A.2.4 REFERENCES
INPO Significant Operating Experience Reports
INPO Significant Operating Experience Report 84-7, Pressure Locking and Thermal Binding of Gate Valves, December 14, 1984.
INPO Significant Event Reports
INPO Significant Event Report xx-9 1, - In Preparation - Inventory Drain Down, 1991.
INPO Significant Event Report 26-89, Loss of Residual Heat Removal Capability Due To Common Mode Failure of Flow Control Valves, October 4, 1989.
INPO Significant Event Report 11-89, Inadvertent Introduction of Hydrogen Into The Instrument and Station Air Systems, April 11, 1989.
INPO Significant Event Report 5-89, Lack of Control of Testing Disables or Challenges Safety Systems, March 3, 1989.
INPO Significant Event Report 36-88, Loss of Residual Heat Removal Due to Misleading Visual Indication of Water Level, November 30, 1988.
INPO Significant Event Report 35-87, Non-lsolable Reactor Coolant System Leak, November 12,1987.
INPO Significant Event Report 3 5-86, Extended Loss of Shutdown Cooling due to Steam Binding of Shutdown Cooling Pumps, October 24, 1986.
INPO Significant Event Report 31-86, Loss of Residual Heat Removal Flow Due To Inadvertent Draining Of The Reactor Coolant System, September 3, 1986.
INPO Significant Event Report 23-86, Loss of Decay Heat Removal Due To Inadequate Reactor Coolant System Level Control, July 3, 1986.
INPO Significant Event Report 17-86, Loss Of Shutdown Co. , Flow, May 27, 1986.
INPO Significant Event Report 79-84, Loss Of Shutdown Cooling Due to Inaccurate Level Indication, November 14, 1984.
Operating Experience Review Implementation Plan 27 of 50
NEDO-33262, Rev. 2
INPO Significant Event Report 71-84, Residual Heat Removal Pump Damage Caused By Operation With Suction Valve Closed, October 2, 1984.
INPO Significant Event Report 60-83, Loss of Residual Heat Removal (RHR) Cooling During Reactor Vessel Drain Down, August 30, 1983.
INPO Significant Event Report 59-83, Residual Heat Removal (RHR) Pump Suction Valve Closure Due To Control Circuitry Design, August 18, 1983.
INPO Significant Event Report 13-83, Unplanned Radioactive Release and Loss of Shutdown Cooling, February 25, 1983.
NSAC/INPO Significant Event Report 95-81, Automatic Valve Closure Causing Loss of Shutdown Decay Heat Removal, November 25, 1981.
NSAC/1NPO Significant Event Report 91-81, Steam Voiding in the Reactor Coolant System During Decay Heat Removal Cooldown, October 6, 1981.
NSAC/INPO Significant Event Report 89-81, Level Instrumentation Oscillations Due To Reference Leg Flashing, October 23, 1981.
NSAC/INPO Significant Event Report 87-81, Inadequate Reactor Coolant System (RCS) Water Level Indication, October 19, 1981.
NSAC/INPO Significant Event Report 78-81, Erroneous Indication. Reactor Vessel Level Causes Loss of RHR, October 1, 1981.
INPO Nuclear Network Entries
INPO Nuclear Network, WE 655 ENR PAR 90-061, Residual Removal Flow Fluctuations During Drawing of Vacuum in the Reactor Coolant System, September 19, 1990.
USNRC Reports
USNRC. Ornstein, Harold Dr., AEOD/C503 Case Study, Decay Heat Removal Problems at US. Pressurized Water Reactors, December 1985.
USNRC Information Notices
USNRC Information Notice, No. 90-61, Potential for Residual Heat Removal Pump Damage Caused by Parallel Pump Interaction, September 20, 1990.
USNRC Information Notice No. 90-26, Inadequate Flow of Essential Service Water to Room Coolers and Heat Exchangers for Engineered Safety-Feature Systems, April 24, 1990.
USNRC Information Notice No. 90-06, Potential for Loss of Shutdown Cooling While at Low Reactor Coolant Levels, January 29, 1990.
USNRC Information Notice No. 89-67, Loss of Residual Heat Removal Caused by Accumulator Nitrogen Injection, September 13, 1989.
USNRC Information Notice No. 88-36, Possible Sudden Loss of RCS Inventory During Low Coolant Level Operation, June 8, 1988.
Operating Experience Review Implementation Plan 28 of 50
NEDO-33262, Rev. 2
USNRC Information Notice No. 87-51, Failure of Low Pressure Safety Injection Pump Due to Seal Problems, October 13, 1987.
USNRC Information Notice No. 87-23, Loss of Decay Heat Removal During Low Reactor Coolant Level Operation, May 27, 1987.
USNRC IE Information Notice No. 87-06, Loss of Suction to low-pressure Service Water Pumps Resulting From Loss of Siphon, January 30, 1987.
USNRC IE Information Notice No. 86-101, Loss of Decay Heat Removal due to Loss of Fluid Levels in Reactor Coolant System, December 12, 1986.
USNRC IE Information Notice No. 85-75, Improperly Installed Instrumentation Inadequate Quality Control and Inadequate Post Modification Testing, August 30, 1985.
USNRC IE Information Notice No. 84-70, Reliance on Water Level Instrumentation With a Common Reference Leg, September 4, 1984.
USNRC IE Information Notice No. 83-88, Air/Gas Entrainment Events Resulting in System Failures, November 14, 1983.
USNRC IE information Notice No. - 9 Degradation of Residual Heat Removal (RHR) System, March 26, 1981.
USNRC IE Information Notice No. 80-20, Loss of Decay H. Removal Capability at Unit 1 While in a Refueling Mode May 8, 1980.
USNRC Generic Letters
USNRC Generic Letter No. 88-17, Loss of Decay Heat Removal, October 17, 1988.
