ML20134L570

From kanterella
Jump to navigation Jump to search
Petition for Commission & EDO Evaluation of Encl Documents Pursuant to 10CFR2.206 to See If Enforcement Action Warranted Based Upon Info Contained Therein
ML20134L570
Person / Time
Site: Vermont Yankee Entergy icon.png
Issue date: 12/06/1996
From: Block J
CITIZENS AWARENESS NETWORK
To: Julian E
NRC OFFICE OF THE SECRETARY (SECY)
Shared Package
ML20134L556 List:
References
2.206, DD-97-25, DD-97-26, NUDOCS 9702190209
Download: ML20134L570 (64)
v • d • e


Text

.

~

JONATHAN M. DiocK ArrORNEY _

AT LAW _

jonb@sover. net Main Street P.O. Box 566 Putney, VT 05346-0566 802-387-2646 (vox)

-2667 (fax)

December 6,1996 Office of the Secretary United States Nuclear Regulatory Commission Washington, D.C. 20055 ATT: Emile Julian, Esq.

Docketing & Service Branch

Dear Mr. Julian,

Enclosed for filing with the Commission and the new EDO please find two memoranda concerning the Vermont Yankee nuclear power station, docket number 50-271. My client, Citizens Awareness Network, Inc., requests that the Commission and EDO evaluate these documents, pursuant to 10 CFR 2.206, to see if enforcement action is warranted based upon the infonnation contained therein.

Thank you for your prompt attention to this matter, Sincerely, p2~</d ds, onathan M, Block Attorney for Citizens Awareness Network, Inc.

1 enci Memoranda on Vermont Yankee Nuclear Power Station with attachment 9

cc: Deborah B. Katz, President 4 CAN P.O. Box 83 i Shelburne Falls, MA 01370-0083 9702190209 97021221 DR ADOCK 050

- - . - . . ._. .. - ..-- _-. . . - . ~ . . - . . - . - - . . - . - . -

4

~ OFFICE OF THE SECRETARY CORRESPONDENCE CONTROL TICKET I

PAPER NUMBER: CRC-96-1232 LOGGING DATE: Dec 12 96

' ACTION OFFICE: EDO t AUTHOR: JONATHAN BLOCK AFFILIATION: VERMONT ,

ADDRESSEE: EMILE JULIAN, SECY/DSB LETTER DATE: Dec '6 96 FILE CODE: IDR-5 VERMONT YANKEE

SUBJECT:

FORWARDS FOR FILING, TWO DOCUMENTS CONCERNING THE  !

VERMONT YANKEE POW 3R STATION---

ACTION: Appropriate DISTRIBUTION: CHAIRMAN +

SPECIAL HANDLING: 2.206 PETITION  !

CONSTITUENT:

NOTES: ENCLS TO: EDO...PROVIDED TO THE CHAIRMAN'S OTFICE 1 FOR REVIEW PRIOR TO FORWARDING TO THE EDO i DATE DUE:

l SIGNATURE: . DATE SIGNED:

AFFILIATION:

l l

a l

l 1

u 2

i i

l EDO -- G960950 j

MEMORANDUM DATE: December 5,1996 To: Vermont State Nuclear Advisory Panel FROM: Citizens Awareness Network RE: CAN'S analysis of Vermont Yankee's July 23, 1996 presentation on RHR minimum flow valve cc: U.S. NRC and general release Summary of CAN's Analysis of VY's Presentation, "RHR Minimum Flow Valve Enforcement Conference," (July 23,1996).'

4 VY spent much time in its presentation trying to demonstrate that the safety significance of the reported RHR problem was minimal, despite VY's repeated failures to identify and correct it. There may, however, be an outstanding issue ofsome significance. When VYchanged the normal position of the valves to open, they may have introduced a unreviewed safety question. These valves probably perform a containment isolation function. According to the slides, the open valves willnot close on loss of DC power and may not close via remote operation. It is not apparent that VY addressed the containment isolation function when they rixed their problem. In other words, repositioning the valves may only have switched problems rather than eliminating problems.

Vermont Yankee Appendix K LOCA Analysis

. Problem:

The residual heat removal (RHR) system at Vermont Yankee consists of two loops. Each loop has two pumps that take suction from the

, suppression chamber. Each pump has a minimum flowline that connects to a common minimum flow header for each loop that returns flow to the

' Copy attached hereto. CAN hereby gratefully acknowledges the work of Nuclear safety Engineer David lochbaum, Union ofConcerned scientists, Washington, D C. in preparing this memorandum.

s .

., 'j

. suppression chamber.: Each minimum flow header has a minimum flow valve (MOV-16A forloop A and MOV-16Bfor loop B).  !

i In the low pressure coolant injection (LPCI) mode of RHR operation, all four pumps automatically start upon indication of an accident condition.

When the pressure in the reactor vessel drops from around 1,000 psig during normal operation to around 400 psig during the accident, the LPCI 7 injection valves automatically open to allow RHR to pump water from the i

suppression pool to the reactor vessel for core. cooling.- The safety  :'

analyses indicate that the reactor core will be adequately cooled if only one RHR!oop is available.

In the event of a large break loss of coolant accident (LOCA),the reactor  !

pressure decreases rapidly as reactor coolant spills out through the large -

broken pipe. If the LOCA is caused by the rupture' of a small pipe, the i reactor pressure will remain above 400 psig for a long time. The RHR ,

pumps willhave automatically started upon the accident signal, but the l LPClinjection valves willremain closed. To prctect the large RHR pumps, j the minimum flow valves automatically' open to allow flow to be re- I circulated back to the suppression pool. When the LPCIinjection valves open, the minimum flow valves automatically close to prevent flow fiom being diverted from cooling the reactor core.

In the original Vermont Yankee configuration, the RHR minimum flow

, valve .(MOV-16A and MOV-16B) were normally closed. The Vermont Yankee staffidentified that a single power supply failure would prevent both RHR minimum valves from operating. If this power supply failure occurred during a small' break LOCA, all four RHR pumps would automatically start and run without a flow path for a long period of time until the LPCIinjection valves opened. The concern was that all four RHR J

pumps might be damaged.  !

/

It is significant that Vermont Yankee personnel reported at least 10

" missed opportunities" to identify this problem over the 22 year lifetime of. l the plant.

