ML20211C516

Augmented Insp Repts 50-280/86-42 & 50-281/86-42 on 861209- 870114.Violation Noted:Failure to Fully Follow Procedures, Provide Adequate Instruction for & Document Performance of Maint Operations

ML20211C516
Person / Time
Site:	Surry
Issue date:	02/10/1987
From:	Panciera V NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II)
To:
Shared Package
ML20211C439	List: ML20211C435 ML20211C478 ML20211C516
References
50-280-86-42, 50-281-86-42, NUDOCS 8702200119
Download: ML20211C516 (53)

See also: IR 05000280/1986042

Text

{{#Wiki_filter:' . y UsesTSO STATSS f NUCLEAR REGULATORY COMMISSHM ' f Reescos as . g tel e4ARIETTA STREET.N.W.

ATLANTA.G80A41A 30333

• $

..... ' . Report Nos.: 50-280/06-42 and 50-281/86-42 Licensee: Virgirtia Electric and Power C'ompany Richmond, VA 23261 Docket Nos.: 50-280 and 50-281 License Nos.: DPR-32 and DPR-37 Facility Name: Surry 1 and 2 Inspection Conducted: December 9,1986 - January 14, 1987 Team Inspectors: J. Caldwell M. A. Caruso W. T. Cooper 8. R. Crowley J. T. Gilliland W. E. Holland T. A. Peebles P. A. Taylor Contributing Inspectors: A. R. Herdt J. D. Ennis P. M. Mad n W. Ros Approved by: I /L n s h a 7 _mm Vincent W. Panciera, Team ~ Lea' der' ~ /Date Sigried ~ Division of Reactor Safety SL)l9tARY Scope: This special, announced augmented inspection was conducted for the Surry Unit 2 feedwater pipe rupture event of December 9,1986. The areas inspected included the sequence of events, effects of failure, metallurgical aspects, items contributing to the likelihood or severity of the event, licensee's response to the event, aspects that made handling the event more difficult, consideration of shutdown of Unit 1, investigation and corrective actions planned and safety considerations for station restart. Results: One violation was identified (paragraph 11.a.(2)). . 0,g22Kg[[{ $$$$ go ' o - t

' . ' . REPORT DETAILS . 1. Persons Contacted ' Licensee Employees W. L. Stewart, Vice President, Nuclear Operations R. J. Hardwick, Corporate Manager for Licensing and Safety R. F. Saunders, Surry Station Manager

• R. W. Calder, Nuclear Engineering Manager

"H. L. Miller, Assistant Station Manager for Licensing and Safety

• D. L. Benson, Assistant Station Manager for Operations and Maintenance

J. M. McAvoy, System Metallurgist

• W. D. Craft, Licensing Coordinator
• W. R. Benthall, Nuclear Specialist

Other licensee employees contacted included engineers, technicians, operators, mechanics, security members and office personnel. NRC Residen' Inspector

• W. Holland
• Attended exit interview.

. 2. Exit Interview The inspection scope and findings were summarized on January 14, 1987, with those persons indicated in paragraph 1 above. The inspectors described the areas inspected and discussed in detail the inspection findings listed below. No dissenting comments were received from the licensee. Violation 50-281/86-42-02 - Inadequate Procedure for the Maintenance of the Main Steam Trip Valve (paragraph 11.a.(2)). ~ Inspector Followup Item 50-280, 281/86-42-01 - Clarification of Surface Preparation Methods in NOE Procedures (paragraph 8.e.). The licensee did not identify as proprietary any of the material provided to or reviewed by the inspectors during this inspection. 3. Licensee Action on Previous Enforcement Matters This subject was not addressed in the inspection. 4. Unresolved Items Unresolved items were not identified during the inspection. L .- 4 0 .

. . ~ . -- . -- .- . _ _ - - _.- _ . . _ _ - - . - . - _ _ _ - - - .. - ' . b 2 = 4 - 5. Augmented Inspection Team (AIT) Activities

Shortly after the pipe rupture event, Region II was notified by the Surry Senior Resident Inspector (SRI) who was on site, and had proceeded to the y control roong to assess the situation. The Regional personnel immediately 1 staffed the regional response center at about 2:45 p.m. NRC Headquarters was then notified at approximately 3:00 p.m. that a main feedwater line pipe rupture in the turbine building had occurred. An open line between the Surty site and the NRC Operations Center was maintained until early hours of the next morning. About 3:30 p.m., a decision was made by Regional ,

management to send an inspection team to the site. This team consisted of { Regional based personnel and the SRIs from North Anna and Surry. The team arrived on site about 9:30 p.m. on December 9, 1986. After a meeting with

j plant management to assess the operational status of the unit, the team ! toured the damaged area of the turbine building in the vicinity of the feed- l pump suction piping. During a meeting at 9:00 a.m. on December 10, 1986, with plant management, NRC inspection assignments were outlined. Virginia Power agreed to provide any assistance required by the team. In addition, 4 l the ground rules to be applied by the inspection team regarding quarantine ! of equipment were discussed. Virginia Power agreed to seek NRC concurrence ! before any work was accomplished for restoration of systems. During the ' morning of December 10, 1986, the team's status was upgraded to an Augmented ! Inspection Team (AIT), and an engineer from the Office of Nuclear Reactor l Regulation, knowledgeable in water hammer phenomena, was assigned to the l team. The team conducted inspections during the remainder of the week 1 ending December 12, 1986, to ascertain the circumstances involved in the j accident. An executive summary was transmitted to the Region II office on l December 17, 1986. This summary provided the significant facts concerning

the event. The AIT did not conclude its inspection at that time due to the ! ongoing activities by the licensee to develop a root cause analysis, which I required subsequent inspection activities. AIT activities continued during ! the weeks of December 22 and 29, 1986, and January 12, 1987. An AIT exit l meeting with plant management was held on January 14, 1987, after review of

the licensee's investigative report entitled "Surry Unit 2 Reactor Trip and ! Feedwater Pipe Failure Report" and proposed corrective actions which were j presented to the NRC on January 12, 1987, in addition to the AIT inspection i activities, inspectors knowledgeable in security, fire protection systems, l water chemistry and check valve design were assigned to review specific ! concerns in these areas. Where applicable, their inspection findings have i been incorporated into this AIT inspection report. t 6. Overview of the Event , .

On December 9, 1986, with both units operating at 100 percent reactor power, ! a Unit 2 reactor trip followed by a main feedwater (MFW) line rupture

occurred. Unit 2 had completed a refueling outage and returned to full I power operation on December 8, 1986. ! A low-low level in the C Steam Generator ($/G) caus6d a reactor trip and l start of the two motor driven auxiliary feedwater pumps. .' e ' . . I

' . . e 3 The control room operators noted the S/G code safety valves lifting and regulated S/G pressure through the atmospheric dump valves. Approximately 30 seconds after the trip the unit's electrical busses auto-transferred to offsite power. A small steam release noise was heard followed by a very loud noise approximately five seconds later. A shift supervisor who was in the turbine building, realizing that a large steam break had occurred, went to the control room and alerted the control room watch. All secondary pumps (high pressure drain, condensate and main feedwater) were secured, and the break was isolated. Water to the S/GS was supplied by the auxiliary feedwater system. The primary systems responded normally to the loss of load transient. Reactor coolant temperature, pressure, and pressurizer level were stabilized in the desired band. A notification of unusual event was declared by the licensee at 2:27 p.m. and was upgraded later to an ALERT in order to ensure accountability of all station personnel. The 18-inch suction line to the A main feedwater pump was subsequently found to have ruptured at the elbow where the line connects to the 24-inch condensate header. In addition, station halon and cardox systems actuated because of water short-circuiting control systems in the area. Control room habitability was a concern prior to initiating control room ventilation because doors were blocked open to allow better control room access without recognizing that carbon dioxide had been discharged in the areas above. The carbon dioxide was apparently coming into the control room from the hallway. The emergency was terminated at 4:23 p.m. after personnel accountability had been established. Eight individuals were injured due to the steam and water. Four of the injured subt.equently died. Two of the injured were treated and released. Two individuals remained hospitalized. One, individual was later released. Unit 2 was placed in cold shutdown at 7:04 a.m. hours on December 10, 1986. 7. Sequence of Events a. Initial Plant Conditions Prior to the Unit 2 Event Unit 2 had achieved stable 100 percent power operation on December 8, 1986, following a refueling outage. Unit 1 was operating at 100 percent power. Two major maintenance or surveillance activities were in progress: the troubleshootin coolant pump (RCP)g of a B train underfrequendy relay for a reactor breaker, and the troubleshooting of an aux 111ary . . , ! 9 .

.' . ' 4 instrument air ccepressor. The first item had required the racking in and closing of the B reactor trip bypass breaker. The A and B reactor trip breakers were still closed. The second item required the shutdown of the running auxiliary instrument air compressor and the attempted start of the non-running auxiliary instrument air compressor. The delay in starting the auxiliary instrument air compressor caused the instrument air pressure to decrease to approximately 78 psig, instead of the normal 100 psig. Some minor construction activity was occurring in the vicinity of the main feedwater (MFW) pumps, such as installing insulation on piping. The unit's data gathering computer (Prodac 250) was out of service, but reactor trip information was available from a sequence of events (SOE) alarm printer and a newly installed Emergency Response Facility Computer (ERFC). The SOE alarm printer prints information continuously on a millisecond basis, but is limited in scope to alarms. The ERFC displays s' stem parameters, but only updates in fifteen second incre- y ments and samples the parameters at different times. The ERFC is intended for a broader picture than the SOE alarm printer. Interviews with the Shift Supervisor and Control Room Operators (CRO) were used to correlate times and to fill in gaps of the event. The SOE alarm printer time of the reactor trip was 1420:03(RT00)and the ERFC time of the reactor trip was between 1421:15-:30 and has been correlated to be 1421:15. Therefore, the SOE information will be addressed in increments per the ERFC clock with specifics referred to as seconds of time from the RT per the SOE alarm printer. Other sequence of events information was developed by the licensee, using security alarm computer data, interviews with additional person- nel, and time motion studies. This information correlates with this SOE data. b. Secondary System Conditions Prior To The Event Both MFV pumps were operating with a suction pressure of 370 psig, a discharge pressure of 1040 psig and a temperature of 374 degrees F. The condensate system was operating normally with one of two high pres- sure heater drain pumps, two of two low pressure heater drain pumps, and two of three condensate pumps running. The full flow condensate polishing system and all feedwater h9aters were in service. . c. Plant Conditions and Personnel Actions During The Event 1421:(00-15) ERFC time The first indication of a problem occurred at RT -03 when the Unit 2 control room received an annunciator alarm for!the B steam generator (S/G) as MFV flow was less than steam flow. This indication and the .' ' . O i

.' 5 , subsequent alarm on the A S/G indicated that the C main steam trip valve (MSTV) had inadvertently closed. The closure of the MSTV caused the steam flow from the other S/Gs to begin to increase by 50 percent and caused the mismatch alarm, since the MFW flow to the S/Gs had not yet responded. . A direct indication of the C MSTV closing was not received as the valve-closed limit switches did not function properly. However, indication and alarm that the valve was not fully open was available to the CRO. The closure of the C MSTV caused MFW pressure downstream of the C MFW flow control valve (FCV) to increase from 865 psig to 970 psig with the A and B MFW pressures initially stable at 845 and 835 psig, respectively.. - The other steam generator MSTVs closed shortly afterward due to the higher than normal steam flow in those lines caused by the continuing 100 percent demand of the main turbine. The MSTVs are reverse seated check valves held open against the steam flow by air operated pistons. As the MSTV discs are partially in the steam flow path, an increase in steam flow places more closing force on the disc. All three MSTVs closed and seated properly and steam flow was stopped. 1421:(15-30) A low-low S/G 1evel annunciator signal which was received for C S/G and was the initiating signal for the reactor trip at 1421:15 (RT 00) and for the starting of the two motor driven auxiliary feedwater pumps. The reactor trip resulted in a trip of the main turbine generator. The stopping of steam flow to the main turbine by the MSTVs closing caused the S/G pressures to increase. As C MSTV had closed first, its pres- sure increased first. This increase in pressure collapsed the bubbles in its S/G which caused the level to decrease to the reactor trip low- Iow level setpoint. At RT +03, the CR0 manually tripped th'e reactor. One control rod (M-10) indicated that it had inserted from 228 steps to 35 steps. Reactor power was verified to have decreased to normal post-trip decay l values. At RT +04, the CRO, noting that the S/G code safety valves were lif ting, took the S/G Power Operated Relief Valves (PORV) out of manual and began to regulate S/G pressure through this atmospheric dump mode. S/G pressures had increased from their initta) values of 820, 814 and ! I 1 i

