ML20206B597

RWCU Sys Automatic Isolation & Safety Considerations

ML20206B597
Person / Time
Issue date:	03/31/1987
From:	Thomasson N NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
Shared Package
ML20206B554	List: ML20206B547 ML20206B555 ML20206B558 ML20206B576 ML20206B597
References
TASK-AE, TASK-E705 AEOD-E705, TAC-62757, TAC-62758, NUDOCS 8704090247
Download: ML20206B597 (35)

Text

~

> i I

1 y.. l

.l 1

L AEOD/E705 ENGIt'EERING EVALUATION PEPORT*

1 I

i RWCU SYSTEM AUTOMATIC ISOLATION AND SAFETY CONSIDERATIONS I -

1 March 1987 1

Prepared by: Neill Thomassen 1

d q

l Office for Analysis and Evaluation 4

of Operational Data i U.S. Nuclear Regulatory Commission 3

i

, *This report documents results of a study completed to date by the Office 1 for Analysis and Evaluation of Operational Data with regard to a particular operational situation. The findings and recommendations do not necessarily represent the position or requirements of the responsible program office nor the Nuclear Regulatory Commission.

4

' 8704090247 870327 NEXD PDR ORG

__________________j_____.

4

% ~

e TABLE OF CONTENTS 1

'I i

Page

SUMMARY

. . . . . . . . . . ... . . . . . . . . . . . . . ... . . . 1 INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2 DISCUSSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 f

Reactor Water Cleanup System Functions and Components . . . . . 4 Automatic Isolation Capability ................. 6 Regulatory Requirements Related to RWCU System Leakage .... 8 4

ANALYSIS OF OPEP.ATIONAL DATA . . . . . . . . . . . . . . . . . . . . 9 LER Data Base . . . . . . . . . . . . . . . . . . . . . . . . . 9 Analysis of Valid Isolation Events .............. 10 1

Flow-Related Isolation Events .............. 10 Temperature-Related Isolation Events . . . . . . . . . . . .

11 4 Analysis of Spurious Isolation Events . . . . . . . ... . . . . 17 Flow-Related Isolation Events .,............. 17 l Temperature-Related Isolation Events . . . . . . . . . . . 18

! Actions to Improve RWCU System Operations . . . . . . . . . . . 18

Flow-Pelated Design and Component Improvements . . . . . . 19 i Temperature-Pelated Design Improvements ......... 26 Personnel and Procedural-Related Improvements ...... 27 FINDINGS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 i

CONCLUSIONS ............................. 30 SUGGESTIONS ............................ 31 i

REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 1

AEOD ENGINEERING EVALUATION REPORT

• UNITS: ALL BWRs EE REPORT NO.: AEOD/E705 00CKET NOS.: Multiple DATE: March 31, 1987 LICENSEE: Fultiple EVALUATOR / CONTACT: N. Thomasson NSSS/AE: General Electric / Multiple EVENT DATE: Initiating Events: July 23, 1986, at Millstone 1 and August 1-4 at Dresden 2

SUBJECT:

RWCU SYSTEM AUTOMATIC ISOLATION AND SAFETY CONSIDERATIONS

SUMMARY

On July 23, 1986, Millstone 1 experienced a complete severance of a one-inch pipe to a reactor water cleanup (RWCU) system regenerative heat exchanger relief valve resulting in a 2,200-gallon discharge of ree.ctor coolant to the heat exchanger room sump. Other RWCU system integrity failures have occurred at Quad Cities 2, Vermont Yankee, and Dresden 2, with the most serious event at Dresden 2. Between August I and August 4, 1986, the Dresden 2 RWCU system developed a low-energy fluid leak of approximately 50 gallons-per-minute (gpm) from a filter-demineralizer unit train valve. The leak resulted in the accumulation of approximately i 140,000 gallons of reactor coolant in the reactor building basement torus

. room sump.

As a consequence of these events and numerous other events reported in Licensee Event Reports (LERs) involving primary containment isolation ^

system (PCIS) initiation, which automatically isolated the RWCU system, an engineering evaluation has been conducted to:

analyze the causes and actual consequences of the reported events; determine the corrective actions which already have been and might yet be taken to reduce the frequency of these events; determine the causes and safety consequences of the actual leaks that have occurred in the RWCU system; and review the RWCU leak detection and isolation capabilities in light of the safoty significance evaluation of the RKCU system leaks.

A data base of RWCU system isolation opr: rating experience was prepared from LERs and Daily Reports covering the period from January 1984 through September 1986. The data were analyzed in detail for the 10 units  ;

showing the highest incidence of RWCU system isolations. The analysis showed l

• This document supports ongoing AE0D and NRC activities and does.not

represent the position or requirements of the responsible NRC program office.

l

that although approximately 15% of all LERs reported RWCU system events, only 26% of the isolations were due to actual RWCU system operational problems. These included system leaks through pump seals and valve bonnets and a few small-diameter pipe and valve failures; internal leakage past component isolation valves, through resin strainer valves and other ball valves; high temperature conditions at the filter-demineralizer; and a number of high area temperature conditions due to ventilation system inadequacies. The large majority of isolations (i.e., 74%) were due to spurious actuations. These involved erroneous indications of high system flow and high area temperature, as well as operator error. The spurious high area temperature isolation events were ,

generally associated with surveillance testing of the leak detection '

system temperature detector modules.

A number of licensees have implemented design and procedural improver:ents to overcome the operational problems which cause RWCll system isolations.

Measures taken to eliminate sensed spurious flow perturbations include removal of air trapped in the system or sensing lines, relocation and resizing of flow neasurement orifices, incorporation of a time delay between an alarm condition and initiation of an isolation signal, and recalibration of flow measuring devices. The most beneficial change applied to reduce spurious isolations due to the temparature sensors involves the addition of noise suppressors and/or short time-delays to filter spurious electronic noise pulses. The LER data trends appear to support the conclusion that these design changes have been effective in reducing or eliminating the spurious automatic isolation problems.

An evaluation of the events shows that no significant safety problem is indicated by the operational data. However, because automatic isolation of the RWCU system involves actuation of an engineered safety feature, these are reportable events. Additionally, the investigation, repair, and cleanup activities associated with RWCU system problems (including spurious isolations) can res91 t in increased personnel exposure. Also, activities associated with thc *stigation and reporting of spurious events take resources away from ot m potentially more important activities.

This investigation may be useful in ongoing reviews of maintenance programs and new plant operating experience by industry organizations, such as INPO. For example, this report may help to characterize the desian improvements and procedural changes which can be implemented to reduce the frequency of spurious isolation events associated with the RWCU system. Additionally, it is suggested that AE0D reevaluate the LER reporting requirements for spurious isolation events associated with the RWCU system. Finally, it is suggested that NPR reevaluate the need for daily testing of the RVCU system leak detection system temperature monitors in view of the relatively high frequency of spurious isolation events initiated by such testing and the relatively low incidence of significant leakage events.

INTRODUCTION On @ly 23, 1986, Millstone 1 experienced a complete severance of a one-inch pipe to a reactor water cleanup (RUCU) system regenerative heat exchanger relief valve. The control room operator identified the break

.v 3 I based on a control room. indication of high ambient equipment room temperature and visual confinnation by another operator. During the 6-10 minutes reouired to locate and isolate the break, 2,200 gallons of high energy (i.e., high t temperature and pressure) reactor coolant was discharged outside primary containment into the heat exchanger room.

On August 7, 1986, another RWCU system leakage event at Dresden 2 was reported .

in a Daily Report. .This event involved an unidentified 50 gallon / minute-(gpm) leak of low energy reactor coolant for over 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. The leak was eventually identified to be from an RWCU system filter-demineralizer relief valve. The a leakage was first identified by excessive water accumulation in the reactor building basement torus room sump. During the same summer period, Quad Cities 2

experienced an RWCU system pipe leak, and Vermont Yankee had an RWCU system pump

seal failure. None of these events resulted in an automatic closure of the

. containment isolation valves between the RWCU system and the reactor coolant system pressure boundary.

In addition to these specific events, there have been numerous BWR events

. involving automatic isolation of the RWCU system caused by a signal from the leakage detection system (LDS). Some of these events were related to i system pressure boundary leakage (e.g., pump and valve seals); while j others were related to leakape internal to the presure boundary (i.e.,

i through leaking valves to the condenser or radwaste system); and many were related to actuations triggered by room temperature sensors. - A few newer plants (i.e., River Bend, LaSalle, Limerick, Fermi 2, and WNP 2) i have experienced numerous RFCU system isolation events caused by spurious

signals from the LDS sensors.

