser-vative operator action for a failure of one of these valves 42

Engineering Date Evaluation Issued Sub.iect has not always been taken by the operating staff in a manner which is fully consistent with the plant's* technical speci-fications. In each of the events studied, the operating stiff positioned and then disabled the affected valve so as l to ensure the operability of one safety function while ren-dering the other safety function inoperable. In each case the plant staff failed to recognize the adverse consequences of the actions taken and thereby failed to declare the adversely affected function to be inoperable.

The study found that an NRC staff document describing the appropriate actions to be taken following the failure of dual function valves (which was previously developed in connec-tion with the Dresden event) contains generic guidance applicable for all licensees. The study suggests that the NRC's Office of Inspection and Enforcement consider issuing an information notice which discusses the events at Dresden, Brunswick and Peach Bottem and provides the staff guidance concerning appropriate actions to be taken following the failure of a dual function valve.

From the earlier review of the Dresden event, the staff also

. concluded that because the dual function LPCI pump suction valve was not included in the technical specifications, the associated action statement might not have been fully appar-ent to the operating personnel involved. As a result, the staff requested Commonwealth Edison (the Dresden licensee) to examine the Dresden plant piping configurations to ensure that each of the dual function valves is listed in the tech-nical specifications. This study also found that the dual function valves involved in the Brunswick and Peach Bottom events are listed in the respective plant FSARs as a con-tainment isolation valve but are not included in the plant technical specifications. The study suggests that the Office of Nuclear Reactor Regulation (NRR) consider requir-ing that all dual function valves be identified in the table i

of containment isolation valves of each plant's technical specifications.

Finally, the Peach Bottom Unit 3 technical specifications for the containment cooling subsystem were reviewed to assess the completeness of the description of the subsystem. The evaluation concluded that the Peach Bottom technical specifi-cations may be incomplete by not making reference to the applicable RHR system components involved in the containment cooling subsystem. This report suggested that the Office of Nuclear Reactor Regulation review the Peach Bottom technical specifications for the containment cooling subsystem and, if warranted, require revisions to the technical specifica-tions as necessary.

43

I  !

i l Engineering Date

Evaluation Issued Subject E602 1/16/86 UNEXPECTED CRITICALITY DUE TO INCORRECT CALCULATION AND FAILURE TO FOLLOW PROCEDURES i On February 28, 1985, with Virgil C. Summer Unit 1 in a reactor startup, a reactor trip occurred on a high flux

, positive rate trip. The event was attributed to a number of causes. First, the licensed operator conducting the l startup failed to adhere to applicable procedures in that criticality was not anticipated during control rod bank withdrawal and an awareness of plant conditions was not maintained at all times. The second cause which contributed to the event was a lack of adequate guidance in the proce-l dures used to calculate the estimated critical rod position (ECRP) and reference critical data (RCD). Finally, the last cause identified which could have contributed to the event was procedural inadequacy in the licensee's admini-stration of the plant's on-the-job training program.

Uncontrolled rod bank withdrawal from a subcritical core I condition is an analyzed condition II fault in the licensee's Updated Safety Analysis Report (USAR). The resultant reac-i tivity insertion rate for the February 28, 1985 event was I determined to be a conservative case compared to the analyzed transient for this accident. Thus, the Summer startup event of February 28, 1985 was bounded by the accident analysis.

However, some concerns were identified in our review of this event and related operating experience. The ability of currently used ECRP procedures to correctly predict the I, core critical position and adequate training in the use of these procedures are suspect and may warrant further l refinement.

AE00 identified a number of recent events from its review of operating experience where the actual critical rod bank position deviated significantly from the predicted critical rod bank position. In most cases, these events could be attributed to inadequate procedures, erroneous input of data, and failure to adhere to procedures. These causes could indicate deficiencies in several licensees' quality assurance and quality control programs for the proper maintenance of the ECRP procedures and for the proper training of plant personnel in the use of these procedures. The deficiencies identified in Summer's ECRP procedures could potentially exist at other PVR facilities since this licensee's ECRP calculational met ?d is not unique to this facility. An inaccurate ECRP ciuld misinform the operator of the actual core conditions at the time of reactor startup, which could result in the core achieving criticality below the rod insertion limits. Plant operation with the control rods below the rod insertion limits, when combined with a power 44

)

Engineering Date Evaluation Issued Subject transient, could result in exceeding local departure from nucleate boiling (DNB) limits. An industry organization has issued a report covering some of the recent premature criticality events; licensees are currently following up on i its recommendations.  ;