Resolution: l The nonnal position of the RHR minimum flow valves was changed to open from closed. Since the valves still have the single failure l 2

l

~

vulnerability (i.e., now they will remain open if the single power supply failure occurs), Vermont Yankee personnel reanalyzed the small break LOCA event and determined that adequate core cooling would be provided even with some flow diverted to the suppression pool via the open minimumflow valve. This provides reasonable assurance that the facility can adequately handle a small break LOCA event in its current configuration.

To evaluate the consequences of the as-found configuration, Vermont Yankee personnel examined plant and industry experience and

. documented several instances where large pumps, including pumps identical to the Vermont Yankee RHR pumps, operated without minimum flow protection for periods of up to five hours without apparent damage.

This provides reasonable assurance that the facility would have been able to handle a small break LOCA event in its original configuration even with the deficiency.

PotentialProblem:

The RHR minimum flow valves (MOV-16A and MOV-16B) are shown on the slide " BACKGROUND SYSTEM DIAGRAM" to be the first isolation device on a line penetrating the suppression pool below the water line.

Although it is not specified in the presentation slides, the RHR minimum flow valves probably have a containment isolation function. The RHR minimum flow valves at other boiling water reactor (BWR) plants of similar design (FitzPatrick, Browns Ferry, Peach Bottom, Hatch, etc.) perform a containment isolation function. Specifically, the RHR minimum flow valves must close to isolate the primary containment in the event of a pipe break outside containment. y When VennontYankeepersonnel changed the normalposition of the RHR minimmn flow valves from closed to open, they resolved the RHR pump protection problem. However, it is not certain that the containment isolation function of these valves was addressed. According to the slides

" EXAMPLE CASE STUDYSINGLEFAILUREOF DC BUS 1 WITH LNP,"

the RHRminimum flow valves are normally open and fail open on loss of l this power supply. With these valves now normally open, a single failure l could prevent isolation of two containment penetrations.

I l

3 e -

o .

In addition, the footnotes to these slides implythat the RHRminimumflow '

valves may not be provided with remote manual closure capability. Since the RHR minimum flow valves have dual function (to open on low pump flow for pump protection and to close for containment isolation), the operator in the control room must have the ability to override the l automatic open signal to close the valves when necessary forcontainment isolation. In 1992, the New York Power Authority reported this exact deficiency to the NRC(LER50-333/92-037-00 dated July 24,1992).

In response to NUREG-0737 requirements, all licensees were required to evaluate containment isolation dependability following the Three Mile Island accident. It is imperative that the current configuration of the RIIR J minimum flow valves at Vermont Yankee be properly evaluated for containment isolation, dependability, including remote manual closure capability.

I 1

l 4 >

i

a G

-3 Vermont Yankee  ;

Nuclear Power Corporation -

3

=

S

=

32 1

, RHR Minimum Flow Valve ,

Enforcement Conference July 23,1996 ffffkFTY7fJ8Mif fe GLI l

Vermont Yankee Ii

_-- N_uclea.LEower Corpor.ati.on._.. .. . J Attendees  :

i 3

Ross Barkhurst President and CEO i i

Jay Thayer Vice President Engineering l Bob Wanczyk Plant Manager l

Stan Miller Design Engineering Manager l Jim Callaghan Lead Fluid Systems Engineer 1

Michele Sironen VY Nuclear Engineering Coordinator Bruce Slifer Senior Fluid Systems Engineer Jim Duffy Licensing Engineer ft

~

i

_ ,,, . _ . - _ . . . . _ . . - . _ _ _ - --_.......)

I I

n

. _ . . . . . . . . . - . . . , . ~ . . . _ _ , . _ . . , _ . , . . o i e Enforcement Conference Agenda  !

) o

-_. _ ........_...... . .. ._ .-...... .. - ....... ..... ..> P i

r.

. T

- Introduction Jay Thayer .

Babkground Bruce Slifer i 5 j

- Missed Opportunities Stan Miller j Corrective Action Process  !

- Short-Term Corrective Actions Jim Callaghan j

- Root Cause Analysis Bruce Slifer }

- Single Failure Assessment Jim Callaghan  ! '

s N

Safety Assessment j

- RHR Pump Performance Stan Miller j  !

- LOCA Analysis impact Michele Sironen l

- IPE impact Michele Sironen  !

Conclusion Jay Thayer  !

i d

a f

S Introduction - - - - - - - - - -- --

~ ~ ~ ~ '>

Apparent Violation Nar' row focus: past process insufficient to <

detect / correct problems I Mitigating Factor i 3

Current Corrective Action Process broad based and comprehensive .

?

E"3 g - _ ..

O M

4 N ,

5 2 -

S 4

3 $

L .

l l

l . _ . . . _ - - . _ _ . - . . _ _ .-

Introduction i

l Apparent Violation Failure to perform Appendix K, LOCA analysis assuming worst-case single failure Mitigating Factors

  • Self-identified Prompt and comprehensive corrective actions 4

LOCA analysis had been performed with worst-case single failure known at the time Existing beyond design basis LOCA analysis bounded the identified worst-case single failure scenario E This analysis shows that 10CFR50.46 limits would not i be exceeded n

m o

s i b 5 i

l 9

1

.=

1 I l0 h3  :* * '

- 9N' l % p ..*.*

=

Y a

f!U o

)

[ h

t.  !

. . . g,!)

i.

C ~

e- >e l o i gl y

g -

~  !

." C 35 5?

5 =

[II . =I' t lIl'o {

f E' 'A l CE 1

.. = ,C . ,

g '

5-V g i! q) ~" 3E- ,

2g.

)

Ig

.=

C m 'c geq/v e (0: )

ei le 3  % ;P .=$ =<ia si j!!

j o 6

.=% .):,

x ib,,g s-Q i

  • m* S*M r

"z

=

pi I f :t-w e- ) , :: :: . l l

h b5 l

M $

g l l,{  ; Q.

, I(-

1 g y 4ss ise4 i

a gj" i f i

% ~ $3 !E ~

,' Iy

- m I': A"g-

- C ! 1 :a

@ A 3, Eyl E -f  ;

$ 5

si? }s[ Ifx

.m B~

.. p .

i!>m  :, lIoa, 1: v,, . l 57 . so t #:g z j

l

~~

3 C w  %

g W  ; 3, a

$I hk d$d,I -

=

= ,  ;  ;

__ ,C. 2 me - T

" $ 5, *

    • 5 1 ,,

": 3=

l-l I

I

. I 1 l i  !,

i i

i

- ..- _ .-. - - - - - - - ----.--==.--e- - e ------*---**e w

.w Background g w...

