ML20248D669

Forwards Correspondence Re Installed Hardened Wetwell Vent at Plant,For Comments

ML20248D669
Person / Time
Site:	Pilgrim
Issue date:	09/20/1989
From:	Dixon D PLYMOUTH, MA
To:	Murley T Office of Nuclear Reactor Regulation
References
GL-89-16, NUDOCS 8910040357
Download: ML20248D669 (25)

Text

.

_l/

[,y .g. ,

[

6 I Plymouth-Nuc3 ear. Matters Committee L Town of Plymouth F: 11 Lincoln Street k Plymouth, .MA 02360 l

H ' September 20, 1989 Mr. Thomas E. Murley Director

-Office of Nuclear Reactor Regulation Nuclear Regulatory Commission 7920 Norfolk Avenue Bethesda, MD 20814 RE: Pilgrim Nuclear Power Station Direct Torus Vent System

Dear Mr. Murley,

Please find enclosed, copies of correspondence relating to the recently installed hardened wetwell vent at Pilgrim Station.

Since several.of the issues under discussion concern NRC's review and approval of the system and since you are one of the key individuals involved in the modification, we are seeking your input to help. clarify this situation. . It would be greatly appreciated if you could respond directly to relevant aspects of this issue in writing to the above address.

Although Generic Letter 89-16 states- "The staff found the installed system and the associated.bECo analysis acceptable,"

we have not been able to conclude this from any of the other existing documentation. Specifically all of the Safety Evaluations describe only the install,a tion, not the use of the vent. Also, the logic used in Safety Evaluation 2269, dated 1/9/88, wh1ch concludes that anchange to the Technical Specifications is not required, is very questionable. Do you concur with BECo's arguement there?

In addition, inadvertent or premature venting is a very serious safety question, yet, in various documentation, BECo maintains that the DTVS does not involve an unreviewed safety question. If you agree, could you explain why it does not?

Many state and local publie- officials, as well as numerous residents realize the close and necessary linkage between controlled venting and emergency preparedness. However, as

'you may well know, the adequacy of emergency planning for Pilgrim is hotly debated. The topic is even under investigation by the NRC Inspector General's office. Do you believe that the DTVS should have been allowed to be made operational without adequate emergency preparedness by the community and the licensee?

Obviously, this is a far reaching technical and politically sensitive issue within the NRC. In reviewing the documentation, we, of course, would have preferred that the NRC approach to this issue had been more straightforward: if it was a good idea, get behind it and insure that it was designed, installed, and planned for properly, and if it was a However, the bad idea, stop it from being implemented.

/pN k ffOCKOUl 690920 H 05000293 FDC

= _ = _ _ - - _ - - - _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ - _ _ _ - . - _ _ - _ - . - _ , - _ _ _ _ _ . _ _ _ _ _ _ . - - _ _ _ - _ _ _ _ - __--__-__a

L 3

.. .'. l i

existing documentation indicates official hesitancy; no one seemed to relish having their names, reputations, and' careers closely tied to this plant modification. We live downwind of Pilgrim. It would reassure-us if you could provide your assurances that BECo is up to the task of using this powerful new tool.

Pilgrim, as you are aware, has had a very troubled history:

'Some of the largest fines, longest shutdowns, most expensive capital repairs, highest O & M costs, and lowest SALPs of currently operating reactors. Now, the first DTVS in the nation is installed here and we are extremely concerned.

Also included is our report on the April 12, 1989 spill in the RCIC system at Pilgrim. There are many issuec here which we feel vill be of considerable interest to you. First, the AIT report contained. errors. Second, the executive summary and cover letter did not reflect the conclusions from the body of the report or from the appendixes. Third, it was on interfacin systems loss of coolant accident whichyoukavebeenclosely involved. Fourtb,awetopic are with requesting higher level NRC review of the issue, with special emphasis on the role of HRC in the event investigation and, core broadly, in the power accension oversight. These are serious assertions and serious requests.

Your comments on both of these matters would be greatly appreciated.

Thank you, C  %

David C. Dixon Vice-Chairman, Plymouth Nuclear Matters Committee

ll a ..

^'

. TOWN OF PLYMOUTH I 11 Lincoln Street fff Plymouth. Massachusetts 02360 A.g" ' j.

1617)747-1620 I

r September 5, 1989 Mr. David F. Tarantino District Manager Nuclear Information Division 448 State Road, Suite 5 Plymouth Ma, 02360

Dear Mr. Tarantino,

Thank you for the information on the Direct Torus vent System. Regretably, we already had obtained those documents, with the exception of the most recent letters between Peter Agnes and Ralph Bird, and the questions we had asked resulted from the study of those documents. We now resubmit the questions and ask you to seek direct responses to them.

The significance of this issue should not be underestimated.

Prior to the DTVS, one of the final layers of defense in depth was the steel and concrete Mark 1 containment, which has a burst pressure of over 100 psi. The DTVS punches through that layer, relieving directly to the environment at only 30 psi. It is the most significant change to Mark 1 containment design in twenty years, and is the first such system in the nation. It use requires early notification and coordination with Civil Defense officials in the EPZ.

While we would like specific responses to the ten questions, the most important issues can be distilled into two main areas:

1. The NRC has indicated in several instances that they were unwilling to endorse Pilgrim's DTVS and that the

-installation of valve AO-5025 would require a change to the Technical Specifications. In all of the documentation available to us, the installation and the use of the DTVS were analyzed seperately. Futher, BECo states repeatedly that the system will not be made operational, that the valve AO-5025 will not be installed without formal NRC approval.

The valve is now installed and operational. Can you provide this committee specific documentation indicating that NRC has now formally approved the use of the Pilgrim DTVS, that its use does not introduce unreviewed safety questions and that BECo, in proceeding with the installation, has not violated 10 CFR 50?

h~..,#

K'y .7

'3g -

u', .

