ML20215J055

Power Reactor EVENTS.November-December 1986

ML20215J055
Person / Time
Issue date:	05/31/1987
From:	Massaro S NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
References
NUREG-BR-0051, NUREG-BR-0051-V08-N6, NUREG-BR-51, NUREG-BR-51-V8-N6, NUDOCS 8706240305
Download: ML20215J055 (42)

Text

. _ _ _ _ _ _ _ _ _ _ _ _ _

NUREGlBR-0051 Vol. 8, No. 6 f KtCy

/ ,A POWER REACTOR EVENTS i

,(... . . . . ,/ United States Nuclear Regulatory Commission Date Published: MAY 1987 Power Reactor Fvents is a bi-monthly newsletter that compiles operating experience information about commercial i I

nuclear power plants This includes summaries of noteworthy events and listings and/or abstracts of USNRC and other documents that discuss safety related or possible generic issses. It is intended to feed back some of the lessons learned from operational experience to the various plant personnel, i e., managers, licensed reactor operators, training coor-dinators. and support personnel Referenced documents are available from the USNRC Public Document Room at1717 H Street. Washington, D C. 20555 for a copying fee. Subscnptions of Power Reactor Events may be requested from the Superintendent of Documents, U.S. Covernment Printing Office. Washington, D.C. 20402, or on (202) 783-3238.

Table of Contents l Page 1.0 SUMMARIES OF EVENTS... . . . . . . . . . . . . . . . . 1 1.1 Inoperability of Pressurizer Safety Valves Due to incorrect Lift Setpoints at St. Lucie Unit 2, McGuire Unit 1, Arkansas Nuclear One Unit 2... . ... ... . . . . . . . . . . . I 1.2 Leak from Spent FuelPools Due to Loss of Air to inflatable Seals in Transfer Canal at Hatch Units 1 and 2... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. .. 4 1.3 Overpressurization and Rupture of Condensate Storage. Tank Piping Caused by inadequate Overpressure Protection and Operator Error at Fermi Unit 2.. . . . . . . . . . . . . . . 6 1.4 Discovery that Single Failures in the Control Room Ventilation System May Result in the Loss of the System at Turkey Point Unit 3.... . .. .. 11 1.5 Valve Failure to Open When Operated from the Control Room, Due to incorrect Torque Switch Setting at Oconee Unit 3 and McGuire Units 1 and 2 Update....... ... .. 13 1.6 References.. . . . . . . . . . . . . . . . . . . . . . 15 2.0 EXCERPTS OF SELECTED LICENSEE EVENT REPORTS... . . .. . . . . . . . . . .. .. 17 3.0 ABSTRACTS / LISTINGS OF OTHER NRC OPERA TING EXPERIENCE DOCUMENTS.... . .. 23 3.1 Abnormal Occurrence Reports (NUREG 0090)..... .. . . . . . . . . . . . . . . . . . . . . .. 23 3.2 Bulletins and informatran Notices... . . . . . . . . . . . . . . . . . . . . . . . . 24 3.3 Case Studies and Engineering Evaluations... .. .. . . . . . . . . . . . . . . . . . .. 27 3.4 Generic Letters... . . .. . . . . . . . . . . . . . 37 3.5 Operating Reactor Event Memoranda... . .. . . . . . . . . . . . . . . . . 38 3.6 NRC Documentation Compilotions... . . . ........., . .. . ... 39 8706240305 870531 PDR NUREo Editor: Sheryl A. Massaro BR-OO51 R PDR Office for Analysis and Evaluation of Operational Data U.S. Nuclear Regulatory Commission Period Covered: November-December 1986 Washington, D.C. 20555

UNITED STATES

1. jp F80uq'o NUCLEAR REGULATORY COMMISSION

,E g WASHINGTDN, D. C. 20565

% E

• %...../

NOTE TO RECIPIENTS: QUESTIONNAIRE ON USE OF POWER REACTOR EVENTS Following an agency-wide reorganization, the NRC is in the process of assessing the need for and use of certain information feedback publications.

Your responses to the questionnaire on the fol-lowing page will help us determine the kinds of j individuals that will find Power Reactor Events '

to be informative, the ways in which the informa-tion provided is used, and how the document could be made more useful.

The reverse side of the questionnaire forms a preaddressed, franked envelope. Simply fold the page so that the address is on the outside, and staple or otherwise secure. We would appreciate return of the questionnaire by July 31, 1987.

If you prefer, responses may be phoned in to Sheryl Massaro on 301-492-4493 or to Jack Crooks on 301-492-4425.

1

QUESTIONNAIRE ON USE OF POWER REACTOR EVENTS e Regarding presentation of operating experience at nuclear power plants, I find that:

O The publication provides a good spectrum of information O Other publications are more timely and more complete O I receive no new information from this publication e Regarding Section 1 of the report, the event summaries generally:

O Clarify or fully explain the event, and thus are useful O Confuse or muddle the event, and thus have little utility e Regarding the Licensee Event Report excerpts in Section 2:

O The information provided generally is interesting and useful O The excerpts are of limited use e Please provide suggestions on what types of events Sections 1 and 2 should emphasize (e.g., events involving human error, equipment failure, inadequate maintenance, procedure deficiencies, etc.):

• Regarding Section 3, I find the listings of the various NRC information feedback documents to be:

O Useful as reference sources O Of little interest e i find this publication in general to be:

O Factual and objective O Biased e Power Reactor Events should be published:

O Bimonthly l 0 Quarterly O Not at all 1

e Please briefly describe your reasons for subscribing to Power Reactor Events, including specific uses of the  !

information (e.g., operator training, maintenance improvements, procedure changes, etc.):

• Please provide suggestions on the kinds of information that would make this report more useful:

• Please state your type of company (e.g., utility, vender, architect / engineer, State agency, etc.) and your position:

N

y 9

0 4

4 8

s e

e t

i e

e 8

e e

0 0

e e

9 e

e B

s e

1 5

e 0

0 8

4 8

a e

e e

S e

8 FOLD HERE l .....................................................................................

e UNITED STATES ",0c7,8',^G' s ,y l NUCLEAR REGULATORY COMMISSION , ,

'F u A8 0 8 WASHINGTON. D C. 20666 UNITED STATE $

OFFICIAL BUSINESS e

e PENALYY FOR PRIVATE USE $300 M m

m

i. BUSINESS REPLY Mall ,,,,

l FIRST CLASS PERMIT NO.12904 WASHINGTON DC M f POSTAGE WILL BE PAID BY ADDRESSEE B

m l U. S. Nuclear Regulatory Commission M l ATTN: S. Massaro M l EWS 263 l Washington, DC 20555 8

4 0

4 8

0 0

0 8

4 l ......................................................................................

l FOLD HERE 8

8 8

8 8

4 4

0 I

e 1

8 8

0 8

0 0

0 0

9 8

8 0

8 I

I 8

0 0

9 8

0 0

I 8

8 8

8 8

8 8

9 4

1.0 SUMMARIES OF EVENTS 1.1 Inoperability of Pressurizer Safety Valves Due to Incorrect Lift Setpoints at St. Lucie Unit 2, McGuire Unit 1 Arkansas Nuclear One Unit 2 On November 4, 1986, the NRC issued Inspection and Enforcement Information Notice 86-92, " Pressurizer Safety Valve Reliability," which briefly summarized three events-involving the inoperability of pressurizer code safety relief valves due to incorrect lift setpoints. The purpose of the pressurizer safety valves is to ensure that the primary reactor coolant system (RCS) pressure will not exceed a predetermined value over design pressure. The valves involved are manufactured by the Crosby Valve and Gauge Company. The events discussed in the information notice and their corrective actions are detailed

.below.

St. Lucie Unit 2*

On April 17, 1986, during a normally scheduled outage, with the reactor vessel head removed, two out of three pressurizer code safety relief valves (Crosby, type NB-BP-86) failed to lift within the required pressure limits of the tech-nical specification. The lift setting of the third valve could not be deter-mined due to excessive seat leakage. The required lift setting for the pres-

^

surizer code safety valves is 2500 psia i 1% at normal operating temperature.

At' test temperature, the required lift setpoint is 2515 i psi 1%. (Valve V-1200 lifted at 2554 psi, V-1201 lifted at 2893 psi, and V-1202 leaked too much to obtain a lift setpoint.)

The plant normally rebuilds all three of these valves every refueling outage.

This is more than is required by the ASME Boiler and Pressure Vessel Code Section XI, which requires testing only one valve as long as that valve passes. l When V-1201 was disassembled it was found that the bellows was ruptured. This allowed boric acid in the RCS to get at the valve internals. The boric acid caused extensive corrosion of some of the carbon steel components. This cor-resion caused excessive binding that resulted in the lift setpoint being too high. The setpoint of V-1200 was only 14 psi out of tolerance. No cause was found other than normal drift over the course of an 18-month cycle. Due to steam cutting of the seats of V-1202, the bench test rig did not have enough capacity to overcome the seat leakage. This prevented obtaining an as-found reading before the valve was torn down for rebuilding. The failure modes of each valve appear to 'oe unrelated to each other.

No immediate corrective actions were required since the reactor vessel head was already removed when the valves were tested and thus there was no requirement for them. When the first valve failed to lift, additional testing of the safety valves was conducted as required by the ASME Code. All of the pressurizer

• St. Lucie Unit 2 is an 837 MWe (net maximum dependable capacity) Combustion Engineering PWR located 12 miles southeast of Ft. Pierce, Florida, and is operated by Florida Power and Light Company.

1

code safety valves were rebuilt and bench test.ed satisfactorily tefore the reactor vessel head was replaced. (Ref. 1.)

McGuire Unit 1*

On September 2, 1986, RCS pressurizer code safety relief valve INC-1 (Crosby, HB-BP-86, size 6M6, type E) lifted with the unit in hot standby and RCS pressure at approximately 2375 psig. After valve 1NC-1 lifted, RCS pressure decreased to approximately 1800 psig before the valve reseated, a 24% decrease in system pressure.

An RCS leak test was being performed at the time of the incident. The leak test requires that RCS pressure be increased to approximately 2400 psig with the unit in hot standby, while a system inspection is performed. RCS pressure was being closely monitored as it increased. When operators in the control room received an indication of valve INC-1 lifting, they observed RCS pressure and temperature. When RCS pressure decreased to 1955 p,sig, an operator blocked the pressurizer low pressure safety injection (SI) actuation signal, which automati-cally activates at 1845 psig. Valve 1NC-1 reseated almost immediately after the SI signal was blocked. RCS pressure reached a ninimum of 1800 psig during the transient.

Valve 1NC-1 was declared inoperable, and a work request was written to investi-gate and repair the valve. The unit was taken to cold shutdown. A spare pres-surizer code safety relief valve was removed from stock, tested and subsequently installed in place of the valve that lifted at the incorrect pressure. On September 5, valve INC-1 was declared operable.

Licensee personnel and the valve manufacturer's representative investigated the reasons valve INC-1 lifted early and caused extended RCS pressure blowdown.