. , ! ' l -

~ . . 6 - 815 psig and were 936, 979, and 1055 psig.* The S/G pressures all responded to the individual MSTV closings, and since C MSTV had been closed longest, it caused the C S/G to reach the highest pressure. The AFW flows were greatest to the S/G with the least pressure. AFW flow was 344, 300 and 98 gpa. . Pressure downstream of the MFW FCVs increased to 1054, 1042 and 1090 psig. 1421:(30 -45) Pressure downstream of the MFW FCVs decreased to 1008, 1015 and 1028 psig. S/G pressures were 1028, 1013, and 1055 psig. The C S/G PORV was being used to control primary temperature and C S/G pressure remained constant. Low-low levels occurred in the A and B S/Gs in response to their increasing pressure which caused the automatic initiation of the third auxiliary feedwater pump. The steam inlet valve to the turbine driven auxiliary feedwater pump opened and the pump started. S/G 1evels as a percent of wide range instrumentation were 74, 73 and 75 versus a normal operating level of 84 percent. AFW flow was 337, 317 and 109 gpm. 1421:(45-1422:00) . The three MFW FCVs received an automatic signal to close and in a few seconds were closed. This signal is generated to minimize primary system cooldown following a reactor trip and is generated when the primary temperature decreases to less than 554 degrees F. The MFW pump recirculation valves (FCV-FW-250A and 2508) for A and 8 MFW pumps auto- opened a few seconds later. Each recire valve opens when flow from its MFW pump decreases to less than 2800 gpm. Pressure downstream of the MFW FCVs increased on A to 1059 and decreased on B and C to 812 and 949 psig. Pressure in the S/Gs remained constant at 1028, 1013 and 1065 psig. The A MFW FCV may have been slightly slow in closing, and as the discharge pressure of the MFW pumps was increasing to its high of 1290 psig, the pressure down- stream of the A MFW FCV would have increased. The unit's electrical busses auto-transferred to offsite power at RT +32, when the main generator, as is normal, auto-transferred on a 30-second delay signal following a main turbine generator trip. 1

• When pressures, flows, etc., are listed in sequence, the order refers

respectively to the A, 8, and C steam generatob. ' . , d u . . - . _ _ _ . . . _ - . _________._._._--.__ - ,._ ______._ _ _.- _ __m, - _ . _ _ - _ _ _ _ _ _-- - .. _ -.. , . -. - _

.' ' .- 7 Five seconds later at RT +37, a small steam release was seen and heard in the vicinity of the A MFW pump and the first point heater steam-side safety relief. 1422:(00 -15) . ., . Pressure downstream of the MFW FCVs decreased to 445 psig which indicates that the downstream MFW check valves were operating and the pressure of the water in the lines was decreasing to its saturation pressure. The S/G pressures decreased to 997, 1003 and 1020 psig and levels remained in the 74 percent range. The AFW flow was 342, 317 and 98 gps. The MFW pump discharge pressure reached a peak of 1290 psig and the suction pressure rose to 550-600 psig as the condensata pumps responded to the minimal recirculation flow conditions. The noise of a small steam release was followed at approximately RT +42 by a very loud noise from the vicinity of the MFW pump suction piping. The primary system responded normally to the loss of load transient. Reactor coolant system temperature was stabilized at 552 degrees F and pressurizer level was recovered as it reached the low level setpoint. Reactor coolant system pressure decreased from 2235 to 2015 psig in response to the cooldown. The probable time for the piping break appears to have occurred at RT +42. The break occurred in an elbow where the 24-inch MFW suction header splits off at a tee to an 18-inch branch line in an elbow toward the suction of the A MFW pump. About ten feet farther down the 24-inch header toward the suction of the 8 MFW pump is where the high pressure heater drain pumps' discharge flow is combined with the condensate flow. , Approximately 15 seconds after the large pipe rupture, at RT +57, the A MFW pump tripped due to low suction pressure. The time delay relays , ' which operate in conjunction with a suction pressure of less than 55 psig were found set at 15 seconds,V pump rectre valve indicated that and the SOE alarm printer agrees with the time of pump trip. The B MF it closed while the A rectre valve remained open, as it should have, , i for 60 seconds after the pump trip. A reason for the 8 recirc valve closing is that the B MFW pump continued to run and the flow in that r l line increased to greater than the rectre re-setpoint of 4000 GPM. This increase in flow was caused by a backward flow path through-the ,

tripped A MFW pump. It was later found that this pump's discharge j check valve was disabled. The 8 MFW pump continued to run for 23 l seconds.

! ! .' & O t

- . . 8 - 1422:(15-30) An operations supervisor was in the turbine building observing construc- tion activity around the MFW pumps. He heard and saw the large steam break, And immediately ran to the control room to alert the operators. He also' told them that people had been injured. The shift supervisor then ordered that all secondary pumps be secured. 1422:(30-45) When the CR0s began to secure the secondary pumps, the B MFW pump was found " auto-off" with its yellow disagreement light on, which occurred at RT +81, or about 1422:36. Its time delay relays were also found set at 15 seconds. Therefore, its trip point of 70 psig was i reached at RT 66 or about 24 seconds after the break. The high pres - sure heater drain pump was running and had to be turned off, and both low pressure heater drain pumps had tripped. After all secondary pumps were secured, the steam release stopped. The ERFC and SOE alarm printer agreed with the operators on the above time sequence. 1424 The CR0 noted that primary temperature was stable at about 550 degrees F. ' The NRC Senior Resident Inspector arrived in the Control Room. ! 1425 The CR0 secured the B RCP to avoid adding heat to the reactor coolant system. Plant conditions were stable with RCS temperature being l maintained at approximately 540 degrees F by releasing decay heat through the C S/G power operated relief valve (PORV). ' 1427 An Unusual Event was declared. 1430 l Ground and air ambulances were called. The CR0 changed the normal suction of the charging pumps to refueling water storage tank. The B and C S/G low-low level alarms cleared and the steam driven APW pump was secured. ! The Regional response center called the c,ontrol room. , , b en

_. _ ~ . , 9 . , 1440 An Alert was declared to assist in personnel accountability. 1445 . _ The CR0 secured the A RCP. The Shift Supervisor noted that the condenser still had a vacuum and as there was no steam for the main turbine gland seal, opened the vacuum ' breaker. State and local authorities were notified of the Alert. 1500 NRC Operations Center was notified of the Alert. Reactor coolant system temperature was 530 degrees F, pressurizer level was 25 percent, and pressurizer pressure was 2160 psig. 1506 The CR0 secured B auxiliary motor driven feedwater pump. 1514 The CR0 began emergency boration to cold shutdown concentration as part ' of the normal post trip procedure. 1518 . ' Personnel accountability initiated. I 1535 i The corporate Emergency Response Cente'r was activated. 1539 The CR0 secured emergency boration. i ! 1548 Personnel accountability completed. 1625 The Alert was terminated. The control rod (M410) which had indicated that it inserted only to 35 steps now was noted to indicate fully inserted. .' - !

..- . . - - - . . . . - _ . - - . . . 10 -

1821 Cooldown at 50 degrees F per hour was initiated. 2130 , . , t < NRC team arrived on site. , 0355 December 10, 1986 Unit placed on residual heat removal system with ter.perature at 350 degrees F and pressure at 450 psig. 0704 i The unit achieved cold shutdown conditions. ' 8. Effects of Fai1'ure ! a. Pipe Rupture The rupture of the 18-inch A MFW suction pipe occurred on a 90 degree ! elbow at a point about one foot from where the suction pipa joins the condensate supply header. The point at which the break occurred , relative to the main feedwater pump is indicated on Figure 1, which is ' a picture of the identical undamaged Unit 1 piping configuration. Figure 2 shows the rupture location from the condensate supply header side. Figure 2 clearly indicates that the rupture was a catastrophic, ,

360 degree circumferential break. Figure 3 shows the broken pipe from

the MFW pump suction side. ! b. Pipe Whip i Observation of the damaged A MFW pump suction piping indicated sig- nificant movement of the piping following the rupture. The piping, attached to the pump suction, dropped and rotated away from the break point, pivoting on the elbow near the pump suction. Although the ,

piping came to rest against a prtion of the B MFW pump discharge l piping it did not appear to have damaged it significantly. ! Inspection of the area following the event also revealed that one piece of suction piping had ripped off and was blown some distanca from ' the break point. The piece was about two feet by three feet in size. It appears that the joint between the' suction pipe and condensate supply header provided lateral support of the suction piping assembly including the suction isolation valve. The loss of this support along with the weight distribution of the suction pipe assembly probably , contributed to the pivot and rotation of the assembly. It is also i

likely that back flow by the B MFW pump througli the damaged A MFW ' pump discharge check valve and out the broken suction pipe contributed to pipe whip motion of the feed pump suct, ion pipe. l

' , l ~ . . ---,--r-- - , , - -m-r-- ..,,ew ,----+-+--m ,-m- w w-*----

• • v*we*--w

-

• -"--' - " * * " * * - - * ' ' " " * * " " " "

~ . . 11 . c. Personnel Injury Those injured were eight contractor employees who were working in the general area, but not on the affected pipe itself. Six of these individuals were hospitalized f.or treatment of severe burns. Three were evacuated directly from the site by helicopter, and three others were taken off site by ambulance. The other two, who were less severely injured, were treated at a clinic and released. One of those hospitalized died the afternoon of the following day and another victim died two days after the accident. Two others. died several days later. The others remained in serious to critical condi- tion. One of the two hospitalized improved and was later released, but the other was still in serious condition more than a month after the accident. These contractor personnel were employed by Daniel Construction Company of Greenville, South Carolina, and by Insulation Specialties Inc., of Hopewell, Virginia. They were doing instrument line relocation and pipe insulation work, d. Plant Cooldown The loss of the suction, piping to the A MFW pump and subsequent steam release had no adverse effects on the plant cooldown. The MSTVs had closed as had the MFW FCVs before the pipe rupture. These actions - isolated the S/Gs from the rupture. The normal cooldown mode for a MSTV closure event is steam release by the code safeties, and S/G PORVs and continued feedwater flow from the auxiliary feedwater system. e. Employee Concerns On December 11, 1986, a former employee at Surry (a carpenter) contacted the NRC and expressed concern about grinding activities at , } Surry. The employee said that during June 1986, he and four other ' carpenters were directed to grind on p,ipe in the containment building. He stated that his foreman advised his crew that they were carpenters

and not qualified to perform this work activity. They were terminated for refusing to do the work. A case was filed with the Department of

Labor (DOL). The employee did not know the current status of his DOL

issue. The employee stated that the group of carpenters who remained i did perform grinding activities at various locations, including in the l turbine building. He did not know if they actually performed gririding i on the pipe that ruptured but wanted the NRC to determine if the pipe rupture was connected with the carpenters' grinding work. J As discussed in paragraph 9 below, preliminary investigations show ! that the pipe rupture was caused by a corrosion / erosion mechanism on i the inside surface of the pipe. It is clear tfhat the rupture was not ! related to grinding on the outside of the pipe. ,' w n

. . . 12

As further followup to the employee's concern, the inspector discussed grinding practices at the site with licensee officials. The licensee was aware of the employee's concern based on the individual's DOL case in June 1986, and the employee's contacts with the news media after the pipe rupture. The licensee stated that the work to which the former employee-referred was buffing or cleaning pipe welds in preparation for non-destructive examination (NDE) and was not grinding. The licensee's representative said their practice had always been to use carpenters or laborers to help pipe fitters clean or buff pipe welds in preparation for NDE. The carpenters or laborers worked under direction of the pipe fitters and were never allowed to grind pipe. The inspectors interviewed both the foreman who had terminated the carpenters in June, and a carpenter who was on shift at the time the other carpenters were terminated. Both agreed with the Itcensee's statements about carpenters being used only for cleaning or buffing pipe welds in preparation for NDE. They both also stated that the issue was that the carpenters who were terminated wanted pipe fitters' pay. When they refused to buff pipe without pipe fitters' pay, they were terminated. The foreman was the same foreman, who the concerned employee stated, had advised his crew that they were carpenters and not qualified to perform this work activity. During the interview, the foreman stated that, at the time of the termination he advised the carpenters only that the work they were requested to perform (buffing pipe welds) was not outside their work classification. The inspectors also reviewed U. S. 00L letter dated November 21, 1986, relative to the employee's concern. The letter states in part: " ... it is our conclusion that your allegations are unprovable for the following reason: Your termination, although officially recorded as involuntary, arose from a refusal to accept a work assignment arising from previous and ongoing personal and jurisdiction disputes with supervisor (s). These disputes were unrelated to any safety and health issue." ~ The inspector also reviewed the licens e's program for control of ! grinding on pipe. During fabrication of piping systems, grinding is controlled by Volume 2 of the Corporate Welding Manual including ! Procedure P-101, Revision 2, " General Piping and Pressure Vessel Welding Procedure," and Attachment A to P-101, " Weld Grinding Standard , and Techniques." For NDE, surface preparation is covered by NDE proce- ' dures. The inspectors reviewed a number of NDE procedures from the

NDE Manual and found that the procedures specify the surface condition i required but do not always clearly specify the method of surface preparation required to obtain the surface condition. NDE Procedure i NDE-3.1, Revision 3, Preparation, Issue and Control of Nondestructive . Examination Procedures, requires in paragraph 4.3.2.5 that NDE proce- dure list all actions which should be completeif prior to implementing the procedure, such as surface condition and preparation, temperature j of parts, etc. The licensee agreed to ev,aluate NDE procedures and

- , \\ [

-- - - . - - - -. - ---. - . . j 13

. determine if clarification is needed in specifying required surface - preparation methods. Pending review of the licensee's evaluation, ! Inspector Followup Item 280, 281/86-42-01, Clarification of Surface Preparation Methods in NOE Procedures, is identified. - 4 . 9. Metallurgical Aspects As noted in paragraph 8.a. above, the 18-inch suction line to the A main i feed pump failed catastrophically completely severing the line from the ! 24-inch header (see Figures 1, 2 and 3). The failure occurred in an 18-inch 90 degree elbow approximately one foot downstream of a tee in the 24-inch > header. The suction line was completely separated and dislocated from the header. Immediately after the failure, the licensee initiated a comprehen- sive analysis to determine the reasons for the failure and the necessary corrective actions. The following summarizes the licensee's analysis: - a. Initial Observations . ] The failed 18-inch suction line was fabricated from ASTM A-106, Grade B, Extra Strong carbon steel seamless pipe and ASTM A-234, '

Grade B, Extra Strong, WP8 carbon steel wrought fittings with a j nominal wall thickness of 0.500 inches.