L e

2. : The' logic behind using the DTVS is complicated.Yet, our

. reading of the" documents indicates that there.have been no changes to.your EOP's incorporating the new decision trees or early notification requirements; no training on the use

'of the special keys, electrical' jumpers, special' fuses; or the other idiosyncracies of the system. No management .

review,lno public involvement. Only the pre-existing EOP-3 relates to containment venting, and'BECo did-not rewrite it before implementing the new DTVS. If detailed' procedures have been prepared, please issue us a copy. If not, please explain why it is not necessary to prepare to use this powerful and potentially dangerous system.

While we commend BECo for going beyond the NRC requirements for mitigating severe accidents beyond the design basis, we require assurances that the system has been implemented properly and that both the utility and the state and local groups are prepared for its use. We have not obtained that assurance from the available documentation.

If you require clarification of this request, please write to our committee, care of the Town of Plymouth, or. call committee member David Dixon at 508-946-1000 during the day.

Thank you, Plymouth Nuclear Matters Committee CC: Ralph Bird, Sr. VP-Nuclear, BECo Plymouth Selectmen Thomas'Murley, NRC-NRR William Russell, NRC Region 1 Richard Wessman, PDI-3/NRR Dan Mcdonald, NRC-NRR Charlie Marshall, Pilgrim Resident Inspector Members of the Nuclear Safety and Health Advisory Committee

e To: Plymouth Selectmen and Plymouth Nuclear Matters Committee Members From: David C. Dixon

Subject:

Request for Information on the PNPS Direct Torus Venting System Date: June 13, 1989 During our tour of Pilgrim last month, Mr. David Tarantino offered to have technical questions about the Direct Torus Venting System (DTVS) answered by the engineering staff. In response, our committee has developed the attached list of questions. They were reviewed and approved by committee during the May 24, 1989 meeting.

These questions have arisen from our study of the DTVS. It is an important issue which has received little public discussion, in part due to its technical nature. This vent releases pressure, and possibly fission products, from the containment durang a severe accident directly into the atmosphere, thus bypassing the inherent safety offered by the steel and concrete protective containment structure. In theory, it is to be used only as a stopgap measure to keep the containment from rupturing, thereby avoiding a more serious, uncontrollable release of fission products to the environment.

There are three main issues in the analysis:

(1) Under what accident scenarios is the DTVS intended to be used, given that for some accidents it helps, some it exacerbates and others it's irrelevant?

(2) Has BECD implemented the concept properly? Has it minimiced the risks of improper use of true vent, such as inadvertent or premature ventino? Are their people trained to use such a powerful tool should it ever become necessary? Is the public prepared to respond?

(3) Has the NRC played its proper role in this modification? Since the modification exists to mitigate accidents beyond the desian basis, the NRC has taken a hands-off approach. Also, if the NRC had maintained its initial assertsons that the DTVS required a change to the Technical Specifications, public hearings could have been necessary.

We are requesting this information from BECo to enable us to issue a more complete report analycing the DTVS.

Answers to these questions will fill in some of the gaps .

DF ( '__ _

i 1

l

7

+ .. ..

.m TOWN OF PLYMOUTH ll Lincoln Street

{ %ge*

\

,e Plymouth. Massachusetts 02360 (617) 747-1620 e

June 2, 1969 Mr. David Tarantino Pilgrim Nuclear Power Stat 2on '

Rocky Hill Road Plymouth, MA 023GO

Dear Mr. Tarantano,

Thank'you for guiding us on the informative tour of the station.last month. The time spent allowed the members of our committee to better understand the operation of the facility.

During the tour, you offered to accept questions of a techn2 cal natur e about the d2 rect torus vent. The comin2ttee has several questions for wh2ch we would like answers before proceeding w2th our review of the DTV5.

The members of the committee believe that the DTVS is a powerful and somewhat controversial tool which could help the plant operators mitagate the effects of a sever e accadent.

We need to acquire a bettes understanding of the system to help us evaluate the benefits and racks of th2s installation. Your wr2tten response- would be greatly apprec2ated.

Should you need to daccuss th2s request for 2nformation, please feel free to call or wr2te to one of our corrrta t t e e members: David C. D2xon, 13S Gunners Exchange, Pl y rno u t h ,

MA. Day phone: 946-2000, ext.2497. Eve phone: 747-09s3.

Thank you again for your help in this matter. If at appear s that that request micht take lo:sper than two weehe to fulfill, please let our commattee know when we traphi expect a response.

52ncerely,

/ *@+ d ( L E 4*t. 77ErL5 Ow.

cc Plymouth Selectmen P1 mouth Nuclear Matters Committee Members W

DTVS1 --

6/12/89. Page 1 QUESTION 1:

Cer tain actione are required to open the outboard containment valve AD-5025. Could you indicate where rthe fuse installation occure to enable power to the DC

. solenoid

• Alco, who har pocceccion of the key for the remote manual switch which opens valve AD-5025?

QUESTION 2:

Certain actione are required to open the inboard containment valve AO-5042B after the automatic containment high pressure trip point has been achieved. Could you descrabe the manual anctallation procedure for the hard wire Jumper? Does thic action occur behind the panel in the control r o o r>, or out in the plant?

DUESTION 3:

The earlier design for the DTVS also had an automatic reclosure of the vent if a high rad 2atson level in the torus vac achaeved (1). Thic is now deleted from the current design (4). Could you indicate why thic cafety element of the dec2gn vac elaminated?

DUESTION 4:

The rupture dick in the vent line ic specified for 30 pc2 ( 3). Yet the containment decign preccure is approximately 60 pri and ultimate rupture preccure of the containment as appr ox2mately 120 psi. Could you explain why the DTVS in 2ntended to operate at such a low preccure?