USNRC Generic Letter No. 87-12, Loss of Residual Heat Removal (RHR) While the Reactor Coolant System (RCS) is Partially Filled, July 9, 1987. USNRC IE Bulletins
USNRC IE Bulletin No. 80-12, Decay Heat Removal System Operability, May 9, 1980.
USNRC NUREGs
USNRC NUREG-1269, Loss of Residual Heat Removal System, Diablo Canyon, Unit 2, April 10, 19-7, June 1987.
USNRC NUREG-1410, Loss of Vital AC Power and the Residual heat Removal System During Mid-Loop Operations at Unit 1 on March 20, 1990, May 1990.
USNRC SECYs
USNRC SECY-90-326, Quarterly Report on Emerging Technical Concerns, October 4, 1990.
Operating Experience Review Implementation Plan 29 of 50
NEDO-33262, Rev. 2
A.3 EVENT SUMMARIES: LOSS OF OFF-SITE POWER
A.3.1 EVENT TYPE: LOSS OF OFF-SITE POWER
Condition and Concern: Redundant Sources of Power
AC power is needed during shutdown conditions to maintain cooling to the reactor core, transfer decay heat to the heat sink, and restore containment integrity when needed. During shutdown conditions, technical specifications may allow sources of AC power to be taken out of service concurrently although this increases the chance for loss of AC power. Removing sources of AC power concurrently is not prudent during mid-loop operation when the times to boiling in the core and core damage are significantly reduced. Because technical specifications for cold shutdown, refueling, and mid-loop operations are generally not based on a comprehensive safety analysis (including whether the single failure criteria should apply), plants should attempt to maintain as much additional margin beyond technical specifications as is consistent with efficient, low-risk outages.
References: NRC IN 8442; NUREG-1410; INPO SERS 42-81 and 5-89.
Human Interactions of Interest:
Power sources have been found to be most adequate when the following actions are taken:
" Equipment is taken out of service during an outage for maintenance then returned to service in a timely manner I " An attempt is made to minimize the time during which the plant is at minimum technical specifications configuration for electrical power modifications and work applicable to the above period are reviewed to ensure they do not affect existing operable power supplies (e.g., inadvertent relay actuation causes a loss of bus)
" Minimum technical equipment guidelines exist for conditions not covered by technical specifications in order to meet commitments of the site emergency, security, and fire protection plans
" Plant personnel are aware at all times of the status of safety electrical systems and unusual interdependencies created due to new configurations
" Testing of essential safety equipment is deferred if possible when plant is at or near the minimum technical specification limits
A.3.2 EVENT TYPE: LOSS OF OFF-SITE POWER
Condition and Concern: Switchyard and Electrical Equipment Activities
Of the 37 losses of offsite power events during shutdowns from 1965 to 1990, 18 were initiated as a result of human error. Most of these errors were associated with maintenance activities such as switching errors, electrical maintenance and testing, and inadequate procedures. Inadvertent grounding of transformers also led to loss of offlsite power. Working on energized equipment can also result in severe injury or loss of life.
Operating Experience Review Implementation Plan 30 of 50
NEDO-33262, Rev. 2
References: SER 17-88 and'36-87, NUREG 1410.
Human Interactions of Interest:
Switchyard and electrical maintenance and testing activities can be effectively performed when the following actions are taken:
* Special precautions, such as signs and pre-job briefings, are taken for activities near incoming and outgoing transmission lines and in the switchyard.
* Utility safety and management personnel make periodic inspections of work areas and activities to detect developing hazards or improper work practices.
* Proper protection boundaries are established, all changes in work activities are considered prior to resumption of work, and entrance and time within protection boundaries are minimized.
* Electrical equipment maintenance is performed by qualified personnel, and license requirements for electrical equipment operation are enforced.
" Relay work on switchyard is included in a procedure that has been reviewed and authorized by the site personnel. Site personnel review, authorize, and possibly control procedures for switchyard work and testing.
* Training programs stress precautions such as the following:
- electrical equipment is assumed energized unless proven otherwise
- tag-out procedures
- resolution of any discrepancies in authorized work instruction
- proper use of safety equipment
" Procedures for working on high-voltage equipment that could cause major losses of power and/or personnel hazards are technically correct and reviewed for consideration of human factors.
" Maintenance activities on vital power lines are avoided to the extent possible during times that the reactor core cooling is especially sensitive to loss of power, such as midloop conditions, or when important electrical components, such as breakers and transformers, of parallel trains are out of service.
" The switchyard is not used as a storage or lay-down yard.
* Portable equipment such as air compressors or diesel generators are located where they can be refueled without entering the switchyard.
A.3.3 EVENT TYPE: LOSS OF OFF-SITE POWER
Condition and Concern: Alternate Power (Cross-Connects/Non-Safety Power/Load Shed)
In the event that off-site power is lost and emergency AC generator power is unavailable, the RHR system function is lost and other safety functions such as closing the reactor containment building are impaired. Alternate power sources can help reestablish power to RHR and other
Operating Experience Review Implementation Plan 31 of 50
NEDO-33262, Rev. 2
safety functions. Various procedures to recover AC power and extend DC (battery) power can be implemented. Under worst case conditions, the inability to restore RHRS function may lead to core boiling in 1/2 hour or less and core damage within a few hours. Temporary hookups and the availability of alternate AC power greatly improves the situation if the backup equipment is available on-site, ready to perform, covered by procedure, and has an installed hookup capability.
References: NUREG - 1410; and NSAC Report. 146.
Human Interactions of Interest:
Actions to align alternate power capabilities are strongly enhanced by the following:
Cross-connect procedures for using alternate AC power sources, such as the following, are available and training is conducted to eliminate unrevealed faults or triggering events.
- If "missing breaker" arrangements are used, personnel can locate and align the breaker and spooling components necessary to cross connect AC power.
