ML20244D816
| ML20244D816 | |
| Person / Time | |
|---|---|
| Site: | Millstone, Haddam Neck, 05000000 |
| Issue date: | 04/13/1989 |
| From: | Mroczka E CONNECTICUT YANKEE ATOMIC POWER CO., NORTHEAST NUCLEAR ENERGY CO., NORTHEAST UTILITIES |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| REF-PT21-89, REF-PT21-89-061-000 B13178, PT21-89-061-000, PT21-89-61, NUDOCS 8904240128 | |
| Download: ML20244D816 (10) | |
Text
- - _. - -
t N UTIIJTIES o n.,.i Orric.. seiden Street, Berlin, Connecticut I
wistia sucuens ucmc w" P.O. BOX 270 HARTFORD, CONNECTICUT 06141-0270 J ",j",Z SUjy"cou,",
(203) 665-5000 k
L April 13, 1989 Docket Nos. 50-213 50-245 50-336 50-423 B13178 U.S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555
References:
(1)
E. J. Mroczka (NU) letter to W. T. Russell (NRC), Report of Substantial Safety Hazard, B12863, March 25, 1988.
(2) Rosemount letter to Northeast Utilities, Rosemount Nuclear Qualified Transmitters, December 9, 1988.
(3) Rosemount letter to Northeast Utilities, Notification Under 10CFR21, February 7, 1989.
Gentlemen:
Haddam Neck Plant Millstone Nuclear Power Station, Unit Nos.1, 2, and 3 Rosemount Transmitters This information letter is being submitted to provide a summary of our activ-ities involving Rosemount transmitters.
Since Rosemount transmitter failures were first identified at Millstone Unit No. 3 in 1987, Northeast Nuclear Energy Company (NNECO) personnel have been actively involved in evaluating and addressing this concern.
In addition, we have had a number of discussions with the vendor, NRC inspectors, and various industry representatives, and have met NRC reporting requirements on this issue.
Since our knowledge has substantially increased on this issue since the docketing of Reference (1),
NNEC0 believes it is appropriate to ensure the NRC Staff is more fully informed, by providing this information letter.
Backaround During the first cycle of Millstone Unit No. 3 operation, five Rosemount capacitive-type differential pressure transmitters failed in the reactor coolant system.
Twelve such transmitters are used to monitor reactor coolant flow in the primary loops and provide a reactor trip signal to the reactor protection system.
There are three transmitters in each loop.
If any two of the three transmitters in a loop sense low flow, a trip signal is initiated.
The failures occurred individually over a period between March and November 1987, such that two transmitters never failed simultaneously in any one loop.
8904240128 890413 PDR ADOCK 05000213 7
I S
PNV
4 U.S. Nuclear Regulatory Commission I
B13178/Page 2 April 13, 1989 Each failed transmitter was taken out of service and the affected channel was placed in the trip condition. The transmitters that failed were all Rosemount model 1153 HD5PCs.
Attempts to calibrate the failed transmitters were unsuccessful and the transmitters were replaced.
The five failed transmitters were returned to Rosemount and destructive testing determined a loss of oil to be the cause of the failed condition.
The individual failures of these transmitters were evaluated for deportability in accordance with station procedures.
The plant remained in compliance with technical specifications and no reportable condition existed under 10CFR50.72 and 50.73.
However, NNECO concluded that the number ' of failures was of concern.
Accordingly, an evaluation was initiated in late November 1987 to determine if a Substantial Safety Hazard existed.
This included technical reviews performed by engineering disciplines and operations personnel, meetings with the vendor, deliberations by the Millstone Unit No. 3 Nuclear Review Board, and a final determination by a senior.arporate officer.
A conclusion was reached that the five failures represented a substantial Safety Hazard, and the NRC Staff was accordingly notified under-10CFR21 on March 25, 1988 (Reference 1).
That notification also informed the NRC Staff that the Rosemount problem existed at Millstone Unit No. 3 and not at NU's other plants.
The Haddam Neck Plant does not have Rosemount transmitters.
Millstone Unit No. I has ten safety-related Rosemount transmitters, model 1152, that are used only for ATWS mitigation.