OUESTION 5:

Are ther e decign basic accadento for which it ic

- calculated that the toruc preccure could exceed 30 pei?

~ DUESTION 6:

In early correspondence v2th the NRC, BECO and2cated that 2nformation on procedural changes accocasted with the modif2 cation for the LTVS would be physicalprovided(plant l). Later corresporedence ic calent on thsc matter. Have procedures cor. trolling the use of the DTVE been completed, revaewed and approved by BECO? Have thoce procedures been reviewed or approved by the NRC? How many and who of the PNPS percennel have been trained and have formally cisned off en the procedures? Can a copy of the procedurec be made available to our committee?

DUESTION 7:

During the March 7, 1988 tour of PNPS by Mr. Russell, Dr.

Murley, and Dr. Thadana, BECO recponded to the questionc goced by sEP.

• the NEC in the2r

• Initial Accessment c1 F21 gram In that presentation, PECO ctrected that the declarat2on of General Emer gency and recommendations for protective actions wall be sesued by BECO early in events which may lead to containment ventang(3). Doet EECO have -

i i

l m_______._____________ __ . _ . . _ . _ . _ _ _ _ . _ _ _ _

I ..

DTVS1 - 6/12/89~ Page 2 1'

l 1

-approved guidelines and procedures in.effect for recommend 2no evacuation of the EPZ in eventc which may lead to containment venting? Have the people in the who are charged to draft emergency action plans been*EPZ briefed on the DTVS and the impact of such early notification and potential evacuataen?

QUESTION 8:

Has-any similar venting system been inctalled and made operational at any other GE Mark I, II, or III facility in the U.S. or elsewhere? Dad, Vermont Yankee proceed with a DTVS? Are there DTVS outcide the U.S. which vent through carbon or gravel beds, resulting in a ground level release on utility property? Are there any DTVS operational which vent through a stack, resulting in an serial dispersion with potentially greater geographic contamination? What are the pros and cons of either arrangement?

DUESTION 9:

We requect clarification of BECO'c act2onc in lacht of the NRC's stated pocationc on the DTVS. In the NRC's anitial asseccment of the Pilgrim Safety Enhancement Program, the NRC was not prepared to endorce the use of the DTVS (2).

Further, the NRC ctated that the installation of an additional branch line and containment asolation valve would require a chance to the plant Technical Specification (2). Thuc the NHC concluded that the installation of the DTVS could not be implemented under the provisions of 20 CFR 50.59 (2). However, the additional branch line and the new outboard containt.ent isolation valve AO-5025 have been inctalled. BECO claims that NRC appr oval ic not required becauce, first, containment ventino has been previously approved in the Bo112ng Water Guidelines, and Reactor second, Owners GroubO25 valve AO- meetc the NECEmergency Operating uirements for a sealed cloced isolation valve as reksnedinNUhEG0800SRP6.2.4 de (3). Could you provide documentation from the NRC which indicates the2r concurrence that the DTVS can be implemented and that such act2on doec not require a change to the Plant Techn2 cal Specificat1onc?

OUESTION 10:

One of'the arguements for the DTVS, that the system offerc "significant im capab112ty (3)"provements

, comes as a surpr2ce relativetotoobservers existangwhovent were not aware that plant for contaiment ventino during revere acc2 dents had been previoucly developed. Could you descr2be the conta2nment ventino procedures which exarted before the implementation of the'DTVS, and how the DTVi offers a significant impr ovement to that system? Had these prior planc ever been approved by the NRC?

O

f, .

z;  :. . . ..

DTVS1 - 6/12/89 Page 3 p' ' ' '

> ,'helpful Supporting to our backup documentation committee such as: which exists would bee Locie Diagrams UFSAR/ Tech Specs-P L ID's Eelevant Procedures Elec. One-Line Diagrams-

~

System Deceriptions Thank you hor:your consideration of this request.

l l

l-l~

l-1

Notes:

1) . R. G. . Bird, Senior Vice President--Nuclear, BECO, 8

LetterdatedJulgroj,1987toS.A.

Div..of Reactor- Varga, ects I/II, NRC, Directori Information Regarding Pilgrim Station Safety Enhancement Program *

2) S. A. Varpm.. Letter dated August 21, 1987 to R.G. Bird

'Init.ial Assessment of Pilgrim Safety Enhancement Program *-

3) S. J. Collins, Deputy Director, Divisien of Reactor Projects, NRC, Letter dated May 31, 1988 to R.G. Dird

'NRC. Region I Inspection Report #50-293/88-12'

4) R. G. Bird, Letter dated August 18,1988 to US NRC, Document Control Desk,

• Revised Information Regarding Pilgrim Station Saiety Enhancement Program

• i' ,

. 1

, e, .-

, TOWN OF PLYMOUTH 11 Lincoln Street Plymouth Massachusetts 02360 (508) 747-1620 t

September 8, 1989 To: Plymouth Selectmen cc: Members of the Nuclear Safety,and Health Technical Support Group Thomas Murley,NRC Charlie Marshall, Pilgrim Resident Inspector From: Plymouth Nuclear Matters Committee This report is a translation, summary, and critique of the 100+ page Augmented Inspection Team report of the April 12, 1989 accident in the Reactor Core Coolant (RCIC) system at Pilgrim.

We hope that these pages elicit a wider public discussion of the accident and provide access to technical information for those unable to study the larger report.

We conclude that this accident was more significant than indicated by the AIT report. Further, that certain aspects of the AIT conclusions were incorrect, the technical analysis was faulty, and the cover letter and executive summary did not reflect the serious nature of the accident as described in the body of the report.

In our review of the available documentation describing recent problems at Pilgrim, the April 12 accident is by far the most serious. Indeed, the number, variety, and degree of errors and malfunctions which occurred could, under probable alternative situations, have caused a far more serious accident, endangering the health and safety of the public.

