ML20137X615

Engineering Evaluation of Deficient Operator Actions Following Dual Function Valve Failures

ML20137X615
Person / Time
Site:	Dresden, Peach Bottom, Brunswick, 05000000
Issue date:	01/09/1986
From:	Leeds E NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
Shared Package
ML17199F676	List: ML20137X615
References
TASK-AE, TASK-E601 AEOD-E601, NUDOCS 8603110115
Download: ML20137X615 (12)

Text

-

AE0D ENGINEERING EVALUATION REPORT

• UNITS: Dresden Unit 3 EE REPORT NO.: AE0D/E601 Peach Bottom Unit 3 DATE: January 9, 1986 Brunswick Units 1 & 2 EVALUATOR / CONTACT: E. Leeds DOCKET NOS.: 50-249 50-278 50-325/50-324 LICENSEES: Commonwealth Edison Company Philadelphia Electric Company Carolina Power and Light Company

, NSSS/AE: Sargent & Lundy/ General Electric United Engineers and Constructors /

General Electric Bechtel/ General Electric

SUBJECT:

DEFICIENT OPERATOR ACTIONS FOLLOWING DUAL FUNCTION VALVE FAILURES

SUMMARY

On February 8, 1983, during power oparations, a low pressure coolant injection (LPCI) system valve operability test was being performed at Dresden-3 in

.-- accordance with the plant technical specifications because of an inoperable diesel generator. During the test, the LPCI suppression pool suction valve failed to open. The valve was then manually opened and electrically deactivated to ensure operability of the LPCI mode of the affected residual heat removal system train. However, the subject valve serves both an emergency core cooling system (ECCS) and a containment isolation function. Accordingly, this action defeated the valve's capability to perform its containment isolation function.

At the time, this adverse effect was not fully recognized by the plant operating staff.

The Dresden event, along with similar events at Brunswick and Peach Bottom were invLtigated to evaluate the underlying cause(s), the potential safety significance and the generic applicability of events involving deficient opera-tor actions associated with dual function, (i.e., ECCS/ containment isolation) valves. The study found that most light water reactors are equipped with a number of valves which perform both an emergency core cooling (or containment cooling) function and a containment isolation function. However, operating experience shows that the proper and conservative operator action for a failure of one of these valves has not always been taken by the operating staff in a manner which is fully consistent with the plant's technical specifications.

In each of the events studied, the operating staff positioned and then disabled the affected valve so as to ensure operability of one safety function while rendering the other safety function inoperable. In each case the plant staff failed to recognize the adverse consequences of the actions taken and thereby failed to declare the adversely affected function to be inoperable.

ll0ll M This document supports ongoing AEOD and NRC activities and does not represent the position or requirements of the responsible NRC program office.

=

The study found that an NRC staff document describing the appropriate actions to be taken following the failure of dual function valves (which was previously developed in connection with the Dresden event) contains generic guidance appli-cable for all licensees. The study suggests that the Office of Inspection and Enforcement consider issuing an information notice which discusses the events at Dresden, Brunswick and Peach Bottom and provides the staff guidance concerning appropriate actions to be taken following the failure of a dual function valve.

From the earlier review of the Dresden event, the staff also concluded that because the dual function LPCI pump suction valve was not included in the tech-nical specifications, the associated action statement might not have been fully apparent to the operating personnel involved. As a result, the staff requested Commonwealth Edison (the Dresden licensee) to examine the Dresden plant piping ,

configurations to ensure that each of the dual function valves is listed in the '

technical specifications. This study also found that the dual function valves involved in the Brunswick and Peach Bottom events are listed in the respective plant FSARs as a containment isolation valve but are not included in the plant technical specifications. The study suggests that the Office of Nuclear Peactor Regulation (NRR) consider requiring that all dual function valves be identified in the table of containment isolation valves of each plant's technical specifi-cations.

Finally, the Peach Bottom Unit 3 technical specifications for the containment cooling subsystem was reviewed to assess the completeness of the technical specification description of the subsystem. The evaluation concludes that the Peach Bottom technical specifications may be incomplete by not making

. reference to the applicable RHR system components involved in the containment v.- cooling subsystem. It is suggested that NRR review the Peach Bottom technical specifications for the containment cooling subsystem and, if warranted, require revisions to the technical specifications as necessary.