Millstone Unit No. 2 has Rosemount transmitters, three of which are used in safety-related applications, and two of these are similar in model number (1153HD5PA) to the Millstone Unit No. 3 failures.
Reference 1 also reported that Millstone Unit Nos. I and 2 have not exper-ienced this problem.
In addition to having replaced all failed transmitters by the end of the first cycle, NNEC0's corrective actions included the preparation of an in-service test procedure, and a monthly test of all twelve (12) Rosemount transmitters in the reactor coolant system throughout Cycle 2 operation.
Millstone Unit No. 3 is scheduled to shut down for the second refueling on May 20, 1989.
Since the first cycle, no additional failures of Rosemount transmitters have been observed.
Continuina Review Recognizing that the monthly test may not in itself provide total operability information, in addition to the monthly surveillance being performed at l
Millstone Unit No. 3 over the past year, NNECO has continued to investigate l
the Rosemount transmitter issue.
During a meeting on February 6,1989, NNECO concluded that all new information should be evaluated to ensure operability I
and deportability requirements were being fully met.
Accordingly, new eval-l uations were initiated on February 8,1989 for Millstone Unit Nos.1, 2, and
t U.S. Nuclear Regulatory Commission B13178/Page 3 April 13, 1989
-3.
The evaluations focused on new information provided by Rosemount and on information that was learned as a result of increased analysis of data from Millstone Unit No. 3.
In Reference (2), Rosemount confirmed to NNECO that there was a problem affecting Rosemount transmitter models 1153 and 1154.
The letter stated that a small number of these transmitters may respond sluggishly to input changes or may drift outside normal specifications.
The source of the problem was identified as a loss of oil within the sensor cell.
Several oil loss paths were possible:
the glass-to-metal interface, fill tube and damaged isolator diaphragm.
The letter stated that the failure was a random and low probabil-ity event.
Finally, Rosemount identified that increased acceptance criteria were added to the cell manufacturing and testing process, to assure a reliable product.
In Reference (3), Rosemount provided a 10CFR21 Notification to NNEC0 concern-j ing the problem affecting Rosemount transmitter models 1153 and 1154.
In this i
letter, Rosemount stated that the loss of oil from the sensing cell may cause a reduction in transmitter performance (such as drift, lack of response and an increase in response time).
The letter also stated that the problem may be unidirectional.
In addition, no firm limits could be placed upon the perfor-mance reduction of a failed transmitter.
The scope of the problem as indicated in Reference (3) is believed to be limited.
Information used in Rosemount's assessment suggests that trans-mitters in service longer than 36 months may not exhibit the loss of oil
- failure, i.e., failures exhibit an infant mortality nature.
This is because the failure is related to a specific manufacturing process and is not directly service related. No known loss of oil failure has occurred after 30 months of service.
The Millstone Unit No. 3 transmitters now have approximately 36 months of service.
The information in Reference (3) did not rule out generic applicability.
The letter stated that
... prior to detectable failure, the transmitter may continue to provide a signal but not respond over its full range and/or time response may be significantly degraded.
This may be a safety concern at your plant."
Rosemount also stated that action has been taken to correct the source of the problem by " improving the manufacturing process and intensifying test criteria."
Therefore,
... potential for failures of this nature in transmitters currently being produced has essentially been eliminated."
Reference (3) also identified that all failures reported to Rosemount have occurred in certain groups of transmitters.
Transmitters from these groups that were shipped to the Millstone site were identified in an attachment to the Rosemount letter.
A total of 16 transmitters were listed as having come from batches with confirmed failures.
Our review of this list confirmed that 13 of these were used in Millstone Unit No. 3 and three of these were used in Millstone Unit No. 2.
We have identified the locations of these transmitters
U.S. Nuclear Regulatory Commission B13178/Page 4 April 13, 1989 in our plants, and determined the effect that reduced transmitter performance may have in each application as described below.
Millstone Unit No. 3 - 13 Transmitters from Suspect Batches The identification, function, failure effects and calibration results for each of the 13 transmitters from manufacturing batches with confirmed failures is described below:
Additional actions that provide increased operability confidence are described later in this letter.
Model No.
Serial No.
Plant Taa No.