Appendix R Reanalysis Finding ,

A

  • Event discovered as result of comprehensive review E by fire protection team j 7,:

I o

  • Review conducted as corrective action in response to Appendix R violation l l
  • Cabic-by-cable verification was in progress for all i

systems g

  • Cross-connects between Bus 3 and 4 identified
  • Appendix R team identified single failure concern and promptly initiated event report process f

_ _ _ _ _ _ _ _ _ _ _ _ 7 q

____ _ _ _ _ _ _ . . _ _ _ . . _ _ _ _ _ _ . _ _ _ . _. . - - _ - _ _ _ _ . , . - . . _ _ .. ___ _ _ _ _ _ _ _ _ _. _ _ ~_ ___ . _ _ __ _ _ _ _ _ . . . . _ _ _ .'

-6 -6#6e Ahwm m m,

..*ge. ewe.

Missed Opportunities To Prevent: '

  • Failure to address vessel draindown concern (1971)  ;

I Failure to change P&lD (1971)

Failure to perform thorough single failure evaluation (1974)

)

i

~~ ~ ' ^~ ~ ~~ ~ ~ ~

O 4

8 -

9 4

_ _ m ___ -. . - _ - ..-

?

Missed Opportunities ,

. =

7 To Discover: a

  • Generic evaluation of de power failure (1978)

GE safety evaluation regarding minimum flow design adequacy (1987) 0

- LER 89-09 single failure results in loss of both RHRSW Icops (1989)

- - - ---~ - - ~ ~ '

- - - ~ - ~~

-~Z 9

g .

o i

Missed Opportunities 4

To Discover: t Plant Design Change Reques1 (PDCR) 89-04 ,

Review of Cooper Significant Event Report (1993)  ;

  • New LOCA analysis with RELAP5YA (1993) 3 + Transfer IPE insights to design basis LOCA results (1993)

- P&lD corrective drawing update to show minimum flow valves closed (1995)

E.

a b

? _

e; 10 .'

i

' t

e

-a a i Missed Opportunities ,

e t

3 m

Fundamental Question 3

  • With the opportunities presented over 22 years, how ..

did we fail to identify this mistake earlier?

b i

1_1

Missed Opportunities

  • Need for questioning attitude in all activities not consistently reinforced Methods for performing event evaluations not always broad enough in focus Deuign basis documentation not easily retrieved
  • - " ~ - * ' " * ' " " ' * ' " - * * * "

-_ .~-- _

M O S

e E,

. g-Program improvements ,

e U

= Improved questioning attitude / safety culture / external perspective

- Improve review process and set higher management expectations for evaluating operating events

  • Significant improvements in engineering training programs

- Accelerate DBDs for high and medium safety g significant systems consistent with IPE and Maintenance Rule a Complete FSAR upgrade in 1997

  • Developing System Engineering Program

- '~

,.,,,.me-eA-*- -"""*

ia I

Missed Opportunities Summary

  • Continued emphasis on questioning attitude and safety culture supported with external perspective

- Problem evaluation program has been improved over the years and is in the process of additional improvements

  • Design basis documentation and FSAR upgrades to be accelerated ma -_-,,m_m ,w ,, ., , __ _ ,_ _
  • Nw-* - eem-me e ese- w-+

b e

O e

- - _ ___ _ _ _ _ _ - _ _ _ - _ _ _ . _ _ _ _ . _ - _ _ . . - _ _ . . - _ - . - . _ . . - _ _ _ . - - _ _ _ _ - - - - _ . . - _ - - .- ----__--_ , a

T 1

4 2

Corrective Action Process  ;

Short-Term Corrective Actions Prompt event report and immediate operability a assessment Basis for Maintaining Operation (BMO)

Timely 10CFR50.59 safety evaluation for valve b position change

,,,,,m,,w , - - +m----N* *"" '~~* ' '- -

Short-Term Corrective Actions Event Report 96-229 Initiated April 11,1996 on LOCA single failure analysis con'cerns (1615)

Initial design engineering assessment on operability concern

- Pump vendor information limited break size concerns

- Industry events of RHR pumps in no-flow condition  !

- Analysis for one core spray pump and ADS (1993)

- Discussed evaluation with plant management and NRC Resident on April 11,1996

,_,,,,,m..-m e my em-4e em d'"* *N" * * * *"

4 16 ,

e

r . .

i i

Short-Term Corrective Actions .

Event Report 96-229 Discussed concern with shift supervisor on April 11,1996 (1710)

- Shift supervisor determined, based on engineering evaluation, no immediate operability concern

- Shift supervisor determined VY was outside design g basis per 10CFR50.72(b)(1)(ii)B

- Shift supervisor initiated non-cmergency, one-hour notification (1724)

,y ._, .m mw 'M=

  • G

_____,__._______.____________.____--.s-,, - m ~.-. .- _--- ___ m -,_- _-____ _ -m - __ _ _ _ ___ - m __ . .-

Short-Term Corrective Actions Event Report 96-229 Event report discussed at event report screening m'eeting on April 12,1996

- ER was determined to be a Level 1 event, the highest level available

- Basis for maintaining operation was requested within a seven day time frame

- . .~. l

1. _

_ _ _ . . _ _ . - . _ _ - - .-. - --- - - - - - - - - - - -- - - - - - - - ------ -~ - - ~ - ~ ~-

4 4

~ ~'~ ~ ~

l Short-Term Corrective Actions -

Event Report 96-229 Event report presented to Plant Operations Review Corhmittee (PORC) immediately following screening

- Significance of finding led to speciai PORC presentation

- Event discussed in length, with emphasis on operability concerns g

- PORC determined initial assessment acceptable, re-emphasized BMO time frame

  • Formal root cause analysis initiated based on Level 1 event report

,,_ , , ,,, w-- ag-,- -- -'* "- ' - - - * ~

19  !

