ML20235Q117
| ML20235Q117 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 10/01/1987 |
| From: | Norelius C NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| To: | |
| Shared Package | |
| ML20235Q101 | List: |
| References | |
| 50-346-87-25, NUDOCS 8710070498 | |
| Download: ML20235Q117 (31) | |
See also: IR 05000346/1987025
Text
_ _ _ _ _ _ _ _ _
_
'
s,
..
.s
U. S. NUCLEAR REGULATORY COMMISSION
REGION III
AUGMENTED INSPECTION TEAM
Report No. 50-346/87025(AIT)
Docket No. 50-346
License No. NPF-3
I
Licensee: Toledo Edison Company
j
Edison Plaza
!
300 Madison Avenue
Toledo, OH 43652
Facility Name:
Davis-Besse Nuclear Power Station, Unit 1
Inspection At:
Davis-Besse Site, Oak Harbor, OH
Inspection Conducted:
September 8-11, 1987
Team Members:
N. J. Chrissotimos
l
M. J. Farber
i
D. C. Kosloff
!
J. C. Harper
!
I
P. O. Chopra
dafwS T)&
Approved By: Charles E. Norelius, Director
/0/' /P7
i
Division of Reactor Projects
Date
Region III
1
Inspection Summary
inspection from September 8-11, 1987 (Report No. 50-346/87025(AIT))
Areas Inspected: Augmented Inspection Team review of the events surrounding
the September 6, 1987, reactor. trip and subsequent equipment problems at the
Davis-Besse Nuclear Power Station, Unit 1.
I
8710070498 871001
ADOCK 0D000346
0
_-________A
-__
..
,
I
Augmented Inspection Team Report
l
50-346/87025
Page No.
I.
INTRODUCTION
4
A.
AIT Formation
4
B.
Charter
4
II.
DESCRIPTION - EVENTS OF SEPTEMBER 6, 1987
5
,
A.
Overview of Event
5
B.
Sequence of Events
6
C.
Equipment Problems / Failures
8
D.
Personnel Errors
9
III.
INSPECTION EFFORTS
10
A.
Failed Feedwater Flow Control Circuit Transient Details
10
B.
Subsequent Equipment Anomalies
11
1.
Bus A Auto-transfer
11
2.
Service Water Pump No. 1
13
!
3.
14
4.
Startup Feedwater Control Valve
16
5.
19
6.
CCW Heat Exchanger Service Water Control Valves
21
7.
Decay Heat System Void Formation
23
C .- Operator Performance During and After the Transient
25
D.
. Generic Aspects of Specific Equipment Problems
26
1.
Bus A Auto-transfer
26
2.
Decay Heat System Void Formation-
27
IV. SUMMARY
28
A.
Safety Significance
28
B.
Event Reporting
28
C.
Conclusions / Recommendations
28
V.
ADDENDUM TO AIT INSPECTION REPORT
31
VI. ATTACHMENTS
Attachment
Description
Number
1
Confirmatory Action Letter
2
AIT Charter
3
Validyne Printout
u
l.
4
Alarm Printout
5
Feedwater Flow Instrumentation Diagram
!
6
Switchyard Electrical Distribution Diagram
.
2
1
L
L
- _ _ - -
,.
.
i
'
7
8
Main Steam Safety Valve Nomenclature. for Figure 7
,
9
Safety Valve Arrangement
i
10
Feedwater Control Valve Piping. Drawing.
11
Main Steam Piping and Turbine Bypass Valve
(
Simplified Schematic
/
12
Erosion / Corrosion Cavity in Service Water
4
Valve Body
1
13
Decay Heat Removal / Low Pressure Injection'
i
System Diagram
)
14
Restart Authorization Letter of September 16, 1987
l
1
4
3
- - _ - - _ _
_
1
l
.,
I.
' INTRODUCTION
A.
AIT Formation
On Sunday, September 6, 1987, the Davis-Besse Nuclear Power Station,
Unit 1, experienced a high flux reactor trip from 104 percent power
which was initiated by a failed feedwater flow control circuit.
Subsequent to the trip, a number of equipment malfunctions occurred.
On Tuesday, September 8, 198/, an Augmented Inspection Team (AIT)
was formed-consisting of:
Team Leader:
N. J. Chrissotimos, Deputy Director,
Division of Reactor Safety, Region III
Team Members:
M. J. Farber, Reactor Inspector, DRP, RIII
D. C. Kosloff, Resident Inspector,
Davis-Besse
J. C. Harper, Vendor Inspector, NRR
P. O. Chopra, Reactor Engineer, NRR
Additional
Personnel:
P. M. Byron, Senior Resident Inspector,
Davis-Besse
Two members of the AIT arrived on-site on September 8,1987 and
began gathering and evaluating the available data. The remaining
members of the team arrived on-site on September 9, 1987.
In
,
parallel with the AIT formation, RIII issued a Confirmatory Action
j
Letter '(CAL) dated September 9,1987 (Attachment 1) which confirmed
certain actions in support of the AIT and established conditions
required to be met prior to plant restart.
B.
Charter
i
l
A draft charter was formulated for the AIT and transmitted from E.
G. Greenman to N. J. Chrissotimos on September 8, 1987 with the
final charter being issued on September 10,1987(Attachement2)
l
with copies to the EDO, NRR, and selected Region III personnel.
1
The AIT was terminated on Friday, September 11, 1987 by the Regional
Administrator.
I
4
_ _ _
_ _ - _ .
-
1
1
.
..
i
II. ' DESCRIPTION - EVENTS OF SEPTEMBER 6, 1987
A.
Overview of the Event
On Sunday, September 6, 1987, at approximately 11:42 a.m., the
Davis-Besee Nuclear Power Station, Unit i reactor tripped from a
power level of 104 percent on a high flux Reactor Protection System
(RPS) signal. The initiating event was the failure, at approximately
11:39 a.m., of an amplifier card in the Steam Generator No. 2 Loop 2
)
flow indication circuit (FTSP2A1). This resulted in a false low feed
i
flow signal to the Integrated Control System (ICS). The ICS responded
!
to this signal by increasing feed flow to the. steam generator which
j
cooled the primary system, resulting in a subsequent power increase.
An operator attempted to reduce reactor power by manually inserting
i
control rods, not recognizing that Group 8, Axial Power Shaping Rods
-l
(APSR) had been previously-selected for a troubleshooting effort
!
instead of the normally controlling Group 7 rods.
Insertion of the
APSRs forced core flux radially outward and resulted in an indicated
increase in core power to the high flux trip setpoint.
Immediately after the trip and during the following twenty-four hours
several apparent equipment malfunctions occurred which complicated
the operator's response to the trip and subsequent transition to Mode 4.
Immediately after the trip, 1) a Main Steam Safety Valve, which had
routinely lifted in response to the trip, failed to fully reseat, 2)
transformer breaker HX01A failed to close and transfer power from
the Unit Auxiliary transformer to the Startup transformer, causing
Bus A to de-energize with the resulting loss of two Reactor Coolant
'
Pumps, and 3) the Rapid Feedwater Reduction (RFR) circuit closed the
Startup Feedwater Control valves with a large error signal which caused
a low level in the steam generators and required operator intervention
to prevent a Steam and Feedwater Line Rupture Control system (SFRCS)
actuation.
From shortly after the trip until approximately three hours later
the operators' task of stabilizing the plant was complicated by 1)
the failure of Service Water Pump 1-1 to automatically restart when
Emergency Diesel Generator No. I started in response to the loss of
Bus A, 2) leakage through the Startup Feedwater Control valves
resulted in steam generator level control problems, and 3) a Turbine
i
Bypass Valve failed open, causing steam generator level problems
and a resultant SFRCS and start of the Auxiliary Feedwater pumps.
Placing the Decay Heat Removal (DHR) system in service during the
transition to Mode 4 was delayed by 1) a void in the discharge
piping of DHR Loop 2 and 2) the failure of the No. 2 Component
Cooling Water (CCW) Heat Exchanger Service Water Outlet valve to
open on demand by the operator.
{
Although somewhat hindered by the equipment problems which occurred,
i
the operators stabilized the plant, established DHR, and the reactor
was in Mode 4 at 5:01 a.m on September 7, 1987.
