ML20214G314

Power Reactor EVENTS.March-April 1986

ML20214G314
Person / Time
Issue date:	11/30/1986
From:	Massaro S NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
References
NUREG-BR-0051, NUREG-BR-0051-V08-N2, NUREG-BR-51, NUREG-BR-51-V8-N2, NUDOCS 8611260061
Download: ML20214G314 (43)

Text

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _________

NUREGlBR-0051 Vol. 8, No. 2

\

i'.....h POWER REACTCiR EVE NTS

/ United States Nuclear Regulatory Commission e....

Date Published: NOVEMBER 1986 Power Reactor Fvents is a bi-monthly newsletter that compiles operating experience information about commercia'

, nuclear power plants. This includes summaries of noteworthy events and listings and/or abstracts of USNRC and of.her documents that discuss safety-related or possible generic issues. It is intended to feed back some of the lessons learned from operational experience to the various plant personnel, i e.. managers, licensed reactor operators, training coor-dinators. and support personnel. Referenced documents are available from the USNRC Public Document Room at1717 H Street. Washington. D C. 20555 for a copying fee. Subscriptions of Power Reactor Events may be requestea from the Superintendent of Documents, U.S Government Printing Of fice. WasTington. D C. 20402. or on (202) 783-3238.

1 Table of Contents Page 1.0 SUMMARIES OF EVENTS 1 1.1 Failure to isolate Reactor Coolant System from Residual Heat Removal System Due to Leakage of Primary Containment isolation Valves at Pilgrim . . . .

I 1.2 Outof-Sequence Control Rod Withdrawal Due to Series of Operator Errors at Peach Bottom Unit 3.. . . ....

. 5 1.3 Loss of Shutdown Cooling Due to Improperly Functioning Water LevelIndicators at San Onofre Unit 2. .. . . . . . . . . . . . . . . . 8 1.4 Plant Shutdown Due to Leak in Pneumatic Supply to Automatic Depressurization System Valves at Grand Gulf Unit 1. . .. .. .

. 13 1.5 Weld Failure on Pipe Support Structure Due to improper Design at Palo Verde Unit 1 - 15 1.6 Update on Emergency Diesel Generator Engine Problems at North Anna.. . . . . . . . . . . . . . 18 1.7 Update on Failure of Automatic SprinklerSystem Valves to Operate at Grand Gulf Unit 1. . 21 1.8 References = . . . . . . . 23 2.0 EXCERPTS OF SELECTED LICENSEE EVENT REPOR TS. . 25 3.0 ABSTRACTS / LISTINGS OF OTHER NRC OPERA TING EXPERIENCE DOCUMENTS. 35 3.1 Abnormal Occurrence Reports (NUREG 0090) . . . . . . . . .. 35 3.2 Bulletins and information Notices... . 36 3.3 Case Studies and Engineering Evaluations.. 38 3.4 Ceneric Letters... ..-.. . 41 3.5 Operating Reactor Event Memoranda... . .. .. 42 3.6 NRC Documentation Compilations... . 43 g1260061 e62230 - Editor: Sheryl A. Massaro DR-DOfgf pgp WW k WW ad haw 5 of Operational Data U.S. Nuclear Regulatory Commission Period Covered: March-April 1986 Washington, D.C. 20555

1.0 SUMMARIES OF EVENTS 1.1 Failure to Isolate Reactor Coolant System from Residual Heat Removal System Due to Leakage of Primary Containment Isolation Valves at Pilgrim On April 4 and 12, 1986, the Pilgrim

• reactor scrammed from low power during routine reactor shutdowns. Both scrams were caused by unexpected Group I**

primary containment isolations. In both cases, the isolation signal was promptly reset, but the four outboard main steam line isolation valves (MSIVs) could not be promptly reopened. As a result, the main condenser was not avail-able as a heat sink during a portion of the reactor cooldown. A shutdown on April 11 was initiated because the residual heat removal (RHR) system had been pressurized by leakage of reactor coolant past a check valve and two closed injection valves in the B RHR loop. An Unusual Event was declarea because of the RHR valve leakage, and a controlled shutdown was initiated. While shutting down, an unplanned reactor scram occurred on April 12, and the outboard main steam isolation valves failed to open fully on demand. These events are detailed below.

At 1:00 p.m. on April 4,1986, a reactor shutdown was initiated after oil leakage was detected in the main turbine control oil system. The low pressure coolant injection (LPCI) system was considered inoperable at the time due to the unrelated problem of water leakage past a block valve, M0-36A, in the RHR system torns cooling line.

At 8:15 p.m. on April 4, a Group I primary containment isolation (resulting in a reactor scram) occurred as reactor pressure decreased to 898 psig in the shutdown sequence. The two low main steam line pressure alarms (set to approximately 880 psig) were received at the time of the isolation. The containment isolation signal was promptly reset following the scram; however, the outboard MSIVs could not be reopened for approximately 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The inboards MSIVs were opened during that time period. As a result of the closed MSIVs, most of the subsequent reactor cooldown was controlled by directing reactor steam to the high pressure coolant injection (HPCI) turbine. The HPCI system was operated in the test mode and did not inject water into the reactor.

The reactor mode switch had been moved from the "run" to the "startup" position 45 minutes prior to the isolation. The low steam line pressure containment isolation function is active in the run mode, but is bypassed when the mode switch is placed in the startup mode. During the review of this event, the licensee concluded that all the contacts in the reactor mode switch did not

• Pilgrim is a 670 MWe (net) MDC General Electric BWR located 4 miles southeast of Plymouth, Massachusetts, and is operated by Boston Edison Company. I

• • Group I: main steam isolation valves, steam line drains and reactor water sample lines.

close properly when the switch was transferred from the run to the startup mode during the shutdown. As a result, the low pressure containment isolation function was still active when steam line pressure dropped below the trip setpoint (about 880 psig). The licensee determined that proper positioning of the mode switch required removing the key from the switch each time it was moved to a different mode. Training for all Control Room Operators on proper mode switch operation was conducted prior to the subsequent reactor startup.

The licensee also concluded that an air leak in the A outboard MSIV, A0-203-2A (coupled with repeated attempts to open the valves) probably lowered air pres-sure to the four outboard valves, preventing them from fully opening. The air leak was attributed to foreign materials in the MSIV pneumatic control valve.

The evaluations of the mode switch and MSIV problems were reviewed by the licensee's 0peational Review Committee on April 8, 1986. The reactor was restarted at 2:46 a.m. on April 10, 1986.

Periodic RHR system high pressure alarms (400 psig) were received on April 10 and 11, indicating that the RHR system wcs being pressurized by reactor coolant leakage. The RHR piping in the B lcop was. warm, indicating the leakage was coming through the normally closed injection valve, M0-298, and an inline check valve, 688. (Sec Figure 1.) At 2:16 p.m. on April 11, a second B loop injection valve, M0-28B, was closed in the RHR system in an attempt to stop the leakage. The low pressure coolant injection (LPCI) subsystem of the RHR system was declared inoperable at that time. However, leakage con-tinued into the RHR system, causing a high pressure alarm 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> later. At 4:53 p.m. on April 11, 1986, a reactor shutdown was initiated from about 92%

power, and an Unusual Event was declared due to the leaking valves.

At 1:56 a.m. on April 12, a Group I primary containment 1 solation (with an associated reactor scram) occurred during the shutdown sequence. Reactor pres-sure was 908 psig at the time of the isolation. The mode switch had been moved from the "run" to the "startup" position, and the key had been removed from the mode switch 20 minutes earlier, at 1:36 a.m. The isolation and scram occurred about 30 seconds after the two main steam line low pressure alarms annunciated in the control room.

As before, the outboard MSIVs could not be opened for approximately 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the isolation signal was reset, and the HPCI system (in the test mode) was used to cool the reactor. (The MSIVs could not be opened due to pilot poppet disengagement determined to be caused by installation error.) The reactor was placed in cold shutdown and the Unusual Event was terminated at 9:08 a.m. on April 12, 1986.

During the period between April 13 and April 19, 1986, extensive RHR system walkdowns and isolation valve leak measurements were conducted. A special water leak rate test was designed that would simulate reactor water pressure on the reactor side of valve 68B (Figure 1). The test was conducted to determine the amount of water leakage associated with the as-found condition of the three valves. Thus the leak rate of the check valve 66B, the closed gate valve 29B, and the closed globe valve 28B, in series with one another, was to be 2

l l

450 psig l

1

, .; y j 28B 1250 psig

• Pressur Sw ch (400 psig)

"q-

.,!r

' ? .*.

33B *? . ' 29B g 68 8 ' '. ;

LO M *!

. ! .' 34B 36B

&2 & 2

'.' *.i Primary l

) ,'* Containment l

Recirculation Loop A 67D 66D M

' LO j

RHR Pump P-203D i

' 16B u2 j r ,

i i RHR Pump P-2038 678 66B 158 170 l N M i

i n Heat Exchanger E-2078

Figure 1 PILGRIM RHR LOOP B (Original Condition) i SIMPLIFIED RHR DIAGRAM

. o - --

determined. In addition, the test continued until pressurization of the RHR piping was achieved and the RHR Hi alarm sounded in the control room. Each segment of piping between the isolation valves and between valve 288 and the RHR pump check valve was monitored for pressure.

The test was conducted on April 17, 1986. Tne normally locked open manual valve, 338, near the reactor was closed and water was pumped between it and valve 688. The pressure between valves 33B and 68B was increased to 300 psig.

The technician found it difficult to hold pressure constant. At one point, the pumping was stopped completely for several minutes and then varied between ten and 20 strokes / minute. An air-operated positive displacement water pump was used. It became apparent that as the technician increased pressure, valve 68B became an effective barrier until such time as the pressure difference across the valve equalized, after which the valve had no affect. The pressure was increased to 600 psig and then to 950 psig. It was held at 950 psig for 95 minutes, at which time the RHR Hi alarm sounded in the control room. During this period the average pump flow rate was about 0.5 gpm.

The root cause of the RHR Hi pressure alarms was the approximate 0.5 gpm water leak past the loop B RHR isolation valves in conjunction with relatively leak-tight RHR pump discharge check valves. This condition caused a build-up in pressure in the intervening pipe segments to about 390 psig, resulting in the alarm. There was no indication that the potential existed for sudden, gross failure of all three isolation valves and resultant sudden overpres-surization of the RHR piping. No root causes were found for the spurious primary containment isolations on April 4 and 12, 1986, despite considerable licensee investigation.

On April 12, 1986, the NRC sent an Augmented Inspection Team (AIT) to Pilgrim to review the events in depth. The AIT determined that the licensee did a thorough job in evaluating the LPCI injection valve leakage and recurring RHR pressurization events. Although the leak rates which were measured were relatively low, continued power operation with the recurring pressurization of the RHR piping and the resultant RHR alarm was unsatisfactory because (1) of the potential for a loss of coolant outside containment; (2) an operator's attention is frequently drawn to an alarm that has uncertain and undefined operational / safety significance; and (3) the excessive cy-ling of the two safety-related isolation motor-operatea valves (34B and 3bts) used to vent the pressure to the suppression pool contributed to premature wearout of these valves. The AIT recommended that the licensee eliminate the cause of the recurring pressurization of the RHR piping. In addition, several areas were identified where improvements were needed to ensure that the significance of similar events in the future can be determined and/or minimized. These include: periodically verifying that the LPCI injection check valve properly seats with a differential pressure across the valve; installing pressure monitoring equipment on the RHR piping; and developing a method to quantita-tively measure the LPCI injection valve leakage during reactor operation.