At a minimum, we are requesting that those authorities uho are responsible for protecting public safety and regulating the nuclear industry at the town, state and national level study this accident and strongly request that the NRC convene an Incident Investigation Team. This higher level inspection team will not only review the details of the accident, but also, from a broader perspective, assess the influence of the regulatory process on the cause or the course of the event.

One of our concerns has already been realized when NRC commissioner Zech responded to Alba Thompson's letter of July 13, 1989, stating, "(the event) was evaluated by the AIT to be of minor safety significance with minimal effect on plant equipment". These conclusions by the NRC must be challenged, for they are not supported by the facts of their own investigation.

r e

Our additional concern is that.now that the enforcement action has been issued, the matter will be shelved; the scrutiny of both specific and generic concerns will cease and necessary corrective actions will.not occur. ,

An annotated version of our report is available for those who wish to study in greater depth the full AIT report. Should further clarification be desired, please write the committee care of the Town, or contact committee member David Dixon and 508-946-1000, ext. 2497, during the day.

Thank you, s8)d Ck.

Plymouth Nuclear Matt rs Committee

' RCIC REPORT -- O/22/89 PAGE 1

SUMMARY

AND COMMENTS ON THE APRIL 12, 1989 ACCIDENT AT THE PILGRIM NUCLEAR POWER STATION PLYMOUTH, MASSACHUSETTS er

Introduction:

On April 12, 1989, during a test of the Reactor Core Isolation Cooling (RCIC) system, radioactive high pressure water backed up into low pressure piping systems, causing damage to equipment and the release of radioactive water and steam into the RCIC Area and the Residual Heat Recovery Area B (RHR-B). The accident was caused by an unantic2 pated combination of errors by several different people, errors in approved procedures, and by faulty valve maintenance.

It was an event which could have caused an " Interfacing '

Systems Loss of Coolant Accident (LOCA)" a scenario where the cooling water leaks out of the reactor. This type of LOCA is particularly dangerous because the containment is bypassed.

Boston Edisen reacted very well to this event and the NRC toch keen interest, dispatching an Augmented Inspection Team (AIT) to study the accident. The types of problems which occurred could have, under credible alternative conditions, caused far more serious consequences.

Yet BECO concluded, and the NRC concurred, thet the accident was not even an " Unusual Event," a classification which indicates merely that the level of safety at the plant had been degraded. More disturbing, the AIT concluded the accident was not a significant precursor to an Interfacing Systems LOCA.

There are many disturbing aspects to the April 12, 1989 accident and the subsequent NRC report. The purpose of th2s summary is to evaluate the accident, and translate the AIT report.

II. What is the Logic System Functional Test (LSFT) for the Reactor Core Isolation Cooling (RCIC) system, which was being performed when the accident occurred?

The RCIC is a safety system which provides another means of supplying cooling water to the core during certain accidents. It backs-up the High Pressure Coolant Injection (HPCI) system, serving a similar function.

However, the RCIC as not taken credit for in the safety analysis of design basis accidents, so it is not considered an Engineered Safety Feature. The purpose of the LSFT is to demonstrate that the RCIC pump shuts off if the reactor water level gets too high, but automatically restarts when the reactor water level drops to a preset low level. The RCIC LSFT (procedure 8.M.2-2.10.11.1) is done every six months, as per the Technical Specifications (TS).

III.What happened before end during the accident on April 12, 1989?

Prior to the accident,this Prior to the accident, was supposed to happen: this happened:

l All involved ersonnel This was not done.

were to have een briefed l

l

4, .

n 4 . .

- . . ' {

RC2C REPORT - '0/22/89 PAGE 2 on this infrequently done procedure.

f The control room operator Evidently done-correctly sets the position of.eight The report does not valves, actually changing indicate problems.

two of them from closed to open.

An operator was to position. Of the seven, six were the carcuit breakers for the positioned wrong, and D. C. power to seven motor one valve, not even part

' operated RCIC valves, either of the test, was turned on or off, and put tags on off because.of a typo in the circuit breaker handles. the procedure (1301-17).

A second operator is to The two operators had check the work of the done the tagging first operator, together, and apparently did not check each others work.

The Instrument and The I&C technician Control technician, who signed the sheet.

was. running the test, was to review / inspect and accept the tagging, and sign the tagout sheet.

The control room operator They did not observe the and the I&C technician problems indicated on should have seen from the graphics panels.

the graphics panels in the control room that the valves were not set up correctly for the test The logic test was then begun, involving the lead IEC technician, the control room operator and two other ILC technicians at a control panel in another part of the plant. Durino the test, a restart of the RCIC is simulated, buE with. power to the RCIC pump blocked off.

But since the RCIC pump discharge valves 1301-49 and 1301-50 still had power to their actuators (incorrectly),

they opened. Since the upstream side of those valves was not pressurized, water backed up into the RCIC pump and the RCIC pump low pressure suction piping. Check valve 1301-50 is supposed to close, prohibiting flow in the upstream direction, but it could not, because it had been materiel p(reviously Furmanite),temporarily repaired with an injectedand when the valve had been subsequently later overhauled, some of the Furmanite was leit on the valve stem, prohibiting its closure. Hot, high pressure water thus backed up in the system damaging some instrumentation, opening a relief valve, and causing thermal and pressure shock to the RCIC system. The relief valve spewed radioactive water and steam into the RCIC area, and since the floor drains are connected, the Residual Heat Recovery (RHR-B) area was also contaminated with radioactive water and steam.

IV. What went wrong?

The personnel did not follow procedures for the RCIC LEFT

b RCIC REPORT -- 8/22/89 PAGE 3 and did not follow procedures for positioning the valves or for tagging circuit breakers. p The control room operators did'not recognize nor correct the problems shown on the system graphics panels.

Ultimate responsibility lies with these senior individuals, who failed, in this instance, to perform their duties.