5
u______
l
,
,
q
'
e
.c
,
3
. . -r
)
,
t!
t
. B'
Sequence of' Events
{
'
.
The Augmented Inspection Team'(AIT) and the licensee compiled
'
a-
sequence.of events-listings- using control room logs, operator
j
l interviews, Validyne computer printouts, and alarm printouts.
Copies of the Validyne ; computer printouts and the' alarm printouts
are provided as Attachments 3 and 4.
Initial _ conditions: ' 100% power, normal operating temperature and
s
pressure
, Sept' ember 6, 1987
11:39
'(Exact time unknown) Amplifier card fails in Main
Feedwater flow loop FTSP2A1 causing an indication of
i
low feedwater flow to Steam Generator 2.
Main'
4
Feedwater Flow Control' valve No. l' begins to open in
response to indicated low flow.
11:39:07
ICS indicates' reactor power is limited by the
indicated low feedwater flow,
m
11:41:02-
Operator attempts to drive in Group 7 rods but
because Rod Group Selector Switch is in Group 8 for-
.
troubleshooting he drives in the Axial Power Shaping
'
Rods.
11:41:34
Reactor Protection System (RPS) Channel 4'Hi-Flux
- tri p
11:41:40
RPS Channel 1 Hi-Flux trip.
Reactor trips on 2 of 4
coincident protection signals.
11:41:42
High' Pressure' Turbine Stop and Governor valves close
and Main Turbine trips in response to reactor trip.
Maln Steam pressure begins to rise.
11:41:45
Main Steam Safety Valves (MSSV) lift
11:42:08
Busses A, E6, E3, E2, and essential busses El and C1
are de-energized when auto-transfer from the
Auxiliary to Startup transformer does not occur due
to failure of breaker HX01A to close.
<
Reactor Coolant Pumps 1-1 and 2-2 trip when Bus A is
L
lost.
-
MS-199, Moisture Separator Reheater No. 1 Second
'
Stage Reheat Stop valve, fails to close due to loss
of Bus A.
11:42:18
Emergency Diesel No. I has started, comes up to
speed, and 4160VAC Essential Bus C1 is re-energized.
6
_ _ - _
_
.
.-
.
..
!
- .
.
y :n
..
11:42:19'
. Main Steam. pressure is reduced but MSSV SP1783 fails
to fully reseat.: Valve continues:to pass
i
~m.
approximately 5 percent of its rated steam flow.
'
L
11:42:30
-Rapid Feedwater Reduction " targets" and the Startup
l
Feedwater Contro1' valves are closed with a large;1evel
error signal due'to high initial steam generator
,
-levels.
-
'
- 11:42:58.
. Service; Water Pump 1-1 fails.to auto-start ~after Bus
C1 is re-energized.
11:47:10
Service Water Pump 1-1 is started manually.
11:49:21
Channel 1 SFRCS low level trip
Operator'ta'es manual. control of Startup Control
11:49:40
k
valve No. 1 and raises level in Steam Generator'l to
avoid full SFRCS trip..
11:55:48
Startup Feedwater Control' valves control steam
generator levels on ICS low level limits.
.13:19:34
Operator inadvertently trips Reactor Coolant Pump.2-1.
.
1
13:22:13
RCP 2-1 is restarted.
13:43:21
Bus A voltage is restored.
!
- 13:56.
Motor Driven Feed Pump-is. started, feeding through
'the Startup Feedwater Control valves to the steam
generators.
Steam. generator levels _begin to trend upwsrd,
13:57:09
RCP 2-2 is restarted.
14:00:49
RCP 1-1.is restarted.
~14:08:49
Steam Generator No. 2 reaches level of approximately
.
100 inches.
Startup Feedwater Control valves are
!
isolated and feed flow is ' controlled by " mini-feed"
valves.
14:27:56
Operators shut down Emergency Diesel Generator No.1.
I
14:30:17
Steam generator levels are returned to normal low
level limits.
15:08:13
Turbine Bypass valve SP13A3 fails open.
!
15:11:43
Steam Generator No. 2 reaches low level alarm point.
7
.i
- _ _ _ _ _
b
m _
.
.
15:12
Channel 2 SFRCS low level trip.
15:12:03-
Channel 1 SFRCS low level trip.
SFRCS full trip. Both Turbine Driven Auxiliary
Feedwater-pumps start.
15:13:02
Steam Generator No. 2 restored to low level limits.
.15:16:48
Shutdown AFW pump no. 2.
15:16:49
Shutdown AFW pump no. 1.
September 7, 1987
04:30
Pressurizer level drops a total of 16 inches while'
,
placing Decay Heat Removal Loop 2 in service.
05:01
Plant is in Mode 4.
11:15
SW-1434, Component Cooling Water Heat Exchanger
Service Water Outlet valve will not open when
operators attempt to initiate service water flow
'
through CCW Heat Exchanger No. 2.
C.
Equipment Problems / Failures
Review of the event revealed a number of apparent equipment failures
or improper operations. They are listed here and will be discussed
in detail in Section III.
1.
An amplifier circuit board in feedwater flow indicating loop
FTSP2A1 failed due to apparent overheating.
2.
13.8 kV Bus A failed to auto-transfer when the unit tripped.
3.
Service Water Pump 1-1 breaker failed to automatically close
and start the pump after its bus was re-energized.
4.
Main Steam Safety Valve SP-PSV-1783 failed to fully reseat
after lifting.
5.
Difficulties in controlling steam generator levels with the
Startup Feed Control Valves were experienced immediately
following the trip and about two hours afterward.
6.
Turbine Bypass Valve SP13A3 failed open.
L
7.
SW-1434, Component Cooling Water Heat Exchanger No. 2 Service
}
Water Outlet Valve failed to open on demand.
8.
A large void existed in the discharge piping of Decay Heat
Removal system loop 2.
8
,.
. _ - _
..
!
.
!
Items 1-3 were new problems directly related to the September 6, 1987
trip.
Items 4-7 were previously known problems which the licensee had been
working 'on either through replacement or repairs.
Item 8 is a new phenomenon for Davis-Besse and the industry.
D.
Personnel Errors
l
The review of the September 6, 1987 event identified one personnel
'3
error committed during the transient and one error committed
approximately one and one-half hours after the reactor trip.
i
1.
An operator attempted to reduce reactor power by driving in
control rods but was unaware that Group 8, the Axial Power
Shaping Rods (APSR) were selected rather than the normally
selected Group 7.
Insertion of the APSRs increased indicated
reactor power to the trip setpoint.
2.
Approximately one and one-half hours after the trip, Reactor
Coolant Pump 2-1 was inadvertently tripped by an operator while
checking breaker indications prior to re-energizing Bus A.
The
1
pump was restarted about one minute later.
Although the initiating event for the transient was the failure of
the feedwater control circuit, the first error was the actual cause
of the reactor trip.
The second error had little effect on the
event other than a momentary delay in re-energizing Bus A.
i
I
I
i
l
9
l
l
.
1
_ _ _ _ _ - - - _
- . - _
. - - .
l
_--_
- ___ - .
- - - _
.
, . -
, s
.
, ,
~III. INSPECTION EFFORTS
lA.
' Failed Feedwater Flow Control Circuit
Problem
f
.The initiating event was the failure-of a signal amplifier module in
Main Feedwater Flow Indicating Loop FTSP2A1. This caused indicated
P
Lflow to fall'to approximately 85 percent.of actual. flow. This false
'
indicationcausedtheIntegratedControlSystem(ICS)toincrease
,"
the flow of feedwater to Steam Generator No. 2.
This in turn
resulted-in~a cooling of the. Reactor Coolant _ System and a subsequent
reactor power increase to 103 percent.
Licensee Evaluation
Main Feedwater' Flow is sensed across flow elements FESP2A and FESP2B
as shown in Attachment 5. . Each flow element has redundant' flow trans-
mitters for control and indication: FTSP01A1 and FTSP02B1 (preferred)
for flow element FESP2A and FTSP02B2 and FTSP02A2 (alternate) for flow
element FESP28. The output of these transmitters is compared to a
flow demand by the ICS and the error signal is used to position the
feedwater regulating valves.
On' November 25, 1986, loop FTSP02A1 could not be properly calibrated.
The signal amplifier module, which was of non-encapsulated construction,
was replaced.with a 'different type of module which was of potted,
encapsulated construction. The modules are interchangeable, the
encapsulated module being a newer design for harsh environment applica-
tions.