4

The leaking of primary coolant into RHR lines that were not designed to contain fluid at that temperature and pressure can cause a number of incidents: overpressurization with possible faulting of the low pressure line, and a LOCA; steam binding of one or more of the RHR pumps; and waterhaniner. The safety significance of these events is the increased probability of core melt and releases in excess of 10 CFR 100 limits. The NRC's Office of Nuclear Reactor Regulation has designated this topic Generic Issue 105, " Interfacing Systems LOCA at Boiling Water Reactors," and has given it a "high" priority. In addition, an NRC generic letter concerning staff actions relating to this topic is being considered.

Restart of Pilgrim is pending NRC authorization in accordance with Confirmatory Action Letter 86-10,-issued April 12, 1986, and subsequent NRC requests for additional information. Investigation is ongoing to determine root cause, to assess the safety consequences and implications of the event, and to determine corrective action to reduce the probability of a similar event occurring. The inability of the operations staff to determine significance due to instrument and procedural inadequacies should be addressed. In addition, greater attention should be focused on the isolation function of valves that protect low pressure emergency core cooling systems from the high pressure reactor coolant. Startup of Pilgrim currently is planned for the second quarter of 1987, since the licensee is considering an extensive replacement and modification program. This event will be updated in a future issue of Power Reactor Events. (Refs. 1-3.)

1.2 Out-of-Secuence Control Rod Withdrawal Due to Series of Operator Errors at Peach Eottom Unit 3 On March 18,1986, at 8:55 a.m., Peach Bottom Unit 3* was manually scrammed from approximately 3% power in the startup mode. The event was caused by a series of personnel errors involving failure to withdraw the correct control roo with the rod worth minimizer (RWM) out of service, failure to adequately verify that the correct withdrawal sequence was followed, and failure to verify the proper position of a control rod prior to utilizing the rod sequence control system (RSCS) bypass function for that rod. The reactor was manually scrammed due to concerns that the out-of-sequence rod and resulting rod pattern may not have been bounded by the current reload specific rod drop accident (RDA) safety analysis. Subsequent analyses showed that the reactor was not operated in a condition such that RDA consequences would have exceeded the design criteria at any time during this event, and RDA consequences were significantly less severe than the reload specific RDA analysis results. The event is detailed below.

i

• Peach Bottom Unit 3 is a 1035 MWe (net) MDC General Electric BWR located 19 miles south of Lancaster, Pennsylvania, and is operated by Philadelphia Electric Company.

5 l

l Unit 3 reactor startup began on March 17, 1986 at 10:18 p.m. The RWM was manually bypassed at the time because of a process computer fault. A licensed operator was assigned _to moritor control rod withdrawal in accordance with Technical Specification 3.3.B.3.b which states, "Whenever the reactor is in the startup or run modes below 25% rated power the Rod Worth Minimizer shall be operable or a second licensed operator shall verify that the operator at the reactor console is following the control rod program." Control rods 1 through 5 of Group 1 were withdrawn prior to change of shift at 11:00 p.m.

At shift change, a different licensed operator was assigned Technical Specification 3.3.B.3.b duties. Rod withdrawal recommenced at Step 6 of Group 1 and continued to Step 13 of Group 1. Step 13 specified that rod 02-23 be fully withdrawn; however, the reactor operator inadvertently withdrew rod 10-23, which is located near rod 02-23. Further, the second licensed operator mistakenly verified that rod 02-23 had been correctly withdrawn.

This withdrawal error occurred at 1:28 a.m. on March 18, 1986.

Rod withdrawal continued, in proper sequence, to Step 6 of Group II. Step 6 specified that rod 10-23 was to be fully withdrawn. At this point, the reactor operator left the control rod panel to check recorders that were monitoring various parameters. When the operator returned to his station, he observed that rod 10-23 was fully withdrawn, and, not realizing that he had previously withdrawn rod 10-23 at 1:28 a.m., signed off the rod withdrawal sheet for Step 6, Group II. Rod withdrawal continued until all Group II rods were fully withdrawn.

Group III rod withdrawal was attempted at 2:30 a.m. RSCS initiated a rod block at this point, due to 02-23 being fully inserted. The Shift Superintendent and Shift Supervisor placed the RSCS bypass keyswitch in the " full-out" position for rod 02-23, without verifying that rod 02-23 was fully withdrawn. This action bypassed the rod 02-23 rod block and allowed rod withdrawal to continue.

Group III rod withdrawal was completed at 4:34 a.m. With the exception of the last rod in Group IV (which was only withdrawn as far as position 10), all Group IV rods were fully withdrawn by 6:11 a.m. No further rod withdrawals were performed on this shift, which ended at 7:00 a.m. The Shift Superinten-dent, Shift Supervisor, and both reactor operators ended their shift at 7:00 a.m.

At 7:30 a.m., the Shift Superintendent on the day shift requested that trouble-shooting be performed on the RWM. At 7:40 a.m., the RWM was reinitialized and returned to service. The RWM indicated an insert error for rod 02-23. The reactor operator observed that rod 02-23 was fully inserted, although it should have been fully withdrawn. Further investigation revealed that the RSCS keylock bypass switch for rod 02-23 was placed in the " full-out" position, thereby bypassing the RSCS rod block. At 7:48 a.m., the RSCS bypass switch was returned to the normal position. As expected, a rod withdrawal block occurred due to rod 02-23 being out-of-sequence. A controlled shutdown was begun by inserting rods so that rod 02-23 could be withdrawn in correct sequence.

However, due to concerns that the 02-23 insertion may have adversely affected the RDA analyses, the reactor was manually scramned at 8:55 a.m. The scram occurred properly, and was reset at 9:03 a.m.

6

c.

This event was caused by a series of personnel errors involving failure of the reactor operator to withdraw the correct rod, failure of the second operator to adequately verify that the correct withdrawal sequence was being followed, and failure of the Shift Supervisor and Shift Superintendent to verify the proper position of a control rod prior to utilizing the RSCS bypass function for that rod.

The four individuals responsible for this event were disciplined. In addition, the following actions have been developed to prevent recurrence and are in various stages of implementation:

(1) A letter was issued on March 18, 1986, from the Superintendent / Operations to all licensed personnel outlining the event and describing interim requirements for verification of proper rod positioning.

(2) A procedural control has been developed to use the plant process computer to generate a core map at the completion of withdrawal of specific rod groups. The computer-generated map will be compared to a rod map which is attached to the operator's rod withdrawal sheet. The two maps will then be verified to be identical before proceeding to the next rod group.

(3) Six procedures involving RWM and RSCS have been revised to enhance the procedural requirements. Included in these revisions is the RSCS bypass procedure, which has been revised to provide a Shift Supervision sign-off sheet for proper verification of rod position prior to implementing the RSCS bypass function.

(4) On March 24, 1986, the Plant Manager issued a letter to Shift Supervision to ensure that "best efforts" are made to place the RWM in service prior to beginning reactor startup.

(5) Henceforth, when rod movements are being performed with the RWM bypassed, the second licensed operator will be dedicated to ensuring that the proper rod sequence is being followed; this will be his only assigned duty.

(6) Plant staff management meetings are being held with all Operations Personnel to discuss the event and individual responsibilities.

Although technical and process oriented corrective action was promptly taken following this event, including prompt institution of an investigation to determine root cause, the immediate cause was personnel error. The licensee, after in-depth investigation of the error, determined that failure to follow approved procedures was the root cause. In this particular case the procedures were followed as to the technical aspects, except that human effort combining failure to observe and proceeding on an untrue assumption permitted rod withdrawal out of sequence. This event emphasizes the need for better management involvement in plant activities to ensure a high level of personnel performance. (Refs. 4-6.)

7

i a

, .1.3 Loss of Shutdown Cooling Due to Improperly Functioning Water Level

. Indicators at San Onofre Unit 2 On March 26, 1986, with San Onofre Unit 2* in cold shutdown, the shutdown .

cooling system (SDCS) experienced a total loss of flow for a period of 49 minutes. This occurred while reactor coolant system (RCS) level was being i reduced to repair a leaking cold leg system generator nozzle dam which had been I installed to allow work in steam generator channel heads. Using the estab-

.11shed level indication, which was later found to be in error, the-RCS was

. drained to a level where vortexing occurred at the RCS/SDCS suction connection, *

causing the SDCS/ low pressure safety injection (LPSI) pumps to eventually. -

f become airbound. The pumps were stopped and the system vented, reestablishing

, SDCS flow. Concurrent with the restoration of SDCS flow, both gas channels of 3

the fuel handling isolation system actuated on high noble gas as a result of

! the RCS degassing. The high pressure safety injection (HPSI) system was used

to make-up to the RCS until SDCS flow returned to a stable state. The cause of I this event was erroneous level indication, resulting in the operators'not

, racognizing the RCS low level condition prior to complete loss of SDCS flow.

i Immediate corrective action was taken to prevent SDCS/LPSI pump damage, restore j SDCS flow to a stable state, and recalibrate the level indicators. Changes in

plant design, procedural revisions, formal control of level indicator instal-

! lation, and operator training has been completed. The event is detailed

! below.

i On March 26, 1986, at 10:08 p.m., with the unit in cold shutdown, a loss of

}

flow in the SDCS for 49 minutes was experienced. This occurred during a

planned evolution where the RCS is drained to below mid-loop on the RCS hot leg. The RCS is drained below mid-loop to install, remove, or repair steam

generator nozzle dams, which are installed to allow work to be accomplished in l the steam generator channel heads concurrent with refueling activities. For l this particular evolution, the RCS was being drained to accomodate repair of a

. leaking cold leg nozzle dam in steam generator E089.

The Unit 2 SDCS uses portions of two safety systems to remove decay heat from the reactor core in cold shutdown; the LPSI system and the containment spray system (CSS). Each LPSI pump is aligned to take suction from the RCS hot leg and discharge through a CSS heat exchanger back to an RCS cold leg. Normal '

operation of the SDCS in cold shutdown requires one LPSI pump to be in opera-tion, with the redundant pump in standby. Normal flow by procedure is 3000 .

gpm, but in cold shutdown, flow may be throttled to a lower rate, or stopped entirely, as long as core outlet temperature is maintained 10 degrees F below saturation temperature.

The suction connection of the SDCS to the RCS is located at the bottom of one of the 42-inch diameter hot legs. The system piping runs outside containment to the LPSI pump suctions, with sufficient elevation differential provided for t adequate net positive suction head. However, when the RCS level is being

• San Onofre Unit 2 is a 1070 MWe (net) MDC Combustion Engineering PWR located 5 miles south of San Clemente, California, and is operated by Southern Califernia Edison Company

[ 8 4

_ _ _ _ , . . _ . , , . , . . . _ . _ , _ _ . _ - . . _ . _ _ _ . . ~ . . - _ . _ _ _ _ . - - - . . _ . _ _ _ _ _ _ _ _ - . _ _ _ . . _ -

I controlled with the loops not filled (i.e., within the 42-inch range above the suction connection), air entrainment due to vortex formation above the suction connection can occur.

RCS water level is lowered at less than 1-inch per minute, asing the LPSI pump mini-flow line to divert flow from the SOCS to the refueling water storage tank (RWST). To raise the RCS level, a HPSI pump is started,' which draws water from the RWST and injects it into the RCS cold legs. During this event, the RCS water level was being monitored by a recently installed level indication system, consisting of narrow range and wide range level detectors providing control room indication. The narrow range is used to monitor RCS level when it is below the top of the hot leg. It covers a 42-inch range with zero at the bottom of the inside of the hot leg and +42 inches at the top of the inside of the hot leg. "The wide range covers a range from 10 feet below the reactor vessel flange to 25 feet above the flange. Zero on the wide range is at the top of the reactor vessel flange, or at 100-1 inches above the bottom of the inside of the hot leg. These detectors are permanently installed, but require temporary connections to join them to an RCS hot leg drain and a pressurizer instrument tap when they are placed in service. The installation of these detectors and their control room indication was accomplished to provide .

increased accuracy and operator control of draining and refilling evolutions, rather than relying solely upon a local indicating tygon tube manometer.

