ML20216J061

Loss of RHR,821221

ML20216J061
Person / Time
Site:	Pilgrim
Issue date:	10/31/1982
From:	NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
Shared Package
ML20216J020	List: ML20216J017 ML20216J061
References
TASK-AE, TASK-E244 AEOD-E244, NUDOCS 9709170145
Download: ML20216J061 (11)

Text

. _- ... - . . . . _. .. -_ .. - . - .- -- - .-. .

o t

1

-[,

PILGRIM NUCLEAR POWER STATION LOSS OF RES100AL HEAT REMOVAL s . - -

DECEMBER 21, 1981 i-ENGINEERING EVALUATION REPORT by the t

o .

REACTOR OPERATIONS ANALYSIS BRANCH OFFICE FOR ANALYSIS AND EVALUATION OF OPERATIONAL DATA-  :

October 1982

. . ..,. .t L

Prepared by: Thomas R._ Wolf 9709170145 1 1 PM ADOCK 0 3-S PM

ENGINEERING EVALVATION REPORT OF .

' ~

LOSS OF RESIDUAL HEAT REMOVAL EVENT AT .

PILGRIM NUCLEAR POWER STATION ON DECEMBER 21, 1981 t

1.0 EventDescriptiqn ,

In late September 1981 Pilgrim Nuclear Power Station (PNPS) entered into a planned refueling outage. By December 21, 1981 the refueling operation had been completed, but the reactor vessel head was still off. The heat being generated by the reconstituted core was being removed by the residual heat removal (RHR)systemwhichwasoperatinginitsnormalshutdowncoolingmode with only one pump (P-203C) running of the four RHR pumps (P-203A, B, C, and

0) available. See Figure 1 for an RHR system schematic with pertinent com-ponents identified. The major reactor parameters on December 21,1981 were:

~~

Hoderator temperature.---------- ---70'F Vessel shell temperature.-----------72'F Vessel fl ange temperature-----------68'F ,

Vessel water level------------------190 inches above top ,

. 0f core AsreportedirkLicenseeEventReport 131-064,lat approximately 1410 on December 21, 1981 jnaintenance personnel attem'ptes & live. transfer bf power from;the normali power feeder for a 480v bus (B-2).to:an alternate power bus (B-4) ~so.that work on a.normbi power feeder transfonner X-22)' could be accompl-ished. The procedure being'.followes tb complete this,tran;s(er7as f to locally close the alternate. ~

feeder ti.eier (52-410) and thensimmediatJ y-6 l pen the normal f'eeder breaker. .

(52-201), This-procedure was being 'followed, but because of;.u~nknown problems',

the alternate feeder breaker did not make up before the nonnal' feeder breaker broke contact. This resulted in the momentary loss of powe# to bus B-2 which',

in turn, caused a momentary power interruption to a primary._ccatJLiDment isola ~ tion system (PCIS) control panel (Y4). Two of the components which receive control sighWfrM7HeT Y4 are the RHR pump suction shutdown cooling isolation valves ' '

MOV-1001-47 and 50. These valves are shown in Figure 1. - r The PCIS control logic for these two valva is such that upon power interruption, relays (16AK30 and 54) should de-energize < and seal-in even if power is restored.

This feature -if motive power is available to the valves, causes the valves to assume- their isolation (closed) position. In this case, the relays and valves performed as designed resulting in valves MOV-1001-47 and 50 closing.

At PNPS the RHR pump control logic contains protection circuitry which prevents a non-running pump from being started and commands a running pump to stop if it senses that no open pump suction path is available. The suction path status is monitored by suction isolation valve position switches. In the shutdown cooling path valves MOV-1001-47 and 50 are monitored along with valves -

MOV-1001-43A, B, C, and D. In the torus suction rath val'ves MOV-1001'7A, - B, C, and D are monitored. Figure 1 shows these valves rnd Figure 2 is a sample.

diagram of this control logic.

.e

- 2 e,

. 8

• 4 se $ 44 E

T T

g. .

4 L M - w w -

y.

,dt or xN .

i N

$ S

• >om E ' 7 5 kOS d $

X g) m

[&K

[C b(

~

g Hs 2 2 (f. x g e

i i ese s- di l dji; j i ' a ae 8 8 4 .G

[ D 7 "a I y,s e -

E e l

'i

'f (is JK g j 7

S e m

.3 .

g g # E S'T Q8 Mg g' 2

M g Pyxk i i

~

~/ Y. .,

x .u _ m 2 8 '

Oaz Oi!

e-Z Lg 3, $_ xxAvA 2; i

4 x-(/VN ) x

• a

- . . , . ,. --,.._,.....-.....-....,-.,.,;m_ ,.-m. _ - ,,,.,-,.._r_, , , . . . -

3

- Val *ve Limit Switch .Valye Limit Switch

'Valwe Limit Switch Initiates Except .