- If "interlocks" are used, personnel can cross-connect AC power to the correct redundant trains of safety-related equipment, and administrative controls exist to prevent inadvertent cross connecting that would lead to faulty leg.
- Applicable breakers and bus locations are easily identified to allow switching operations of key components.
- Procedures are in place that require immediate action to reduce loads on DC buses to prevent premature depletion of one of the DC systems and to strip all nonessential loads to extend the availability of DC power supplies.
- Equipment and tools are staged for quick hookup, and operators and technicians are trained on the hookup procedures. Walk-through exercises identify key switchgear and verify that all tools are available, all fittings work, and cable lengths are adequate.
- Procedures are developed to control the most probable alignments for crossconnecting power unit-to-unit or safety-related to nonsafety-related buses. The procedures discuss defeating interlocks, maximum load that can be supplied, and problems created because components such as transformers cannot be isolated.
* Recover AC Power and emergency procedures exist that do the following:
- Diagnose and recover off-site power
- Strip failed AC buses to ensure acceptability of the initial loading when AC power is reestablished - Diagnose and restart on-site emergency AC power
* Backup AC power Sources- Backup AC power sources such as small portable AC generators are provided to maintain DC power and supply power to installed systems. The generators are readily accessible on-site, periodically tested, and have jumper cables tailored to the required applications.
Operating Experience Review Implementation Plan 32 of 50
NEDO-33262, Rev. 2
A.3.4 REFERENCES
INPO Significant Operating Experience Reports
INPO/NSAC Significant Operating Experience Report 80-5, Potential Loss of Coolant Accident (LOCA) From A Single Electrical Failure, September 23, 1980.
INPO Significant Experience Reports
INPO Significant Experience Report 11-88, Inadvertent Disablement of The Automatic Start Capability For All Site Diesel Generators, May 6, 1988.
INPO Significant Experience Report 25-85, Emergency Diesel Generator Failed To Supply Emergency Bus Due To Non-emergency Trip, June 3, 1985.
INPO Significant Experience Report 73-83, Loss ofAll AC Power (Blackout), October 27, 1983.
NSAC/INPO Significant Event Report 56-81, Loss of Station and Reserve Auxiliary Power, August 56, 1981.
USNRC Information Notices
USNRC Information Notice No. 91-22, Four Plant Events Involving Loss of AC Power or Coolant Spills, March 19, 1991.
USNRC Information Notice No. 90-25, Loss of Vital AC Power With Subsequent Reactor Coolant System Heat-up, April 16, 1990.
USNRC Information Notice No. 89-64, Electrical Bus Bar Failures, September 7, 1989.
USNRC Information Notice'No. 89-16, Excessive Voltage Drop in DC Systems, February 16, 1989.
USNRC Information Notice No. 85-91, Load Sequencers For Emergency Diesel Generators, November 27, 1985.
USNRC Information Notice No. 88-75, Disabling of Diesel Generator Output Circuit Breakers By Anti-Pump Circuitry, September 16, 1988.
USNRC Information Notice No. 85-73, Emergency Diesel Generator Control Circuit Logic Design Error, August 23, 1985.
USNRC Information Notice No. 85-28, Partial Loss of AC Power and Diesel Generator Degradation, April 9, 1985.
USNRC Information Notice No. 84-69, Supplement 1, Operation of Emergency Diesel Generators, February 24, 1986.
USNRC IE Information Notice No. 84-42, Equipment Availability For Conditions During Outages Not Covered By Technical Specifications, June 5, 1984.
USNRC. IE Information Notice No. 83-37, Transformer Failure Resulting From Degraded InteMal Connection Cables, June 13, 1983.
Operating Experience Review Implementation Plan 33 of 50
NEDO-33262, Rev. 2
USNRC IE Information Notice No. 83-51, Diesel Generator Events, August 5, 1983. 1
USNRC IE Information Notice No. 83-17, Electrical Control Logic Problem Resulting in Inoperable Auto-start of Emergency Diesel Generator Units, March 31, 1983.
USNRC IE Information Notice No. 80-20, Loss of Decay at Removal Capability at-- Unit 1 While in a Refueling Mode e, May 8, 1980.
Operating Experience Review Implementation Plan 34 of 50
NEDO-33262, Rev. 2
A.4 EVENT SUMMARIES LOSS OF RCS INVENTORY
A.4.1 EVENT TYPE: LOSS OF RCS INVENTORY (BWRs)
Condition and Concern: RPV Drain Down to Suppression Pool
There are a number of potential inventory loss paths from the RPV through the RHR to the suppression pool when removing decay heat. A single mispositioned valve can initiate loss of inventory. Once initiated, the ensuing primary coolant inventory loss has the potential for uncovering irradiated fuel inside the reactor vessel.
A typical BWR has two or three automatic protective features that can prevent a core uncovery, but not all of these features are required to be available during cold shutdown or refueling operations. If these protective features are not in place, most inventory drain-down or pumpdown events will terminate naturally at a water level that exposes about one-third of the core, based on the relative elevations of the core and vessel piping penetrations.
References: INPO SOERs 87-2, 85-1; NRC IN 84-81; GE SIL-388; and NSAC 88.
Human Interactions of Interest:
Inadvertent RPV drain down to the suppression pool is minimized when the following actions are taken:
* Procedures account for loss of inventory during cold shutdown and guide the operator to use alternative water sources and pumps that are likely to be available during shutdown.
* Proper valve lineup is checked prior to placing the RHR system in service.
* Only limited and controlled bypassing of Emergency Core Cooling System (ECCS) functions is possible during shutdown in order to preclude automatic losses of coolant inventory.
" The automatic isolation function of the RHR on low RPV level is operable during shutdown cooling for all potential drain paths, including idle and operating RHR loops.
* Valve interlocks exist to prevent suppression pool and shutdown cooling suction valves from being open simultaneously, regardless of which valve is initially open. Also, interlocks prevent opening of SDC valves and full-flow test return valves at the same time.