The k'owledge n available from a similar 1983 accident in the High Pressure Coolant Injection system was not incorporated into plant documentation.

Even though the written, approved LSFT procedure conta2ned a critical error, somehow the error had gone undetected during previous, supposedly uneventful L5FT's.

The control of the Furmaniting procedure was poor, as vac the subsequent check valve overhaul.

When valve 1301-17 was tagged out in the open posit 2on, the plant lost redundant containment isolation, an violation of the Technical Specifications.

requires notification under .OCFR 50.73 and possibly the This in itself declaration of an Unusual Event.

It is unclear to both BECO and NRC whether or not the check valve 1301-50 is a containment isolation valve, and if so, that it should be leak tested as such. The AIT tabled this issue to ' future FSAR revisions'.

It may have been discovered that the leak testing procedures for the check valve 1301-50, and other check valves at P21 grim and elsewhere,perhaps do not for indicate the valves actual leakage when installed. Further study is pending.

V. How did BECO respond?

The Augmented Inspection Team's report indicates that the BECO immediate response was appropriate and timely.

Specifically,he response to t eventthe wasradiological protection organization'e prompt, efficient, and thorough.

Eleven people were slightly contaminated.

After the event, BECO formed three investigative teame, led by an overs 2ght group: a team to evaluate the effects on the RCIC system, a team to detail the accident, and a peer rev2ew.

VI. How did the NRC respond?

The NRC's William Russell, Region 1 administrator, initiated the Augmented Inspection Team on April 13, 1989.

Their report was published May 8, 1989. The AIT as NRC's second-level events investigation, the first level being an Incident Investigation Team (IIT). It should be noted that the convening of an AIT for an event deemed by the licensee to be less significant than the lowest level Emergency Action Level - ' Unusual Event" --

possibly indacates that the NRC felt that the event might have been more sersous.

Perhaps the reason the NRC took great inter est in the event, was the possibility that this accident involved an

Vs p (- g y n ., .q: ,

"y~ ,~

.._ ..m. ,

CCIC: REPORT -- 8/22/89 PAGE 4 1 1 i

', l

' Interfacing Systems Loss of Coolant,- or was a sig'nificant precursor event to an Interfacing Systems Loss 02: Coolant i Accident (Intersystems LOCA 3- j Criteria which exist-within the NRC'for the' determination ~

of a significant event are:

1 i

1. Event sequence not previously analyzed or;could l f-' be far more serious with credible alternative conditions. -

{

l

. 2. System interaction resulting from a previously unrecognized interdependence of systems and components.

3. . Improper operation, maintenance or design that-has.or could cause. common cause, common / mode ,

failure.of a safety system. i

? 4 '. - . Unexpected system or component performance with serious safety implications or radiation release.

5. - Multiple. failures (including personnel errors) occurred in the event.  ;

6. Equirient failures (particularly non-safety  :

equitsnat) that caused serious transients.and  !

challenges to safety system.  !

'A case can'be made that all of these conditions were met.

The April 12, 1989 accident at Pilgrim was very j significant. .j If the AIT report is studied closely, other problems are uncovered which are-not discussed in the cover letters, executive sume3 ries, the Licensee Event Report, or the a news summaries. First, it is not known for certain when j the event terminated, or when the the release stopped.  ;

Second, it is not known how much water backed up past the  ;

check: valve ' 1301-50. Third, it is not known what pressure j was seen by the RCIC pump or suction pipino. Specifically, i the logic used to arrive at a figure of 400 psi was incorrect. The fact that the pressure switch 1360-22 was not ruptured does not indicate that the pressure remained below 600 psi. Rupture of the switch can occur in a range of 900 to 2000 psi, and is a ver what pressure actually occurred.yFourth unreliable indicator oi duration of the release is unknown and tbesince the pressure of the piping is unknown, the amount of water released by the relici valve is also unknown. The "approximately 100 gallons

• referred to in the AIT report is optimistic guessang.

9II. What is an Interfacing System LOCA?

In NRC's words,"Recent BWR operating experience indicates that the pressure isolation valves may not adequately protect against overpressurization of low pressure systems. This overpressurization may result in the rupture of low pressure piping. This event, if combined with failures in the emergency core cooling systems (ECCE) and other systems (eg. feedwater) that may be used to provide makeup to the reactor coolant system, could result in a core melt accident with the possible release of

_ = _ - - _ .

. l

- lRCIC-REPORT -- O/22/89 PAGE 5 i

fission products outside the primary containment. Some.

ECCS failures-may rupture:and/or be the directeffects.'

its environmental. result of the ingial This type of accident, it should be emphasized, is very critical because it bypasses the containment and it 1 bypasses emergency preparedness. It is a ' hot

• topic in j Nhc circles (see attachments). Two recent Interfacing  !

Systems LOCA precursors have been scrutinized: a January 20, 1989 accident at Arkans.es Nuclear One Unit 1, and a March 8, 1989 accident at Vogtle Unit 2.

the NRC recently issued, Furtherboiling LOCA: Water Reactor' as NUREG 5124' Interfacing (see Systems attachment). This report is mentioned-in the AIT report, 1 but it is unclear whether the AIT report is accurate. The AIT report indicates that BECO complies with the recommendations of NUREG 5124. However, BECO's Technical Specifications require an RCIC LSFT every six months and one of NUREG 5124's main conclusions is to perform this test only at shutdown, when the reactor is depressurized, in order to reduce the chances of an Interfacing Systems LOCA. For BECo to comply with NUREG 5124, a change to the Technical Specifications would be required.