They " popped" the valve several times on the relief valve test bench, and the valve consistently lifted at approximately 2318 psig. Further investigation showed that, prior to installation, the valve was tested on June 7,1985. The three recorded lift pressures were 2500, 2461, and 2430 psig, respectively. In addition, the adjusting ring was discovered to be mispositioned, which would cause extended blowdown.

On September 4, 1986, the adjusting ring settings on valves 1NC-2 and 1NC-3 were verified. The adjusting ring of valve INC-3 was set correctly, but the adjusting ring on valve INC-2 was mispositioned. Licensee personnel and the valve manu-facturer's representative correctly positioned the adjusting ring on valve 1NC-2.

Affected piping, supports, and snubbers were inspected following the lifting of valve INC-1. All system components were verifieu operable, with no degradation.

No work request affecting valve 1NC-2 revealed valve maintenance to the extent the adjusting ring would have been repositioned from the original factory set-ting. Valve 1NC-2 was originally a spare pressurizer code safety relief valve.

Some spare valves were tested under " miscellaneous equipment" work requests prior to plant startup. The adjusting ring may have been adjusted during early testing, but this could not be determined.

• McGuire Unit 1 is a 1150 MWe (net maximum dependable capacity) Westinghouse PWR located 17 miles north of Charlotte, North Carolina, and is operated by Duke Power Company.

l 2

51 A search of the available operating experience data systems was performed on the Crosby code safety relief valve, style number HB-BP-86, size 6M6, type E. The search revealed that other utilities have discovered these valves lifting below their documented setpoints on approximately eight occasions for 65 valves.

.These failures were discovered during periodic testing. No other utilities lreportedvalvesactuallyliftingearlyduringplantoperation.

'f,.

Valve INC-1 will be sent to the Wyle Laboratory for further testing. Licensee personnel in conjunction with Wyle Laboratory personnel will determine whether a~ any correlation factor due to hot versus cold testing of the pressurizer code safety relief valves needs to be incorporated in valve maintenance and testing procedures. (Ref. 2.)

Arkansas Nuclear One (ANO) Unit 2*

On September 24, 1986, the unit tripped from 100% power on high RCS pressure

,following a trip of the main turbine. The cause of the trip of the main tur-bine was due to a secondary system transient. Post trip evaluation of.the transient data showed indications that a pressurizer code safety relief valve (Crosby, type HB-BP-86) may have partially lifted prematurely during the event.

On September 25, 1986, mechanical maintenance personnel performed in situ testing on the valves to determine the lift setpoints. This testing indicated that the setpoints were below the technical specification minimum required setpoint value.

The valves were declared inoperable. With both valves inoperable, the unit entered the requirements of Technical Specification 3.0.3. A plant cooldown was commenced. The unit reached hot shutdown and remained in that condition to perform additional valve testing.

The valve manufacturer was contacted and a representative from the manufacturer was brought on site. On September 26, mechanical mair.~

• nance personnel, with assistance from the valve manufacturer representative, performed additional in situ valve testing to determine the valves' lift setpoints. These tests con-firmed the lift setpoints were below the minimum value of 2475 psia. The valves were adjusted to increase the lift setpoints, and were tested satisfactorily.

The ANO Unit 2 pressurizer code safety valves discharge to an in-containment quench tank. The discharge piping from the valves to the quench tank contains a resistance temperature detector and acoustic detector for each valve. Review of the transient data for these monitoring devices for the reactor trip on Sep-tember 24 indicated that flow from valve 2PSV-4633 had occurred. The transient data for the RCS indicated that the maximum pressure reached during the reactor trip was approximately 2400 psia, and that no abnormal decrease in RCS pressure had been experienced. Based on this data, it was suspected that a premature, partial lift of 2PSV-4633 had occurred. Operations personnel stated that no unusual actions were required to be taken to respond to the trip or to stabi- J lize the plant following the trip.

J

• Arkansas Nuclear One Unit 2 is an 858 MWe (net maximum dependable capacity)

Combustion Engineering PWR located 6 miles west-northwest of Russellville, 1 Arkansas, and is operated by Arkansas Power and Light Company. l 3

\

The in situ testing performed on the valves indicated that the lift setpoint for valve 2PSV-4633 was 2425 psia, and was 2450 psia for valve 2PSV-4634. Both valves were adjusted to increase the lift setpoints and were retested. Final lift setpoints attained were 2510 psia and 2503 psia, respectively.

Both valves had been replaced during a recently completed refueling outage.

Valve 2PSV-4633 had been refurbished by Wyle Laboratories during the outage, and valve 2PSV-4634 had been refurbished by Wyle in early 1986. The certifica-tion test reports supplied with these valves indicated acceptable final lift setpoints. A review of the procedures and test methods used by Wyle to measure and adjust the lift setpcints of the valves produced no evidence as to why the valves were found out of specification.

The root cause of this event has not been determined. Future corrective actions include engineering evaluations being conducted to attempt to identify the root cause of the low safety valve set pressures. (Ref. 3.)

As stated in Information Notice 86-92, a search of licensee event reports from January 1, 1983 to the present shows that 20 other events related to pressurizer safety valve problems involving 32 valves have occurred. The problems included 18 valves with setpoint drift, 12 valves with seat leakage, one valve with set pressure high, and one valve designated as inoperable. Other information on the subject of safety valve performance and reliability may be found in Informa-tion Notices 86-05, issued January 31, 1986, 86-05, Supplement 1, issued Octo-ber 16, 1986, and 86-56, issued July 10, 1986. The subjects of these informa-tion notices are main steam safety valves.

1. 2 Leak From Spent Fuel Pools Due to Loss of Air to Inflatable Seals in Transfer Canal at Hatch Units 1 and 2 On December 2, 1986 at Hatch,* a Plant Equipment Operator (PE0), in the process of restoring a clearance on air drop station valves, noticed an air valve in a not fully shut position (mid position). Since an Operations Department letter of February 3, 1986 required that all hose station valves in use be tagged open on.a clearance, the PE0 closed this partially open, untagged, air valve. The valve closed by the PE0 isolated the single air supply to the transfer canal's six inflatable seals. The inflatable seals, not being entirely leak tight, slowly deflated (from December 2 at 10:00 p.m. until the pressure was restored on December 3 at 10:30 p.m.), creating a leak path from the refueling pool into the gt.p between the two reactor buildings, and from there to areas of Unit 1 and 2 reactor buildings, Unit 1 and 2 turbine buildings, the control building, the' hot machine shop, the nitrogen storage area, and to a swamp located on licensee property /la the storm drain system. The fuel pool level dropped about 5.5 feet (141 J00 gallons) below the normal level before the seals were rein-flated. Represcurization of the inflatable seals stopped the loss of water from the fuel peol. Unit 1 was at full power at the time of this event, and Unit 2 was in cold shutdown following refueling.

Causes contributing to the event included the following:

i 1 -. I

• Hatch Unit 1 it a 768 MWe (net maximum dependable capacity) and Unit 2 is a 777 MWe (net) .'1DC General Electric BWR. They are located 11 miles north of Baxley, Georgia and are operated by Georgia Power. q 4

(1) Neither a deficiency report nor a maintenance work order had been written when the air regulator supplying air to the transfer canal seals was found defective (at an unknown date) and a valve in the same line was throttled to control air to the seals.

(2) The air valve to the transfer canal seals was not tagged open on a clearance in accordance with the Operations letter of February 3, 1986.

This letter also implies that all non-tagged hose station valves should be closed.

(3) The pressure to the transfer canal seals was not required to be monitored on a regular basis, even though the pressure to other inflatable seals on the refueling floor was monitored.

(4) The design of the transfer canal seals was such that redundant air supplies could have been used for the inner and outer seals. As built, only a single air source supplied all six seals. This was the air source which was isolated, initiating the event. l (5) The leak detection system, designed to detect leakage past the transfer canal seals, was inoperable due to improper valve position (i e. , the I drain valve was open) but, due to its design, could possibly nave been I incapable of performing its alarm function upon loss of all air pressure to the seals even with the drain valve closed.

(6) The design of the seal leak detection system was also subject to a common mode failure of the single air supply to all seals. Due to the design of the leak collectors, leakage will only be directed to the leakage detection system if the seals in the gap between the two buildings are leak tight.

This seal is not leak tight as shown by this event. Sufficient water must accumulate in the building gap above the inflated s6al to reach the hori-zontal drain from this area to the leakage collection system.

The licensee's cleanup and recovery organization consisted of senior plant man-agement, directing the containment and recovery efforts of maintenance, opera-tions, health physics and chemistry, emergency planning, and engineering. Al-though the Technical Support Center (TSC) was not officially activated, the licensee utilized the TSC for planning and directing the cleanup and recovery activities. The TSC was manned for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> per day with two shifts. The li-censee staff was well organized and utilized various applicable status boards as well as onsite and offsite maps for ease of information flow.

During the night of December 3 and the morning of December 4, 1986, the licensee took positive and effective action to determine the extent of and to limit the spread of contamination. A series of water samples were collected to determine which outfalls contained contaminated water. Additionally, a series of small  !

dikes (dams) were constructed in the swamp to minimize the spread of the contam-ination. The licensee promptly performed radiation surveys of the affected buildings and the outfall area of the swamp pool to determine the extent of the release. It was estimated that 141,500 gallons of water were released from the 1

fuel pool. The licensee estimated that 17,500 gallons were processed through the radwaste system, 80,000 gallons were released to the swamp, and 44,000 gal-lons were between the reactor buildings. The maximum amount of radioactive material that could have been released was approximately 0.373 curies (based on a volume of 124,000 gallons).

5

During the afternoon of December 4, 1986, direct radiation readings along the outfall which led to the swamp ranged from 1 to 2 mrem /hr. Direct radiation readings along the shoreline of the swamp ranged from 150-250 uR/hr (normal readings were typically 8-10 uR/hr). Water sample results at the location identified as a potential pathway to the river indicated no detectable activity.

The water from behind the dikes and at the entrance to the swamp pool was pumped back to tanker trucks, filtered through demineralizers, and then dis-charged through the plant radwaste system with all normal discharge precautions in place.

Fuel pool to transfer canal gates were installed on December 4, and by Decem-ber 5 the air supplies were configured such that the transfer canal gate seals were fed from both units such that the inner seals were supplied from one unit and the outer seals were supplied from the other unit, thus achieving redundancy.

Also, by December 6 the transfer canal seals were pressurized from each unit such that a single loss of air supply would not cause the seals to deflate.

In plant cleanup activities were ongoing, while the swamp sampling and cleanup were progressing. In plant cleanup activities were directed in the following main areas: (1) the nitrogen storage tank area; (2) the hot machine shop; (3) the asphalt area outside the hot machine shop; and (4) portions of the east cable way at the 130-foot elevation of the Unit 1 and Unit 2 reactor buildings.

A temporary roof was put on the nitrogen storage tank building and contaminated portions of the asphalt area outside the hot machine shop area were temporarily covered with Herculite (trademark) until the surface could be removed and repaved.