* Caution tags are placed on the CR panel next to hand switches for controlling valves that may cause inadvertent draining of the RPV.
A.4.2 EVENT TYPE: LOSS OF REACTOR COOLANT SYSTEM INVENTORY
Condition and Concern: Inadvertent Transfer of Coolant From RCS
Operating Experience Review Implementation Plan 35 of 50
NEDO-33262, Rev. 2
Most large loss of coolant inventory events occur during shutdown. Human performance and procedures are contributing factors. Plant configurations during the outage should not exist where a single failure can result in a loss of RCS coolant inventory. During shutdown periods, the RCS boundary enlarges because low-pressure systems such as the RHR are connected to the RCS. The plant configurations and activities during outages increase the possibility of a valve misalignment that can result in a loss of RCS inventory.
Although primary pressure during cold shutdown is much lower than normal operating pressure, core uncovering can occur in as little as 20 minutes because flow diversions during shutdown tend to be large. Recent events resulted in transfers of 9,500 gallons. A single valve was opened in the RHR system that allowed a direct flow path to the containment spray header. This allowed 110,000 gallons to be sprayed into containment from the primary system and the refuel water storage tank. Other transfers of coolant from the RCS result from improper adjustment of the RHR suction relief valve or from premature lifting and excessive blowdown of residual heat removal relief valves.
REFERENCES: NRC IN 90-55, 81-10, 86-74, and 84-81; NSAC Report 52 and 43; INPO SOER 82-4, and SER 31-81 and 5-90.
HUMAN INTERACTIONS OF INTEREST:
Operator errors that have occurred in past events of loss of coolant from RCS inventory include: opening suppression pool suction valve before closing shutdown cooling suction valve, intentional use of shutdown cooling for vessel level reduction, and inadvertent opening of test return, minimum flow and upper containment pool return lines. These events resulted from problems in three areas: (1) valve interlocks and valve-closing logic, (2) procedure adequacy, and (3) human performance. The following human factor issues were revealed during review and should be checked for this type of operational event.
* Valve-closing logic is maintained and switch position on motor-operated valves are in the closed position.
* Procedures clearly stipulate initial plant conditions for work.
* Potential adverse ramifications to operator error have been considered, and mitigation steps exist in operating and testing procedures. For example, written warnings and precautions are available to operators and technicians during evolutions such as containment spray pump testing. * Proper sequencing of steps and restoration is emphasized, especially for positioning of
critical valves.
* Water level is closely and frequently checked during evolutions.
* The CR has adequate indication of actual valve positions for all valves capable of creating a LOCA via the RHRS such as containment sump isolation valves and RHRsupplied containment spray isolation valves.
* Adequate low coolant level audible alarms are installed in the control room.
Operating Experience Review Implementation Plan 36 of 50
NEDO-33262, Rev. 2
* Manual-locking devices, electrical interlocks, or motor-actuator breaker rack is required on valves that must remain in a specified position, and consideration is given to the need to restore valve operability in emergency situations.
* Applicable boration. flow paths are verified prior to configuration changes for maintenance and testing.
A.4.3 EVENT TYPE: LOSS OF RCS INVENTORY IN BWRs
Condition and Concern: Inadvertent Safety Relief Valve Actuation, Automatic Depressurization System (ADS)
The potential exists for reactor cavity drain down during refueling when open main steam line plugs are not in place, as occurred in 1985. The possibility also exists for exposing nuclear fuel in the event of a rapid draining of the reactor cavity or spent fuel pool during a refueling outage because fuel assemblies, which are higher than the potential drain-down level, may become uncovered. While the opening of a safety relief valve (SRV) cannot result in uncovering the core, which is below the elevation of the main steam lines, SRV opening can be a serious problem if it occurs during fuel movement.
It is a common misconception that two-stage target rock safety-related relief valves will not open below 50 psig. In actuality, vendor testing has shown that these valves will open at pressures as low as 25 psig.
References: INPO SER 38-85, SER 72-84, and SOER 85-1.
Human Interactions of Interest:
The following human factor issues were revealed during review of operational events. The allocation of actions to prevent inadvertent safety-related relief valve actuation should concentrate on ADS control systems maintenance and testing during refueling.
When possible, maintenance: and testing of the ADS system logic or support systems should not be scheduled during the fuel movement. When these activities are performed, procedures should require that the ADS initiation be disabled by opening links in the logic or removing power from the valve solenoids or that only one subchannel of logic be tested and reset at a time. Operators should monitor vessel water level during the activity and be prepared to stop the test and reset the logic should an inadvertent actuation occur.
* SER 72-84, Supplement 1, discusses the possibility of using main steam line plugs during outages to prevent vessel down drain through safety-related relief valves or main steam isolation valves via the main steam lines. Main steam line plugs should be required to be installed whenever fuel or irradiated components are being handled.
" Care should be exercised the first time newly revised procedures are performed to ensure that no unanticipated failure or procedural error results in drain down.
A.4.4 EVENT TYPE: LOSS OF RCS INVENTORY IN BWRs
Condition and Concern: Inadvertent Pressurization
Operating Experience Review Implementation Plan 37 of 50
NEDO-33262, Rev. 2
Inadvertent pressurization events occurred during cold shutdown operations in which the primary system pressure rose above prescribed limits. One 1989 BWR event resulted in a heatup and pressurization to above 1,000 psig and showed that the potential existed to pressurize that plant all the way to the safety-related relief valve set-points, which would have caused a loss of RCS inventory. Other events have resulted from loss of natural circulation while shutdown during hydrostatic testing of the reactor pressure vessel and check valves and when RHR system isolation valves inadvertently closed. Over pressurization events can result in damage to lowpressure piping and may exceed American Society of Mechanical Engineers (ASME) code limits for cold reactor vessels (e.g. nil-ductility limits), creating the potential for breaks in the reactor coolant boundary leading to a loss of RCS inventory.