E603 2/20/86 DELAYED ACCESS TO SAFETY-RELATED AREAS DURING PLANT

. OPERATION In 1985, several events of delayed access to vital areas because of security, radiological protection, or administra-tive provisions were reviewed to determine the impact on plant operational safety. The events did not occur during a plant emergency; therefore, they were of no immediate safety consequence and would not alter previous safety analy-ses. The recent delayed access events were of sufficiently short duration that, had they occurred during an actual emergency, operator actions very likely could have been taken inside the affected compartment in time to prevent a sig-nificant degradation of plant safety margins. However, an event at the Limerick plant (described in this engineering i evaluation) involved delayed local operator actions because plant procedures did not include provisions for having a set of equipment or compartment keys available at the remote

, shutdown panel during a remote shutdown demonstration. This procedural deficiency will be prevented from recurring as a result of improvements implemented in the planning and pro-cedures for remote shutdown operations. To remind licensees of the need for adequate key availability during remote shut-down operations, AE00 suggested that the Office of Inspection

and Enforcement issue an information notice describing the lessons learned from the Limerick experience.

1 1

l 1

e k

j l

45

3.4 Generic Letters Issued in January-February 1986 Generic letters are issued by .the Office of Nuclear Reactor Regulation, Division of Licensing. They are similar to IE Bulletins (See Section 3.2) in that they transmit information to, and obtain information from, reactor licensees, appli-cants, and/or equipment suppliers regarding matters of safety, safeguards, or environmental significance. During January and February 1986, two letters were issued.

Generic l'atters usually either (1) provide information thought to be important in assuring continued safe operation of facilities, or (2) request information on a specific schedule that would enable regulato$ decisions to be made regard-ing the continued safe operation of facilities. They have been a significant means of communicating with licensees on a number of important issues, the reso-lutions of which have contributed to improved quality of design and operation.

Generic Date Letter Issued Title 86-01 1/3/86 SAFETY CONCERNS ASSOCIATED WITH PIPE BREAKS IN THE BWR SCRAM SYSTEM (Issued to all boiling water reactor applicants and licensees) 86-03 2/10/86 APPLICATIONS FOR LICENSE AMENDMENTS (Issued to all licensees of operating reactors and applicants for an operating license) i l

46 I

3.5 Operatina Reactor Event Memoranda Issued in January-February 1986 The Director, Division of Licensing, Office of Nuclear Reactor Regulation (NRR),

disseminates information to the directors of the other divisions and program offices within NRR via the operating reactor event memorandum *(OREM) system.

The OREN documents a statement of the problem, background information, the safety significance, and short and long term actions (taken and planned). Copies of ORENs are also sent to the Offices for Analysis and Evaluation of Operational Data, and of Inspection and Enforcement for their information.

No ORENs were issued during January-February 1986.

i l

47 l

l

3.6 NRC Document Compilations The Office of Administration issues two publications that list documents made publicly available.

The quarterly Regulatory and Technical Reports (NUREG-0304) compiles bibliographic data and abstracts for the formal regulatory and technical reports issued by the NRC Staff and its contractors.

The monthly Title List of Documents Made Publicly Available (NUREG-0540) contains descriptions of information received and generated by the NRC.

This information includes (1) docketed material associated with civilian nuclear power plants and other uses of radioactive materials, and (2) non-docketed material received and generated by NRC pertinent to its role as a regulatory agency. This series of documents is indexed by Personal Author, Corporate Source, and Report Number.

The monthly Licensee Event Report (LER) Compilation (NUREG/CR-2000) might also be useful for those interested in operational experience. This document contains Licensee Event Report (LER) operational information that was processed into the LER data file of the Nuclear Safety Information Center at Oak Ridge during the monthly period identified on the cover of the document. The LER summaries in this report are arranged alphabetically by facility name and then chronologically by event date for each facility. Component, system, keyword, and component vendor indexes follow the summaries.

Copies and subscriptions of these three documents are available from the Superintendent of Documents, U.S. Government Printing Office, P.O. Box 37082, Washington, DC 20013-7982.

I 48

UNITED STATES nasr etass man NUCLEAR RESULATURY CCMMISSl!N WASHINGTON, D.C. 20666 'o***g.

wasa o c Penmit me. aar OFFICIAL BUSINESS PENALTY FOR PRIVATE USE,6300 1 1AN1N411M11S1 120555078877 US NRC ADM-DIV 0F TIDCMGT BR-PDR NUREG POLICY & PUB 20555 W-501 DC WASHINGTON l

l e

l i

s I