The licensee replaced the damaged cable tray insulation on the east cable ways, and initiated extensive cleanup activities in the hot machine shop. Addition-ally, engineering personnel performed an evaluation to determine the amount of water contained along the wallG of the Unit 1 and Unit 2 reactor buildings, turbine buildings, control building, and radwaste buildings and, whether that water needed to be removed from between buildings and processed through the radwaste treatment system. It was determined that no further action is required.

The operators' response to the event once the spill was noticed was commend-able; however, they were not alert to the changing fill rates of the fuel pool during the seal failure period. Had each refill of the fuel pool been logged in either the Plant Operator's log or the Shift Supervisor's log, the increased frequency might have been noticed and corrective action taken prior to complete depressurization of the seals. (Ref. 4).

1.3 Overpressurization and Rupture of Condensate Storage Tank Piping Caused by Inadequate Overpressure Protection and Operator Error at Fermi Unit 2 On November 17, 1986, during system restoration while Fermi Unit 2* was in cold shutdown, an incorrect valving sequence resulted in damage to the test return line for the condensate storage tank (CST) and condensate return tank (CRT), and the release of water to the CST /CRT area diked basin. Most of the f

• Fermi Unit 2 is a 1093 MWe (design electrical rating) General Electric BWR j located in Frenchtown Township, Michigan, and is operated by Detroit Edison. I The plant currently is authorized to operate at 50% power.

6

water which entered the diked basin eventually was absorbed into the ground.

On December 1, however, some of the water which had collected in the cable vaults on November 17 was inadvertently released to the outflow canal. The first event was caused by inadequate design of the piping to the CST and CRT for potential overpressurization, and was contributed to by a personnel error involving actions which were not in accordance with procedure. The second event also was caused by a personnel error which resulted from actions which were not in accordance with procedure. As corrective actions, the tank and piping damage were repaired, the affected procedures and checklist were improved, personnel involved in the overpressure event were disciplined, required reading was implemented, design reviews were performed, overpressure and overflow protection was added for the CST and CRT, and a liner was installed in the CST /CRT diked basin. These events were not contributed to by any component or system failures. They are detailed below.

At 7:30 p.m. on November 17, 1986, Fermi Unit 2 was in cold shutdown, with the reactor at 150 degrees F, 0 psig, and 0% reactor power. While restoring the control rod drive minimum flow line to service, an incorrect valving sequence resulted in overpressurization of test return line piping to the condensate storage tank (CST) and condensate return tank (CRT).

The incorrect valving sequence and subsequent overpressurization which resulted caused failure of the bellows located in the CST test return line, failure of a seal weld at the CST /CRT test return line connection to the CST, and the uncon-trolled release of some of the slightly contaminated water from the CST /CRT diked basin.

At 8:22 p.m. on December 1, 1986, some of the spilled water which had accumu-lated in the underground cable vaults as a result of the November 17 spill was inadvertently released offsite. Both the spill which resulted from the CST test return line seal weld failure and the subsequent release from the cable vaults resulted in liquid effluent releases which were within the concentration and dnse limits stated in 10 CFR 20 and technical specifications, but were not performed in a manner which is in accordance with the Fermi Unit 2 Offsite Dose Calculation Manual (00CM).

The operations activity which was being performed prior to the first event and which initiated the event was being performed by a Power Plant Operator (PP0)

(non-licensed, utility) following a maintenance activity. During the restora-tion, the PPO opened the valves in an incorrect sequence.

Procedurally, the responsibility for providing direction on the return of equip-ment to service is delegated to the Nuclear Supervising Operator (NS0); however, neither the checklist which was being used by the PP0 to restore the valve lineup nor the NSO (licensed, utility) who directed the system to be restored specified that either the CRT or CST isolation valve needed to be open before the test return line isolation valve could be opened.

As a result of the PP0 not being directed with regard to the proper valving sequence, he opened the test return line isolation valve without first opening a tank isolation valve. During the time when the test return line isolation valve was open and the tank isolation valves were closed, the CRD pumps were operating and providing flow to the CRD mechanisms. The CRD pumps also were aligned to the test return line through the minimum flow line.

7 1' '

i U '

CRD line pressure can be up to 1400 psig at pump shutoff. Since neither of the tank isolation valves was open during this event, pressure in the test return line increased until a metal bellows expansion joint in the CST test return

.line ruptured. The test return line dislocation which resulted when the bellows ruptured resulted in damage to the test return line piping connection at the bottom of the CST.

In addition to failure of the metal bellows located in the CST piping and failure of the welded connection between the CST floor and the test return line, over-pressurizing the test return line caused the following damage to the test return line piping: deformation of the metal bellows located in the CRT piping; defor-mation of the CST floor, and deformation of several hangers and supports. The ,

CRT maintained its structural integrity throughout the event.

The reture line standpipe is seal welded to the CST floors, and is positioned directly above an underground valve room. The CST return line bellows that failed also is located in this valve room. Because of the location of the weld and the CST return line bellows, an unisolable leak from the CST resulted when these components failed.

The loss of CST inventory began at approximately 7:30 p.m. on November 17, and continued until about 10:40 p.m. The CST test return line seal weld and bellows failure was first noticed by control room personnel at 7:35 p.m., when a sump high water level alarm was received in the main control room for the CST valve room. Main control board indications of rapidly decreasing CST level also were noted at the time the alarm was received.

i As a result of the CST break, water filled the CST and the CRT valve rooms.

This caused the valve room sump pump for each room to automatically start. At '

this time, sump pump discharge flow was being routed to the waste collector tank at a total rate of approximately 100 gallons / minute. Upon discovery of the CST leak, the valves in the CST valve room were deenergized at 7:40 p.m.,

and efforts were initiated at 7:55 p.m. to minimize the amount of spilled CST water by transferring the CST inventory to the CRT.

The flow to the CRT was subsequently routed to the waste collector tank. When the waste collector tank became full, CRT flow was diverted to the waste surge tank. The overflow water which resulted when the waste collector tank became full was collected on the radwaste building floor and was subsequently routed through the floor drain system to the radwaste building floor drain collector tank.

When the CST valve room filled with water, the piping and conduit tunnel which connects the valve room to the radwaste building and the turbine building also flooded. The spilled water leaked into the radwaste building and the turbine building through conduit runs, and ultimately took residence in the radwaste building floor drain tank and the turbine building basement. Some of this water also flowed to the underground cable vaults.

Flow through the weld break and bellows stopped at about 10:40 p.m. when CST level had drained to the seal weld elevation. When the leak stopped, several feet of water had collected in the CST /CRT diked basin, and the radwaste build-ing basement had approximately 1 to 2 inches of standing water as a result of 8

I

overflow from the radwaste building floor drain tank (10,000 to 15,000 gallons).

The turbine building basement was also partially covered with a small amount of water.

Prior to the event, the CST contained about 365,000 gallons of water. Based on a CST water inventory performed after the event, it was determined that the l amount of water which was ultimately spilled into the CST /CRT diked basin was  !

gpproximately 275,000 gallons, and that approximately 100,000 gallons of the l CST inventory was recovered. Approximately 69,000 gallons of the recovered water was transferred to various collection tanks during the event. Another 32,000 gallons of the recovered water remained in the CST after the leak flow stopped. None of the spilled CST water was discharged to the sanitary sewage system as a result of this event.

After the event, air and water samples were taken by Health Physics at the diked basin, the radwaste building basement, and the turbine building basement. Addi-tionally, water samples were taken from Lake Erie at a location adjacent to the CST /CRT diked basin, and soil samples were taken from the CST diked basin.

Analysis of the spill water samples taken after the event was independently performed by both the licensee and the NRC. The results of these analyses con-cur, and indicate that the spilled water contained approximately 5.3E05 micro-curies /ml of hydrogen-3 in the form of tritiated water, and 1.2E08 microcuries/ml of cobalt-58. No other gamma emitting radioisotopes were identified as present during the spill water sample analysis. Samples of water taken from Lake Erie after the spill were also taken and analyzed. No detectable radioactivity was found in the lake water samples.

The activity level of the spilled water corresponds to approximately 2% of the maximum permissible concentration (MPC) allowed for radioactive liquid effluent releases to an unrestricted area in 10 CFR 20 Appendix B, Table II, Column 2.

Soil samples from the CST diked basin were analyzed and indicated trace levels of tritium and radiocobalt. No detectable radioactivity was identified in any of the air samples.

As previously noted, some of the spilled water entered the conduit tunnel and took residence in the underground cable vaults. Samples of water taken from the vaults indicate that the water which was trapped in the vaults consisted of diluted water spilled from the CST., Based on analysis, it was determined that the spilled water in the cable vaults had been diluted to approximately one-half to one-tenth concentration by non-contaminated water from natural sources, such as precipitation and groundwater, which had collected in the vaults.

On December 1,1986, at 10:22 p.m. , it was discovered that the water in one of l the cable vaults was being pumped to the outflow canal. Investigation after {

the event determined that the maintenance person (non-licensed, utility) who I had directed pumping of the cable vault had not informed the Nuclear Shift Supervisor (NSS) (licensed, utility) of the pumping activities prior to initia-tion, as required by procedure. It is estimated that 1360 gallons of the diluted spilled water from the cable vaults was inadvertently released offsite via the outflow canal between approximately 6:45 p.m. and 10:22 p.m.

9

Approximately 80,000 gallons of the diluted spi,lled water was recovered from the cable vaults and processed as radwaste. Based on analysis, the concentration of the released effluent was within the limits of 10 CFR 20 for release to an unrestricted area. The dose to a member of the public as a result of the cable vault release was accounted for during the radiological assessment of the spill from the CST and was within the limits established in technical specifications.

The first event (the damage to the CST and the subsequent effluent release) was caused by inadequacy in the design of the CST and CRT test return line over-pressure protection to mitigate an event involving a personnel error. The per-sonnel error in the first event was performed by the NSO, who was responsible for properly restoring the CRD minimum flow line, and involved actions which were not in accordance with procedures.

The second event was caused by a personnel error involving a person not notifying the NSS that the cable vaults were being pumped, and resulted from actions which were not in accordance with procedures. These events were not contributed to by any structures, components, or systems which were inoperable at the start of the event.

The following corrective actions were taken:

(1) An electrical valve interlock was added to prevent simultaneous closure of the CST and CRT isolation valves during normal operations. This will aid in preventing CST and CRT overpressurization.

(2) Three pressure relief valves (RVs) were added to the piping connections to the CST and CRT. These RVs are sized and designed to prevent tank over-pressurization and releases by providing relief flow to the CST /CRT diked basin.

(3) The earthen CST /CRT diked basin floor was covered with a liner to facilitate the recovery of water from any leak or spill from the CST or CRT.

(4) The damage to the CST piping and hangers was repaired or reworked.

(5) Overflow gutters were installed on the CST and CRT to prevent any tank overflow from splashing outside the diked basin.

(6) An alarm was installed to warn control room personnel that CST or CRT overflow conditions exist.