REFERENCES: INPO SOER 82-2; NRC IN 84-74 and 89-73; NSAC REPORT 88; GE RICSIL-049; INPO SER 63-84 and 2-82.
Human Interactions of Interest:
To avoid the possibility for iAadvertent pressurization, the following should be considered:
* Vessel Charging
- When the RCS is closed and control rod drive pumps are being used to provide seal purge flow for the recirculation pumps, procedures require that vessel inventory is decreased (periodically) and water level is not increasing beyond that expected. Safety Relief Valves (SRVs) should be operable and maintenance on these valves deferred. The procedures should recognize that pressure limits for brittle fracture control are considerably lower than at normal operation and that relying on the spring opening set points of the SRVs is not prudent.
- Operating procedures require that makeup flows to RCS (e.g., reactor coolant pump seal injection) are promptly isolated after RHR system inlet isolation valves close.
" Hydrostatic Testing
- Protection from possible RPV over pressurization during hydrostatic testing should be provided. Typical provisions are recalibration of relief valves, operability of pressure vent valves from control room, etc.
- Adequate pressure instrumentation should be available and monitored in the control room. Testing of valves in instrument lines used to monitor RPV pressure should be allowed only after achieving full hydrostatic pressure.
" Natural Circulation Core Cooling
- Reactor shutdown cooling procedures should be developed that specify minimum natural circulation reactor water level, in other words, the steam separator turnaround point plus water level instrumentation uncertainties. These procedures should require the following:
o When the reactor water level is above the minimum natural circulation level, operate at least one shutdown cooling pump to maintain the reactor water temperature specified for cold shutdown mode.
Operating Experience Review Implementation Plan 38 of 50
NEDO-33262, Rev. 2
o When the reactor water level is at or below the minimum natural circulation level, operate at least one shutdown cooling pump in each loop flow to maintain the reactor water temperature specified for cold shutdown mode.
- Whenever feasible, shutdown cooling heat exchanger coolant, such as service water and reactor building closed cooling water, flow should be throttled to maintain the reactor coolant temperature prior to throttling shutdown cooling system flow.
- Reactor water level is maintained above the minimum natural circulation level whenever the forced cooling is unavailable. If, for any reason, the reactor water level is to be maintained at or below the minimum natural circulation level, periodic monitoring of vessel metal temperatures above and below the intended water level is initiated.
Outage Return
- Pressurization of the RCS during low-temperature operation, i.e., returning from refueling outage, is determined by the nil ductility limits of the reactor pressure vessel, particularly starting reactor coolant pumps for venting or filling the RCS.
- Loss of instrument air resulting in letdown isolation and increased level followed by increased pressure.
- Starting an additional RHR pump:
o Inadvertent actuation of a high head ECCS pump.
o Over pressureprotection system out of service.
A.4.5 REFERENCES
INPO Significant Operating Experience Reports
INPO Significant Operating Experience Report 87-2, Inadvertent Draining of Reactor Vessel to Suppression Pool at B WRs, March 19, 1987.
INPO Significant Operating, Experience Report 82-4, Improper Alignment of Spray System To Residual Heat Removal System, May 19, 1982.
INPO Significant Operating Experience Report 82-2, Inadvertent Reactor Pressure Vessel Pressurization, Apr. 28, 1982.
INPO Significant Event Report 7-91, Failure to Control Valve Lineup Status Resulting in a Reactor Vessel Coolant Drain Down, April 2, 1991.
INPO Significant Event Report 19-90, Monitoring Plant Evolutions Using Inoperable Control Board Indications, November 21, 1990.
INPO Significant Event Report 5-90, Premature Lifting and Excessive Blowdown of Residual Heat Removal Relief Valves, February 3, 1990.
Operating Experience Review Implementation Plan 39 of 50
NEDO-33262, Rev. 2
INPO Significant Event Report 39-87, Undetected Loss of Reactor Coolant Due To Release of Dissolved Gases, December 29, 1
INPO Significant Event Report 4-86, Internal Flooding of An Emergency Core Cooling System (ECCS) Pump Room, January 6, 1986.
INPO Significant Event Report 37-83, Supplement 2, Inadvertent Draining of Reactor Pressure Vessel To Suppression Pool, October 9, 1985.
INPO Significant Event Report 37-83, Inadvertent Draining of Reactor Vessel to Suppression Pool, June 9, 1983.
NSAC/INPO Significant Event Report 85-81, Inadvertent Discharge From Reactor Coolant System to Containment Sump, September 25, 1981. NSAC/INPO Significant Event Report 64-81, Reactor Coolant Leak Due To Technician's Error,
August 14, 1981.
NSAC/INPO Significant Event Report 31-81, Inadvertent Containment Spray, April 29, 1981.
NSAC/INPO Significant Event Report 1-81, January 16,1981.
INPO Nuclear Network Entries
INPO Nuclear Network Entry WE 496, EAR TYO 90-005, RPV Was Pressurized at Low Vessel Metal Temperature Condition During Refueling Outage, March 1, 1990.
USNRC Information Notices
USNRC Information Notice No. 91-42, Plant Outage Events Involving Poor Coordination Between Operations and Maintenance Personnel During Valve Testing and Manipulations, June 27, 1991.
USNRC Information Notice 'No. 90-84, Potential for Common-Mode Failure of High Pressure Safety Injection Pumps or Release of Reactor Coolant Outside Containment During a Loss-ofCoolant Accident, October 4, 1990.
USNRC Information Notice No. 90-55, Recent Operating Experience On Loss of Reactor Coolant Inventory While In A Shutdown Condition, August 31, 1990.
USNRC Information Notice No. 90-05, Inter-System Discharge Of Reactor Coolant, January 29, 1990.