Prior to initial draining to mid-loop of the RCS hot legs on March 19, 1986, both the wide range and narrow range level detectors were calibrated. On March 20, 1986, the RCS level was lowered to 20 inches by narrow range level indication (approximately mid-hot leg loop) in the control room, and prepara-tions for steam generator nozzle dam installation were initit.ted.

In preparation for this maintenance activity, the RCS eductor was placed in service, minimizing the containment airborne contamination when breaching the integrity of the RCS. Upon placing the eductor in service, both the narrow range and the wide range control room level indications began oscillating. The operators, noting the oscillations, requested the assistance of the Station Technical Cognizant Engineer and Instrument and Control Technicians to perform troubleshooting on the Tevel indicators. This troubleshooting evolution in-cluded draining and purging the reference and sensing legs of each of the instruments, performing calibration checks on the narrow range detector, and observing the effect of starting and stopping the RCS eductor. After perform-ing these evolutions, with marginal success, the tygon tube manometer was installed to verify the RCS level indications being provided by the narrow range and wide range detectors.

On March 22, 1986, the tygon tube manometer was installed with zero level at the top of the reactor vessel flange. The nominal relationship of the three level indicators, assuming all function as intended, at the theoretical hot leg mid-loop position, is as follows:

Narrow Range Wide Range Tygon

+21 inches -6 feet 7-1 inches (-79-) inches) i inches Concurrent with this installation, maintenance activities were initiated to drain the steam generator RCS headers, temove the primary manways, and install 9

_ _ _ _ _ - ___b

the nozzle dams. During these activities, which were completed on March 26, l 1986, the narrow range control roon level indication was at 13 inches i inch {

(8 inches below mid-loop), while the tygon tube manometer indicated a level of I

-83 inches 1 inch (i.e., tygon was 4-1 inches high relative to narrow range). I l

At 10:15 a.m. on March 26, 1986, after completion of these maintenance activities, an RCS level increase was initiated with the tygon manometer indi-cating -83 inches and the narrow range detector indicating 13 inches. After the RCS level had been raised to -22 inches as indicated on the tygon manometer (loops filled), the refill was stopped, and a visual inspection of the nozzle dams was performed. At 2:50 p.m., it was determined that one of the cold leg nozzle dams was leaking excessively and draining was initiated to enable the nozzle dam to be repaired. Operators began draining the RCS to a level of -83 inches (tygon manometer); however, at an indicated level of -77 inches, the in-service SDCS/LPSI pump's motor current began to oscillate, and further reducti6n in level was ceased. After several minutes, when the motor current oscillations did not stabilize, operators initiated RCS refill using the HPSI-19 pump. At 5:15 p.m., after the addition of approximately 100 gallons of RWST makeup water, the pump motor current oscillations stabilized and the HPSI pump was secured.

At that time, the SDCS/LPSI flow was stable at 3000 gpm. It was noted that the narrow range level was indicating 13 inches, the same as that prior to nozzle dam installation (nominal 13 inches), while the tygon manometer indicated 6 inches higher (-77 inches vs. -83 inches) than prior to nozzle dam instal-lation. At 6:30 p.m., the Operations shift was changed.

At 8:30 p.m., a Maintenance Foreman notified the Shift Superintendent that when the leakino cold leg dam was removed, the RCS level was only several inches below the bottom of the dam. Previously, when they had installed the dam, the level was reported to be much lower. For personnel safety, the Maintenance Foreman requested that the level be lowered. (It should be noted that the licensee had trained its maintenance personnel on a mock-up of the dam installation, but the mock-up did not have proper or expected RCS water level indicated inside the RCS loop; thus, the Maintenance Foreman had never seen an example of proper water level.)

One hour later, with indicated RCS level -77 inches on the tygon manometer, operators began draining to -83 inches on the tygon, as permitted by procedure.

After 7 minutes of draining with no apparent level change, the operators throttled SDCS flow to the RCS to 2000 gpm. This increased flow to the RWST and reduced the potential for vortexing. At 9:40 p.m., draining was stopped to verify level and to stabilize SDCS flow. At this time, and for several minutes, the SDCS showed no sign of vortexing. The RCS level indicated -78 inches on the tygon (5 inches above target) and 9.8 inches on the narrow range.

At 9:47 p.m., large motor current oscillations were observed on the inservice LPSI-16 pump; at 9:50 p.m., the pump was stopped to avoid damage. Opera tors ,

believing that RCS level was adequate (tygon was indicating 1-1 inches above mid-loop) restarted the pump 3 minutes later. After several minutes of stable operation, motor current oscillations recurred and the pump was secured. At 10

i I e i

? ~

this point the redundant pump (LPSI-15) was started and indicated stable opera-tion for several minutes. At 10:08 p.m., however, suctica pressure dropped to zero. When, shutdown cooling flow indication was lost, the LPSI-l'i.pumpewas stopped. ..

Recognizing that the SDCS had become airbound and flow had.been Inst, the Shitt Superintendent directed that an accelerated system venting scheme be employed in order to restore SDCS flow as rapidly as possibia.- frior to venting', Health 7 Physics was notified to monitor the expected releasq of radioactivity, and the Shift Technical Advisor and offsite. supervision were sum:noned.

- _ ~.

System venting proceeded well,under the direction'of the Shift Superintendent, and the LPSI-16 pump was restarte'd reastablishing SDCS flow. At 11:00.p.m., ,-

make-up of the RCS level was begun to furtht.r' assure SDCS flow stability using y the HPSI-19 pump until, at 11:30 p.m., the RCi level indicated stable at -77 inches by tygon and 13 inches on the narrow' range detector.

Concurrent with reestablishing SDCS flow, the fuel handling isolation system ,

(FHIS) radiation monitor actuated on both gas channels with a maximum level of f ,

t 300 CPM. This increase of noble gas in the fuel handling building was the result of gas being released into containment via the reactor vessel head.

instrument nozzles and being drawn through the fuel transfer tube by the ' lower pressure in the fuel handling building. Noble gas was released from the RCS due to the vessel water temperature increase during the event. The FHIS functioned as designed, and was reset at 2:35 a.m. on March 27, 1986.

j .

Earlier in the outage, the heated junction thermocouple level indicating systent and core exit thermoccuples had been removed from service in preparation for '

refueling, and the RCS loop resistance -thermal detectors were being relied on for temperature indication. Prior to the event, the hot leg temperature indicated 114 degrees F. During the event, not leg temperature rose briefly to

~

210 degrees F and then rapidly dropped'to below 200 degrees F when SDCS flow was restored. , ,

The licensee's inve:tigation revealed the following:

(1) A 2-i-inch error in khe thon manomefer reference scale, combined with a 10-1-inch error cau:ed by en air bubble that ' existed in the tygon tubing, resulted in an indicated level of'13 ' inches nigher than actual level during the event. The 2-i-inch error occurred as the result of using an s informally surveyed reference scale when the properly surveyed scale could not be located. -

(2) The newly installed wide range and narrow range level detectors had been adversely affected by operation of the RCS eductor. These detectors were originally designed to connect to the pressurizer vent at the same location as the tygon manometer. After preoperational~ testing, however, it had been determined that the eductor would not affect the level indication if the connection were made to in alternate instrument tap on the head of the pressurizer. The tap selected.,however, included a 11 l

_ 3. ,

j);-

I section of flexible tubing which had low points and resulted in the

, formation of a loop seal, preventing proper venting of the detector V through the pressurizer head vent. This tap and flexible tubing were part

[~ '. F of the original plant configuration. This led to operator distrust of the two level detector indications.

(3) The whde rangs) level detector was found to be out of calibration. The reason for beibg out of calibration cannot be detennined, since it had been calibrated only 7 days earlier.

(4) There was local boiling,in the reactor core during the event, and a steam release to containment occurred via incore detection nozzles in the reactor vessel jhsad. The radiation levels involved in this release were less than 1% of the established setpoints on the containment purge radiation menitors. The total release was calculated to be approximately 2 curies.

(5) Although local boiling in the core did occur, the calculated bulk reactor coolant temperature'did not exceed 200 degrees F. The maxiinum heatup rate per technical specifications was exceeded, but an evaluation of the fuel assemblies and the vessel determined that no damage occurred.

The root cause of this event was the nonconservative error in the tygon level

. indications and the information which resulted from the water level in a portion of the c'old legs being higher than the hot legs, indicating to the operators that the RCS level was at mid-loop. As a consequence, the operators were unable to properly diagnose the motor current oscillations being causea by low RCS level.

The following contributing causes have been determined: (1) since RCS level detectors are classified as nonsafety-related, their control was not as formalized as may be necessary when dealing with such evolutions; (2) there were no formal data on the potential for vortexing at lower RCS levels; (3) there was no formal control over the routing and installation of the tygon tubing.

.b

_ The.imediate corrective actions to prevent recurrence included increasing the RCS level and restoring SDCS flow to a stable condition. The tygon level indi-cator was properly reinstalled. The narrow and wide range level instrument reference legs were relocated to a different pressurizer instrument tap to pre-clude adverse effects from eductor operation, and the wide range level indicator was recalibrated.

' The following corrective actions have been or will be completed prior to RCS draindown during the next scheduled unit outage.

4 (1) To establish highly reliable water level indication, draindown procedures

,~ have been revised to require diversified level indication (including the tygon manometer) which must be in agreement as a prerequisite for draining operation; the installation of the tygon manometer has been formalized;

.V

[

12

f 5

?

, and the heated junction thermocouple level indicating system will be main-

'tained in service until redundant refueling water level indication systems

, are in service following the initial draindown, after which the tygon tube will be used to periodically cross-check the. level indication provided by the remote indication. '

(2) A correlation of expected vortexing versus level for a range of flow rates was completed, and this information has been included'in operating instructions.  ;

\ (3) The minimum and maximum flow te be maintained when lowering level below i mid-loop will be defined, and appropriate procedural revisions will be made. .,

(4) The required RCS levels for various maintenance evolutions such as nozzle dam installation and removal, based on cold leg draindown limits will be evaluated.  ;

(5) Augmented training will be provided to operators concerning SDCS operation, particularly when drained down. This will include a review of the lack of temperature indication when flow is stopped, when boiling can i be expected following loss of flow, and the actions to be taken to most quickly restore flow.

,' (6) The installation add operation of the refueling water level detectors and

f, the tygon manometer will be formally proceduralized to apply the same administrative controls as to safety-related systems.

(7) The RCP casing will be vented periodically during RCS level changes to

\ preclude.the theorized water level differential.

! In addition, corrective actions being considere'd include providing an alarming I ,' trend recorder to monitor LPSI pump parameters (amperage, discharge pressure, flow) in order to provide the earliest possible warning of a potential loss of shutdown cooling, and initiating design change to'make the LPSI pump self-venting. (Refs. 7 and 8.)

1.4 Plant Shutdown Due to Leak in Pneumatic Supply to Automatic Depressuriza-f tion System Valves at Grand Gulf Unit 1 On March 19, 1986, at Grand Gulf Unit 1,* supply air flow to the automatic depressurization system (ADS) air receivers was determinrd to be excessive, raising concerns regarding the ability of the air system to meet its design reouirements. The high. makeup air flow was due to excessive leakage through the seats of 16 of the 17 accumulator relief valves. The design seat leak tightness pressurec is 90 percent of set pressure (171 psig). The nominal sys-tem operating pressure (185 psig) exceeded this value, causing the excessive leakage.; The accumulator relief valves were1 set at approximately 190 psig.

3; e Brand Gulf is a 1108 MWe (net) NDC General Electric BWR located 25 miles

, south of. Vicksburg, Mississippi, and is operated by Mississippi Power and Light Ccmpany.

s. - r

,,A /

The relief valves were reworked and the system operating pressure was reduced.