(7) The procedures which control the return of equipment to service and the checklist used to perform off-normal valve lineups were improved, personnel were trained on the revised procedures, and required reading was provided regarding valve manipulations and returning equipment to service.

(8) The personnel involved in the overpressurization event were disciplined.

(9) A review of plant design to determine other potential overpressurization threats was performed, and recommended modifications from the review were implemented.

10

(10) A review of plant design was being performed to determine other potential radiological release pathways.

(11) Sampling and analysis of diked basin soil is being performed in order to determine the need for further action regarding contamination of the diked basin soil.

(12) The procedure used to control the pumping of liquids offsite was revised to require permission prior to initiation of pumping liquids offsite.

(13) The CRD return line was redesigned to prevent CRD related overpres- i surization events, and selected valves and piping were upgraded with l components which are rated for higher pressures. ,

During this event, the reactor was depressurized and the availability of a suction flowpath from the CST to the high pressure coolant injection (HPCI) and reactor core isolation cooling (RCIC) systems was not required. A flowpath to HPCI and RCIC systems from the suppression chamber was available during this event, and was not affected by the event. With regard to the effluent releases, the dose consequence to a member of the public as a result of both events has ,

been calculated to be far below the 3 millirem per year limit imposed by the Fermi Unit 2 technical specifications.

1.4 Discovery that Single Failures in the Control Room Ventilation System May Result in the Loss of the System at Turkey Point Unit 3 On December 18, 1986, with Turkey Point Units 3 and 4* at 100% power, it was determined that a deficiency existed concerning the potential for loss of three air conditioner compressors and three air handlers of the control room ventilation system (CRVS). An engineering evaluation of the CRVS, following the loss of control room air conditioning due to the transfer switch sticking during a safeguards test on July 26, 1986, revealed the concerns. The evalua-tion concluded that during CRVS operation, should a loss of power from motor control center (MCC) 3A occur, and the transfer switch stick between its two positions (MCC 3A and MCC D), no control circuit power will be available, and the CRVS air conditioning compressors and air handlers will be disabled. This condition constituted a substantial safety hazard (SSH), as defined by 10 CFR 21.

The single active failures of the thermostat or temperature controller were also identified. The transfer switch unavailability due to the single failure will be reduced to an acceptable level by verifying its operability on a weekly basis.

Quick-connect jumpers have been installed around the control circuitry of the air conditioner compressor units. Once connected, these jumpers will override operation of the thermostat and the temperature controller. Details of the emergency evaluation and corrective actions are discussed below.

On December 18, 1986, a licensee engineering evaluation of the CRVS (which was undertaken following the loss of control room air conditioning due to the

• Turkey Point Unit 3 is a 666 MWe (net maximum dependable capacity) Westinghouse PWR located 25 miles south of Miami, Florida, and is operated by Florida Power

& Light Company.

11

transfer switch sticking during a safeguards test on July 26,1986) revealed the concerns for the potential loss of the CRVS during an accident.

At Turkey Point, the design basis for the heating and air conditioning portion of the CRVS is to maintain an lnvironment which does not exceed 120 degrees F and 95% relative humidity. In order to satisfy this design basis, one of the three air conditioning compressors and one of the three air handling units would be required to be operating.

The temperature control circuit is normally powered from MCC 3A. MCC 3A is tem-porarily deenergized after a loss of offsite power, during sequencer operation.

Upon loss of power from MCC 3A, the transfer switch in panel DP-312A functions to transfer the power source from MCC 3A to MCC D.

Based on the above, the engineering evaluation concluded that during CRVS opera-tion, should a loss of power from MCC 3A occur, and the transfer switch fail to transfer between the two positions (MCC 3A and MCC D), no control circuit power will be available, and all CRVS air conditioning compressors and air han-diers will be disabled. Should this occur, the maintenance of a control room environment which does not exceed the design basis cannot be assured. This may result in the failure of safety-related components which are located in the con-trol room, due to potentially high temperatures and relative humidity. This in turn may substantially inhibit the ability to safely shut down and/or main-tain the units in a safe shutdown mode.

The engineering evaluation also identified two other single active failures which placed the units outside their design basis. These are the failure of the thermostat, or failure of the temperature controller. Failure of either of these components would result in the loss of control power to all three air conditioning compressors, with the air handlers continuing to operate.

However, as the air handlers will continue to operate, the average control room air temperature would not exceed that required for equipment protection, and therefore no substantial safety hazard would exist.

Until permanent design changes are implemented, the panel DP-312A transfer switch unavailability due to a single failure will be reduced to an acceptable level by the implementation of a plant maintenance instruction to verify the operability of the transfer switch on a weekly basis. This surveillance has been entered in the " Schedule of Plant Checks and Surveillances," to assure timely performance of this surveillance.

In addition, quick-connect jumpers have been installed around the control cir-cuitry for the air conditioner compressor units. These jumpers are not connected during normal plant operation. Once connected, these jumpers will override operation of the thermostat and the temperature controller, thus eliminating any impact on the air conditioning compressors from the failure of either of these devices. No specific time limit is required for the restart of the air condi-tioning compressors with continued air handler operation.

A training brief was issued by the licensee, describing the concern, the above modifications, and the weekly surveillance. Upon identification, the concern and corrective measures were discussed with the shift operators. (Ref. 6.)

12

1.5 . Valve Failure to Open When Operated from the Control Room, Due to Incorrect Torque Switch Setting at Oconee Unit 3 and McGuire Units 1 and 2 - Update This event was first discussed in Power Reactor E' vents, Vol. 7, No. 5, pp. 13-14.

It is updated based on information provided in NRC Information Notice (IN) 86-93, "IEB 85-03 Evaluation of Motor-0perators Identifies Improper Torque Switch S ttings," issued November 3, 1986.

On October 15, 1936, an unsuccessful attempt to open an electric motor-operated (EMO) valve (3LP-2) was made from the Oconee Unit 3* control room. Unit 3 was in hot shutdown after. coming off-line.for maintenance. The valve is required

'to open in order to initiate the decay heat removal cooling mode.

The cause of the incident was the torque switch settings on the valve. Rotork valve actuator settings were not set high enough to operate the valve under system pressure. The settings for opening and closing the valve were both at 1, as they had been set at the factory. These settings were adequate for factory testing, but were not-intended to be the settings for the valve actuator in the field. The torque switch settings were not specified to be any different in the design modification package. Rotork Control, Inc. also did not specifically state the torque switch settings in their " Instruction Manual for Rotork Valve Actuators." A contributing cause for the event at Oconee was that the mainte-nance procedure for Rotork limit / torque switch settings was not written to set torque switches for valves that cannot-be cycled under normal operating condi-tions and system pressures. Also, because it contains conditional steps.for setting the opening and closing of torque switches, the opening torque switch setting step was never required to be performed. This step, if performed, would have set the torque switch setting to the maximum setting, 5.

The immediate corrective action was to open the affected valve from the valve actuator contactors at the motor control center, bypassing the valve actuator's torque switch limit control circuit. In addition, a review was performed for potential generic problems relating to the problem of not specifying the torque settings on design documents for implementation of new valve actuator installa-tions. A similar review also was performed in response to the NRC's Inspection and Enforcement Bulletin (IEB) 85-03, " Motor-0perated Valve Common Mode Failures During Plant Transients Due to Improper Switch Settings," issued on November 15, 1985, 1 month after the Oconee event.

The licensee also found that similar problems with valves operated by Rotork valve actuators existed at another of their nuclear power stations, McGuire Units 1 and 2.** These and other findings are discussed in IN 86-93. Specifi- i cally, the problem at McGuire involved valves for which the factory-set torque (

switch settings had been previously changed at the plant site using a generic j correlation between actuator torque output and torque switch setting. This )

• 0conee Unit 3 is an 860 MWe (net maximum dependable capacity) Babcock & Wilcox PWR located 30 miles west of Greenville, South Carolina, and is operated by Duke Power Company.

• • McGuire Units 1 and 2 are each 1150 MWe (net maximum dependable capacity) West-inghouse PWRs located 17 miles north of Charlotte, North Carolina, and are operated by Duke Power Company.

13

could cagse valve actuator motors to switch off before the valves complete their travel. Arbitrarily raising the torque switch setting to its maximum may result in damage to the valve and/or motor especially since thermal overload protection has been e!iminated in many applications. ,

Rotork Control, Inc., has stated that whenever the factory torque switch is changed in the field, an individual calibration curve or a bench test is required to accurately determine torque output. According to information provided by Rotork, torque switch settings of 1, 2, 3, 4, and 5, do not always correspond to rated torque output values between 40% and 100% as was used based on general information available several years ago. Tests and analytical evaluations by the licensee now confirm that the correlation used by the licensee was incorrect for some actuators. For example, evaluation of several valve actuator certif-icates for the same model revealed that the actual torque output with a switch setting of 1 varied through a range of 11% to 55% of actuator torque output.

The review did not indicate a variation in maximum output at the number 5 setting.

Preliminary data indicate that up to 41 nuclear units may have some Rotork valve actuators. It is not known whether or not these are used in safety-related applications.

The McGuire finding spec $fically deals with improper setting of the torque switches, and illustrates the need for exercising extreme care in the setting of motor-operator switches because all types of switches must be set properly to ensure that the valves will function properly when needed. Other instances have involved actuators manufactured by a company other than Rotork (Limitorque).

In addition, care must be taken to ensure that all of the ramifications of changes to any of the motor-operator switenes are fully understood. For instance, NRC IN 86-29, " Effects of Changing Valve Motor-0perator Switch Settings," issued April 25, 1986, describes how the changing of the limit switches on certain motor-operater valves resulted in a control room indication that the valves were closed when, in fact, they were partially open.

1 14

1.6 References (1.1) 1.- Florida Power & Light' Company, Docket 50-389, Licensee Event Report 86-07, May 19, 1986.

2. Duke Power _ Company, Docket 50-369, Licensee Event Report 86-16, October 2, 1986.

3. Arkansas Power & Light Company, Docket 50-386, Licensee Event Report f 86-12,-October 26, 1986. i (1.2) 4. NRC Region II, Inspection Report 50-321&50-366/86-41, January 7, 1987.

(1.3) 5. Detroit Edison, Docket 50-341, Licensee Event Report 86-45, January 12, 1987.

(1.4) 6. Florida Power & Light Company, Docket 50-250, Licensee Event Report 86-40, December 23, 1986.

l These referenced documents are available in the NRC Public Document Room at 1717 H Street, Washington, DC 20555, for inspection and/or copying for a fee.

(AE0D reports also may be obtained by contacting AE0D directly at 301-492-4484 or by letter to USNRC, AE00, EWS-263, Washington, DC 20555.)

15

2.0 EXCERPTS OF SELECTED LICENSEE EVENT REPORTS ,

On January 1,1984,10 CFR 50.73, " Licensee Event Report System," became effec-tive. This new rule, which made significant changes to the requirements for licensee event reports (LERs), requires more detailed narrative descriptions of the reportable events. Many of these descriptions are well written, frank, and informative, and should be of interest to others involved with the feed-back of operational experience.