USNRC Information Notice No. 89-73, Potential Over pressurization of Low Pressure Systems, November 1, 1989.
USNRC Information Notice No. 87-46, Undetected Loss of Reactor Coolant, September 30, 1987.
USNRC Information Notice No. 87-38, Inadequate or Inadvertent Blocking of Valve Movement, August 17, 1987.
Operating Experience Review Implementation Plan 40 of 50
NEDO-33262, Rev. 2
USNRC Information Notice No. 87-25, Potentially Significant 7t Problems Resulting From Human Error Involving Wrong Unit, Wrong Train, or Wrong Component Events, June 11, 1987.
USNRC Information Notice No. 86-74, Reduction of Reactor Coolant Inventory Because of Misalignment of RHR Valves, August 20, 1986.
USNRC 1E Information Notice No. 81-10, Inadvertent Containment Spray Due To Personnel Error, Mar 25, 1981.
Licensee Event Report 457-90002, Transfer of Pressurizer Inventory to the Refueling Water Storage Tank Due To Procedural Deficiencies, March 18, 1990.
GE RICSIL No. 049, Inadvertent Vessel Pressurization, January 5, 1990.
Operating Experience Review Implementation Plan 41 of 50
NEDO-33262, Rev. 2
A.5 EVENT SUMMARIES LOSS OF FUEL POOL/REACTOR CAVITY INVENTORY
A.5.1 EVENT TYPE: LOSS OF FUEL POOL OR REACTOR CAVITY INVENTORY
Condition and Concern: Reactor Cavity Seal Failure
Some loss of fuel pool water events can result in the entire contents of the reactor cavity being drained within a short period of time. In almost every Spent Fuel Pool (SFP) event, fuel pool water was drained to the bottom of the fuel transfer canal or tube and the water level in the SFP would barely cover the fuel in the racks. Typically, the water level was below the suction piping for spent fuel cooling. Fuel being moved could be uncovered if the cavity drained. Fuel with less than four to six feet of water cover results in high radiation levels in containment and a high radiation exposure hazard, including fuel being moved or suspended from manipulators.
References: NSAC Report 129; INPO SOER 85-1, SER 9-86, 51-81, 72-84, 92-84, 9-86, 3188; NRC IN 84-93, IE 84-03, and 88-65.
Human Interactions and Lessons Learned of Interest:
The probability of loss of fuel pool water events is reduced when the following are considered:
* Procedures exist for dealing with high radiation levels in the SFP area while restoring the water level. The procedures analyze and address the implications of loss of SFP level on radiation shielding and resulting personnel dose rates.
" Abnormal Operating Procedures (AOPs) address the following:
- methods for recovery from inadvertent pumping down or draining of the cavity and the fuel pool when the transfer tube is open,
- equipment loss by flooding
- potential system interactions
- alternate methods of SFP cooling
- administrative controls on proper valve alignments for coolant makeup
- flooding of secondary containment
* The AOPs address all credible types of seal failures, including seal rupture and loss of air leading to displacement of reactor cavity seals. Other potential drainage paths are also analyzed such as the following:
- reactor cavity drains
- ventilation hatches from the drywell to reactor cavity
- residual heat removal shutdown cooling line
- recirculation system valves
- main steam isolation valves
Operating Experience Review Implementation Plan 42 of 50
NEDO-33262, Rev. 2
- safety relief valves
- temporary nozzle dams installed in the steam generators
* During refueling operations, temporary instruments are installed to warn operators of a seal failure, with alarms for water level in the spent fuel pool and pressurization of the seal system.
* Seals are used which limit the leak size and the use of nozzle dams or main steam line plugs is restricted during handling of irradiated assemblies. Such seals have several methods of protection (i.e., air pressure primary and seal mechanical design secondary) so that seal integrity is maintained on loss of air pressure.
* Measures to prevent and mitigate seal leaks have been also considered, such as submerged dams in the refueling cavity to ensure some minimum water above any fuel being transferred, flow restrictors that span the reactor cavity seal to reduce leakage flow, limiting the number of irradiated fuel assemblies in-transit or in the refueling cavity, etc.
* Rubber seals between gates receive preventive maintenance change outs to minimize seal failure and are routinely checked for leaks and proper inflation pressure by operators.
* Checkvalves are monitored to ensure reverse drain down to the refueling water storage tank does not occur. t
A.5.2 REFERENCES
INPO Significant Operating Experience Reports
INPO Significant Operating Experience Report 87-2, Inadvertent Draining of Reactor Vessel To Suppression Pool at BWRs, March 19, 1987.
INPO Significant Operating 'Experience Report 85-1, Reactor Cavity Seal Failure, January 10, 1985.
INPO Significant Event Reports
INPO Significant Event Report 1-91, Spent Fuel Pool Overflow Events. January 4, 1991.
INPO Significant Event Report 17-90, Reactor Coolant System Temperature Below Analyzed Limit for an Extended Time Period, October 24, 1990.
INPO Significant Event Report 15-89, Internal Flooding Resulting From Freeze Plug Failures, June 9, 1989.
INPO Significant Event Report 31-88, Reactor Cavity Seal Failure From Deflation and Inadequate Design, October 27, 1988.
INPO Significant Event Report 3-88, Inadvertent Draining of Reactor Vessels Due To Procedural Content and Usage Deficiencies, February 12, 1988.
INPO Significant Event Report 7-87, Pressurization of Vessel During Cold Shutdown, March 19, 1987.
Operating Experience Review Implementation Plan 43 of 50
NEDO-33262, Rev. 2
INPO Significant Event Report 4-87, Pipe Break and Condensate Storage Tank Draining, March 9, 1987.
INPO Significant Event Report 40-86, Spent Fuel Pool Leakage, December 24, 1986.
INPO Significant Event Report 8-86, Inadvertent Drainage of Refueling Shield Tank, February 24, 1986.