Function ll53DB5 408073 3CHS*LT102 Boric Acid Tank Lvl. TK5A 11530B5 408074 3CHS*LT104 Boric Acid Tank Lvl. TK5A 1153DB5 408076 3CHS*LT106 Boric Acid Tank Lvl. TK5B These transmitters are used to measure boric acid tank level.
Two of the transmitters are on Tank 5A and one is on Tank 58.
These transmitters are listed in the Unit 3 Technical Specification Section 3.3.3.5 as being part of the required Remote Shutdown Instrumentation.
There are two sensors on each tank and the minimum number of sensors required is one.
Therefore a failure of any one of these sensors would not jeopardize remote shutdown capability.
These transmitters were calibration checked in February 1989 and found to be in noraal working order.
Model No.
Serial No.
Plant Tao No.
Function ll53DB5 408078 3SWP-FT59A CTMT Recirc Cooler A outlet Flow 1153DB5 408079 3WSP-FT59B CTMT Recirc Cooler B outlet Flow These transmitters are used to measure service water outlet flow through the containment recirculation coolers.
They provide only a monitoring function.
Failure of the transmitters would not prevent any of the recirculation coolers l
from performing their safety function.
These transmitters were calibration checked in February 1989 and found to be in normal working order.
Model No.
Serial No.
Plant Tao No.
Function 1153HD5 408188 3RCS*FT424 RCS Flow Loop 2 1153HD5 408190 3RCS*F1426 RCS Flow Loop 2 ll53HD5 408103 3RCS*FT436 RCS Flow Loop 3 These transmitters are used to measure reactor coolant loop flow. There are a 1
total of three transmitters installed in each loop. Two out of three logic is used to provide a low flow reactor trip at full power.
Two of the above
I i
o U.S. Nuclear Regulatory Commission i
813178/Page 5 April 13, 1989 transmitters are installed in loop 2 and one is installed in loop 3.
If the two transmitters installed in loop 2 fail simultaneously then the plant would not be able to provide a loop 2 low flow reactor trip.
In February 1989, all RCS flow transmitters were monitored for performance using high speed data acquisition equipment and/or using the Offsite facility Information System (0FIS). All transmitters were found to be in normal working order.
Model No.
Serial No.
Plant Tao No.
Function 1153HD5 408198 3RCS*LT461 Pressurizer Level This transmitter is used to measure pressurizer level.
There are three transmitters measuring pressurizer level and providing a 2 out of 3 high-level reactor trip.
Should the transmitter fail there would still be two other transmitters that could provide the reactor trip function.
This transmitter was calibration checked in February 1989 and found to be in normal working order.
Model No.
Serial No.
Plant Taa No.
Function 1153GD8 411114 3RCS*PT403A RCS Pressure Wide Range This transmitter is used to measure wide range RCS pressure.
It is used to provide indication, alarm, input RHR valve interlocks, and input to the inadequate core cooling monitor.
A redundant channel utilizing Foxboro transmitters is provided.
The Rosemount transmitter channel was checked aqainst the Foxboro transmitter channel using 0FIS data and no anomalies were coserved. This transmitter was calibration checked in February 1989 and found to be in normal working order.
Model No.
Serial No.
Plant Taa No.
Function 1153HD5 408197 Not Installed None 1153005 410157 Not Installed None ll54DP4 414993 Not Installed None The above transmitters are not installed and therefore pose no safety con-cerns.
Millstone Unit No. 2 - Three Transmitters from Suspect Batches Reference (3) identified three transmitters from suspect batches which were used at Millstone Unit No.
2.
The identification, function and failure effects of each of these are described below:
Model No.
Serial No.
Plant Taa No.
Function ll53HD5PA 411943 RCS-LT-110Y Pressurizer Level L
O U.S. Nuclear Regulatory Commission B13178/Page 6 April 13, 1989 This transmitter is one of two transmitters used to provide pressurizer level indication signals.
The level signals are used for control and indication, and they provide no reactor protection or engineered safeguards actuation functions.
The selection of either of these two transmitters is made man-ually.
Technical Specification sections 3.3.3.5 (Remote Shutdown Instrumen-tation) and 3.3.3.8-(Accident Monitoring) both require a minimum of one channel to be operable in modes 1, 2, and 3.
Loss of both transmitters would require plant shutdown if not restored within seven days.