This section of Power Reactor Events includes direct excerpts from LERs. In general, the information describes conditions or events that are somewhat un-usual or complex, or that demonstrate a problem or condition that may not be obvious. The plant name and docket number, the LER number, type of reactor, and nuclear steam supply system vendor are provided for each event. Further information may be obtained by contacting the Editor at 301-492-4493, or at U.S. Nuclear Regulatory Commission, EWS-263A, Washington, DC 20555.

Excerpt Page 2.1 Qualification Deficiency Discovered in Environmentally Qualified Cable Splices in the Drywell Penetrations at Dresden Unit 3................................................ 17 2.2 Diesel Generator Differential Relays Found Not Seismically 19 Qualified at Millstone Unit 2.................................

2.3 Radioactive Waste Spill in the Radwaste Building Resulting from Incorrect Valve Position on Piping and Instrumentation Diagram at Susquehanna Unit 1................................. 19 2.4 Contaminated Water Spill Due to Mispositioned Drain Valves at Susquehanna Unit 2......................................... 20 2.5 Loss of Offsite Power Due to Severe Winter Storm at Pilgrim..... 21 2.1 Qualification Deficiency Discovered in Environmentally Qualified Cable Splices in the Drywell Penetrations Dresden Unit 3; Docket 50-249; LER 86-24; General Electric BWR On December 5, 1986, with Unit 3 in the run mode at 99% power, Dresden person-nel were notified by the Engineering Department that butt splices manufactured by AMP Industries similar to those located in three primary containment elec-trical penetrations on Unit 3 had not passed a recent environmental qualifica-tion (EQ) test conducted by Wyle Laboratory. Since all of the Unit 3 safety-related high pressure injection and pressure relief systems were affected by <

the EQ splice deficiency, a Generating Station Emergency Plan (GSEP) Unusual Event was declared at 1430 hours0.0166 days <br />0.397 hours <br />0.00236 weeks <br />5.44115e-4 months <br /> on December 5, and a normal unit shutdown was commenced.

17

During an audit of the Dresden Station environmental qualification program per-formed May 19 through May 23, 1986, the NRC had expressed concern with the EQ documentation file for the AMP butt splices found in the three electrical penetrations. Specifically, the NRC noted that the environmental qualification test documentation supplied by General Electric (GE) for the affected electrical penetrations, did not describe the splices installed or indicate the condition of the splices at the end of the test. As such, the NRC did not feel that simi-i 1arity between the AMP butt splices and those tested by GE could be established.

In response to the NRC concern, the licensee for Dresden committed to include additional information in the EQ documentation file for the splices.

Although no commitment had been made to the NRC to conduct any further EQ testing of the splices, the licensee made a decision to subject the splices to additional EQ testing. A total of eight AMP butt splices were removed from an electrical penetration at the Quad-Cities Station (two GE BWRs). The splices had been exposed to approximately 12 years of aging (thermal and radiation) while in- i stalled at Quad-Cities. An initial test was conducted at Wyle Laboratory on November 21 through 26, 1986, using four of the AMP butt splices. The four AMP butt splices were aged for 5 years and then subjected to a simulated LaSalle Station (GE BWR) loss-of-coolant accident (LOCA) profile. Upon completion of the test, inspection revealed that the nylon insulation on the butt splices was no longer intact. Because the LaSalle Station LOCA profile is more severe than the Dresden and Quad-Cities Station profiles, the initial test was considered invalid, and a second test was conducted using four more butt splices.

The second test was conducted on December 4 and 5, 1986. The test simulated the postulated LOCA profile for Dresden and Quad-Cities, with the exception of the accident level radiation dose. The samples were irradiated in excess of 1.0E05 rads rather than the required 1.18E08 rads. The splices tested had been exposed to approximately 12 years of aging (thermal and radiation) at Quad-Cities. Wyle subjected the samples to aging and radiation sufficient to add an additional year. After this aging and irradiation, the samples were inspected and tested for insulation resistance. The samples showed no sign of fatigue and exhibited a high insulation resistance. The samples were then put into a LOCA chamber and energized for the start of the LOCA test. Two samples were energized with 528 V and two samples were energized with 132 V. During the preheat of the LOCA chamber and before the actual LOCA test, one of the 528 V samples began shorting to ground and blew its fuse. At this point, the temperature in the chamber had reached only 150 F. The test was continued with two other specimens blowing fuses at the 20-second point and at the 2-hour, 23-minute point of the test. The fourth sample finished the test, but excessive leakage currents were measured. The licensee notified the NRC of the AMP splice failure by telephone on December 5, 1986, in accordance with 10 CFR 21.

The deficient AMP butt splices were used to connect field cables from equipment located in the primary containment to electrical penetration leads. Failure of these splices would have affected valves in the high pressure coolant injection system, the reactor recirculation system, and other systens which do not perform emergency core cooling functions but are part of the primary containment isola-tion system. All of the deficient splices were repaired by taping with an environmentally qualified tape and using a qualified procedure.

18

2.2 Diesel Generator Differential Relays Found Not Seismically Qualified Millstone Unit 2; Docket 50-336; LER 86-15; Combustion Engineering PWR On November 14, 1986 at 1500 hours0.0174 days <br />0.417 hours <br />0.00248 weeks <br />5.7075e-4 months <br />, while the plant was shut down for refueling, an evaluation of General Electric (GE) Model 12 CFD differential relays was l received. The evaluation prepared by GE Engineering staff concluded Model 12 l CFD differential relays were not seismically qualified for Class 1E service at Millstone Unit 2.above the 30-foot elevation. The Class 1E equipment affected by this evaluation were the emergency diesel generators.

The evaluation prepared by GE Engineering was in response to NRC's IE Information Notice 85-82, " Diesel Generator Differential Protection Relay Not Seismically Qualified." The information notice was provided to alert licensees of a poten-tially signifitant safety problem involving a GE Model 12 CFD relay that is not seismically qualified for Class 1E service in the deenergized state of operation.

The non qualified relays could have caused the feeder breaker for both emergency diesel generators tc trip during a design basis seismic event, rendering both diesel generators irgereble. Both diesel generators were immediately declared inoperable; core alterati>ns were halted and containment integrity was verified in accordance with Technical Specifications 3.8.1.2 and 3.8.2.2.

The immediate corrective action was to remove the relays from service, thus returning the emergency diesel generators back to Class 1E service. The relays provide equipment protection in the event of an electrical fault and are not used for any safety-related function. A Plant Design Change Request (PDCR) was processed to change the differential relays from Model 12 CFD to Model 12 IJD, which meets all seismic criteria. The only difference between the two relays is the coil pickup threshold current, which is 100 milliamps lower for type IJD. The relays were installed and the diesel generators started and tested for operability.

2.3 Radioactive Waste Spill in the Radwaste Building Resulting from Incorrect Valve Position on Piping and Instrumentation Diagram Susquehanna Unit 1; Docket 50-387; NRC Inspection Report 50-387/82-24; General Electric BWR During routine processing of liquid radioactive waste (LRW) at 6:30 a.m. on October 22, 1986, the B waste mixing tank "not available" light, and the chemical RW sump hi-hi level alarms were received in the radwaste control room.

An operator investigating the reason for the alarms discovered water flowing out from under the decontamination room door on the 646-foo'. elevation of the RW building. All radwaste processing activities were terminated and the waste mixing tank room was entered, where several inches of watt.> were found on the floor.

i Further investigation found that the B filter cake discharpe valve (HV-062278) {

was not fully closed, even though it indicated closed on the LRW filter panel.

Valves HV-06227 A&B are 16-inch, 4-way solenoid, air-operated knife gate valves at the outlet of the A&B LRW filters in line to the A&B waste mixing tanks, and 19

l are used to transfer sludge buildup from the filters to the waste mixing tanks for processing. An operator had previously isolated the valve's air supply and vented the valve operator's accumulator with the valve in the closed position.

Although a high level alarm was received on the local panel at elevation 646 feet for the B waste mixing tank, no reflash of the trouble alarm was received in the RW control room.

Inventory of the LRW collection and sample tanks indicated that approximately 8,000 gallons of waste water was transferred through HV-062278 to the 8 waste mixing tank, which overflowed to the catch basin and floor drains. A drain from the catch basin directs waste water to the RW building chemical RW sump, which in turn pumps waste water to the chemical waste tank and also has an overflow to the RW building LRW sump. The increase in level in the chemical waste tank accounted for 3500 gallons of the waste, while it is estimated that approximately 3000 gallons were returned to the LRW collection tanks from the LRW sump. Ap-proximately 1000 square feet of floor space on the 646-foot elevation was con-taminated due to backup of floor drains and overflow of the catch basin and sumps with an estimated 600 gallons present in the decontamination room. Maximum

~

radiation levels recorded were 120 mR/hr immediately following the spill with average contamination levels of 25K DPM/100 sq. cm. Decontamination activities were promptly initiated and access to the area was restored.

The air supply to HV-062278 was restored, and the valve was visually observed to move approximately 1/4 inch in the closed direction. The licensee believes that system pressure on this type of valve may cause it to lift off its seat when air is removed from its operator. Leakage through HV-06227 A&B has been observed by the licensee on previous occasions when the valves have not been mechanically blocked closed. Although it was known by some of the operators that these valves need to be mechanically blocked to prevent leakage, it was not documented or implemented in procedures. Mechanical blocking is presently only imposed on those valves which are to be placed in a position other than that in which they fail. The operator who removed the air supply from the valve operator assumed by the system drawing that the valve would fail closed on removal of the air supply. Piping and instrumentation diagram (P&ID) M-162 incorrectly indicates the valve operator as fail closed on loss of air since it shows a spring on the valve operator which does not actually exist. The valve actually fails as-is on loss of air and fails closed on loss of power with air available. The licensee is currently evaluating the situation to determine if this drawing discrepancy is an isolated case or exists on any other P& ids, and is initiating a program to correct the discrepancies.

2.4 Contaminated Water Spill Due to Mispositioned Drain Valves Susquehanna Unit 2; Docket 50-388; NRC Inspection Report 50-388/86-26; )

General Electric BWR At 4:00 p.m. on October 22, 1986 with Unit 2 starting up at 120 psig and 346 F, high pressure coolant injection (HPCI) was being aligned to perform the 150 psig flow test as required during the startup sequence from its first refueling outage. Initial alignment requires opening the bypass valve (HV2F100) around the main steam inboard supply valve (HV2F002) to allow warmup and pressure equal-ization in the HPCI steam supply line. During this evolution, a walkdown of the system was being performed when an operator observed some steam in the re-sidual heat removal (RHR) Division I pump room. Upon investigation, the operator 20

l discovered water spraying down onto the floor from a drain line off of the HPCI l steam line. HPCI was immediately isolated, Health Physics was notified, and two in-series drain valves (2F134A and 2F135A) on the line to the A RHR heat exchanger which had been left open were closed. Approximately 750 gallons of t'ater spilled into the RHR pump room. Decontamination efforts proceeded rapidly, and no personnel were contaminated.