When the 18-inch elbow failed, a fragment approximately two feet by 4 three feet was ejected from the outside of the elbow. The free end of , j the severed line was displaced in a horizontal direction approximately 6.5 feet and was wedged against the bottom of the B main feed pump discharge line. During the displacement, the A suction line rotated around the point of connection at the inlet to the pump, severely , ' deforming that portion of the line. The failed elbow, the short

section of pipe between the elbow and the 24-inch header, and a short section of pipe downstream of the elbow were removed for a detailed i study. The three parts were re-assembled as close as possible to

understand better the failure origination point and the sequence of l the failure after origination. The licensee performed a field i metallurgical investigation of the fai, led elbow as detailed below. ! (1) The investigation consisted of the following: Visual inspection of the system failure location. - Removal of the fractured elbow from the suction line. - . Visual 5X magnification evaluation and photography of - fracture surfaces, and elbow surface conditions. ' Ultrasonic wall thickness measurements, on a two-inch grid - pattern, of the failed elbow. ,' sem . -,------m._ ~ ,

. O - 14 . Metallurgical replicas taken on the elbow at several surface - locations. Mechanical measurements of elbow thickness. - (2) Th'e_ investigation resulted in the following observations: Visual inspection of the inside surface of the elbow revealed - a dimpled surface appearance, generally thinned wall and a number of localized very thin areas. The localized thin areas were small in area, usually less than one inch across, with remaining wall thickness as small as 1/16-inch. The areas were fairly smooth and blended smoothly into the surrounding material. Ultrasonic thickness measurements showed the wall thinning to be a gradual sloping change over' most of the surface of the elbow. The general thickness of the elbow varied from 0.120 inches to 0.390 inches. The short section of upstream pipe varied in thickness from 0.150 inches to 0.450 inches. Near the elbow, thickness measurements on the section of downstream pipe revealed thicknesses from 0.295 inches to 0.405 inches. The wall thickness of pipe a short distance downstream of the elbow was within manufacturer's tolerance. As noted above, the nominal wall thickness should have been 0.500 inches. Field metallurgical replicas taken on the surface of the - elbow revealed a microstructure typical of ASTM A-106 Grade 8 material with no signs of strain. The fracture surface was typical of a ductile tearing mode - failure. Tears, which appeared to be fracture origination points, were noted at two localized thin cavity areas of the fracture. Small defects, indicative of laps, laminations and inclusions, typical for A-106, Grade B, materials, were noted at the fracture surface. One of these small defects was noted at one of the thin overload tear areas and could j have been the start of the fracture. l (3) The licensee's analysis revealed the following probable scenario ! for the pipe failure: , The pipe failed because of a thinned wall. A corrosion / - l erosion mechanism is the probable cause of the wall loss. l Wall loss by this mechanism occurs by a gouging out pattern _ on the carbon steel surface under the action of a flowing medium and an electrochemical action. This phenomenon has i . been well documented for two phase fIow such as extraction , steam systems. The licensee has an inspection procedure documented for monitoring the t,hickness of its two phase . . O ..- . . - - . . . , - _ _ . . . _ - - - . . , - - , , , , , . . . _ _ . - , , - - , , _ . . . . . . , _ . . . - . _ _.., --.--,,-, - _ .-- - .

. O . - 15 systems (see Surry Administrative Procedure SUAD-M-33, No. ADM-89.13. " Secondary Piping Inspections"). However, for single phase flow in systems, such as feedwater and condensate, the problem had not been recognized. The only place where the phenomenon has been documented in a single , ' phase flow system is in the steam generator feed ring J-tubes. The design geometry of the failed elbow in the feedwater suction line is similar to the design geometry of the feed ring J-tubes. Both consist of a header or large diameter pipe and a right angle discharge pipe with a 90 or ISO degree turn. The licensee concluded that the turbulent flow created by the geometry and the low oxygen feedwater probably contributed to the corrosion / erosion thinning of the pipe wall. Because of the thinned wall (as low as 0.048-inches in a - localized area and 0.100-inch over a more general area), ' local membrane stresses were near yield at system pressure and temperature of 367 psig and 374 degrees F, respectively. The system underwent an upward pressure transient (see para- graph 7.c. above) resulting in a localized tensile overload failure in a thin wall cavity. Using the ASME Code minimum wall equation, and assuming an internal pipe pressure of 600 psig, a temperature of 370 degrees F, and an ultimate strength of 60,000 psi, results in a calculated burst thick- ness of 0.090 inches and a yield thickness of 0.173 inches. , Therefore, with a local cavity thickness of 0.048 inches, ' l a general thickness of 0.100-inch, and a upward pressure I transient, the material easily exceeded its burst strength. The initial tensile overload tear was considered to have arrested and not to have developed into an unstable tearing mode. Water flashing to steam was heard by station person- nel. As water continued to flash to steam for a few seconds and pressure continued to increase in the elbow, an unstable tear developed in a second t,hin walled area. The pipe then ruptured, ejecting the fragment from the elbow.

b. Metallurgical Analysis (1) VEPCO VEPC0 has hired Failure Analysis Associates (FAA) to perform a complete metallurgical analysis of the failed elbow. The following is a summary of the work to be performed and the . preliminary results as of January 14, 1987: l l (a) Phase 1 - Scheduled for completion a, bout February 1, 1987 Tensile Tests - .' - > _ , , _ , . . . - - - --. . . - .,- - --, . - - - - - - . , - - - - - , - - - - - - - ~ ~ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

. . . O .- 16 Tee, elbow and across the weld tested. Results complete. Acceptable to specifications. Charpy Impact Tests - Elbow tested. Small specimens used due to thickness of ' ~ material. Results appear to be satisfactory. Complete curve will be generated to correlate results with full size specimens. Hardness Tests - Elbow base material, elbow heat affected zone (HAZ), tee base material, tee HAZ and weld material tested. Results complete and appear to be satisfactory. Chemistry - Elbow base material, tee base material, and weld material tested. Results complete and appear to be satisfactory. Trace elements are almost nonexistent. Micro and Macro Examinations - Work partially complete. At 50X, inside surface dimpled, outside surface smooth. Structure typical - Pearlite / Ferrite. Scanning Electron Microscope Examination - Started. Oxide Layer Micro Probe Study - Started. (b) Phase 2 - Scheduled for compietion about the end of February, 1987. l l Finite Element Analysis - Basic Stress Analysis - -. Complete. Primary stresses 8500 psi, secondary thermal stresses 5000 psi. Code allowable 15,000 psi primary, , j 22,500 psi primary plus secondary. _ , i

. i g ' . , , - , - -- _-- - ,--- , - , , - , . , - - , - - , - - - -

. _ _ . _ . . . _ . . _ ._ _ _ ' . ~ 17 - f (c) Phase 3 - Scheduled for completion about mid-March,1987. Establish J-Resistance Curves tad perform detailed - fracture mechanics analysis. , ! ' _ Contract is being finalized. FAA will have basic contract. Material Engineering Associates (MEA) will be used as a subcontractor. I (2) NRC The NRC has hired Brookhaven National Laboratories to perform an independent metallurgical analysis of the failed elbow. The tests being conducted are essentially the same as the VEPCO Phase 1 tests. Tests are scheduled for completion about the same time as the VEPCO Phase 1 tests. 10. Chemistry - Corrosion a. Introduction A Region II chemistry specialist / inspector visited the Surry site on December 22-23, 1986 to examine the sections of the feedwater suction lines from both units that had been exposed by the licensee subsequent to the rupture in Unit 2. The inspector also reviewed chemistry data that had been documented since the startup of Unit 2 in 1973 to assess the chemistry control of the secondary water system during the operational history of this unit. Based on the information that is summarized below, the inspector evaluated the licensee's preliminary theory that the pipe rupture was the result of extensive - ' erosion / corrosion of the 18-inch suction line to a feedwater pump,

especially in the vicinity of the intersection of this pipe and the i feedwater header. b. Inspection (1) Visual Inspection " ! (a) Unit 1 - On December 21, 1986, the licensee had cut out

the suction line to A feedwater pump from, and including, ' the junction with the feedwater header to, and including, the isolation valve. The upstream portions of this pipe had been further separated and stored indoors while the downstream segments had been stored in'the open overnight. The most significant observations were as follows: An adhesive black film, conside, red to be Fe 034 - ' (magnetite), covered the inner ' surface of the junction i segment (i.e., approximately four feet of the header and the 18-inch pipe past the. initial 90* bend) except in a ' , .- 9 . . . , _ _. . _ . _ _ _ . . _ _ . , _ _ _ . _ _ _ _ _ . _ _ - _ . _ _ _ . , _ . , _ _ - . . - . _ . _ , _ , , _ _ _ _ _ . - . _ _ - . _ -_ _ _ _ , , _ . - .

.,

18 . limited region in the lower part of the 90' bend. A - similar patch of black oxide was located on the surface of the second bend. Although there were small areas of . black oxide in the other portions of the suction line, most inner surfaces were covered with a thin layer of , _ red powder that was assumed to be Fe O2 3 (hematite).

The weld bead that formed the inner junction of the - header and 18-inch pipe had been worn smooth on the downstream side, and significant (approximately one quarter-inch) amounts of weld metal had been lost. The weld bead joining the upstream segment of the - 18-inch pipe to the first elbow had also been worn smooth except in the quadrant approximating the outer portion of the bend in the elbow.

The weld discussed above also exhibited a scallop shaped - depression that indicated a limited region of signifi- cant loss of metal. This gouged area was located in both the weld bead and adjacent pipe approximately 90 degrees from the direction of flow in the header. An indication of a scratch or gauged area, approximately - 0.5 inch x 12 inches was observed in the isolated black region on the top (horizontal) side of the second elbow from the header. (b) Unit 2 - After tne 18-inch suction line ruptured the licensee had cut out this line at the tee weld at the header and five feet downstream of the first elbow from the header. The section of pipe that was removed included the failed region and the 2-ft. x 3-ft. hole formed by the expulsion of the ! weakest section of the first elbow. The exposed openings in the header and the 18-inch suction line had been capped with plastic for protection against dust. The most significant observations relating to the feedwater header and the remaining section of the suction pipe are listed below: Approximately one inch *of water remained at the bottom - ( of the header, and evidence of fresh rusting was observed beneath the water. I ! ' , Q , - . . . - , . - - . , . . - , , , . , , . w -w ---y-,

.

19 , The entire length of the header from the upstream - elbow to the most distant section downstream that was visible with a flashlight was coated with red iron oxide. The layer of oxide was not deep, however, and appeared as a film over roughened iron , _ and was easily wiped off. + The nearest elbow on the header upstream from the - opening was black in color. The downstream region of the inside bead of the weld - head that held the 18-inch pipe to the header was gouged out in the same manner and location as observed in Unit 1. Also, as in Unit 1, this weld bead had been worn smooth with the pipe except on part of the upstream side. A concave area of approximately two inches in diameter - had been formed immediately below the weld in the remaining stub of the 18-inch pipe. The inner surface of the initial foot of the downstream - run of the suction pipe was red in color while the remainder of the visible portions were black. The line of demarcation was very sharp. (c) Evidence of thinning The licensee had completed detailed ultrasonic tests of the Unit 1 suction line to A pump so that profiles of pipe thickness were available to the inspector. These profiles and visual evidence of thinning at the ends of cut out sections of this 18-inch pipe showed clearly that widespread wastage had occurred from the header to several (approxi- mately 5) feet downstream of the first elbow from the header. However, the thinning was no,t evident from the inner surfaces of the pipe beer.use the loss of metal had been very uniform, as if polished with coarse emery cloth, even where the pipes were red in color. The degradation of the welds at the tee junction and the single gouged region in each unit were the only obvious indications of metal having been removed in a non-uniform fashion. (2) Audit of Chemistry Records , The inspector reviewed archived documentation of daily analyses of the condensate, feedwater, and reactor coolant from the startup of Unit 2 (March 1973) until the unit was sh,utdown in February 1979. ,' +o - .- --. - - - . . - - . - . . _ , - - - . . - . - - - - - - . - - - - - , ., ~ . - - - - . - - - . , . _ - - - - - - - - , . ,

