Text

Forwards Draft NUREG/BR-0051, Power Reactor Events, Vol 8, Number 1 for Mar-Apr 1986.Comments & Review by 861031 Requested
	ML20214J794
Person / Time
Issue date:	10/21/1986
From:	Heltemes C; NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:	Grace J, James Keppler, Murley T; NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I), NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II), NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
Shared Package
ML20214J230	List: ML20214J228; ML20214J794;
References
	RTR-NUREG-BR-0051, RTR-NUREG-BR-51 NUDOCS 8612010464
	Download: ML20214J794 (51)
	v • d • e

. ,-

OCT 21191m MEMORANDUM FOR: Thomas E. Murley, Regional Administrator, Region I J. Nelson Grace, Regional Administrator, Region II James G. Keppler, Regional Administrator, Region III Robert D. Martin, Regional Administrator, Region IV John B. Martin, Regional Administrator, Region V FROM: C. J. Heltemes, Jr. , Director Office for Analysis and Evaluation of Operational Data

SUBJECT:

DRAFT POWER REACTOR EVENTS, VOL. 8, N0. 2 (MARCH-APRIL 1986)

Enclosed for your review and comment are two copies of the draft Power Reactor Events, Vol. 8, No. 2, which covers the March-April 1986 pericd. We found your comments on Vol. 8, No. I to be very useful. We would appreciate your reviewing the enclosed draft with regard to the content and degree of detail in the event summaries, as well as in the LER excerpt and document listing / abstract sections.

As always, your suggestions for possible events or future improvements to Power Reactor Events are encouraged, particularly if they apply or will increase the usefulness to plant staff. Comments on this issue are needed by October 31, 1986, and may be telephoned to Sheryl Massaro at FTS 492-4493 or Jack Crooks at FTS 492-4425, or mailed to me at the above address.

ihapuseyedW

e. A em a nu m a C. J. Heltemes, Jr. , Director Office for Analysis and Evaluation of Operational Data

Enclosure:

As Stated cc w/ enclosure E. Brach, DEDR0GR Distribution:

PTB SF JCrooks PTB CF MWilliams AE0D SF FHebdon AE0D CF CHeltemes SMassaro APDR m 0FC :PTB PTB :C/PTB :0D/A.IOD :D/A : :

-_--_:_ --_ 4_______::-- e ----_: . __ -- --:--44.-__--__:_ ___---_:--_---------:--__-______

NAME :SMassaro rb :JCr :MWil i s :FHebdon: :C mes :

:__-h/86 DATE :10/ :10/@l/86 :10/h8 :10/r7/86 :10/486 : :

0FFICIAL RECORD COPY 8612010464 861021 PDR NUREG BR-0051 R PDR

DRMI Nuatciea-oo5, Vol. 8, No. 2

/Q.....,United PC'WER REACTOR EVENTS Q .....

/ States Nuclear Regulatory Commission Date Published:

Power Reactor Events is a bi-monthly newsletter that compiles operating experience information about commercial nuclear power plants. This includes summaries of noteworthy events and listings and/or abstracts of USNRC and other documents that discuss safety-related or possible generic issues. It is intended to feed back some of the lessons learned from operational experience to the various plant personnel, i.e., managers, licensed reactor operators, training coor-dinators, and support personnel. Referenced documents are available from the USNRC Public Document Room at1717 H Street. Washington, D C. 2055s for a copying fee. Subscriptions of Power Reactor Events may be requested from the Superintendent of Documents. U.S Government Printing Office, Washington, D C. 20402, or on (202) 783-3238.

Table of Contents Page 1.0 SUMMARIES OF EVENTS.............................................. 1 1.1 Failure to Isolate Reactor Coolant System from Residual Heat Removal System Due to Leakage of Primary Containment I s olat i on Va lve s at P i lgr im. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Out-of-Sequence Control Rod Withdrawal Due to Series of Operator Errors at Peach Bottom Unit 3......................... 6 1.3 Loss of Shutdown Cooling Due to Improperly Functioning Water Leve l Ind icators at San On of re Un it 2. . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.4 Plant Shutdown Due to Leak in Pneumatic Supply to Automatic I Depressurization System Valves at Grand Gulf Unit 1. . . . .. . ... .. 18 1.5 Weld Failure on Pipe Support Structure Due to Improper Design at Palo Verde Unit 1........................................... 20 1.6 Update on Emergency Diesel Generator Engine Problems at North Anna.................................................. 24 1.7 Update on Failure of Automatic Sprinkler System Valves to Operate at Grand Gu lf Un it 1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 1.8 References....................................................... 31 l 2.0 EXCERPTS OF SELECTED LICENSEE EVENT REP 0RTS...................... 32 3.0 ABSTRACTS / LISTINGS OF OTHER NRC OPERATING EXPERIENCE DOCUMENTS... 41 Editor: Sheryl A. Massaro Office for Analysis and Evaluation of Operational Data U.S. Nuclear Regulatory Commission

, Period Covered: March-April 1986 Washington, D.C. 20555

. _ . _ _ _ _ . - - - _ - _ _ _ _ - _ . a

o 1.0 SUMMARIES OF EVENTS 1.1 Failure to Isolate Reactor Coolant System from Residual Heat Removal System Due to Leakage of Primary Containment Isolation Valves at Pilgrim On April 4 and 12, 1986, the Pilgrim

reactor scrammed from low power during routine reactor shutdowns. Both scrams were caused by unexpected Group I**

primary containment isolations. In both cases, the isolation signal was promptly reset, but the four outboard nain steam line isolation valves (MSIVs) could not be promptly reopened. As a result, the main condenser was not avail-able as a heat sink during a portion of the reactor cooldcwn. A shutdown on April 11 was initiated because the residual heat removal (RHR) system had been pressurized by leakage of reactor coolant past a check valve and two closed injection valves in the B RHR loop. An Unusual Event was declared because of the RhR valve leakage, and a controlled shutdcwn was initiated. While shutting dowr., an unplanned reactor scram occurred on April 12, and the outboard main steam isolation valves failed to open fully on demand. These events are detailec below.

At 1:00 p.m. cn April 4,1986, a reactor shutdown was initiated after oil leakage was detected in the main turbine control oil system. The low pressure coolant injection (LPCI) system was considered inoperable at the time due to the unrelated problem of water leakage past a block valve, M0-1001-36A, in the RHR systen torus cooling line.

At 8:15 p.m. on April 4, a Group I prwary containment isolation (resulting in a reactor scram) occurred as reactor pressure decreased to 898 psig in the shutdown sequence. The two low main steam line pressure alarms (set to

Pilgrim is a 670 MWe (net) NDC General Electric BWR located 4 miles southeast of Plymouth, Massachusetts, and is operated by Boston Edison Company.

- Group I: main steam isolation valves, steam line drains and reactor water sample lines.

o o

approximately 880 psig) were received at the time of the isolation. The containment isolation signal was promptly reset following the scram; however, the outboard MSIVs could not be reopened for approximately 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months . The inboards MSIVs were opened during that time period. As a rcsult of the closed MSIVs, most of the subsequent reactor cooldown was contrciled by directing reactor steam to the high pressure coolant injection (HFCI) turbine. The HPCI system was operated in the test mode and did not inject water into the reactor.

The reactor mode switch had been moved from the "run" to the "startup" position 45 minutes prior to the isolation. The low steam line pressure containment isolation function is active in the run mode, but is bypassed when the mode switch is placed in the startup mode. During the review of this event, the licensee concluded that all the. contacts in the reactor rode switch did not clcse properly when the switch was transferred from the run to the startup mode during the shutdown. As a result, the low pressure containment isolation fur.ction was still active when steam line pressure dropped below the trip setpoint (about EE0 psig). The licensee determined that proper positioning of tFe mcde switch rcouired removing the key from the switch each tine it was rcved to a di#ferent mode. Training for all Control Room Operators on proper mode switch operation was conducted prior to the subsequent reactor startup.

The licensee also concluded that an air leak in the A outboara MSIV, A0-203-2A (coupled with repeated attempts to open the valves) probably lowered air pres-sure to the four outboard valves, preventing them from fully opening. The air leak was attributed to foreign materials in the MSIV pneumatic control valve.

The evaluations of the rede switch and MSIV problems were reviewed by the licensee's Operational Review Committee on April 8, 1986. The reactor was restarted at 2:46 a.m. on April 10, 1986.

Periodic RHR system high pressure alarms (400 psig) were received on April 10 and 11, indicating that the RHR system was being pressurized by reactor coolant leakage. The RHR piping in the B loop was warm, indicating the let'. age was coming through the normally closed injection valve, M0-1001-29B, and an inline 2

6 1

l

) 450 psig i n 1f "*O .

Ak 2

! 1001-28B

' 1250 psig us y _

l 'U E 1001-68B -

i Q O 0 '

1001-338 i

]

l':'

a;;;ib\ Primary Containment

' " Recirculation ~ ~g Loop A

, 1001-66D

. ~

1001-67D LO i

RHR Pump l P-203D LA r7

\ 1001-16B l RHR Pump i P-2038 1001-66B U N 1001-67B X-LO l

Figure 1 PILGRIM RHR LOOP B (Original Condition)

SIMPLIFIED RHR DIAGRAMS

o check valve, 1001-688. (See Figure 1.) At 2:16 p.m. on April 11, a second B locp injecticn valve, M0-1001-288, was closed in the RHR system in an attempt to stop the leakage. The low pressure coolant injection (LPCI) subsystem of the RHR system was declared inoperable at that time. However, leakage con-tirued into the RHR systen, causing a high pressure alarm 2.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months later. At 4:53 p.m. on April 11, 1986, a reactor shutdowr was initiated from abcut 92%

power, and an Unusual Event was declared due to the leaking valves.

At 1:56 a.m. on April 12, a Group I primary containment isolation (with an associated reactor scram) occurred during the shutdown sequence. Reactor pres-sure was 908 psig at the time of the isolation. The mode switch had been moved fren the "run" to the "startup" position, and the key had been removed from the mode switch 20 minutes earlier, at 1:36 a.m. The isolation and scram occurred atcut 30 seconds after the two main steam line low pressure alarms annunciated in the control room.

As before, the cutboard MSIVs could not be opened for approximately 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after the isolation signal was reset, anj the HPCI systen (in the test mode) was used to cool the reactor. The reactor was placed in cold shutdown and the Urusual Event was terminated at 9:08 a.m. on April 12, 1986.

During the period between April 13 ard April 19, 1986, extensive RHR system walkdowns and isolation valve leak measurements were conducted. A special water leak rate test was designed that would simulate reactor water pressure en the reactor side of valve 68B (Figure 1). The test was conducted to determine the amount of water leakage associated with the as-found valve condition. Thus the leak rate of the check valve 68B, the closed gate valve 29B, and the closed globe valve 288, in series with one another, was to be determined. In addition, the test continued until pressurization of the RHR piping was achieved and the RHR Hi alarm sounded in the control room. Each segment of piping between the isolation valves and between valve 28B and the RHR pump check valve was monitored for pressure.

The test was conducted on April 17, 1986. The normally locked open manual valve, 338, near the reactor was closed and water was pumped between it and valve 688. The pressure between valves 338 and 688 was increased to 300 psig.

4

Q The technician found it difficult to hold pressure constant. At one point, the pur. ping was stopped completely for several minutes and then varied between ten j and 20 strokes / minute. An air-operated positive displacement water pump was used. It became apparent that es the technician increased pressure, valve 68P be:are an effective barrier until such tire as the pressure difference across the valve equalized, after which the valve had no affect. The pressure was increased to 600 psig and then to 950 psig. It was held at 950 psig for 95 minutes, at which time the RHR Hi alarm sounded in the control room. During this period the average pump flow rate was about 0.5 gpm.