The licensee determined that drain valves 134A and 135A were left open because they were not listed on either of the divisional checkoff lists (COLs) but were on a common COL due to their location in the common steam supply header. Al-though the common COL had been performed on September 27, 1986, it is believed that the two drain valves had been left open following work which had been per-formed on two pressure control valves in the steam supply line. Thus, when the lineups for the individual divisions were performed, the 134A and 135A valve positions were not verified.

To prevent a recurrence of this event, the licensee will now require that, in addition to the individual division COLs, common COLs will always be performed whenever work involves an individual division.

l 2.5 Loss of Offsite Power Due to Severe Winter Storm Pilgrim; Docket 50-293; LER 86-27; General Electric BWR At about 0819 on November 19, 1986, Pilgrim was in cold shutdown with the mode switch in the " Refuel" position, when a severe winter storm caused a loss of offsite power (LOP). In response to the LOP, both emergency diesel genera-tors automatically started and loaded, supplying power to the emergency buses.

All other engineered safety features also responded as expected for the existing plant configuration, including appropriate portions of the primary and secondary containment isolation systems and the reactor protection system.

The Pilgrim offsite power distribution system consists of an onsite 345 kV ring bus which connects the main and startup auxiliary transformers to two 345 kV transmission lines. At the time of the LOP, both transmission lines tripped as designed due to near simultaneous, detected faults.

Investigative efforts were coordinated with the regional power transmission control center. Onsite efforts focused on the switchyard, with interviews and inspections conducted to verify proper operation during the LOP and to attempt to locate the source of the fault. Interviews with personnel in the switchyard area verified that no unusual or unexplained noises or responses were observed.

Simultaneously, the transmission center dispatched personnel to check the distribution lines.

At approximately 1015, the two lines were reenergized with the respective dis-connect switches open in the plant switchyard. Neither line indicattJ a continu-ing fault, and observers in the switchyard witnessed no problem. About 1 minute later, the plant switchyard was partially reenergized to verify its ability to operate. Again no faults or problems were indicated, and at about 1128 the balance of the switchyard and remaining transmission line were reenergized. At about 1133 normal power restoration was begun, with full restoration completed at approximately 1238.

21

4 i

A follow up inspection of the transmission lines was performed with a helicopter as soon as the local weather would permit. No physical degradation or failure was observed.

Based on the inspections and investigation results, and the severity of the storm, it was concluded that the LOP was attributable to arcing of the high voltage lines due to locally heavy ice and snow.

Besides the availability of the diesel generators, power remained available throughout this event from the local grid via the 23 kV supply to the shutdown auxiliary transformer. Though not used, this backput supply provided an additional margin of safety.

22

3.0 ABSTRACTS / LISTINGS OF OTHER NRC OPERATING EXPERIENCE DOCUMENTS 3.1 Abnormal Occurrence Reports (NUREG-0090) Issued in November-December 1986 An abnormal occurrence is defined in Section 208 of the Energy Reorganization Act of 1974 as an unscheduled incident or event which the NRC determines is significant from the standpoint of public health or safety. Under the provisions i of Section 208, the Office for Analysis.and Evaluation of Operational Data reports abnormal occurrences to the public by publishing notices in the Federal Register, and issues quarterly reports of these occurrences to Congress in the NUREG-0090  ;

series of docuinents. Also included in the quarterly reports are updates of .

some previously reported abnormal occurrences, and summaries of certain events i that may be perceived by the public as significant but do not meet the Section 208 abnormal occurrence criteria.

No abnormal occurrence reports were issued during November-December 1986.

23

3.2 Bulletins and Information Notices Issued in November-December 1986 The Office of Inspection and Enforcement periodically issues bulletins and information notices to licensees and holders of construction permits. During the period, 23 information notices, two information notice supplements, and one information notice revision were issued.

Bulletins' are used primarily to communicate with the industry on matters of generic importance or serious safety significance (i.e., if an event at one reactor raises the possibility of a serious generic problem, an NRC bulletin may be issued requesting licensees to take specific actions, and requiring them to submit a written report describing actions taken and other information NRC should have to assess the need for further actions). A prompt response by affected licensees is required and failure to respond appropriately may result in an enforcement action. When appropriate, prior to issuing a bulletin, the NRC may seek comments on the matter from the industry (Atomic Industrial Forum, Institute of Nuclear Power Operations, nuclear steam suppliers, vendors, etc.),

a technique which has proven effective in bringing faster and better responses from licensees. Bulletins generally require one-time action and reporting. l They are not intended as substitutes for revised license conditions or new l requirements. j Information Notices are rapid transmittals of information which may not have been completely analyzed by the NRC, but which licensees should know. They require no acknowledgement or response, but recipients are advised to consider the applicability of the information to their facility.

Information Date Notice Issued Title 86-14 12/17/86 OVERSPEED TRIPS OF AFW, HPCI, AND RCIC TURBINES Sup. 1 (Issued to all power reactor facilities holding an operating license or construction permit) 86-21 12/4/86 RECOGNITION OF AMERICAN SOCIETY OF MECHANICAL Sup. 1 ENGINEERS ACCREDITATION PROGRAM FOR N STAMP HOLDERS (Issued to all power reactor facilities holding an operating license or construction permit) 86-82 11/4/86 FAILURES OF SCRAM DISCHARGE VOLUME VENT AND DRAIN Rev. 1 VALVES (Issued to all power reactor facilities holding an operating license or construction permit) 86-90 11/3/86 REQUESTS TO DISPOSE OF VERY LOW-LEVEL RADI0 ACTIVE WASTE PURSUANT TO 10 CFR 20.302 (Issued to all power reactor facilities holding an operating license or construction permit) 86-91 11/3/86 LIMITING ACCESS AUTHORIZATIONS (Issued to all power reactor facilities holding an operating license or construction permit, and fuel fabrication and processing facilities) 24

Information Date 4 Notice _ Issued Title 86-92 11/4/86 PRESSURIZER SAFETY VALVE RELIABILITY (Issued to all PWR facilities holding >an operating license or con-struction permit) 86-93 11/3/86. IEB 85-03 EVALUATION OF MOTOR-0PERATORS IDENTIFIES IMPROPER TORQUE SWITCH SETTINGS (Issued to all power reactor facilities holding an operating license or

. construction permit) (See Section 1.5 of this issue, pp. 20-21.)

86-94 11/6/86 .HILTI CONCRETE EXPANSION ANCHOR BOLTS (Issued to all power reactor _ facilities holding an operating license or construction permit) 86-95 .11/14/86 LEAK TESTING 10 DINE-125 SEALED SOURCES IN LIXI, INC.

IMAGING DEVICES AND BONE MINERAL ANALYZERS (Issued to all licensees authorized to use Lixi, Inc. imaging devices) 86-96 11/20/86 HEAT EXCHANGER FOULING CAN CAUSE INADEQUATE OPERABILITY OF SERVICE WATER SYSTEMS (Issued to all power reactor facilities holding an operating license or construction permit) 86-97 11/28/86 EMERGENCY COMMUNICATIONS SYSTEM (Issued to all power reactor facilities holding an operating license or construction permit, and fuel facilities) 86-98 12/2/86 0FFSITE MEDICAL SERVICES (Issued to all power reactor facilities holding an operating license or construction permit) 86-99 12/8/86 DEGRADATION OF STEEL CONTAINMENTS (Issued to all power reactor facilities holding an operating license or construction permit)86-100 12/2/86 LOSS OF OFFSITE POWER TO VITAL 8USES AT SALEM 2 (Issued to all PWRs or BWRs holding an operating license or construction permit)86-101 12/12/86 LOSS OF DECAY HEAT REMOVAL DUE TO LOSS OF FLUID LEVELS IN REACTOR COOLANT SYSTEM (Issued to all PWRs holding  ;

an operating license or construction permit) '86-102 12/15/86 REPEATED MULTIPLE FAILURES OF STEAM GENERATOR HYDRAULIC SNUBBERS DUE TO CONTROL VALVE SENSITIVITY (Issued to all power reactor facilities holding an operating '

license or construction permit)86-103 12/16/86 RESPIRATOR COUPLING NUT ASSEMBLY FAILURES (Issued to all power reactor facilities holding an operating license or construction permit, and fuel facilities) 25

Information Date.

Notice Issued Title 86-104 12/16/86 UNQUALIFIED BUTT SPLICE CONNECTORS' IDENTIFIED IN QUALIFIED PENETRATIONS (Issued to all PWRs and BWRs holding an operating license or construction permit)86-105 12/19/86 POTENTIAL FOR LOSS OF REACTOR TRIP CAPABILITY AT.

INTERMEDIATE POWER LEVELS (Issued to all'PWRs and BWRs holding an operating license or construction permit)86-106 12/16/86 FEEDWATER LINE BREAK (Issued to all power reactor facilities holding an operating license or construc-tion permit) l 86-107 12/29/86 ENTRY INTO PWR CAVITY WITH RETRACTABLE INCORE DETECTOR '

THIMBLES WITHDRAWN (Issued to a111 power reactor facilities holding an operating license or construc-tion permit) 3 86-108 12/29/86 DEGRADATION OF REACTOR COOLANT SYSTEM PRESSURE BOUNDARY RESULTING FROM BORIC ACID CORROSION (Issued to all PWR facilities holding an operating license or construction permit)86-109 12/29/86 DIAPHRAGM FAILURE IN SCRAM OUTLET VALVE CAUSING R0D INSERTION (Issued to all BWR facilities holding an operating license or construction' permit)86-110 12/31/86 ANOMALOUS BEHAVIOR OF RECIRCULATION LOOP FLOW IN JET PUMP BWR PLANTS (Issued to all BWR facilities holding-an operating license or construction permit) i t

26

3.3 Case Studies and Engineering Evaluations Issued in November-December 1986 The Office for Analysis and Evaluation of Operational Data (AE0D) has as a primary responsibility the task of reviewing the operational experience reported by NRC nuclear power plant licensees. As part of fulfilling this task, it selects events of apparent safety interest for further review as either an engineering evaluation or a case study. An engineering evaluation is usually an immediate, general assessment to determine whether or not a more detailed protracted case study is needed. The results are generally short reports, and the effort involved usually is a few staff weeks of investigation time.

Case studies are in-depth investigations of apparently significant events or situations. They involve several staff months of engineering effort, and result  !

in a formal report identifying the specific safety problems (actual or potential) illustrated by the event and recommending actions to improve safety and prevent recurrence of the event. Before issuance, this report is sent for peer review and comment to at least the applicable utility and appropriate NRC offices.

These AE0D reports are made available for information purposes and do not impose any requirements on licensees. The findings and recommendations contained in these reports are provided in support of other ongoing NRC activities concerning the operational event (s) discussed, and do not represent the position or requirements of the responsible NRC program office.