The event is detailed below.

On March 19, 1986, with the plant operating at about 80 percent power, supply air flow to the ADS air receivers was determined to be excessive. ADS valves operate by pneumatic pressure that is stored in two accumulators for each valve. The accumulators receive makeup air pressure from the air receivers that are pressurized by the instrument air system. The air system is designed with the capability to allow for two actuations of each ADS safety relief valve and then hold the valves open for 5 days without replenishment. The excessive leakage observed on March 19, 1986, raised concerns regarding the ability of the air system to meet these design conditions.

At 11:00 a.m. on March 19, 1986, the ADS system was declared inoperable and a limiting condition for operation (LCO) was entered. The LC0 requires the plant to be in at least hot shutdown within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and reactor steam dome pressure to be reduced to less than or equal to 135 psig within the next 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Operators began plant shutdown at 7:05 p.m. The reactor was manually scrammed at 9:42 p.m. By 4:30 a.m. on March 20, 1986, the reactor steam dome pressure was less than 135 psig.

The high makeup air flow to the ADS air receivers was due to excessive leakage through accumulator relief valve seats. All of the 17 accumulator relief valves were removed and bench tested for leakage. Sixteen were reworked to reduce the leakage to an acceptable rate. One was determined acceptable with-out rework and was returned to service. The relief valves are J. E. Lonegan, Model LCT11. The design seat leak tightness pressure is 90 percent of set pressure (171 psig). The normal system operating pressure was 185 psig nominal which exceeded this value, causing the excessive leakage. The relief valve lift setpoints are set at about 190 psig.

The relief valves were bench tested using a water bath to a depth of 0.5 inch surrounding the relief valve discharge line to determine leakage. The relief valves were refurbished to an acceptable leakage rate of five bubbles per min-ute at a pressure of 90 percent of the relief valve setpoint (171 psig), and were reinstalled. Mechanical joints in the ADS air system were also checked for leakage. No leakage was. identified. The normal system operating pressure was reduced from 185 psig nominal to 165 psig nominal. This change has been reflected on the operator's rounds sheets and in the System Operating Instructions.

The ADS safety relief valvcs operate to depressurize the reactor so that flow frcm the low pressure coolant injection subsystems and the low pressure core spray system can enter the reactor vessel in time to cool the core and limit fuel cladding temperatures during accident sequences in which the reactor core isolation cooling and the high pressure core spray systems fail to maintain reactor water level. The ADS valves would complete their safety-related function with the replenishment air supply available from the instrument air system. A loss of this supply with the system leakage present during this event would have reduced the length of tin,e following a LOCA that the system would have been available. (Refs 9 and 10.)

14

1.5 Weld Failure on Pipe Support Structure Due to Impropee Design at Palo Verde Unit 1 During a snubber surveillance inspection at Palo Verde Unit 1* on March 13, 1986, the license identified a failed pipe support on a 24-inch main feedwater line to a steam generator. The failure occurred at a welded connection between two members of the support, resulting in their total separation. Licensee metallurgical analysis determined that the weld failure resulted from over-loading. The root cause of the failure was evaluated by the licensee and Bechtel (the architect engineer) to have resulted from an improper design consideration of localized flange bending, as well as inadequate allowance for lateral thermal motion.

As result of the failure, Bechtel initiated a review of all large bore safety-related supports of a similar design. As a result of that review, moaifications to ten additional supports were initiated at all three Palo Verde units. The modifications consisted primarily of adding stiffeners to the existing support structures. Further, Bechtel performed a sampling review of small bore pipe safety-related supports, and concluded the supports had adequate designs. The event and subsequent evaluations are detailed below.

A surveillance inspection of Palo Verde Unit 1 on March 13, 1096 identified a broken pipe support (1-SG-005-H008). The broken support wat ~ acated inside the containment building and was a strut type support for the 24-inch main feedwater line to steam generator No. 2. The break occurred in the weld between the flange connection of the upper and lower support beams. The lower portion of the support separated completely from the upper support beam (see Figure 2).

The axes of the two beams were oriented 90 degrees, and it was discovered that the two 4-inch lon and E (lower beam)g,1/4-inch leg fillet had fractured. welds between A distortion members of the beam A (upper flanges at thebeam) weld location also occurred. The time of support failure is unknown. A visual inspection of the hanger had been performed by the licensee in March 1985, prior to post-core hot function testing, at which time the support was intact.

The broken support was visually inspected. The upper beam's bottom flange edge showed substantial benfing. Similarly, the lower beam's upper flange showed some bending. Part of the fractured weld remained on the upper beam with the remainder on the lower beam.

Also, the weld surfaces on the lower beam were examined under a stereo micro-scopo. Part of the fracture was in the base n ul near the fusion zone and part was in weld metal. The weld quality was satisfactory. The fractured surface of the beam had a woody appearance, but the fractured surface in the weld metal appeared smooth.

• Palo Verde Unit 1 is a 1221 Mwe (net) MDC Combustion Engineering PWR located 36 miles west of Phoenix, Arizona, and is operated by Arizona Public Service.

15

UPPER SUPPORT SEAM

/

FAILURE OCCURRED

,/ /%,\ AT THIS STRUCTURAL

. WELD ATTACHMENT

.] BETWEEN TLANGE CONNECTION OF UPPER AND LOWER I]

o x SUPPORT BEAM LOWER SUPPORT BEAM SUPPORT ,

LOAD SUPPORT 1/4" LEG FILLET LOAD WELDED CONNECTION BETWEEN UPPER AND LOWER SUPPORT BEAM EXTENSIVE LOWER ' '

FLANGE DEFORMATION AT AREA OF BEAM ATTACHMENT (DOWNWARD)

\ N NO STIFFENER I

PLATE OTHER I SIDE IIl l \/

LOWER SUPPORT Iill l FLANGE DEFORMED l UPWARD n

{

SUPPORT SUPPORT LOAD LOAD END VIEW FIGURE 2. PIPE SUPPORT 1-SG-005-H008 FAILURE LOCATION 16

The fractured surfaces were additionally examined under a scannir.g electron microscope (SEM). The examination showed elongated dimple structures typical of a ductile overload under shear stresses. The base metal had some equiaxed dimples and elongated fibers, indicating ductile overload fracture. No evi-dence of any striation was seen under the SEM, proving that fatigue was not a factor in this fracture.

Review of the failure concluded that the support was designed for the load being applied vertically, but due to thermal displacement of the pipe, the load was actually applied at about E degrees off vertical. This angle generated a lateral load, the effect of which was amplified on the failed weld by the depth of the lower beam (W6 x 12), which significantly reduced tbo load bearing capac-ity of the failed weld. Flange bending flexibility was identified as another factor which further reduced the capability of the weld.

Based on the above observations, it was concluded that the weld fractured due to overloading. Deformation of the flanges indicated that the weld transferred the loads until it could no longer accommodate strains imposed by deformation of the flange, causing the weld to fracture.

The root causes of the failure of Unit I support 1-SG-005-H008 were not adjusting the direction of the applied loads to accommodate the normal thermal motion of the pipe, and not considering the effect of localized flange bending.

The combination of a relatively large thermal motion and short sway strut length resulted in a large angle which generated a horizontal force not accounted for in the original design. The effect of this horizontal force on the failed weld was amplified by its acting not only through the pin-to-back-plate height of the rec- bracket but also through the 6-inch height of the W6 x 12 lower beam.

Additionally, the failed weld joined two open section members connected flange to flange at right angles. It is believed that the welds parallel to the web of the upper member are subject to a prying action resulting from the bending of the lower flanges of that upper beam (localized flange bending). Finite element analysis of the failed structure has indicated that this action does reduce weld capability. It was concluded that these two effects created excessive stresses in the welds, due to the unanalyzed conditions, that led to support failure.

Prior to plant heatup, pipe support 1-SG-005-H008 was subjected to loads exceeding the design criteria for dead load only. During subsequent and repeated hot functional tests, the loading on the support increased even higher above the yield point. This resulted in local flange bending and deformations and, as a result, imposed stresses in the welds attached to the support flange.

This significantly reduced the weld capacity to carry additional loads.

Thermal loads resulting from hot conditions during power operations applied eccentric loads to these welds. Failure of the welds may have occurred prior to or during the power operation phase.

All large bore Q-class supports that are designed to accommodate a swing angle, including struts, rods, snubbers, and springs, were reevaluated. Of the 852 17

supports reviewed, it was determined that five supports in addition to support 1-SG-005-H008 required modification to accommodate the off-vertical loading condition. An additional review of 100% of the large bore Q-class pipe sup-ports, which involved 3,678 design drawings and "as-built" documentation, deter-mined that five supports in the main steam and safety injection systems were inadequately designed for flange bending and required modification.

Based on the above evaluations, it was concluded that there was a loss of design control during the original derign of the support for flange bending and eccentric loading, and that this event may represent a generic design problem.

Corrective actions included modifying the supports found to have insufficient capacity due to lateral loads resulting from a swing angle that had not been properly accomodated in the original design. The six supports inadequately designed for flenge bending were provided with stiffeners. (Refs 11 and 12.)

1.6 Update on Emergency Diesel Generator Engine Problems at North Anna During 1984 and 1985, the emergency diesel generator (EDG) sets at North Anna Units 1 and 2* experienced significant mechanical failures involving piston pin bushings, pistons, anc cylinder liners, together with lesser incidents, such as fuel and water leaks and governor problems. (These problems were discussed in Power Reactor Events, Vol. 6, No. 6, Section 1.8, " Repeated Trips of Emergency Diesel Generators at North Anna," pp.12-14, issued April 1985.)

The scuffing and cracking of cylinder liners and pistons at very low hours of operation, and the widespread wearing and extrusion of insert and piston pin bushings impacted the reliability of these engines for their intended service.

However, the root causes of the problems have been diagnosed, and important changes have been made in the engine lubrication, operation, and maintenance.

These problems, causes and corrective actions tre summarized below from an in-depth, independent engineering evaluation performed for the licensee.

(Ref. 13.)

North Anna ,is a two-unit nuclear station with a total of four EDGs. Two EDGs are fully dedicated to each nuclear unit, with one EDG assigned to each of the redundant electrical power divisions of each nuclear unit. There is no sharing of EDGs between the nuclear units. Power from one EDG to one electrical division of each unit is sufficient to provide for safe shutdown loads or for accident loads. The EDGs at North Anna are Fairbanks-Morse Model 38 TD8-l/8, 12-cylinder, opposed-piston, turbocharged engines. These EDGs are rated for continuous duty at 2750 kW, for 2000 hours0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br /> at 3000 kW, and for 30 minutes at 3300 kW.

During the North Anna Unit 1 and 2 refueling outages in itte 1985 and early 1986, the emergency diesel generators (EDGs) were overhauled in accordance with the manufacturer's recommendations. Inspection of the key components FNorth Anna Units 1 and 2 are each 893 MWe (net) MDC Westinghouse PWRs located 40 miles northwest of Richmond, Virginia, and are operated by Virginia Powera

of the EDG unit revealed that the upper wrist pin bushings exhibited intoler-able extrusion and elongation.

The general design of the Model 38 TD8-1/8 engine is characterized by a pair of pistons in each cylinder, operating in opposite directions and with a common combustion space formed by the pistons. Therefore, there are no cylinder heads, and there are no intake or exhaust valves. Pressurized clean air enters the cylinder via ports encircling the top of the cylinder liner when the upper piston is in a position to uncover these ports. Following the combustion of the compressed air-fuel mixture, the downward motion of the lower piston uncovers the exhaust ports which encircle the bottom of the cylinder liner. The turbocharger, driven by the exhaust gas, provides fresh, compressed, cooled air directly into the engine air receiver and cylinders.