INTRODUCTION In general, both pressurized water reactors (PWRs) and boiling water reactors (BWRs) are equipped with containment isolation systems to provide a means of isolating the various piping systems which pass through containment. The overall design of the containment isolation systems of light water reactors (LWRs) involves the use of a large number of isolation valves serving many different systems. These systems are, by nature, quite varied and complex due to the diversity of the nonsafety-related and safety-related fluid systems involved. General Design Criteria (GDC) 54 through 57 of Appendix A to 10 CFR Part 50 provide the requirements for the isolation arrangenents of the various types of piping systems that penetrate containment. The containment isolation requirements given in the GDC define the number, location and type of isolation valves which should be provided for each type of piping penetration. In general, the applicable GDC requirement depends on the function of the system, whether it is open or closed with respect to the containment atmosphere, or whether it is connected to the reactor coolant system.

In many plant designs safety-related piping systems are equipped with one or more valves which serve both a core cooling function (e.g., injection valve, and a containment isolation function (i.e.,

suction valve,isolation containment minimum flow Such valve). valve) 7ual function valves" are designed, fabri-cated, tested and maintained so as to be highly reliable in both opening and closure in order to provide a high degree of reliability of both functions.

Some specific examples of dual function valves for BWRs would be the low pressure coolant injection system injection and torus suction valves at Dresden and the core spray system (CSS) minimum flow valves at Brunswick. For PWRs, examples would include the low pressure safety injection (LPSI) system header stop valve at Maine Yankee and the safety injection (SI) pump discharge header isolation valve at Indian Point-2. Depending on the specific application, dual function valves may be normally open or normally closed, automatic or manual.

This study was initiated to evaluate events at Dresden, Peach Bottom, and Brunswick involving failures of dual function valves. In each event, plant personnel took action to ensure one function of the valve in such a way as to defeat the valve's alternate function. In each case, plant personnel failed to recognize the adverse effects and thereby failed to implement the applicable technical specification action statement for inoperable equipment. This study evaluates each event with respect to the underlying cause(s), the potential safety significance and the potential applicability to other nuclear plants.

DISCUSSION Operating Experience Dresden Unit 3

w On February 8, 1983, during power operations at Dresden-3, a low pressure cool-ant injection valve operability test was being performed in accordance with the plant technical specifications because the swing diesel generator was inoperable (Ref. 1). During the test, the normally open LPCI system suppression pool suction valve was cycled closed but then failed to reopen. The valve, which provides both an ECCS and a ccatainment isolation function, was then manually opene/ and electrically deactivated. With the valve open and disabled, the ECCS fun % ion of the LPCI system was ensured. Because the LPCI pump suction valve had failed to open while the swing diesel was inoperable, the licensee declared an " unusual event" and initiated a unit shutdown. While the shutdown was in progress, maintenance personnel replaced a failed auxiliary contact in the con-trol circuitry of the valve. The valve was successfully cycled three times and returned to service. The " unusual event" and plant shutdown were subsequently terminated.

The normally open LPCI pump suction valve receives an automatic open signal when an ECCS initiation signal is received. The valve is also designed to be remotely closed from the control room to ensure containment isolation when required. When the valve was manually opened and electrically deactivated to maintain its ECCS function, its capability to perform its containment isolation function was defeated. During the period that the valve was open and electrically deactivated, the licensee did not declare the valve inoperable or enter the applicable technical specification action statement while the containment isolation function of the valve was disabled.

- . . - . .. _ . = _ _ .

Brunswick Units 1 and 2 On or about May 23, 1984, while performing local leak rate testing on several 1

primary containment penetrations, operations personnel at Brunswick Unit 2 observed that the minimum flow valve for the 2A core spray system (CSS) pump

would not stay in the closed position (Ref. P). When the control switch for i the minimum flow valve was turned to the "close" position, the valve closed, but then immediately reopened. Engineering personnel determined that the control logic for the minimum flow valves .for both units was such that the valves would reopen after closure whenever a low flow condition was sensed in the core spray line. This could occur either when the pump was secured or when an actual low flow condition existed. On June 1, an engineering review determined that the minimum flow valve control logic did not appear to meet General Design Criterion 57 in Appendix A of 10 CFR 50. Based on this determina-tion, the normally open minimum flow valves for both CSS trains for Brunswick i

Units 1 and 2 were declared iraperable, closed and deactivated. Operations personnel took these actions to comply with the plant technical specification action statement for inoperable primary containment isolation valves (PCIVs).

The action statement requires that either the inoperable PCIV be restored to an operable status within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after.it is discovered inoperable, or the affected line be isolated.