-VIII. Was the April 12, 1989 accident a potential precursor to I an Interfacing Systems LOCA 7 The AIT report argues that there were several isolable barriers in place to avoid an intersystems loss of coolant: the check valve 6-58A, the check valve 1301-50, and the two block valves 1301-49 and 1301-48. First, check valve 6-58A is a 'feedwater check valve" which is known for frequent failures. In particular, leakage test results for Valve 6-58A are very poor. And based on past history, if a leakage test were done toda it is likely that it would fail. Next..relyingon1301-bo, is questionable because it is not certain that the valve e5'er closed during the accident. Finally, valves 1301-48 and 1301-49 were involved in multiple personnel and administrative errors: they were incorrectly described an the LSFT procedure, they were incorrectly tagged, improperly verified, and not observed properly in the reactor control room. To base the analysis on the adequacy of these valves, is overly optimistic.

The AIT used a variety of narrow criteria to avoio concluding that this was a Interfacing Systems LOCA. Yet the NRC has recently said that that type of analysis is not proper and does not help achieve the goal of reducing the vulnerability of nuclear power plants to Interfacing System Loss of Coolant Accidents.

IX. Could it have been worse?

There are many credible alternative conditions which would have made this event much, much worse:

--The level. plant could have been operating at a higher power

--Check valve 6-58A might not have been able to prevent backflow.

--Check valve 1301-50 might have stuck 40 or 60 degrees

RCIC REPORT -- 8/22/89 PAGE 6 e

off its seat, rather than the accumed 15 degrees.

--the operators might not have concluded that the correct action to take was to close valves.48 and 49. After all, these valves were supposed to have been closed, tagged, with power removed from the motor operators, making them' inoperable from the reactor control room.

--the low pressure piping could have ruptured.

--the steam release could have degraded the environment at both the RCIC and the RHR-B to the point where these systems would not be available to help maintain adequate coolant level in the reactor core.

The AIT report did not include an evaluation ci the potential consequences of credible alternative conditione, an important step in a well executed analycas of this potentially disastrous event. It is not known why. The analysis by the AIT did not even share the concern evidenced by BECO's conclusion that, ...the errors and programmatic deficiencies noted could have caused significantly greater problems under other circumstances.

Therefore, this event should continue to be treated ac ,

significant." '

X. Several things need to happen to resolve the issues raised by this accident:

The check valves 1303-50 and 6-58A should be leak tected.

The RCIC LSFT should be redone (procedure 8.M.2-2.10.11.1)

The RCIC damage evaluation should be closely reviewed by independent technical experts.

The design problem concerning the placement of the check valves and block valves should be resolved.

Analyze the NRC enforcement actions for appropriatenecc.

Resolve the classification problems, and accociated ,

testing requirements for the check valve 1301-60. I Review BECO's compliance with NUREG 5124, and change the l Technical Specifications as required.

Convene the higher level NRC events invest 2gation, the  !

Incident Investigation Team (IIT). The difference from ,

this and the AIT is that the IIT is broader in scope, and includes an evaluation of the influence of the regulatory process on the accident. This serious request is mace necessary by the type and degree of error in the AIT analysis, the continual problems which are occurring at Pilgrim during the ongoing power ascension program, the ,

vider implications of the root causes of this accident for  !

management of the facility, and the closer scrutiny required by a facility which is one of the worst in the nation, by ceveral objective meacures. .

l XI. Conclucione ]

The April 12, 1989 accident at Pilgrim hac serious j implications which were not thoroughly evaluated nor

( objectively reported in the NBC's Augmented Incpection Team repor t. It could have been much worse.

l' ,

3

. . j

.> i RCIC REPORT -- 8/22/89 PAGE 7 i-i l

The character and number of causes of this accidelht may be unprecedented and are deeply disturbing. Further NRC investigation is warranted. Independent assessment of certain technical aspects is also warranted.

Furthermore, when this accident is viewed in light of the other' problems which are occurring during the power ascension, the SCRAMS, the maintenance and design problems, the unresolved va'1ve actuations, the equipment failures, the personnel errors, etc., it seems prudent to question whether the intense pressure to get Pilgrim back on line is contributing to an unsafe situation with potentially disestrous consequences.

l II

^

1

,6 1

0 1

- N 9 3 0 O

- 1 I

7 1 S L

~ 1

- N S EO 1

E 0 O I 'ne L T RO S L PT 1

S o s

r Ro I

Tn P P P

EO e -

jy/ 7 H U RO e T

S 6 PP v v >

P - oi y

1

\ Gv 1g-0 9

1 1

0 3 o 1 '3 D E

i 1 N S s

p 3- E O 1

0 P L a 3 O C 1

E

\b V N -

L r 6 2

21

@ >A B f

3

\MAP 0 3

1

,u T

)

EP r TU o s

SS /

F 2

• E 2- o T 7 AE .

1 1

SG K  !^T o S

DOT AN

.RA 7

Mi /  ;

oc" n N wh g O NT n y I OS y S C c^ ] f, 0 S L o

T p 6- EO 2

g 1 0, RO R g 0 ,

E \[/

E 6-1 .,

3 1 ff- PP P S

y3 U 0 1 RN T 4  ! S AEA SP 1

e 8

4-BD }- j o 3 E

N & NM c 4

1 0

5-T EU AE 1

O [/ 3 0 C D N

P F 1

SG K V^3 1

O u d NA N C s O 9 e ER A S

t j.

R i v

n DOT F

4- DE ei c NT M A 1 E T s ed r e OS 0

EA E P2O C e r W 3 1

FWk. l vt ou anq i

T 1 O v 2r e S .EP U1 E 1D 0 R \r s A r.

y r6 os R 1.E f 1 a 5-Y NE T U0M 1

1 l

0 A

2 n0 o3m S LSD 4 0 b' 3 0 l I

1 5 i t 1 o E21.R u 2 1 l

7 j6 2 ado cn r C V NC 2 OFE i - i 1

<V 6 daf I

C .. C V n0r

i6 nt toa C LA HE RO M..RE w R

\

8 Enop Te 0c O p3 1

e R VWP8P i h

5 NO1 ints flllIi!

,

• PRY 17 '89 09:50-

.., P.3/6

• ~

- i' h UREG/CR-5124 E NL-NUREG-52141 4....,._.,~ ,, ,

Interfacing Systems LOCA:

Boiling Water Reactors I

Manuscript Completed: February 1988 '

Data Published: February 1989

. Prepared by . . .