The root cause of the RHR Hi pressure alarms was the approximate 0.5 gpm water leak past the loop B RHR isolation valves in conjunction with apparently rela-tively leak-tight RHR pump discharge check valves. This condition caused a build-up in pressure in the intervening pipe segments to about 390 psig, resulting in the alarm. There was no indication that the potential existed for sudden failure of all three isolation valves and resultant sudden overpres-surization of the RHR piping. No root causes were found for the spurious primary containment isolations on April 4 and 12,1986, despite considerable licensee investigation.

Or. April 12, 1986, the NRC sent an Augmented Inspection Team (AIT) to Pilgrim tc review the events in depth. The AIT determined that the licensee did a thorough job in evaluating the LPCI injection valve leakage and recurring RHR pressurization events, and that the low leak rates which were measured did not pose a safety problem. However, continued power operation with the recurring pressurization of the RHR piping and the resultant RHR alarm was unsatisfactory because (1) an operator's attention is frequently drawn to an alarm that has uncertain and undefined opuational/ safety significance; and (2) the excessive cycling of the two safety-related isolation motor-operated valves (348 and 368) used to vent the pressure to the suppression pool contributed to premature wearout of these valves. The AIT recommended that the licensee eliminate the cause of the recurring pressurization of the RHR piping. In addition, several areas were identified where improvements were needed to ensure that the sig-nificance of similar events in the future can be determined and/or minimized.

These include: periodically verifying that the LPCI injection check valve properly seats with a differential pressure across the valve; installing 5

B Q

pressure monitoring equipment on the RHR piping; and developing a method to quantitatively measure the LPCI injection valve leakage during reactor operation.

Thcugh the low leak rate of the isolation valves poses no safety problem, the inability of the operations staff to determine significance due to instrument ano procedural inadequacies should be addressed. In addition, greater attention should be focused on the isolation function of valves that protect low pressure emergency core cooling systems from the high pressura reactor coolant. (Refs.1-3.)

Restart of Pilgrim is pending NRC authorization in accordance with Confirmatory Action Letter 86-10, issued April 12, 1986, and subsequent NRC requests for acditional information. Investigation is ongoing to determine root cause, to assess the safety consequences and implications of the event, and to determine

~

corrective action to reduce the probability of a similar event occurring.

Startup of Pilcrim currently is planr.ed for the second quarter of 1987, since the licer.see is considering an extensive replacement and modification progran.

This event will be updated in a future issue of Power Reactor Events.

1.2 Out-of-Sequence Control Rod Withdrawal Due to Series of Operator Errors at Peach Bottom Unit 3 On March 18, 1986, at 8:55 a.m., Peach Bottom Unit 3* was manually scrammed from approximately 3% power in the startup mode. The event was caused by a series of personnel errors involving failure to withdraw the correct control rod, failure to adequately verify that the correct withdrawal sequence was followed, and failure to verify the proper position of a control rod prior to utilizing the rod sequence control system (RSCS) bypass function for that rod.

The reactor was manually scrammed due to concerns that the out-of-sequence rod and resulting rod pattern may not have been bounded by the current reload

Peach Bottom Unit 3 is a 1035 MWe (net) MDC General Electric BWR located 19 miles south of Lancaster, Pennsylvania, and is operated by Philadelphia Electric Company.

6

4 specific rod drop accident (RDA) safety analysis. Subsequent analyses showed that the reactor was not operated in a condition such that RDA consecuences would have exceeded the design criteria at any time during this event, and RCA censequences were significantly less severe than the reload specific RDA analysis results. The event is detailed below.

Unit 3 reactor startup began on March 17, 1986 at 10:18 p.m. The rod worth minimizer (RWP1) was bypassed at the time because it could not be proven to be operable. Two licensed operators were assigned to monitor control rod with-drawal in accordance with Technical Specification 3.3.B.3.b which states, "WFenever the reactor is in the startup or run modes below 25% rated power the Rod Worth Minimizer shall be operable or a second licensed operator shall verify that the operator at the reactor console is following the control rod program." Control rods 1 through 5 of Group I were withdrawn prior to change of shift at 11:00 p.m.

At shift charge, two different licer. sed operators were assigned Technical Specification 3.3.B.3.b duties. Rod withdrawal recorrenced at Step 6 of Group 1 and continued to Step 13 of Group 1. Step 13 specified that rod 02-23 be fully withdrawn; however, the reactor operator inadvertently withdrew rod 10-23, which is located near rod 02-23. Further, the second licensed operator mistakenly verified that rod 02-23 had been correctly withdrawn. This withdrawal error occurred at 1:28 a.m. on March 18, 1986.

Rod withdrawal continued, in proper sequence, to Step 6 of Group II. Step 6 specified that rod 10-23 was to be fully withdrawn. At this point, the reactor operator left the control rod panel to check recorders that were monitoring various parameters. When the operator returned to his station, he observed that rod 10-23 was fully withdrawn, and, not realizing that he had previously withdrawn rod 10-23 at 1:28 a.m., signed off the rod withdrawal sheet for Step 6, Group II. Rod withdrawal continued until all Group II rods were fully withdrawn.

Group III rod withdrawal was attempted at 2:30 a.m. RSCS initiated a rod block at this point, due to 02-23 being fully inserted. The Shift Superintendent and Shift Supervisor placed the RSCS bypass keyswitch in the " full-out" position for rod 02-23, without verifying that rod 02-23 was fully withdrawn. This 7

O action bypassed the rod 02-23 insert error and allowed rod withdrawal to continue. Group III rod withdrawal was completed at 4:34 a.m. With the exception of the last rod in Group IV (which was only withdrawn as far as position 10), all Group IV rods were fully withdrawn by 6:11 a.m. No further red withdrawals were performed on this shift, which ended at 7:00 a.m. The Shif t Superintendent, Shift Supervisor, and both reactor operators ended their shift at 7:00 a.m.

At 7:30 a.m., the Shift Superintendent on the day shift requested that trouble-shooting be performed on the RWM. At 7:40 a.m., the RWM was reinitialized and returned to service. The RWM indicated an insert error for rod 02-23. The reactor operator observed that rod 02-23 was fully inserted, although it should have been fully withdrawn. Further investigation revealed that the RSCS keylock bypass switch for rod 02-23 was placed in the " full-out" position, tFe reby bypassing the insert error. At 7:48 a.m., the RSCS bypass switch was returned to the normal position. As expected, a rod withdrawal block occurred du tc rod 02-23 being out-of-sequence. A controlled shutdown was begun by irserting rods so that rod 02-23 could be withdrawn in correct sequence.

Fowever, due to concerns that the 02-23 insertion may have adversely affected the RDA analyses, the reactor was manually scrammed at 8:55 a.m. The scram occurred properly, and was reset at 9:03 a.m.

This event was caused by a series of personnel errors involving failure of the reactor operator to withdraw the correct rod, failure of the second operator to adequately verify that the correct withdrawal sequence was being followed, and failure of the Shift Supervisor and Shift Superintendent to verify the proper position of a control rod prior to utilizing the RSCS bypass function for that rod.

The four individuals responsible for this event were disciplined. In addition, the following actions have been developed to prevent recurrence and are in various stages of implementation:

(1) A letter was issued on March 18, 1986, from the Superintendent / Operations to all licensed personnel outlining the event and describing interim requirements for verification of proper rod positioning.

8

4 (2) A procedural control has been developed to use the plant process computer to generate a core map at the completion of withdrawal of specific rod groups. The computer-generated map will be compared to a rod map which is attached to the operator's rod withdrawal sheet. The two maps will then be verified to be identical before proceeding to the next rod group.

(3) Six procedures involving RWM and RSCS have been revised to enhance the procedural requirements. Included in these revisions is the RSCS bypass procedure, which has been revised to provide a Shift Supervision sign-off sheet for proper verification of rod position prior to implementing the ,

RSCS bypass function.

t (4) On March 24, 1986, the Plant Manager issued a letter to Shift Supervision to ensure that "best efforts" are made to place the RWM in service prior tc beginning reactor startup.

(5', Henceforth, when rod movements are being perforned with the RWM bypassed, the second licensed operater will be dedicated to ensuring that the proper rod sequence is being followed.

(6) Plant staff management meetings are being held with all Operations Personnel to discuss the event and individual responsibilities.

Alttcugh technical and process oriented corrective action was promptly taken following this event, including prompt institution of an investigation to determine root cause, the immediate cause was personnel error. The licensee, after in-depth investigation of the error, determined that failure to follow approved procedures was the root cause. In this particular case the procedures were followed as to the technical aspects, except that human effort combining failure to observe and proceeding on an untrue assumption permitted rod withdrawal out of sequence. This event emphasizes the need for better management involvement in plant activities to ensure a high level of personnel performance. (Refs.4-6.)

9

1.3 Loss of Shutdown Cooling Due to Improperly Functioning Water Level Indicators at San Onofre Unit 2 On March 26, 1906, with San Onofre Unit 2* in cold shutdown, the shutdown cooling system (SDCS) experienced a total loss of flow for a period of 49 minutes. This occurred while reactor coolant system (RCS) level was being reduced to repair a leaking cold leg system generator nozzle dam which had been

, installed to allow work in steam generator channel heads. Using the estab-lished level indication, which was later found to be in error, the RCS was drained to a level where vortexing occurred at the RCS/SDCS suction connection, causing the SDCS/ low pressure safety injection (LPSI) pumps to eventually become airbound. The pumps were stopped and the system vented, reestablishing SDCS flow. Concurrent with the restoration of SDCS flow, both gas channels of the fuel bandling isolation system actuated on high noble gas as a result of the RCS degassing. The high pressure safety injection (HPSI) system was used to make-up to the RCS until SDCS flow returned to a stable state. The cause of this event was erroneous level indication, resulting in the operators not recognizing the RCS low level condition prior to complete loss of SDCS flow.

Irmediate corrective action was taken to prevent SDCS/LPSI pump damage, restore SDCS flow to a stable state, and recalibrate the level indicators. Changes in plant design, procedural revisions, fermal control of level indicator instal-lation, and operator training will be undertaken. The event is detailed below.

On March 26,1986, at 10:08 p.m. , with the unit in cold shutdown, a loss of flow in the SDCS for 49 minutes was experienced. This occurred during a planned evolution where the RCS is drained to below mid-loop on the RCS hot leg. The RCS is drained below mid-loop to install, remove, or repair steam generator no:zle dams, which are installed to allow work to be accomplished in the steam generator channel heads concurrent with refueling activities. For this particular evolution, the RCS was being drained to accommodate repair of a leaking cold leg nozzle dam in steam generator E089.

San Onofre Unit 2 is a 1070 MWe (net) MDC Combustion Engineering PWR located 5 miles south of San Clemente, California, and is operated by Southern California Edison Company i

10

The Unit 2 SDCS uses portions of two safety systems to remove decay heat from the reactor core in cold shutdown; the LPSI system and the containment spray systen (CSS). Each LPSI pump is aligned to take suction from the RCS hot leg an: discharge through a CSS heat exchanger back to an RCS cold leg. Normal operation of the SDCS in cold shutdown requires one LPSI pump to be in opera-tien, with the redundant pump in standby. Normal flow by procedure is 3000 gpm, but in cold shutdown, flow may be throttled to a lower rate, or stopped entirely, as long as core outlet temperature is maintained 10 degrees F below saturation temperature.

The suction connection of the SDCS to the RCS is located at the bottom of one of the 42-inch diameter hot legs. The system piping runs outside containment to the LPSI pump suctions, with sufficient elevation differential provided for adecuate net positive suction head. However, when the RCS level is being centro 11ed with the loops not fillec (i.e., within the 42-inch range above the suction connection), air entrainment due to vortex formation above the suction cornection can occur.