In view of the Dresden 2 and Fillstone 1 events and the elevated frecuency of LERs and NFC Daily Reports involving RWCU system isolations, a study was initiated to focus on the following areas to:

1. analyze the causes and actual consequences of the reported RWCU system events;

2. determine the corrective actions which already have been and might yet be taken to reduce the frequency of these events;-

~

3. determine the causes and safety consequences of the system

! pressure boundary leaks that have occurred in the RWCU system; and

! 4. review the RWCU leak detection and isolation capabilities in i light of the safety significance evaluation of the RWCU syster I leaks.

.The approach taken for the study was to identify reactor operating _ events related to the PWCU system that have been reported in LERs and recent NRC Daily Reports that might indicate safety implications, to identify tne l regulatory requirements applicable to the RWCU system, and to assess the i causes for and significance of actual leakage events warranting isolation )

and the causes for spurious isolations.

i l

- n . y-, e, ., ,-, .-.m.- -y,_. , , - , ,. ., ,. -_r , , , _ , , , ,, ,,-g,..-,,,-y,(

1

-4e l The first section which follows prese1ts a description of the RWCU system and its functions, with particular emphasis on automatic isolation arrangements of the system. hext, a brief discussion of regulatory requirements pertinent to the discussion, followed by an analysis of the operating data is presented in three parts: (1) valid isolation events, (2) spurious isolation events, and 1 (3)actionstakentoimproveRWCUsystemoperations. Each of these discussions is separated into subsections focussing on the system involved in the isolation function--flow or temperature sensors. Also, the section on operations improve-ment addresses personnel and procedural related improvements. Each principal section ends with a sumary statement regarding the perceived safety significance derived from the operating data.

DISCUSSION Reactor Water Cleanup System Functions and Components The PWCU system is classified as a power conversion subsystem and is designed to: (1) maintain the reactor coolant chemistry within technical specification limits; (2) conserve thermal energy during removal and return of reactor coolant to the pressure vessel; (2) remove excess reactor coolant during various operational phases; (4) serve, in part, as a reactor coolant system pressure boundary; and (5) provide a containment isolation function (since its piping penetratestheprimarycontainment)(Ref.1). Only the latter two functions are directly related to safety.

The major RWCU system equipment is located in the secondary containment building external to the primary containment. Because the system processes high energy and high activity coolant, the system components are in shielded, separated compartments or spaces, generally located in the lower elevations of the reactor building. The system is designed to standards established for safety-related systems (i.e., seismic Class 1 and Quality Standard A) up to the first nonregenerative heat exchanger, which is downstream of the outboard RWCU system suction line isolation valve. Each RWCU system equipment room or area has a floor drain and an equipment drain whose accumulations are routed to the dirty radwaste and the clean radwaste collection tanks in the radwaste system. Each area is ventilated by the reactor building heating, ventilation and air conditioning (HVAC) system whose discharge is through the radiation-monitored reactor building ventilation stack. The stack is automatically isolated by a high radiation signal.

The PWCU system is designed for continuous, controlled removal of reactor coolant ** (typically 180 gpm) from the reactor recirculation system piping. As shown in Figure 1, the inlet piping connects to both the reactor ccolant recirculation line and the bottom of the reactor vessel within the drywell. After passing through an inboard primary containment isolation valve and an outboard-isolation valve, the RWCU system suction flow is increased in pressure by redundant, parallel, motor driven, centrifugal pumps which discharge to the regenerative heat exchangers. From there the flow is routed to the nonregenerative heat

• • About 1% of the rated reactor coolant flow.

i I

e O

ISOLATION MAIN VALVES CLEANUP CLOSED RECIRCULATION REACTOR SYLDS PUMPS THERMAL PRESSURE REL8 r

- VESSEL

@ SUCTION REGENERATIVE g( g NON RECENER ATIVE FT j HEA8EECHANGER$ HEAT EXCHANGERS

\

M C FE COOLAN f FT KECIRCULATION LINE X * * - - e -

RSCCW p ,ig y pg LDS FLOW V V V '

V V DETECTORS CONTAINMENT FT _. - pgg FCV FT gEACTOR

" M WENT FEEDWATER e """ FE E

STRAINE R

,\ CLEANUP FILTE R

- D DEMIN e- n

.E VO UNIT A H

m W MAIN m a CONDENSER _ ',

rw FROM UNIT S HOLDING PUMPS I

WASTE COLLECTOR m a h. 70PMASE CLEANUP at SURGE TANK v ,

RG SEPARATOR

- - 04 I ( SACKWASH 9 PRECOAT PUMP RECElvtNG TANK K DETECTION SYSTEM (LDS)

OtFFERENTIAL FLOW TRANSMITTERS

%h a  %

PROVIDE t.4PUT TO SUMMING DEVICE THAT INITIATES ISOLATION SIGNAL 8 ADAPTED FROM HATCH NUCLE AR PLANT UNIT 2 FIGURE S ETS TO UNtf 9 (REF 25 FIGURE 1 SIMP:.dFIED SCHEMATIC OF REACTOR WATER CLEANUP SYSTEMA

. . . . . - , ,. - . .=.

t- j d

exchangers, and filter-demineralizer units. It is returned to the feedwater

. piping via the shell side of the regenerative heat exchanger.through a globe

valve and a check valve before entering the drywell. ;0nce inside the drywell the piping connects to the feedwater system.

The return line valving provided inside the drywell varies somewhat from plant to plant. In some plants there is only a check valve inside containment.~ In~  ;

others, a motor-operated or air-actuated valve ~is provided for remote opening or closure of the isolation valves. Also, for some BWRs with a Mark III containment, isolation valves are included on the return lines inside and outside the shield building that serves as a secondary containment enclosing-the drywell and wetwell (Refs.~ I and 3). At Perry and River Bend (and possibly other plants with a Mark III containment), the high energy portions of the RWCU system inlet suction piping between the drywell and the auxiliary building are enclosed in protective guard pipes.

PWCU system flows are sensed by differential pressure elements-located across flow orifices on the inlet line, condenser blowdown line, and radwaste letdown line. Poom and area temperature measurements are provided by ambient. tempera- '

ture sensors and thermoccuples within equipment areas and across roor-ventilation ducts (inlet / outlet).

Automatic Isolation Capability All BWRs are provided with an automatic isolation of the RKCU system to meet safety-related reouirements for primary containment isolation. The RWCU system inlet isolation valves are closed on signals.from the primary containment isolation system (PCIS), which are triggered by low reactor water level or actuation of the standby liquid control system (SLCS). Isolation valves on the RWCU system return line (where provided) are also automatically closed on PCIS signals. Where power operated valves are not provided, check valves are used to satisfy the primary containment isolation requirements. During a postulated accident, closure of these valves assures that (1). primary coolant pressure boundary is maintained and losses of' reactor coolant, including SLCS injected sodium pentaborate, is limited; and (2) the release of radioactivity from primary containment is li:nited.

~

All but seven of the oldest BWPs***, as shown in Tab 1E 1, have-some-additional automatic isolation capability actuated by the RWCU system leakage detection system (LDS). This additional automatic isolation-capability is not provided for a safety-related function, but does serve to limit RWCU system leakage of radioactive reactor coolant outside of containment. This in turn limits local contamination and high radiation and temperature environments in equipment areas. The LDS also isolates the RWCU and connected systems in the event of RWCU system leakage and i

! potentially abnormal operating conditions (especially high fluid.

temperature). For example, almost all BWPs rely on nonsafety-related j

• • • 0yster Creek, Dresden 2 and 3, Millstone 1, Monticello, and Quad Cities 1 and 2.

l

TABLE I REACTOR WATER CLEANilP SYSTEM LDS' ISOLATION SIGNALS Plant High System High System High Area High Differential Flow Differential Temperature Temperature Flow Oyster Creek No No No No Nine Mile Point 1 No No Yes No Dresden 2/3 No No No No .

Millstone Point 1 No No No No Monticello No No No No Quad Cities 1/2 No No No No Vermont Yankee No No Yes No Pilgrim Yes No Yes No Browns Ferry 1/2/3* No No Yes No i Peach Bottom 2/3 Yes No Yes No -4 Cooper Yes. No Yes- No a Duane Arnold No Yes Yes Yes Edwin I. Hatch 1/2 No Yes Yes Yes James A. FitzPatrick No* No Yes No Brunswick 1/2 No Yes Yes Yes LaSalle-1/2 No Yes -Yes- Yes-Grand' Gulf 1 No. Yes Yes 'Yes Susquehanna 1/2 _

Yes Yes Yes Yes Washington Nuclear Pwr. 2 No Yes Yes Yes Limerick I' No Yes Yes Yes Fermi 2 No Yes Yes Yes

'Shoreham No Yes Yes No River Bend No Yes Yes. Yes Perry 1 .