Case Date Study Issued Subject C603 12/86 A REVIEW 0F MOTOR-0PERATED VALVE PERFORMANCE This study provides an assessment of motor-operated valve assembly operating experience, and identifies failure modes and overall valve operator performance. The study brings together and reviews previous NRC studies and documents, reviews operating experience from 1981 to the present, and incorporates new data from an NRC valve testing program which utilizes signature tracing techniques on valves in operating plants. This report also responds to action item 6(i) of the actions directed by the NRC Executive Director for Operations (E00) to respond to the NRC staff investigation of the June 9,1985 event at Davis-Besse.

AE00 Report C203, issued in May 1982, which addressed the valve operator-related events during 1978, 1979, and 1980, included several generic recommendations. The 1982 report identified several events involving deficiencies with set-tings of torque switches, limit switches and valve operator motor burnout. The major recommendations were: (1) improved methods and procedures for the setting of torque switches should be developed and evaluated relative to valve oper-ability and functional qualification under accident condi-tions; (2) signature tracing techniques (such as measurement of electrical current and voltage applied to the motor) 27

l Case .Date Study Issued Subject C603 should be developed and used as part of the inservice test (cont' d) program with the objectives to serve as an indicator of

. changes in operability characteristics (e.g., aging, inadequate adjustment or maintenance) and a predictor of the remaining margin of failure; (3) the guidance to bypass i

' thermal overload protective devices associated with motor-operated valves should be reassessed; and (4) follow-up action pertaining to IE Circular 77-01, "Halfunction of Limitorque Valve Operators" [ Note: these valves failed to open in a manner similar to the June 9, 1985 event at Davis-Besse] should be conducted because events similar to the concerns identified continue to be reported. In addi-tion, the issue of valve operator motor burnout was again reviewed in AEOD Report S503, issued in September 1985.

That investigation determined that motor burnout was still occurring and appeared to be occurring more frequently, and recommended expedited implementation of the plans to address motor burnout. (See Power Reactor Events, Vol. 7, No. 5, issued May 1986, p. 31, for a brief summary of S503.)

This current study represents an extension and update of the past reports. Operating events from 1981 to the present that were retrievable from two broad databases were reviewed.

The events reviewed included 565 LERs (1981 to the present) from the Sequence Coding and Search System (SCSS), and more l than 600 events for 1984 and 1985 from the Nuclear Plant Reliability Data (NPRD) System. Review of these data indicates that recent motor-operated valve events ~ involve failures that are similar to those observed in earlier studies, and there is no apparent improvement in the rate of failure. Thus, the previous recommendations are still valid. Most of the valve inoperability was associated with items such as torque switch / limit switch settings, adjust-ments, or failures; motor burnout (over 200 events); improper sizing or use of thermal overload devices; premature degradation related to inadequate use of protective devices; damage due to misuse (valve throttling, hammering of valve operator); mechanical problems (loosened parts or improper assembly); or the bypass circuit around the torque switch not being installed or improperly set. In many events, however, the root causes of failure to operate were not specifically determined and/or reporte'd. Thus, the issue of valve performance and reliability is a complex subject that involves several technical disciplines.

In addition, the review of the data from 1981 to the present suggests two new areas for concern. The area of primary concern involves undetected valve failures. That is, a valve would be deemed operable based on a surveillance test, but actually would not operate during the next demand. An 28

Case Date Study Issued Subject C603 apparently successful surveillance test process can result (cont'd) in a situation in which there is component failure (e.g.,

motor burnout, operator parts failed, stem disc separation) or improper positioning of protective devices (e.g. , thermal overload, torque switch, limit switch) that are not detected in the test. These failures, or improper positionings, can render the valve inoperable for the next demand and remain undetected because there are inadequate status indication features to alert plant operators about the true condition of the valves. The other new item is associated with reversing the direction of valve motion while it is already being operated, such as attempting to close a valve that was being opened. This process could exceed design require-ments with resultant valve failure, but the scope of this problem cannot be determined from the available data.

The most important conclusion from this study concerning valve assembly operability and performance / reliability is that current methods and procedures at many operating plants are not adequate to assure that motor-operated valve assemblies will operate when needed (e.g., under credible accident conditions). The limited NRC test program utilizing signature tracing equipment demonstrated there were several safety-related valves in operating plants that exhibited deficiencies which could prohibit valve operation under accident conditions even though the valve had operated under test conditions. The most common deficiencies involved incorrect adjustments that were undetected by existing plant procedures intended to assure operability, such as surveillance testing (plant technical specifications and ASME Code,Section XI inservice testing) or operator observations. Thus, assurance of valve operability appears to be strongly dependent upon diagnostic capability to correctly assess and evaluate valve assembly failures to operate so that root causes of failure, including erroneous switch setpoints, are correctly determined and proper changes are implemented. l AE00 believes that a concerted, high priority licensee effort is needed to develop and implement improved guidance, ,

procedures, and/or equipment to address all aspects of safety-related motor-operated valve assembly operability.

Acceptable methods are needed to address the issues covered in the recommendations below:

(1) An effort to implement the recommendations presented in AE00 Case Study C203 and AE0D Special Study $503 should be expeditiously implemented.

(2) Licensees should be required to establish procedures and diagnostic capability to determine root causes of failure to operate in order to establish programs 29

Case Date Study Issued Sub, Ject C603 that will provide assurance of motor-operated valve (cont'd) assembly performance and reliability under accident conditions.

(3) Licensees should be required to develop a strong training program to ensure that appropriate informa-tion and instructions are disseminated to operating and maintenance personnel. This effort should re-ceive site management support.

(4) The scope of IE Bulletin 85-03 should be extended to cover all safety-related motor-operated valve assem-blies required to be tested for operational readiness in accordance with 10 CFR 50.55 a (g). (Bulletin 85-03, " Evaluation of Motor-0perators Identifies Im-proper Torque Switch Settings," is also discussed in l Section 1.5 of this report, pp. 20-22.)

The overall goal is that these improved plant procedures and practices be routinely implemented in order to provide assurance of motor-operated valve assembly operability and reliability. If effective licensee action is not forthcom-ing after a reasonable period of time, regulatory action should be implemented on an expedited basis.

C604 12/86 EFFECTS OF AMBIENT TEMPERATURE ON ELECTRONIC COMPONENTS IN SAFETY-RELATED INSTRUMENTATION AND CONTROL SYSTEMS This report documents the review and evaluation of four  ;

events involving failures of solid state electronic com-ponents in safety-related instrumentation and control systems l due to overheating. Failures of electronic components in safety-related instrumentation systems lead to malfunctioning control systems, plant transients, inoperability of instru-mentation channels in protection systems, inadvertent actuations and/or failures of safety systems, and erroneous indications and alarms in the control room. Unless plant operators are made aware of and trained in the potential consequences and behavior of plant instrumentation systems exposed to elevated ambient temperatures, such failures, especially common cause failures, can lead to unsafe l

operation of the plant.

This review was initiated by an event that occurred at McGuire in June 1984, during which the control area ventila-tion system was inoperable for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Based on this event, and a resulting initial AE0D study, Information Notice 85-89,

" Potential Loss of Solid-State Instrumentation Following Failure of Control Room Cooling," was issued in November 1985, to alert licensees of operating nuclear plants of the event and concerns. Three other events were subsequently identified in which the root cause of failure 30 i

l 1

l I

l Case Date Study Issued Subject C604 of the instrumentation system was determined to be over- ,

(cont'd) heating of electronic components located in cabinets in a  ;

controlled environmental area. These events occurred at  !

Davis-Besse, Palo Verde 1, and Summer 1. t

)

The review of these events found that, in general, '

identifying elevated room ambient temperatures or instrument  ;

cabinet internal temperatures as the root cause for the '

failure of electronic components has not been immediate or easy. Licensees, over an extended period, experienced several failures and many corrective actions before finally identifying overheating of components as the underlying reason for many of the failures they had experienced, l'

Technical specifications regarding area ventilation cooling systems and instrumentation systems also were yeviewed, and were found to be inadequate with respect to the temperature rating of electronic components in the instrument cabinets. l In addition, a review of the staff's proposed resolution of NRC's Unresolved Safety Issue A-44, regarding design adequacy and capability of instrumentation and control  !

system equipment needed to function in environmental condi- '

tions associated with a station blackout, found that addi-tional actions were warranted. Specifically, plant specific evaluations are needed with regard to the actual temperature and condition of heat sensitive components inside instrument cabinets. '

Overheating of electronic components in safety-related instrumentation and control systems raises two concerns:

(1) decreased reliability of electronic equipment due to increased failure rate of printed circuit cards and other heat sensitive electronic components, and (2) the potential for common cause failure of redundant safety-related instru-mentation channels due to extended loss of normal cooling air flow to the cabinets in which the instruments are located. These concerns are generic to all operating nuclear units that utilize solid state electroMc components.

Based on this study's findings and conclusions, recommenda-tions which address these two concerns are provided in the J report. The recommendations address: (1) the establishment of procedures and training of operators to cope'with loss of cooling to instrument cabinets, (2) the need to monitor s actual conditions (specifically, temper'ature) in instrument cabinets, (3) the need for plant technical specification requirements governing the operability of control rcom cooling and ventilation systems which reflect actual tem-perature in the instrument cabinets, and (4) the need for specific considerations of this issue in the plant specific 31

.. .. w

l01

St ['

a Case Date Study Issued Subject C604) evaluation and resolution of the station blackout issue.

(cont'd) (See also Power Reactor Events, Vol. 8, No. 5, Section 1.5, l.. " Inadvertent Engineered Safety Features Actuation and Sub-sequent Reactor Trip at Palo Verde Unit 1 - Update," pp. 8-9.)

C605 12/86 OPERATIONAL EXPERIENCE INVOLVING LOSSES OF ELECTRICAL INVERTERS This report provides a study on operational experience involving losses of electrical inverters. The report con-tains (1) a review of previous activities in this area by both the NRC and industry groups; (2) an analysis and evaluation of inverter loss events which occurred during 1982, 1983, and 1984; and (3) recommendations that were

>s discernible from these events. In addition, this report contains a brief analysis and evaluation of inverter loss events which occurred during 1985. The primary sources of information for this study were Licensee Event Reports (LERs).

The major findings and conclusions of this study include the following:

f' (1) The number of events involving inverter losses per reactor-year shows little or no improvement in each calendar year. The number of events involving inverter losses which were described in LERs increased for each consecutive calendar year in the 3 year period included in the study. The number of events involving inverter losses which are occurring each calendar year are at least in the range of 50 to 60. This overall lack of improvement has occurred in spite of a number 1

of previously recommended corrective actions.

(2) Events involving inverters illustrate that a loss of power from the output of an inverter often results in a loss of power for the bus which it was supplying.

The loss of bus power causes connected electrical loads to deenergize, and this results in a number of undesirable plant conditions and/or actions. These resulting situations, in conjunction with the number of events involving inverter losses, suggest that measures leading to a decrease in the number of such events are warranted.

(3) The dominant cause of the inverter loss events was attributed to component failures. Such components include diodes, fuses, silicon control rectifiers, capacitors, transistors, resistors, printed circuit boards, transformers and inductors. The review indi-cates that a major contributing factor for these com-ponent failures is incompatibility between actual plant 32

Case Onte S,tudy j(csued Sub.iect C603 service conditions and design service conditions (i.e. ,

(cont'u) actual plant service conditions are more severe than those assumed in the design of inverters).