RCS water level is lowered at less than 1-inch per minute, using the LPSI pump mini-ficw to divert flow from the SDCS to the refueling water storage tank

( F'r.S T ) . To raise the RCS level, a HPSI punp is started, which draws water from the RWST and injects it into the RCS cold legs. During this event, the RCS 1 water level was being monitored by a recently installed level indication system, consisting of narrow range and wide range level detectors providing control room indication. The narrow range is used to monitor RCS level when it is below the top of the hot leg. It covers a 42-inch range with zero at the bottom of the inside of the hot leg and +42 inches at the top of the inside of the hot leg. The wide range covers a range from 10 feet below the reactor vessel flange to 25 feet above the flange. Zero on the wide range is at the top of the reactor vessel flange, or at 100-1 inches above the bottom of the inside of the hot leg. These detectors are permanently installed, but require temporary connections to join them to an RCS hot leg drain and a pressurizer instrument tap when they are placed in service. The installation of these detectors and their control room indication was accomplished to provide increased accuracy and operator control of draining and refilling evolutions, rather than relying solely upon a local indicating tygon tube manometer.

11

f Prior to initial draining to mid-loop of the RCS hot legs on March 19, 1986, both the wide range and narrow range level detectors were calibrated. On March 20, 1986, the RCS level was lowered to 20 inches by narrow range level indication (approximately mid-hot leg loop) in the control room, and prepara-tions for steam generator nozzle dam installation were initiated.

In preparation for this maintenance activity, the RCS eductor was placed in service, minimizing the containment airborne contamination when breaching the integrity of the RCS. Upon placing the eductor in service, both the narrow range and the wide range control room level indications began oscillating. The operators, noting the oscillations, requested the assistance of the Station Technical Cognizant Engineer and Instrument and Control Technicians to perform troubleshooting on the level indicators. This troubleshooting evolution in-cluded draining and purging the reference and sensing legs of each of the instruments, performing calibration checks on the narrow range detector, and cbserving the effect of starting and stopping the RCS eductor. After perform- .

ing these evolutions, with marginal success, the tygon tube manorreter was irstalled to verify the RCS level indit.ations being provided by the narrow range and wide range detectors.

On March 22, 1986, the tygon tube msnometer was installed with zero level at the top of the reactor vessel flange. The nominal relationship of the three level indicators, assuming all function as intended, at the theoretical hot leg mid-loop position, is as follows:

Narrow Rance Wide Rance M

+21 inches -6 feet 7-i inches (-79-1 inches) i inches Concurrent with this installation, maintenance activities were initiated to drain the steam generator RCS headers, remove the primary manways, and install the nozzle dams. During these activities, which were completed on March 26, 1986, the narrow range control room level indication was at 13 inches i inch (8 inches below mid-loop), while the tygon tube manometer indicated a level of

-83 inches 1 inch (i.e., tygon was 4-i inches high relative to narrcw range).

12

At 10:15 a.m. on March 26, 1986, after completior of these maintenance activities, an RCS level increase was initiated with the tygon manometer indi-cating -83 inches and the narrow range detector indicating 13 inches. After i the PCS level had been raised to -22 inches as indicated on the tygon manometer (leeps filled), the refill was stopped, and a visual inspection of the nozzle dar.s was perforced. At 2:50 p.m., it was determined that one of the cold leg nozzle dams was leaking excessively and draining was initiated to enable the nozzle dem to be repaired. Operators began draining the RCS to a level of -83 inches (tygon manometer); however, at an indicated level of -77 inches, the in-service SDCS/LPSI pump's motor current began to oscillate, and further reduction in level was ceased. After several minutes, when the motor current escillaticns did not stabilize, operators initiated RCS refill usirg the HFSI-19 pump. At 5:15 p.m., after the addition of approximately 100 gallons of EkST makeup water, the pump motor current oscillations stabilized and the HPSI purp was secured.

At that time, the SDCS/LPSI flow was stable at 30C0 gpm. It was noted that the narrow rarge level was indicating 13 inches, the same as that prior to nczzle dar. installutien (ncminal 13 inches), while the tygon manometer indicated 6 inches higher (-77 inches vs. -83 inches) than prior to nozzle dam instal-lation. At 6:30 p.m., the Operations shift was changed.

At 8:30 p.m., a Maintenance Foreman notified the Shift Superintendent that when the leaking cold leg dam was removed, the RCS level was only 1-inch below the bottom of the dam. Previously, when they had installed the dam, the level was repcrted to be much lower. For personnel safety, the Maintenance Foreman requested that the level be lowered.

l One hour later, with indicated RCS level -77 inches on the tygon manometer, cperators began draining to -83 inches on the tygon, as permitted by procedure.

After 7 minutes of draining with no apparent level change, the operators throttled SDCS flow to the RCS to 2000 gpm. This increased flow to the RWST and reduced the potential for vortexing. At 9:40 p.m., draining was stopped to verify level and to stabilize SDCS flow. At this time, and for several minutes, the SDCS showed no sign of vortexing. The RCS level indicated -78 inches on the tygon (5 inches above target) and 9.8 inches on the narrow range.

13

/t 9:47 p.m., large motor current oscillations were observed on the inservice LPSI-16 pump; at 9:50 p.m., the pump was stopped to avoid damage. Operators, believing that RCS level was adequate (tygon was indicating 1-1 inches above mid-loop) restarted the pump 3 minutes later. After several minutes of stable operation, motor current oscillations recurred and the pump was secured. At this point the redundant pump (LPSI 15) was started and indicated stable opera-tion for several minutes. At 10:08 p.m., however, suction pressure dropped to zero. When shutdown cooling flow indication was lost, the LPSI-15 pump was stopped.

Recognizing that the SDCS had become airbound and flow had been lost, the Shift Superintendent directed that an accelerated system venting scheme be employed ir. order to restore SDCS flow as rapidly as possible. Prior to venting, Health Physics was notified to monitor the expected release of radioactivity, and the Shift Technical Advisor and offsite supervision were summoned.

System venting proceeded well under the direction of the Shift Superintencent, and the LPSI-16 pump was restarted reestablishing SDCS flow. At 11:00 p.m.,

make-up of the RCS level was begun to further assure SDCS flow stability using the HPSI-19 pump until, at 10:30 p.m., the RCS level indicated stable at -77 inches by tygon and 13 inches on the narrow range detector.

Concurrent with reestablishing SDCS flow, the fuel handling isolation system (FHIS) radiation monitor actuated on both gas channels with a maximun level of 300 CPM. This increase of noble gas in the fuel handling building was the result of gas being released into containment via the reactor vessel head instrunent nozzles and being drawn through the fuel transfer tube by the lower pressure in the fuel bandling building. Noble gas was released from the RCS due to the vessel water temperature increase during the event. The FHIS functioned as designed, and was reset at 2:35 a.m. on March 27, 1986.

Earlier in the outage, the heated junction thermocouple level indicating system and core exit thermocouples had been removed from service in preparation for refueling, and the RCS loop resistance thermal detectors were being relied on for temperature indication. Prior to the event, the hot leg temperature 14

frdicated 114 degrees F. During the event, hot leg temperature rose briefly to 210 degrees F.and then rapidly dropped to below 200 degrees F when SDCS flow was restored.

The licensee's investigation revealed the following:

(1) A 2-i-inch error in the tygon manoneter reference scale, combined with a 10-i-inch error caused by an air bubble that existed in the tygon tubing, resulted in an indicated level of 13 inches higher than actual level during the event. The 2-i-inch error occurred as the result of using an informally surveyed reference scale when the properly surveyed scale could not be located.

(2) The newly installed wide range and narrow range level detectors had been adversely affected by operation of the RCS eductor. These detectors were origir:lly designed to connect to the pressurizer vent at the same location as the tygon manometer. After preoperational testing, however, it had been determined that the eductor would not affect the level indication if the connection were made to an alternate instrument tap on the head of the pressurizer. The tap selected, however, included a section of flexible tubing which had low points and resulted in the i

formation of a loop seal, preventing proper venting of the de?.ector through the pressurizer head vent. This tap and flexible tubing were part of the original plant configuration. This led to operator distrust of the two level detector indications.

(3) The wide range level detector was found to be out of calibration. The

.eason for being out of calibration cannot be determined, since it had been calibrated only 7 days earlier.

(4) It is theorized that a condition can exist where the level in a portion of the cold legs is greater than the indicated level in the hot legs. The higher actual cold leg level prompted the request to lower RCS level which, in turn, led to the vortexing of the SDCS/LPSI pumps. This condi-tion appears to have existed prior to the event when a high level was observed in the steam generator cold leg channel head.

15

(5) There was local boiling in the reactor core during the event, and a steam release to containment occurred via incore detection nozzles in the reactor vessel head. The radiation levels involved in this release were less than 15 of the established setpoints on the containment purge radiation monitors. The total release was calculated to be approximately 2 curies.

(6) Although local boiling in the core did occur, the calculated bulk reactor coolant temperature did not exceed 200 degrees F. The maximum heatup rate per technical specifications was exceeded, but an evaluation of the fuel assemblies and the vessel determir.ed that no damage occurred.

The root cause of this event was the ncnconservative error in the tygon level indications and the information which resulted from the water level in a portion of the cold legs being higher than the hot legs, indicating to the cperators that the RCS level was at mid-loop. As a consequence, the operators were unable to properly diagnose the motor current oscillations being caused by Icw RCS level.

The following contributing causes have been determined: (1) since RCS level detectors are classified as nonsafety-related, their control was not as formalized as may be necessary when dealing with such evolutions; (2) there were no formal data on the potential for vortexing at lower RCS levels; (3) there was no formal control over the routing and installation of the tygon tubing.

The immediate corrective actions to prevent recurrence included increasing the RCS level and restoring SDCS flow to a stable condition. The tygon level indi-cator was properly reinstalled. The narrow and wide range level instrument reference legs were relocated to a different pressurizer instrument tap to pre-clude adverse effects from eductor operation, and the wide range level indicator was recalibrated.

16

The following corrective actions have been or will be completed prior to RCS draindown during the next scheduled unit outage.

(:) To establish highly reliable water level indication, draindown procedures have been revised to require diversified level indication (including the tygon manometer) which must be in agreement as a prerequisite for draining operation; the installation of the tygon manometer has been formalized; and the heated junction thermocouple level indicating system will be main-tained in service until redundant refueling water level indication systems are in service following the initial draindown, after which the tygon tube will be used to periodically cross-check the level indication provided by the rerote indication.

(2) A correlation of expected vortexing versus level for a range of flow rates was completed, and this information has been included in operating instructions.

(2) The minimum and maximum flow to be maintained when lowering level belcw mid-loop will be defined, and appropriate procedural revisions will be made.

(4) The required RCS levels for various maintenance evolutions such as nozzle dam installation and removal, based on cold leg draindown limits will be evaluated.

(5) Augmented training will be provided to operators corcerning SDCS operation, particularly when drained down. This will include a review of the lack of temperature indication when flow is stopped, when boiling can be expected following loss of flow, and the actions to be taken te most quickly restore flow.

(6) The installation and operation of the refueling water level detectors and the tygon manometer will be formally proceduralized to apply the same administrative controls as to safety-related systems. l l

l l

17

_ ~ . - _ _ . _ _ . . _ _

F- .

(7) The RCP casing will be vented periodically during RCS level changes tc preclude the theorized water level differential.

In addition, corrective actions being considered include providing an alarming trend recorder to monitor LPSI pun.p parameters (amperage, discharge pressure, flow) in order to provide the earliest possible warning of a potential loss of shutdown cooling, and initiating design change to make the LPSI pump self-venting. (Refs. 7 and 8.)

1.4 Plant Shutdown Due to Leak in Pneumatic Supply to Autorratic Depressuriza-tion Systen Valves at Grand Gulf Unit 1 Or March 19, 1986, at Grand Gulf Unit 1,* supply air flow to the automatic depressurization system (ADS) air receivers was determined to be excessive, raising concerns regarding the ability of the air systen to meet its design recuirements. The high makeup air flow was due to excessive leakage through .

the seats of 16 of the 17 accumulator relief valves. The design seat leak tightness pressure is 90 percent of set pressure (171 psig). The nomir.al sys-ten operating pressure (185 psig) exceeded this value, causing the excessive leakage. The accumulator relief valves were set a approximately 190 psig. The relief valves were reworked and the system operating pressure was reduced. The event is detailed below.