No Yes Yes .Yes Hope Creek No Yes Yes Yes-

• Automatic isolation is also provided by high sump water level in RWCU equipment areas a

,~ fluid temperature . sensors at the outlet of-the non-regenerative heat exchanger to provide actuation signals for the RWCU isolation in order to protect the filter-demineralizer units from excessive temperatures. Since LDS-actuated isolations involve the PCIS, they are classified as engineered safety feature i

. (ESF)actuations.

With the exception of FitzPatrick, plants ordered after Browns Ferry have . l l an RWCU system LDS that automatically closes the RWCU system inlet isolation '

valves based on a flow-related measurement (i.e., high total flow or high ,

differential flow between system inlet and outlets). In-addition, one earlier i ger.eration plant, Pilgrim, has a similar capability.. Beginning with the cuane Arnold plant, the high flow LDS was replaced by a high differential flow LDS that automatically closes the RWCU system inlet isolation valves. In addition, a more sensitive temperature-based LDS for smaller equipment leaks was added.

l The temperature-based LDS uses differential temperature sensors located across the room ventilation system's inlet and discharge ducts and room / area ambient temperature detectors. With the exception of FitzPatrick, all BWRs since Duane-Arnold are provided with a high differential flow LDS isolation capability.

Susquehanna 1 and 2 have automatic isolation by either a high flow or a high differential flow signal. Also, with two exceptions (FitzPatrick and Shoreham) all BWRs since Duane Arnold have a combination of area and differential tempera-ture sensors. In addition'to the LDS capability shown in Table 1, the Browns Ferry units also provide LDS isolation signals based on high floor drain temperature for areas containing components with high-energy fluids (Ref. 4).

The older plants which do not have LDS-based automatic isolation have local RWCU system pressure, temperature, and flow indication, as well as control room indication of RWCU system pressure and temperature and room temperature that provide a basis for manual isolation of the RWCU system.

e Most plants that have a differential flow rate LDS provide a time-delay (typically 45 seconds) between the initial sensing of a high flow imbalance and the initiation of the isolation signal. This delay provides time to adjust system operations to bring the imbalance below the trip setpoint. In a practical sense, the plants with LDS automatic isolations are " leakage limited."

For example, the maximum leakage would be limited to the 45-second period i

before the differential flow rate sensors would terminate hioher levels of leakage (i.e., greater than 50 to 75 gpm). Further, the temperature-based LDS is generally designed based on an assumed leakage equivalent to the allowable

~

leakage inside containment as established in the technical specifications.

That is, with excessive leakage the sensors would initiate isolation based on

a given temperature change calculated to occur within the equipment area over' a set time period.

1 Regulatory Requirements Pelated to RWCU System Leakage l l

There are no explicit leakage limits established in plant technical specifica- '

tions for the RWCU system. The only leakage limits are for identified and unidentified leakage from the reactor coolant system within primary containment.

Similarly, the BWR Standard Technical Specifications (Ref. 5) and Regulatory Guide 1.45 (Ref. 6) only provide limits for leakage of coolant past the reactor coolant pressure boundary inside primary containment. Thus, the. leakage limits 1

I

i l

.,. - -.,-.--.--D

are not strictly applicable to RWCU systen leakage in a regulatory sense. As long as'the reactor coolant makeup system (feedwater system) can compensate for losses from the RWCU system, the primary limitation en reactor operation with RWCU system leakage is whether coolant chemistry can be maintained within technical specification limits.

For the more recent plants, technical. specifications have been developed regarding the sensitivity of LDS differential flow rate and LDS temperature instrumentation and related surveillance testing. For example, Hatch, Susquehanna, Limerick, LaSalle and Grand Gulf have technical specifications for isolation actuation instrumentation similar to those in BWR Standarti Technical Specifications Section 3/4.3.2 (Ref. 7). Such requirements in effect limit leakage by establishing LDS instrument trip setpoints.

As a consequence of concerns for' bypass leakage of highly radioactive fluids past the primary containment boundary following a potential core damage or core-melt accident, requirements were imposed by TMI Action Plan Item III.D.1.1 (Ref. S) to identify and reduce primary coolant leakage outside of centainmer.t.

This is covered, for example, in the Administrative Controls Section (6.8.4) of

the BWR Standard Technical Specifications (Ref. 5). Finally,10 CFR Part 50.73 specifies the LER reporting requirenents, including ESF actuations, that have resulted in reporting of RWCU system isolations (Ref. 9).

Safety-related considerations associa;od with the RWCU systen are addressed in Section 5.4.8 of the Standard Review Han (Ref.10). The regulatory review addresses safety concerns related to RWCU system pipe rupture, jet impingement, adverse environments, flooding, and containment isolation. These areas of concern are reflected in the plant-specific final safety analysis reports and other special f;PC safety initiatives, such as those regarding the design adequacy of older plants (e.g., under the Systematic Evaluation Program).

ANALYSIS OF OPERATIONAL DATA 1ER Data Base The LER data base for events which occurred during the period from January 1984 through September 1986 served as the principal source of information for this study. Other information on events involving the RWCU system leakage was obtained from t;RC Daily Reports. A total of 270 LEPs documrinting 302 isolation events associated with the RWCU system were found and reviewed. The reviews were conducted to identify the significant factors related to RWCU system component failures and problems, particularly from those reports involving actuation of the PCIS.

As of June 1986, 34 BWRs with a General Electric NSSS were licensed to operate at 25 sites. Six of the oldest plants involving a total of 10 units reported no RWCU system related events, and three others had on13 one or two LERs. Four of the plants that submitted no RWCU system-related LERs had significant system leakage events during July or August 1986. However, these events did not meet the reporting threshold because no ESFs were actuated. The events were briefly

1 l

addressed in the Daily. Reports; however,10 of the remaining 24 other units submitted 20% of the LERs that involved either a valid isolation (events with actual high system flow and/or high area temperature conditions) or spurious isolations of the RWCU system. Each of these units contributed at least 10 LERs with an aggregate total of 217 out of a total of 270 LERs. The RWCU system-related events represent on average approximately 15% of all of the LERs subnitted by these 10 plants during the period encompassed by the study. The RWCU system operating experience at these 10 units was the focus of the detailed data analysis of this study.

The events documented in the LERs for the 10 plants were separated into two groups. The first grouping relates to those events involving valid isolation signals. The second grouping involves spurious isolation events. The valid isolation events are events that resulted in an RKCU system LDS-monitored parameter (flow, differential flow rate, temperature, or differential tempera-ture) setpoint actually being exceeded because of some type of equipment problem.

As discussed below, equipment problems were associated with either system boundary integrity, internal valve leakage or actual high temperature conditions.

Leakape events were categorized as " external" for leaks that were through the pressure boundary of the RWCU system, or " internal" for leaks past valve seats or to another closed component or system (e.g., the radwaste phase separator or equipment drain tank).

In spurious isolation events the monitored temperature parameter did not actually exceed the LDS setpoint as a result of RWCU system operation, and the monitored differential flow rate (or total flow) parameter only exceeded the setpoint because of lack of density-compensated flow measurement or false high flow indication, e.g., when the flow element became uncovered or when coolant flashed in the blowdown line to the condenser when condenser vacuum increased.

The LER data vere analyzed as a function of the LDS subsystem (i.e., flow or temperature) that initiated the RWCU system isolation and the causative factors associated with each event. Causative factors included equipment malfunctions, design defects, personnel error (during maintenance, testing, or RWCU system or plant operational mode changes), and procedural deficiencies.

Many LERs documented multiple factors that contributed to the reported event.

Analysis of Valid Isolation Events As indicated above, valid isolation events involved situations in which LDS flow-based monitors (i.e., those measuring total flow or differential flow rate) detected an actual high flow or high differential flow rate, or temperature sensors in the RWCU system or its equipment areas detected high temperature. Slightly over half of all isolation events were initiated by high differential flow rate sensors. The rest were initiated by temperature sensors. Twe.nty-six percent of all isolation events were found to be valid.

The rest, or 74%, were spurious (i.e., invalid). .