Extra horsepower is provided via the turbocharger, which raises the power out-put a considerable degree.

Each EDG is equipped with a lube oil keep-warm system, a prelube system, and a lode oil booster system for the upper crankshaft lubrication during fast starts. In the keep-warm system, an electric heater and thermostat keep the lube oil at 130-135 degrees F to maintain a desired viscosity. The keep-warm circulating pump sends the warmed lube oil through the lower crankshaft line, maintaining continuous lubrication of the bearings in the lower portion of the engine, and back to the oil sump. Due to the possibility of getting oil by the inverted pistons and into the firing chamber of these opposed-piston engines, this lubrication system does not circulate lube oil to the upper crankshatt during standby. '

In the prelube system, a separately powered lube oil pump is started auto-matically (for remote manual EDG starts), and is run for about 2 minutes prior to the actual starting of the engine. The prelube system provides lubr'icating oil to both the lower and upper crankshaft lines. For all test starts of the EDGs at North Anna, the prelube system is now used prior to the actual diesel start. In addition, for those simulated engineered safety features (ESF) actuation / loss-of-power tests where prelube is not activated automatically, the prelube system is started manually prior to actually simulating the need for an emergency auto start. In the case of actual emergency starts, however, the EDG starts immediately and is not delayed in order to provide prelube.

The lube oil booster system includes a lube oil supply in a piston-operated accumulator operated by engine starting air. As the engine first begins to rotate, approximately 1 gallon of lubricating oil is fed immediately to the bearings along the upper crankshaft line by the accumulator. This booster oil to the upper crankshaft line supplements the prelube system.

The general conclusion of the independent engineering evaluation performed on the EDGs was that the engines are adequate to successfuly meet their required operational limits as long as these diesels are:

- Not overloaded,

- Properly maintained, Operated with Chevron DELO 6000 or compatible / suitable oil, and Effectively monitored.

19 l

l

L l

Evaluation of the key engine components is summarized below.

Bushings. Bushing performance reliability has recently been improved through the use of a more appropriate lubricant accompanied by implementation of more rigorous constraints on EDG loading. In addition, a program to carefully monitor the bushing's side clearances should ensure early detection of any extrusion.

Pistons and Cylinder Liners. Piston and liner evaluations indicate that no major contribution to decreased reliability resulted directly from these particular components. Except for damage resulting from bushings failures, the pistons, piston rings, and liners were in excellent condition. All cylinder liners in the engines now have the Viton water jacket seals.

Governor and Load Control. The governor is deemed sufficient to handle required emergency loads, but when the unit is on the grid, there is an apparent problem with lead control. A particular characteristic of the present governor system is that the engine can be overloaded when on the grid unless the load control is continually monitored and adjusted. Thus, it is essential that the engine itself have its own independent overload protection distinct from the governor system, which will also allow the unit to meet technical specification load requirements. To this end, the mechanical rack stops have been adjusted to limit total rack travel to approximately 8 millimeters.

It might be desirable to further protect the engine bearings and parts by developing a soft-start philosophy, such as with a partial startup fueling capability.

Lubricating 011 System. An ongoing concern has been the adequacy of the lubricating oil system to lubricate the upper drive train during normal engine startup. Examination of the system, examination of bushing and piston failures, and observation of engine starts have led to the conclusion that no failures could be attributed to lack of lubricant flow during EDG startup.

The station requirement to prelube the engine before starting is an additional safety factor being utilized. All lubrication failures which were investigated were attributable to deficiencies in characteristics of the oil being used.

Selection of a more suitable lubricating oil, together with recalibration of the fuel injection pumps and adjustment of camshaft timing to avoid excessive firing pressures, has permitted engine operation in excess of 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br /> without apparent problems; prior to these improvements, certain failures had occurred in less than 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br /> of EDG operation.

Fuel Oil System. All fuel injection pumps have been rebuilt with erosion sleeves and have been recalibrated. The manufacturer's fuel oil system is deemed adequate as long as rack ad,justments are minimized and kept within the recommended settings for meeting rated load. Limiting rack travel, however, impacts on the engine power output, and any adjustments should be within the requirements of engine performance. Proper calibration of fuel oil pumps, correct shimming, and correct camshaft timing, as accomplished in the recent overhauls, will ensure a more uniform peak firing pressure, within the desired 1200 to 1300 psi range.

20

i.

i Since implementation of the independent evaluation suggestions summarized 4 above, the EDG set at North Anna have demonstrated substantially improved reliability and availability, and have fulfilled their operability require-ments adequately. Although certain basic problems have been addressed and

, resolved, more detailed engineering analyses will continue. Other improve-i ments and fine tuning also will continue, particularly in the areas of load regulation and engine monitoring. (Refs.13 and 14.)  :

1.7 Update on Failure of Automatic Sprinkler System Valves to Operate at Grand Gulf Unit 1 At Grand Gulf Unit 1* on September 4,1983, a fuel line ruptured on the No.11 diesel generator. The engine was manually stopped and the outside air fans

were secured when a fire was reported at the engine. The fire brigade responded with fire hoses and portable extinguishers. It was noted, however, that the automatic fire water deluge valve had not opened. The manual release was ineffective since the drop weight had already been released by the

,. automatic function. A mechanic was able to open the valve by removing the i actuator enclosure box cover and striking the top of the weight, and the fire was extinguished.

4 This and similar events were reviewed in Power Reactor Events, Vol. 5, No. 5, February 1985, pp. 8-9, and in NRC Information Notice 84-16, dated March 2, 1984. The following information, updating review of the failure of the valves, has been edited from a more recent information notice, 86-17, " Update of Failures of Automatic Sprinkler System Valves to Operate," issued March 24, 1986.

The valves of concern are 6 . inch deluge and pre-action fire protection water control valves, identified as Model C, manufactured by Automatic Sprinkler j Corporation of America (ASC0A). The NRC received a copy of notification from i ASC0A in January of 1986 stating that previous instructions issued to

, customers in late 1984 or early 1985 concerning maintenance to these valves i was inadequate to prevent the failure-to-actuate problems that had been experienced.

In June 1984, ASC0A had concluded in a letter to NRC that the Grand Gulf events were plant unique. In November of 1984, ASC0A informed the NRC that three separate reports of the 6-inch Model C valve failing to actuate under certain circumstances had caused them to reevaluate their previous conclusion. They provided NRC with an advance copy of instructions to customers on the nature of the problem, identification of affected systems, and a recommended course of action to be taken to correct the problem. - ASC0A stated this notification would be sent to all their nuclear customers.

The most recent ASC0A instructions (January 1986) supersede these previous instructions, and state that the previously recommended maintenance procedure is inadequate. These instructions provide what is temed a " temporary solution."

I

• Grand Gulf Unit 1 is a 1108 MWe (net) MDC General Electric BWR located 25 miles south of Vicksburg, Mississippi, and is operated by Mississippi Power and Light Company.

i 21

A tentative date for availability of a permanent solution, additional information for identification of affected valves, and a course of action described by ASC0A as " required" for the elimination of the problem also are given. However, is it not clear that this notification has been sent to all nuclear customers. Licensees who have not received this communication from ASC0A are encouraged to contact their ASC0A representative for this important informa tion.

t 22

1.8 References (1.1) 1. Boston Edison Company, Docket 50-239, Licensee Event Report 86-09, May 9, 1986.

2. I;RC, Augmented Incident Response Team Report 50-293/86-17, May 16, 1986.

3. Letter from W. Harrington, Boston Edison Company, to T. Murley, NRC Region I, re: Second Response to Confirmatory Action Letter 86-10, June 16, 1986.

(1.2) 4. NRC Region I, Inspection Report 50-278/86-09, March 25, 1986.

5. Philadelphia Electric Company, Docket 50-278, Licensee Event Report 86-09, April 16, 1986.

6. Letter from Philadelphia Electric Company to J. Taylor, NRC, re: NRC Notice of Violation and Proposed Imposition of Civil Penalities, July 23, 1986.

(1.3) 7. Southern California Edison Company, Docket 50-361, Licensee Event Report 86-07, April 25, 1986.

8. NRC Region V, Inspection Report 50-361/86-06, April 25, 1986.

(1.4) 9. Mississippi Power and Light Company, Docket 50-416, Licensee Event Report 86-09, April 17, 1986.

~

10. NRC Region II, Inspection Report 50-416/86-08, April 22, 1986.

(1.5)11. NRC Region V, Inspection Report 50-528/86-09, May 20, 1986.

12. Letter from E. Van Brunt, Jr., to G. V,nighton, NRC, re: Revision to Report on Pipe Support Failure, June 2,1986.

(1.6) 13. Letter from W. L. Stewart, Virginia Power, to J. Grace, NRC Region II, July 14, 1986, forwarding (1) Colt Industries' May 28, 1986 report, (2) Trident Engineering Associates' July 2,1986 report, and (3) Chavron Research Company's May 22, 1986 report.

14. NRC Region II, Inspection Report 50-338 and 50-339/86-05, April 24, 1986.

These referenced documents are available in the NRC Public Document Room at 1717 H Street, Washington, DC 20555, for inspection and/or copying for a fee.

(AE0D reports also may be obtained by contacting AE0D directly at 301-492-4484 or by letter to USNRC, AE00, EWS-263A, Washington, DC 20555.)

23

l 2.0 EXCERPTS OF SELECTED LICENSEE EVENT REPORTS On January 1,1984,10 CFR 50.73, " Licensee Event Report System" became effec-tive. This new rule, which made significant changes to the requirements for licensee event reports (LERs), requires more detailed narrative descriptions of the reportable events. Many of these descriptions are well written, frank, and informative, and should be of interest to others involved with the feedback of operational experience.

This section of Power Reactor Events includes direct excerpts from LERs. In general, the information describes conditions or events that are somewhat unusual or complex, or that demonstrate a problem or condition that may not be obvious.

The plant name and docket number, the LER number, type of reactor, and nuclear steam supply system vendor are provided for each event. Further information may be obtained by contacting the Editor at 301-492-4493, or at U.S. Nuclear Regulatory Commission, EWS-263A, Washington, DC 20555.

Excerpt Page 2.1 Inoperable Safety Injection Trains Due to Personnel Errors in Scheduling and Performing Surveillance Procedures at Callaway Unit 1 ................................................... 25 2.2 Reactor Core Isolation Cooling Isolation Due to Temperature Switch Des ign Problem a t Duane Arnold . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.3 Unsealed Auxiliary Feedwater Pump Room Penetrations Due to Inadequate Review During Design Process at Palo Verde Units 1 - 3 ........................................................ 29 2.4 Inadvertent Actuation of Balance of Plant Engineered Safety Features Actuation System During Inspection of Cabinet at Palo Verde Unit 2 .................................................. 30 2.5 Reactor Vessel Indications Discovered During Examination of Clad Side o f Flange Face a t Oconee Uni t 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 2.1 Inoperable Safety Injection Trains Due to Personnel Errors in Scheduling and Performing Surveillance Procedures at Callaway Callaway Unit 1; Docket 50-483; LER 86-09-01; Westinghouse PWR On 4/12/86 at 1010 CST, the plant entered Technical Specification (TS) 3.0.3 upon discovery that both intermediate head safety injection (IHSI) trains of the emergency core cooling system (ECCS) were inoperable. The trains were restored to operability within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. At the time of the event, the reactor had been shut down for about 42 days.

Operation of the plant with both IHSI trains inoperable is a condition pro-hibited by the plant's TSs in the power operation, startup, and hot standby modes, thus requiring appropriate action per TS 3.0.3 and reporting per 10 CFR 50.73(a)(2)(1), 10 CFR 50.73(a)(2)(v), and 10 CFR 50.73(a)(2)(vii). A 4-hour report via the Emergency Notification System (ENS) to the NRC Operations room should have been made under 10 CFR 50.72(b)(2)(iii). This report was not made.