The cause of the failure of the signal amplifier module was a
shorted capacitor that loaded down the. output and caused the transformer
in the module to overheat.
Licensee Corrective Actions
The licensee will send the failed module to Bailey, the vendor, for
!
further' evaluation. The licensee has replaced the failed module with
the previously installed one after appropriate calibration and
testing. The licensee considers the failure of the module as a random
failure and not indicative of a trend or design flaw. An encapsulated
.
'
amplifier module (similar to the one that failed) is presently used
in the complementary flow channel as well as several level transmitter
applications.
The encapsulation of the module is a standard Bailey
design to accommodate a harsher environment and has been in service in
the plant for many years.
I
AIT Review
]
The AIT reviewed calibration and maintenance history for these modules
and the main feedwater flow indicating loops. Based on this and the
licensee's review the team concluded that the signal amplifier module
failure was random. As noted above, the encapsulated design is
standard, has been in service in the plant for many years, and has
proven to be reliable.
The AIT considers the licensee's corrective
action in this regard to be adequate.
10
i_ --
_-
1
. - _ _ .
_
.
4
I
B.
Subsequent Equipment Anomalies
i
1.
Bus A Auto-transfer
Problem
,
During normal power operation 13.8kV buses A and B are fed from
the secondary windings of the Unit Auxiliary Transformer as
shown in Attachment 6.
On a unit trip these buses are auto-
matically transferred to Startup Transformers 01 and 02. This
ensures reliable operation of plant essential and auxiliary
,
equipment for plant shutdown.
Each startup transformer is supplied
1
from a different 345kV switchyard bus section which constitutes
,
an offsite power source.
The automatic transfer is initiated by
generator or transformer protective relays.
When the reactor
,
tripped, failure of 13.8kV non-safety Bus A to fast transfer
l
from the Unit Auxiliary Transformer to Startup Transformer 01
l
resulted in the bus being de-energized. The 13.8kV Bus B
transfer from the Unit Auxiliary Transformer to Startup Transformer
02 was accomplished as designed.
Licensee Evaluation
Upon initiation of the Bus A fast transfer, Auxiliary Transformer
Breaker HX11A opened but Startup Transformer Breaker HX01A did
not close.
In the course of subsequent troubleshooting it was
discovered that the floor tripper interlock for Breaker HX01A did
not have enough clearance, i.e., the floor tripper cam was found
exerting pressure on the breaker tripping trigger which prevented
the breaker from closing. HX01A is a 15kV, 2000 Amp Westinghouse
Type 150DHP7500 breaker.
The floor trippers for breakers are used
to ensure that the breaker is tripped while rolling it into the
cubicle. According to Westinghouse, the breaker cubicle floor
trippers are set at the factory and unless the breaker is rolled
over an obstruction on the floor that bends the levers, they
should not require adjusting. The licensee's assessment is that
racking in/out of the breaker from the cubicle may have contributed
to the problem with the floor tripper operation.
Licensee Corrective Actions
The floor tripper for HX01A was adjusted to obtain proper clearance,
the breaker was successfully tested, and the Bus transfer scheme
was tested on September 9, 1987. This first test of Bus A was
unsuccessful as HX01A failed to close on demand.
Further trouble-
.
shooting revealed a failed auxiliary position switch on 345kV
switchyard Main Disconnect 34620. This position switch provides
a permissive to the bus transfer scheme.
The licensee re-adjusted
the linkage that connects the position switch assembly to the
.
operating mechanism. The Bus A transfer from the Unit Auxiliary
!
Transformer to Startup Transformer 01 was restested on September 11,
f
1987 and Bus A transferred as designed.
l
11
- _ _ _ _
.
>
li '
. I
,
The licensee has revised MP10410.69," Periodic Maintenance of
13.8kV and 4.16kV' Breakers" to cover floor tripper adjustment.
j
The preventive maintenance on 13.8kV and 4'.16kV breakers is
]
-performed every five years.
For added assurance, the licensee -
i
checked all:13.8kV and 4.16kV breakers to ensure that the floor
tripper interlock has adequate clearance between the floor
tripper cam and the breaker. tripping trigger.
j
I
It.' appears that the malfunction of the position switch on Main
Disconnect 34620 may have contributed to the failure of the Bus
~
4 -
A transfer during the September 6,.1987 event and would have
I
definitely prevented future bus transfers. Since the 13.8KV
Buses A and B tranferred successfully on the. reactor trip of
4
August 21, 1987, the auxiliary position switch had to have been
closed at that time. This switch might have become'openLduring
cycling Main Disconnect 34620 following the. reactor trip on
September 6, 1987. The licensee'can not be sure if this problem
'
. occurred before or after September 6,1987.
The licensee will also evaluate generator-transformer protection
relaying for common mode failure to ensure operability of the bus
transfer scheme.
AIT Review-
1
The AIT reviewed the schematic diagrams of the bus transfer
scheme, the proposed retesting program, the maintenance procedure
for 13.8kV.and 4.16kV breakers, and the. Technical Specifications
related to these breakers. The team also witnessed portions of
the troubleshooting and testing conducted by the licensee. The
team noted that the licensee had in existence a preventive main-
tenance program which would have identified the misadjusted
interlock.
Breaker HX01A was scheduled for this preventive
maintenance in mid-September. The team determined that the
failure of non-safety Bus A to auto transfer was of minimal
safety significance because safety Bus C1 was re-energized by
the diesel generator as designed. The team concluded that the
licensee has taken adequate corrective actions to ensure that.the
bus transfer circuitry will function as designed.
The AIT noted that the bus auto-transfer of 13.8kV Buses A and
B from their normal source, the Unit Auxiliary Transformer, to
their reserve sources, Startup Transformers 01 and 02, is not
periodically tested in accordance with Technical Specification 4.8.1.1.18 (the manual testing requirement of 4.8.1.1.1B is
performed during unit startups and shutdowns).
From the team's
discussions with the licensee staff, it appears that periodic
surveillance testing is performed each refueling outage by
auto-transferring 13.8kV Buses A and B between Startup Trans-
former 01 and 02 and not from the Auxiliary Transformer to the
I
Startup Transformers. The AIT believes that the licensee has
misinterpreted this surveillance requirement.
,
12
i
_ _ _ - _
-
._
_.
I
'
1
I
i
-
- L
2.
-Service Water Pump No. 1
i
Problem
i
13.8kV Bus A normally supplies 4.16kV Bus C1 through bus tie
transformer AC and non-essential Bus C2 as shown in Attachment
8.
When Bus A de-energized as a result of the auto-transfer
,
failure, an under-voltage condition occurred on esuntial 4.16kV
l
'
Bus C1.
When Bus C1 experienced loss of voltage, Emergency
1
Diesel Generator (EDG) No. 1 started, bus loads were stripped,
I
and the diesel generator breaker closed to re-energize Bus C1.
Service Water (SW) Pump 1-1 breaker tripped as required for the
i
C1 under-voltage condition; however, the breaker failed to aut-o-
matically reclose and start the pump after the prescribed time
delay (forty seconds after the diesel generator breaker closes).
q
The pump was subsequently started by closing the feeder breaker
from the control room.
Licensee Evaluation
Troubleshooting revealed that the control circuit wiring in the
service water feeder breaker cubicle was incorrect: one wire
was missing and one other was mislanded. This deficiency
existed only in the loss of voltage closing circuitry and not
in the manual or the safety actuation closing circuits for this
feeder breaker.
The undervoltage/ loss of voltage portion of the control circuit
for SW Pump 1-1 feeder breaker was last tested in June 1980.
At that time the test was documented as having been performed
successfully. This test does not appear to be required by the
Technical Specifications.
On July 4, 1986, SW Pump 1-1 feeder breaker was changed due to
implementation of fire protection modifications.
The modifications
changed wiring in the same general physical area within the breaker
cubicle.
It appears that the wire has been missing from the
control circuitry of SW Pump 1-1 feeder breaker since at least
'
July 4, 1986. After the fire protection modifications, the
breaker control circuitry was tested to verify pump operability;
however, this test was limited to simulating a loss of off-site
power in conjuction with an ESF actuation test signal. The
control circuitry to start SW Pump 1-1 on a loss of off-site
power only, was not tested.