T-L Chu, 6. Stoyonov, and R. Fitzpatrick Contributors J. Lahner, Appendix E A. Tingle, Appendix 1 Brookhaven National Laboratory Upton, NY 11973 Prepared for Division of Safety issue Resolution Cffice of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington. DC 20655 NRC FIN A3829 i

I

_______.______________._______.______-_________._____________-.__.._m._ ____ _

W . MAY 17 .'89 89:A9 UCS !#1SHINGTON, DO P.24 MURLEY LAUNCHES STUDY OF RISK OF INTERFACING SYSTEMS LOCAs Thomas Murley, director of NRC's OfAce of Nuclear Reactor Reguladon, has launchod a program to confirm that probabilisde risk assessments (PR As) accurately renect the low probability I hat an inurfac-ing systems loss of coolant accident (LOCA) will lead to severe core melt accidents with signi6 cant off.

alte reinassa.

V sessor N.a.C.- AprU to,1s# s Murley initiated the effon because he is skepdcal of PRA data that uniformly shows the chances of asvare core mehs prompted by interfacing systems LOCAs are low. "I have to be frank." Murley told abe Advisory Committas on Reactor Safeguards (ACRS) April 6. "I am not believing the tumbers. The numbers are telling us that...intersystem LOCA is not a problem. I shouldn't any I don't klieve it. I say I'm akeptical, so we'st going to start sking some actions."

(identi6ed in the 1975 Wash.1400 reactor safety study, and was labe Murley said precursor events to the inersymem LOCA scenano-including the 1937 a vent at the West German Biblis A PWR.-. concerned him and prompted him to initiate the NRC revie u program (INRC,5 Dec. 'g3,1). Under the sequence, failure of the check valves separating the prire ary circuit

{

from the low pressure injection system pardon cf the emergency core cooling system couM result in a '

LOCA that suddenly discharges into the low. pressure system and bypasses containment.

The NRC initiadve was only about "a week old" when Murley addressed the ACRS, a nd he said he doesn't andelpate requiring any specl6c industry inidadves at this time.

"The goalis to have high confidence-end I stress that high con 6dence-4 hat the prot sbility of an interfacing systems LOCA, which could lead to an unisolab!c LOCA outside comainment, is less than acn to-ths.minus six per year for each plant in the U.S. "Murley said. Murley added that fiRC hopes to wrap up the review in about a year, and that the agency may, depending on the outcome of the review, secommend changes to industry training prognms to see whether they can be improved so that operators w111 be "sensitiud" to the algni5cance of the long postulated accident sequence.

/ At reactors that have experienced precursors to the sequence V event, "the operators..s ildn't know

( bow close they had come or what the rami 5 cations were of the situation, so we think the w hole indus:ry as well as NRC has to be asnsidad." Murley said.

"This saquence is important in my judgment because it bypasses the containment and h bypasses amargency preparedness," Murley said in defending his decision to move forward whh the iniciadvs. "It affectively bypasses two levels of our defense.in. depth safety philosophy under the worst oircumstan-oss," Marley said. "The worst circumstances (are) that you have a break out in the RHR (a psidual heat removal) system which then causes you to not only lose coolant but to lose at! your safety :njecdon '

capability, and which u!dmately then leads to core damage and core meltdown to an open c ontainment.

"That goes straight to the atmosphere and it can happen in a shon time," he added "The worst time calculadons that I've seen can lead to core uncoverage in a half hour, core damage in 45 m notes, and off site doses la the 100 rem range in an hour or hour and a half. So !!'s the importance of Aar sequence that caused me to consider taking another look as it. I have no tvidence that the probab!!ity ofit happen.

ing is higher than what is said in the PRAs, (but) I'm starting to see these precursors, so rat ur than uke the FRA results at face value,I'm going to be a litde skeptical,just because of this sequene e and its con.

sequences."

Murley rcjected suggestions by ACRS members that the sequence V scenario be consid ved as part of the Individual Plant Examinations (IPEs) that NRC has required of all U.S. nuclear facil; des.

"I think h's just going to overburden IPE," he said. "ZPE was never meant to be the vehicle to resolve allissues associated with severe accidents. If we were to ask licensees to lookmt atVeras pan of their ZPEs, three years from now we would get back something that I almost guarantae m ouldn't be worth anything. I don't think they have the methodology (that) would be good enough (so) Aat I would be satis 6ed and I also don't want to wait for three to ove years."

Last year, when details of the 1987 Biblis event surfaced. Murley sa4 the agency was e >nsidenr:g the need for further guidance on the issue.-Cave Airoso, Washington Sn NMi%& 57M /uE Of wh der

- (NAY 17 '99 09:51 UCS WASHItCTON, DC ~ P. v6

-si-1 EXECUTIVE SUMKARY  !

This study was performed by the Risk Evaluation Group, Deparcqent of Nucle-at Energy, Brookhaven National Laboratory for the Office cf Nuclear Regulatory j Research, Rasctor and Plant Safety Issues Branch, Division of Raaetor and Plant i Systems, U.S. Nuclear Regulatory Commission. The objectives of this study are to investigate the vulnerability of current boiling water reactor (BWR) designs to an interfacing systems LOCA (ISL), identify any improvements that would sig-afficantly reduce the frequency of !$Ls, determine the cost-benefit considera-I tions thereof, and determine the effects and the cost benefit relationship of instituting leak testing programs of the pressure isolation valves for those (plants that do not currently have such a requirement.