At the time the minimum flow valves were closed, Unit 2 was defueled but Unit 1 j

was operating at power. The Unit 1 valves were also placed under shift foreman 1 clearance to ensure effective operator. action to minimize the potential for pump damage in the event of a pump start. Therefore, although the Unit 1 CSS minimum flow valves were closed, Carolina Power and Light (the licensee) believed that any potential for pump damage could be easily avoided by timely operator action, e

From subsequent discussions with the pump vendor, the plant operating staff learned that damage to the CSS pump could occur witnin as little as one minute j after initiation if the pumps were run at shutoff head without the minimum required . flow. The plant staff re-evaluated the situation and concluded that the rist of possible pump damage with the valves closed was unacceptable.

Accordingly, after a plant shutdown on June 12, the minimum flow valves were reopened and actuation power restored. During the subsequent Unit I startup on June 13, administrative controls and special procedures were effected to ensure closure of the valves when required for containment isolation.

In review, Unit 1 operated at power from June 1,1984 to June 12, 1984 with 4

the CSS minimum flow valves closed and deactivated. During this period, the

plant staff did not consider either train of the CSS to be inoperable. At the l

time these actions were taken, the licensee's technical staff did not fully l recognize the potential adverse effects of a closed minimum flow valve on the operability of its associated CSS pump.

Peach Bottom Unit 3 On January 15, 1985, with the Peach Bottom Unit 3 reactor operating at 87%

power, plant personnel were performing necessary equipm.nt operability testing because of an inoperable emergency diesel generator. While equipment

testing was in progress the NRC resident inspectors discovered that the RHR torus spray valve was closed and disabled (Ref. 3). Based on subsequent inter-views with plant personnel and a review of the releva'nt documents, the inspectors determined that the valve had been closed and inoperable since January 7. On January 7, the valve had been opened to establish suppression pool cooling for a reactor core isolation cooling (RCIC) system test. However, after the test was completed, the valve could not be reclosed using the attached motor operator. An investigation of the valve failure by plant personnel found a mechanical binding problem within the valve motor operator. To satisfy its containment isolation function, the valve was mechanically closed with.a strap wrench, deactivated and declared inoperable.

The RHR torus spray valve also receives a close signal upon receipt of a low pressure coolant injection (LPCI) initiation signal. This ensures that all LPCI flow is directed to the reactor should an accident occur while the valve is open. The valve is designed to be remotely opened after adequate core cooling is established in order to provide suppression pool cooling.or spray functions. The valve is also designed to be remotely closed from the control room to ensure containment isolation when required. With the RHR torus spray valve closed and deactivated, loop A of torus cooling and spray was unavailable.

However, the licensee did not declare the associated cooling 1.oop to be inoper-able when the valve was closed and disabled on January 7,1985.

The inspectors noted that when a diesel generator is inoperable, the plant technical specifications require the containment cooling subsystems associated with the redundant diesel generator to be operable. On January 15, when the inspectors brought to the licensee's attention the apparent failure to meet the limiting condition for operation, the licensee declared an " unusual event" and began an orderly unit shutdown. While the shutdown was in progress, the RHR torus spray valve was repaired, tested satisfactorily, and declared operable.

With the torus spray valve returned to an operable status, the licensee dis-continued the shutdown and terminated the " unusual event."

The operability of the containment cooling mode of RHR requires the operability 3

of such equipment as the RHR pumps, the RHR heat exchangers, an open flowpath to and from containment and the high pressure service water (HPSW) systen.

However, a review of the Peach Bottom Unit 3 technical specifications by the resident inspectors revealed that only the high pressure service water system is specified for containment cooling subsystem operability. It is believed that the absence of an open flow path requirement statement in the plant technical specifications contributed to the inappropriate closure of the torus spray l valve during the event. The licensee agreed to provide interim administrative controls for assuring operability of the containment cooling subsystem until i such time that this issue can be either permanently addressed through a revision to the plant technical specifications or resolved by some other acceptable means.

ANALYSIS AND EVALUATION l The Final Safety Analysis Reports (FSAPs) submitted for LWR licensing generally provide a comprehensive description of the purpose, design and operation of the various containment isolation systems and their associated isolation valves.

The FSARs also typically contain tables which list all of the containment isola-tion valves in the plant and whether the valves have an automatic closure feature 1

or whether they are provided with a remote manual isolation capability. Valves with an automatic closure feature would be provided, for example, for lines penetrating containment associated with nonsafety-related functions, non-ECCS lines connected to the reactor coolant pressure boundary and steam supply lines to certain safety-related turbine-driven pumps.

