ML20211C516
Jump to navigation
Jump to search
| ML20211C516 | |
| Person / Time | |
|---|---|
| Site: | Surry  |
| Issue date: | 02/10/1987 |
| From: | Panciera V NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| To: | |
| Shared Package | |
| ML20211C439 | List: |
| References | |
| 50-280-86-42, 50-281-86-42, NUDOCS 8702200119 | |
| Download: ML20211C516 (53) | |
See also: IR 05000280/1986042
Text
{{#Wiki_filter:'
.
y UsesTSO STATSS
' f NUCLEAR REGULATORY COMMISSHM
.
f Reescos as
g tel e4ARIETTA STREET.N.W.
*
ATLANTA.G80A41A 30333
*$
.....
'
.
Report Nos.: 50-280/06-42 and 50-281/86-42
Licensee: Virgirtia Electric and Power C'ompany
Richmond, VA 23261
Docket Nos.: 50-280 and 50-281 License Nos.: DPR-32 and DPR-37
Facility Name: Surry 1 and 2
Inspection Conducted: December 9,1986 - January 14, 1987
Team Inspectors: J. Caldwell
M. A. Caruso
W. T. Cooper
8. R. Crowley
J. T. Gilliland
W. E. Holland
T. A. Peebles
P. A. Taylor
Contributing Inspectors: A. R. Herdt
J. D. Ennis
P. M. Mad n
W. Ros
Approved by: _mm I /L n s
Vincent W. Panciera, Team ~ Lea' der'
h ~
a ~
7
/Date Sigried
Division of Reactor Safety
SL)l9tARY
Scope: This special, announced augmented inspection was conducted for the Surry
Unit 2 feedwater pipe rupture event of December 9,1986. The areas inspected
included the sequence of events, effects of failure, metallurgical aspects, items
contributing to the likelihood or severity of the event, licensee's response to
the event, aspects that made handling the event more difficult, consideration of
shutdown of Unit 1, investigation and corrective actions planned and safety
considerations for station restart.
Results: One violation was identified (paragraph 11.a.(2)).
.
'
0,g22Kg[[{ $$$$ go
-
o
t
'
.
'
.
REPORT DETAILS
.
1. Persons Contacted
'
Licensee Employees
W. L. Stewart, Vice President, Nuclear Operations
R. J. Hardwick, Corporate Manager for Licensing and Safety
R. F. Saunders, Surry Station Manager
*R. W. Calder, Nuclear Engineering Manager
"H. L. Miller, Assistant Station Manager for Licensing and Safety
*D. L. Benson, Assistant Station Manager for Operations and Maintenance
J. M. McAvoy, System Metallurgist
*W. D. Craft, Licensing Coordinator
*W. R. Benthall, Nuclear Specialist
Other licensee employees contacted included engineers, technicians,
operators, mechanics, security members and office personnel.
NRC Residen' Inspector
*W. Holland
* Attended exit interview.
.
2. Exit Interview
The inspection scope and findings were summarized on January 14, 1987, with
those persons indicated in paragraph 1 above. The inspectors described
the areas inspected and discussed in detail the inspection findings listed
below. No dissenting comments were received from the licensee.
Violation 50-281/86-42-02 - Inadequate Procedure for the Maintenance of the
Main Steam Trip Valve (paragraph 11.a.(2)).
~
Inspector Followup Item 50-280, 281/86-42-01 - Clarification of Surface
Preparation Methods in NOE Procedures (paragraph 8.e.).
The licensee did not identify as proprietary any of the material provided
to or reviewed by the inspectors during this inspection.
3. Licensee Action on Previous Enforcement Matters
This subject was not addressed in the inspection.
4. Unresolved Items
Unresolved items were not identified during the inspection.
L .-
4
0
.