Short-Term Corrective Actions Basis for Maintaining Operation (BMO 96-07)

J

  • Identified factors which compensated for adverse f condition

- Discussions with pump vendor of potential damage

- Industry experience of pumps operating in a f no-flow condition

- Analysis for one core spray and ADS LOCA case

- IPE analysis conclusion of low risk significance

. - .-.~ -

m-m,, ,, ,, ,,m,, . ,

==eme , - w. m-a. - w mumm. e+wes mm.,n . e m.-

$ e

~ @

s Short-Term Corrective Actions e e

n Basis for Maintaining Operation (BMO 96-07) ,

a

  • Recommendations for correcting the condition g e

e

- 10CFR50.59 initiated to support line-up change for 3 minimum flow valves "

  • BMO 96-07 presented to PORC April 19,1996

- PORC concluded basis for operability was sound g but additional documentation was needed x

  • BMO 96-07, Revision 1, presented to PORC April 25,1996 and approved by Plant Manager on .

May 1,1996 I 1

O 2I

Short-Term Corrective Actions 10CFR50.59 Safety Evaluation

=

Safety evaluation of changing normal position of mi6imum flow valve initiated Comprehensive design basis evaluation considered:

- Originai system design and minimum flow valve position

- Impact of position change on current calculations (LOCA, long-term containment cooling) .

- Impact of position change on Vermont Yankee programs (Appendix R, Appendix J, ISI, IST, MOV)

- Impact on plant controlled documents (FSAR, procedures)

- Discussions with other utilities

, , , . - . . - - . e w * *** "" " ' ~~

22 e g

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ . . _ _ . _ _ _ _ _ _ _ _._ . _ _ _ _ _ _ . __ _ _ _ _ _ _ _ _ _ _ . ____ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ ._, __ ___ ____ _ ___.______m

s Short-Term Corrective Actions =

s 10CFR50.59 Safety Evaluation ,

M

  • Safety evaluation was presented to PORC on i Apdf 24,1996 $

. h

- Evaluation accepted with commitment to address changes required

- Evaluation approved by plant Manager on April 25,1996 0 Minimum flow valve normal position changed to open on April 26,1996 .

I 23

l l i .

_ 4

_ 4 2

9 s .

n

. i o

_ t

- - c

_ A

- e e

. i v i v _

. t s _

c y r e n

e e

a t h

r m a e r t p

i d r o m u m e p m

. C S r o m m

o _

P C _

I m

r * * *

. e _

- T-t

_ r .

o _

h _

S ,

m

e 5

Root Cause Analysis Loss of RHR Minflow Protection

=E=?

lr y. - - .:0 ]0, ST~~ ~ ,2.

~5' 0

=- .

.:"O

=?.

.~

..__. . . - - . _ . . - - . . - - - . - -.-.-..------------M----: - - - - - - - - . - - - - - - - - - - - - - - - - - - ----

VV

--z

.-au mw.uurm 4

-- - _ _ _ _ - _ _ - _ - . . _ _ _ _ . - . - _ . - - - - - - _ - - . - - - _ - . - - _ - _ - - _ _ - - _ - - - _ _ - - + - - _ _ _ - - - _ - - _ - _ _ - - - - - - _ - - - . - _ _ - _ _

t Root Cause Analysis i

Loss of RHR Minflow Protection esse one p es** es eenperseg  :

t '"***'*'

  • [

{ i w I woes =teman e_,. s  : ---

. -e  ;

i i

, P&Oseuscliengse EN sia ,; _ _ _ _ . .

P89* I 7 to ste.estee.mesensup b..tegneserts

. ee om p ,

page 3 l

i i __.__.. __ _ _ _ _ .._. _ . . _ _ _ _ _ _ _ _ _ _ _ . . _ - - - - - - - -- --

w ------------g - - ------- - - - - - - - - - - - - - - - - - - - - - -- - -

---]

o. ,.=-

t-a -

nmueuw wsren4

~

8 9 4

e b d

e e

2 Root Cause Analysis Loss of RHR Minflow Protection

=== = _ . ,::: --

~ ~.: ;-- ~* -~ ~ ~ e f.:r..'.'2 ~: =,

$ e ..~.s 6 ,

" -8"

  • .e* et S ee m

": :I .:(E: g

=.__.

9=

. =- ==

==.2: ..

. ' ? " #~~

W

~L n=uru = man

-- _y 9

Root Cause Analysis Event Definition .

- Failure to provide minimum flow protection for cross-powered RHR pumps

+ Primary Effects

- Minimum flow valves closed by procedure, but P&lDunchanged f

- RHR Pumps B and C cross-powered but not minimum flow valves

__ _ ___...--w- - - - - - - - - - * - ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ' * ~ ~ ^ ' ~ ~

l Root Cause Analysis E

s I

  • Root Cause '

si e

- Inadequate design / single failure evaluation f

  • Contributing Causes

- Inadequate documentation of minimum flow design basis @

- ECCS design focus on large break phenomena

- Design engineers assumed minimum flow valves were open when they were closed (

s s

_ _ . . . . _ _ . . - - - - - - - - - - - ~ - - - - - - - " ~ - ~ * * * ~ ~ ~ " ~ ~ ~ ~ ' ~ ~ ~ ~ " ~ ~ ~

h 3

a 29 -

i i

Root Cause Analysis .

t Corrective Actions - Completed Maintain minimum flow valves open during normal operation Revise LOCA analysis to account for failure of valve to close I

a Review current design change process to ensure broad scope, comprehensive reviews i

_ _ _ _ _ _ . _ _ _ _ . . . _ . . . _ - - -- . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ' - - - ~ ~ ~ ~ ~ - - - ~ ~ - - ~ - - ~ ~ ~ ~ ~ ~ ~ - ~~ ~ ~ ' ~

30

  • B $

s 3

Root Cause Analysis  ;

Corrective Actions -In Progress Complete single failure vulnerability review for all ECCS

  • Revise FSAR description of minimum flow function i

Revise P&lD to show minimum flow valves open

8 Develop policy on use of P&lD as design basis document

~

- * - ' ' ~ * * * * * * * ^ ~ * * ~ ~ ~ ~ * * * * * - - ' " " * ' ~ ~ " " ~ ~ ' " " ' ' ~ ~ ' ' ~ ~ ~ ~ ~ ~ ~ ~

31 b

__._______._.m__ _ _ _ . _ _ _ _ . . _ _ _ _ _ . - _ _ _ _ _ _ _ _ _ _- - - _ _ _ _ _ _ _ _ _

Root Cause Analysis Corrective Actions - Planned Provide copies of RCA and missed opportunities to:

- Task team working on OE assessment improvements (7/96)

- Training Department for inclusion in ESP training (7/96)

- Design engineering personnel (7/96)

Self-assessment of process used to transfer analysis assumptions to operating procedures (12/96)

Self-assessment of drawing revision process (12/96)

- - ~ '

- - ----- --- - - - - . - ~ - - - - - - - - - - - - - - - - - - - - " - - - ---~-

9 32 8 9

-.____m.__._ .._.___._____ ___.______ _ __ _ _ _ ___ _._____ _ - - - _ -__

=

s Root Cause Analysis-- - - --- --

Summary

  • Investigated event origins
  • Identified root and contributing causes v
  • Corrective actions 4 IR

,g . _ . . . .