As stated in the FSAR, the injection lines of safety-related and emergency core isolated because their isolation would cooling systems disable the are safety system's not automatically function (i.e., mitigation of the consequences of a postulated accident). However, since it still may be postulated that an ECCS or safety-related pipeline could rupture or leak outside containment, and thereby result in the. release of radioact!ve materials to the environment, these lines are usually capable of remote manual isolation from the control room.

Frequently, a valve (e.g., injection or isolation) which must open to permit a safety function to be accomplished is the same valve which must close to ensure containment isolation. This arrangement results in a number of valves which perform both an ECCS (or containment cooling) function and a containment isolation function (i.e., " dual function valves"). ,

The lists which identify containment isolation valves in FSARs typically include a number of valves which serve functions in ECCS, containment cooling, and other safety-related systems. However, the containmeat isolation valve table in plant technical specifications generally do not explicitly identify which of these valves serve dual functions. Furthermore, plant technical specifications usually do not explicitly list or identify each of the valves which must be open or operable to ensure that the safety functions required by the technical specifica-tions for a system, subsystem or train are operable (i.e., that an open flow e path is available). As a result, the containment isolation function of a dual function valve is more clearly and explicitly addressed in plant technical speci-fications than the safety function served by the same valve which is often only implicitly covered in the technical specifications. In general, plant technical

specifications explicitly require the isolation function of each containment isolation (and dual function) valve to be operable during reactor power operating conditinns. Even so, plant technical specifications usually allow reactor power operations to continue with an inoperable containment isolation valve provided at least one valve in the line having an inoperable valve is isolated. Plant technical specifications, however, generally do not precisely prescribe the appropriate actions to be taken with respect to positioning and disabling a failed dual function valve.

i The failure of dual function valves may, on occasion, present the operating staff with difficulty in determining the most appropriate valve position (open or closed) and valve technical specification requirement status (enabled or disabled). Clearly, if an inoperable dual function valve in the ECCS loop flowpath was closed and disabled to satisfy its containment isolatior. function, the flowpath would be unavailable and the ECCS loop would have to be declared inoperable. If the licensee takes action to preserve the ECCS function of the valve and opens and deactivates the valve to maintain an operable flowpath for the ECCS loop, the valve's containment isolation capability is defeated, resulting in a violation of the containment isolation requirements.

However, the appropriate actions to be taken following the failure of a dual function valve have been examined and addressed by the NRC staff (see Attach-ment 1). As discussed in Attachment 1, if a plant's technical specifications do not provide explicit criteria for positioning an inoperable dual function valve, the staff's general guidance is that, "...the valve should be closed so as to maintain containment integrity. Furthermore, the ECCS loop should be declared inoperable and its action statement complied with." The staff's guidance considers specific modes of dual function valve failures and discusses the appropriate immediate operator actions to be taken for positioning and dis-abling the valve depending on the actual mode of valve failure. For example, the actions to be taken in the event an automatic dual function valve failed to open may be different than the actions necessary if the valve failed to close.

At Dresden-3, the failure of the dual function LPCI pump suction valve on February 8, 1983 resulted in an incorrect personnel action which preserved one function of the valve but defeated the valve's alternate function. The Dresden technical specifications require that if a containment isolation valve becomes inoperable, "...at least one containment isolation valve in each line having an inoperable valve shall be placed in the isolated condition." However, if the LPCI pump suction valve was closed, the associated ECCS flowpath would be unavailable resulting in an inoperable ECCS loop. The licensee decided to open and dea.:.ivate the LPCI pump suction valve to preserve the valve's ECCS function. However, when this was done it defeated the valve's capability to

perform its containment isolation function. The licensee also failed to declare the containment isolation function inoperable. The staff's guidance is that if any function of the LPCI valve is inoperable, the valve must be declared inoperable. Furthermore,'ince s opening the pump suction valve is required for the LPCI system to perform its intended function, the LPCI system should have W

been declared inoperable according to the staff guidance. This guidance was specifically developed following the staff's review of the Dresden-3 event and was transmitted to the licensee for information on October 5,1983 (Ref. 5).