Dr. March 19,19E6, with the plant operating at about 80 percent power, supply air ficw to the ADS air receivers was determined to be excessive. ADS valves operate by pneumatic pressure that is stored in two accumulators for each valve. The accumulators receive makeup air pressure from the air receivers that are pressurized by the instrument air system. The air system is designed with the capability- to allow for two actuations of each ADS safety relief valve and then hold the valves open for 5 days without replenishment. The excessive flow rate observed on March 19, 1986, raised concerns regarding the ability of the air system to meet these design conditions.

Grand Gulf is a 1108 MWe (net) MDC General Electric BWP located 25 miles south of Vicksburg, Mississippi, and is operated by Mississippi Power and Light Company.

18

3, At 11:00 a.m. on March 19, 1986, the ADS system was aeclared inoperable and a ifmiting condition for operation (LCO) was entered. The LC0 requires the plant to be in at least hot shutdown within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reactor steam dome pressure to be reduced to less than or ecual to 135 psig within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Operators began plant shutdown at 7:05 p.m. The reactor was manually scramr.ed at 9:42 p.m. By 4:30 a.m. on March 20, 1986, the reactor steam dome pressure was less than 135 psig.

The high makeup air flow to the ADS air receivers was due to excessive leakage through accumulator relief valve seats. All of the 17 accumulator relief velves were removed and bench tested for leakage. Sixteen were reworked to reduce the leakage to an acceptable rate. One was determined acceptable with-out rework and was returned to service. The relief valves are J. E. Lonegan, Mccel LCTll. The design seat leak tightness pressure is 90 percent of set pressure (171 psig). The normal system operating pressure was 185 psig nominal which exceeded this value, causing the excessive leakage. The relief velve lift setpoints are set at about 190 psig.

The relief valves were bench tested using a water bath to a depth of 0.5 inch sc rounding the relief valve discharge line to determine leakage. The relief valves were refurbished to an acceptable leakage rate of five bubbles per min-ute at a pressure of 90 percent of the relief valve setpoint (171 psig), and were reinstalled. Mechanical joints in the ADS air system were also checked for leakage. No leakage was identified. The normal system operating pressure was reduced from 185 psig nominal to 165 psig nominal. This change has been reflected on the operator's rounds sheets and in the System Operating Instructions.

The ADS safety relief valves operate to depressurize the reactor so that flow from the low pressure coolant injection subsystems and the low pressure core spray system can enter the reactor vessel in time to cool the core and limit fuel cladding temperatures during accident scenarios in which the reactor core isolation cooling and the high pressure core spray systems fail to maintain reactor water level. The ADS valves would complete their safety-related function with the replenishment air supply available from the instrument air 19

W system. A less of this supply with the system leakage present during this event would have reduced the length of time following a LOCA that the system would have been available. (Refs 9 and 10.)

1.5 Weld Failure on Pipe Support Structure Due to Improper Desion at Palo Verde Unit 1 During a snubber surveillance inspection at Palo Verde Unit 1* on March 13, 1986, the licenseeidentified a failed pipe support on a 24-inch main feedwater line to a steam generator. The failure occurred at a welded connection between the flange's two I-beams, resulting in a total separation of the two beans.

Licensee retallurgical analysis determined that the weld failure resulted from ove rloading. The root cause of the failure was evaluated by the licensee and Bechtel (the architect engineer) to have resulted from an improper design corsideration of localized flange bending, as well as inadequate allowance for lateral thermal motion.

As result of the failure, Bechtel initiated a review of all large bore safety-related supports of a similar cesign. As a result of that review, mcdifications to ten additional supports were initiated at all three Palo Verde units. The modifications consisted primarily of adding stiffeners to the existing support structures. Further, Bechtel performed a sampling review cf small bore pipe safety-related supports, and concluded the supports had adequate desigr.s. The event and subsequent evaluations are detailed below.

A surveillance inspection of Palo Verde Unit 1 on March 13, 1986 identified a broken pipe support (1-SG-005-H008). The broken support was located inside the containment building and was a strut type support for the 24-inch main feedwater line to steam generator No. 2. The break occurred in the weld between the flange connection of the upper and lower support beams. The lower portion of the support separated completely from the upper support beam (see Figure 2).

Palo. Verde Unit I is a 1221 Mwe (net) MDC Combustion Engineering PWR located 30 miles west of Phoenix, Arizona, and is operated by Arizona Public Service.

20

\

u UPPER SUPPORT BEAM h

FAILURE OCCURRED

/ A, AT THIS STRUCTURAL

. WELD ATTACHMENT

,j BETWEEN FLANGE CONNECTION OF UPPER AND LOWER I -

SUPPORT BEAM

(" LOWER n SUPPORT SUPPORT BEAM LOAD -

o SUPPORT 1/4" LEG FILLET LOAD WELDED CONNECTION BETWEEN UPPER AND LOWER SUPPORT BEAM EXTENSIVE LOWER , ,

FLANGE DEFORMATION AT AREA OF BEAM ATTACHMENT (DOWNWARD) 4 s x. 1 NO STIFFENER '

PLATE OTHER l i SIDE Iil l \/ IIll LOWER SUPE' ORT l FLANGE DEFORMED UPWARD l o

{

SUPPORT SUPPORT LOAD LOAD END VIEW FIGURE 2. PIPE SUPPORT 1-SG-005-H008 FAILURE LOCATION 21

N v

The axes of the two beams were oriented 90 degrees, and it was discovered that the two 4-inch long, 1/4-inch leg fillet welds between members A (upper beam) and E (lower beam) had fractured. A distortion of the beam flanges at the weld location occurred. The time of support failure is unknown. A visual inspection of the hanger had been performed by the licensee in March 1985, prior to post-ccre hot function testing, at which time the support was intact.

The broken support was visually inspected. The upper beam's bottom flange edge showed substantial bending. Similarly, the lower bean's upper flange showed some bending. Part of the fractured weld remained on the upper beam with the renainder on the lower beam.

Also, the weld surfaces on the lower beam were examined under a stereo micro-scope. Part of the fracture was in the base metal near the fusion zone and part was in weld metal. The weld quality was satisfactory. The fractured surface of the beam had a woody appearance, but the fractured surface in the weld metal appeared smooth.

The fractured surfaces were additionally examined under a scanning electron nicroscope (SEM). The examination showed elongated dimple structures typical of a ductile overload under shear stresses. The base metal had some equiaxed dimples and elongated fibers, incicating ductile overload fracture. No evi-derce of any striation was seen under the SEM, proving that fatigue was not a factor in this fracture.

Review of the failure concluded that the support was designed for the lead being applied vertically, but due to thermal displacement of the pipe, the load was actually applied at about 6 degrees off vertical. This angle generated a lateral load, the effect of which was amplified on the failed weld by the depth of the lower beam (W6 x 12), which significantly reduced the load bearing capac-ity of the failed weld. Flange bending flexibility was identified as another factor which further reduced the capability of the weld.

22

0 Based on the above observations, it was concluded that the weld fractured due to overloading. Deformation of the flanges indicated that the weld transferred the loeds until it could no longer accommodate strains imposed by deformation of the flange, causing the weld to fracture.

The root causes of the failure of Unit I support 1-SG-005-H008 were not adjusting the direction of the applied loads to accommodate the normal thermal motion of the pipe, and not considering the effect of localized flange bending.

The combination of a relatively large thermal motion and short sway strut length resulted in a large angle which generated a horizontal force not accounted for in the origir.al design. The effect of this horizontal force on the failed weld was amplified by its acting not only through the pin-to-back-plate height of the rear bracket but also through the 6-inch height of the W6 x 12 lower bean.

Additionally, the failed weld joined two open section members connected flange to flange at right angles. It is believed that the welds parallel to the web of the upper merber are subject to a prying action resulting from the bending cf the icwer flanges of that upper beam (localized flange bendirg). Finite element analysis of the failed stiucture has indicated that this action does reduce welo capability.

It was concluded that these two effects created excessive stresses in the welds, due to the uranalyzed conditions, that led to support failure. It also was l noted that minor contributions were made by (1) the lateral thermal notion re-quiring that the sway strut pull the pipe upward; and (2) axial tilting action of the pipe which could generate an additional and unbalanced load on the sway struts.

! Prior to plant heatup, pipe support 1-SG-005-H008 was subjected to loads above the yield point due to dead load only. During subsequent and repeated hot func-tional tests, the loading on the support increased even higher above the yield l

l point. This resulted in local flange bending and deformations and, as a result, imposed stresses in the welds attached to the support flange. This signifi-I cantly reduced the weld capacity to carry additional loads. Thermal loads re-sulting fror. hot conditions during power operations applied eccentric loads to 23 l

l these welds. Failure of the welds may have occurred prior to or during the power operation phase.

All large bore Q-class supports that are designed to accommodate a swing angle, including struts, rods, snubbers, and springs, were reevaluated. Of the 852 supports reviewed, it was determined that five supports in addition to support 1-5G-005-H008 required modification to accommodate the off-vertical loading condition. An additional review of 100% of the large bore Q-class pipe sup-ports, which involved 3,678 design drawings and "as-built" documentation, deter- :

mined that five supports in the main steam and safety injection systems were inadequately designed for flange bending and required modification.

Based on the above evaluations and the limited number of problems identified, it was concluded that there was a loss of design control during the original design of the support for flange bending and eccentric loading, but this loss was an isolated case resulting from an oversight on the part of the designer -

and checker, and not a generic breakdown of the design process.

Corrective actions included modifying the supports found to have insufficient capacity due to lateral loads resulting from a swing angle that had not been properly accommodated in the original design. The six supports inadequately designed for flange bending were provided with stiffeners. (Refs 11 and 12.)

1.- 6 Update on Emeroency Diesel Generator Engine Problems at North Anna During 1984 and 1985, the emergency diese1 generator (EDG) sets at North Anna Units 1 and 2* experienced significant mechanical failures involving piston pin bushings, pistons, and cylinder liners, together with lesser incidents, such as fuel and water leaks and governor problems. (These probler- ere discussed in Power Reactor Events, Vol. 6, No. 6. Section 1.8, " Repeated Trips of Emergency Diesel Generators at North Anna," pp. 12-14, issued April 1985.)

North Anna Units 1 and 2 are each 893 MWe (net) MDC Westinghouse PWRs located 40 miles northwest of Richmond, Virginia, and are operated by Virginia Power.

24

The scuffing and cracking of cylinder liners and pistions at very low hours of operation, and the widespread wearing and extrusion of insert and piston pin bushings impacted the reliability of these engines for their intended service.

However, the root causes of the problems have been diagnosed, and important changes have been made in the engine lubrication, operation, and maintenance.

These problems, causes and corrective actions are summarized below from an in-depth, independent engineering evaluation performed for the licensee.

(Ref. 13.)

North Anna is a two-unit nuclear station with a total of four EDGs. Two EDGs are fully dedicated to each nuclear unit, with one EDG assigned to each of the redundant electrical power divisions of each nuclear unit. There is no sharing of EDGs between the nuclear units. Power from one EDG to one electrical division of each unit is sufficient to provide for safe shutdown loads or for accident loads. The EDGs at North Anna are Fairbanks-Morse Model 38 TD8-1/8, 12-cylinder, opposed-piston, turbocharged engines. These EDGs are rated for continuous duty at 2750 kW, for 2000 hours0.0231 days 0.556 hours 0.00331 weeks 7.61e-4 months at 3000 kW, and for 30 minutes at 3300 kW.