. . ~ . -- . -- .- . _ _ - - _.- _ . . _ _ - - . - . - _ _ _ - - - .. -
'
.
b
=
2
4
-
5. Augmented Inspection Team (AIT) Activities
: Shortly after the pipe rupture event, Region II was notified by the Surry
Senior Resident Inspector (SRI) who was on site, and had proceeded to the
y
control roong to assess the situation. The Regional personnel immediately
1 staffed the regional response center at about 2:45 p.m. NRC Headquarters
was then notified at approximately 3:00 p.m. that a main feedwater line pipe
rupture in the turbine building had occurred. An open line between the
Surty site and the NRC Operations Center was maintained until early hours
, of the next morning. About 3:30 p.m., a decision was made by Regional
- management to send an inspection team to the site. This team consisted of
{ Regional based personnel and the SRIs from North Anna and Surry. The team
arrived on site about 9:30 p.m. on December 9, 1986. After a meeting with
j plant management to assess the operational status of the unit, the team
! toured the damaged area of the turbine building in the vicinity of the feed-
l pump suction piping. During a meeting at 9:00 a.m. on December 10, 1986,
with plant management, NRC inspection assignments were outlined. Virginia
4
Power agreed to provide any assistance required by the team. In addition,
l the ground rules to be applied by the inspection team regarding quarantine ! of equipment were discussed. Virginia Power agreed to seek NRC concurrence ! ' before any work was accomplished for restoration of systems. During the
morning of December 10, 1986, the team's status was upgraded to an Augmented
! Inspection Team (AIT), and an engineer from the Office of Nuclear Reactor l Regulation, knowledgeable in water hammer phenomena, was assigned to the l team. The team conducted inspections during the remainder of the week 1 ending December 12, 1986, to ascertain the circumstances involved in the j accident. An executive summary was transmitted to the Region II office on l December 17, 1986. This summary provided the significant facts concerning
- the event. The AIT did not conclude its inspection at that time due to the
! ongoing activities by the licensee to develop a root cause analysis, which I required subsequent inspection activities. AIT activities continued during ! the weeks of December 22 and 29, 1986, and January 12, 1987. An AIT exit l meeting with plant management was held on January 14, 1987, after review of
- the licensee's investigative report entitled "Surry Unit 2 Reactor Trip and
! Feedwater Pipe Failure Report" and proposed corrective actions which were j presented to the NRC on January 12, 1987, in addition to the AIT inspection i activities, inspectors knowledgeable in security, fire protection systems, l water chemistry and check valve design were assigned to review specific ! concerns in these areas. Where applicable, their inspection findings have i been incorporated into this AIT inspection report. t ,
6. Overview of the Event .
On December 9, 1986, with both units operating at 100 percent reactor power,
! a Unit 2 reactor trip followed by a main feedwater (MFW) line rupture
occurred. Unit 2 had completed a refueling outage and returned to full
I power operation on December 8, 1986. ! A low-low level in the C Steam Generator ($/G) caus6d a reactor trip and l start of the two motor driven auxiliary feedwater pumps.
.'
e
'
. .
I
'
.
.
e 3
The control room operators noted the S/G code safety valves lifting and
regulated S/G pressure through the atmospheric dump valves. Approximately
30 seconds after the trip the unit's electrical busses auto-transferred to
offsite power. A small steam release noise was heard followed by a very
loud noise approximately five seconds later.
A shift supervisor who was in the turbine building, realizing that a large
steam break had occurred, went to the control room and alerted the control
room watch. All secondary pumps (high pressure drain, condensate and main
feedwater) were secured, and the break was isolated. Water to the S/GS was
supplied by the auxiliary feedwater system.
The primary systems responded normally to the loss of load transient.
Reactor coolant temperature, pressure, and pressurizer level were stabilized
in the desired band.
A notification of unusual event was declared by the licensee at 2:27 p.m.
and was upgraded later to an ALERT in order to ensure accountability of all
station personnel.
The 18-inch suction line to the A main feedwater pump was subsequently
found to have ruptured at the elbow where the line connects to the 24-inch
condensate header.
In addition, station halon and cardox systems actuated because of water
short-circuiting control systems in the area. Control room habitability
was a concern prior to initiating control room ventilation because doors
were blocked open to allow better control room access without recognizing
that carbon dioxide had been discharged in the areas above. The carbon
dioxide was apparently coming into the control room from the hallway. The
emergency was terminated at 4:23 p.m. after personnel accountability had
been established.
Eight individuals were injured due to the steam and water. Four of the
injured subt.equently died. Two of the injured were treated and released.