Although the LPCI pump suction valve is listed in the Dresden FSAR as a contain-ment isolation valve, the valve was not listed as such in the technical specifications. The staff acknowledged that since the valve was not listed in the technical specifications, the associated containment isolation action state-ment may not have been apparent to the licensee. However, since the LPCI pump

. suction valve is considered a containment isolation valve, the staff requested the licensee to submit an application for a license amendment to add the valve (and any other dual function valves not already designated) to the table of con-

, tainment isolation valves in the technical specifications (Ref. 5). Adding the dual function valves to the technical specifications would increase operator awareness of the importance of the containment isolation function of the dual function valves. A license amendment (Amendment No. 88) which listed the LPCI pump suction valve along with other dual function valves in the Dresden P and 3 technical specifications table of containment isolation valves was issued May 30, 1985 (Ref. 6).

, In the Brunswick event, the actions taken to preserve one function of a dual

function valve disabled the valve's alternate function. Upon detemining that i

the CSS minimum flow valves' control logic prevented the valves from fulfilling

their containment isolation function, the CSS minimum flow valves were closed i

i

and deactivated. This was done to comply with the technical specification requirement for containment isolation although the valves are not listed as such in the plant's technical specifications. This action was taken because the licensee recognized that the CSS minimum flow valves are described in the FSAR as containment isolation valves. However, neither CSS train was declared inoperable while the valves were closed and deactivated. This is inconsistent with paragraph 2 of the Attachment which requires that the valve be closed to maintain containment integrity and the corresponding ECCS loop (s) be declared inoperable.

The event at Peach Bottom-3 on January 7, 1985, involving the inoperability of the 'A' RHR torus spray valve also involved personnel actions which preserved one function of a dual function valve and disabled the valve's alternate function without the plant staff recognizing the adverse effect on the alternate ~

function. The valve involved is described in the plant's FSAR as a containment isolation valve although the valve is not listed as such in the technical specifications. In the Peach Bottom event, the 'A' RHR torus spray valve was closed, deactivated and declared inoperable to comply with the technical speci-fication requirement for containment isolation. Closure of the valve defeated the valve's ECCS function by making containment cooling loop 'A' unavailable.

However, the 'A' containment cooling loop was not declared inoperable while the valve was closed and deactivated. This is also inconsistent with paragraph 2 of the Attachment which requires that the valve be closed to maintain containment integrity and the corresponding cooling loop be declared inoperable.

A review of the FSAR and technical specifications for the Peach Bottom contain-ment cooling subsystem also indicates that a lack of information may have contributed to the. event. The Peach Bottom FSAR describes the containment cooling function as requiring the RHR pumps, the RHR heat exchangers, the necessary open flowpaths (for the various modes of containment cooling) and the high pressure service water system. However, the plant technical specifications only cite the HPSW system. To assess this apparent inconsistency between the Peach Bottom FSAR and technical specifications, the Browns Ferry FSAR and technical specifications for the containment cooling subsystem were examined.

Although the containment cooling subsystem at Peach Bottom is quite similar to the system at Browns Ferry, the Browns Ferry technical specifications for the subsystem are much more comprehensive. Both the Browns Ferry FSAR and technical specifications mention the RHR pumps, the RHR heat exchangers, and the appli-cable flowpaths as well as the HPSW system as required for containment cooling.

Thus, the Peach Bottom technical specifications appear to be somewhat incomplete in this area.

An example of an event in which a dual function valve failure was correctly acted upon by the operating staff (i.e., without violating the plant's technical specifications) is presented here for comparison. At Maine Yankee, the low pressure safety injection (LPSI) header stop valve is a dual function valve.

The normally closed valve opens on receipt of a safety injection actuation signal to align both LPSI trains to the reactor coolant system. The LPSI header stop valve can also be remotely closed from the main control board for contain-ment isolation. On January 16, 1985, during monthly ECCS testing, the transfer times of the automatic bus transfer (tPT) device for the LPSI header stop valve

-__e_- ._ _. - . _ .

-9,

, were being measured (Ref. 4). While the normal to-emergency bus transfer time was within acceptable limits, the emergency-to-normal transfer time was slow.~

Since the normal-to-emergency transfer activated properly, the valve remained operable. However, corrective actions were required to correct the ABT emergency-to-nomal transfer. To repair the valve, plans were made to disable it open in its safeguard position to satisfy plant technical' specifications for operable safeguard trains. At the same time the applicable limiting condition for operation (LCO) action statement would be entered while the containment isolation function of the valve was disabled.