AT 0402 CST on 4/12/86, Operations personnel began surveillance procedure OSP-EP-V0003, "Section XI Accumulator Safety Injection Valve Operability," re-quired by TS 4.0.5 every 18 months. Two initial conditions stated in OSP-EP-V0003 were: (1) to run this test while in hot shutdown with reactor coolant system (RCS) pressure abosa 300 psig; and (2) to close the safety in-jection (SI) pumps discharge to cold leg injection isolation hand control valve, EM-HV-8835. Due to unintentional operational and scheduling personnel errors associated with this procedure, a temporary change notice (TCN) was generated which allowed the test to be run in hot standby after ECCS subsystems were made operable (4/11/86). Closing EM-HV-8835 in accordance with the procedure, there-fore, isolated the common line necessary for the SI pumps to inject into four RCS cold legs during an emergency situation. The procedure was completed at 0558 CST on 4/12/86. Restoration of EM-HV-8835 to the open position was not performed since it was not included on the restoration decklist of OSP-EP-V0003.

Restoration was not included in this procedure since it should have been per-formed in hot shutdown and the valve properly restored with a separate IHSI system procedural lineup performed for hot standby entry.

The problem was discovered at 1010 CST on 4/12/86, when an operator performing the routine Control Room (CR) Shift and Daily Log Readings and Channel Checks, founc EM-HIS-8835 indicating closed. TS 3.0.3 was immediately entered since TS 3.5.2, ECCS Subsystems - Tavg greater than or equal to 350 degrees F, does not provide action statements for two inoperable Si trains. EM-HV-8835 was restored to the open position within the 1-hour TS 3.0.3 time constraint.

This event is an isolated case of utility personnel error during the scheduling, reviewing and running of OSP-EP-V0003. These errors and contributing factors are summarized as follows:

(1) Scheduling personnel identified OSP-EP-V0003 as required to be performed in hot standby prior to RCS pressure reaching 1000 psig which failed to recognize the Surveillance Task Sheet (STS) " Task Performance Mode" re-quirements. This " Task Performance Mode" required performance of the surveillance in hot shutdown ONLY.

(2) The 4/12/86 hot standby change letter confused operating pertonnel. In an attempt to provide additional information to the CR, mode change letters have historically identified surveillances that will be due in the near future that would be affected by the mode change as well as surveillances required for the mode change. Surveillance tracking personnel identified OSP-EP-V0003 on the hot standby change letter to be performed in hot standby when conditions permit (RCS pressure greater than 300 psig). This was based on the need to perform the surveillance (18-month surveillance -

due June 1986) prior to declaring the SI accumulators operable.

26

(3) Operations personnel erroneously authorized performance of the OSP in hot standby. During review of OSP-EP-V0003 prior to running the test, Opera-tions personnel noted that the OSP initial conditions required performance 3~

of the procedure in hot shutdown only. They reviewed the OSP, mode change letter and schedule, and erroneously authorized performance of the surveil-lance in hot standby by a TCN. This action was caused by the discrepancy between the schedule, initial conditions of the procedJre, and the mode change letter. The senedule required performance prior to 1000 psig. The '

mode change letter required the RCS to be greater than 300 psig. Finally, the Operators overlooked the effect of closing EM-HV-8835 when in hot standby.

(4) Revision of the STS did not follow the existing review and approval cycle.

With issuance of the TCN, the STS " Task Performance Mode" was changed by Operations personnel without the appropriate review and approvals.

The following actions to prevent recurrence are numbered to correspond with the numbered items above:

(1) For future outages, OSP-EP-V0003 scheduled in hot shutdown as a hot standby restraint.

Progressive discipline has been initiated for appropriate Outage personnel.

Outage Planning and Scheduling personnel have been advised concerning their involvement in this event.

An outages procedure currently in draft form will specifically address use of the STS " Task Performance Mode" for scheduling surveillances.

(2) Future mode change letters will reflect only required task performance conditions and TS requirements for mode changes.

(3) The TCN that allowed performance of the OSP in hot shutdown was voided.

Progressive discipline has been initiated for Operations personnel involved in this event, and the necessity to comply with programmatic controls has been reemphasized.

Additional guidance will address the utilization of TCNs for surveillance procedures. This guidance will be incorporated into plant administrative procedures.

(4) Management will reemphasize the existing administrative controls for re-

~

visians to task sheets and surveillance procedures to appropriate plant personnel.

To correct the problem relative to failure to provide the 4-hour ENS notifica-tion, appropriate personnel will be advised of guidance concerning reporting items pursuant to 10 CFR 50.72(b)(2)(iii).

Although the closure of EM-HV-8835 isolated the IHSI flowpath from the SI pumps to the RCS cold legs for approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, the SI pumps remained functional.

Additionally, if a situation had occurred requiring IHSI, Operations Emergency procedure E.0 calls for verification of SI pump start and flow. Steps require 27

l reverification of valve lineups if no flow is indicated. EM-HV-8835 can be opened from the Control Room. Other portions of the ECCS which provide high head and low head safety injection were available during the event. EM-HV-8835 is routinely verified to be opened every shift while in power operation through hot standby. This operating routine minimizes the time EM-HV-8835 could have remained shut and remained undetected.

2.2 Reactor Core Isolation Cooling Isolation Due to Temperature Switch Design Problem at Duane Arnold Duane Arnold; Docket 50-331; LER 86-07; General Electric BWR On 3/15/86, at 1723 hours0.0199 days <br />0.479 hours <br />0.00285 weeks <br />6.556015e-4 months <br />, with the reactor shut down for a maintenance outage, the reactor core isolation cooling system (RCIC) isolated. At the time of the isolation, the portion of the daily surveillance test procedure which monitors air temperatures and temperature differentials in the steam leak detection system (SLDS) was in progress. Temperature switches and temperature differen-tial switches (TDS) in the SLDS are tested by means of a switch on the instru-m+ itself, which when taken to the READ position, will provide a signal to a re indicator on the same panel. A RCIC system isolation occurred concurrent wit- :aking RCIC area temperature differential Switch TDS-2445A to the READ position. The simultaneous trip of a relay in the SLDS cabinet containing TDS-2445A was noted by the Operator when TDS-2445A was placed to READ. The SLDS ambient high temperature annunciator was received in the control room.

This annunciator will activate on signals from some RCIC SLDS instruments, but not TDS-2445A (which provides an input to the SLDS high differential temperature annunciator). A process computer point indicat d that the RCIC system had iso-lated. However, other computer points indic<ti g a RCIC SLDS isolation signal were not present. These process computer points are sampled at a once-per-seccnd rate. The RCIC isolation was promptly reset and investigation into the cause of the isolation initiated.

Switch TDS-2445A was examined on 3/18/86, and no problems were found. The READ switch was cycled numerous times, with no SLDS annunciator, RCIC system isola-tion alarm, or RCIC isolation computer point resulting. (The examination was performed with the RCIC logic in the TEST position to prevent possible unneces-sary challenges to this safety function).

Switch TDS-2445A is a Riley Pan Alarm Model 85. This instrument model provides an input to actuation or isolation functions in the RCIC and high pressure cool-ant injection system (HPCI) SLDS, and in reactor water cleanup system logic.

It has in the past demonstrated some susceptibility to spurious signals, although there have been no similar events at Duane Arnold involving placing a switch in the READ position, and few problems within the RCIC and HPCI SLDS systems (see LERs84-028, Revision 1,85-001,85-023). The manufacturer has indicated it is aware of problems with spurious signals upon Model 86 being switched to the READ position due to an internal design problem. The signal can occur due to a difference in the ground potentials of the Model 86, and the remote indicator and can influence other instrumentation within the circuitry. The spurious actuation may or may not be repeatable. The intermediate cause of the RCIC isolation on 3/15/86 was therefore the generation of a short, spurious signal by TDS-2445A upon being placed in the READ position. The root cause of the event is an internal design problem within the switch, which has been identified 28

by the manufacturer. Iowa Electric initiated a presently ongoing design study of this problem in October 1985, following receipt of General Electric documen-tation on the subject.

The HPCI/RCIC Task Force formed to study system reliability (see LER 85-044) has recommended placing a short (approximately 1-second) time delay within the RCIC and HPCI SLDS circuitry. The reactor water cleanup system already has a short ti;ne delay in place. A time delay would eliminate violations of HPCI and RCIC due to short, spurious signals in the SLDS, such as the one generated by placing a Riley Pan Alarm Model 86 to read, but would not prevent the system from responding to a real event within the necessary time. As a corrective action for this event, a design change package is being prepared to install this time delay. As this will require declaring HPCI or RCIC inoperable per technical specifications due to lack of SLDS instrumentation, the time delay will be installed at the next opportunity, when HPCI or RCIC is either inoper-able for other reasons, or not required to be operable.

2.3 Unsealed Auxiliary Feedwater Pum) Room Penetrations Due to Inadeouate Review During Design Process at )alo Verde Palo Verde Units 1-3; Dockets 50-528, -529, -530; LER 86-25; Combustion Engineering PWRs On April 10, 1986, a walkdown of Unit 3 was being performed to review 10 CFF 50 Appendix R open items. During this walkdown, three unsealed penetrations were identified in the west wall of the two auxiliary feedwater pump rooms. The same condition was also identified in Units I and 2. These observations were evaluated by the design organization, and it was determined that the penetrations were required to be sealed.

No immediate action was required on Unit 1 since it was in cold shutdown, and the AFW pumps were not reouired to be OPERABLE. With Unit 2 in Hot Shutdown, the associated AFW pumps were declared inoperable at 2300 on April 16, 1986, and the appropriate action statement was complied with. The third Unit 2 AFW pump remained operable, since it is located in the turbine building and was not affected by this condition.

The AFW pump rooms are located in the seismic Category I main steam support structure (MSSS) and are required (by Detailed Design Criteria) to be watertight.

The Final Safety Analysis Report (FSAR) requires the AFW piping and components to be protected from high and moderate energy pipe rupture, and requires the AFW system to be designed so that conditions such as flooding and earthquakes will not impair its safety function. These events could potentially impact AFW pump operability by subjecting them to environmental conditions for which they i

have not been qualified.

An investigation was performed to determine why these penetrations had not been sealed or identified by previous walkdowns. The architectural penetration loca-tion drawings had been developed from existing civil / structural concrete floor and wall drawings. Information regarding the west wall of the MSSS had never been transfarred and, therefore, the wall and associated penetrations had never appeared on architectural penetration drawings. Since the architectural draw-ings were utilized to generate penetration seal drawin;;s and schedules, these penetrations were never identified for scaling. Therefore,, the root cause of this event was cognitive personnel error (contractor) occurring as an inadequate 29

review in the design process to ensure all applicable information was trans-ferred during the development of architectural penetration drawings. This error was contrary to an approved procedure. There were no unusual characteristics of the work location that directly contributed to this error.

As a corrective action, the penetrations were sealed in Unit 1 and Unit 2, and the Unit 2 AFW pumps were restored to an operable status at 1300 on April 17, 1986 (event duration of 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br />). The revised drawings of the MSSS west wall and associated penetrations have been issued.

A review was performed of architectural penetration location drawings for the auxiliary building and MSSS. This review represented a sample of similar pene-tration seals. No additional discrepancies were identified by this sample re-view and, therefore, this has been determined to be an isolated case of inade-quate transfer of information from civil / structural drawings to architectural drawings. No further corrective action is planned.

An assessment of the safety consequences and implications of this condition indicated that the potential existed for a flooding or steam line rupture event in the MSSS to impact the operability of both AFW pumps. The effects of these

~

events would be reduced by drainage through existing floor drains and by leak-age of water / steam past the seismic gap seal (this seal is not designed to be watertight). The third AFW pump would not be affected by these events since it is located in the turbine building. This pump is not seismically qualified, but would be available for all other events.