Flow-Related Isolation Events Thirty percent of the flow-based isolation l events were'related to actual system leakage. About half of these were associated with RWCU system external leakage and the rest were associated with internal leakages. Generally, the internal leaks were related to valve problems 1

- or personnel errors iri realigning system components. The primary contributors to valid isolation events associated with RWCU system external leakage (i.e.,

leakage.into a room) were caused by pump seal failures and relief valve problems on the heat exchangers. Other external system leaks which resulted.in automatic isolation involved an instrument-line weld . failure on the filter-demineralizer outlet orifice;-a gasket failure on the filter-demineralizer tank head; and a failure of a filter-demineralizer valve to close.-

l Themagnitude(whereknown)oftheleakageevents,reportedintheLERsand Daily Reports, is provided in Table 2. For the period studied, the most significant known leakage events occurred at Millstone 1 and Dresden 2. The Dresden 2 event resulted in a total release of about 140,000 gallons of-low-energy coolant that accumulated in the reactor building baseirent torus room. The Millstone 1 event resulted in the release of 2,200 gallons of high-energy fluid through a ruptured heat exchanger relief. valve pipe connection. None of the other external leaks reported a significant quantity of fluid release.

The most common internal leakage was associated with valves. Comonly,-

ball valves, such as the flow control valve (FCV), were involved in these events. In some cases the ball of the valve was overrotated so that the valve remained partially open when it appeared to be closed. Other valve leaks that were a recurrent cause of high system flow involve the resin strainer drain valve (adaptor-plate' defects and ball mispositioning); and the filter-demineralizer backwash air supply valve (seat leakage).

However, these problems have been limited to a few plants, with 12 of the 14 related valid isolation events at Hatch and LaSalle.

A number of flow-based isolation events involved RWCU system flow rate imbalances between the system inlet and return flows frorr and to the reactor and/or excessive letdown flow to the condenser and the radwaste system. In many plants, the main control room front panel only indicates the flow rate of coolant returning to the reactor; the differential flow rate meter is often on a "back panel" in the control room. Thus, the

differential flow rate indication is not routinely utilized as flow imbalances are ad,iusted.

Temperature-Felated Isolation Events Isolation events which were initiated by the temperature-based LDS occurred as a result of measurement of high area temperature or high differential temperature across area ventilation system inlet and outlet ducts, or by high temperature in the RWCU system at the filter-demineralizer. Only 24% of the temperature-based isolations occurred as a result of a valid measurement of high temperature. These system isolations were caused by: (1) external system leaks resulting in high area tmperature, (2) high fluid temperatures sensed at the filter-demineralizers, anc (3) high area temperature caused by environmental conditions unrelated to RWCU system operation. The majority of the temperature-related isolations were associated with either inadequate area ventilation system design or systems-interactions which systems occurred (serving when the RWCU the reactor equipmentbuilding) ventilation area were or component taken out cooling of service. The latter water also was a causative factor in system fluid temperatures increasing sufficiently to initiate automatic isolation to protect the filter-demineralizers. Another cause for this type of isolation event was when the return flow to the reactor l

l

- .. - - - , - - - - - - - -, - _. , - , .. _._-r , , , - - , , - - _

TABLE 2 IDENTIFIED VALID RWCU SYSTEM LEAKAGE EVENTS -- ALL PLANTS Plant Licensee Typq of Proximate Cause Identified in Report Underlying Flow Rate Event Report Leakage

• Cause** or Quantity Grand Gulf 50-416 85-019 Internal Filter-demineralizer (F/0) strainer H Unspecified flush valve left open Duane Arnold 50-331 86-006 External F/D tank head flexigasket leak E Gross leak Duane Arnold 50-331 86-004 External Regenerative heat exchanger (RHx) vent E Minor steam drain line globe valve packing leak Limerick 1 50-352 65-082 Internal Pump flow control valve malfunction E Unspecified Limerick 1 50-352 85-072.01 External F/D outlet valve failed to close-- E Unspecified seals in two flow glasses ruptured Limerick 1 50-352 86-040 External Pressure relief valve opened E Unspecified Fermi 2 50-341 85-032 Internal Containment isolation valve (suction H Unspecified valve) left open I

Fermi 2 50-341 85-050 External Isolation valve leak at telltale E 1-2 cups / min. -

in containment ' }'

River Bend 50-458 85-059 Internal Air operated valve seat leakage to E 10-15 gpm backwash receiver tank Dresden 2 Daily Repnrt External F/D train valve packing failure E- 50 gpm 140,000 gallons Quad Cities 2 Daily Report External Weld failure E Small Vermont Yankee Daily Report External Sump seal failed E Unspecified Millstone Pt. 1 Daily Report External RHx vent valve one inch line severed E 2,200 gallons Nine Mile 1 50-220 85-012 External NonRHx one inch vent valve leak E Unspecified from the gland seal

" External leaks are those beyond the pressure boundary of the RWCU system to the equipment area; Internal leaks are those either through open valves within the system piping or to other closed systems such as the radwaste system vis closed piping.

• • Human factor caused--H; or equipment failure caused--E 1

-- . 6 --- -

TABLE 2 (Centinuzd) .

IDENTIFIED VALID RWCU SYSTEM LEAKAGE EVENTS -- ALL PLANTS ,

! Plant Licensee Type pf Proximate Cause Identified in Report; Underlying

'- Flow Rate Event Report Leakage

• Cause** or Quentity Cooper 50-298 85-018 External Pump seal retaining ring sleeve H- Unspecified slipped causing seal failure--

installation error Cooper 50-298 86-004 ' Internal F/D bypass valve leak E Unspecified Brunswick 1 50-325 85-004 External Leak near temperature detector E Minor steam Brunswick 2 50-324 85-007 External F/D outlet orifice pressure sensing E Unspecified 4

weld failed Susquehanna 2 50-386 85-032-01 External Flow control valve leak caused relief _ E. 20 gallons valve to lift--two spills 5 gallons l' Hatch 1 '50-321 85-001 External RHx relief valve leak E Unspecified Hatch 1 50-321 85-019 External Pump shaft seal, inboard isolation E Unspecified '

valve, and pump vent valve leaks [;.

Hatch 1 50-321 85-022 External RHx drain valve leak at stem gland seal E Unspecified Hatch 1 50-321 85-031 External Pump seal blew out E Unspecified Hatch.1 50-321 86-028-01 External RHx equipment drain steam leak E ' Steam Hatch 2 50-366 84-007 External Pump seal leak Unspecified E.

Hatch 2 50-366 84-031 External Pump shaft seal and two pump vent E Unspecified valves leaked i Hatch 2 50-366 84-032 Internal 8ackwash air supply isolation valve ' E- Unspecified i seat leak.

, Hatch 2 50-366 85-020-01 Internal. Incorrectly slotted adapter plate H/E Unspecified i

'in resin strainer drain ball valve caused improper valve position i

4 TABLE 2 (Centinu:d)

IDENTIFIED VALID RWCU SYSTEH LEAKAGE EVENTS -- ALL PLANTS +

Plant Licensee Type of Proxigate Cause Identified in Report Underlying Flow Rate Event Report Leakage

• Cause** or Quantity Hatch 2 50-36Q 85-033 Internal Incorrectly slotted adapter plate H/E ' Unspecified on resin strainer drain ball valve Hatch 2 50-366 86-002-01 Internal Resin strainer drain valve leaked; H/E Unspecified failed to close downstream drain valve.