, M m -

4 i5

=

h

=

33 w - .- a n --- --,- __ -_ _ _ _ _ - - - - _ a

ECCS Single Failure Assessment

  • Purpose

- Identify all single active failures

- Confirm ECCS design basis LOCA requirements are satisfied i

rece e.m em e. es m,ew-ww-mm - neue e -ame -m-muur+e* - - - -- * * * = =-m MN **-*'"*N*"hN ***d'" "* N * * " ""*** " * * * *

  • e e

34 e 9

- - ..- e.

. _ .- - _m - - _ _ . . - -

ECCS Single Failure Assessment Scope

  • Initial detailed assessment complete - undergoing independent review
  • ECCS systems / components

- HPCI

- ADS

- CS

- LPCI h

- Electrical systems 125V/24 Vdc power 4 kV/480 Vac power 480 V/LPCI-UPS power m -- s-

- , g , , , , , _

em eewe 4 meg mesma m meem = wee -u-meow - emwme -enaeme wmme,w m .m

es ei se o w w m a,.

s mee ammummmmmmmma em m menemme mun-e

ECCS Single Failure Assessment Scopo >

  • Short-term ECCS injection (blowdown, refill, reflood)

- No credit for ECCS delivery to broken loop / pipe

- Coincident loss of off-site power 1

_.. . . . . _ . - - - . - - . . . - . . - - - - = = = - - - - - - - - - - - - = - - - - * - - - - - - * . ~ * - - - - * * - - - - - - - - = * * * " * * * - * - * " " " * * * * * * * " " - * " - " *" -

b

& g

1 O '

o .

l I

ECCS..S. ingle _ F.a. _ilure.. A_._s_s_essment___ ___

P Bounding Single Active Failure Cases DC-1 bus failure DC-2 bus failure

- LPCI UPS failure r

v e

N m

-4  !

N 37

_ m__am_____ ____.____ - i.____.__-____-__m_m __.-_.___ _ _ _ . _ _ _m_.___ - - - _---______2__-__-____m________ _ _ __. --

1 i -

1

! co 4 i

co .

I 1  !

i 1

! l

\ l i

l I i

hh E EE  ! 't E'E E III  !!Il ! i't 3  !!!! %

Z  ;

) 0$ $ I I I 's II I E!E E!!! E h'5 8  !!!! *u l

[,

iij

a. .t .t .
. 'e

.. - _t e -r .::. . .t .a s. 'g

.. .e t.e : f, s uam '

b .I I

t

.t . .t .t 's

. .t .e .e -tr- .e g

. .e .t .s .: 5 'r. 2 . .E' ': ',

W -

l V

i s'

5 l

I.

4mmf t .e e

.: .: 'g

.e.r .  ::: g gs e r, r_ f., . ggg s W $

g 4

. ..- .-28 . .:. .... .

n . .

(

.E .a .t .t .t

'* Et .t 8. I. . f

-- .E .t. .t .E t t !- - .!  :. .E .t..  ?. f.

& =

-j - -

e i I

.I

  • I..g II t .* ,

C E

g

.E .E .I .E .E- E I

_g j .! .! .C .! I.

g . .

C u

"" a 2

T 3

g f .g g g g

g*

  • g:* g***

a f I

;. .. gg=a i i

G b,

f

,:s  !

m.,m , -

n 5 i U i .k I ., g . -

. --s.

. , g. f * - s< <: 8 *

3 w * .4%ugqq.q ,g-1bug.99 e5q t - s
=.=.=* = awa
:e 4 $ g" tw

! 4 EN i

  • d f

> =i 8

  • g i3 = -} l tid:
  • 3

[sI []seg .:e

. 3 3 23 e. e mm = * * *

  • sg -

- .: j 9a E g t- 3.ps_: e 1 3.812

a 8
;
  • fg . e asw r 8 a= Wit.gg=- i.

i >* 2  ; e ss*.[:..== 3 . ,

E v 2  : 63 ;* 6s* s"

.T

  • E :. . .y
~7?*$ssJJ A J 3
  • j
  • j . 2 y 6 3 j . 22 e "

s amme  ;

i 3

g. 77gg ~~** g. gy*gg*

5 8

.F -$

E, _} , .._ sees .. s(Y e e .* * - c

-3 l T

g 5

C 2

s.

3 E p.

. U S

p. .  !

E f

.I I' 5, I

L i E E

I 1

i I

I i

{. -

l cs

,- I. n t

l l 1

1 l

l

, k ih!  !!!!! ! Ei!!! $5'; ! !

Z Ij!  !!!!! !!'s ! !

y I!!!! ! i i

E t4

" p~

-  :::::...8.  ::::: : :' : :

.......J ~

I 2

I i u .I. i

.t=.d :r: ' .

E  !

.s

_r

.t

.e

.1 _r,la a

13

$ =

) g i" I f hk

'6=8

{ } 33333 ; j;;;; 33e f 3 3 j g1 jj W ~}

3

.t s

. I_i : 1.i[

g 5 h  !!!!! E $

2

!!!53 33's  !! N55tl 0 9 2 I I er %

@ t - -

3 3

8 -

3 2

-s 2 .L1

-- [I gl t

. m u -1 3 1 - -t3 i is.is

::::.  :  ::::: ::  : : g <

7 -

t . . . .

a 1i i;11 2 7 il 1.

- O - Iu -

!!. *i isai i

Eh 51 a] S3155 S E!!!! !!'s ! ! 1t 17 b@ L. -

8 8

~

23 : :41;:idi LI:UDE 1

'D3i 8

3-3 k . g N 3 5 d g:

3

  • l9:sI3 9 2

.1 r _[3 I~12 1

iaii si!!!it "flN I'!111gElll!ii I

l X -@ rr 5  :

0 E

s; =t s:

- . y 1 .1 rI.