During the North Anna Unit 1 and 2 refueling outages in late 1985 and early 1986, the emergency diesel generators (EDGs) were overhauled in accordance with the manufacturer's reconrnendations. Inspection of the key components of the EDG unit revealed that the upper wrist pin bushings exhibited intoler-able extrusion and elongation.

The general design of the Model 38 TD8-1/8 engine is characterized by a pair of pistons in each cylinder, operating in opposite directions and with a common combustion space formed by the pistons. Therefore, there are no cylinder heads, and there are no intake or exhaust valves. Pressurized clean air enters the cylinder via ports encircling the top of the cylinder liner when the upper piston is in a position to uncover these ports. Following the combustion of the compressed air-fuel mixture, the downward motion of the lower piston uncovers the exhaust ports which encircle the bottom of the cylinder liner. The turbocharger, driven by the exhaust gas, provides fresh, 25

s compressed, cooled air directly into the engine air receiver and cylinders.

Extra horsepower is provided via the turbocharger, which raises the power out-put a considerable degree.

Each EDG is equipped with a lube oil keep-warm system, a prelube system, and a lube oil booster system for the upper crankshaft lubrication during fast starts. In the keep-warm system, an electric heater and thermostat keep the lube oil at 130-135 degrees F to maintain a desired viscosity. The keep-warm circulating pump sends the warmed lube oil through the lower crankshaft line, maintaining continuous lubrication of the bearings in the lower portion of the engine, and back to the oil sump. Due to the possibility of getting oil by the inverted pistons and into the firing chamber of these opposed-piston engines, this lubrication system does not circulate lube oil to the upper crankshaft during st'andby.

In the prelube system, a separately powered lube oil pump is started auto-

matically (for remote manual EDG starts), and is run for about 2 minutes prior to the actual starting of the engine. The prelube system provides lubricating oil to both the lower and upper crankshaft lines. For all test starts of the EDGs at North Anna, the prelube system is now used prior to the actual diesel start. In addition, for those simulated engineered safety features (ESF) actuation / loss-of-power tests where prelube it. not activated automatically, the prelube system is started manually prior to actually simulating the need for an emergency auto start. In the case of actual emergency starts, however, the EDG starts immediately and is not delayed in order to provide prelube.

The lube oil booster system includes a lube oil supply in a piston-operated accumulator operated by engine starting air. As the engine first begins to rotate, approximately 1 gallon of lubricating oil is fed immediately to the bearings along the upper crankshaft line by the accumulator. This booster oil to the upper crankshaft line supplements the prelube system.

The general conclusion of the independent engineering evaluation performed cn the EDGs was that the engines are adequate to successfuly meet their iequired operational limits as long as these diesels are:

- Not overloaded,

- Properly maintained, 26

v t

- Operated with Chevron DELO 6000 or compatible / suitable oil, and

- Effectively monitored. I Evaluation of the key engine components is summarized below.

Bushings. Bushing performance reliability has recently been improved through the use of a more appropriate lubricant accompanied by implementation of more rigorous constraints on EDG loading. In addition, a program to carefully monitor the bushing's side clearances should ensure early detection of any extrusion.

Pistons and Cylinder Liners. Piston and liner evaluations indicate that no major contribution to decreased reliability resulted directly from these particular components. Except for damage resulting from bushings failures, the pistons, piston rings, and liners were in excellent condition. All cylinder liners in the engines now have the Viton water jacket seals.

Governor and Load Control. The governor is deemed sufficient to handle required emergency loads, but when the unit is on the grid, there is an apparent problem with load control. A particular characteristic of the present governor system is that the engine can be overloaded when on the grid unless the load control is continually monitored and adjusted. Thus, it is essential that the engine itself have its own independent overload protection distinct from the governor system, which will also allow the unit to meet technical specification load requirements. To this end, the mechanical rack stops have been adjusted to limit total rack travel to approximately 8 millimeters.

It might be desirable to further protect the engine bearings and parts by developing a soft-start philosophy, such as with a partial startup fueling capability.

Lubricating Oil System. An ongoing concern has been the adequacy of the lubricating oil system to lubricate the upper drive train during engine startup. Examination of the system, examination of bushing and piston failures, and observation of engine starts have led to the conclusion that no failures could be attributed to lack of lubricant flow during EDG startup.

27 i . _ _ _ _ - _ _ _ _ - - _ _ _ _ _ _ _

The station requirement to prelube the engine before starting is an additional safety factor being utilized. All lubrication failures which were investigated were attributable to deficiencies in characteristics of the oil being used.

Selection of a nore suitable lubricating oil, together with recalibration of the fuel injection pumps and adjustment of camshaft timing to avoid excessive firing pressures, has permitted engine operation in excess of 200 hours0.00231 days 0.0556 hours 3.306878e-4 weeks 7.61e-5 months without apparent problems; prior to these improvements, certain failures had occurred in less than 80 hours9.259259e-4 days 0.0222 hours 1.322751e-4 weeks 3.044e-5 months of EDG operation.

Fuel Oil System. All fuel injection pumps have been rebuilt with erosion sleeves and have been recalibrated. The manufacturer's fuel oil system is deemed adequate as long as rack adjustments are minimized and kept within the recommended settings for meeting rated load. Limiting rack travel, however, impacts on the engine power output, and any adjustments should be within the requirements of engine performance. Proper calibration of fuel oil pumps, correct shimming, and correct camshaft timing, as accomplished in the recent overhauls, will ensure a more uniform peak firing pressure, within the desired 1200 to 1300 psi range.

Since implementation of the independent evaluation suggestions summarized above, the EDG set at North Anna have demonstrated substantially improved reliability and availability, and have fulfilled their operability require-ments adequately. Although certain basic problems have been addressed and resolved, more detailed engineering analyses will continue. Other improve-ments and fine tuning also will continue, particularly in the areas of load regulation and engine monitoring. (Refs. 13 and 14.)

1.7 Update on Failure of Automatic Sprinkler System Valves to Operate at Grand Gulf Unit 1 At Grand Gulf Unit 1* on September 4,1983, a fuel line ruptured on the No.11 i diesel generator. The engine was manually stopped and the outside air fans

Grand Gulf Unit 1 is a 1108 MWe (net) MDC General Electric BWR located 25 miles south of Vicksburg, Mississippi, and is operated by Mississippi Power and Light Company.

28 l l

e a

were secured when a fire was reported at the engine. The fire brigade responded with fire hoses and portable extinguishers. It was noted, however, that the automatic fire water deluge valve had not opened. The manual release was ineffective since the drop weight had already been released by the automatic function. A mechanic was able to open the valve by removing the actuator enclosure box cover and striking the top of the weight, and the fire was extinguished.

This and similar events were reviewed in Power Reactor Events, Vol. 5, No. 5, February 1985, pp. 8-9, and in NRC Information Notice 84-16, dated March 2, 1984. The following information, updating review of the failure of the valves, has been edited from a more recent information notice, 86-17, " Update of Failures of Automatic Sprinkler System Valves to Operate," issued March 24, 1986.

The valves of concern are 6-inch deluge and pre-action fire protection water control valves, identified as Model C, manufactured by Automatic Sprinkler Corporation of America (ASC0A). The NRC received a copy of notification from ASC0A in January of 1986 stating that previous instructions issued to customers in late 1984 or early 1985 concerning maintenance to these valves was inadequate to prevent the failure-to-actuate problems that had been experienced.

In June 1984, ASC0A had concluded in a letter to NRC that the Grand Gulf events were plant unique. In November of 1984, ASC0A informed the NRC that three separate reports of the 6-inch Model C valve failing to actuate under certain circumstances had caused them to reevaluate their previous conclusion. They provided NRC with an advance copy of instructions to customers on the nature of the problem, identification of affected systems, and a recommended course of action to be taken to correct the problem. ASC0A stated this notification would be sent to all their nuclear customers.

The most recent ASC0A instructions (January 1986) supersede these previous instructions, and state that the previously recommended maintenance procedure is inadequate. These instructions provide what is termed a " temporary solution."

29

+

4' A tentative date for availability of a permanent solution, aeditional information for identification of affected valves, and a course of action described by ASC0A as " required" for the elimination of the problem also are given. However, is it not clear that this notification has been sent to all nuclear customers. Licensees who have not received this communication from ASC0A are encouraged to contact their ASC0A representative for this important information.

f 30

l

, i 1.8 References (1,1) 1. Boston Edison Company, Docket 50-239, Licensee Event Report 86-09, May 9, 1986.

2. NRC, Augmented Incident Response Team Report 50-293/86-17, May 16, 1986.

3. Letter from W. Harrington, Boston Edison Company, to T. Murley, NRC Region I, re: Second Response to Confirmatory Action Letter 86-10, June 16, 1986.

(1,2) 4. NRC Region I, Inspection Report 50-278/86-09, March 25, 1986.

5. Philadelphia Electric Company, Docket 50-278, Licensee Event Report 86-09, April 16, 1986.

6. Letter from Philadelphia Electric Company to J. Taylor, NRC, re: NRC Notice of Violation and Proposed Imposition of Civil Penalities, July 23, 1986.

(1.3) 7. Southern California Edison Company, Docket 50-361, Licensee Event Report 86-07, April 25,1986.

8. NRC Region V, Inspection Report 50-361/86-06, April 25, 1986.

(1.4) 9. Mississippi Power and Light Company, Docket 50-416, Licensee Event Report 86-09, April 17, 1986.

10. NRC Region II, Inspection Report 50-416/86-08, April 22,1986.

(1.5) 11. NRC Region V, Inspection Report 50-528/86-09, May 20, 1986.

12. Letter from E. Van Brunt, Jr., to G. Knighton, NRC, re: Revision to Report on Pipe Support Failure, June 2, 1986.

(1.6) 13. Letter from W. L. Stewart, Virginia Power, to J. Grace, NRC Region II, July 14, 1986, forwarding (1) Colt Industries' May 28, 1986 report, (2) Trident Engineering Associates' July 2, 1986 report, and (3) Chevron Research Company's May 22, 1986 report.

14 NRC Region II, Inspection Report 50-338 and 50-339/86-06, April 24, 1986.

These referenced documents are available in the NRC Public Document Room at 1717 H Street, Washington, DC 20555, for inspection and/or copying for a fee.

(AE0D reports also may be obtained by contacting AE0D directly at 301-492-4484 or by letter to USNRC, AE0D, EWS-263A, Washington, DC 20555.)

31

e t

2.0 EXCERPTS OF SELECTED LICENSEE EVENT REPORTS On January 1,1984,10 CFR 50.73, " Licensee Event Report System" became effec-tive. This new rule, which made significant changes to the requirements for licensee event reports (LERs), requires more detailed narrative descriptions of the reportable events. Many of these descriptions are well written, frank, and informative, and should be of interest to others involved with the feedback of operational experience.

This section of Power Reactor Events includes direct excerpts from LERs. In general, the information describes conditions or events that are somewhat unusual or complex, or that demonstrate a problem or condition that may not be ob.ious.

The plant name and docket number, the LER number, type of reactor, and nuclear steam supply system vendor are provided for each event. Further information may be obtained by contacting the Editor at 301-492-4493, or at U.S. Nuclear Regulatory Commission, EWS-263A, Washington, DC 20555.