. -. . . . ' 20 . Through previous inspections, the inspector was already familiar with the licensee's chemistry control subsequent to the replace- ' ment of the steam generators in Unit 2; i.e., from 1980 to the present time. 4 ' As'_one of the first nuclear power plants constructed in the United States, both units at Surry began operation with a chemistry control program that included the use of hydrazine to control the

detrimental effect of dissolved oxygen - as an oxidant of carbon steel pipe. For two years the licensee also had added phosphate salts to the feedwater to control pH and to prevent attack of the carbon steel by hydrogen ions. In 1975 the phosphate control l program had been discarded in favor of the use of ammonia in an effort to minimize or eliminate denting of the tubes in the steam generator. During part of 1976-1977 cyclohexamine had been also - added for pH control but was soon replaced by the use of morpho- l i ne.. When the units started up after replacement of the steam generators, the licensee, following the recommendation of the Steam Generators Owners Group (SG0G), based the chemistry control on all-volatile-chemical treatment (AVT) with hydrazine and ammonia. Because of the original design of the Surry units (copper-alloy ' condenser tubes, absence of a condensate cleanup system, copper- alloy feedwater heater tubes) and the relatively high salinity of the condenser cooling water, control of secondary water chemistry had been difficult, as indicated by the following examples: l Intrusions of chloride ions in concentrations of tens of - parts per million (ppm) occurred several times in 1973, i I 1975, 1977, and 1978 as the result of condenser tube failures. (The current upper limit recommended by the SGOG to prevent corrosive attack of iron pipe is 20 parts per billion (ppb)). ' During four weeks in 1975 the pH of the feedwater remained - below a value 8, and thus ingreased the vulnerability of carbon steel pipe to corrosion by hydrogen ions (acid). The SGOG recommends that the pH of the feedwater be maintained between 8.8-9.2 in ferrous / copper systems such as were present in the Surry units prior to 1980. In systems that do not contain copper components, the SGOG recommends that the feedwater be maintained in a more basic condition (pH of 9.3 to 9.6) to increase the electrochemical stability'of iron in water and to minimize the dissolution of iron through reaction with hydrogen ions (acids). During the period when cyclohexamine was used, the pH of - the feedwater exceeded 9.5 and, occasionally even 10.0. Although the higher pH benefited the! reduction of iron corrosion, it also caused accelerated corrosion of the copper-bearing alloys in the co,ndenser and feedwater heater ' . . - --,~._,_____-_,,,,_ . - _ . _ - _ _ _ ...__ _ __ , - _ . __ _ _ -_.- , . - . , - . _ . - , _ _ _ . . . , _ , _ _ _ _ _ _

. .- .- . . . . 21 - tubes. Inasmuch as copper ions in solution exacerbate .several forms of chemical corrosion of carbon steel and alloy 600 (Inconel), the SGOG recommends that the concentration of copper in feedwater be kept below 2 ppb. The presence of higher concentrations of copper in the feedwater of the Surry , units before 1980 was considered to be a major cause of the _ degradation of the original inconel steam generator tubes. The licensee replaced the copper alloy condenser tubes with titanium during the steam generator replacement outage but is only now planning the replacement of the feedwater heater tubes with non-copper alloys. Throughout the operational history of Unit 2 the licensee had - observed the concentration of oxygen in the condensate and feedwater to have been less than the limit detectable by the most sensitive analytical instrumentation (except during 10 days in 1975 when, because of seal failures, the concentra- tion of oxygen increased to approximately 20 ppb.) The inspector considered that the lowest detectable limit had been 0-10 ppb during this period - which is consistent with the limiting concentration, 5 ppb, currently recommended by the SGOG. Control of oxygen had been maintained by the addition of hydrazine; however, during much of the early operating history the residual concentration of hydrazine had been close to the detectable limits (approximately 5 ppb). Currently the licensee adds sufficient hydrazine to ensure - that the residual is greater than 20 ppb, as recommended by the SGOG, so that oxygen is quantitatively reduced and elimi- nated as an oxidant. (3) Conclusions l The tee and upper elbow of the 18-inch pipe to the A feedwater l pump in both Surry units were visually observed to have been ! degraded through extensive thinning and severe, but localized, ( gouging. However, the interrelationship between the roles of l corrosion and erosion was not clear. The degree to which the I feedwater pipe had been protected against general corrosion by a film of magnetite was difficult to establish because the pipes had been opened and exposed to moist air. Although general corrosion, as well as more localized forms of chemical attack, may have been aggravated by the occasional presence of corrosive impurities in the feedwater during the initial seven years of plant operation, there was no visual or ultrasonic evidence to support this speculation. A more comprehensive analysis of this subject is presented in the Appendix to this report. ! .- . , , . - . . , - - . _ . _ . , - - , . - .--,-,.,-.--,-.---.-_-------- --_- .-- , ... ..--- - -

-

. .

22 11. Items Which Could Have Contributed to the Likelihood or Severity of the Event a. General , ' The inspectors reviewed system operating procedures, system maintenance history and the operating status of selected systems to determine those factors which contributed to the closure of the C steam generator main steam trip valve (MSTV TV-MS-201C) and the subsequent reactor trip and feedwater pipe ruture. (1). Plant Service Air / Instrument Air System (SA/IA) The inspectors reviewed control room logs, interviewed control i room operators and examined equipment in the plant associated with SA/IA system. This system supplies air to the air operated MSTVs. The air pressure supplied to the air operated cylinders associated with each MSTV holds the MSTV open during normal plant operation. The air pressure is automatically vented off the operating cylinders following a trip signal or manually vented by the operator action. The MSTV will then shut, assisted by the steam flow acting on the value disc. Prior to the reactor trip, the operating status of the SA/IA system was as follows: , SA/IA blue auxiliary air compressor was in operation; the three turbine building air compressors were in automatic mode, one was off; one of the condensate polisher air compressors was floating i on the SA/IA system. System pressure indications as observed from the control room was approximately 100 psig (normal operating range is 95-110 psig). I Planned maintenance was being performed on the SA/IA grey auxiliary compressor which consisted of the installation of a new temperature sensing element. Following this maintenance, the grey compressor was scheduled to be placed in service. Both the blue and grey air compressors share a. single power source. In order to position the transfer switch from the operating blue compressor to ' the grey compressor, the electrical power supply is required to be deenergized. Control room operators were aware of these operations and were adjusting air flow from the condensate polisher air system. System pressure decreased to approximately 85 psig as both blue and grey compressors were deenergized. At the time of the reactor trip, control room operators noted that SA/IA system pressure was approximately 78 psig. Subsequent to the reactor trip, the blue air compressor was placed back into service. ! ! ,' . _ _ , _ _ _ . . - - _ _ .. . ,m_ . - _ _ . _ - . . _ . , - - - . - . . , , - - - - - - . - - , . - - - . - - _ - - _ _ _ . - - - - - . . - - - . - - - - -

_ _ _ _ _ _ ___ _ _ _ _ _______ _ _ _ __ _ _ _ . _ ' . . ' 23 Discussions with control room operators indicated that operating

experience has shown that SA/IA receiver pressure has decreased as , low as 55 psig without any MSTV closing. As noted by this ' event, the only MSTV to close as a result of the lower instrument air pressure was the C MSTV. I The inspectors reviewed operating procedures for the SA/IA system. , Discussions were also held with operators to determine adherence to procedures; no problems were identified. During December 15-19, 1986, the licensee tested and opened for ' inspection the C steam generator MSTV. The detailed inspection and testing of the valve and the results are discussed in a separate paragraph in this report. The problem discovered during , this inspection, however, showed that the valve disc operator - assembly had previously been assembled incorrectly and permitted . the~ valve disc to be positioned in the steam flow path at an

angle greater than that allowed by design. This condition, j coupled with the drop in SA/IA system air pressure prior to the reactor trip, appeared to have allowed rapid closure of the MSTV by steam flow forces. ' Following the event, soap bubble air leak testing of instrument ' air piping and components to the C MSTV was conducted under normal system pressure condition. No significant leakage was identified that would have affected MSTV air operated cylinder operation. , (2) C Main Steam Trip Valve (MSTV). The action which initiated the reactor trip and subsequent feedwater rupture was the inadvertent closing of the C MSTV. i I A review of the maintenance history indicated this valve was overhauled during the most recent refueling outage in November I 1986. On November 27, 1986, following the overhaul, the valve i i position limit switch was adjusted and the valve was cold-cycled ' satisfactorily per Periodic Test 14.2. On November 29, 1986, with Unit 2 in hot standby, the C MSTV was again cycled, and the valve failed to open fully. The reactor operator generated a Work Order 046251, which indicated that the C MSTV was binding and capable of only partially opening. That same day, November 29, 1986, it was determined that the cause of the C MSTV was nots fully opening because of water in the valve. The next operating shift drained the water and successfully cycled the valve on ' November 30, 1986. However, Work Order 046251 remained open because the valve appeared to operate somewhat differently from the other MSTVs, even though it met its intended safety function as required by Technical Specifications. ' . e = . . . - . .

___ _ _ _ - _ _ , _ _ . . . . 24 . Following the event and the initial AIT inspection, the C MSTV was released to the licensee for inspection and testing. The , licensee developed a detailed testing and inspection program to determine the cause of the valve's inadvertent closure. The results of this program are as follows: Prior to disassembly, the valve was cycled and determined to only open approximately 62 degrees. Normal full open position should be 80 +2 degrees. Disassembly of the valve revealed the valve cover had been installed one stud or approximately 15 degrees off. This cover has a stop tube welded to it which normally limits valve disc travel to 80 +2 degrees when going full open. With the cover installed approximately 15 degrees off, the stop tube was positioned such that it limited the disc travel to only 62 degrees which left the disc approximately 25% from the full open position, exposing the disc to the closing force of main steam flow. This pragram also revealed that the radius lever had been i installed on the rock shaft one spline tooth off, which would ! have limited valve travel to 75 degrees had it not been for the valve cover misalignment. This also would leave a portion of the disc exposed to the closing force of the steam flow. The misalignment of the radius lever also contributed to the failure of the C MSTV closed limit switch to indicate that the valve had closed. During testing, the licensee determined that placement of the radius lever up one spline tooth prevented the limit switch from fully engaging in the closed position. A maintenance history review revealed that l the limit switch was adjusted before the valve was retested after maintenance. This adjustment appeared to be on the i lower limit switch, but a complete determination of what was ' actually adjusted could not be made dua to lack of documenta- tion. The operation of the closed limit switch was deter- mined to be intermittent. During the cold and hot cycle, the switch was depressed enough ,to actuate. But during and following the event, the switch, even though engaged, was not depressed enough to actuate, although only slight additional movement caused the closed limit switch to actuate. Several observations can be made based on the licensee's inves- tigation into the C MSTV closure. The maintenance procedure MMP-C-MS-002 used for overhaul of C MSTV was not correctTy ' followed. The procedure was inadequate in that it did not prevent, nor did the post maintenance testing discover the improper assembly of the C MSTV. The licensee failed to document all the non-routine work associated with this valve overhaul. A review of MMP-C-MS-002 shows that step 5.4.8 which reinstalls the radius levers does not prdvide adequate instruc- tions to maintenance personnel or quality control (QC) inspectors

. ~~ . __ . . = _ . _ - . - _ , , _ . _ . _ _ _ . - _ _ _ , , _ . _ _ _ , _ _ . - _ _ - _ _ _ _ . , . _ , , - - _ _ _ - . - , , _ -

' . . 25 - as to the proper reinstallation alignment. Investigation by the licensee revealed that the maintenance person reinstalling the valve decided, based on comments from a QC inspector, to reinstall , the radius lever up one spline tooth from the previous installa- ti,on. This decision was made without any documentation or engineering review. This decision alone resulted in limiting valve travel to only 75 degrees exposing the disc to steam flow and appears to be the cause of the failure of the closed limit switch to operate. Step 5.4.12 required the QC inspector to check and record the arc of valve travel. The recorded data was 80 degrees - although the licensee determined after the event that it was only 75 degrees. The inaccurate documentation appears to be a result of the QC inspector performing this verification by visual check < only. Since the step calls for a quantitative result, the step should have required that some type of instrumentation be used to determine the arc of the valve travel. Also, the QC inspector should not have documented it as 80 degrees unless there was a means of precise verification. Although Step 5.4.15 required replacement of the valve cover, the step does not mention anything about cover alignment; specifi- cally, there is no mention of any problem that cculd result from cover misalignment. This would have illustrated the importance of proper alignment. The inadequacy of the step resulted in the misalignment of the cover, preventing full travel of the valve disc, and leaving the disc exposed to the closing force of steam flow. Finally, step 6.3 requires a post maintenance test be performed which only tested the operation of the valve based on the open and closed limit switches. This test, PT-14.2, does not verify full valve disc travel, and therefore was not adequate to verify proper valve reassembly. However, it should be noted that the test was adequate to verify the safety function of the valve which is to close. Also this test was used to verify that the valve was in compliance with Technical Specifications. The fact that the C MSTV was reassembled so that the disc was always exposed to the closing forces steam flow, coupled with the

low air pressure, resulted in the inadvertent closure of the C ' MSTV. This inadvertent closure of the C MSTV resulted in a reactor scram but did not contribute to or cause the rupture of the main feed piping. This rupture would have happened during any normal pressure transient of the feedwater system. Even though

the inadvertent closure of the C MSTV did not cause the feed ! line rupture and the safety function of t,he valve along with - . 3 9 -- . - . - -. ,-. -. ., .- - - - - . - - . - _ . - - . _ , _ - - . . - - . - _. .