INPO Significant Event Report 41-85, Containment Spraying Events, September 19, 1985.
INPO Significant Event Report 38-85, Reactor Vessel Partially Drained Due To Inadvertent Actuation of the Automatic Depressurization System (ADS) While in Shutdown, August 12, 1985.
INPO Significant Event Report 92-84, Partial Drain of Spent Fuel Storage Pool To Spent Fuel Shipping Cask Pit Due To Deflated Seal, December 27, 1984.
INPO Significant Event Report 72-84, Reactor Cavity Seal Ring Failure, October 3, 1984.
INPO Significant Event Report 72-84, Supplement 1, Reactor Cavity Seal Ring Failure, April 18, 1985.
INPO Significant Event Report 72-84, Supplement 2, Reactor Cavity Seal Failure, February 13, 1986.
INPO Significant Event Report 63-84, Over pressurization of Reactor Vessel During Cold Shutdown, Aug. 30, 1984.
INPO Significant Event Report 46-83, Inadvertent Initiation of Low Pressure Coolant Injection (LPCI), July 1, 1983.
INPO SignificantEvent Report 2-82, Cold Pressurization of Reactor Coolant System, January 7, 1982.
NSAC/INPO Significant Event Report 76-81, Loss of Primary Coolant To reactor Building Sump, September 25, 1981.
NSAC/INPO Significant Event Report 61-81, Inadvertent Spent Fuel Pool Overflow, August 12, 1981.
NSAC/INPO Significant Event Report 51-81, Spent Fuel Pool Watertight Gate Seals, July 28, 1981.
USNRC Information Notice No. 89-73, Potential Over pressurization of Low Pressure Systems, November 1, 1989.
USNRC Information Notice No. 88-92, Potential For Spent Fuel Pool Drain Down, November 22- 1988.
USNRC Information Notice .No. 88-65, Inadvertent Drainages of Spent Fuel Pools, August 18, 1988.
USNRC IE Information Notice No. 84-93, Potential For Loss of Water From The Refueling Cavity, December 17, 1984.,
Operating Experience Review Implementation Plan 44 of 50
NEDO-33262, Rev. 2
INPO Nuclear Network Entry OE 4629, Low Level in Spent Fuel Pool due to Loss of Air to Transfer Canal Weir Gate Bladder, June 4, 1991.
USNRC IE Bulletin No. 84-03, Refueling Cavity Water Seal, August 24, 1984.
Operating Experience Review Implementation Plan 45 of 50
NEDO-33262, Rev. 2
A.6 EVENT SUMMARIES - REACTIVITY SHUTDOWN MARGIN
A.6.1 EVENT TYPE: REACTIVITY CONTROL SHUTDOWN MARGIN
Condition and Concern: Unplanned Criticality/Low Temperature
During periods of cold weather, the RCS water temperature can drift below the minimum value used to analyze reactor shutdown margin and fuel pool criticality. An event, of this type occurred recently at a BWR. Cold water injects positive reactivity to the core, decreasing the shutdown margin. This effect is more important in BWRs than in PWRs because the nominal shutdown, margins are smaller. Temperatures 10' C below the minimum temperature specification may reduce the reactivity shutdown margin by a factor of two. This effect applies to both the core and the spent fuel storage pool and may be especially important during fuel shuffling operation. Low coolant temperature may also increase the risk of a nil-ductility temperature event on the pressure vessel.
References: INPO SER 17-90.
Human Interactions of Interest:
Based on past events, a utility analysis of cold weather shutdown margin verifies the following: " Analysis for adequate reactor shutdown margin and margin to fuel pool criticality reflects the minimum temperature expected at the plant. " Plant personnel are aware of the potential reduction in reactivity margin that cold cooling water presents and are cognizant of the effect of low temperature coolant on nil ductility temperature. " Plant configurations that can result in lower coolant temperatures than expected address the potential for unplanned criticality (e.g., flow control values to heat exchangers being open greater than nominal). " Refueling procedures do not allow fuel movement during times of lower than minimum temperature. Safety- analyses used for fuel evolutions specifically consider low coolant temperatures.
A.6.2 EVENT TYPE: REACTIVITY CONTROL SHUTDOWN MARGIN
Condition and Concern: Inadvertent Control Rod Withdrawal or Misplaced Fuel
BWRs do not use soluble -boron to control reactivity during refueling. Instead, reactivity margins are normally maintained by control rods and fuel loading controls. Shutdown margin is significantly reduced during refueling if control rod blades or fuel assemblies are misplaced. By loading fuel into an unrodded cell or by withdrawing a control rod from a fueled cell, the core may become critical. This could initiate cladding damage, release fissions products to the coolant, cause fuel damage with inadequate cooling, and result in high radiation levels that could cause plant personnel exposure.
Operating Experience Review Implementation Plan 46 of 50
NEDO-33262, Rev. 2
Due to the limited number of source range monitors, the way a core is loaded (e.g., spiral, Ushape, etc.) is important. Aný improper loading scheme can allow regions of the core to approach criticality without early detection by the monitor, greatly reducing the margin of safety. Complicated refueling procedures may also cause human performance problems that can erode safety margin. There is no generic guidance from vendors or the NRC.
References: SER 15-83, NSAC Report 129; NRC IE 89-03, IN 83-35.
Human Interactions of Interest:
Past studies have shown that reactivity margins are best maintained by operators when the following are considered:
" Fuel cells are loaded only after positive verification of control rod insertions, and no fuel is moved with any control rod drawn.
* Core status boards reflect current fuel, blade guide, and control blade status.
* Safety analyses performed for the purpose of safety and shutdown margin evaluation should include analysis of intermediate fuel assembly positions including fuel placed in other than its designated position. The placement and effectiveness of source range monitors should be included in such evaluations.