Excerpt Page 2.1 Inoperable Safety Injection Trains Due to Personnel Errors in Scheduling and Performing Surveillance Procedures at Callaway Unit 1 ................................................... 32 2.2 Reactor Core Isolation Cooling Isolation Due to Temperature Switch Design Problem at Duane Arnold ............................. 35 2.3 Unsealed Auxiliary Feedwater Pump Room Penetrations Due to Inadequate Review During Design Process at Palo Verde Units 1 - 3 ........................................................ 36 2.4 Inadvertent Actuation of Balance of Plant Engineered Safety Features Actuation System During Inspection of Cabinet at Palo Verde Unit 2 .................................................. 37 25 Reactor Vessel Indications Discovered During Examination of Clad Si de of Flange Face a t Oconee Uni t 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 2.1 Inoperable Safety Injection Trains Due to Personnel Errors in Scheduling and Performing Surveillance Procedures at Callaway Callaway Unit 1; Docket 50-483; LER 86-09-01; Westinghouse PWR On 4/12/86 at 1010 CST, the plant entered Technical Specification (TS) 3.0.3 upor discovery that both intermediate head safety injection (IHSI) trains of the emergency core cooling system (ECCS) were inoperable. The trains were restored to operability within I hour. At the time of the event, the reactor had been shut down for about 42 days.

32

Operation of the plant with both IHSI trains inoperable is a condition pro-hibited by the plant's TSs in the power operation, startup, and hot standby modes, thus requiring appropriate action per TS 3.0.3 and reporting per 10 CFR 50.73(a)(2)(i), 10 CFR 50.73(a)(2)(v), and 10 CFR 50.73(a)(2)(vii). A 4-hour report via the Emergency Notification System (ENS) to the NRC Operations room should have been made under 10 CFR 50.72(b)(2)(iii). This report was not made.

AT 0402 CST on 4/12/86, Operations personnel began surveillance procedure OSP-EP-V0003, "Section XI Accumulator Safety Injection Valve Operability," re-quired by TS 4.0.5 every 18 months. Two initial conditions stated in OSP-EP-V0003 were: (1) to run this test while in hot shutdown with reactor coolant system (RCS) pressure above 300 psig; and (2) to close the safety in-jection (SI) pumps discharge to cold leg injection isolation hand control valve, EM-HV-8835. Due to unintentional operational and scheduling personnel errors associated with this procedure, a temporary change notice (TCN) was generated which allowed the test to be run in hot standby after ECCS subsystems were made operable (4/11/86). Closing EM-HV-8835 in accordance with the procedure, there-fore, isolated the common line necessary for the SI pumps to inject into four RCS cold legs during an emergency situation. The procedure was completed at 0558 CST on 4/12/86. Restoration of EM-HV-8835 to the open position was not performed since it was not included on the restoration checklist of OSP-EP-V0003.

Restoration was not included in this procedure since it should have been per-formed in hot shutdown and the valve properly restored with a separate IHSI system procedural lineup performed for hot standby entry.

The problem was discovered at 1010 CST on 4/12/86, when an operator performing the routine Control Room (CR) Shift and Daily Log Readings and Channel Checks, found EM-HIS-8835 indicating closed. TS 3.0.3 was immediately entered since TS 3.5.2, ECCS Subsystems - Tavg greater than or equal to 350 degrees F, does not provide action statements for two inoperable SI trains. EM-HV-8835 was restored to the open position within the 1-hour TS 3.0.3 time constraint.

This event is an isolated case of utility personnel error during the scheduling,-

reviewing and running of OSP-EP-V0003. These errors and contributing factors are summarized as follows:

(1) Scheduling personnel identified OSP-EP-V0003 as required to be performed in hot standby prior to RCS pressure reaching 1000 psig which failed to recognize the Surveillance Task Sheet (STS) " Task Performance Mode" re-quirements. This " Task Performance Mode" required performance of the surveillance in hot shutdown ONLY.

(2) The 4/12/86 hot standby change letter confused operating personnel. In an attempt to provide additional information to the CR, mode change letters have historically identified surveillances that will be due in the near future that would be affected by the mode change as well as surveillances required for the mode change. Surveillance tracking personnel identified OSP-EP-V0003 on the hot standby change letter to be performed in hot standby when conditions permit (RCS pressure greater than 300 psig). This was based on the need to perform the surveillance (18-month surveillance -

due June 1986) prior to declaring the SI accumulators operable.

33

(3) Operations personnel erroneously authorized performance of the OSP in hot standby. During review of OSP-EP-V0003 prior to running the test, Opera-tions personnel noted that the OSP initial conditions required performance of the procedure in hot shutdown only. They reviewed the OSP, mode change letter and schedule, and erroneously authorized performance of the surveil-lance in hot standby by a TCN. This action-was caused by the discrepancy between the schedule, initial conditions of the procedure, and the mode change letter. The schedule required performance prior to 1000 psig. The mode change letter required the RCS to be greater than 300 psig. Finally, the Operators overlooked the effect of closing EM-HV-8835 when in hot standby.

(4) Revision of the STS did not follow the existing review and approval cycle.

With issuance of the TCN, the STS " Task Performance Mode" was changed by Operations personnel without the appropriate review and approvals.

The following actions to prevent recurrence are numbered to correspond with the numbered items above:

(1) For future outages, OSP-EP-V0003 scheduled in hot shutdown as a hot standby restraint.

Progressive discipline has been initiated for appropriate Outage personnel.

Outage Planning and Scheduling personnel have been advised concerning their involvement in this event.

An outages procedure currently in draft form will specifically address use of the STS " Task Performance Mode" for scheduling surveillances.

(2) Future mode change letters will reflect only required task performance conditions and TS requirements for mode changes.

(3) The TCN that allowed performance of the OSP in hot shutdown was voided.

Progressive discipline has been initiated for Operations personnel involved in this event, and the necessity to comply with programmatic controls has been reemphasized.

Additional guidance will address the utilization of TCNs for surveillance procedures. This guidance will be incorporated into plant administrative procedures.

(4) Management will reemphasize the existing administrative controls for re-visions to task sheets and surveillance procedures to appropriate plant personnel.

To correct the problem relative to failure to provide the 4-hour ENS notifica-tion, appropriate personnel will be advised of guidance concerning reporting items pursuant to 10 CFR 50.72(b)(2)(iii).

Although the closure of EM-HV-8835 isolated the IHSI flowpath from the SI pumps to the RCS cold legs for approximately 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , the SI pumps remained functional.

Additionally, if a situation had occurred requiring IHSI, Operations Emergency procedure E.0 calls for verification of SI pump start and flow. Steps require 34

reverification of valve lineups if no flow is indicated. EM-HV-8835 can be opened from the Control Room. Other portions of the ECCS which provide high head and low head safety injection were available during the event. EM-HV-8835 is routinely verified to be opened every shift while in power operation through hot standby. This operating routine minimizes the time EM-HV-8835 could have remained shut and remained undetected.

2.2 Reactor Core Isolation Cooling Isolation Due to Temperature Switch Design Problem at Duane Arnold Duane Arnold; Docket 50-331; LER 86-07; General Electric BWR On 3/15/86, at 1723 hours0.0199 days 0.479 hours 0.00285 weeks 6.556015e-4 months , with the reactor shut down for a maintenance outage, the reactor core isolation cooling system (RCIC) isolated. At the time of the isolation, the portion of the daily surveillance test procedure which monitors air temperatures and temperature differentials in the steam leak detection system (SLDS) was in progress. Temperature switches and temperature differen-tial switches (TDS) in the SLDS are tested by means of a switch on the instru-ment itself, which when taken to the READ position, will provide a signal to a remote indicator on the same panel. A RCIC system isolation occurred concurrent with taking RCIC area temperature differential Switch TDS-2445A to the READ position. The simultaneous trip of a relay in the SLDS cabinet containing TDS-2445A was noted by the Operator when TDS-2445A was placed to READ. The SLDS ambient high temperature annunciator was received in the control room.

This annunciator will activate on signals from some RCIC SLDS instruments, but not TDS-2445A (which provides an input to the SLDS high differential temperature annunciator). A process computer point indicated that the RCIC system had iso-lated. However, other computer points indicating a RCIC SLDS isolation signal were not present. These process computer points are sampled at a once-per-second rate. The RCIC isolation was promptly reset and investigation into the cause of the isolation initiated.

Switch TDS-2445A was examined on 3/18/86, and no problems were found. The READ switch was cycled numerous times, with no SLDS annunciator, RCIC system isola-tion alarm, or RCIC isolation computer point resulting. (The examination was performed with the RCIC logic in the TEST position to prevent possible unneces-sary challenges to this safety function).

Switch TDS-2445A is a Riley Pan Alarm Model 86. This instrument model provides an input to actuation or isolation functions in the RCIC and high pressure cool-ant injection system (HPCI) SLDS, and in reactor water cleanup system logic.

It has in the past demonstrated some susceptibility to spurious signals, although there have been no similar events at Duane Arnold involving placing a switch in the READ position, and few problems within the RCIC and HPCI SLDS systems (see LERs84-028, Revision 1,85-001,85-023). The manufacturer has indicated it is aware of problems with spurious signals upon Model 86 being switched to the READ position due to an internal design problem. The signal can occur due to a difference in the ground potentials of the Model 86, and the remote indicator and can influence other instrumentation within the circuitry. The tourious actuation may or may not be repeatable. The intermediate cause of the RCIC isolation on 3/15/86 was therefore the generation of a short, spurious signal by TDS-2445A upon being placed in the READ position. The root cause of the event is an internal design problem within the switch, which has been identified by the manufacturer. Iowa Electric initiated a presently ongoing design study 35

of this problem in October 1985, following receipt of General Electric documen-tation on the subject.

The HPCI/RCIC Task Force formed to study system reliability (see LER 85-044) has recommended placing a short (approximately 1-second) time delay within the RCIC and HPCI SLDS circuitry. The reactor water cleanup system already has a short time delay in place. A time delay would eliminate violations of HPCI and RCIC due to short, spurious signals in the SLDS, such as the one generated by placing a Riley Pan Alarm Model 86 to read, but would not prevent the system from responding to a real ever.t within the necessary time. As a corrective action for this event, a design change package is being prepared to install this time delay. As this will require declaring HPCI or RCIC inoperable per technical specifications due to lack of SLDS instrumentation, the time delay will be installed at the next opportunity, when HPCI or RCIC is either inoper-able for other reasons, or not required to be operable.

2.3 Unsealed Auxiliary Feedwater Pum) Room Penetrations Due to Inadequate Review During Design Process at )alo Verde Palo Verde Units 1-3; Dockets 50-528, -529, -530; LER 86-25; Combustion Engineering PWRs On April 10, 1986, a walkdown of Unit 3 was being performed to review 10 CFR 50 Appendix R open items. During this walkdown, three unsealed penetrations were identified in the west wall of the two auxiliary feedwater pump rooms. The same condition was also identified in Unit 2. These observations were evaluated by the design organization, and it was determined that the penetrations were required to be sealed.

No immediate action was required on Unit 1 since it was in cold shutdown, and the AFW pumps were not required to be OPERABLE. With Unit 2 in Hot Shutdown, the associated AFW pumps were declared inoperable at 2300 on April 16, 1986,

, and the appropriate action statement was complied with. The third Unit 2 AFW pump remained operable, since it is located in the turbine building and was not affected by this condition.

The AFW pump rooms are located in the seismic Category I main steam support structure (MSSS) and are required (by Detailed Design Criteria) to be watertight.

The Final Safety Analysis Report (FSAR) requires the AFW piping and components to be protected from high and moderate energy pipe rupture, and requires the AFW system to be designed so that conditions such as flooding and earthquakes will not impair its safety function. These events could potentially impact AFW pump operability by subjecting them to environmental conditions for which they have not been qualified.

An investigation was performed to determine why these penetrations had not been sealed or identified by previous walkdowns. The architectural penetration loca-tion drawings had been developed from existing civil / structural concrete floor and wall drawings. Information regarding the west wall of the MSSS had never been transferred and, therefore, the wall and associated penetrations had never appeared on architectural penetration drawings. Since the architectural draw-ings were utilized to generate penetration seal drawings and schedules, these penetrations were never identified for sealing. Therefore, the root cause of this event was cognitive personnel error (contractor) occurring as an inadequate 36

e review in the design process to ensure all applicable information was trans-ferred during the development of architectural penetration drawings. This error was contrary to an approved procedure. There were no unusual characteristics of the work location that directly contributed to this error.