This study is based upon the detailed examination of three plants (Peach Botton, Nine Nile Point 2, and Quad Cities) with the goal of taking the plact-specific findings and extrapolating the results to aid in the reso12 tion of NRC

( Generie Issue 105.

Racent NWR operating experience indicates that the pressure is 21stion valves may not adequately protect against overpressurisation of low pressure systems. This overpressurization may result in the rupture of low pressure piping. This event, if combined with f ailures in the emergency cor t cooling

.f i-t systema (ECCS) and other systems (e.g. feedwater) that may be used to provide

'~ 4 makaup to the reactor coolant system, could result in a core melt a:cident with the possible release of fission products outside the primary containment. same ECCS failures may be a direct result of the initial rupture and/or Lts environmental affects.

One of the primary goals of this study was to determine the co st-benefit relationship associated with requiring plants that do not currently have Isak testing requirements on their pressure isolation valves (PIVs) to institute such a program. E0 wever, all of the reference plants already have vario2s require-ments reisted to leak testing. Therefore it was decided that since none of the reference plants represented a true " base case" model in this area in additional base case model would have to be created. The base case model was taken to be the Peach Bottom model with the PIV leak testing aspects removed. temoving the leak testing benefits from the Peach Bottom model resulted in a large increase in predicted core damage frequency due to ISL. Based upon the resu Lts of a separate sensitivity study, it appears sufficient for the leak test Lng progra:

to include provisions such that leak testing be performed at each r efueling as well as af ter individual valve maintenance. The risk-based benefit  ; calculated for this leak testing program show that such testing schemes are co st affective.

In addition, the offsite risk-based cost-benefit considerations for the suggested testing program were calculated to be fully cost effectiv t whether or not the brosk in the low pressure system was assumed to be submerge i under water. A submerged break would result in trapping of some of the a trosol fis-sion products in the water and thus lower the predicted offsite con sequences.

The results indicate that in spite of uncertainty in predicting fission product release the benefits in risk reduction outweigh the cost of impleme iting such a leak testing program.

- . - - - - - - - - - - - - - - . _ - - - - - - - - , - - - - - . - ---A

^. ',itW 17 '99 09!G1 UCS WGHINGTON, DC '

P.5/6

~

-xii-N The insights from this study fall into two basic categories. The first category deals with assuring that the pressure boundaries are intact prior to increasing reactor pressure and the second category deals with how tt avoid placing the plant. unnecessarily into a acre vulnerable mode of plant operation.

Table 1 provides'a convenient collection of.the pertinent core damage frequen-cies (CDFe) presented throughout this report. The table will be user to facilitate comparisons and derive insights.

The first category above is addressed by PIV leak testing provisions. From Table.1, " Peach Bottom (no leak testing)" represents an analysis whenein the Peach Bottos model was stripped of all credit for its current leak testing prac-tices. " Peach Botton (current)" refers to the Peach Bottom plant as found and modelled. "Pesch Bottom (with leak testing)" reflects the minimum isak testing provisions derived from this study (i.e. leak testing all air-operate d check valves at each refueling and individually after maintenance). Comparing the "no-testing case" to " Peach Botton (current)" shows that the existing level of

. leak testing has stready reduced the Peach lottom CDF due to ISLs by an order of magnitude. Comparing " Peach Bottom (current)" to " Peach Bottom (with leek testing)" shows another order of magnitude reduction is still available. A significant benefit (similar to that derived for Peach Bottom) for such a leak testing program is expected to hold across the BWR population.

The second category of insights is addressed by changing current testing practices. These testing practices can be almost as significant as implementa-tion of a leak testing program, however, they are quite plant-specific. The dominant example from this study is found at Nine Mile Point 2 (NMP). By courparing the two MMP-2 entries in Table 1, there is apparently more than a two f order of magnitude decrease in the CDF for ISL available by prohibiting the currently allowed practice of stroke testing the valves in the steam :ondensing lines to the ENR heat exchangers (with the reactor pressurized) and allowing the j

stroke testing to avait a convenient shutdown (with the reactor depressurized).

A second example of significant testing-induced risk can be seen by compar-l ing " Peach Bottom (current)" with " Peach Sottom (logic test at shutdo m)" f rom Table 1. This is the single most effective corrective action identifLed for the Peach Bottom plant in reducing core damage frequency. Current Peach bottom testing requirements include the provision to test the ECCS logic every six sonths independent of whether or not the reactor is pressurized. By solding off en the ECCS logic system functional test until a reactor shutdown com ts along.

(i.e., the reactor is depressurised), the ISL COF can be reduced by a ;most an order of magnitude.

In summary, the results of this study show that institution of a minimum icek testing program for the air-operated pressure isolation check va'ves .

represents a significant reduction in the estimated ISL CDT for the three plants studied, which should apply across the entire BWR population. In addhtion, it has been shown that some of the current SWR testing practices can also represent a large contribution to ISL CDF and that this testing-induced risk is easily rosoved by rather simple and cost-effective changes to existing testiog procedures (as discussed directly above).

( ._ . . . .

UCS WASHINGTON, DC J .[. f1AY 17. ',89 098.52 P.6/6

-xiii- .

l l

l l

V .

Table 1 l Summary of Estimated ISL CDF vs. Plant States

, Plant State CDP / Year )

Peachlottom(Noleaktestin5) 1.86E-5 .

Peach Bottom (Current) 1.02E-6 Peach Bottom (With leak testing) 1.97E-7 Nine Mile Point 2 (current) 8 81E-6 Nine Mile Point 2 (With all fixes) 3.22E-8 Peach Bottom (Logic test at shutdown) 1.21E-7 1

l

_ _ _ _ _ _ _ _ _ - _ _ _ _ - _ _ _ - _ . - - - - - - - - - - - - - - - - - - - - - -