Scratches on ball valve seat i Hatch 2 50-366 86-005-01 internal Resin trap valve failed open; air E Unspecified j vent inlet line series valves stems

, bent preventing closure Hatch 2 50-366 86-018 Internal (Possible) partially open flow control H Unspecified ball valve LaSalle 1 50-373 84-b23-01 External RHx shell side relief valve stuck E Unspecified open discharging to equipment drain LaSalle 1 50-373'84 032-01 , External Hx vent line discharge to building vent H Unspecified .

drain during Hx filling and venting **

i LaSelle 1 50-373 84-043-01 Internal F/D drained because of improper ball H Unspecified valve positioning LaSalle 1 50-373 84-045-01 Internal F/D drained during precoat because of H Unspecified improper positioning of ball valves LaSalle 1 50-373 84-046 Internal F/D filler drain valve to phase H Unspecified.

separator partially open-LaSalle 1 50-373 84-047 External.-Open plenum vent. valve from the precoat H Unspecified i

tank allowed discharge to floor following precoat cycle LaSalle 1 50-373 84-050 _ Internal Two manual. valves on chemical cleaning H Unspecified drain line out of position allowing discharge to radwaste system 4

i TABLE 2 (C@ntinued)

! IDENTIFIED VALID RWCU SYSTEM LEAKAGE EVENTS -- ALL PLANTS l ,

Plant Licensee Type of Proximate Cause Identified in Report Underlying Flow Rate-

, Event Report Leakage

• Cause** or Quantity LaSa 1e 1 50-373 84-053 Internal Vent valves leaked to radwaste phase E. Unspecified

, separator and manual valve leaked LaSalle 2 50-374 84-013 External RHx shell side relief valve stuck E. Unspecified open allowing discharge to equipment drain tank '

LaSalle 2 50-374 84-021-01 Internal Valve failed open in instrument air E Unspecified line allowing readmission of water to post strainer and radwaste system LaSalle 2 50-374 84-023 External RHx safety relief valve lifted; E Unspecified damaging itself, preventing closir.g LaSalle 2 50-374 84-036 Internal F/D isolation valve seat leakage to E. Unspecified chemical cleaning drain during precoat Internal Resin transfer valve operator damaged - [.

LaSalle 2 50-374 .84-037 E. Unspecified causing leak to chemical waste collection 'n tank 8 LaSalle 2 50-374 84-044-01 External RHx relief valve lifted during reactor. E- Unspecified startup; vented to reactor building drain tank LaSalle 2 50-374 84-061 External RHx relief valve on shell side lifted E Unspecified twice LaSalle 2 50-374 84-066 External Fill hose for Hx ruptured after unit H Unspecified mistakenly deisolated with Hx at reactor pressure and temperature -

l

TABLE 2 (Ccntinuid)

IDENTIFIED VALID RWCU SYSTEM LEAKAGE EVENTS -- ALL PLANTS Plant Licensee Type of Proximate Cause Identified in Report Underlying . Flow Rate .

Event Report Leakage

• Cause** or Quantity

LaSalle 2 50-374 85-036 Internal F/D stop valve missing stop pins E Unspecified i caused inaccurate position indication allowing flow to phase separator LaSalle 2 50-374 86-006 Internal Post strainer blowdown valves E Unspecified mispositioned when valve position stops broken; vent valve motor failed when torque switch failed op,en r

I m

E j

.i s

.,w

_ 17 was inadeouate to cool the inlet coolant flow to the regenerative heat exchanger.

Also, plants in southern states have frequently experienced high room tempera- i tures and isolation events during summer months because of inadequate room  !

cooling (Ref. 11).

hone of the valid isolation events involving the LDS flow rate or temperature I sensors actually involved significant adverse environmental conditions. No l safety-related equipment degradations were reported.and no environmental condi- l tions were reported which had the potential to affect safety-related equipment.

This is because most leaks were fairly small (i.e., a few gpm). Most personnel radiation exposures were also small. These were associated with time spent verifying the existance of an actual leak. When there were actual external leaks, some additional low-level occupational exposures were associated with repair and decontamination activities. The most noteworthy incident involving radiation exposures occurred at Susquehanna where some workers were contaminated slightly with a mixture of water and demineralizer resin (Ref.12).

Analysis of Spurious Isolation Events Spurious isolation events accounted for 74% of all PWCU system isolation events. Of these, slightly more than one-half were associated with the flow-based LDS. The rest were initiated by the temperature-based LDS.

Forty-two percent of these spurious isolation events were associated with RWCU system operation and reactor operating mode changes. Another 40%

occurred during surveillance testing. The balance of these spurious isolation events were largely related to RWCU system component failures.

Twenty-six percent of the spurious isolation events showed evidence of inadequate procedures. In some cases, the procedure was not sufficiently detailed, gave inadequate warning, or failed to recognize the potential for systems interactions, e.9., during shutdown of or as a consequence of the shutdown of the normal area ventilation or cooling water systems, area or differential temperatures increased to the LDS temperature sensor setpoint.

Flow-Related Isolation Events An apparent erroneous indication of high differential flow rate, as opposed to actual high differential flow rate or high flow, was the dominant factor associated with flow-based spurious isolation events. Approximately 70% of all flow-based LDS isolations were the result of spurious causes. The dominant causes for erroneous density indication were related to lack of coolant density compensation of sensors and entrained air.

These are discussed below in more detail.

A false indication of high differential flow rate has been caused by the coolant density difference between the hot incoming fluid and the cool fluid exiting the system in switching from the recirculation to the blowdown mode of operation or vice versa. This is a result of a lack of. temperature compensation in the flow rate measurement. During periods of reactor startup or shutdown the RWCU i system processes large volumes of relatively low-energy reactor coolant and discharges the coolant to the main condenser under such conditions the density of the coolant entering the system is higher in the blowdown mode of operation than during the recirculation mode when the reactor is at power operation and the reactor-coolant is at higher temperature. The density differences between

blowdown and recirculation modes can equate to an apparent 37 gpm flow rate change. This is si of 55 gpm (Pef.13)gnificant or where awhen normalthesetpoint LDS trip point of 70 gpmisimbalance set at a flow imbalance can.be narrowed to 23 gpm by density differences (Ref. 14). Since the RWCU system LDS is generally calibrated in a conservative manner, i.e., for the recircula-tion mode of operation at reactor operating conditions,.the differential flow rate margin between the inlet and blowdown flows is reduced-substantially.

resulting in a high sensitivity of the LDS to any system flow rate changes.

l .

Another significant group of flow-based spurious isolations was related to

inadvertent introduction of air into the process components or instrument sensing lines during maintenance or system operations. Air can be admitted to the RWCU system when rotating the filter-demineralizer in and out of the-flow path for regeneration or during maintenance of instrumentation lines. Such.

events frequently compound the flow rate measurement problems. If air is intro-duced, it is easily compressed (e.g., by the surge of coolant filling the

filter-demineralizer). Since the differential flow rate is based on measurement of system pressure drop across critical flow orifices, increased pressure differential translates into increased flow rate. Thirteen percent of the flow-based spurious isolation events involved air being introduced into the RWCU system.

s Temperature-Related Isolation Events The preponderance of the temperature-related spurious isolation events was associated with the LDS temoerature-sensor module design and with surveillance testing of the

, temperature modules. Nearly all the wurious isolation events caused by the ambient area or the differentia: temperature detectors have been associated with daily surveillance tests of the Riley-Panalarm temperature detectors (Panalarm Model 86), which are utilized in most of these systems. Thirty-eight-percent of the temperature-based spurious isolations were LDS temperature module design-related; 36% were attributable'to signals generated during changes in the temperature monitor switch position during surveillance testing, while 27% were attributable to electrical problems. For example, a number of plants have experienced repeated problems of accessibility to instrumentation cabinets for the temperature monitor relays during surveillance testing.

Over half of the reported spurious isolation events related to electrical .,

problems were caused by the location of the tenninals in cabinets. '

These events resulted in grounding when leads were lifted or were caused 1 by improper use of jumpers. The other electrical problems resulted from blown fuses and loss of electrical power to components. 1 None of these spurious isolation events had any safety significance other l

than the unnecessary actuation of the PCIS associated with the RWCU system isolation valves' function. However, there is some additional personnel i

~

radiation exposure associated with every spurious RWCU system isolation event since the cause of the event and the occurrence of an actual system leak is normally confirmed by visual observation in the RWCU system l

equipment area, which is a high radiation zone.

l Actions to Improve RWCU System Operations Most licensees have taken steps to remedy recurrent RWCU system isolation problems, including those associated with design and manufacturing defects, personnel errors, surveillance testing, and procedural deficiencies. The RWCU l

\

- - . - _ - - - . - - ~ - .- -- ,- -- - _ - . - - . . . -

s system operational experiences reported in many LERs together with the hardware and procedural modifications made by a number of utilities provide important insights for reducing the RWCU system-caused isolations. The most significant hardware changes proposed or implemented are summarized in Table 3 and the specific areas in which procedures were identified to have been improved are given in Table 4. Some of these modifications are discussed below.

Flow-Related Design and Component Improvements As indicated earlier, the RWCU system is particularly vulnerable to spurious actuations related to expected flow changes or density variations. Various utilities have identified design improvements to overcome some of the problems. However, the focus of each licensee on the root causes and the appropriate corrective actions varies considerably. System isolation events have often been attributed by licensees to " inherent characteristics" of the design and operation of the RWCU system, without further root cause analysis. At least 18% of all automatic isolation events of the RWCU system appear to be attributable to design deficiencies that resulted in sensing of high differential flow rate. About 16% of the isolation events involved RWCU system component failures, such as valve leakage and pump seals.