Licensee Corrective Actions
,
The licensee corrected the wiring for SW Pump 1-1 feeder breaker
L
and performed a functional test of the under-voltage / loss of
l
voltage control circuit to verify that the wiring corrections
resolved the problem.
For added assurance, the other Service
'
Water Pump and Component Cooling Water Pump feeder breaker control
circuits were inspected to ensure that they are properly wired
I
for all designed auto-starts.
13
_ _ _
..
.
The licensee will revise their surveillance procedures to test
SW pumps on a loss of off-site power signal at every other
refueling. The licensee will also evaluate the adequacy of
their retesting procedures, the adequacy of the System Review
and Test Program retest, and verify the applicability of the
surveillance testing as used to declare system operability for
SW/CCW pumps.
.
AIT Review
The AIT reviewed the schematic for the breaker control circuit,
l
the surveillance procedures associated with Service Water Pump
1-1, the documentation package for the fire protection modifica-
tions performed in July 1986, and the licensee's proposed retesting
plan. The failure of Service Water Pump 1-1 to auto-start was
of minimal safety significance because procedural guidance and
operator intervention quickly identified the failure of the pump
to start.
The team concluded that the licensee has taken
. appropriate actions.to ensure that the Service Water pumps will
auto-start as designed.
!
'
The AIT noted that a periodic test simulating a loss-of-offsite
power by itself and verifying load shedding, diesel start, and
]
energizing of the auto-connected shutdown loads is not performed
{
at Davis-Besse. The Service Water pumps supply cooling water to
]
the diesel. generators and other safety systems. A test simulating
1
a loss-of-offsite power in conjuction with an ESF actuation test
]
signal is periodically performed every refueling as part of
)
Technical Specifications. Since the Service Water pump has a
separate circuit for auto-start on ESF actuation, the loss-of-
4
!
offsite power auto-start circuitry is not exercised during this
test. The team considers the operability of these pumps during
a loss-of-offsite power event is as important as during a
,
loss-of-offsite power in conjunction with an ESF actuation.
j
i
'
3.
Problem
Davis-Besse uses nine Dresser 3700 " maxi-flow" type safety
!
valves with set pressures of 1050, 1070, 1090, and 1100 psig on
j
each of the two main steam headers (Attachments 7, 8, & 9).
In
I
response to the trip, the Main Steam Safety Valves (MSSV) lifted
1
to relieve secondary pressure. MSSV SP-PSV-1783 (B3) failed to
fully reseat after lifting. Apparently, the disc jammed off-center
on the nozzle allowing steam to escape around the disc and nozzle
seat area. Attempts to reseat the valve by manually lifting and
by gagging were unsuccessful and the valve continued to pass
l
approximately five percent of its rated steam flow.
Licensee Evaluation
l
There have been three previous disc collar failures, two occurred
!
in-service and one occurred during testing.
In each case, the
14
__
l
-
.
.
.
disc was laterally displaced, the spindle was bent, and the disc
l
- holder was in the fully open position, wedged between the top of
l
the disc and the cover plate.
Additionally, all failures have
been associated with the lower set pressures (1050 - 1070 psig)
on the "B" header.
1
A visual inspection of SP1783 while on the header on September
7, 1987 revealed a failure of the disc collar. This confirmed
an earlier speculation of the failure mode which was based on
,
previous similar failures.
Visual inspections of the remaining
'
MSSVs were conducted on September 7, 1987. Eleven valves
showed no sign of degradation of internals and six showed signs
of wear such as disc collar flaring, stem bending, and stop
j
collar galling.
,
)
Valve B3 was removed from the header and its position blank-flanged.
l
After engineering review of the visual inspection findings, B1 was
l
also removed. To compensate for this and provide symmetry on the
j
header, valve A3 was relocated to the B1 position and position A3
was blank-flanged. B3 was disassembled in the mechanical main-
j
tenance shop under controlled conditions.
The disassembly revealed
<
extensive internal damage which was identical to that seen in the
i
three previous failures.
l
Based on the findings from evaluation of the previous failures
and the recent disassembly of B3, the licensee has concluded
that the failure of MSSV B3 to fully reseat was caused by
failure of the disc collar.
The root cause of this and previous
disc collar failures has not yet been determined although several
hypotheses exist.
l
Licensee Corrective Actions
I
!
The licensee's corrective actions for this problem _ involve
)
short-term and long-term actions.
In the short term, B3 was
removed and its locations blank-flanged. Valve B1 was removed
and to provide symmetry for the header, A3 was relocated to the
B1 position and position A3 blank-flanged. The high flux reactor
trip setpoint will be readjusted for one inoperable safety valve
on each steam generator in accordance with Technical Specification
Table 3.7-1.
The licensee also performed an evaluation to determine the
'j
maximum leakage which can be tolerated and still maintain plant
temperature control.
Since the valves have always reseated, the
remaining concern is the degree of leakage.
The evaluation
'
determined that the degree of leakage could be no more than 7.5
percent of maximum relief capacity of a given valve and a total
of 47 percent capacity; six valves can fail in this mode without
negating the capability to control plant temperature.
The ongoing engineering evaluation has revealed that the disc
collars are made from CB30, a corrosion resistant stainless
steel casting which possesses a low impact strength. Metallurgical
15
- -_--
- - _ _ _ _ - -
4
4
1
testing by Babcock & Wilcox showed that the failed disc collars
j
possessed very low impact strength, a marginally acceptable
(
chemical composition, and grain structure which indicated-that
i
the casting did not receive the proper cooling cycle. The licensee
will refurbish all eighteen MSSVs during the forthcoming refueling
outage with new wrought and machined (stronger material) disc
collars. All stems will be replaced and enhanced quality control
will be applied in the area of stem to disc interface, collar to
stem interface, and parts identification.
The licensee will continue their engineering evaluation into
)
the failures of the disc collars and the apparent restriction
]
,
of the failures to the "B" header.
i
AIT Review
,
The AIT reviewed the maintenance procedure for disassembling
Main Steam Safety Valves, Babcock & Wilcox metallurgical reports,
Dresser Engineering Report SV-231, licensee preliminary reports
on the MSSV failures, and a video tape and photographs from the
disassembly of valve B2, which failed during a reactor trip on
March 13, 1987. The team also inspected B1 and B3 prior to their
disassembly, witnessed the disassembly of B3, and conducted a
telephone interview with a B&W metallurgist.
The team noted that the licensee was aggressively pursuing
resolution of the problem prior to this latest occurrence and
that prior to this trip, plans had already been made to refurbish
all the MSSVs during the forthcoming refueling outage.
The number of safety valve lifts at Davis-Besse appears to be
excessive. A study to develop methods of reducing the number-
!
of lifts occurring during a reactor trip would be beneficial
since it appears to the team that the frequency of lifts bears
on the failure rate.
The AIT considers the licensee's corrective action program for
MSSV failures to be adequate. The team concurs with the licensee's
!
evaluation that a single MSSV failure will not negate the plants
capability to control temperature.
4.
Startup Feedwater Control Valves
Problem
Following the reactor trip and approximately two hours later the
,
'
operators experienced difficulty in controlling steam generator
i
levels.
In the immediate case the Integrated Control System (ICS)
Rapid Feedwater Reduction (RFR) circuit responded to the reactor
trip by closing the Startup Feedwater Control to a " target"
l
,
position. When ICS control of feedwater flow shifted from RFR
j
l
to low level limits, the steam generators were at a higher water
J
1evel than desired.
This resulted in auto-closing of the Startup
i
'
Feedwater Control valves with a large error signal which caused
16
I
i
_-_________________-__a
,
.
-
.-
- . - - - - - -
- _-
_ - - -
- - - - - - -
- - - -
.
. '
l
steam generator levels to fall below the low level limits.
l
Operator intervention was necessary to prevent an SFRCS actuation.
1
Approximately two hours after the trip, seat leakage through the-
Startup Feedwater Control valves while the Motor Driven Feed Pump
(MDFP) was operating caused steam generator levels to rise. To
l
regain control of water levels, the operators isolated the
j
startup control valves and used the " mini-feed" bypass line to
i
feed the steam generators.
i
Licensee Evaluation
]
The licensee's review of the problems revealed that the first
j
problem was the result of using an inappropriate time constant
{
in the control circuit which " targets" the Startup remater
1
Control valves after the trip.