2.1 2gete r . I. $ ie -

n9 5 s .,

z

-3 :.__ .. g g

+ 3 t1 J }I 14: 42 ; re:: .. gag,

~i38: 2 gT _ s_

@ E. $E?ig E !sl!;lli!}I~ gl1111:g..3;],II:j t

88.3.'I:,jie: O n.

!1 5i

- !3 ts! ' - 1 t e: Em. 3; In-i-lr--

--fIl U l sus * :

C 'e-r3I ttt. -I m;gj2::3**::

11: e - -

C 4.:h. =. ,.: .r }.I=df b. 3 13 . : . '3_!11.E 8

_o.

~l

<<Elissah,!.l-!! '.*. ..

.3. < =. .

. .v.illt s st :ltigia

. . . . . ! .g .a:

i -l s i

pa 1-  ! .

d ;;0 5%

9 W c'  :  !- *I !______.___ce-i A::::cece;;;;; e44.:s iv t b, E

i 2 i

[

l i

ECCS Single Failura Assessment Summary

  • Did not identify any new single active failures
  • ECCS availability matched design basis LOCA analysis

. ~ .

t p

____.m

w- - - - ~. . - . . . . _ - - -

e i

Safety Assessment 3 5

RHR Pump Performance ,

b

= lmmediate operability assessment E d

  • A PWR operated an RHR pump 66 minutes in a 5 no-flow condition without damage

- Another PWR tested a spare RHR pump in a no-flow condition for approximately one hour without damage

- A BWR operated an RHR pump in a no-flow condition for more than one hour without damage 41 0

Safety Assessment RHR Pump Performance

  • Sister utility ran RHR pump for five hours in no-flow c6ndition (1981)
  • Pump remained operable

- Pump tested three days later - no degradation in head / capacity Pump test showed low vibration levels giving assurance of no mechanical damage

  • Pump was of same manufacturer and model as Vermont Yankee pumps l

42

, 9 i

F Safety Assessment 2 E

LOCA Analysis impact .,,

K

  • Original ECCS design basis analysis relied only on CS and g!

ADS.  ::

  • SAFE /REFLOOD ECCS analysis results (intermediate-to- g large breaks) unaffected by availability of RHR pump
  • Realistic ECCS analyses using SAFE for small breaks with one CS System + two ADS valves: PCT < 2200*F

= RELAPSYA-BWR beyond design basis analysis - one core spray + ADS: maximum PCT = 1806"F n

- RELAPSYA-BWR design basis analysis - current, RHR

minflow valve open
maximum PCT = 1793 F

= With current analysis methods (RELAPSYA-BWR) 10CFR50.46 limits would not be exceeded due to loss of all I LPCI flow S

43 $

~

m_____ _ ,___._. ~ ~ . .___._<e _ _ __-%-.___ __ __.___ _ ___ .-___m_ - ___ __ w- _ _ _ . . _ _

Safety Assessment IPEimpact

  • IPE correctly modeled RHR minimum flow valves cidsed
  • IPE assumed closed valves would fail RHR pumps for small and medium LOCA events
  • Overall CDF of 4E-6 not affected by discovery of

, design basis issue g

- RHR pump failures due to minimum flow valves did not appear in any LOCA sequence >1E-9

'~_..

44 e+ E

y_ .

o (

o .

Safety Assessment . _ . . . _ _ _ . . _ _ _ . _ _ _ . . _ _ _ . . _ . _ .

Summary RHR pumps are expected to work

  • ECCS criterion is met

,y o

3

g. __.

w S

4S

S

_ __.. __ _ Enforcement Considerations _ _

identification

- Self-identified through comprehensive corrective dctions from a previous enforcement action (Appendix R)

  • Not identified through an event 4

v

= Involves an old design issue i

a 2- . . . .

O b

c.

U U ,

46 l

o , .v, o

l Enforcement Considerations Corrective Actions Prompt and comprehensive corrective actions

- Immediate operability assessment

- Basis for maintaining operation

- 10CFR50.59 evaluation 4

v

- Licensee event report

- Comprehensive root cause analysis g - Extensive management oversight g . . . .

M 1

55 i: '

47

f g ,

s .

Conclusion Design Basis / Engineering Program Review .

  • Threshold for findings low Actions on findings more consistent r

o

  • Management reinforcement of questioning attitude 0

g - . - -  !

m  :

a U i t

g -

=

48 ee *

. _ _ _ _ _ _ _ . _ _ _ _ _ _ _ . . _ . _ _ _ . _ . . _ _ _ . _ _ _ _ _ _ . _ . _ . _ _ _ _ _ _ _ . _ . _ _ _ _ _ _ _ _ . _ _ _ _ . _ _ _ . _ . _ _ _ _ _ . _ _ _ _ . _ _ . _ _ _ _ _ . _ _ _ _ _ . _ ____._______J

.. o

s MEMORANDUM i DATE: December 6,1996 TO: Vermont State Nuclear Advisory Panel FROM: Citizens Awareness Network, Inc.

RE: Vermont Yankee Nuclear Power Station 1996 Licensee Event Report Summary (May 1996 - October 1996).

CC: U.S. NRC and general release Citizens Awareness Network's Critical Analysis' of Vermont Yankee Nuclear Power Station's 1996 Licensee Event Report Summary (May 1996 - October 1996)

LER 96-13 Vermont Yankee's analysis:

"The LER describes a fire protection issue that was identified during our Fire Protection Program self-assessment. We identified a section of piping that was not included in the design calculation for the fire sprinkler system. The concern i

was that the water flow to the sprinklers could be less than expected if all the sprinklers activated simultaneously. Although such as activation is not likely, we are recalculatingthe sprinkler system design for such a scenario."

CAN's analysis:

This LER describes TWO fire protection issues: (1) the reactor recirculation pump mo to r generator foam suppression syste m, and (2) the reactor building sprinkler system at elevation 252'. Neither j the LER nor Vermont Yankee's analysis address the cause and consequences of the foam suppression system deficiency.

3 CAN gratefully acknowledges the assistance of David Lochbaum of Union of Concerned Scientists, Washington, D.C., in preparing these critical analyses.

4 s _

o .