Initiates Except Initiates Except When Fully Gpen' When Fully Open When Fully Open Limit MOVIl001- Limit MOV-1001- Limit MOV-1001-Switch 50 Switch 47 ' Switch 43A n u v 1r Valve Limit Switch -

NOT Permissive

~

When Fully Open .

s .

Limit MOV-1001-Switch 7A

. , e Pump - P-203A Pump - P-203A Start Stop ,

~

Air Circuit Breaker (52)

Figure 2: Pilgrim Nuclear Powkr Station Residual Heat Removal System Typicil Pump Suction Yalve Interlock Control Diagram. . .

t

, 1

. l l

On December 21, 1981 as a result of torus modification work be< ng perfomed, the torus was drained and the RHR torus suction isolation valves were closed -

with their motive rower removed. Consequently, when the shutdown cooling valves MOV-1001-47 and 50 closed, the pump protection circuitry should: havt ,-

actuated, non-running RHR pumps P-203A, B, and D should have been prevented

) from starting and running RHR pump P-203C should have been commanded ta stop.

Due to poor environmental seals and operating environment conditions; however, '

valve position switch contacts utilized in the pump protection circuitry were ,

corroded to such an extent that trip signals were not being generated in valves MOV-1001-7A, C and D. Because of this, the pump protective trip logic sensed open suction paths for pumps P-203A, C, and D. As a result RHR f pump P-203C continued to run without an open suction path.

To infom the control room operators of the status of the RHR system, several control room panel indicators are available including valve position indicator lights, pump motor current meters and process computer data items. The latter

> includes RHR heat exchanger water temperatures. .

Nomally during shutdown conditions the operator utilizes the process computer as the prime monitor for RHR system operation. At the initial time of this

• event, the process computer was not functioning but the valve position indi-cator lights and pump uotor current indicators were functioning correctly.

The control room operator did not recognize the significance of the data being received. As a consequence, the running RHR pump continued to operate without an open suction path and the decay heat being generated in the core

• was not being removed by the RHR system.

This pump running /no forced heat removal condition continued throughout the remainder of the shift. When the relief shift took over, the new shift supervisor, noted that pump P-203C was running but failed to recognize that no suction path was open to it. This condition persisted until approximately ..

1900 hours0.022 days <br />0.528 hours <br />0.00314 weeks <br />7.2295e-4 months <br /> when the process computer became functional ,again. At this time, the operating supervisor noted that the RHR heat exchanger teyperatures were out of normal bounds. Upon checking, it was finally recognized that the pump was running with no open suction path. The pump was immediately stopped, - -

valves HOV-1001-47 and 50 opened, and pump P-203A started. To investigate the reason why pump P-203C had not been stopped upon valve closure, M0Y-1001-47 was cycled closed. When pump P-203A did not trip automatically, it was manually stopped and a maintenance request was issued to investigate the pump logic circuit. Residual heat removal was re-established by reopening valve MOV-1001-47 and starting an RHR pump.

2.0 Consequences At no time during this event were any core or coolant temperature limits approached.- All technical specifications for equipment operability and J

e

., , - . . - . - - , - . , , , y ,,--..%-. .---,-v-.

. . - , _----, -, ,,--r . , . - . - - - - . - . -,

1

- 3. - .

i plant conditions were met. Immediately after the event, an exfernal investi-gation of pump P-203C revealed no apparent damage and, in fact, the pump casing

and drive motor housing wre cool to the touch. A subsequent internal inspection

. also revealed no pump damage. '

~ . .-

3.0 Corrective .

Actions

< As a result of this event, the licensee has implemented immediate and planned long-tem corrective actions. The immediate actions taken were to 1) repair / replace faulty components; 2) Conduct a perfomance test on RHR pump P-203C to determine if any degradation had occurred; and 3) Review incident with operations personnel and reinforce the need for attention to detail. The long-term actions planned included:

- visual aids in the form of a system status display to allow the operator to follow changes in plant / systems more easily and readily;

- less traffic in the control room during shift turnover;

~~ ~

. - guideline / instructions to assist-the operator in more easily 4

determining the effect of equipment isolations;

- reduced refueling outage work scope by re-schaduling r of corrective and preventative maintenance during the operation of the plant;

- surveillance testing of equipment / components that currently are not required to be performed;

- improved operator attentiveness and assertiveness in the control room

, through upgraded training programs;

- reduce paper handling in the control room throug'h restructuring of r work control methods. .