The time constant utrols the
i
length of time that the valves take to reach their desired
!
position. Review of existing RFR module settings revealed that
I
a nine second time constant had been set resulting in the
i
Startup Feedwater Control valves targeting in 36-45 seconds
i
vice the design intent of approximately five seconds.
Keeping
the valves open longer than desired allowed more feedwater flow
than desired and resulted in higher levels in the steam generators
"
when control was released to the low level limits. The large
3
level error drove the Startup Feedwater Control valves shut and
I
level then fell below the low level limits and approached the
J
setpoint for an SFRCS actuation. Computer data showed the upward
trend of steam generator levels after the MDFP was placed in
I
service. When the MDFP is placed in service upstream pressure
4
at the startup feedwater control valves goes up approximately
i
400 psig as a result of the higher discharge pressure developed
by the
Data acquired from the ICS also showed that the
valve (pump.SP7A) for steam generator 2 was approximately two percent
f
open rather than fully closed as needed. Testing by the licensee
I
while in Mode 4 showed that both Startup Feedwater Control valves
had higher than expected leakage.
The higher than expected valve
q
leakage, failure of SP7A to fully close as demanded, and the
"
affect of the higher head of the MDFP on valve performance all
contributed to the difficulty in maintaining steam generator
t
levels.
1
Licensee Corrective Actions
'
The licensee's near-term corrective actions for this problem
included additional troubleshooting of the control circuitry,
l
-
further leak testing of both Startup Feedwater Control valves
]
during both Modes 4 and 3 to better quantify the leak rates
i
'
using both the MDFP and the Main Feed Pumps, troubleshooting of
i
l
Startup Feedwater Flow Transmitter 3B for suspect indication,
and evaluating the control valve's RFR time constant for modifi-
.
cation and retesting in Mode 3.
Long term corrective actions
include a review of the operating procedures for changes to
l
provide guidance for operation of the Startup Feedwater Control
j
valves and the " mini-bypass" valves when each is used with the
-
MDFP and the Main Feed Pumps, a review of the engineering
I
17
l
-_
-
)
__
_
_
N
l
. . ,
analysis for the MDFP in service with the Startup Feedwater
Control valves, and complete rebuilding of both valves and their
4
!
positioners during the forthcoming refueling outage.
AIT Review
The AIT reviewed the maintenance history on the Startup Feedwater
.'
Control valves, reviewed the calibration records for the valve's
positioners, reviewed chart recordings of ICS functions (demand,
flow, valve position) related to operation of the valves during
the' event, monitored the valve's operation both locally and in
the control room while they were in use controlling steam
generator levels in Mode 3, reviewed. test results from the Mode
4 and subsequent Mode 3 leak tests, reviewed the logic diagrams
for the controllers, and met with members of the licensee's
engineering and operations staffs.
The inspectors noted that there was a considerable history of
problems related to operation of the Startup Feedwater Control
valves, especially when used in conjunction with the Motor
i
Driven Feed Pump (Attachment 10). This particular. operating
configuration was of concern to a number of the operators who
felt that the valves were not designed to operate with the -
higher head provided by that pump. Review of the calibration
j
records and the chart recordings did not reveal any inconsis-
1
tencies other than those noteu by the licensee with regard to
i
RFR target closure timo, +/- four percent oscillations around
J
the five percent open position by SP7A, and SP7A remaining
approximately 2 percent open inspite of a demand to fully close.
It should be noted that these valves have approximately a two
!
inch stroke and two percent open represents .04 inches. The
j
inspectors reviewed the results of the Mode 4 leak tests and
'
noted that although seat leakage was considerably above expected,
the test was conducted with a differential pressure of approxi-
1
mately 1400 psid rather than 500 psid noted when the problems
occurred. The actual leak rate would be somewhat less but can
i
not be quantified until the Mode 3 tests are completed.
1
The team noted that the licensee was aware of problems with the
i
Startup Feedwater Control valves and had been actively pursuing
resolution before the September 6, 1987 trip.
)
l
The AIT judged the licensee's pre-event approach to resolving
the problem to be technically acceptable. The pre-event
i
schedule was also adequate based on availability of repair
'
parts. The team determined that this is an operational burden
I
under certain low power conditions and is not a safety concern.
l
The licensee's present corrective actions, as outlined above
i
appear to adequately address the problem. The operation of
these valves after they are rebuilt should be closely monitored
during startup and power ascension following the outage to
ensure that the problems are resolved.
!.
l
18
l'L_
_ - -
- _ _
___
- _ _ .
.__
. __
,
,.
5.
,
t
, Problem
f
At approximately 3:08 p.m. Turbine Bypass Valve SP13A3 failed
open.
Licensee personnel in the vicinity of the valve observed
that it would . rapidly open, remain open ten to fifteen seconds
and then slam shut. System piping (attachment 11) deflected
several inches with each cycle. This sequence was repeated
j
three or four times until SP13A3 failed open. The increased
steam flow associated with SP13A3 being open and the Startup
Feedwater Control valves being isolated resulted in Steam
,
Generator No. 2 level falling to about 23 inches with a resul-
{
tant SFRCS actuation. Both Turbine Driven Auxiliary Feedwater
i
Pumps started as required and proper steam generator level was
quickly restored. The pumps were shutdown and returned to
standby after control of steam generator levels was regained.
Licensee Evaluation
I
Visual inspection of SP13A3 revealed extensive damage to the
positioner: linkages, limit switches,- cams, pipe nipples, and
pins were bent and/or broken and bolts were missing or sheared
off.
The licensee determined that SP13A3 failed due to over-travel
of the positioner cam and linkage. On an opening cycle the cam
follower rode past the mechanical stop and onto a cutaway
section of the cam. This unintended configuration set up a
positive feedback in the positioner which on the next opening
cycle drove the valve into the oscillations witnessed by the
licensee personnel in the area. The successive impacts from
the full-stroke oscillations further damaged the positioner and
i
the valve failed fully open.
Probable causes of the positioner
failure include 1) impro
and cam positions and 2)per alignment of the mechanical stops
,
entrained water in the piping upstream
'
of the valves flashing to steam as it passes the valve plug
thus creating excessive forces in the upward direction on the
valve stem.
The licensee alignment procedure for these valves did not verify
,
the mechanical limits of the valve being aligned.
This appar-
ently resulted in a situation where the electro-pneumatic signal
j
to the positioner is significantly less than the mechanical full
)
open. When the valve opened fully, the positioner cam apparently
j
rotated beyond the drop-off onto the cutaway.
The procedure does
]
not clearly specify the hook-up of the test rig which could result
j
in only the positioner calibration being checked, independent of
)
mechanical position.
If the electrical to pressure (E to P)
converter was misadjusted, this would also result in a situation
where the electrical full open signal is less than the mechanical
full open and the cam could rotate beyond the drop-off.
The
setting ranges specified in the procedure may provide enough
cumulative error to degrade the calibration of the E to P converter.
19
__
_ . _ _
..
_
-
.
.
..
- __ - _ - - _ __= ___ - _ _ _ _ - ____
_ _ - _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _
g,
,
m
,
,
Review ~of the system history revealed a higher incidence'of'
,
repairs,to the "A" train turbine bypass valves. Walkdowns of.
.<
,
the-piping showed less high pressure drain capacity in the
. vicinity of the "A"
valves'and that SP13A3 is closest to the
' header. .This.could result in entrained water. entering these.
.
valves.: When the valves open, the lo'w pressure of the condenser
will cause.this water to flash to steam under the disc . causing..
excessi.ve upward forces;on the stem. . This upward force'could
also contribute to theJover-travel of the cam and linkage.
. Licensee Corrective Actions-
The remaining five valves were inspected on: September 9, 1987-
and two turbine, bypass valves showed mechanica1'open greater.
than 120' percent of electrical open and one valve with mechanical
open at 75 percent of. electrical open.
.The positioner for;SP13A3 was repaired and refurbished. The E
to P converter and positioner was calibrated and operated
manually, pneumatically, and: electrically to verify ' operation.
The other.five. valves were.also calibrated and tested to verify.
operation.
A- full-flow stroke test of the turbine-bypass. valves
.will be performed at full. main steam pressure while the-plant is,
in Mode 3.