_ . __

. ' 26 . compliance witti Technical Specifications were verified, the fact.that the valve was reassembled in such a way that it resulted in an inadvertent reactor scram and a challenge to the unit's safety system is still a significant problem. TkchnicalSpecification6.'4.Arequiresthatdetailedwritten procedures with appropriate check-off lists and instructions shall be provided for preventive or corrective maintenance operation which would have an effect on the safety of the reactor. The failure of the licensee to fully follow procedures, provide adequate instruction for and document the performance of maintence operations involved in the performance of the procedure to over- haul the C MSTV will be identified as Violation 50-281/86-42-02. (3) Feedwater Pump Discharge Check Valve (No. 2-N-127) Dur,ing the initial investigation of the feedwater pipe rupture event, an abnormal pressure transient of the A MN pump suction piping was suspected to be the cause of the rupture. For such a pressure transient to occur, the A MN pump discharge check valve (2-N-127) would have had to be permitted flow in the reverse direction. Since this was a potential cause of the pipe rupture, a review of the maintenance history and an internal inspection was conducted on the check valve (2-N-127). A review of the maintenance history on this particular check valve - revealed that the valve was scheduled to be inspected in late 1984. The licensee decided not to inspect the valve, based ' on a satisfactory inspection perforced on a Unit 1 feed pump discharge system check valve and on the operational history of the valve. It should also be noted that during the startup prior to this event, the B main feed pump was operated with the A main feed pump secured. There was no mention of a problem with high feed pump suction pressures, and the A main feed pump was started successfully on December 5, 1986. The licensee disassembled 2-N-12'7 after the event. Inspection of the internals showed the disc was not fully seated. One of the two hinge pins was missing, and the valve seat was displaced. The condition of the check valve at the time of the inspection would have allowed for flow in the reverse direction. The licensee has been able to determine, based on the operation of the A and B main feed pumps, that reverse flow tarough the A main feed p~ ump did not occur at the time of the' event. As discussed in the sequence of events paragraph that the A main feed pump was still operating after pipe rupture. Therefore, flow past the check valve into A feed pump suction piping could not have occurred prior to the pipe rupture. This conclusion strengthens the supposition that the feed water pipe ruptfured during a normal pressure transient and that back flow past the chec' valve did not cause a pressure spike which resulted in the pipe rupture. . t - . -. .-7 ,_ , _ - - . . . - _ , ,_ _--,_c._ .,.,,_._.,r___.- -- . - - - - - . . - - _ . - _ _ , , - _ . _ _ _ . - - - -- -

__ _ _ - .

27 . However, the condition of the check valve would have contributed to the amount of feed water which exited the feed line break and possibly the extent of the pipe whip after the event. The licensee has inspected the other Unit 1 and Unit 2 feed pump ch;eck valves and discovered additional discrepancies (see para- graph 15.c.). The condition of each of these valves at the time of inspection was such that they would have performed properly and not allowed significant reverse flow. (4) Feedwater System Maintenance History A review of recent feed water system maintenance history did not reveal any identified problems with the A or B main feed pump suction piping. The licensee has identified some problems with the feed water system such as pin hole leaks which were associated with erosion, but these problems were located in the feed water ' pump, discharge recirculation piping. While the licensee did not have a program to inspect the feedwater piping for thickness, it does have a formal ultrasonic inspection program to determine thickness for the following secondary system areas: Turbine Exhaust Cross Under Piping - 1st and 2nd Point Extraction System - 3rd and 4th Point Extraction System - Moisture Separation Drain Liner - Moisture Separator Reheater Inlet Piping - - (5) Safety System Equipment Review ! A discussion with the Superintendent of Operations and a review of i pertinent documents - i.e., plan of the day, the tagging log, the reactor operator's log, the shift. supervisor's log and the minimum equipment list for criticality and power operation checklist-- indicated that all safety-related equipment required to support unit operation was operable. The only safety-related equipment problems indentified prior to the event were (1) the inoperability of one of the three charging pumps (only two are required to be operable by technical specifications); and (2) a service water pump which was operable but listed in an alert condition. ' During the event, all safety systems responded as required. These systems include the operation of the reactor protection system (RPS), the steam generator safety relief valves and the a ' auxiliary feedwater system. The secondary power-operated relief - . Q .e>-ww- w---- - - - v-v--

_ _ _ . _ _ __ . _ _ _ _ _ _ . . - . _ _ __ _ .- _ ._

.

. ' 28 valves (PORVs) were in the manual mode of operation. The opera- tors.took manual control of the secondary PORVs to control steam generator pressure, allowing the secondary relief valves to shut and to control the removal of decay heat in the primary plant. _ , The only equipment which did not respond as required was (1)

. control rod (M-10) which indicated 35 steps for a short time ' following the reactor trip before indicating fully inserted; ! (2) the fire protection system which spuriously initiated as

discussed in paragraph 13; (3) the instrumentation which failed to indicate closure of the C MSTV as discussed in paragraph ,

11.a.(2); and (4) the security door card readers which failed as 6 discussed in paragraph 13.b. t b. Review of Maintenance Activities Being Performed Prior to the Event Discussions with licensee personnel and review of the maintenance

activities being conducted prior to the event did not indicate any ]' maintenance activities which would have contributed to the initiation or resulted in the feed water pipe rupture. Maintenance activities j being conducted by the individuals who were injured were unrelated to l the feed water system rupture and would not have contributed to the cause of the event. i 12. Licensee's Response to the Event 4 a. Operator Response The response of the operators to the initial reactor trip and later pipe rupture was excellent. The break was isolated rapidly. The only ! problem that occurred was a control rod gave an indication of not i being fully inserted by 35 steps. Emergency procedures were followed i quickly and orderly to assure adequate shutdown margin. It should be noted that the licensee has conducted tests with the plant in a cold condition, but has been unable to duplicate this rod position i anomaly. The licensee intends to conduct additional testing during ' startup. b. Emergency Response The inspectors discussed various aspects of the licensee's response ~ to the feedwater pipe rupture with licensee employees. The first person responding to the accident was a senior instrument technician who had been perfor'ning quarterly calibrations on security equipment. He responded to a station security call for first aid assistance to the Unit 2 truck bay. Upon arrival, one injured employee was observed leaving the accident area. The technician escorted the individual to the high level intake structure and set up a triage area. Three additional personnel subsequently exited the decident area and were . ' . . 6 .n - - - . - . - - - , - - - - . , . . , .

_ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ ___ _- _ _ l . . . 29 - . i given first aid by the team that was present. The technician unsuc- cessfully attempted to contact the Unit 2 Control Room using a security radio. The technician then proceeded to the maintenance services area to call for assistance. Upon arrival, the technician discovered two additional accident victims. The technician used the plant page system j , ' to notify the control room who called in offsite medical support, i including two medical evacuation helicopters and two local rescue squads. The licensee prepared the victims for transport and moved them to the licensee's heliport, located behind the training building. The three most seriously injured personnel were air evacuated to hospital burn i units while three were transported by ambulance. Licensee personnel interviewed following the event have stated that ! < the site's emergency team functioned extremely well and was well , - coordinated. Further, licensee representatives have stated that the i Alert was declared so that a personnel accountability could be made i because it was not kncwn at the time of the event how many people had been in the area when the feedwater pipe ruptured. The inspector reviewed the actions required by the licensee's emergency . plan and determined that the actions taken by the licensee were in accordance with the actions specified in the plan. 4 ! c. Emergency Information Activities ' The accident spurred extensive interest from the media in the immediate plant area, throughout Virginia,=and-nationwide. Virginia Power issued - - its first press release slightly more than an hour after the declara- ! tion of the alert. This initial announcement was followed by several others later in the day and into the evening. Follow-up announcements were issued the next few days. In accordance with the company emer- gency information policy, Virginia Power began steps to open the 4 near-site media center in the Surry, Virginia, Community Center. Because the Alert was cancelled before,the media center was fully ! l operational, reporters were briefed at the emergency operations ! facility at the site. Virginia Power also opened its main media center i at company headquarters in Richmond and issued information from there for several days thereafter. The day after the accident press conferences were held at noon at.the on-site training facility and at the Richmond media center. An NRC l public affairs officer went to the site with the Augmented Inspection i Team. He answered telephone media inquiries from the resident inspector's office and participated in three press conferences with

Virginia Power. NRC also responded to inquiries received by the public affairs offices in the Region II office and in, Headquarters.

1 . . ' . - , ,

---

.,,n---,-,_,.--

-,, --~n , - - . - - , , , . - . , - - - - - - - - - - - - - - . - ---

' . . 30 . In addition to written announcements, news briefings, and answers to telephone inquiries, Virginia Power also made available to reporters both videotapes and still pictures of the accident scene. Both NRC and Virginia Power continued for several weeks to respond to media 'imquiries about the accident and the followup investigations. A briefing of NRC by Virginia Power on January 12, 1987, attracted media coverage, as did a technical meeting convened in NRC Headquarters on January 15. Virginia Power on January 22 held a special media briefing on the results of its investigation. NRC received numerous requests from reporters and for copies of the AIT report. 13. Aspects That Made Handling The Event More Difficult a. Security System / Personnel Actions (1) At,the time the pipe ruptured, water and steam saturated a security card reader located approximately fifty feet from the break point and shorted out the entire plant card reader system. As a result, key-cards would not open plant doors. Security personnel responded to the control room and provided access control while doors into the control room were opened for easy access and to improve control room ventilation. Guards admitted personnel on the basis of personal recognition. The Senior Resident Inspector reported observing that plant management and operations personnel were immediately admitted by the guards and nonessential personnel were excluded. The card reader system returned to service approximately 20 minutes after the pipe break and functioned normally thereafter. An operator reported being delayed in the stairway outside the control room as a result of I the card reader failure. Due to the hot water conditions on the turbine building basement floor and the discharge of Halon fire suppression system in the emergency switchgear rooms below the ! control room and the carbon dioxide fire suppression system in the cable tray rooms above the control room, the operator had no safe way to exit the stairway other than the control room itself. The l operator was admitted to the control room by someone opening the l door from inside the control room. The licensee is considering

! installing electronic override switches which would permit the ( opening of electronically locked doors in emergency situations. l l Plant management personnel reported that security provided fast and excellent support during the emergency. ' (2) The security radio repeater is. located in cable tray room 1 (turbine building elevation 45), which is equipped with a Cardox fire suppression system. As a result of steam infiltrating various electrical systems this Cardox system was activated and the full volume of Cardox was discharged!into the room. The security repeater, located approximately five feet from a Cardox discharge nozzle, failed and was la,ter found to be covered with a . l ._- ___ _ -__ _ _ _ _ - _ . .. - - .-. - _ _ _ _ - - _ _

- _ - - _ . . - --

. .' 31 thick layer of ice. As a result, security communications were limited to the non-repeater or " simplex" mode. Since the hand- held security radios have only four watts of transmitting power, some communications clarity was lost between units inside , ' buildings. Loss of the radio repeater may also have prevented cohtact with the Unit 2 control room by the first responder as described in paragraph 12.b. (3) A truck carrying water coolers containing ice was the only vehicle admitted to the protected area during the emergency. While the truck was processed expeditiously, it was not processed as an emergency vehicle, which would have allowed its immediate entry. This resulted from the lack of information available to security personnel at the vehicle gate about the exact nature of the emergency and lack of understanding that the truck was bringing in ice and ice water for use in treating the burn v i ct,i m s . The licensee has recognized the importance of ensuring that personnel functioning in a supporting role know what is happening so they may better understand and, therefore, better respond to tasks they are given or situations as they arise. (4) One security badge /keycard was temporarfly lost during the emergency. Badges were retrieved from five victims before they were transported from the site, but the badge on one individual was overlooked. As part of the personnel accountability process, security realized that one badge, belonging to one of the - victims, was unaccounted for. That badge was deleted from the access control computer and computer records were checked to ensure that the badge had not been.used since the accident. The individual's wife found the badge on his shirt at the hospital and the badge was returned to the plant the morning following the accident. ' (5) At the time of the pipe break, two security shifts were on duty, which permitted security to provide a great deal of manpower to support the plant. The inspector, determined that one security shift could have provided the manpower to perform the actions taken by security during this event. The security force, however,

would have had to suspend all routine activities if only one ' shift had been available. . (6) The Surry security organization has examined its performance ' and identified ten areas in which improvements can and should be made. Recommendations in these areas were submitted to both security and plant management for evaluation and possible implementation on December 19, 1986. b. Fire Protection System Actuations and Main Control Room Habitability l Within minutes of the feedwater pipe rupture event in the Unit 2 turbine building, portions of the Unit 2 turbine building sprinkler I system actuated. Sixty-two sprinkler hea'ds opened in the immediate . - - _ - , . - - .- - - - - _ _ . . _ _ - _ . --

- . - . - - - -. ~. . - - . - - . - - - - - - - - . - _ - - . , - , 4 ! - 32 , i i area of the feedwater pipe rupture due to the high heat levels 3 associated with the event. As they opened, these sprinkler heads ' immediately began discharging water to cool the turbine building ' atmosphere. , ! As a result of the sprinkler wa'ter and feedwater discharge, the carbon dioxide and the Halon fire suppression system control panels were affected. The carbon dioxide fire suppression system control panels

for both Units 1 and 2 cable tray rooms are located near the Unit 2 i cable tray room access door along the column line 9 wall on elevation j 45'-0". The sprinkler water discharge from the sprinkler heads 1 , directly over and adjacent to these panels intruded into the carbon ' dioxide fire suppression system control panels through multiple open

i conduit ends which extend from the panels to the cable tray raceway ' above. As a result, the water intrusion into these panels caused the - time limit switches to short-circuit in the closed position. When ! these switches closed the carbon dioxide fire suppression systems, at i approximately 2:32 p.m. (12 minutes into the event) the Robertshaw fire l protection panel / printer in the main control room recorded the initial discharge of the Unit 2 cable tray room carbon dioxide fire suppression j system. In addition, at approximately 2:34 p. m. (14 minutes into the l event) the Robertshaw panel recorded the second discharge of carbon ' dioxide into the Unit 2 cable tray room. It should be noted that the bulk of carbon dioxide discharge was in the Unit I cable tray room, ' which was noticed by the licensee's loss prevention staff who c'onducted - i the personnel search and initiated the venting of carbon dioxide from ' the cable tray rooms. The Robertshaw fire protection panel / printer did

not register a Unit I discharge throughout the duration of the pipe rupture event. Thus, as a result of the water affecting the time . limit switches in the carbon dioxide control panels, the discharge ! timers did not function as designed. As a result, a total of 17 tons . of carbon dioxide was discharged into the cable tray rooms, i ' In addition, the Halon fire suppression system protecting Units 1 l and 2 emergency switchgear rooms on elevation 9'-6" actuated at approx- imately 3:02 p.m. (42 minutes into the, event as documented by the

! Robertshaw panel printer). The Halon system actuation was caused j by sprinkler water discharge and feedwater runoff which flowed under

the elevation 27'-0" fire door No. 30 installed in the column line 9

wall. The water runoff cascaded down the column line 9 wall, which

separates Units 1 and 2 turbine buildings, on the Unit 1 side, entered a Halon system conduit through a conduit fitting which had the fitting cover plate removed at the time of the event. The specific conduit fitting is located directly below the open grating floor on the Unit 1 3 side of the elevation 27'-0" column line 9 wall fire door No. 30. The

l runoff water which entered the subject conduit flowed through the j conduit and into Halon control panel 1-FPH-CP-1 located on the Unit 1 J side of the column line 9 wall on elevation 9'-6". This water intru- ! sion caused short-circuiting of the time limit!, battery charger and the t

. 4= .