There appear to be a few significant measures for reducing the frequency of spurious PCIS actuation. One design change implemented to address the problem of spurious isolations caused by high differential flow rate measurement resized the blowdown flow orifice. Another change relocated the orifice to assure that the flow element remained fully submerged under all operating conditions, including those created by changes in condenser backpressure.

These changes eliminate flow rate measurement perturbations associated with condenser vacuum changes or conditions allowing two-phase mixtures (created when hot liquid flashes to steam whenever the backpressure is reduced). Other related design changes included modifying the isolation trip logic and annunci-ator circuits to provide an alarm when the 45-secorid time delay initiates, rather than having an alarm coincicent with the isolation signal. Another change relocated the differential flow-rate meter to a control room front panel from a back panel.

A change has also been suggested to modify the calibration parameters of the flow sensors to provide temperature compensation to reflect fluid density changes during different modes of operation (Ref. 15). The most elaborate proposed design in this regard is to add a capability for two calibrations and trip setpoints; one setpoint for each of the primary modes of system operation (Ref. 15). Also, some plants have proposed modifications to the instrumentation so that the instrument lines and locations are not at the high points of the system. This change would eliminate the opportunity for entrained air to accumulate and affect instrument readings (Refs.16 and 17).

Plant-unique equipment design or installation problems have also been reported.

For example, Hatch reported that the slotted plates of the resin strainer drain 1 valves were actually oriented 90 degrees off from that specified by the design '

and that excessive friction between the operator plate and the adaptor prevented proper valve operation (Pef. 18). These kinds of deficiencies caused numerous internal system leaks and high differential flow rate isolation events. Similarly, the various ball valves used in the RWCU system have been shown to be a source l

., _ . _ _ - .- . ..__l

Table ' 3 RWCU System Design Improvements Identified in LERs l

Plant LER Design Change-Flow Related l River Bend 85-024-01 Blowdown differential flow orifice redesigned to eliminate unstable flow indication caused by flashing of the coolant. Orifice resized to increase the back pressure on the flow element to above saturation pressure. Size changed from 250 gpm to 100 gpm. Calibration setpoint for differential flow sensor increased from 18 to 40 gpm by recalibration for shutdown condi-tions rather than reactor operating conditions.

Fermi-2 85-046 Blowdown differential flow element location downstream of the blowdown flow restricting orifice and flow control valve is sensitive to variations in the condenser backpressure, e.g.,

a 40 gpm flow perturbation can be induced by a 5 in water column pressure change at the low pressure tap. The bases for the calibration were also being reevaluated.

LaSalle-2 84-093 Recalibrate flow elements to reflect mass flow rates to allow for volumetric flow changes dur-ing reactor startup/ shutdown and steady state recirculation operating modes. Alternatives for improving calibration include revising monitoring system to provide fluid temperature input as well as pressure or to replace the single alarm point flow switch to a dual alarm to address startup/ shutdown and steady state recirculation conditions. For the latter change, the operative setpoint would be controlled by the position of the valves on the condenser blowdown, waste surge tank and/or the feedwater return lines.

Perry-1 86-039 Replace flow control valves and add electronic dampening for the leak detection flow summer 4 module to eliminate turbulent flow at the blow-down flow element and to keep the flow element immersed in coolant.

WNP-2 84-072-02 Redesign the differential flow annunciator Fermi-2 85-061 circuit to provide an alarm at the initiation of the 45-second delay timer for the isolation logic rather than coincident with the isolation signal, l Shorehan 86-032 Relocate the differential flew indicator to the front control panel from a rear panel.

Table 3 (Continued)

Plant LER Design Change-Flow Related WNP-2 85-060 Relocate flow instruments from RWCU system high points to lower levels to eliminate air entrap-ment in the sensing lines during operation at reduced pressure.

Brunswick-1/2 83-066-036-1 Modify the differential flow transmitter sensing lines to eliminate air entrapment at high points when the system is operated at reduced pressure.

Susquehanna-1/2 85-032-01 Provide for double isolation between the high and low pressure piping by modifying the filter /

demineralizer valve control sequence, thus pro-viding increased protection during the backwash and precoat cycles.

Hatch-2 85-020-01 Resin strainer drain valves redesigned to cor-rect a manufacturing defect in which the adapter j plate (used as a local valve position indicator) was incorrectly slotted 90 out of proper orientation causing the_ position indicator to show the valve to be closed when it was open.

Also, excessive friction between the operator  :

plate and the adapter plate of the ball valve caused the valve stem to overtravel giving an improper position indication.

Hatch-2 85-020-01 Ball valves in resin trap system redesigned to l

86-018 provide a reliable position indication since l as installed valves rotate 360 and can overrun the closed position.

LaSalle-1 84-043-01 Redesign ball valves to make determination of their position certain.

LaSalle-2 85-036 Redesigned manual, remotely operated valves to add position stops for filter /demineralizer s outlet isolation valves, i

Duane Arnold 85-023 LDS temperature sensor trip logic redesigned Fermi-2 85-025-01 to filter out electronic noise pulses by adding a 1-second delay.

River Bend 85-031 Temperature monitor switches redesigned by adding a surge suppressor to eliminate the need to place the switch in " bypass" for surveillance testing.

Table 3 (Continued)

Plant LER Design Change-Flow Related River Bend 85-051 Temperature modules modified by installing a resistor as a voltage spike suppressor in the switch circuit and bypass switches were added. Some modules modified by replacing 16 AWG wire with thermocouple wire.

Grand Gulf 85-022-02 Wiring for temperature monitor thermocouples was modified to eliminate improper commongrounds and inadequate insulation on extension wires which were in contact with the conduit.

River Bend 86-010 Differential temperature switch bypass was modified to eliminate the need to install jumper cables when conducting monthly surveillance tests and adjacent-control panel chassis were insulated.

Limerick-1 85-010 Instrumentation panels were modified to provide easier access for surveillance testing.

Perry-1 86-027 Test switches were installed to eliminate the need to lift wire leads during surveillance tests.

LaSalle-2 84-006 Pump room ventilation and temperature sensor

, location were redesigned to improve flow balance and remove the sensors from the direct influence of heat sources and cooling air. . Air blast shields were added to the sensors.

Limerick-1 85-068 Temperature switch in the heat exchanger room was relocated to remove it from close proximity to the heat exchangers.

l l

l l

Table 4 PWCU System Procedural Changes Suggested in LERs Plant LER Procedural Change-Flow Related Hatch-2 86-018 The resin trap and piping is to be filled and vented following filter /demineralizer (F/D) .

precoating and before the F/D is placed back into service.

LaSalle-1 85-013 The depleted F/D is to be placed on hold and isolated prior to deisolating the regenerated F/D.

Susquehanna-2 85-024 The precoat tank is to be removed from the recirculation path while the resin slurry samples are taken to reduce air entrapment.

Limerick-1 85-072-01 The upstream isolation valves of each F/D are to be closed prior to repressurizing the regenerated unit in order to eliminate flow surges at the blowdown sensors.

LaSalle-1 84-032-01 The standby heat exchange inlet valves are to be 84-08-01 left open during operation of the other heat exchanger train in order to relieve temperature and pressure induced stresses.

Limerick-1 85-068 The blowdown dumpflow to the condenser is to be limited to periods when the F/D are unavail-able, thus ensuring that when the F/D are available there will be adequate return flow to the reactor to cool the regenerative heat exchangers.

Monitoring of the heat exchanger room tempera-ture is to be done whenever heat exchangers are put into service. ,

Cooper 86-004 The reactor pressure level is to be controlled l carefully when placing the RWCU system into service during operating mode change, i.e.,

during cooldown, in order to maintain the required net positive suction head on the RWCU system pumps.

Cooper 85-019 The normal position for the reactor equipment cooling water valve is to be "open" in order to assure cooling water for the nonregenerative l heat exchangers.

l l

I l

l 1

Table 4 (Continued)

Plant LER Procedural Change-Flow Related Cooper 85-018 Installation of the retaining ring on the RWCU system pump' shaft seal is to be done in a manner-to ensure adeouate preloading on the rotating face of the ring.

Hope Creek 86-050 The power ascension procedure was revised to instill greater control as the RWCU system temperature and flow limits are approached in transitions from blowdown to recirculation modes of operation; thus assuring adequate cooling of the regenerative heat exchangers.