The licensee determined that the same positioner
configuration wa's used on other air-operated valves (e.g. the
Startup Feedwater Control Valves) in the plant and these valws
.were also adjusted.
Corrective actions _ beyond the immediate repairs, calibration,
,
and testing of the valves includes evalution of the high .
'
- pressure drain piping for possible addition of another drain
trap upstream of the turbine bypass valve header, possible
redesign of the positioner cam to eliminate the drop-off, and
revision of the calibration procedure to ' clearly establish the
test rig hook-up, provide tighter alignment criteria, and
verify mechanical and electrical limits.
AIT Review
i
The AIT-reviewed the maintenance'and calibration history of the
-
turbine bypass valves, the calibration _ procedure, IC 2700.23
" Control Valves and Accessories Calibration", the vendor
instruction manuals for the valve / positioner loop components,
and licensee engineering evaluations related to the problems
with the turbine bypass valves. The team also witnessed the-
repairs to SP13A3 and recalibration of some of the valves.
The team noted that there was a history of problems with the
operation of the turbine bypass valves. The licensee was aware
i
of the problem and was attempting to resolve it.
Prior to this
event the valves and their positioners had been rebuilt under
l
,
'
the guidance of a vendor technical representative.
20
1
Q
_
_=
_ _ _ - -_ ._
__
s
,
l
J:
/
The AIT/ concluded that the licensee's corrective action with
-
respect' toL repair of, the turbine bypass valves was thorough and -
correct. ' The failure of- SP13A3 was an operational ~ burden that
'
challenged.a safety system. The safety system's response to the
failure minimized'its impact. The operation of' these valves
'should be carefully monitored during the proposed full-stroke
. testing and during subsequent startups and shutdowns.. The
,
'long-term actions proposed by- the licensee also appear adequate.
6'. -
CCW Heat Exchanger Service Water Control Valves
. . .
Problem
Approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the event, wh'ile placing the Decay
Heat Removal system into operation, the Component Cooling Water
!
-(CCW) Heat Exchanger Service Water Outlet valve (SW-1434) . failed
I
to open on demand either from the control room'or locally,
i
SW-1434 isa 16" butterfly valve and throttles the flow of service
water to.the heat exchanger to control.CCW temperature.
Repeated
attempts to open the valve failed; however, it operated properly
when isolated._ CCW Loop 2 was removed from services declared
l
inoperable, and Loop'3 was placed in service. When Loop:3 was
l
placed in service, CCW temperature began to rise above.its
operating temperature of 95 degrees F.
The operators found that
.
setting the controller for SW-1429 (companion valve on Loop 3
'l
to SW-1434) to 50 degrees F. resulted in maintaining CCW temper-
ature at 95 degrees. The controller was subsequently recalibrates
and SW-1429 functioned properly.
~
Licensee Evaluation
The licensee had previously experienced problems with SW-1434
stroking and maintaining temperature.
Testing performed during
early. troubleshooting (December 1986) indicated that there was
significant seat leakage through the valve and this was deter-
mined to be a contributor to the temperature control problems.
The stroking problem appeared to be corrected af ter adjustments
were made to the actuator and valve linkage. Attempts to
completely resolve the temperature control problem continued;
however, when a complete new valve was ordered in March of 1987,
the licensee discovered that the vendor, Hammel-Dahl, no longer
had an N-stamp and could not supply replacements.
During an
outage in June 1987, SW-1434 was removed and dismantled for
,
inspection and refurbishment. At that time the valve was found
!
to have a-large cavity caused by erosion / corrosion (attachment
12) in the top of the seat. Engineering evaluation indicated
that excessive leakage flow through the cavity caused unbalanced
forces across the valve which opposed the operation of the valve
actuator.
The magnitude of these forces was determined to be
-
large enough to prevent opening the valve. The evaluation
indicated that rotating the valve body 180 degrees to place the
cavity at the bottom would result in the unbalanced forces
assisting the opening of the valve.
SW-1434 was refurbished,
j
reinstalled, and surveillance tested to verify operability.
A
21
m
. _ .
-
-
~.
f
.
special.. test prepared to check the valve at design flow, conditions
could'not be performed at'that time.due to plant and atmospheric
conditions.
In parallel.with that activity, the license ident-
'
ified a new source for replacement valves and has ' ordered
replacement valve bodies. Following the September 7,1987-
failu_re of'SW-1434 to open, the .. licensee reviewed the earlier
,
engineering evaluation and determined that the rotation of the.
- valve body did not resolve the stroking' problem and that-the
- most probable cause of. SW-1434's failure to open was that
.
i
- unbalanced forces, resulting from the leakage throFgh the' cavity
and. acting on the valve disc, opposed the valve actuator enough
to prevent'its' operation. 'The licensee has concluded that.
similar failures to open should not occur with the temperature
control. valves on the other two CCW-loops. This is based on no
evidence of the excessive leak-through which was) observed on
SW-1434.
A review of calibration and maintenance history and of controller
design revealed that the temperature controllers used for the
service water outlet' valves on all three CCW heat exhangers are
sensitive to_ changes in service water temperature. .The licensee
has determined that the controller is not adequate to perform
i
over the range of service-water temperatures which occur with~
seasonal or climatic changes and that the root cause of the
difficulties experienced with SW-1429 were the result of change
,
- in service water temperature since the controller was last
'1
calibrated.
- j
J
Licensee Corrective Actions
j
1
SW-1434 was declared inoperable following the September 7,1987
]
failure' and will remain out of service until the replacement
valves arrive on-site.
The new valves are scheduled to arrive
I
by October 4,1987 and replacement is planned to occur as soon
'
as'possible thereafter.
The temperature controller for SW-1429 was recalibrates and
I
functioned properly afterward. The licensee has determined that
climate related calibrations are necessary to ensure proper
operation.of the temperature controllers and is evaluating the
scheduling of that activity.
)
In an effort to detect problems similar to those experienced
with SW-1434, the licensee is evaluating the adequacy of the
present surveillance requirements for the CCW Heat Exchanger
Service Water Outlet Valves.
AIT Review
The AIT reviewed the maintenance and calibration history for
these valves, engineering analyses addressing the flow induced
forces which are considered to be the cause of the valve's
failure to open, procurement documents for the replacement
valves, Technical Specifications related to the service water
22
(
'
_.
_
- _ _ _
-
m
,_
- .
,
i
.
system, and. met with members of the licensee's engineering and
operations staff.
,
The AIT noted that the licensee was' aware of problems with
these valves prior to the event and was pursuing resolution in
an acceptable manner. The team considers the licensee's
' probable cause reasonable.in light of the fact that the valve
opens properly when it is isolated and that the failures are
only_ evidenced when the valve is subjected to pump head. _The
, AIT noted that the licensee intends- to completely replace the
' valve portion of SW-1434 at the earliest opportunity after the
- replacement arrives on-site (presently scheduled 'to arrive on
' '
' October,4,1987). The approach proposed by the licensee to
resolve the stroking problems appears acceptable.
,
1
The need!to recalibrates the presently installed temperature
controllers on a seasonal / climatic basis is clear in light of
their demonstrated sensitivity to ' service water temperature.
The team is concerned that these climatic recalibrations may
not be performed _ when conditions- require because, conventional
scheduling programs function on a pe.riodicity basis and have no
. provision for dealing with a variable such as climate.
SW-1434 serves a safety function in that the valve is required
to open automatically on an Safety Feature Actuation Signal
(SFAS) Level 2 to provide a redundant supply path of cooling
-water to engineered safety feature components. Since the valve
would not open on demand from the control room _or^ locally, it
-is questionable as to whether or not the valve would have
properly responded to an SFAS Level 2 signal; however, two other
trains were available to supply cooling water.
The failure of
Technical Specification surveillance testing to identify the
problem with SW-1434 is_of concern to the AIT and the team
concurs with.the licensee.that there is a need to evaluate the
-
adequacy of their surveillance testing of these valves.
7.
Decay Heat Removal (DHR) System Void Formation
Problem
While attempting to place the DHR system in operation during
4 cooldown to Mode 4, pressurizer level dropped a total of 16
inchu when the isolation valve between the Reactor Coolant
System (RCS) and DHR was opened (attachment 13.