On February 11, 1985 while at 75% power, the LPSI header stop valve was opened and electrically disabled for repair of its ABT and the LC0 action statement was entered. Approximately one hour and 23 minutes later the valve repair was completed, the valve was closed and power restored. In this case, the licensee recognized that both functions of a dual function valve were governed by plant technical specifications and took appropriate steps to avoid violating the LC0 action requirement for either function.

l In each of the previously discussed events (with the exception of Maine Yankee),

the actions taken following the failure of a dual function valve resulted in a violation of technical specifications LC0 action requirements .for a containment isolation valve or an inoperable safeguard train. In each case, personnel either opened and disabled or closed and disabled a dual function valve which preserved

! one function of the valve but defeated the valve's alternate. function. Further-more, those action were taken without declaring the alternate function to be inoperable and without declaring the adversely affected function of the valve to be inoperable. At Dresden-3, the affected ECCS loop operability was pre-served but containment isolation requirements were violated. At Brunswick and

. . ~ Peach Bottom-3, containment integrity was maintained but the affected safeguard trains were disabled. None of the plant technical specificztions examined for this study specifically addresses appropriate actions for the failure of a dual function valve.

The operator actions taken at Dresden, Brunswick and Peach Bottom were inconsistent with the staff guidance on operator actions following dual function valve failures. Following the Dresden event, the staff's guidance was transmitted to the Dresden licensee (Commonwealth Edison) for information. However, based on discussions with cognizant NRC staff, it is understood that the staff guidance has not been transmitted to any other licensees.

FINDINGS AND CONCLUSIONS A study of several recent events involving dual function, ECCS/ containment isolation valves has resulted in a number of significant findings and conclu-sions. The study found that although BWRs and PWPs are typically equipped with valves required to perfom both ECCS and containment isolation functions and that these functions are generally adequately described in a plant's FSAR, the appropriate actions for a dual function valve failure are not always taken by plant operating personnel. Additionally, a review of plant technical specifications indicates that operating staff errors may be due in part to the implicit and sometimes incomplete nature of the technical specification action requirements for these valves.

i

---._n------ - - - - . -. - . _ - - - - - - - . . , , - - - - . .

The study found that at Dresden-3, the LPCI pump suction valve was opened manually and electrically deactivated to maintain its ECCS function, defeating the valve's capability to perform its containment isolation function. At Brunswick and Peach Bottom-3, the operating staff at each unit closed and deactivated a failed dual function valve to maintain containment integrity.

However, this action disabled the associated ECCS or containment cooling train (s) at each plant. Furthermore, the affected trains were not declared inoperable.

The study also found that the staff's guidance (which was developed in connection with the Dresden event) on appropriate actions to be taken following the failure of a dual function valve might also have been useful for the pre-vention of the subsequent events at Brunswick and Peach Bottom. However, based on discussions with cognizant NRC staff, it is understood that this guidance has not been transmitted to any LWR licensees other than the Commonwealth Edison Company (i.e., the Dresden licensee).

The study also found that at Dresden, Brunswick and Peach Bottom, the dual function valve involved in each event is listed as a containment isolation valve in'the respective plant's FSAR but is not included in the technical specifications. In reviewing the Dresden event, the staff concluded that because the dual function LPCI pump suction valve was not included in the tech-nical specifications, the associated action statement may not have been fully apparent to the plant operating staff. The Dresden technical specifications have since been amended as requested by the NRC staff to include the LPCI pump suction and other dual function valves. For the Brunswick and Peach Bottom plants a revision to their technical specifications so as to include and identify all dual function valves in the table of containment isolation valves would be consistent with the action taken at Dresden and would help prevent such an event from recurring. It wocid also appear beneficial for all licensees to examine their plant's piping configurations and ensure that the plant's dual function valves are appropriately listed and identified in the technical speci-fication table of containment isolation valves. Ensuring that the applicable dual function valves are included and identified in the appropriate technical specifications containment isolation valve table would promote the operator's recognition of both the containment isolation function and the ECCS function following a dual function valve failure.

Finally, at Peach Bottom-3 it was found that the technical specifications for the containment cooling subsystem appear to be incomplete. The Peach Bottom technical specifications for the containment cooling subsystem only addresses the HPSW system portion of the subsystem and does not include the RHR portion of the subsystem as described in the FSAR. This may have contributed to the

~

operating staff not declaring the containment cooling subsystem inoperable while the 'A' RHR torus spray valve was closed and deactivated.