Perry-1 86-039 The differential flow reset is to be used during RWCU system startup. A one-inch bypass line is to be used to increase system back pressure to keep the blowdown flow element covered during valve realignments associated with the blowdown mode of operation.

Limerick-1 85-064 The piping between the RHR isolation valves is to be filled and vented following local leak rate testing before the valves are reopened to eliminate cavitation of RWCU pumps.

Grand Gulf 85-022-02 All RWCU system flush valves are to be verified closed before placing the F/D into service.

A caution is to be provided to operate only one RWCU system suction pump if the reactor pressure is-less than 100 psig to avoid loss of suction pressure on both pumps.

Shoreham 86-032 The differential flow rate instruments are to be used in adjusting the_ system flows.

LaSalle-1 84-043-01 Instructions for determining the closed position of ball valves following F/D regeneration were added.

Limerick-1 86-040 The RWCU system room temperatures are to be monitored when the Reactor Enclosure Building (REB) HVAC is shut down and a caution is to be added to the REB HVAC shutdown procedure l

concerning the potential effects on the RWCU l system operation.

l l Limerick-1 85-010 The isolation valves are to be deenergized during surveillance tests of differential temperature modules to avoid use of jumper cables.

i

. I s'

~

Table 4 (Continued)

Plant LER Procedural Change-Flow Related Grand Gulf 85-022-02 The temperature trip logic is to be bypassed i when reading the. individual differential l temperature switches to avoid isolations when changing the switch position.

River Bend 85-051 Riley temperature switches are to be placed in

" Bypass" before activating the " read" switch.

f I

. 26 -

of internal leaks since they can be rotated 360 degrees and lack'a velve stop.

Such valves have been modified at some plants by installing stops to eliminate-overrotation and to assure accurate positioning for full closure.(Ref. 19).

Temperature-Related Design Improvements In response to spurious isolation events during daily surveillance testing, design improvements have been implemented or suggested by various licensees. The majority.of the spurious isolation events initiated by LDS temperature sensors were related to testing.

The temperature modules are subject to at least daily surveillance tests, which involve changing the switch position.- Typically 14-21 of these detectors serve the RWCU system. With this many modules there are literally thousands.

of module tests each year at a plant. Thus, some random equipment problems can be expected. However, some plants are reassessing the basis for establishing the temperature monitor setpoints, with special emphasis on the ambient room temperature monitors. Licensees are also modifying temperatures monitor and module designs to eliminate isolation events associated with electronic noise pulses.

The sensitivity of the Riley temperature monitors to small, short-duration voltage pulses has been reported by the Duane Arnold plant (Ref. 20), as well as other plants, and has received considerable attention because of the widespread use of Riley detectors in nuclear plant LDS, as indicated in IN 86-69 and AE0D/E604 (Refs. 21 and 22). Also, General Electric (GE) issued y Service Information Letter (SIL) No. 443, on August 4, 1986 (Ref. ??) to BWR '

operators to delineate the modifications to the Riley switches (Model 86 Temp-matic), which could be taken to eliminate spurious isolation events when changing the switch position from " Read" to " Set." Some licensees have incorporated a design change to install a 1-second time delay in the isolation signal logic to eliminate the short-duration, spurious noise pulse signals that were found to cause isolation events (Refs. 20 and 24). Other utilities have modified the circuit to suppress extraneous noise signals by adding a resistor to the sensor circuit (Ref. 2). River Bend (Ref. 25) has suggested a design change to eliminate the need to use jumpers during testing, and Limerick (Ref. 26) is making design improvements to enhance accessibility to electrical-terminals for surveillance testing of the temperature modules. Grand Gulf also found that numerous wire termination and grounding deficiencies could contribute to noise-pulse signals. The licensee for Grand Gulf has indicated that correction of these wiring deficiencies apprears to have remedied the problem of spurious isolations during temperature monitor testing (Pef. 27).

Fourteen percent of the automatic isolation events can be attributed to the design of the temperature sensors or factors contributing to high temperatures (e.g., ventilation arrangement or design deficiencies associated with the location of the temperature sensors). For example, Limerick had placed one differential temperature element in close proximity to a hett exchanger while the other was located in the relatively cool inlet air stream (Ref. 28).-

Additionally, LaSalle 2 had' located one of the two sensors for the differential temperature monitor in a pump room close to the pump'and the other in the cool inlet air stream (Ref. 29). Hatch had continued to have problems with the ventilation and cooling systems for the RWCU system pump rooms and has modified the cooling system design to provide improved area cooling (Ref. 11).

I Personnel and Procedure-Related Improvements The LERs indicated that personnel errors were involved directly with 42% _of the spurious isolation events. These were equally divided among maintenance, testing, and operations activities, such as in realigning the RWCU system components or taking ventilation or component cooling water systems out-of-service. These. errors resulted in a systems interaction with the RWCU system when area . temperature increased to the monitor setpoint. Personnel errors were largely related to failure to follow procedures,-failure to recognize consequences of actions, or -

inadequate performance of planned actions. Significant areas in which procedures 4

have been modified are given in Table 4..

Procedural changes have been identified to reduce spurious temperature-based-isolation' events. These changes were. intended to improve operator response

, during surveillance testing of the LDS temperature modules and to provide j adequate warning of possible systems interactions with the'.RWCU system LDS

! sensors, such as occur when removing plant ventilation or component cooling water systems from service for maintenance or testing. The use of jumpers has also been addressed. In particular the use of jumpers is avoided by deenergizing i isolation valves or by using bypass switches. Finally; caution statemects I have been added to procedures for changing switch positions.

! As shown in Table 5, except for Hatch 1 and 2 and Duane Arnold,- the other seven i plants show a significant reduction in reportable isolation events in the last i two years studied. One factor in this reduction is that more isolation events

]

occur as a new plant-is brought into commercial operation. - As experience is j gained, the frequency of spurious isolation events caused by personnel and procedural errors generally decreases. Also, as eouipment operational and design problems are identified and corrected, the incidence of PWCU system-caused-isolation events is reduced. The causes for the increase in the number of events at Hatch were largely related to recurring problems with system ball valves and design inadequacies associated with room area coolers during the hot summer months. The Duane Arnold events were related to a diverse set of

circumstances, including spurious isolations associated with placing a i filter-demineralizer into service; a calibration error in a high fluid tempera-i ture monitor; random failure in a differe6tial temperature monitor; jumper use problems; and differential temperature-c.aused isolations following minor steam leaks.

FINDINGS

1. RWCU system leak detection and isolation design features vary with plant' i vintage, although all BWRs have an automatic isolation on low reactor water level and standby liquid control system initiation. Most of the older plants do not have an automatic RWCU system isolation for an RWCU

! system leak, although leak detection sensors are provided in these plants.

Newer plants, beginning with Duane Arnold, have both temperature and j flow-based leak detection systems that provide for automatic isolation of j the RWCU system.

2. RWCU system operating experience involved 21 instances of system external-leakage of which only two were of significant quantity (greater than 2,000

gallons). No evidence of significant radiological releases, significant i

d

Y Table 5 Annual RWCU system isolations by.LDS Duane Hatch LaSalle Grand Year Arnold Unit I linit 2 Unit 1 Unit 2 Gulf WNP-2 Limerick Fermi-2 River Bend Criticality 1974 1974 1982 1984 1982 1984 1984 1985 1985 1984 LDS-Flow 1 3 3 21 25 5 12 1 - -

2 0 3 19 4 7 8 - -

LDS-Typ 1 Other 0 0 1 1 0 2 4 1 - -

1985 LDS Flow 2 7 5 3 1 4 4 7 10 5 ,

LDS Temp 2 4 5 0 0 5 2 8 5 13 m 0 0 0 0 0 4 5 2 .m Other 6 0 e

1986 LDS Flow 2 1 4 0 1 0 2, 3 0 0

- LDS Temp 4 11 0- 0- 0 0 2 4 1- 1 Other 0 2 0 0 0; O O 0 3- 1~

a 0ther includes reported isolatior.s that were not specific regarding which IDS subsystem caused the isolation..

2

'l

personnel exposures, nor' damage to safety equipment'were indicated by the reported operational experience.

3. The majority of RWCU systen engineered safety feature isolation events were due to spurious causes associated with design deficiencies, procedural errors, or deficiencies. relating to the leakage detection systems of newer BWRs. The spurious' isolation events were about equally caused by design and procedural deficiencies associated with the high flow or differential flow rate -

and the high area temperature or high differential area temperature leakage detection systems.