DHR was. lined
up for operation and in preparation for starting the DHR pump
the suction valve from the RCS, DH-1518 was opened. When
DH-1518 was opened pressurizer level immediately dropped ten
inches; DH-1518 was immediately closed. The operator began a
system search for leaks and also vented all of the system high
,
"
points outside of containment: no leaks were found and the
system seemed to be filled and vented. The Shift Supervisor
decided not to enter containment at that time.
DH-1518 was
reopened and pressurizer level dropped an additional six inches
and then stabilized. At that time the Shift Supervisor
23
_ _ _ _ - .
_
--
-
__
\\{
a+
.. ,
9?
J
n
[
,
_
'
t
-a
..
entry was required to check for air in the -
a
x
.
determined that an
piping'in containment. When the DHR system' Loop.2 high point
vent (DH-74) inside containment was opened, a froth mixture of
gas and water was vented' for'approximately .twentp minutes.
before a solid stream of water.was obtained) After the venting
of the high points in the system was completed DHR pump 2 was
,
started and operated satisfactorily.
'
Licensee Evaluation'
'
<
The licensee' has determined that the most probable cause for
~ the void in the DHR system was .the of f-gassing of nitrogen from
.
1
the water ' leaking through check valve 'DH-76 f rom the Core. Flood.
.(CF) system at approximately 600 psig to the DHR system at
.h
'
approximately,30 psig. . The nitrogen coming out of solution
j'
collected in the highest portions of the DHR system piping and
the loss of pressurizer level was caused by the compression of
the' gas bubble.
{j
Surveillance testing of DH-76 during the' June 1987, outage.
9
indicated back-leakage of approximately'.r5 gallons per minute
-(
(GPM). Since this is well below the Technical Specification
'
limit of 5 gpm for that valve the licensee determined that'it
was acceptable to operate with that leakage and repair DH-76 at
.
the next refueling. outage. With the CF system at approximately
600 psig and the DHR system in standby at approximately 30
psig, backleakage through DH-76 would pressurize.the DHR system
and unless a' relief path were provided the 75 psi'g relief valve i
on the su'ction of-the DH pump would periodically. lift to
relieve,the overpressure. . Using their temporary modiffeltiop
r
procedure the licensee provided a continuous drain set e/aal to
the leak rate of DH-76 on the common suction of the Containment
Spray and DHR systems.
Prior to return to power thejDHR system
was filled, vented, tested and the plant operated from June 13
I.
to September 6, 1987 with this configuration in place. An
\\.
engineering evaluation confirmed that the 'obseryed pressurizer
'
,
,
level drop and the size of the void based on the piping
,
,
configuration were consistent with the amount 'of gas calculated
U
to be released from the known leakage through DH-76.
'
The licensee has concluded that the void was l'imited to the
high point DHR pump discharge piping inside containment based
i
on the successful venting and subsequent operation of the
4
system and absence of identified voids during the venting of/.
the high points outside containment.
Licensee Corrective Actions
The licensee has both short and long-term corrective actions in
2
progress with regard to this problem.
In the short-term, the
drain on the common suction was removed, a temporary modification
installed a constant vent at DH-74 to prevent overpressure and
vent off any nitrogen which may come out of solution from the
back-leakage, and the other DHR loop was vented to ensure that
>
24
_ _ _ _ _
n-
v
ge;_-
y
w
l:
a. .
p
,
-
m
- "
+r
g
j
'
sqf
"
P-
-
u;
o
,
no. voids,were present.
In the long-term, D M 6 will be repaired
'e
'
durir.g?the forthcoming refueling outage, other systems will be
eveQuptpdforsusceptabilitytosimilarproblems,andtheindustry
wi'Ii ve notified of the possible generic aspects of this problem.
9
$ ,.
[
AIT Reviewe
N'
W
1[ .
_
,
'
,
,
'
Rif
_ , The AIT' reviewed the Technical Specifications related to ECCS
W
o'
h
. check valves., the maintenance history of DH-76, the surveillance
,
l#
d'
, test results which . identified the'back-leakage,- system piping
I
and instrumentation diagrams and isometric drawings, the temporary
' modification packages for'both the intial drain line and the
proposed constant vent, and the operating procedure for lineup -
'
and operation of the Decay Heat Removal system <
'
e'
.The team determinad that the licensee's operation of the plant
from June'13 through. September 6, 1987 with the known small check-
valve 1erkage and temporary drain line for DHR system overpressure
protection was technically justified and acceptable. The
ih. . ,
. Technical' $pecifichtien limit for leakage through CH-761s five
n
gpmTnd the identified leak rates ranged from .045) to .7 gpm
(one yo two orders of magnitude less than allowed).: Thb team ~
finds the licensee's installation of a constant veM tAHhe high
point to f>e an acceptable short-term' solution prov?ded h,erating
4
<
' procedures are revised to accomodate the modification ands
i-
'
provisions are made to ensure that an increase in the leak rate
does not go undetected. The long-term actMon to repair DH-/6
during the, next refueling outage is also hcceptable,
.
t
Operato' Perfobiance During and After the Transient
C.
r
Membdrs of the AIT reviewed the performance cf the operators .during
,
the transient and the post-trip recovery period. The review' consisted
1
of inspection .of control room logs, computer print-outs, alarn pr%t-
outs, procedures, ard interviews with the operators. The' inspection
i
determined that two personnel errors occurred during the event.
4
The first error involved the position of the Rod Group Selector Switch
which would have normally been in the Group 7 position for.the present
'l
rod configuration. Troubleshootjns being performed on the transfer
'
confirm light required that the switch be placed in the Group 8
o
.
Axial. Power Shaping Rods (APSR) ! position for approximately five to
"
ten minutes twice pe= shift. At the time of the transient, the Rod
'i(
Group Selector Switch had been il the Group 8 position for about an
,
hour. The reactor operator, who had control of the primary panel
for only as few minutes prior to the. trip, was not . aware of the
selection of Croup'8 as a result of an' incomplete turnover. As the
transient progressed, he noted that power was approaching the high
I
'
flux trip setpoint and attempted to drive rods in 'to turn power.
Although he intended a negative reactivity insertion with Group 7,
what ac6 ally occurred was a radial displacement of' core flux causing
]
,'
a rise ,in indicated power. With the Integrated Cohtrol System (ICE)
,
in Auto, Group' 7 rods were initia?iy inserted by ICS and may have
stabilized power at approximately 103 percent without tripping the
/
>
I'
h
,
,
,
s "l
.J__,
I
e
_ _ _ = _
_,
,
..
p'
~
^y;g}i
c
"
q_
f
,
<
.)
<+
g.
,
/k
-
<
"
4
c
reacteri The' flux displacement from. inserting the APSRs, combined
with the re 4ctivity fro ( the feedwater induced temperature excersion
caused the reactor"to trip on high flux.
s ., .
n
- Tho ,econd erfor was committed about one:and one-half hours after
k
th'e trip when' an operator, verifying breaker indication prior to
re-energizing Bus A, inadvertently tripped Reactor. Coolant Pump -2-1.
r;PThe pdmp was restarted 6pprk.imately one minute later and'had no
~
'
-
. effect ca the transient recovery other than a momentary delay in
y
re- eriergizing Bus A.
The breaker indication check is a controlled,
non-stress evolution and the operator involved has no explanation
s
7,
t
.
{r,
for 9ny he' tripped the wrong pump'.
>
9? y #
The-AIT.has the followin'g comments concerning the operators' responses
'
,
s.a
during the the. event:
4
.
1.
"With the exception of the two personnel errors. discussed above,:
'*
'
t
,
th AIT.has concluded that the. operators on-shift during the
h'
,-
'e n nt took prompt and proper corrective action in response to
a
3'
the: initiating feedwater indication failure, the reactor trip,
pud the subsequent equipment problems.
'q2 . ,With regard to the first error, the' AIT concluded that the
5
,foperatar'sattempttoturnreactorpowerbydrivinginGroup7
'
was-proper. Although the Rod Group-Selector Switch was .in the-
'
' Group 8 position Tor far longer than intended by the trouble-
,
shooting prtcedure,'the unintended flux displacement resulted
'
+,4
from the. operator's.being unaware that Group 6 was sclected,
v .,
./ This lack of awareness was caused by' ineffective control room
.
communications; in this instance an incomplete turnover between
V
', operators . This was also revealed by the failure to adhere.to
the troubleshooting guidance for.the transfer confirm light,
7
a
3.