The pressurizer level signals are Type A variables per Regulatory Guide 1.97 and they are also referenced in the plant Emergency Operating Procedures as one means of eval-uating RCS inventory conditions during POST-LOCA operation.
This transmitter was calibrated and response checked in February 1989 and found to be in normal working order.
Model No.
Serial No.
Plant Taa No.
Function ll53HD5PA 411942 Not installed None ll53HD5PA 411944 Not installed None The above spare transmitters are not installed and therefore pose no safety concerns.
Millstone Unit No. 1 - Transmitters from Suspect Batches Millstone Unit No. I has not received transmitters from the batches in question.
Haddam Neck Plant - Transmitters from Susoect Batches The Haddam Neck Plant has not received any transmitters from batches in question, and Rosemount transmitters are not used in any applications at the plant.
Summary of Transmitters from Susoect Batches Rosemount informed NNEC0 under 10CFR Part 21 that a potential failure could occur in Rosemount model 1153 and 1154 transmitters. The loss of sensor fluid failure mode may cause the transmitters to exhibit reduced performance prior to a detectable failure.
Rosemount indicated that the reported failures all occurred in certain manufactured batches.
Millstone Unit No. 3 received 13 transmitters from suspect batches and Millstone Unit No. 2 received 3 trans-mitters.
The functions and failure effects of these transmitters have been identified.
In addition, all of the installed transmitters from these suspect batches were performance checked in February 1989 and found to be in normal working order.
i
'O o
U.S. Nuclear Regulatory Commission B13178/Page 7 April 13, 1989 Inspection of Rosemount. Inc.
NNEC0 has responsibility under 10CFR50 Appendix B to assure that its suppliers of safety-related components are complying with applicable requirements.
Because of our concerns on the Rosemount transmitters, we sent an experienced mechanical engineer to the Rosemount facilities in February 1989 to review their transmitter sensor manufacturing and inspection process, and to verify improvements that have been made.
The inspection focused on the following specific concerns:
1)
Rosemount's determination of the root cause of the failures.
2)
The methodology used by Rosemount to restrict the problem to a subset of transmitters.
Rosemount has concluded, and we concur, that the root cause of failure is the lack of bond between the glass and metal cup within the transducer cell.
The critical manufacturing operation is the furnace glass seal and its preparatory steps.
In August of 1986, Rosemount undertook a process optimization program which, when completed in March of 1987, cut their reject rate from approx-imately 20 percent to 1-to-2 percent.
This, in conjunction with increased testing and inspection criteria, is the basis for Rosemount's determination that the problem will not exist with units manufactured after the first quarter of 1987.
The failures to date have been numerically small, the first documented failure occurring with a 1979 shipping date.
The latest shipping date for a failed transmitter was in the first quarter of 1987.
There were approximately 300 lots totaling just over 14,000 units produced between those dates.
As of February 1989, Rosemount has had 84 reported failed units classified ~as " low oil" failures. Upon testing, 6 of those were found to be due to other causes.
Each of the 78 low oil failures was traced back to its manufacturing lot and 20 lots were classed as suspect.
There are 1004 units in those 20 lots of which 16 units were supplied to NNECO.
Factors mitigating the conservative nature of this data are:
1.
The failure is of the infant mortality type; the metal-to-glass bond delaminates upon cooldown from the furnace temperature to ambient.
2.
The o/erall failure rate is low.
3.
The failures are due to small process variations that are lot dependent.
Therefore, while both Rosemount and we believe that additional lots may be added to the suspect list due to additional failure information, the total number of failures will remain low (in the range of one-percent or less of all units produced).
In addition, units in service are less likely to be found failed due to low oil as service life increases.
Of the known loss of oil I
_____- _ a
h U.S. Nuclear Regulatory Commission B13178/Page 8 April 13, 1989 l
failures, the shortest length of service time was a few days and the longest 30 months.
The most frequent lengths of service before failure were 12,18, and 27 months.
This data is derived from calibration or refuel outage dates and is not truly actual service time.
The Millstone Unit No. 3 transmitters have now operated for approximately 36 months.
Additional Actions Taken to Prostde Operability Confidence In addition to those transmitters specifically listed by serial number and identified by Rosemount as being of concern, we have reviewed all other l
Rosemount transmitters in safety-related applications.