2.4 Inadvertent Actuation of Balance of Pitnt Engineered Safety Features Actuation System During Inspection of Cabinet at Palo Verde Palo Verde Unit 2; Docket 50-529; LER 86-20; Combustion Engineering PWR On April 28, 1986, at 2126, with Palo Verde Unit 2 in hot standby at 0% reactor power, an inadvertent balance of plant / engineered safety features actuation system (B0P/ESFAS) Train A actuation signal was initiated. This actuation was annunciated and responded to by the operators (utility-liceased) in the control room.

A Quality Assurance Inspector (contractor non-licensed) and an Instrumentation ar.d Control Technician (utility non-licensed) were inspecting the back panel of the BOP /ESFAS cabinet as part of a work order. Some wires were moved for better visibility, and this movement initiated the ESF actuation.

Diesel generator A started but did not load into the power system since the normal supply breaker to the bus was closed and power was being supplied by the Class 1E offsite power system. As expected, spray pond pump A started, and the control room ventilation dampers actuated; however, the load sequencer stalled prior to completing its operation. As a result, the essential chiller, control room essential fans, and the battery chargers did not automatically start. As an immediate corrective action, Control Room Operators started the essential chiller, and restored ventilation to the control room and power to the battery chargers. The eveat lasted 49 minutes.

30  ;

I The cause of the ESF actuation was attributed to inadequate pin contact insertion length in the load shed module. All ESF modules have been repinned in Unit I

and Unit 2. Unit 3 modules will be corrected prior to fuel load. Additionally, strain reliefs were installed to inhibit wire movement.

, The cause of inadequate pin contact insertion is suspected to be a design deficiency. An in-depth evaluation of the pin contact length has been addressed in a 10 CFR 50.55(e) and Part 21 report.

l The root cause of the sequencer stall was determined to be inattention to detail and lack of an adequate design and installation review by the vendor.

Train A B0P/ESFAS was retested satisfactorily and the sequencer functioned per '

3 design during the retest.

There were no unusual characteristics of the work location that directly con-i tributed to the event. The inspection was being conducted under the control of j a work document. Work documents are controlled by an approved work document

procedure. The work being done was not contrary to an approved procedure, and

! there were no errors in the procedure that contributed to the event. There

! were no structures, systems, or components inoperable at the start of this event

that contributed to this event.

2.5 Reactor Vessel Indications Discovered During Examination of Clad Side of Flange Face at Oconee Oconee Unit 1; Docket 50-269; Pabcock & Wilcox PWR

(An LER was not available for this event; the reference is a letter from

H. Tucker, Dukt Power Company, to H. Denton, USNRC, April 24,1986)

During March 1986, Duke Power Company (the licensee) notified the NRC that unacceptable indications had been found during an inservice inspection (ISI) at Oconee Unit 1. During the ISI, the reactor vessel to flange shell weld was ultrasonically examined from the flange face. Twenty-two indications were I recorded, all from the clad side of the flange. Only one of the indications i extended onto the unciad side of the flange. The indications were located from 24 to 32 inches from the flange. -Previous examinations conducted from the vessel inner and outer diameter surfaces as well as the unclad side of the flange face did not detect these same indications. The licensee stated that with the

! exception of one geometric reflector recorded in 1979, there were no recordable indications on this weld. The 1986 examination, however, was the first exami-nation conducted from the clad side of the flange face.

Based on the reported size, number and ultrasonic amplitude of the flaw indica-tions in a reactor vessel, other licensees have performed additional inspections to further confirm and characterize flaw indications. Duke Power Company, how-ever, elected to complete the ISI with the available examination data, install the vessel closure head and perform a fracture mechanics evaluation of the flaw indications using the measured dimensions.

Initially, the licensee evaluated the data as though the indications represented real flaws.since there was no evidence to prove otherwise. Nine of these indi-cations were acceptable when compared to the ASME Section XI accpetance stan-dard IWB-3510. The remaining 13 indications were considered acceptable by the licensee by analytical methods permitted by IWB-3600 in accordance with Appen-dix A (Section XI) procedures.

31

Because the licensee decided to resolve the issce by this analytical method, e.g., Linear Elastic Fracture Mechanics Analysis, NRC Region 11 requested that the NRC's Office of Nuclear Reactor Regulation (NRR) review the licensee's fracture mechanics evaluation.

Two meetings were held with the licensee in the NRC Region II office (April 8 and April 21,1986), during which the licensee presented their inspection results, fracture mechanics evaluation and their proposed action plan. At the April 8,1986 meeting, the licensee informed the NRC Staff that some of the reflectors may be geometric in origin. This preliminary conclusion was bared on a limited qualitative laboratory test on a reactor vessel mock-up at the licensee's Mt. Vernon, Indiana facility. However, the licensee intended to consider the flaw indications as actual flaws and to contlete the fracture mechanics evaluation based on the requirements of ASME Section XI, Subarticle IWB-3600.

The Staff reviewed the licensee's submittals, along with additional information requested during the April 21, 1986 meeting, and concluded that Oconee Unit 1 may restart and operate for 8 weeks on the condition that the licensee submit, before June 16, 1986, results on the following work effort:

. Perform a comparison of Units 1 and 3 vessel flange gecmetry, material (s) and cladding and determine why Unit 3 ISI examination of the same weld did not produce similar results; Conduct an ultrasonic examination study on the Mt. Vernon mock-up reactor vessel; and

. Review the original weld design and fabrication history, including non-destructive examination records of the weld in question.

In addition, the Staff stated that the NRC reserves the right to reevaluate its position on the above, in the event that a significant transient occurred on the Unit 1 vessel.

In a letter dated April 24, 1986, the licensee submitted their fracture mechanics evaluation and a summary of the ultrasonic testing results which located and sized the flaw indications.

NRR has concluded that Oconee Unit 1 can be safely returned to full power and operated with actual flaws of the size and circumferential locations described.

This conclusion was based on the Staff's review of the fracture mechanics analy-sis evaluation performed by the licensee, the pressure . temperature limits, and Pressurizer Code Safety Valve Setpoint contained in the Oconee Unit I technical specifications. This conclusion was supplemented with the following conditions:

. The licensee would submit, prior to June 16, 1986, a technical report sumarizing their ongoing ultrasonic testing program on the Mt. Vernon mock-up vessel.

. The Staff would review and determine whether the conclusion that the subject flaw indications are enveloped by the dimensions measured by the licensee is still conservative.

32

l .

Because the Staff considers several of the flaws as conditionally accept-l able per IWB 3122.4, three augmented ISIS based on 10 CFR 50.55a(g)(4) were required.

At least 6 mcnths before the next scheduled refueling outage, the licensee will provide a report describing detailed plans for the above augmented ISIS.

On June 13, 1986 the licensee submitted to NRR a report with the requested infor-ma tion. This report stated that preliminary results, from the data obtained at Mt. Vernon, point to a high probability that the data recorded during the Oconee Unit 1 examination indicated geometric conditions. The report provided a detailed description of the examination of the Mt. Vernon vessel mock-up using the actual calibration block and similar examination equipment to that used during the Oconee Unit 1 examination, and results from those examinations.

Specific recommendations for conducting ultrasonic examination (s) from the flange face of the reactor vessel in future ISIS were provided. These were employed in the upcoming Oconee Unit 2 IS1, performed in August 1986. The licensee's report is currently undergoing review by the Staff.

33

3.0 ABSTRACTS / LISTINGS OF OTHER NRC OPERATING EXPERIENCE DOCUMENTS 3.1 Abnormal Occurrence Reports (NUREG-0090) Issued in March-April 1986 An abnormal occurrence is defined in Section 208 of the Energy Reorganization Act of 1974 as an unscheduled incident or event which the NRC determines is significant from the standpoint of public health or safety. Under the provi-sions of Section 208, the Office for Analysis and Evaluation of Operational Data reports abnormal occurrences to the public by publishing notices in the Federal Register, and issues quarterly reports of these occurrences to Congress in the NUREG-0090 series of documents. Also included in the quarterly reports are updates of some previously reported abnormal occurrences, and summaries of certain events that may be perceived by the public as significant but do not meet the Section 208 abnormal occurrence criteria.

No Abnormal Occurrence Reports were issued during March-April 1986, i

35

3.2 Bulletins and Information Notices Issued in March-April 1986 The Office of Inspection and Enforcement periodically issues bulletins and information notices to licensees and holders of construction permits. During the period, 16 information notices were issued.

Bulletins are used primarily to communicate with industry on matters of generic importance or serious safety significance (i.e., if an event at one reactor raises the possibility of a serious generic problem, an NRC bulletin may be issued requesting licensees to take specific actions, and requiring them to submit a written report describing actions taken and other information NRC should have to assess the need for further actions). A prompt response by affected licensees is required and failure to respond appropriately may result in an enforcement action. When appropriate, prior to issuing a bulletin, the NRC may seek comments on the matter from the industry (Atomic Industrial Forum, Institute of Nuclear Power Operations, nuclear steam suppliers, vendors, etc.),

a technique which has proven effective in bringing faster and better responses from licensees. Bulletins generally require one-time action and reporting.

They are not intended as substitutes for revised license conditions or new requirements.

Information Notices are rapid transmittals of information which may not have been completely lin'alyzed by the NRC, but which licensees should know. They require no acknowledgement or response, but recipients are advised to consider the applicability of the information to their facility.

Information Date Notice Issued Title 86-14 3/10/86 PWR AUXILIARY FEEDWATER PUMP TURBINE CONTROL PROBLEMS (Issued to all power reactor facilities holding an operating license or construction permit) 86-15 3/10/86 LOSS OF 0FFSITE POWER CAUSED BY PROBLEMS IN FIBER OPTICS SYSTEMS (Issued to all power reactor facilities holding an operating license or construction permit) 86-16 3/11/86 FAILURES TO IDENTIFY CONTAINMENT LEAKAGE DUE TO INADEQUATE LOCAL TESTING 0F BWR VACUUM RELIEF SYSTEM VALVE (Issued to all power reactor facilities holding an operating license or construction permit) 86-17 3/24/86 UPDATE OF FAILURE OF AUTOMATIC SPRINKLER SYSTEM VALVES TO OPERATE (Issued to all power reactor facilities holding an operating license or construction permit) 86-18 3/26/86 NRC ON-SCENE RESPONSE DURING A MAJOR EMERGENCY (Issued to all power reactor facilities holding an operating license or construction permit) 86-19 3/21/86 REACTOR C0OLANT PUMP SHAFT FAILURE AT CRYSTAL RIVER (Issued to all power reactor facilities holding an operating license or construction permit) 36

Information Date Notice Issued Title 86-20 3/28/E6 LOW-LEVEL RADI0 ACTIVE WASTE SCALING FACTORS, 10 CFR PART 61 (Issued to all power reactor facilities holding an operating license or construction permit) 86-21 3/31/86 RECUGNITIONOFAMERICANSOCIETYOFMECHANICALENGINEERS ACCREDITATION PROGRAM FOR N STAMP HOLDERS [ Issued to all power reactor facilities holding an operating license or construction permit and all recipients of NUREG-0040 (white book)]