CAN'S ANALVSIS OF VTY'S 1996 LER

SUMMARY

REPORT The LER attributes the root cause to personnel errors by the contractor who designed and installed the sprinkler system. LER 96-20, which )

documents another fire protection d e ficiency, indicates that the Vermont Yankee Cognizant Engineer failed to adequately review the design package which the contractor developed in that case. Vermont Yankee also failed to adequately i review the sprinkler system design package that is

the subject of LER 96-13.

1 LER 96-14 Vermont Yankee's analysis:

"As a result of a concern identified at another plant, we initiated a review of the atmospheric venting capability of our diesel generator rooms. The concern relates to the possible affect on the operability of the diesels due to significant changes in atmospheric conditions inside the rooms resulting from a tomado. Our assessment determined that we needed to improve the venting capability of the

, rooms."

CAN's analysis

I The LER indicates that Vermont Yankee's FSAR has  !

been incorrect with respect to the design features  !

necessary to protect the diesel generator rooms I during a tornado. Although the LER indicates that Vermont Ya nkee may have intended to install i appropriate protective devices, it never did so.

This lo ng standing deficiency raises serious 1 questions about the safety analyses--such as the Individual Plant Examination--which VY performs to support continued operation of the nuclear power station. The FSAR is used in extremely significant ways relating to safe operation. For example, the FSAR is used as an input document for safety evaluations performed under 10 CFR S 50.59, in the development and validation of the plant simulator, in the development of emergency response procedures, and many other vital activities. Hence, 2

~ *

~

CAN'S ANAL YSIS OF VTY'S 1996 LER

SUMMARY

REPORT

/

i flaws in the FSAR cause serious, rippling effects

, throug'iout VY's safety systems. In cases like those l presented by this LER, Vermont Yankee must include i assessments of the impact of the deficient conditions upon all affected programs. Only in this way can VY accurately determine the general effect of-such deficiencies upon safe operation of the Vermont Yankee nuclear power station.

Vermont Yankee states that there have been no L previous LERs reported to the NRC regarding failure to satisfy design basis tornado protection in the past five years. If this statement refers to LERs submitted- by all licensees and not just those submitted by Vermont Yankee, then it is in error.

The New York Power Authority submitted an LER for a simila r problem at their James A. FitzPatrick Nuclear Power Plant in 1992/1993.

i LER 96-15 i Vermont Yankee's analysis:

"In response to an issue identified at another plant, we performed an engineenng evaluation of certain piping systems.' The evaluation looked at the potential for piping to become overpressurized under certain accident scenarios due to thermal induced pressurization. Pressure relief ports were installed on some sections of piping during the refuelingoutage to address this concem."

CAN's analysis:

The LER deals with inadequate thermal protection

, for piping lines in six systems dating back to i original construction of the facility. VY attributes l the root cause to personnel errors during plant design. Thus, VY fails to point out that every modificatio n to these six syste ms - since construction represents a missed opportunity to identify and correct the oriainal errors.

1 i

I 3

4

CAN'S ANAL YSIS OF VTY'S 1996 LER

SUMMARY

REPORT ,

LER 96-18 Vermont Yankee's analysis:

"As a result of the Fire Protection Program self-assessment, we identified a concem with the adequacy of the fire wrap for a small section of electrical cable.

)

4 The concern was that the configuration of this particular section of fire wTap was different than the manufacturers tested configuration. The fire wrap was modified ,

so that it meets the tested configuration." I l
CAN's analysis- I The LER documents a deficiency with significant )
adverse safety implications. A fire could have rendered inoperable both divisio ns of the emergency core cooling systems. Accordino to the
LER, this problem existed for nearly a decade!

l LER 96-19 Vermont Yankee's analysis:

l "This LER addresses the inadvertent trip of a breaker in our reactor protection system. Our review found that the cause was a loose electricalcorinection. The i

breaker was repaired and retumed to service." I CAN's analysis:

4 The LER involves a random equipment failure that was corrected, As stated in the LER, this event presented no significant risk to public health and i sa fe ty.

LER 96-20 Vermont Yankee's analysis:

"This LER resulted form the self-identification of a concem with the adequacy of how we tested the CO2 fire suppression system for our Switchgear Room. We found that we should have adjusted ~ the testing method following the implementation of design modifications we made to the room."

CAN's analysis:

The LER involves a problem resultino from VY's modification to the plant in 19781 As VY states in 4

~

.CAN'S ANAL YSIS OF VTY'S 1996 LER

SUMMARY

REPORT

'f the LER and discusses in its analysis, VY's subsequent testing failed to identify the design fault. In 1982, VY implemented a modification which affected the CO2 system without conducting any post-modification testing. In this way, the LER reveals a serious deficiency in VY's desian chanae control process. Prudent practice dictates that VY should perform an " extent of condition" evaluation to determine how many other modifications have been inadequately tested since startup.

i LER 96-21 .

Vermont Yankee's analysis: i "The LER discusses the unexpected trip on one of our residual heat removal pumps. The cause of the trip was related to the pump's control circuitry. The circuitry was adjusted and the pump was returned to service."

CAN's analysis:

The LER indicates that Vermont Yankee personnel conducted a thorough investigation to determine if other equipment had the same problem that caused the RHR pump to trip. As VY states in the LER, there was no significant risk to public health and safety.

~

LER 96-22 Vermont Yankee's analysis:

"This LER describes the self-identification of an inoperable breaker associated with one of the diesel generators. During routine walkarounds, an operator noticed a couple of small screws on the floor. He immediately checked equipment in the area and determined that the breaker was inoperable. The breaker was repaired and hil other similar breakers were inspected."

CAN's analysis:

The LER states:

i 5

CAN'S ANAL YSIS OF VTY'S 1996 LER

SUMMARY

REPORT. .-

As the B EDG [ emergency diesel generator]

and the emergency Alternating Current (AC) l power source were at all times .available  !

during this event, and the f ailure of a single  !