* Control blades and fuel bundles are prevented from leaning. Movement of assemblies into and out of a cell is done in such a way that assures continued support and keeps the cell upright. Operators recognize that the number of available blade guides has a significant impact on fuel movement sequences, efficiency of refueling, and the shutdown reactivity of the core.
* Incore neutron monitors are checked for proper positioning during fuel shuffle.
* Procedures for the refueling sequence, typically prepared after the RPV head is removed and fuel leak testing is complete, are checked for completeness. Such last-minute activities are more prone to stress type errors. Reactivity evaluation models can be used to check reactor shutdown margin to avoid fuel layouts where reactivity is too high.
* Fuel movement procedures should include guidance to reenter the procedure once a deviation occurs to limit the potential for double errors.
* The staff members responsible for refueling operations are trained in the procedures and understand the consequences of fuel movement under high burnup flux distributions, misplaced fuel, and the implications of higher enrichment fuel.
Operating Experience Review Implementation Plan 47 of 50
NEDO-33262, Rev. 2
A.6.3 REFERENCES
USNRC Information Notices
USNRC Information Notice No. 83-35, Fuel Movement With Control Rods Withdrawn At BWRs, May 31, 1983.
USNRC Bulletins
USNRC Bulletin No. 89-03, Potential Loss of Required Shutdown Margin During Refueling Operations, November 21, 1989.
Operating Experience Review Implementation Plan 48 of 50
NEDO-33262, Rev. 2
A.7 EVENT SUMMARIES FUEL HANDLING
A.7.1 EVENT TYPE: FUEL HANDLING
Condition and Concern: Fuel Transfer Events
Many past incidents involved planned handling and transport of new and irradiated fuel elements including (1) the dropping of fuel elements or fuel pins, (2) lodging or sticking of fuel assemblies in refueling equipment, and (3) improper loading or unloading of a fuel assembly in the core, causing it to topple and lean against other assemblies. Other incidents involved inadvertent or unexpected lifting of fuel assemblies or rod cluster control assemblies from the reactor core; often as the upper core support structure was being lifted. In some of these cases, an irradiated fuel assembly was subsequently dropped. Life threatening radiation exposures and the. contamination of plant areas can result from such events.
References: NSAC Report 129; INPO SERS 1-88, 21-86, 59-81, 31-83, 31-85, and 5-86.
Human Interactions of Interest:
Studies have concluded that fuel transfer operations can be improved when:
" An SRO is assigned fuel-handling responsibility and authority, with no other contingent responsibilities.
* Control rod insertion times are reviewed prior to fuel transfer out of the core as an indication of possible- misalignment between fuel and reactor internals.
" Written procedures detailed plans and practice runs used, especially for unusual or infrequent handling operations. Refueling operations training is conducted prior to fuel transfer or movement of internals.
" All lifting operations involving fuel are done by tools designed to determine and carry the load. Personnel recognize that hoists surpassing their upper limit commonly results in dropped fuel assemblies.
* Operations with auxiliary hoists use direct, unobscured visual observation. Fuel movement stops when visual contact is lost. (Note: it is good practice to augment observations with underwater cameras, or use of observers with binoculars, etc.)
* Cavity and fuel storage water clarity is assured before fuel handling operations commence, and procedures require suspension of operations if pool clarity degrades.
* Pneumatically actuated fuel servicing equipment is checked out (underwater) prior to use. Manipulation of fuel servicing equipment is performed away from the core region whenever possible. Servicing equipment is checked for foreign material that could jam transfer mechanism. Testing is recognized as especially important after modifications to refueling equipment.,
" A refueling safety manual exists which addresses specific safety provisions and precautions related to refueling operations. The manual addresses commonly identified problems. The safety responsibilities of contract and staff supervisory personnel are
Operating Experience Review Implementation Plan 49 of 50
NEDO-33262, Rev. 2
clearly stated. Warnings are included for potential problems. Personnel are trained for fuel transfer operations.
Preventive maintenance is regularly performed on fuel-handling equipment, including inspection of internals lifting rig cable and magnetic particle/ultrasonic testing of lifting hooks prior to refueling operations.
A.7.2 REFERENCES
INPO Significant Event Reports
INPO Significant Event Report 15-91, Fuel Mispositioning Events DL3 to Fuel Bundle Selection Errors, June 11, 1991.
INPO Significant Event Report 10-88, Fuel Assembly Lifted With Upper InteMal, April 21, 1988.
INPO Significant Event Report 5-86, Dropped New Fuel Assembly, January 15, 1986.
INPO Significant Event Rep~rt 21-86, Dropped Fuel Assembly, June 16, 1986.
INPO Significant Event Report 31-85, Inadvertent Fuel Bundle Movement, June 27, 1985.
INPO Significant Event Report 31-83, Irradiated Fuel Assembly Dropped From Fuel Handling Crane, June 6, 1983.
INPO Significant Event Report 15-83, Fuel Handling Error, March 11, 1983.
INPO Significant Event Report 43-82, Fractured Fuel Assembly Guide Tubes, July 19, 1982.
INPO Significant Event Report 59-81, Dropped Fuel Assembly, August 11, 1981.
INPO Nuclear Network Entries
INPO Nuclear Network Entry OE 4167, Fuel Assemblies Withdrawn With Upper InteMals, October 5, 1990.
INPO Nuclear Network Entry OE 4112, Fuel Assemblies Withdrawn With Upper Internals Update to OE's 4167, 4177, and 4187, October 26, 1990.
INPO Nuclear Network Entry OE 4113, Fuel Assemblies Withdrawn With Upper lnteMals Update to OE4167(message replaced OE 4177), October 27, 1990.
INPO Nuclear Network Entry OE 4114, Fuel Assemblies Withdrawn With Upper Internals Update to OE4167 and 4177(message replaced OE 4187), October 27, 1990.
Operating Experience Review Implementation Plan 50 of 50