4. The majority of the external leakage events were associated with degradation in pump seals and leakage at valve seats and valve stems. The most serious leakage events ~were related to a relief valve line rupture and valve stem packing failure.

5. Spurious isolations due to flow-monitor calibrations that are not density compensated dominated the root causes of spurious isolation events initiated by the flow measuring system. Design deficiencies that were important contributing f&ctors to the spurious-isolation events related to inappropriate placement of flow sensors, inadequate isolation logic time delays, unfavorable location of the differential flow-rate meter in the control room, and inadequate design of the instrumentation lines that enabled air to accumulate at high points in the Ifnes.

6. Effective design changes have been instituted at the majority of BWRs to eliminate spurious isolation events initiated by the flow sensors. These include relocating the flow orifices and pressure sensors, providing for a 45-second time delay between the flow imbalance annunciator and the isolation signal, and relocating the differential flow-rate meter to a front panel in the control room. Other effective changes related to: (1) improved design of system ball valves by adding stop pins; (2) elimination-of air entry or air collection points in the system through design and procedural changes; and (3) provision for temperature compensation in the flow rate calibration, either through dual calibrations to reflect normal recycle and blowdown modes or through modification of the calibration to reflect density differences.

7. Spurious isolation events associated with the leak detection system temperature monitors were mostly related to the design of the Riley Panalarm temperature monitors and test switches. The module design is particularly susceptible to short-duration electronic noise pulses. Other related factors included the design of the monitor module cabinets that provide limited access and the use of temporary jumpers or clips to conduct the daily surveillance tests on the monitors.

-I 6 '.

q

8. Design changes. instituted to remedy spurious isolation. initiated by-

-the area temperature monitors in the leak detection system principally have been directed to' eliminate short-duration. noise-i pulses, which occur in changing test switch positions and' originate from other sources, such as improperly grounded wires. Other significant ,

design modifications have related to relocation of the temperature sensors

.with respect to heat and ventilation sources and improved ventilation and cooling for the associated equipment areas. Also, attention is being-j directed to the bases for establishing the instrument trip setpoints.

!. 9. Procedural changes have been suggested to reduce RWCU system spurious isolation events associated with surveillance testing of the RWCU system ,

leak detection system and other plant systems, which can have _

l' -systems-interaction impacts. For example . increased RWCU system fluid.

tr.mperature and area temperature occur when component cooling systems or-

- v2ntilation systems are removed from service.

! C0bCu M ONS  ;

1,  % sipificant safety hazard was revealed by~ the operating experience-rev4w The principal regulatory concern demonstrated by.f.he operating-exprrk d e is increased occupational radiation exposures associated with 3

RWCU cys?am isolation event investigation and recovery.-

f 2. Most engineered safety feature isolations of the~ RWCU system result

! from spurious actuations of the leak detection system and pose no safety concern. However, each spuricus isolation event results in additional personnel radiation exposure during the licensee event investigation. In addition, these events' appear to-involve unnecessary reporting, which can indirectly impact the level of j licensee and NRC resources available to address important operational or safety concerns.

3. The neuer BWPs with automatic isolation capability based on the RWCU system leak detection system are more capable of detecting and providing for timely isolation of RWCU leaks, but operating experience

! does not provide a basis to suggest backfitting the older plants with

! more sensitive leak detection and automatic isolation capability since i there is no operational evidence that public health and safety is adversely affected.

4. The leak detection systems in newer plants offer advantages of limiting RWCU system leakage and area contamination but have the disadvantage of +

causing spurious isolations that result in increased personnel radiation exposure and unnecessary actuation of engineered safety features.

5. Improvements in the RWCU system leak detection system design and j

operation which appear to have reduced spurious isolation events

^

are:

a. modifications to the differential flew rate monitors to keep I'

the monitor elements submersed, temperature compensation for the two primary operating modes of the system, and a: time delay

between an alarm of a flow imbalance and~ the isolation. signal; i

_ . . _ ., . . _ _ . . . . , ,. . ...m. . . - - . . . - . _ _ . - - . . . _ _ _ _ _ , , , . . . , _ . . .

o

b. modifications to the temperature sensor modules to filter extraneous noise pulses, provide improved accessibility for testing, and elimina--

tion of the need for temporary furapers; and

c. procedural improvements to facilitate leak detection system testing and for affecting changes in plant operation that have systems interactions with the RWCU system.

SUGGESTIONS This evaluation may be useful in ongoing reviews of maintenance programs and new plant operating experience by industry organizations such as INPO. For example, this report may help to characterize the design and operational '

changes that can be implemented to reduce spurious engineered safety feature actuations by the RWCU system. Further, it is suggested the reporting of PWCU system events be limited only to those having actual or potential safety significance, such as causing adverse impacts on safety-related equipment or causing a significant radiological release or personnel exposure. Such a change would eliminate the current reporting of inconsequential RWCU system events (e.g., ESF actuations). Finally, it is suggested that NRR reevaluate the need for daily testing of the RWCU system leak detection system temperature monitors in view of the relatively high freauency of spurious isolation events caused by such testing and the relatively low safety significance of the recently reported events.

REFERENCES ,

1. River Bend Station Final Safety ~ Analysis Peport, Gulf States-Utilities, Docket No. 50-458.

2. Edwin I. Hatch Nuclear Plant Unit 2 Final Safety Analysis Report, Georgia Power Company, Docket No. 50-366.

3. Perry Nuclear Power Plant Final Safety Analysis Report, The Cleveland Electric Illuminating Company, Docket No. 50-440.

4. Browns _ Ferry Nuclear Plant Final Safety Analysis Report, Tennessee Valley Authority, Docket Nos. 50-259, 260, and 296.

5. " Standard Technical Specifications for General Electric Boiling Water Reactors (BWR/5)," NUREG-0123, Rev. 3, - Office of Nuclear Reactor Regulation, 'USNRC, Fall 1980.

6. Regulatory Guide 1.45, " Reactor Coolant Pressure Boundary Leakage Detection Systems," UShRC, May 1973.

7. Limerick Plant Technical Specifications, Philadelphia Electric Company, Docket No. 50-352.

8. NUREG-0737, " Clarification of TMI Action Plan Requirements," Office of Nuclear Reactor Regulation, USNRC, Nov. 1980. >

9. Code of Federal Regulations, Title 10, Part 50.73, January 1, 1986.

10. NUREG-0800, " Standard Review Plan," Office of Nuclear Reactor Regulation, USNRC, Rev. 1, 1981.

11. Edwin I. Hatch Unit 1 Licensee Event Peport 86-028-01, Docket No.

50-321.

12. Susquehanna Unit 1 Licensee Event Report 85-032-01, Docket No.

50-387,

13. River Bend Licensee Event Report 85-059, Docket No. 50-458.

14. LaSalle Unit 1 Licensee Event Report 85-003, Docket No. 50-373.

15. LaSalle Unit 2 Licensee Event Report 84-093, Docket No. 50-374.

16. Washington Public Power Supply System Nuclear Unit 2 Licensee Event Report 85-060, Docket No. 50-397.

17. Brunswick Unit 2 Licensee Event Report 83-066-036-1, Docket No.

50-324.

18. Edwin I. Hatch Unit 2 Licensee Event Report 85-033, Docket No.

50-366.

19. LaSalle Unit 2 Licensee Event Report 85-036, Docket No. 50-374.

I

20. Dudne Arnold Licensee Event Report 85-023, Docket No. 50-331.

21. IE'Information Notice No. 86-69, " Spurious Isolations Caused by the Panalarm Model 86 Thermocouple Mon' tor," Office of Inspection and Enforcement, USNRC, August 18, 1986.

l

22. " Spurious System Isolations Caused by the Panalarm Model_86 i Thermocouple Monitor," Office for the Analysis and Evaluation of 1 Operating Data, Engineering Report, AE0D/E604, March 14, 1986.

23. General Electric Company, " Service Information Letter," No. 443, August 4, 1986.

24. Fermi Unit 2 Licensee Event Report 85-025-01, Dor.et No. 50-341.

25. River Bend Licensee Event Report 85-019, Docket No. 50-458.

26. Linerick Licensee Event Report 85-010, Docket No. 50-352.

27. Grand Gulf Licensee Event Report 84-022-01, Docket No. 50-416.

28. Limerick Licensee Event Report 85-066, Docket No. 50-352.

29. LaSalle Unit 2 Licensee Event Report 84-006, Docket No. 50-374.

1

~