- - - - ' . . 33 . dual zone modules. With the shorting of the dual zone modules, which are associated with the manual remote actuation circuit located in the control room, the Halon system actuated discharging 7 percent to i 10 percent Halon concentration into the emergency switchgear rooms. ! Since H'alon extinguishing agent is heavier than air, thi, discharge ' into the emergency switchgear rooms on elevation 9'-6" had essentially no effect on the habitability of the main control room. Upon the initial discharge of the emergency switchgear Halon fire suppression i system some Halon leakage into the main control room through floor penetrations in the Unit I computer room and through the control room emergency air bottle discharge piping was noticed. However, it should be noted that these concentrations of Halon which resulted from the emergency switchgear room discharge would not have put the control room personnel at risk. Upon verification of the carbon dioxide system discharge by the main control room personnel, two nembers of the licensee's loss prevention staff entered the cable tray rooms with self contained breathing apparatus to conduct a search for personnel. As a part of this search, measures were tsken to vent the carbon dioxide from the cable tray , rooms by opening the doors to the Units 1 and 2 mechanical equipment ' rooms and the respective cable tray room access doors located on elevation 45'-0" of the Units 1 and 2 turbine buildings. In addition, while the carbon dioxide was being vented from the cable tray rooms, the main control room annex door in the turbine building / control room complex wall and the main control room door separating the annex from the main control room were blocked open. Thus, carbon dioxide being heavier than air, flowed down from elevation 45'-0" to elevation 27'-0" and into the main control room annex and the main control room through , the open doors. In addition, during the time the carbon dioxide was being vented from the cable tray rooms, the main control room exhaust fan (1-VS-F-15) was operating. The operation of this fan created e

i negative pressure in the main control room and the main control room annex thus, causing the vented carbon dioxide to be drawn into the control room complex. i , 1 l Presence of carbon dioxide in the control room can also be attributed i ' to the fact that at the time of the event control room ventilation L ~ unit 1-VS-AC4 was out of service for design modifications and that a l temporary unit which obtained its makeup air from mechanical equipment , room I was in service. Therefore, when carbon dioxide vented from the ! l respective cable tray room came into the mechanical equipment room', l this allowed the te.nporary control room HVAC fan unit to draw the gas r into the control room ventilation system. I Control room personnel in the main control room annex and near the 1 main control room door experienced shortness of breath, dizziness and nausea. But it should be noted that once theyl recognized that carbon

' dioxide was present the control room operators took the appropriate corrective actions and initiated control , room emergency air supply ' .- , I - - ~ ~ . . - m , _.- - - ...__,,_..._,_-m.__.~... . . , _ , _ - _ , . m_-.

_. .__. __ _ . _ . _ . _. .. ' . . 34 . fans 1-VSF-41 and 2-VSF-41. The starting of these fans placed the main control room at a higher pressure than the turbine building. This action assisted in diluting and exhausting the existing carbon dioxide ' levels and kept any additional carbon dioxide from infiltrating into themajncontrolroom. . As a result of the spurious fire protection system actuations associ- ated with the feedwater pipe break event, the licensee has proposed the following carbon dioxide /Halon fire protection system modifica- tions: (1) Seal the open ends of all conduits leading to the carbon dioxide system control panels throughout the plant. (2) Replace all components within both the Unit 1 and Unit 2 cable tray room carbon dioxide control panels that show visible signs q of corrosion. . ! (3) Fully test both systems to confirm proper system operation. 1 l (4) Seal the Unit I control panel. A 1-1/2-inch hole and a 1 inch hole exist in the right side wall near the bottom of the panel. (5) Replace missing 2-inch conduit cover under the elevation 27'-0" turbine building column line 9 wall platform and walk down all , ' other conduits to ensure that covers to conduit, pull boxes, and junction boxes are in place and properly sealed. i (6) Repair door seal on the Halon control panel and relocate ! identification sign, i ! (7) Replace all existing Halon panel modules which are no longer i manufactured and upgrade these modules to current state-of-the-art equipment < j (8) Perform functional tests of the H.alon system for both units 1 and 2 emergency switchgear rooms to ensure proper operation. (9) Replace Halon system check valves in discharge lines or replace j rubber seals. l (10) Have all Halon cylinder heads replaced or reworked to ensure, bottles will not leak and that seals are in good condition. , (11) Have Halon bottles filled and placed in discharge header. (12) Have Halon pressure switch covers and solenoid covers removed and I inspect for corrosion or water damage. , . . 4 l .. '.

I < -- - - . - _. . . - . - . . - . - - - . - - . - - . . .. - . -

.. . ,. - . _ - . - - - - - - ' . ,- 35 Based on our review of the above modifications, it appears that upon their completion the probabilities of spurious cable tray room carbon dioxide and emergency switchgear room fire suppression system actua- tions due to water / steam intrusion will be greatly reduced. However, it is our recommendation that the licensee, in addition to implementing the abo,ve proposed modifications, consider the following with respect to ensurthg control room habitability and personnel safety: Install a wintergreen odorizer on the Units 1 and 2 cable tray - room carbon dioxide system, Install a permanent oxygen analyzer with a control room audible - alarm in the main control room annex, Develop a procedure which will require the control room operators- - l to pressurize the control room in the event of a gaseous fire ' suppression system actuation in either the cable tray room or the emerge.ncy switchgear rooms, and Install predischarge visual and audible warning devices near the - Units 1 and 2 cable tray room doors and inside the cable tray rooms which will activate to alert personnel prior to a carbon dioxide system discharge. c. Other System Interactions , . i There does not appear to have been other significant system interac- tions which impeded the safe shutdown of the plant. All shutdown systems responded as designed, and an orderly plant cooldown was accomplished. l l 14. Consideration of Shut Down of Unit 1 At 12:30 p.m. on December 10, licensee management decided to shut down Surry Unit 1 and operation of the unit was placed on power ramp down at 5:30 p.m. The unit was subsequently cooled down and pl, aced on residual heat removal and is currently in a cold shutdown condition. The decision to shut down the unit was based on preliminary findings resulting from the Unit 2 main feed pump suction pipe rupture. These findings indicated that there might have been significant thinning of the l pipe wall due to a corrosion / erosion mechanism not fully understood at the time. The shutdown plan included inspections of selected Unit 1 piping.to ascertain its condition with regard to pipe wall thinning. Subsequent ultrasonic examination of the identical elbow that failed in Unit 2 revealed similar but not as severe pipe wall thinning. !

. O O e

- . _ .- . _ .- .- - . - . - - . . . 36 - The licensee gave priority to Unit 1 inspection and hardware replacement in parallel with its investigation to determine the root cause of the Unit 2 pipe rupture. This was done in order to facilitate restart of Unit 1. 15. Investigatipns and Corrective Actions Taken ~ a. Initial Activity The licensee agreed to a quarantine of all equipment and systems which could be significant to the ongoing investigation of the event. , Consequently, all activities undertaken with regard to restoration work or investigations were done with the concurrence of the NRC team on site. During the first week following the event, . concurrence was given for some turbine generator work on the turbine deck which was not relevant to the investigation and work involving cleanup and restora-- tion of the damaged area. The following equipment was inspected: (1) A main feed pump suction indication in the control room pegged at , 1000 psi. The pressure transmitter associated with this indica- tion was inspected to determine operability. Subsequently, it was determined that the transmitter housing was 1/3 full of water and it appeared that the electrical portion of the transmitter was not operable due to shorting. (2) A calibration and circuit check was performed on pressure cutoff switch for the high pressure heater drain pump. This was done to - determine if the section of line leading from the HP heater drain pump discharge to the condensate header had been pressurized to at least 600 psi. The switch was designed to cut off the pump if a 600 psi pressure was exceeded. The switch was calibrated and found to be operable indicating that a line pressure of greater ' l than 600 psi was not present. 5 On December 16, 1986, this quarantine was lifted. l b. Piping Systems , Based on the failure of Surry Unit 2 main feedwater pump suction line

and the fact that the Surry Unit 1 suction line design was similar to , Surry Unit 2, the licensee decided to shut down Surry Unit I and -

inspect the main feedwater pump suction line. The Surry Unit 1 suction line was found to have reduced wall thicknesses similar to , i Surry Unit 2. When pipe wall thinning was found in Surry Unit 1,' l the licensee decided to inspect similar piping at North Anna Unit 1. Approximately 4900 ultrasonic inspections were made on North Anna

Unit 1 piping. No measurements indicated pipe wall thickness below the required minimum. The feedwater pump suction piping and header , wall thicknesses were within original pipe manufacturing specifica- l tions, and the high pressure drain pump dischdrge piping was no more than 15 percent below the original specifications. .' l

. f , - - * - - - - - ,m-., . - - , - - - . , , . , - , - ~ , - - , - - - - - - - - - - - ,,,,,--,,,--,-+.-,.m. _ _ , , . - - - - - - , , - - , - - - - . , . - - - - - - - + - ---s------ -- , ,,

. . . 37 - As a result of finding thinned pipe at both units, the licensee initiated a pipe wall thickness measuring inspection program to define the extent of pipe wall thinning at Surry Units 1 and 2. The following summarizes the criteria for the program, the acceptance criteria, and the inspection results to date. (1) Corrosion / Erosion Parameters In the review to determine the parameters affecting corrosion / erosion, the licensee found limited data available from industry experience with bulk single phase corrosion / erosion. The available literature correlates single phase corrosion / erosion to two phase wet steam corrosion / erosion. The parameters that appear to affect corrosion / erosion in single phase flow are: . Material Phenomenon occurs in carbon steels. The - - resistance to corrosion / erosion ' increases with alloying. Fluid Velocities - High fluid velocities increase - corrosion / erosion. Temperature Corrosion / erosion takes place batween - - 195 and 440*F. High Water Purity- Corrosion / erosion.affected by oxygen - content. These parameters and the corrosion / erosion process relate to the rate of buildup and removal of the protective magnitite (Fe 0 ) 34 layer. Based on the above information, the licensee established the following criteria to select systems to be inspected: System handles water or steam - System piping is carbon steel - System temperature is greater than 195"F - System is deoxygenated (low ppb range) - As added verification of these criteria, the licensee also included in the program specific locations within systems outside the criteria, including safety-related systems, such as, the' auxiliary feedwater system (oxygenated and less than 195*F), charging system (stainless steel) and condensate system prior to the point heater (less than 195*F). (2) Rating Scheme Within a system, a rating scheme, based oh temperature, velocity, and geometry, was used to identify potentially high corrosion / erosion wear regions. .. . , .- 9

. .

38 . After consideration of the above criteria and rating scheme, the licensee decided to inspect components beyond those identified as priority by the rating scheme. In addition to the components picked for the auxiliary feedwater system, charging system, and condensate system to the 4th point heater, the following compo- nents were included in the wall thickness inspection program for both Surry 1 and Surry 2: Every fitting and selected locations on straight pipe from - the inlet of the 4th point heaters to the feedwater pumps and from the feedwater pumps to the feedwater regulating valves. Selected locations along sweeps and straight lengths of pipes - from the feedwater regulating valves to the containment for' loops A, B and C. There were no priority points in these sections of pipe using the rating scheme. High priority points on B feedwater loops from the contain- - ment to the steam generator. The points picked were representative of similar configurations in loops A and C and also included some unusual configurations. (3) Acceptance Criteria The licensee developed an acceptance criteria to provide guidance in determining whether a fitting or section of pipe needed to be replaced immediately, replaced at some future time in its operat- ing life, or monitored by inspection during its operating life. The acceptance criteria were based on the existing wall thickness, as measured by the inspection program, the calculated corrosion wear rate, and the Code minimum required wall thickness. The wear rate was calculated by dividing the wear to date (assumed to be the nominal specification thickness plus manufacturer's tolerance minus the existing as measured thickness) by the number of years of operating history. , The following acceptance categories were defined: (a) Immediate Replacement Existing thickness below - minimum Code or below 0.100 inches. , (b) Engineering Evaluation Existing thickness greater - than Code minimum but calculated (based on wear rate) to still be acceptable at the time to next outage plus I/2 year. .' _ -. . . . . .- . . _ , , . _ . _ _ _ _ _ . _ . , , - _ _ _ . _ . . _ , , . - , _ _ _ _ _ - _ . _ _ _ _ _ _ - . . _ . _ _ , , _ _ _ , , - . _ . . , _ _ _ . . , _ , . . . . . . , _ . _ _

.