As a corrective action, the penetrations were sealed in Unit 1 and Unit 2, and the Unit 2 AFW pumps were restored to an operable status at 1300 on April 17, 1986 (event duration of 14 hours1.62037e-4 days 0.00389 hours 2.314815e-5 weeks 5.327e-6 months ). The revised drawings of the MSSS west wall and associated penetrations have been issued.

A review was performed of architectural penetratitin location drawings for the auxiliary building and MSSS. This review represented a sample of similar pene-tration seals. No additional discrepancies were identified by this sample re-view and, therefore, this has been determined to be an isolated cast of inade-quate transfer of information from civil / structural drawings to architectural drawings. No further corrective action is planned.

An assessment of the safety consequences and implications of this condition indicated that the potential existed for a flooding or steam line rupture event in the MSSS to impact the operability of both AFW pumps. The effects of these events would be reduced by drainage through existing floor drains and by leak-age of water / steam past the seismic gcp seal (this seal is not designed to be watertight). The third AFW pump would not be affected by these events since it is located in the turbine building. This pump is not seismically qualified, but would be available for all other events.

2.4 Inadvertent Actuation of Balance of Plant Engineered Safety Features Actuation System During Inspection of Cabinet at Palo Verde Palo Verde Unit 2; Docket 50-529; LER 86-20; Combustion Engineering PWR On Apri . 28, 1986, at 2126, with Palo Verde Unit 2 in hot standby at 0% reactor power, an inadvertent balance of plant / engineered safety features actuation system (BOP /ESFAS) Train A actuation signal was initiated. This actuation was annunciated and responded to by the operators (utility-licensed) in the control room.

A Quality Assurance Inspector (contractor non-licensed) and an Instrumentation and Control Technician (utility non-licensed) were inspecting the back panel of the B0P/ESFAS cabinet as part of a work order. Some wires were moved for better visibility, and this movement initiated the ESF actuation.

Diesel generator A started but did not load into the power system since the normal supply breaker to the bus was closed and power was being supplied by the class 1E offsite power system. As expected, spray pond pump A started, and the control room ventilation dampers actuated; however, the load sequencer stalled prior to completing its operation. As a result, the essential chiller, control room essential fans, and the battery chargers did not automatically start. As an immediate corrective action, Control Room Operators started the essential chiller, and restored ventilation to the control room and power to the battery chargers. The event lasted 49 minutes.

37

e 0

The cause of the ESF actuation was attributed to inadequate pin contact insertion length in the load shed module. All ESF modules have been repinned in Unit I and Unit 2. Unit 3 modules will be corrected prior to fuel load. Additionally, strain reliefs were installed to inhibit wire movement.

The cause of inadequate pin contact insertion is suspected to be a design deficiency. An in-depth evaluation of the pin contact length will be addressed in a 10 CFR 50.55(e) and Part 21 report.

The root cause of the sequencer stall is under investigation and will be addressed in a supplemental report forecast for submission by August 1,1966.

Train A B0P/ESFAS was retested satisfactorily and the sequencer functioned per design during the retest.

There were no unusual characteristics of the work location that directly con-tributed to the event. The inspection was being conducted under the control of a work document. Work documents are controlled by an approved work document procedure. The work being done was not contrary to an approved procedure, and there were no errors in the procedure that contributed to the event. There were no structures, systems, or components inoperable at the start of this event that contributed to this event.

2.5 Reactor Vessel Indications Discovered During Examination of Clad Side -

of Flange Face at Oconee Oconee Unit 1; Docket 50-269; Babcock & Wilcox PWR (An LER was not available for this event; the reference is a letter from H. Tucker, Duke Power Compcny, to H. Denton, USNRC, April 24,1986)

During March 1986, Duke Power Ccmpany (the licensee) notified the NRC that unacceptable indications had been found during an inservice inspection (ISI) at Oconee Unit 1. During the ISI, the reactor vessel to flange shell weld was ultrasonically examited from the flenge face. Twenty-two indications were recorded, all from the clad side of the flange. Only one of the indications extended onto the unclad side of the flarge. The indications were located from 24 to 32 inches from the flange. Previous examinations conducted from the vessel inner and outer diameter surfaces as well as the unclad side of the flange face did not detect these same indications. The licensee stated that with the exception of one geometric reflector recorded in 1979, there were no recordable indications on this weld. The 1986 examination, however, was the first exami-nation conducted from the clad side of the flange face.

Based on the reported size, number and ultrasonic amplitude of the flaw indica-tions in a reactor vessel, other licensees have performed additional inspections to further confirm and characterize flaw indications. Duke Power Company, how-ever, elected to complete the ISI with the available examination data, install the vessel closure head and perform a fracture mechanics evaluation of the flaw indications using the measured dimensions.

Initially, the licensee evaluated the data as though the indications represented real flaws since there was no evidence to prove otherwise. Nine of these indi-cations were acceptable when compared to the ASME Section XI accpetance stan-dard IWB-3510. The ramaining 13 indications were considered acceptable by the licensee by analytical methods permitted by IWB-3600 in accordance with Appen-dix A (Section XI) procedures.

38

Because the licensee decided to resolve the issue by this snalytical method, e.g., Linear Elastic Fracture Mechanics Analysis, NRC Region II requested that the NRC's Office of Nuclear Reactor Regulation (NRR) review the licensee's .

fracture mechanics evaluation. l Two meetings were held with the licensee in the NRC Region II office (April 8 and April 21,1986), during which the licensee presented their inspection results, fracture mechanics evaluation and their proposed action plan. At the April 8,1986 meeting, the hcensee informed the NRC Staff that some of the reflectors may be geometric in origin. This preliminary conclusion was based on a limited qualitative laboratory test on a reactor vessel mock-up at the licensee's Mt. Vernon, Indiana facility. However, the licensee intended to consider the flaw indications as actual flaws and to complete the fracture mechanics evaluation based on the requirements of ASME Section XI, Subarticle IWB-3600.

The Staff reviewed the licensee's submittals, along with additional information requested during the April 21, 1986 meeting, and concluded that Oconee Unit 1 may restart and operate for 8 weeks on the condition that the licensee submit, before June 16, 1986, results on the following work effort:

. Perform a comparison of Units 1 and 3 vessei flange geometry, material (s) and cladding and determine why Unit 3 ISI examination of the same weld did not produce similar results;

. Conduct an ultrasonic examination study on the Mt. Vernon mock-up reactor vessel; and

. Review the original weld design and fabrication history, including non-destructive examination records of the weld in question.

In addition, the Staff stated that the NRC reserves the right to reevaluate its position on the above, in the event that a significant transient occurred on the Unit I vessel.

In a letter dated April 24, 1986, the licensee submitted their fracture mechanics evaluation and a summary of the ultrasonic testing results which located and sized the flaw indications.

NRR has concluded that Oconee Unit 1 can be safely returned to full power and operated with actual flaws of the size and circumferential locations described.

This conclusion was based on the Staff's review of the fracture mechanics analy-sis evaluation performed by the licensee, the pressure temperature limits, and Pressurizer Code Safety Valve Setpoint contained in the Oconee Unit 1 technical specifications. This conclusion was supplemented with the following conditions:

. The licensee would submit, prior to June 16, 1986, a technical report sumarizing their ongoing ultrasonic testing program on the Mt. Vernon mock-up vessel.

. The Staff would review and determine whether the conclusion that the subject flaw indications are enveloped by the dimensions measured by the licensee is still conservative.

39

k

~1

. Because the Staff considers several of the flaws as conditionally accept-able per IWB-3122.4, three augmented ISIS based on 10 CFR 50.55a(g)(4) were required.

. At least 6 months before the next scheduled refueling outage, the licensee will provide a report describing detailed plans for the above augmented ISIS.

On June 13, 1986 the licensee submitted to NRR a , report with the requested infor-mation. This report stated that preliminary results, from the data obtained at Mt. Vernon, point to'a high probability that the data recorded during the Oconee Unit 1 examination indicated geometric conditions. The report provided a' detailed description of the examination of the Mt. Vernon vessel mock-up using the actual calibration block and similar examination equipment to that used during the Oconee Unit 1 examination, and results from those examinations.

Specific recommendaticas for conducting ultrasonic examination (s) from the flange face of the reactor vessel in future ISIS were provided. These were employed in the upcoming Oconee Unit 2 ISI, performed in August 1986. The licensee's report is currently undergoing review by the Staff.

-40 J

w

'O v

3.0 ABSTRACTS / LISTINGS OF GTHER NRC OPERATING EXPERIENCE DOCUMENTS 3.1 Abnormal Occurrence Reports (NUREG-0090) Issued in March-April 1986 l

An abnormal occurrence is defined in Section 208 of the Energy Reorganization Act of 1974 as an unscheduled incident or event which the NRC determines is significant from the standpoint of public health or safety. Under the provi-sions of Section 208, the Office for Analysis and Evaluation of Operational Data reports abnormal occurrences to the public by publishing notices in the Federal Register, and issues quarterly reports of these occurrences to Congress in the NUREG-0090 series of documents. Also included in the quarterly reports are updates of some previously reported abnormal occurrences, and summaries of certain events that may be perceived by the public as significant but do not meet the Section 208 abnormal occurrence criteria.

No Abnormal Occurrence Reports were issued during March-April 1986.

i A l

41

3.2 Bulletins and Information Notices Issued in March-April 1986 The Office of Inspection and Enforcement periodically issues bulletins and information notices to licensees and holders of construction permits. During the period,16 information notices were issued.

Bulletins are used primarily to communicate with industry on matters of generic importaTc'e or serious safety significance (i.e., if an event at one reactor raises the possibility of a serious generic problem, an NRC bulletin may be issued requesting licensees to take specific actions, and requiring them to submit a written report describing actions taken and other information NRC should have to assess the need for further actions). A prompt response by affected licensees is required and failure to respond appropriately may result in an enforcement action. When appropriate, prior to issuing a bulletin, the NRC may seek comments on the matter from the industry (Atomic Industrial Forum, Institute of Nuclear Power Operations, nuclear steam suppliers, vendors, etc.),

a technique which has proven effective in bringing faster and better responses from licensees. Bulletins generally require one-time action and reporting.

They are not intended as substitutes for revised license conditions or new requirements.

Information Notices are rapid transmittals of information which may not have been completely analyzed by the NRC, but which licensees should know. They require no acknowledgement or response, but recipients are advised to consider the applicability of the information to their facility.