EDG is bounded by our current [nucl ear power] pl ant . acci dent and transient analyses, this event did not result in plant operation which endangered the health .or ,

saf ety of'the public. {

1 This statement is ill-founded.

While it may be true that the Vermont Ya nkee nuclear power station accident and transient analyses demonstrate reasonable assurance that lt public health and safety will be protected in event of failure of a single EDG, it is improper for VY'to  :

rely on this argument to justify an EDG failure lasting. longer than the Technical Specification d u ra tio n. Vermont Ya nkee's . Tec hnical Specifications limit that duration to only 7 days.  :

The VY nuclear reactor continued to operate, while {

the failed EDG went undetected for 25 daysl If an  !

accident or transient had occurred .when the EDG j failed, public health and safety would have been {

reasonably assured ONLY if no other equipment failure occurred. Vermont Yankee tries to justify this flagrant breach of safe practice by stating that {

the remaining EDG and the emergency AC power

. source were operable. In order- to maintain safe operation- during accident conditions, ALL of the other emergency equipment (p u mp s, mo to rs, valves, etc.) must respond flawlessly. Hence, it is specious of VY to attempt to justify continued operation without both EDGs fully operable.

Vermont ' Yankee once again misco nstrues the function of Technical Specification limits upon the 6 i i

l J

-. .-. - .. -- ~ - - _ .. - .- - - _ - .-. . - . - - . _

ie

  • hAN'S ANAL YSIS oF VTY'S 1996 LER

SUMMARY

REPORT

.c i

r. )

. d ura tio n fo r which eq uipment may be out of l l -service. The 7 day limit for the EDGs is intended to provide reasonable assurance that ALL equipment  ;

will be operable and available to respond in the event of an emergency. Vermont Yankee has  :

imp ro perly attempted to explain away the I
seriousness of.this deficiency on the grounds that i

the analyses assume only a single failure. 'As a point of fact and law, the analyses assume that a j single failure will occur during VY's response to the l event, not that a pre-existing failure will start the  :

l accident.2

, s

! Once the problem was identified, Vermont Yankee personnel conducted a thorough " extent of .

condition" evaluation that identified and corrected

] simila r p ro blems affecting other breakers.

However, VY's misconstruing the purpose of TS  ;

j limits on equipment' outages appears to be part of  !

.a . chronic pattern of misunderstanding the  !

i d

underlying safety purposes of Technical i Specifications, the FSAR, design bases, and NRC l

, regulations.

4 LER 96-23

$ Vermont Yankee's analysis:

! "During a routine surveillance of a radiation monitor, a technician determined that

{. an output contact of the monitor had not been properly tested. Following a root j cause analysis of the finding, we modified the related surveillance and test 4

procedure to more clearly describe the testing method."

j' CAN's analysis:

As stated in the LER, the radiation monitor was  ;

' demonstrated to be operable when re-tested using '

the corrected procedure. Therefore, this event l 2

i See LER 96-25 for a related misapplication.

i 7

i 4

CAN'S ANAL YSIS OF VT\"S 1996 LER

SUMMARY

REPORT ,

presented no significant risk to public health and safety. t LER 96-25 Vermont Yankee's analysis: -

"The LER describes the self-identification of a concern with the testing criteria we ,

used for a valve in the plant's nitrogen purge system. The engineering review  !

found that the leak testing method we used for this particular valve needed to be i adjusted. The valve was tested using the new methodology during the recent refuelingoutage." .

CAN's analysis:

This LER reports a substantial deficiency in a '

containment isolation valve at the Vermont Yankee l nuclear power sta tio n. The LER states that,

"[l]eakage was beyond the capacity of the test device's capability to measure." This deficient i condition existed since at least 19781 The LER concludes that this event presented no significant risk to public health and safety because a review -

"...show[ed] that since 1978 the applicable pathway leak rates were within TS limitations and accident assumption values....demonstrat[ing] that the containment system was at all times intact, i providing a via ble fission product b a rrie r, consistent with plant design."

Once again, Vermont Ya nkee's conclusion s absolutely wrong and demonstrates a complete lacl.

of app recia tio n fo r the " defense in depth"  !

philosophy underlying NRC regulations.

The deficient containment isolation valve is the first of two co ntainment isolation valves on TWO separate prima ry co ntainment penetrations. If either of the two downstream containment isolation 8

i . _. _ _ . . _ _ _ _ . _ .

1 , . . ,

l,

, CAN'S ANAL YSIS OF VTY'S 1996 LER

SUMMARY

REPORT valves 3 failed

! to close during an accident, the

. excessive leakage through the deficient valve would i not be contained. Such a failure has potentially

[ serious, adverse public health consequences. The

plant' desian reauires that p rima ry containment l intearity be assured in the event of a sinale failure.

Prima ry containment intearity at the Vermo nt

! Yankee ' nuclear reactor could not be established l l

under such conditions. -

j Vermont Yankee yet again fails to properly apply 4 i

the " single failure" criterion when evaluating the  ;

significa nce of incidents at the nuclear power j i sta tio n. VY must not be permitted to accept pre- l

! existing d eficie ncies--pa rticula rly those of a l

protracted duration--in its nuclear safety analyses.

l The analyses assume a single failure concurrent

! with the accident or subsequent to the accident, i

not single failures existing prior to the accident.

CONCLUSIONS ,

i Based upon the foregoing analyses, CAN concludes that:

1.The number of long standing deficiencies VY acknowledges in these LERs--10 to 18 yearsil--

raise serious questions about the adequacy of l VY's safety analyses. VY and the NRC should 1 immediately begin reviewing all of the safety I analyses conducted since startup of VY, with particular attention to their role in providing a complete and up-to-date FSAR. l l

2. VY needs to correct serious deficiencies in its design change control process. VY should immediately commence a review of its design 3

Valves 23 and 9 on the figure provided in the LER, d

See LER 96-22 for the other instance.

9

CAN'S ANAL YSIS OF VTY'S 1996 LER

SUMMARY

REPORT \

i l

control process, including an historical review of its design control documentation to verify the  !

accuracy of this documentation when compared with the actual, physical configuration of VY. I

3. VY should perform a global " extent of condition" evaluation to determine how many modifications l

! have been inadequately tested since startup. As l a corollary, any and all untested (or long ago  ;

tested) systems at VY should be immediately tested (or re-tested). 1 4.VY needs to initiate an thorough retraining program to review and emphasize the underlying safety purposes of Technical Specifications,'the FSAR, design bases, and NRC regulations in relation to routine operation of the nuclear power station, emergency preparedness, and practicalimplementation of the NRC's " defense in depth" philosophy. l 5.CAN strongly recommends that the Vermont Yankee staff receive training on the proper use  ;

of the " single failure" criterion. i 4

1 10 t J

Retrieved from "https://kanterella.com/w/index.php?title=ML20134L570&oldid=2872074"