. 39

. (c) Potential Next Outage Existing thickness greater than - Replacement acceptable thicknest at time to next outage plus 1/2 year but less than acceptable thickness at time to next two outages , , plus 1/2 year. Inspect at a _ next outage. (d) Each Outage Inspection Existing thickness greater - than acceptable thickness at time to next two outages plus 1/2 year but less than acceptable to next three outages plus one year. , (e) Place Component in Existing thickness greater - Station's Inspection than acceptable thickness at Program time to next three outages plus one year. (4) Summary of Inspection Results and Replacement as of January 8, 1987 Unit 1 Unit 2 Components to be Inspected 588 588 Inspection Requests Issued - - - - 515- 208 Inspections Complete 427 150 Components Designated for Immediate 48 7 Replacement Components Designated for Potential 8 4 Replacement at Next Refueling Outage Components Designated for Inspection 40 8 at Next Refueling Outage Components Removed 38 7 Components Installed 8 0 b. Main Steam Trip Valve Because of deficiencies found in the Unit 2 C MSTV (see paragraph 11.a.(2), the licensee inspected the internals of the remaining Unit 2 MSTV and the three Unit 1 MSTVs. No assembly deficiencies were found. In addition, each pair,of air actuating cylinders for each valve was rebuilt. .' 9 _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ . _ . . _ _ _

. . _ _ _ __. ~ . ' . 40 - c. Main Feed Pump Discharge Check Valve ' The remaining three main feed pump discharge check valves were inspected. The results were as follows: , 5 Both c' lamp assemblies had loose bolts and the Unit 2 8 Check Valve - lock wires for these bolts were missing. The lock plates exhibited some erosion but the

disc / seat assembly was not displaced. t Unit 1 B Check Valve Both clamp assemblies had loose bolts and the - lock wires for these bolts were missing. The lock plates exhibited extensive erosion but the disc / seat assembly was not displaced. The left side hinge pin was missing. Unit 1 A Check Valve - No defects found. This valve was overhauled

- in May 1986. ' The check valves will be modified as follows: (1) New hinge pins will be installed that are secured in place by a lock pin which is welded in place. The lock pin will project through a hole in the hinge pin. This modification will be completed prior to startup of the units. (2) The clamp assembly which holds the seat to the valve body will be eliminated by welding the disc / seat assembly onto the valve body. " This modification required a material change. Due to the unavail-

ability of this material, the modification will be made at the l next scheduled outage of sufficient duration when the material is available or during the next refueling outage. (3) The check valves will be periodically inspected in accordance with an inspection plan to be developed by the licensee. ' 16. Safety Considerations for Station Restart By letter dated January 14, 1987', the licensee submitted a report entitled "Surry Unit 2 Reactor Trip and Feedwater Pipe Failure." This report provides detailed information on the December 9, 1986 event and a recovery plan and corrective actions for NRC review and concurrence prior to station restart. The AIT has reviewed this report and has conducted an independent inspection effort which provides the bases for our concurrence with the licensee's restart plan. I

. ee. .. ~ . . - _ _ _ _ _ , , . _ . _,, _ _ , . - _ . .__.- , _ , . _ _ _ . . _ _ _ _ _ _ _ . - _ - . - . . . . . -. . .

_ _ _ _ _ _ _ _ _ . . > . . , 41 - ' The Itcensee's report outlines a program which has been implemented for initial inspection, hardware replacement and periodic inspection of the main feed and condensate piping systems. This program provides for development of a model which is believed to predict the erosion-corrosion mechanism and the rate of pipe wall thinning in a conservative manner. The licensee, ush g this model, developed an inspection / replacement program for various fittings in the feed / condensate systems. This program defines conservative acceptance criteria for the fitting replacement which predict the time that would elapse before minimum allowable wall thickness would occur (see Section 15.b). In addition, a periodic inspection program has been established. The periodic inspections would provide information to continually reaffirm or modify the model. Thus, the present inspection / replacement program would permit a satisfactory knowledge of the present state of the plant's condensate /feedwater systems. Future inspections together with the current information would continually provide assurance j that the loss of wall thickness is not occurring at the rate which could result-in prem.ature failure. These actions provide additional confidence in the startup and permits the carrying out of a conservative inspection program which adequately defines weak points in the feed and condensate systems. l This replacement / inspection program is an interim measure to be utilized as more information_is developed with regard to the mechanism of erosion /

corrosion. The licensee intends to develop a long range program of correc- ' tive action that includes geometry as well as material changes to the feed and condensate systems.

Inspection performed on the other single phase systems in the plant showed. - no indication of the type of failure experienced in the feed / condensate system (i.e., wall thinning due to corrosion / erosions). In addition, the licensee will continue the inspection program previously developed for two- phase flow systems. The AIT has also reviewed the licensee's corrective actions with regard to the MSTV maintenance procedures and the proposed short-term and longer term hardware improvements for the main feed pump discharge check valves, and concludes that the licensee actions are satisfactory. In addition, as a result of the AIT inspection and re. view of the licensee's program, the following conclusions and findings were developed. a. Sequence of Events . The inspectors performed an independent evaluation of the event scenario, including the sequence of events and their cause of the events. The inspectors' conclusions are that the reactor primary system and all safety-related components reacted properly to a loss of load transient initiated by the closure of one of the main steam trip valves. The pipe rupture occurred before the bain feedwater discharge l

> _ 9 - , - . - - ..-,c------- - ., - - - - . - - - - - ---,- ,- _ _ ---- .. -- - . -- - - -

. - _. . .

. 42 - check valve could malfunction. The only contribution to the event was that the malfunction of the MFW pump discharge check valve caused steam / water to be discharged from the break. We concur with the

licensee's evaluation of the sequence of events. b. WaterbammerOccurrence ' Inspection of the Surry Unit 2 condensate and feedwater piping conducted following the pipe rupture event did not indicate that feedwater system water hammer occurred during the event. Reviews of PWR operating experience regarding water hammer in feedwater systems indicate that severe water hammer loads usually result in extreme damage to pipe nanger supports and instrumentation and are usually the result of feedwater control valve instability. The Surry Unit 2 feedwater piping from the containment penetration back through the A main feedwater pump, haater drain pump and condensate pumps have been inspected by the team, and there is no indication of this type of damage anywhere but in the vicinity of the rupture. Inspection by the licensee has also indicated no such damage. In addition to this, measurements of pressure between the steam generator and feedwater control valves indicate there was no leakage from the steam generator back through the feedwater system. c. Metallurgical The pipe rupture occurred due to severe pipe wall thinning. The general thinning condition appears to have been caused by a corrosion / erosion mechanism with thinner localized areas related to high turbulent flow. The fracture appeared to have originated at one of the local severely thinned areas. The licensee's preliminary metallurgical analysis indicated that the material met all specification require- ments. Additional tests are in process by the licensee and the NRC to fully define all material properties. The licensee has outlined an inspection program for the feedwater and condensate piping systems, based on conservatively predicting the corrosion / erosion mechanism and the rate of wall thinning which should, ensure that the wall thickness is monitored adequately to preclude premature failure. The licensee's results and inspection program are outlined in their report, "Surry Unit 2 reactor trip and feedwater pipe failure" submitted by letter dated January 14, 1987. We concur that the report covers the metallur- gical aspects of the problem adequately, d. Chemistry ' The methodology used to control secondary water chemistry to prevent localized corrosion of stea:n generator components (as recommended by the Steam Generator Owners Group) may result in " aggressive" water chemistry conditions that favor general corros, ion of carbon steel. I I -

.

. _ . ,_.._,____._x _ .__.._____,__ ._. ,_,.. _ ,_________.___ ,.___ ,_. _.,___, . _____.__ __.__ - ._._____._ _.~_

._ _ .- . _ - _ _ . ._ . . . .

43 The formation and retentien of an adhesive film of magnetite on the . inner surfaces of carbon steel pipe, in regions of single phase and turbulent flow, may be affected by variables other than regeneration by oxygen. Emergen'cy Preparedness ' e. The facility's emergency organization responded to the pipe rupture event in a commendable manner. The plant staff worked together effi- ciently to minimize personnel injuries and to mitigate the consequences of the event. Offsite support requested for the injured personnel responded to the call for assistance expeditiously to transport the injured personnel to area medical facilities. Verbatim compliance with the actions specified in the Emergency Plan appears to have been .

.

exercised by the plant staff in responding to the event. <

f. Public Information Virginia Power implemented an aggressive and candid program to inform < ' news agencies - and, through them, the public - of the basic facts concerning the accident and of continually updated findings as the Company's own investigation went forward. Key ranking company execu- tive spent an unusual amount of time in briefing reporters in several

news conferences. Reporters were taken on several tours for a first- ! hand look at the accident area and at pieces of the broken pipe. I ! g. Plant Systems (1) The inspectors reviewed the' licensee's program for determining the cause of the C MSTV closure and also the failure of the MFW pump discharge check valve to fully close during the event. The licensee's technical evaluation and the corrective actions taken to restore the above components to normal operation were deter- mined to be comprehensive and acceptable. (2) An apparent violation of Maintenance Procedure MMP-C-MS-002 which initially overhauled the C MSTV wits identified. This procedure lacked detailed instructions, was not fully followed and did not provide adequate documentation to show the repair of the MSTV was accomplished in a quality manner. The licensee was informed that similar problems may exist with other system maintenance procedures and licensee review should be conducted. , (3) The inadequate maintenance performed on the C MSTV did not prevent the valve from performing its safety function or cause it to be in l noncompliance with Technical Specifications. (4) The reactor trip was a direct result of the improper overhaul of the C MSTV in conjunction with the lower than normal instrument , air pressure. However, the MFW line rupture was not caused by l the MSTV closure but occurred due to the normal pressure transient ' which followed the reactor trip.

' ,_ , , - , . - - - - - . - - , - - , - - - . - - - - - , - - . . - , - ~ , . - - - - - - - - - , - - - - . . - ~ - - - - - - - - ~ ~ - - - - - - - - - -

. . ~ 44 - . (5) The maintenance performed on the C MSTV indicated several cases where anomalies were resolved without either proper documentation, notification of supervision or engineering review. Examples are the changing of the radius levers on the rock shafts and the need to adjust the MSTV lijnit switch following maintenance. Had these problems received the proper attention and evaluation, the improper reassembly of the C MSTV could have been identified . before causing a reactor trip and a challenge to the reactor ' safety systems. (6) The post maintenance test used to check the operation of the MSTVs following maintenance only verified their safety function and compliance with Technical Specification. Additional testing should have been required to verify full are travel of the valve , disc and therefore proper reassembly of the valve would have been confirmed. h. Security The actions of security personnel during the event provided prompt personnel access to sensitive operational areas including the control room. As a result of evaluating the security aspects of the event, the licensee is considering additional training and hardware changes to further facilitate emergency access to restricted areas. 1. Fire Protection As a result of the feedwater pipe rupture event in the Surry Unit 2 4 turbine building, Units 1 and 2 cable tray room carbon dioxide fire suppression systems and emergency switchgear room Halon fire suppres- sion systems spuriously actuated causing control room habitability problems during the event. Based on our review, we conclude that the l licensee's staff has properly analyzed what caused the spurious fire ! protection system actuations and has initiated modifications to the ' subject fire suppression systems which will greatly reduce the prob- abilities that these systems will spur,iously operate due to water / steam , j intrusion. In addition, it should be noted that once carbon dioxide ! leakage into the control room was recognized, the licensee's control room operations staff initiated prompt corrective actions to maintain control room habitability. However, with respect to ensuring control room habitability and personnel safety we recommend that the licensee consider the following: The installation of a wintergreen odorizer on the Units 1 and 2 - cable tray room carbon dioxide system, The installation of a permanent carbon dioxide analyzer with a - control room audible alarm in the main co,ntrol room annex, .' 4 ,- - _ _ _. .. _ -_ _ _ __ .._,.___m...,_, , _ . _ _ _ _ , - _ _ _ , . _ , . . , _ . _ _ . _ , _ _ - _ . . _ _ _ . . _ _ _ . . . _ _

l . . '

45 . i The development of a procedure which will require the control - room operators to pressurize the control room in the event of a gaseous fire suppression system actuation in either the cable tray room or the emergency switchgear rooms, and ' , Th'e_ installation of predischarge visual and audible warning - devices near the Units 1 and 2 cable tray room doors and inside the cable tray rooms which will activate to alert personnel prior to a carbon dioxide system discharge. a . O , I . *

i , w e . . -.- , - , - - - - -- .n , , y .,, - .,-. - . ,, .-- - , , ,- ,en,- n--- , _ ---, -w,-_.,-- - - - - . - - -- _ - - - , - - - - - . _ - _ . _ _ _ . - -

. _ _ _ -_. . . _ ._. _ . _ - _ _ -. . . . ~ . t APPENDIX . CHEMISTRY-CORROSION CONSIDERATION OF THE SURRY , UNIT 2 FEEDWATER P.IPE RUPTURE EVENT 1. Fundamentals of Generalized Corrosion Although the eventual rupture of the 18-inch suction pipe may have been initiated at a point on the upper-inside region of the first elbow down- stream of the header, both visual evidence and ultrasonic measurements showed that generalized wastage of the pipe, with resulting thinning from , the nominal 0.5-inch wall thickness, had been the obvious precursor to the pipe failure. Because of the uniform nature of the thinning there was no evidence of other types of mechanical or chemical attack. Generalized thinning of iron surfaces is considered to be caused by erosion /

corrosion processes, with either process being dominant. The potential for ' mechanical and hydraulic erosion is greatest in regions of turbulence and non-single phase flow and is enhanced by increased flow and temperature. Consequently, erosion mechanisms can be expected in the regions of the tee junction of the feedwater header and suction pipe, and, to a lesser degree, in the elbow regions of the suction pipe. The role of corrosion, specifically in the Surry feedwater system, is more speculative because of the multiple chemical reactions that might have occurred during the thirteen - years of normal and abnormal chemistry control. The licensee has tenta- tively assumed that general corrosion occurred because the carbon steel ! pipes had been in contact with ' aggressive' (low dissolved oxygen) water. Removal of iron from a carbon steel pipe is thought to occur through ' oxidation processes that establish a corrosion electropotential between i metallic iron (as an anode) and an oxidant in the water layer adjacent

to the metal surface (cathode). Depending on the magnitude of the corrosion potential the oxidant in feedwater could have been hydrogen tons, cupric or i cuprous ions, or oxygen. All of these cathodic reactions are enhanced by j the presence of chloride ions. l In stagnant water systems the ferrous ions (Fe++) generated at the metal / water interface are amenable to further oxidation by dissolved oxygen to l j produce insoluble iron oxides such as Fe 02 3 (hematite) and Fe 03 4 (magnetite) l as well as other, less stable, hydrous oxides of iron. The formation of magnetite also can occur in the absence of. measurable amounts of dissolved t oxygen. One mechanism that has been prop ~osed is further electrochemical reaction of hydrogen ions (H+) and the trace concentrations of soluble ferrous hydroxide in the aqueous layer adjacent to the metal surface. The formation of magnetite rather than hematite is favored by increased [ temperature (especially between 300-350 degrees F) ,and again under stagnant conditions. Under optimum conditions, a non-porous', adhesive film of magnetite forms on iron or steel surface. The film eventually terminates '; .