All safety-related Rosemount transmitters were evaluated by specific function to assess what, if any, further testing or analysis was appropriate. These fell into two primary categories, transmitters that for various reasons did not require further testing and/or analysis and transmitters that did require further testing and/or analysis.
Further testing and analysis consisted of calibration checks, review of 0FIS data and/or review of transient analysis data as appropriate to detect any performance anomalies. To date, none of these other transmitters have exhibited symptoms associated with the loss of sensor fluid problem.
Rosemount has stated in References 2 and 3 that industry data has shown that the transmitter failures are random with the highest probability of occurrence during the beginning of operation.
NNEC0 has not discovered any additional transmitters that have experienced this failure mode.
We believe this supports the infant mortality conclusions that were independently reached as a result of our inspection of Rosemount's facilities.
Future monitoring of our Rosemount transmitters includes a program at Millstone Unit No. 3 which will (1) verify transmitter performance utilizing 0FIS data and (2) instruct instrument technicians of symptoms to be alerted to, which would be indicative of degraded transmitters.
Conclusions on Failure Symotoms Our e.aluations and analyses of Rosemount transmitters described in this letter have lead us to conclusions that any of the following symptoms may be an indication of transmitter failure.
1.
Slow drift in either direction on the order of 1/4% per month.
2.
"One sided" noise from flow signals.
3.
Slow response to a transient or inability to follow a transient.
4.
Decrease in the RMS noise level.
5.
Deviation from redundant channels.
a
U.S. Nuclear Regulatory Commission
(
B13178/Page 9 April 13, 1989 Transmitter calibration when exercised over the calibrated range is considered the best indicator of a loss of oil at the present time.
If any of the following symptoms are observed during calibration, further evaluation is recommended.
1.
Inability to respond over the entire range.
2.
Slow response to either an increasing or decreasing hydraulic test pressure.
(e.g. Response at either the high or low end of the calibrated range may be on the order of 2 minutes to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.)
3.
Any drift of greater than 1% from original calibration.
We have shared the above conclusions with the industry via Nuclear Network l
notification on February 14, 1989 and we have factored these conclusions into our monitoring program.
Conclusion We have had a high level of involvement in the Rosemount transmitter issue.
Information which we have helped to identify and share with the vendor, the NRC Staff, and various industry representatives, is contributing to the under-standing and resolution of this issue.
We nave continued to ensure that operability and reporting requirements have also been met.
Our confidence in the continued operability of the Rosemount transmitters is based on a number of factors including:
o Specific evidence to believe Rosemount has identified and also corrected the deficiencies in the manufacturing process.
o Specific evidence to believe Rosemount has identified and improved their inspection process to preclude defective units being shipped.
I o
Infant mortality evidence supported by data collected by Rosemount and by NNEC0.
The mortality is such that the transmitters that are subject to failure can be expected to have already failed, o
Identification and review of all safety-related Rosemount trans-mitters used in our plants, principally to determine their function and potential failure effects, o
Specific operability verifications provided by transmitter response testing, calibration, review of recorded transmitter performance, use of high-speed data acquisition monitoring, and use of Offsite Facility Information System monitoring, o
A monitoring program that will selectively verify transmitter performance.
..r a
U.S. Nuclear Regulatory Commission:
j B13178/Page 10 April 13, 1989 This summary of our activities on the Rosemount transmitter issue is intended l
to further contribute to the understanding and resolution of this concern.
Very truly yours, CONNECTICUT YANKEE ATOMIC POWER COMPANY NORTHEAST NUCLEAR ENERGY COMPANY l
bdW E.J.froczka
./
Senior Vice President cc:
W. T. Russell, Region I Administrator A. B. Wang, NRC Project Manager, Haddam Neck Plant J. T. Shedlosky, Senior Resident Inspector, Haddam Neck Plant M. L. Boyle, NRC Project Manager, Millstone Unit No.1 G. S. Vissing, NRC Project Manager, Millstone Unit No. 2 D. H. Jaffe, NRC Project Manager, Millstone Unit No. 3 W. J. Raymond, Senior Resident. Inspector, Millstone Unit Nos. 1, 2, and 3
__j