SUGGESTIONS It is suggested that the Office of Inspection and Enforcement (IE) consider issuing an IE information notice to all LWR licensees concerning the events at Dresden, Brunswick and Peach Bottom involving the deficient operator actions which were taken following dual function (i.e., ECCS/ containment isolation) valves failures. The information notice should also provide, to the extent appropriate, the staff's generic guidance concerring actions to be taken following the failure of dual function valves.

~

It is suggested NRR request all licensees to examine their plant's piping configurations and ensure that the plant's dual function valves are appropriately listed and identified in the technical specification containment isolation valve table. In this way, the staff would extend to all licensees the technical

' specification improvements made by Commonwealth Edison (the licensee) for Dresden Units 2 and 3. This improvement could possibly be implemented as part of NRR's ongoing Technical Specification Improvement Project.

Finally, it is suggested that NRR review the Peach Bottom technical specifica-tions with respect to the adequacy of the limiting conditions for operation for the the containment cooling subsystem.

• a REFERENCES

1. Licensee Event Report 83-006, Dresden Nuclear Power Station Unit 3, Docket No. 50-249, February 18, 1983.

2. Licensee Event Report 84-009, Brunswick Steam Electric Plant Unit 1 Docket No. 50-325, July 27, 1984.

3. Region II, Inspection Report No. 50-277/85-07 and 50-278/85-07, January 15, 1985.

4. Licensee Event Report 85-001, Maine Yankee Atomic Power Company, Docket No. 50-309, March 14, 1985.

5. Letter from D. M. Crutchfield, URC, to D. L. Farrar, Director of Licensing, Commonwealth Edison Company,

Subject:

Licensee Actions Following Failure of Certain ECCS/ Containment Isolation Valves, October 5,1983.

6. Letter from J. A. Zwolinski, NRC, to D. L. Farrar, Director of Licensing, Commonwealth Edison. Company,

Subject:

Technical Specification Changes to Revise Table 3.7.1, May 30, 1985.

ATTACR4ENT 1 October 5,1983 -

Docket No. 50-237/249 LS05-83-10-009 Mr. Dennis L. Farrar Director of Nucicar Licensing Comonwealth Edison Company Post Office Box 767 Chicago, Illinois 60690

SUBJECT:

. ISOLATION VALVESLICENSEE ACTIONS FOLLOWIN Dresden. Nuclear Power Station, Unit Nos. 2 and 3 at Dresden 3 was discussed in which LPCI pump s failed to open during testing.

- " Isolation capability, was opened manually and then electricall to maintain its ECCS function.

containment isolation capability.This defeated its capability to perform its Inspection Report No. The event was also discussed in Region III (DPRP). 50-010/83-06(DPRP); 50-237/83-07(DPRP); 50-249/83 06 -

LER and the Inspection Report.Several concerns have resulted fro The staff has studied the im the event and has addressed those concerns in the enclosure.pifcations of You should particularly note that it is the staff's position that the LPCI suction valves (4) and core spray suction valves (2) should be included in Table 3.7.1, Primary Technical Containment Isolation, of the Dresden Unit 2 and Unit 3 Specifications.

for Itcense amendments which will add them to Table 3.7.1 for .

designated which serve such dual functions and whic Table 3.7.1 of the Technical Specifications.

You should examine your piping configurations and include these valves in your amendment submf tta .

MDRIMADocg H Ha 03000p37 assoon ff+01 8 p@)

pSd PDR

.o e

Mr. Dennis L. Farrar -

2- October 5. 1983 This request only pertains to Dresden Nuclear Power Station, Units 2 and 3

'(fewer than 10 respondents); therefore, OMB clearance is not required un P.L.96-511.

Sincerely.

Original signed by Dennis M. Crutchfield, Chief Operating Reactors Branch #5 Division of Licensing

Enclosure:

As stated cc w/ enclosure:

See next page DISTRIBUTION Docket file NRC POR Local PDR NSIC ORB IS Reading DCrutchfield HSmith RG11bert OELO ELJordan JKTaylor ACRS (10)

CHeltemes Ok:' h 5

/HSm thilc-DL RG l>ert

1. 5 DLhW DCrs 7

tta f f eld rg /3 /83 /v/sF/83 lI/7 /83

1 Mr. Dennis L. Farrar - Octob'er 5, 1983 CC Isham, Lincoln a Beale Counselors at Law One First Illinois Chicago, National60603 Plaza 42nd Floor Mr. Doug Scott Plant Superintendent Rural Route #1 Morris, Illinois 60450 U. S. Nuclear Regulatory Commission '