• eo

, , - - r , ,,n,,,,,-----,--,--,--,-,--,r,- ,~,c,-..--~n ,-,.~.-------.->_.-,~w--,-,-~---.,,-,----,n~ - - - , .

. . Appendix 2 further removal of iron by electrochemical attack by eliminating the anodic reactor (Fe*+ Fe++). The oxide is in chemical equilibrium with the adjacent water and will degrade if the equilibrium is impacted by chemical and/or hydraulic factors. 2. Role of Pass'ivity and Corrosion in the Thinning of the Feedwater Pipes a a. Observations As the result of his visual inspection the inspector could not establish the extent to which the chemistry of the feedwater abetted the thinning process or provided protection against the continuous removal of iron from regions of turbulence and single phase flow. The appearance of the pipe in Unit 1 was significantly different from Unit 2; however the extent of thinning was similar in both units, but < it was less severe in Unit 1. The presence of.a thin layer of red hematite in.the region of the rupture in Unit 2 can be attributed to removal of any previous magnetite film during the expulsion of water / steam followed by inflow of moist air while the pipes were hot. Upstream and downstream of the rupture the pipes appeared to have retained a magnetite film. The appearance of the pipe in Unit I was considered to be more repre- sentative of the true condition of the inner surface of the feedwater system during plant operation, although most the suction line had been exposed to air for 24 to 48 hours before being insps:ted. However, this unit was shut down normally and the pipes drained at ambient temperature before the pipes were cut u Such conditions.are less conducive to conversion of magnetite to hematite. The most significant nbservation was that in Unit 1 the suction pipe tee with the header and the first elbow had a black coloration although extensive thinning had occurred. Conversely, downstream sections of , l the suction lines that experienced much less thinning had a thin layer of red, non passivating, hematite. b. Effect of Chemical Variables ' The role of chemistry control, especially before the original steam generators were replaced, is also not clear. The very large amounts of iron oxide sludge that has been periodically removed from all of the steam generators throughout the thirteen years of operation is proof ! that wastage was occurring. However, this oxide sludge is thought'to have originated predominantly in the high pressure pipes of the second- ary water system which have been subjected to both dry and moisture l laden steam. l ! l - - - - - - _ - - - , , _ _ _ _ , _ _ , , _ _ _ , _ , _ _ _ _ _ _ _

. .

Appendix 3 During the last four years the deposition of sludge in the steam generators had decreased considerably, a phenomenon that has been attributed to higher purity condensate and feedwater and to AVT chemistry control following the criteria of the Steam Generators Owners Group (SGOG). . Before 1980 several relatively brief periods of inleakage of James River water upset chemistry control and allowed ppe amounts of chloride to enter the secondary water system. Consequently, stress corrosion of carbon steel and inconel components of the steam generator occurred as well as denting of the inconel steam generator tubes through formation of magnetite in the tube / tube sheet regions. The effect of these transients on the general wastage of carbon steel pipe is not obvious. The licensee's tentative scenario stresses the capability of pure, deaerated water to attack carbon steel: ! ' Fe*+ Fe*+ + 2e- 2e- +2H+ + 20H" + H + 20H'_ 2 Fe* (solid) + 2H+ + 20H + Fe++ + 20H +H (gas) ~ - 2 The trace amount of Fe (OH)2 is continuously removed from the region of formation before it can be further converted (oxidized) to adhesive and passivating magnetite. (1) Effect of pH l It is the purpose of pH control, however to minimize this 1 mechanism of attack by reducing the concentration of hydrogen ions. During the first seven years of operation the licensee controlled pH with several chemicals; i.e., sodium phosphate, cyclohexamine, morpho 11ne, and ammonia, and the pH of the feed- water and condensate varied from less than 8 (conducive to general corrosion of iron) to greater tha,n 10 (not conducive to general corrosion of iron - although conducive to loss of copper from condense and feedwater tubes.) Since startup after the steam generator replacement outages the pH has been maintained between 8.8 and 9.2, as recommended by the SGOG, as a compromise range to minimize the corrosion of copper and iron in both the low and high pressure lines in the secondary system. (2) Effect of Dissolved Oxygen The licensee, as well as various investigators of corrosion mechanisms, considers very low concentrations of oxygen to be detrimental to control of generalized thinning of carbon steel. , 1 In steady state conditions diffusion of dxygen to the metal - water interface aids in the initial formation of magnetite and its continued replacement. Under such conditions redLcing agents are ' -- -- . - , . _ , - - - . . , , - - , - - - , , . - - - - - - - , - - - - - - - - - - - - - - - - - - - - - - - - - - - , - - - - - , - - - - - - - - - - - - - - - - - -

_ _ , - _ - .__ - , .. ' Appendix 4

harmful since they tend to reverse the formation of ferrous ton through the reactions written above. However, this argument must be balanced against the cathodic attack of oxygen on iron (if the iron surface is not isolated by impervious Fe 03 4 (magnetite). 8 In' a dynamic environment, such as in the feedwater pipe, all . equilibria are changed because of the high probability that the products of electrochemical reactions will be removed immediately. 3. Conclusions On the basis of current technology and the understanding of the mechanisms of localized corrosion, the damage experienced by the or'31nal steam generator tubes during the initial seven years of plant operation is understandable. However, the inspector has not been able to correlate the - cause of steam generator tube denting to the generalized thinning of the A feedwater suct, ion pipe. Also, the inspector has not been convinced that the feedwater system was ever coated completely with magnetite, or if it were, that the magnetite protected the pipe from erosion / corrosion. It is evident that thinning occurred in regions of hydraulic turbulence, and consequently erosion appears to have been the dominant cause of thinning. The degree to which generalized corrosion mechanisms abetted the transfer of

metallic or ionic iron from the pipe surface has not been established.

. . I

. . _ 1 , ! " g < ,n.- -- , , - - , , ,- ,,,r,_n.,,, ,,-n__-_ nn,- n.- -.,_,n ,n . , - - - , ,-n. , .n.,,--..n-.,-- --.,,.----n.- ,,,,.---,,.m--. , - _ , .

___.___ ____ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ ___ _ __ _ _ _ _ .. -- - _ ~ '

• ':

< . , . . ,

., , ;; -

.,e eemf

, , 1 ' . \\ . ' . / s

-

- g'__. - 4 , , , ^ f 1 . ? ~ < , Y , ~, ' e , _ ,-, . . g . a+s 7[ ' ' 1 ' % ' [ I - - , _7 . l - - , . 3,. g , , g . . l - : . ' , \\ . ' ' - .< . .o .v

. > ..., , , . < . , , ' . / i / . .. , .j p.- . , - , 3

. . w - ,. ' ' 'M /, ,'

, , ,_ , ,

. , ' ' ' 4 , . . ' ' i , ,

l i "B" "A" Location 24" Condensate l MFW Pump MFW Pump of Rupture Supply Header in "A" Suction Pipe . Figure 1

. _ - _ _ _ _ _ _ ._ _ _ _ _ _ _ . < l . t 77 7 . , - ' l- - - -

g

,. ..

. . <,3 / .e- . . <c ( . , ..

. y.: ',' y .1 -

l ._ T g ' -- ' i &* f- ~

s . l _ - -

~ . . 4 ! _. . % ' ? r > s - \\ ,. - ~'$ % ~ l} i > ~ . , , . . l ! . ' , ,, ,

• ' *

... - - f .,. l. i , e J _ summme- - M 'W!9 M ' , _ . , ', < . . - - . _ . . . "B" "A'" Location 24" Condensate MFW Pump MFW Pump of Rupture Supply Header in "A" Suction Pipe i Figure 1 _ _ _ . . - - - . . . . . -. . -__ . _ _ . . _ . - . . .

- - - - - - A - ' -- . - - - . - - - - . . . - , - - - - - . - - - ! = i nypw ?J - ' i . , l' .t , 4% 1 4

• m

&'.. . s.

• -Y1

.t

, .wK .. . , , ~g .- y ., , . 8 '/ 7 % s' jy - %g[pq m) 'ktJi [4 g' y ' :"*- Qf3;p* ' ' Wy' . 's ,1;

)

-, 3[, i - u %,1 - ,-7 ' ' ' ' . _,w %j {+, ' -; ( .. , < G;wikhiar&,W, m "x' ' w-am c.. - w:1" <. t 9*' (yOf+'f'( - , ' -

i occ ,, ?

, , , ~ . s . s f y ? - gpg+' - ,< . .;'

ye ;

< . I , -: av 4. - l 1 V . r . y~^ 'an - 1, j,,'U . , (;t ' t' : -a- / . '!

,

;n

$f.%; 'u ;.g gy ...

, ~. , . n < , .Yh yh'%k'i%.h i

,_. \\ '

n, - v .- s +

g

n - , ., '\\ ' . ' i n . gs

1. 3

-

s .\\ f4 3 2 , .a . -Q,L f . , 7. a ' , , \\.

• 3f

ci e '

s +m- ., y s , , ' . .] N' fj

<;,..e- N - . , . , , ' , f._ \\. - V !! f , 4 ~ , , _ , , , v

,

m - - < . l . y . -

- , < l - f \\ 'E,'< _ t. '_- ' - m . - ,, , &;* h f ff Q Q ',\\ .if?b b ' '; , ' q E O.tk p,?e ~' Aq,7 , 4uc p];q j& g^ 4 :, ,m,.$.W;f h ., "hkh IM '

s\\ . m - . Al . A- , wen,.c.e4In f '

2h ' -- -

- - - . _ _ _ _ _ _ . _ _ _ . O r> - NY;$%@ gv., y ,. 7 _ Y bj i%?Q * g ,; e y J;Jgg ty;,.. + ;; 4 g.g 7. t y9 O'"klR f '" , . .' !id ' ~. 4;l, ,. l

~- .. ,.;f:;, N s ,og ,

~

-- , y . , , , ~. e n t, f.I;q)?2'" . ;; 3 L t - a ':. . . ' . =y ~.5'

.jf s, g - . b y- . . , - .y . - OA'F ' '{, J. .,[[? N 'hNfI;f.; .t '; bl. }R j;;L , . 1' - ,7 1 .- ~

. yp;,g., - ', , .. i ~ , _ . - .. ,, - e [- ' - , ~ a !- - 7 . j m ,x e. ,. ~. } s,

.

• '

ia% ( $ f s f' h ' D .+; , i, ,, ?:

.

, % I . $ay ' , . ' ; Fl$ ,cg w ~ ' [ . . . _ , . 7 ep .: ~ v arg - .

- _ _ _ _ . _ . . . _ _ _ . _ _ . _ _. __ __ 1 e , l -e - em w- . . . . . l . , i 4. . _ 4 ' f ' , l .. ! s , 1 . g - . _ -t ~ ! ' . - ' , . . . . . i . - I ' '..

• -

l g\\ ~ Ruptured 'A" MFW Suction Pipe ( l' ' ,~ ' fiesting Against "B" MFW Pump

% Discharge Pipe. (Post Rupture

. 4 Configuration) ' ' . . -

e , . , 'e - i..' 4., .. ._ . & - ' . h,[ ,, ' ,

' , ~.

'

' e' <: . , , P ' / ,

% . . 1 . - = ' ' ' 4 .

. ~ - - . - . . > 1 . . -

' - , e .- ,

- . ' l 8 e. e. / - ,

g Y f , I l > , . ) M .- . l i l ' Figure 3 i ' I _. . ._ _ .--

a ...,m.,.-maa_ _-_a_.Au___.h._a__-2 _____m- a .a--_.-.,44 4_am___2,_____s. ma _ _ . .__ . _ _ _ _ _ _ . 4 .___..am .mam._ __ _,, m2,.m _ ,., . .l ' ,

, 9 .. , - , i . ! , ' - - . . !

. , , ,a %.-

.

. .. 3- / . - - . , l r .

. - - , .; . , , e "a ^ \\ - c . .. . W_ ?', ^

.

- , i - -- _ _. }}