.n -

4.0 Analyses A combination of the low decay heat generation rate of the core, natural circu-lation within tne core, heat capacity of the coolant in the reactor vessel, and ambient heat losses from the coolant to the environment kept both the core and coolant temperatures well within safety limits during this event. If this loss of forced shutdown cooling had occurred 4nd gone undetected earlier in the refueling outage, this may not have been true. One possible scenario is that the core would heat up sufficiently to result-in coolant boiling with accompanying evaporative coolant losses. Such losses could result in localized radioactivity releases, personnel hazards and contamination and, if allowed to continue for -

similar time' periods as the Pilgrim event, fuel damage as a result of the fuel becoming uncovered.

l 4

j i Frorn the human factors viewpoint, this event contains good exai:: pics of previously recognized concerns, particularly in the areas of rote operation of equipment and performance under hectic working conditions. In rote operation of e.quipment ,a-person becomes occustomed to operating equipment and monitoring its performance by use of a few key items. Other items which are provided and which Wbuld help monitor the equipnent performance are overlooked. In this instance, the unit had been shut down and the RHR system had been in operation for some .

three months. During this time period, the RHR system performance was monitored via computer-supplied indications. When the computer was down, pump running status was the key factor monitored. The operating RHR pump continued to run during the event. Overlooked, however, were the valve status indicators and RHR pumps motor current value. Only after the computer was returned to service and the computer outputs normally monitored for system perfortnance were restored, was the equipnent operational problem detected and identified.

Heavy, hectic workloads can also contribute to hunan performance problems.

The more items which must be done in any given time period, the more likely that errors will occur. In this case, the shift changeover was so hectic that proper equipnent operation was cursorily examined. As a result, the inter.

relationship between the available indications, the equipnent status and the '*

system operation were not recognized.

The valve limit switch problem is indicative of how essential it is to properly install, test, and maintain equipnent. It also points out how insidious some challenges can be. The principal cause for the limit switch corrosion was moisture entering the valve operator housing. This moisture was primarily introduced via connecting electrical conduits and a missing valve housing gasket.

Ambient moisture was able to enter, condense, and collect within the conduits through cpen ends, such as at cable tray connections, and unsealed intennediate and termination connections, such as at the valve opera. tors. Acting as pipe lines, the conduits channeled the moisture to the valve operators where, since the conduits were not sealed internally or externally at the operators, the moisture was able to enter and invade the valve operators. Also, as'a result - ~

of a leaking RHR heat exchanger flange, one operator was being lightly sprayed with water. Unfortunately, the valve operator housing sealing gasket was missing.

This allowed water to enter the housing. The resulting increased ambient moisture levels within the valve operator housings resulted in the contact corrosion. Also significant, is the fact that not all contacts were affected equally. In this case, the contacts supplying the valve position indication in the main control room were working correctly but the contact for the pump interlock logic were not functioning correctly. These contact problems were not detected or corrected until after the event.

i

. . l Since the RHR system is a safety grade system and is essential j for the safe I operation of the plant and mitigation of many accidents, it is imperative to l protect its operability. In the case of the RHR pumps, two items which help assure operability are pump seal coolers and pump room coolers. Both of these ,

items are supplied with cooling water from the safety grade reactor building , - I closed cooling water system (RBCCW). It appears that for the conditions of this event, the RBCCW cooling supplied via the RHR pump seal and room coolers was sufficient, even upon loss of RHR suction, to protect the RHR pumps.  :

However, if the event had occurred earlier in the outage when the initial '

RHR fluid conditions were much warmer, such protection may not be sufficient.

As a consequence major RHR pump damage, such as shaft seizure or seal failure, could occur.

5.0 Conclusions The event initiator was a result of an unknown and non-repeatable circuit breaker problem which occurred while the testing and maintenance personnel involved were properly performing their duties. Due to the plant operating conditions during this loss of RHR event, no adverse reactor core effects resulted. No technical specification parameters were violated and all appli-

cable NRC rules and regulations were met. One of the four RHR pumps was operated in a potentially destructive mode but apparently because of continued seal cooling throughout the event duration, no pump damage occurred, lhe valve operator limit switch problems were c6mmon mode, comnfbn cause, pre-existing undetected failures resulting most probably from a combination of poor instal-lation, i.e., failure to seal all operator penetrations to ensure operation environment qualification, and poor maintenance, i.e., failure to maintain valve operator gaskets in place and in working condition.