86-22 3/31/86 UNDERRESPONSE OF RADIATION SURVEY INSTRUMENT TO HIGH RADIATION FIELDS (Issued to all power reactor facilities holding an operating license or construction permit) and research and test reactors) 86-23 4/9/86 EXCESSIVE SKIN EXPOSURES DUE TO C0f;TAMINATION WITH HOT PARTICLES (Issued to all power reactor facilities hold-ing an operating license or construction permit) 86-24 4/11/86 RESPIRATION USERS NOTICE: INCREASED INSPECTION FRE-QUENCY FOR CERTAIN SELF-CONTAINED BREATHING APPARATUS AIR CYLINDERS (Issued to all power reactor facilities holding an operating license or construction permit; research and test reactor facilities; fuel cycle li-censees and Priority 1 material licensees) 86-25 4/11/86 TRACEABILITY AND MATERIAL CONTROL OF MATERIAL AND EQUIPMENT, PARTICULARLY FASTENERS (Issued to all power reactor facilities holding an operating license or con-struction permit) 86-26 4/17/86 POTENTIAL PROBLEMS IN GENERATORS MANUFACTURED BY ELEC-TRICAL PRODUCTS INCORPORATED (Issued to all power reac-tor facilities holding an operating license or construc-tion permit) 86-27 4/21/86 ACCESS CONTROL AT NUCLEAR FACILITIES (Issued to all power reactor facilities holding an operating license or construction permit, research and nonpower reactor facilities, and fuel fabrication and processing facilities) 86-29 4/25/86 EFFECTS OF CHANGING VALVE MOTOR-0PERATOR SWITCH SETTINGS (Issued to all power reactor facilities holding an operating license or a construction permit) 86-30 4/29/86 DESIGN LIMITATIONS OF GASE0US EFFLUENT MONITORING SYSTEMS (Issued to all power reactor facilities holding an operating license or construction permit) 37 l

____-- _ -----_______-------------.------------.----I

3.3 Case Studies and Engineering Evaluations Issued in March-April 1985 The Office for Analysis and Evaluation of Operational Data (AE0D) has as a pri-mary responsibility the task of reviewing the operational experience reported by NRC nuclear power plant licensees. As part of fulfilling this task, it se-lects events of apparent safety interest for further review as either an en-gineering evaluation or a case study. An engineering evaluation is usually an immediate, general assessment to determine whether or not a more detailed pro-tracted case study is needed. The results are generally short reports, and the effort involved usually is a few staffweeks of investigative time.

Case studies are in-depth investigations of apparently significant events or situations. They involve several staffmonths of engineering effort, and result in a formal report identifying the specific safety problems (actual or potential) illustrated by the event and recommending actions to improve safety and prevent recurrence of the event. Before issuance, this report is sent for peer review and comment to at least the applicable utility and appropriate NRC offices.

These AE0D reports are made available for information purposes and do not impose any requirements on licensees. The findings and recommendations contained in these reports are provided in support of other ongoing NRC activities concerning the operational events (s) discussed, and do not represent the position or re-quirements of the responsible NRC program office.

Special Date Study Issued Subject 5601 4/86 0FFICE FOR ANALYSIS AND EVALUATION OF OPERATIONAL DATA -

1985 ANNUAL REPORT AE00 is part of an overall NRC program to review operating experience in order to identify specific events and generic situations where the margin of safety established through licensing has been degraded, and to identify and recomend corrective actions that will restore the originally intended margin of safety. AE0D's role in the prograr, is to analyze operating experience independent of regulatory activities associated with licensing, inspection or enforcement.

The recommendations contained in AE0D studies are not final NRC positions. They are internal recommendations for action by appropriate NRC program offices (e.g., NRR, IE) or Re-gional Offices. The program office or Regional Office is responsible for reviewing and, where appropriate, implement-ing AE0D recommendations. A written response to each recom-mendation is required and a formal action tracking system has been established.

During 1984 and 1985, the NRC sought to identify potential improvements in the existing program for the investigation of significant operational events in response to a response by Congress. Brookhaven National Laboratory was contracted 38 I

Special Date Study Issued Subject by the NRC to perform a study to assess and evaluate im-provements to the program. Subsequent to that effort, the NRC staff identified a number of changes in the approach to investigating significant events. The most noteworthy change is the investigation of such incidents by a i:.alti-disciplined Incident Investigation Team (IIT), made up of technical experts from the various NRC offices. These teams prepare a single comprehensive report for each inci-dent describing the event, setting forth the relevant facts, identifying causes, and presenting findings and conclusions.

In 1985, AEOD responsibilities were expanded to include the development and support of the Incident Investigation Program.

The AE0D annual report for 1985 included results from se-lected studies, overviews of three IIT reports, summaries of abnomal occurrences involving U.S. power plants, anal-yses of 1985 licensee event reports, a review of reactor scram experience in 1984 and 1985, a review of engineered safety features actuations, and summaries of studies on loss or unavailability of safety system functions. In addition, the report provides comments and observations on 1985 operating experience involving nonreactor and medical misadministration events. Also included are summaries of studies in progress at the end of the reporting period, and a review of the status of AE00.. recommendations provided in previous reports.

Engineering Date Evaluations Issued Subject E604 3/14/86 SPURIOUS SYSTEM ISOLATIONS CAUSED BY THE PANALARM MODEL 86 THERM 0 COUPLE MONITOR Recent events involving spurious system isolations at various nuclear power plants were collected and re-viewed. The system isolations were commonly caused by spurious trips of the Model 86 thermocouple monitor manufactured by the Panalam Division of the Ametek Company. The study found that the elevated sensitivity of the Model 86 thermocouple monitor makes the instru-ment highly susceptible to spurious trips caused by momentary disturbances to the electrical circuitry.

The spurious system isolations caused by the instru-ments are undesirable because of the potentially ad-verse impacts on system reliability, isolation valve operability, and the distractions presented to the plant operating personnel. A design modification to the leak detection system trip circuitry at the Duane Arnold Energy Center has proven successful in preventing 39

Engineering Date Evaluations Issued Subject spurious system isolations. The study suggests that the Office of Inspection and Enforcement consider issu-ing an information notice which discusses the spurious system isolations caused by the Model 86 thermocouple monitor and describes the design modification imple-mented at Duane Arnold as a possible corrective action.

E605 4/29/86 LIGHTNING EVENTS AT NUCLEAR POWER PLANTS During the summer of 1985, several nuclear plants in the United States were affected by lightning strikes.

To alert licensees of the problems that were experienced by nuclear units, the Office of Inspection and Enfcrce-ment issued Information Notice 85-36, " Lightning Strikes at Nuclear Power Generating Stations" on November 5, 1985. To assess the impact that lightning strikes have had on operating nuclear plants, and to determine the safety implications of the effects of lightning, AE0D conducted a search of the licensee event report (LER) database and a review of the events thus obtained.

The search identified 62 events involving lightning for the period 1981 to 1985. The 62 events occurred at 30 plant sites and involved 32 reactor units. In comparing the number of lightning events, the geographic location of the affected units and the annual lightning strike density at the location, a direct correlation between the annual lightning strike density and the number of events is noted.

The data show that the systems affected are: (1) the offsite power system; (2) the safety-related instrumen-tation and control systems; (3) the meteorological and

- weather systems; (4) the radiation, gas and effluent flow monitoring systems; and (5) the air intake tunnel halon system.

This report documents the review of the events with regard to how lightning strikes affected these systems.

The report includes the findings of the review and con-cludes that although lightning strikes have adversely affected the operation of some nuclear plants, in most cases, there has been no significant degradation of safety and minimal equipment damage. In particular cases where damage has been extensive or where fail-ures caused by lightning strikes have been repetitive, the licensees have taken corrective actions to reduce the consequences of future strikes. (For a more de-tailed review of this study, see Power Reactor Events, Vol. 8, No.1, Section 1.7.)

40

3.4 Ger.eric Letters Issued in March-April 1986 -

Generic letters are issued by the Office of Nuclear Reactor Regulation, Division of Licensing. They are similar to IE Bulletins (see Secticn 3.2) in that they transmit information to, and obtain information from, reaca.r licen$ees, appif-cants, and/or equipment suppliers regarding matters of safety, safeguards, or environmental significance. During March and April 1986, three letters were  :

issued. -

/

Generic letters usually either (1) provide information thought to be important in assuring continued safe operation of facilities, or (2) request information on a specific schedule that would enable regulatory decisions to be made regifrd-ing the continued safe operation of facilities.~ They have been a significant means of communicating with licensees on a number of important issues, the reso-lutions of which have contributed to improved quality of design and operation.

Generic Date Letter Issued Title <

r 86-04* 2/13/86 POLICY STATEMENT ON ENGINEERING EXPERTISE ON SHIFT (Issued to power reactor licensees and applic. ants for power re' actor licenses) ,

86-07 3/20/86 TRANSMITTAL OF NUREG-1190 REGARDING THE SAN0'N0FRE UNIT 1 LOSS OF POWER AND WATER HAMMER EVENT'(Issued to all reactor licensees and applicants) ,86-008 3/25/86 AVAILABILITY OF SUPPLEMENT 4 to HUREG-0933, "A PRIORITIZA-TION OF GENERIC SAFETY ISSUES (Issuedfto all licensees of operating reactors, applicants for operating licenses, and holders of construction permits)~ -s 86-09 3/31/86 TECHNICAL RESOLUTION OF GENEP.IC ISSUE NO. B-59-(N-1)' LOOP.

OPERATION IN BWRs and PWRs s (I' sued to all licensees of $

operating BWRs and PWRs and license applicants) ,

2

~

d

• This report had not been listed in Power Reactor Events, Vol. 8,.No. ',, which j covered the January-February 1986 period.

/

41 .

s

I

_. . 3.5 Operatinb_ReactorEventMemorandaIssuedinMarch-April 1986 The Director, Division of Licensing, Office of Nuclear Reactor Regulation (NRR), disseminates information to the directors of the other divisions and program offices within NRR via the operating reactor event memorandum (OREM) system. The OREM documents a statement of the problem, background information, the safety-significance, and short and long term actions (taken and planned).

Copies of OREMs are also sent to the Offices for Analysis and Evaluation of Operational Data, and of Inspection and Enforcement for their information.

No ORENs were issued during March-April 1986.

I e

b 4

sJ e

'b a

1 42

{ .

t ,

,1 i.

.n 1

3.6 NRC Docu;nentation Compilations The Office of f.eministration issues two publications that list documents made publicly available. *

. The_ quarterly Regulatory and Technical Reports (NUREG-0304) compiles bibliographic data and abstracts for the formal regulatory and technical reports issued by the NRC Staff and its contractors.

. The monthly Title List of Documents Made Publicly Available (NUREG-0540) contains descriptions of information received and generated by the NRC.

Thisinfr/rmationincludes(1)'docketedmaterialassociatedwithcivilian nuclear power plants and other/ uses of radioactive materials, and (2) non-docketed material received and generated by NRC pertinent to its role as a regulatory agency. This series of documents is indexed by Personal Author, Corporate Source, and Report Number.

The monthly Licensee Event Report (LER) Compilation -(NUREG/CR-2000) might also -

be useful for those interested in operational experience. This document con-tains Licensee Event Report (LER) operational information that was processed into the LER data file of the Nuclear Safety Information Center at Oak Ridge during' the monthly period identified on the cover of the document. The LER summaries in this report are arranged alphabetically by facility name and then chronologically by event date for each facility, Component, system, keyword, and component vendor indexes follow the summaries. /

Copies and subscriptiens of these three documents are available from the Superintendent of Documents, U.S. Government Printina Office, .

P.O. Box 37082, Washington, DC 20013-7982. ,

. t=

1 1

1 1

4 i

6'

\

fr

, [4

\

'43- -

UNITED STATES m, m .

NUCLEAR REGULATORY COMMISSION roat = ***earmo

.E.c.

WASHINGTON, D.C. 20666 pone n n..a w 1

OFFICIAL BUSINESS PENALTY FOR PRIVATE USE. 6300 120555078877 1 1A01N411M11S1 US NRC ADM-DIV 0F PUB SVCS POLICY & PUB MGT BR-POR NUREG W-501 WASHINGTON OC 20555-i e

d 4

l l

l

- -, - - - , , . , . . - . - - , . - _ , - , . - . . . , . ,