Information Date Notice Issued Title 86-14 3/10/86 PWR AUXILIARY FEEDWATER PUMP TURBINE CONTROL PROBLEMS (Issued to all power reactor facilities holding an operating license or construction permit) 86-15 3/10/86 LOSS OF 0FFSITE POWER CAUSED BY PROBLEMS IN FIBER OPTICS SYSTEMS (Issued to all power reactor facilities holding an operating license or construction permit) 86-16 3/11/86 FAILURES TO IDENTIFY CONTAINMENT LEAKAGE DUE TO INADEQUATE LOCAL TESTING 0F BWR VACUUM RELIEF SYSTEM VALVE (Issued to all power reactor facilities holding an operating license or construction permit)

! 86-17 3/24/86 UPDATE OF FAILURE OF AUTOMATIC SPRINKLER SYSTEM VALVES TO OPERATE (Issued to all power reactor facilities holding an operating license or construction permit)

, 86-18 3/26/86 NRC ON-SCENE RESPONSE DURING A MAJOR EMERGENCY

! (Issued to all power reactor facilities holding an operating license or construction permit) 86-19 3/21/86 REACTOR COOLANT PUMP SHAFT FAILURE AT CRYSTAL RIVER (Issued to all power reactor facilities holding an operating license or construction permit) l l

42

o Information Date Notice Issued Title 86-20 3/28/86 LOW-LEVEL RADI0 ACTIVE WASTE SCALING FACTORS, 10 CFR PART 61 (Issued to all power reactor facilities holding an operating license or construction permit) 86-21 3/31/86 RECOGNITION OF AMERICAN SOCIETY OF MECHANICAL ENGINEERS ACCREDITATION PROGRAM FOR N STAMF HOLDERS [ Issued to all power reactor facilities holding an operating license or construction permit and all recipients of NUREG-0040 (white book)]

86-22 3/31/86 UNDERRESPONSE OF RADIATION SURVEY INSTRUMENT TO HIGH RADIATION FIELDS (Issued to all power reactor facilities holding an operating license or construction permit) and research and test reactors) 86-23 4/9/86 EXCESSIVE SKIN EXPOSURES DUE TO CONTAMINATION WITH H0T PARTICLES (Issued to all power reactor facilities hold-ing an operating license or construction permit) 86-24 4/11/86 RESPIRATION USERS NOTICE: INCREASED INSPECTION FRE-QUENCY FOR CERTAIN SELF-CONTAINED BREATHING APPARATUS AIR CYLINDERS (Issued to all power reactor facilities holding an operating license or construction permit; research and test reactor facilities; fuel cycle li-censees and Priority I material licensees) 86-25 4/11/86 TRACEABILITY AND MATERIAL CONTROL 0F MATERIAL AND EQUIPMENT, PARTICULARLY FASTENERS (Issued to all power reactor facilities holding an operating license or con-struction permit) 86-26 4/17/86 POTENTIAL PROBLEMS IN GENERATORS MANUFACTURED BY ELEC-TRICAL PRODUCTS INCORPORATED (Issued to all power reac-ter facilities holding an operating license or construc-tion permit) 86-27 4/21/86 ACCESS CONTROL AT NUCLEAR FACILITIES (Issued to all power reactor facilities holding an operating license or construction permit, research and nonpower reactor facilities, and fuel fabrication and processing facilities) 86-29 4/25/86 EFFECTS OF CHANGING VALVE MOTOR-0PERATOR SWITCH SETTINGS (Issued to all power reactor facilities holding an operating license or a construction permit) 86-30 4/29/86 DESIGN LIMITATIONS OF GASE0US EFFLUENT MONITORING SYSTEMS (Issued to all power reactor facilities holding an operating license or construction permit) 43

s s

3.3 Case Studies and Engineering Evaluations Issued in March-April 1985 The Office for Analysis and Evaluation of Operational Data (AEOD) has as a pri-mary responsibility the task of reviewing the operational experience reported by NRC nuclear power plant licensees. As part of fulfilling this task, it se-lects events of apparent safety interest for further review as either an en-gineering evaluation or a case study. An engineering evaluation is usually an immediate, general assessment to determine whether or not a more detailed pro-tracted case study is needed. The results are generally short reports, and the effort involved usually is a few staffweeks of investigative time.

Case studies are in-depth investigations of apparently significant events or situations. They involve several staffmonths of engineering effort, and result in a formal report identifying the specific safety problems (actual or potential) illustrated by the event and recommending actions to improve safety and prevent recurrence of the event. Before issuance, this report is sent for peer review and comment to at least the applicable utility and appropriate NRC offices.

These AE0D reports are made available for information purposes and do not impose any reauirements on licensees. The findings and recommendations contained in these reports are provided in support of other ongoing NRC activities concerning the operational events (s) discussed, and do not represent the position or re-

quirements of the responsible NRC program office.

Special Date Study Issued Subject S601 4/86 0FFICE FOR ANALYSIS AND EVALUATION OF OPERATIONAL DATA -

1985 ANNUAL REPORT AE0D is part of an overall NRC program to review operating experience in order to identify specific events and generic situations where the margin of safety established through licensing has been degraded, and to identify and recommend corrective actions that will restore the originally intended margin of safety. AE0D's role in the program is to analyze operating experience independent of regulatory activities associated with licensing, inspection or enforcement.

The recommendations contained in AE0D studies are not final NRC positions. They are internal recommendations for action by appropriate NRC program of# ices (e.g., NRR, IE) or Re-gional Offices. The program office or Regional Office is responsible for reviewing and, where appropriate, implement-ing AE0D recommendations. A written response to each recom-mendation is required and a formal action tracking system has been established.

During 1984 and 1985, the NRC sought to identify potential improvements in the existing program for the investigation of significant operational events in response to a response by Congress. Brookhaven National Laboratory was contracted 44

y Special Date Study Issued Subject by the NRC to perform a study to assess and evaluate im-provements to the program. Subsequent to that effort, the NRC staff identified a number of changes in the approach to investigating significant events. The most noteworthy change is the investigation of such incidents by a multi-disciplined Incident Investigation Team (IIT), made up of technical experts from the various NRC offices. These teams prepare a single comprehensive report for each inci-dent describing the event, setting forth the relevant facts, identifying causes, and presenting findings and conclusions.

In 1985, AE0D responsibilities were expanded to include the development and support of the Incident Investigation Program.

The AE0D annual report for 1985 included results from se-lected studies, overviews of three IIT reports, summaries of abnormal occurrences involving U.S. power plants, anal-yses of 1985 licensee event reports, a review of reactor scram experience in 1984 and 1985, a review of engineered safety features actuations, and summaries of studies on loss or unavailability of safety system functions. In addition, the report provides comments and observations on 1985 operating experience involving nonreactor and medical misadministration events. Also included are summaries of studies in progress at the end of the reporting period, and a review of the status of AE0D recommendations provided in previous reports.

Engineering Date Evaluations Issued Subject E604 3/14/86 SPURIOUS SYSTEM ISOLATIONS CAUSED BY THE PANALARM MODEL 86 THERMOCOUPLE MONITOR Recent events involving spurious system isolations at various nuclear power plants were collected and re-viewed. The system isolations were commonly caused by spurious trips of the Model 86 thermocouple monitor manufactured by the Panalarm Division of the Ametek Company. The study found that the elevated sensitivity of the Model 86 thermocouple monitor makes the instru-ment highly susceptible to spurious trips caused by momentary disturbances to the electrical circuitry.

The spurious system isolations caused by the instru-ments are undesirable because of the potentially ad-verse impacts on system reliability, isolation valve operability, and the distractions presented to the plant operating personnel. A design modification to the leak detection system trip circuitry at the Duane Arnold Energy Center has proven successful in preventing 45

+

Engineering Date Evaluations Issued Subject spurious system isolations. The study suggests that the Office of Inspection and Enforcement consider issu-ing an information notice which discusses the spurious system isolations caused by the Model 86 thermocouple monitor and describes the design modification imple-mented at Duane Arnold as a possible corrective action.

E605 4/29/86 LIGHTNING EVENTS AT NUCLEAR POWER PLANTS During the summer of 1985, several nuclear plants in the United States were affected by lightning strikes.

To alert licensees of the problems that were experienced by nuclear units, the Office of Inspection and Enforce-ment issued Information Notice 85-86, " Lightning Strikes at Nuclear Power Generating Stations" on November 5, 1985. To assess the impact that lightning strikes have had on operating nuclear plants,-and to determine the safety implications of the effects of lightning, AE0D conducted a search of the licensee event report (LER) database and a review of the events thus obtained.

The search identified 62 events involving lightning for the period 1981 to 1985. The 62 events occurred at 30 plant sites and involved 32 reactor units. In comparing the number of lightning events, the geographic location of the affected units and the annual lightning strike density at the location, a direct correlation between the annual lightning strike density and the number of events is noted.

The date show that the systems affected are: (1) the offsite power system; (2) the safety-related instrumen-tation and control systems; (3) the meteorological and weather systems; (4) the radiation, gas and effluent flow monitoring systems; and (5) the air intake tunnel halon system.

This report documents the review of the events with regard to how lightning strikes affected these syst;ms.

The report includes the findings of the review and con-cludes that although lightning strikes have adversely affected the operation of some nuclear plants, in most cases, there nas been no significant degradation of safety and minimal, equipment damage. In particular cases where damage has been extensive or where fail-ures caused by lightning strikes have been repetitive, the licensees have taken corrective actions to reduce the consequences of future strikes. (For a more de-tailed review of this study, see Power Reactor Events, Vol. 8, No. 1, Section 1.7.)

46

+

3.4 Generic Letters Issued in March-April 1986 Generic letters are issued by the Office of Nuclear Reactor Regulation, Division of Licensing. They are similar to IE Bulletins (see Section 3.2) in that they transmit information to, and obtain information from, reactor licensees, appli-cants, and/or equipment suppliers regarding matters of safety, safeguards, or environmental significance. During March and April 1986, three letters were issued.

Generic letters usually either (1) provide information thought to be important in assuring continued safe operation of facilities, or (2) request information on a specific schedule that would enable regulatory decisions to be made regard-ing the continued safe operation of facilities. They have been a significant means of communicating with licensees on a number of important issues, the reso-lutions of which have contributed to improved quality of design and operation.

Generic Date Letter Issued Title 86-04* 2/13/86 POLICY STATEMENT ON ENGINEERING EXPERTISE ON SHIFT (Issued to power reactor licensees and applicants for power reactor licenses) 86-07 3/20/86 TRANSMITTAL 0F NUREG-1190 REGARDING THE SAN ON0FRE UNIT 1 LOSS OF POWER AND WATER HAMMER EVENT (Issued to all reactor licensees and applicants) .86-008 3/25/86 AVAILABILITY OF SUPPLEMENT 4 to NUREG-0933, "A PRIORITIZA-TION OF GENERIC SAFETY ISSUES (Issued to all licensees of operating reactors, applicants for operating licenses, and holders of construction permits) 86-09 3/31/86 TECHNICAL RESOLUTION OF GENERIC ISSUE NO. B-59-(N-1) LOOP OPERATION IN BWRs and PWRs (Issued to all licensees of operating BWRs and PWRs and license applicants)

This report had not been listed in Power Reactor Events, Vol. 8, No. 1, which covered the January-February 1986 period.

47

o 3.5 Operating Reactor Event Memoranda Issued in March-April 1986 The Director, Division of Licensing, Office of Nuclear Reactor Regulation (NRR), disseminates information to the directors of the other divisions and program offices within NRR via the operating reactor event memorandum (0 REM) system. The OREM documents a statement of the problem, background information, the safety significance, and short and long term actions (taken and planned).

Copies of ORENs are also sent to the Offices for Analysis and Evaluation of Operational Data, and of Inspection and Enforcement for their information.

No OREMs were issued during March-April 1986.

48

f P .4

.c

,o l

l 3.6 NRC Documentation Compilations The Office of Administration issues two publications that list docurrents made publicly available.

. The quarterly Regulatory and Technical Reports (NUREG-0304) compiles bibliographic data and abstracts for the formal regulatory and technical reports issued by the NRC Staff and its contractors.

. The monthly Title List of Documents Made Publicly Available (NUREG-0540) contains descriptions of information received and generated by the NRC.

This infomation includes (1) docketed material associated with civilian nuclear power plants and other uses of radioactive materials, and (2) non-docketed material received and generated by NRC pertinent to its role as a regulatory agency. This series of documents is indexed by Personal Author, Corporate Source, and Report Number.

The monthly Licensee Event Report (LER) Compilation (NUREG/CR-2000) might also be useful for those interested in operational experience. This document con-tains Licensee Event Report (LER) operational information that was processed into the LER data file of the Nuclear Safety Information Center at Oak Ridge during the monthly period identified on the cover of the document. The LER summaries in this report are arranged alphabetically by facility name and then chronologically by event date for each facility. Component, system, keyword, and component vendor indexes follow the summaries.

Copies and subscriptions of these three documents are available from the Super-intendent of Documents, U.S. Government Printing Office, P.O. Box 37082, Wash-ington, DC 20013-7982.

49

ML20214J794

Text

SUBJECT:

Enclosure:

Navigation menu

Search