With regard to the second error, the AIT noted that the operator
was fully aware of what the correct actions were, was prepared
to perform them in a controlled manner, and for reasons which he
is unable to explain, erred.
2
r
D.
Generic Aspects of Specific Equipment Problems
1.
Bus A Auto-transfer
Westinghouse type 15DHP750C 15kV 2000 amp circuit breakers are
used in both safety and non-safety applications in many nuclear
facilities. The clearance adjustment for floor tripper interlock
mechanisms on these breakers is'very critical and misadjustment
will render the breaker inoperable.
Because of the broad use of
]
these breakers throughout the industry the AIT considers this
]
problem-to have generic implications for all facilities using
,
these type breakers.
26
_n______
._
_ _ _ .
)
- . .
.
t
i
2.
Decay Heat' Removal System Void Formation
Neither the AIT nor the licensee had any knowledge of previous
occurrences of a problem like this at their facility or any
other.
The Emergency Core Cooling Systems (ECCS) at Davis-Besse are
similar in design to those used at all Pressurized Water Reactor
facilities regardless of vendor. They consist of a passive
system (intermediatepressure,nitrogenloaded,boratedwater
injection tank) and an active system (low pressure, high flow,
pump driven) connected to the Reactor Coolant System (RCS) with
the high/ low pressure interfaces controlled by check valves.
The primary difference between the Babcock & Wilcox design, as
used at Davis-Besse, and the Westinghouse and Combustion
Engin2ering designs is how the systems are connected to the
reactor vessel.
In the B&W design the systems are connected by
a separate core flood nozzle and the other vendors connect these
systems to RCS loop-piping. The high/ intermediate / low pressure
interfaces and check valve locations are identical for all three
designs.
'
ECCS check valve leakage is a common occurrence at PWR facilities
and Technical Specifications require periodic surveillance testing
to detect and quantify any existing leakage. The Technical
Specifications also provide limitations to ensure that excessive
leakage does not compromise the ability of the systems to perform
their functions.
The potential consequences of the formation of a void in the
Decay Heat Removal system, as occurred in this event, are that
initiation of the DHR sytem may be delayed for several hours at
j
a critical time and that transfer of the void to a depressurized
i
'
reactor vessel could interfere with the establishing of f.orced
! ,'
recirculation or natural circulation flow during an accident.
Recognizing that ECCS check valve leakage is known to occur and
that the system designs are nearly identical, the AIT is
concerned that all PWR facilities may be susceptible to this
type of problem.
i
l
l
l
1
L
l
I
i
27
!
L
- - - - - - ---- -
d
y j
i
- IV. SUMMARY'
t
,
A.
Safety Significance
After careful review of the transient and the subsequent equipment
malfunctions which occurred, the AIT concluded that this event'did
not pose any hazard to the public nor did it raise.any significant
safety concerns regarding the operation of the facility. The safety
significance was evaluated with respect to operator performance,
safety system performance, and licensee response. The AIT-found
that with thel exception of the two errors noted in Section III, the
operators responded properly to minimize the consequences of the
event. During and immediately after the reactor trip, all safety
systems functioned as required; the problems encountered with safety
systems. developed during the post-trip recovery. The licensee's
response to the event was aggressive, thorough, and indicative of
commitment to safety.
B.
Event Reporting
The AIT evaluated event reporting with regard to the notifications
required by 10 CFR 50.72 and communications with the resident
inspectors and regional management. The team reviewed NRC and
licensee transcripts of the 10 CFR 50.72 notification call, listened
to a copy of the NRC Headquarters Duty Officer recording of the call,
and interviewed licensee personnel, the Senior Resident Inspector,
and members of regional management.
The team concluded that the. event was adequately reported although
-
some problem; were identified. The required notification to
Headquarters was made approximately twenty minutes late. The cause,
4
as identified by the Shift Supervisor in charge at the time of the
event, was that his watch stopped and that when he was reminded of.
the call, it was already late. The amount and content of the
q
information transmitted was adequate with'the exception that the
licensee did not specifically state that Emergency Diesel Generator
No.-I had auto-started and loaded in response to the loss of voltage
,
on Essential Bus C1 and that Service Water Pump 1-1 had failed to
auto-start when Bus C1 was re-energized.
C.
Conclusions / Recommendations
The AIT recommends the following with regard to both plant specific
and generic aspects of this event:
1.
The licensee should re-evaluate their interpretation of
Technical Specification 4.8.1.1.1B and develop a surveillance
procedure which specifically tests the auto-transfer of power
from the Unit Auxiliary Transformer to the Startup
1
Transformers.
2.
Region III should determine whether or not the licensee has
,
misinterpreted 4.8.1.1.1B and failed to perform adequate
surveillance of the electrical power distribution system.
28
_ - __
,b
.-
3.
The licensee should develop a surveillance test which verifies
the auto-start of the Service Water Pumps on a loss-of-offsite
power signal .
Further, the licensee should consider an
ammendment to their Technical Specifications to incorporate
this testing.
4.
The licensee should implement a program to evaluate the
operating parameters (number, frequency, acceleration of lifts)
of the Main Steam Safety Valves in order to make necessary
charges.
In addition the licensee should evaluate methods to
reduce the number of lifts experienced by these valves at
i
Davis-Besse.
5.
The licensee intends to completely rebuild / refurbish the
Startup Feedwater Control valve during the forthcoming
refueling outage. The licensee should conduct a closely
monitored post-maintenance testing program for these valves
during startup and power ascension following that outage,
l
6.
The licensee should continue their engineering evaluation of
the configuration of the turbine bypass valve header in light
of the failures being apparently limited to the
"B'.' header.
Because of the critical tolerances involved in the setting of
the mechanical stop and cam follower, the. licensee should
evaluate the implementation of a periodic testing program to
j
verify the proper operation of the turbine bypass valves.
~
7.
Region III should determine if the the surveillance testing for
the CCW Heat Exchanger Service Water Outlet valves was adequate.
8.
The void in the Decay Heat Removal system appears to have
generic implications because of the common design of PWR ECCS
systems and the common occurrence of check valve back-leakage.
Region III should assess the generic implications of this
occurrence.
9.
The failure of breaker HX01A to close due to the misadjustment
of the floor interlock tripper mechanism appears to have generic
implications due to the industry's broad use of this model
breaker in both non-safety and safety systems. Region III
should assess the generic implications of this occurrence.
The team found that where a previous history of problems existed
with a component that malfunctioned during the event, the licensee
had already identified the problem and was pursuing resolution.
Resolution for two of the four historical problems was limited by
availability of parts and the other two were undergoing engineering
,
evaluation.
'
The team noted that the licensee's task force approach to assessment
of the event was aggressive, thorough, and effective.
In addition
to determining root causes and corrective actions for the various
equipment problems, the task force identified areas of equipment and
.
systems performance requiring attention and provided a forum for the
l
consideration of operator concerns arising from the event.
'
l
29
1E__
3
.s_
.
The AIT concluded that the safety significance of the event was
minimal due to the nature of the initiating problem, the response of
the plant systems, the response of the operators to the trip and the
subsequent equipment malfunctions ~,
i
I
30
. _ . _ _ _ _ . _ _ _ _ _ _ . _ _ _ _ _ _ - _ _
_ _ - _ _ _ _ _ _ _ _ _ _
!
-
..
ADDENDUM TO AIT INSPECTION REPORT
Between-the end of the inspection and September 15, 1987, the licensee completed
all of the actions required by the Confirmatory Action Letter of September 9,
1
'
1987. The completion of these items was verified by the resident inspector
staff.
To provide additional assurance that plant systems were ready to support power
operation, the resident inspectors and a regional inspector conducted an
inspection of maintenance backlog and a walkdown of several plant systems.
The results of this inspection are documented in Inspection Report
50-346/87022(DRP).
On September 16, 1987, the Regional Administrator authorized the restart of
Davis-Besse, Unit 1.
The reactor was critical at 8:13 p.m. (EDT) that day,
the generator was synchronized to the grid at approximately noon the next day.
The startup and return to power operation were monitored by the resident
inspectors, assisted by a regional inspector,
l
.
f
31
,