Three potential failure mechanisms for inverters involve: (1) high ambient temperature and/or humidity within inverter enclosures; (2) electrical intercon-nections and physical arrangements of components which form the inverter circuitry; and (M voltage spikes and perturbations at inverter inputs and outputs in conjunction with relatively rapid response time of solid state devices. The two failure mechanisms involving service conditions (i.e., ambient temperature / humidity and voltage spikes) have common i cause implications. These mechanisms potentially can ,

cause the simultaneous loss of redundant )

inverter powered buses.  !

(4) The second largest cause of events involving inverter losses was personnel actions. These include: opening incorrect circuit breakers; connecting faulty test equipment to an inverter (or attendant circuitry);

causing short circuits during maintenance and testing activities; improperly transferring power sources for a bus; and removing the wrong inverter unit from ser-vice. Principal contributing factors to such actions are inadequate maintenance and testing procedures and deficient practices. Inadequate planning, training and verification for related maintenance and testing activities are also contributing factors.

(5) Two specific areas of circuitry design which involve inverter units warrant further consideration. One of these areas involves the reactor coolant system (RCS) pressure instrumentation channels associated with residual heat removal (RHR) system isolation valves.

A loss of power to either of these two instrumentation channels as a result of a single inverter loss causes a loss of shutdown cooling.

The other area involves the circuitry which monitors the position of circuit breakers for reactor coolant pump (RCP) motors. This item appears to be limited to Westinghouse plants which use the solid state pro-tection system (SSPS). Upon loss of power output from an inverter unit, this circuitry deenergizes, thus indicating to the SSPS that a circuit breaker for an RCP motor is open when in actuality it is not. Above a certain reactor power level, the SSPS causes a trip of the reactor with an attendant plant transient. Eight events at three plants involving spurious reactor trips with attendant plant transients are identified in this report.

33

Case Date Study Issued Subject l

I C605 (6) Plant technical specification operating restrictions (cont'd) (e.g., action statements) for an inoperable inverter, or the unavailability of one of two input power sources for inverters with dual power inputs, are not consis-tent for comparable plant designs. At multiple unit sites inconsistencies in the tech 11 cal specifications between plant units can contribute to plant personnel I

errors. This may cause inappropriate personnel actions which result in the plant not being operated in accor-dance with its technical specifications.

The recommendations provided in this report are as follows:

(1) The Office of Inspection and Enforcement should issue an information notice which addresses events involving inverter losses. The information notice should suggest that licensees review the compatibility between actual plant service conditions and design service conditions for installed inverters.

Also, to minimize the number of inverter loss events I

resulting from personnel actions, licensees should consider reviewing related maintenance and testing procedures and practices for inverters. To the extent possible, these reviews should be directed toward identifying the appropriate sequence of steps required for inverter maintenance and testing activities.

(2) Eight events at three plants involving spurious reactor trips with attendant plant transients are identified in this report. These events are attributed to the circuitry which monitors the position of the circuit breakers for reactor coolant pump motors. In view of this operating experience, and to prevent a single failure of a safety-related component from causing an unnecessary plant transient the as-installed arrange-ment for this circuitry should be reassessed by the Office of Nuclear Reactor Regulation (NRR).

(3) Technical specifications which specifically address inverters and/or attendant buses for comparable plant l designs should be reviewed to ensure that action state-ments addressing plant operating restrictions are con-sistent. Inconsistent action statements identified during such reviews should be modified accordingly or, at least, technical bases should be established for such inconsistency. Such reviews should include special consideration for inverter units with dual power inputs.

It is suggested that NRR consider this aspect during resolution of Generic Issue 128, " Electrical Power Reliability."

34

Case Date Study Issued Subject E612 12/86 EMERGENCY DIESEL GENERATOR COMPONENT FAILURES DUE TO VIBRATION This engineering evaluation report reviewed cracking of  ;

small bore piping that resulted in inoperability of emergency diesel generators (EDGs). The cracked lines were found in EDG lube oil. fuel oil, and cooling water systems. The piping cracks, which were caused by cyclic fatigue that 1 resulted from engine-induced vibration, were not detected by the inservice inspection or the preoperational testing program for the piping. The failures were only discovered after the cracks propagated completely through the tube wall and fluid was observed leaking from the pipes. In one of the eight events identified, a fire occurred as lube oil spraying from a cracked lube line was ignited by the hot i exhaust piping of the diesel engine. In the specific events,  !

the associated EDG became inoperable and the plant lost its  !

required onsite emergency ac power redundancy. The cracked pipes in four of the events identified during the review were made of either copper or brass material, which are considered to be vulnerable to cracking due to vibrational loads. In each case, the licensee replaced the piping with piping made of steel.

The study found that the forced vibration induced from engine operation produces complex and interacting vibration modes that can affect all components connected to the engine.

Lube, fuel, and water lines are often subject to relatively high amplitude pulsating loads that may cause rapid degrada-tion. The pulsating loads are very difficult to define at the piping system design stage. Additionally, there are no specific requirements for an evaluation of such conditions in the applicable codes or the regulatory review guides.

Generally, the loading conditions for this type of vibration have not been analyzed in the original piping design.

Although design contingency for vibration loads has been considered in some design practice, these identified events indicate that the design contingencies included for vibra-tory conditions in the original design were inadequate.

The piping fatigue failures were detected neither in pre-operational vibration tests nor in inservice inspections, but were detected only after a leak or a fire resulting from the leak had already developed. Such leaks could re-sult in sudden disabling of the emergency diesel generators when needed and could adversely affect a safe plant shut-down in the event of a loss of offsite power. In view of this safety concern, the report suggested that the Office of Inspection and Enforcement consider issuing an informa-tion notice to inform licensees of the potential safety problem concerning fatigue cracks in the fuel oil, lube oil, and coolant lines of the emergency diesel generator.

The information notice should make licensees aware that l

35

Case Date Study Issued Subject C612 copper material used in these lines is particularly vul-(cont'd) nerable to failure due to cyclic loading during generator operation.

E613 12/86 LOCALIZED ROD CLUSTER ASSEMBLY (RCCA) WEAR AT PWR PLANTS The purpose of this study was to investigate RCCA wear relative to possible generic application to PWR plants.

The study was initiated based on the events at Point Beach Unit 2 and Kewaunee. The RCCA degradation at these Westinghouse designed PWRs was found to be related to (1) wear during rod motion associated with startup, shut-down, reactor trip, and load following; (2) flow induced vibration with fretting wear between the rodlet and the guide card when RCCAs are at fixed positions for longer periods of time; and (3) rodlet cladding cracking (inter-granular stress corrosion cracking) that appears related to absorber / clad interaction. The results suggest that wear should be expected for all RCCAs depending primarily upon the number of fuel cycles of operation and/or the extent of plant load-following service. There was no operational data concerning similar wear problems at Babcock & Wilcox or Combustion Engineering designed PWRs. The safety concerns are that the degradation mechanisms may adversely impact RCCA insertion into the core, or lead to possible loss of absorber material with reduced shutdown margin or reduced negative reactivity worth.

The extent of degradation can only be determined by inspec-tion of the RCCAs during a refueling outage. Such inspec-tions require relatively long-term planning. Hence, it is believed that the informal notification letters that have been sent to licensees by Westinghouse may not be adequate to assure timely action by licensees.

Since RCCA degradation has occurred in Westinghouse designed plants, the report recommended that the Office of Inspection I and Enforcement issue an information notice to alert licensees about the wear problem, and the need to plan and schedule inspections to determine the condition of all RCCAs. ,

It also suggested that the Office of Nuclear Reactor Regula-  !

tion consider whether there is a need to establish periodic l inspections (such as a 10 year interval) of RCCAs and assess I the feasibility of reactor water chemistry monitoring procedures.

i 36

3.4 Generic Letters Issued in November-December 1986 Generic letters are issued by the Office of Nuclear Reactor Regulation, Division of Licensing. They are similar to IE Bulletins (see Section 3.2) in that they transmit information to, and obtain information from, reactor licensees, appli-cants, and/or equipment suppliers regarding matters of safety, safeguards, or environmental significance.

Generic letters usually either (1) provide information thought to be important in assuring continued safe operation of facilities, or (2) request information on a specific schedule that would enable regulatory decisions to be made regarding the continued safe operation of facilities. They have been a signi-ficant means of communicating with licensees on a number of important issues, the resolutions of which have contributed to improved quality of design and operation. 1 t

No generic letters were issued during November-December 1986. l l

i 37

3.5 Operating Reactor Event Memoranda Issued in November-December 1986 The Director, Division of Licensing, Office of Nuclear Reactor Regulation (NRR),

disseminates information to the directors of the other divisions and program offices within NRR via the operating reactor event memorandum (OREM) system.

The OREM documents a statement of the problem, background information, the safety significance, and short and long term actions (taken and planned).

Ccoles of OREMs are also sent to the Offices for Analysis and Evaluation of Operational Data, and of Inspection and Enforcement for their information.

No 0.iEMs were issued during November-December 1986.

38

3.6 NRC Documentation Compilations The Office of Administration issues two publications that list documents made publicly available.

The quarterly Regulatory and Technical Reports (NUREG-0304) compiles bibliographic data and abstracts for the formal regulatory and tech-nical reports issued by the NRC Staff and its contractors.

The monthly Title List of Documents Made Publicly Available (NUREG-0540) contains descriptions of information received and gen-erated by the NRC. This information includes (1) docketed material associated with civilian nuclear power plants and other users of radio-active materials, and (2) non-docketed material received and generated by NRC pertinent to its role as a regulatory agency. This series of -

documents is indexed by Personal Author, Corporate Source, and Report Number.

The monthly License Event Report (LER) Compilation (NUREG/CR-2000) might also be useful for those interested in operational experience. Thit document contains Licensee Event Report (LER) operational information that was processed into t' LER data file of the Nuclear Safety Information Center at Oak Ridge during the monthly period identified on the cover of the document. The LER summaries in this report are arranged alphabetically by facility name and then chronologi-cally by event date for each facility. Component, system, keyword, and compo-nent vendor indexes follow the summaries.

Copies and subscriptions of these three documents are available frem the Superintendent of Documents, U.S. Government Printing Office, P.O. Box 37082, Washington, DC 20013-7982.

t i

e u. 5. COVEChecht PRihilh; Orr 1CE ,1987 181 682 s 60103 39

UNITED STATES NUCLEAR REGULATORY COMMISSION po"e%rlNeUIe WASHINGTON, D.C. 20665 of,*""fe.

penurr me. oar OFFICIAL BUSINESS PENALTY FOR PRIVATE USE,430'!

120555078877 r$'fyNyf-0 ARM-U ADtf A01N41ygyy31 POLICY e SVCS

" UB MGT ap-POR W-S37 6 WASHINGTON DC 20555 l

l

.-