In this case, only minor logic contacts were affected but even this helped incapacitate the RHR system. Historical experience has shown, however, that the most likely failure mode of valve operators subjected to moisture intrusion is loss of operator function. Thus, the operability of the valves affected by the moisture intrusion, namely MOV-1001-7A, C and D, is questionable.

The mechanical failures of the valve operator contacts also indicates th6t *

• some equipment having well defined functions which could affect unit safety may either escape thorough surveillance testing or the normal surveillance program may not be adequate to uncover such problems. No failures occurred in the two RHR letdown isolation valves MOV-1001-47 and 50. They, along with their controlling circuitry, performed as designed on an indicated loss-of-power.

Finally, while sufficient parametric information was available to identify the event, operating personnel failed to immediately detect the event. Whether from inattention, overwork, lack of proper training, insufficient procedures or whatever the cause, this lack of system performance recognition potentially indicates that a significant administratm control problem may exist at the plant.

9 6.0 Recommendations 1

Noted in the following paragraphs are several items which contributed to or I were discovered as a result of the Pilgrim event. It is recommended that conside, ration be given to initiate or continue investigations of these items. _

These studies are needed to better understand the items and their significance while formulating solutions to problems identified. The goal of these studies would be to, reduce failure risks, increase system operability, enhance personnel performance, and help assure unit safety.

1. Shift change work loads, especially supervisory personnel workloads -

A major contrit Jting factor in the Pilgrim event was too hectic a shif t change and accompanying supervisory work load, especially during a re-fueling outage. This resulted in equipment performance monitoring oversight which could have led to essential equipment destruction and core cooling problems.

2. System operating parameters importance -

The need to be cognizant at all times of the system operating parameters, their functions and their importance is essential for the safe operation ...

of a nuclear plant covering two shifts, the Pilgrim event demonstrated a failure in system operational parameter information recognition.

Personnel training programs as wel.1 as operationa) procedure and admini-strative controls must fully address this awareness need.

3. Complex system interactions studies -

• This event further supports the need for a thorough understanding of the complex system interactions which may occur and which could lead to critical equipment problems. Particular emphasis should be placed on electrical equipment moisture problems and method

• to prevent moisture intrusion. Flour Pioneer Inc. produced a study in 1978 as part of the NRC Generic Task No. A-17 investigation. This report detailed a system interaction study for Zion Station and several items found dealt .with , .

moisture intrusion into electrical equipment enclosures. The Pilgrim event along with other events, such as discussed in recent Brunswick Steam Electic Plant Unit Reports (LER 81-108/03L and 81-139/03T), show moisture intrusion events are occurring. It should be noted that AE0D is presently preparing a report on moisture intrusion experience in operating reactors.

4. Inservice testing procedures -

Present inservice testing procedures may not adequately address all aspects of equipment operability. Pilgrim identified this problem as a result of this event and has listed upgraded surveillance testing as one of its long-tenn actions. Similar problems may exist in the industry. Therefore, continued review of inservice equipment operability testing procedures appears warranted. Special emphasis should be given to establishing or enhancing test procedures which verify total system operability including such items as valve operator limit switch contact outputs.

a

• 7

5. Pump operability testing -

i .

In the Pilgrim event, an RHR pump ran for some five hours without I suction but suffered no apparent damage. This performance confilets l with present design philosophy that flow in such a pump cannot be- _

interrupted for more than a few minutes before major physical dahage " '

to the pump occurs. Because of_this philosophy, many systems designs contain. pump flow loss protection logic which complicates the pump control logic. This complexity can lead'to' higher unavailability  ;

f actors for the pump. A detailed investigation into the reasons why the RHR pump at Pilgrim performed as it did could lead to simplifications in such control logic, thereby increasing the availability of many essential pumps. Such en investigation may require a pilot test program which verifies long term pump operability- and performance  :

characteristics upon flow loss.

4 0

' ' ,W h e

% E

References . .

1. Letter, R. D. Kachon, PHPS, to Director, Region I, NRC, erclosing Pilgrim Nuclear Power Station Licensee Event Report 81-064 dated January 23, 1982.

2. Letter, R. W. Starostecki, NRC, to J. E. Howard, BEco, " Inspection 50-293/81-

.24 and 50-293/81-35," dated February 4,1982. -

3. Note, J. Angelo NRC to H. Schieling, et. al, " Zion Station Systemi Interaction Study," dated October 10, 1978. '

0

' O

.W  %

a