Resident Inspectors Office Or'esden Station RR #1 Morris Illinois 60450 Chairman Board of Supervisors of Grundy County Grundy County Courthouse ,

Morris, Illinois 60450

1. "' ' * ' ' U. S. Environmental Protection Agency Federal Activities Branch Region V' Office ATTN: Regional Radiation Representative 230 South Dearborn Street Chicago, Illinois 60604 James G. Keppler, Regional Administrator Nuclear Regulatory Commission, Region III 799 Roosevelt Road Glen Ellyn, Illinois 60137 Mr. Gary N. Wright, Manager Nuclear Facility Safety Illinois Department of Nuclear Safety 1035 Outer Part Drive, 5th Floor Springfield, Illinois 62704 1

l ENCLOSURE e

. 1

)

CONCERNS RELATING TO FAILURE OF CERTAIN ECCS/ CONTA 1.

The LPCI (1501-5D) valve has an automatic open signal whichthe opent valve if closed when an ECCS automatic initiation signal is received.

The automatic open portion of the valve was not operable because when .

1 the valve closed it was incapable of being automatically opened. The

- staff concern is whether the valve should be considered inoperable or valve was open with the capability of closing. operable wit The staff position is that, if any automatic function of an ECCS or Containment Isolation becomes inoperable, the valve is inoperable. The-valve must be considered inoperable even if the au operable).

the automatic condition. opening feature would leave the plant in Such a position is consistent with the staff's intent as Operability which all power reactor licensees were r the generic letter of April 10, 1980.

It is the staff's position that if -

any function of the LPCI valve is inoperable, the valve must be declared inoperable.

LPCI be system declared to inoperable. perform its intended function, the LPCI s 2.

• , ~ , When an ECCS/ Containment Isolation valve is declared ~1noperable, the staff's position is that the licensee should follow the requirements of the applicable Technical Specification.

Techrifcal Specification does not provide explicitIn the event the appitcable criteria for positioning an inoperable ECCS/ Containment Isolation valve the staff believes containment integrity. that the valve should be closed so as to maint inoperable and its action statement complied with.Furthermore, the EC In the case where such a valve was inoperable solely 'as a result of being unable to auto-i matica11y open, the staff would consider it acceptable to maintain the

! valve in an open position provided the ECCS loop was declared i b operab

! its action statement was complied witt., and the valve was capable of

being closed by an automatic containment isolation signal.

3.

, Once an ECCS/Contairment Isolation valve is declared inoperable and the l valve is then placed in a designated configuration (either open or

{. closed),

subsequent thisinadvertent valve should be electrically deactivated to preclude its actuation.

i is being maintained in its open position in accordance with the crite given above, it is the staff's position that this valve should not be

.electrically deactivated since it would then be incapable of closing to

provide containment isolation.

Furthermore, the staff does not believe 1 that automatic initiation of the ECCS loop should be bypassed, i i

I l

l E

~ ..

s

. r 4

Since the 1501-5D valve was not in the Technical Specifications, the associated action statement was not apparent to the licensee. As part of the ECCS. systems, these valves would not normally be listed separately since the definition of Operable-Operability (which all power reactor licensees were requested to adopt via the generic letter of April 10,,1980) would require these valves to be operable in order for the ECCS systems to be operable. However, since these valves are considered as part of the boundary for containment isolation, it is the staff's position that they should be included in Table 3.7.1, Primary Containment Specifications. Isolation, of the Dresden Units 2 and 3 Technical 5.

The SEP action topicbe should recommendation provided. Thewas that appropriate procedures for operator 1 licensee had not issued these procedures.

The licensee should follow the requirements of the applicable Technical Specification.

In the event the appitcable Technical Specification does not provide explicit criteria for positioning an inoperable ECCS/

Containment Isolation valve, the staff has determined that, in general, the valve should be closed so as to maintain containment integrity.

Furthermore, the ECCS loop should be declared inoperabic and its action statement complied with.

In the case where such a valve was inoperable solely as a result of being unable to automatically open, the staff would consider it acceptable to maintain the valve in an open position provided the ECCS loop was declared inoperable, its action statement was complied "i ' with, and the valve was capable of being closed by an automatic contain-ment isolation signal. However, there may be situations which can arise which will dictate different actions be taken concerning the disposition of thethese valves and they should be addressed on a plant specific basis by licensee.

__