Two individuals remained hospitalized. One, individual was later released.
Unit 2 was placed in cold shutdown at 7:04 a.m. hours on December 10, 1986.
7. Sequence of Events
a. Initial Plant Conditions Prior to the Unit 2 Event
Unit 2 had achieved stable 100 percent power operation on December 8,
1986, following a refueling outage. Unit 1 was operating at 100
percent power.
Two major maintenance or surveillance activities were in progress:
the troubleshootin
coolant pump (RCP)g of a B
breaker, train
and theunderfrequendy
troubleshooting ofrelay for 111ary
an aux a reactor
. .
,
!
9
.
.'
.
'
4
instrument air ccepressor. The first item had required the racking
in and closing of the B reactor trip bypass breaker. The A and B
reactor trip breakers were still closed. The second item required
the shutdown of the running auxiliary instrument air compressor and the
attempted start of the non-running auxiliary instrument air compressor.
The delay in starting the auxiliary instrument air compressor caused
the instrument air pressure to decrease to approximately 78 psig,
instead of the normal 100 psig.
Some minor construction activity was occurring in the vicinity of the
main feedwater (MFW) pumps, such as installing insulation on piping.
The unit's data gathering computer (Prodac 250) was out of service,
but reactor trip information was available from a sequence of events
(SOE) alarm printer and a newly installed Emergency Response Facility
Computer (ERFC). The SOE alarm printer prints information continuously
on a millisecond basis, but is limited in scope to alarms. The ERFC
displays s'y stem parameters, but only updates in fifteen second incre-
ments and samples the parameters at different times. The ERFC is
intended for a broader picture than the SOE alarm printer. Interviews
with the Shift Supervisor and Control Room Operators (CRO) were used
to correlate times and to fill in gaps of the event.
The SOE alarm printer time of the reactor trip was 1420:03(RT00)and
the ERFC time of the reactor trip was between 1421:15-:30 and has been
correlated to be 1421:15. Therefore, the SOE information will be
addressed in increments per the ERFC clock with specifics referred to
as seconds of time from the RT per the SOE alarm printer.
Other sequence of events information was developed by the licensee,
using security alarm computer data, interviews with additional person-
nel, and time motion studies. This information correlates with this
SOE data.
b. Secondary System Conditions Prior To The Event
Both MFV pumps were operating with a suction pressure of 370 psig, a
discharge pressure of 1040 psig and a temperature of 374 degrees F.
The condensate system was operating normally with one of two high pres-
sure heater drain pumps, two of two low pressure heater drain pumps,
and two of three condensate pumps running. The full flow condensate
polishing system and all feedwater h9aters were in service. .
c. Plant Conditions and Personnel Actions During The Event
1421:(00-15) ERFC time
The first indication of a problem occurred at RT -03 when the Unit 2
control room received an annunciator alarm for!the B steam generator
(S/G) as MFV flow was less than steam flow. This indication and the
.'
'
.
O i
.'
,
5
subsequent alarm on the A S/G indicated that the C main steam trip
valve (MSTV) had inadvertently closed. The closure of the MSTV caused
the steam flow from the other S/Gs to begin to increase by 50 percent
and caused the mismatch alarm, since the MFW flow to the S/Gs had not
yet responded. .
A direct indication of the C MSTV closing was not received as the
valve-closed limit switches did not function properly. However,
indication and alarm that the valve was not fully open was available to
the CRO.
The closure of the C MSTV caused MFW pressure downstream of the C MFW
flow control valve (FCV) to increase from 865 psig to 970 psig with
the A and B MFW pressures initially stable at 845 and 835 psig,
respectively.. -
The other steam generator MSTVs closed shortly afterward due to the
higher than normal steam flow in those lines caused by the continuing
100 percent demand of the main turbine. The MSTVs are reverse seated
check valves held open against the steam flow by air operated pistons.
As the MSTV discs are partially in the steam flow path, an increase
in steam flow places more closing force on the disc. All three MSTVs
closed and seated properly and steam flow was stopped.
1421:(15-30)
A low-low S/G 1evel annunciator signal which was received for C S/G and
was the initiating signal for the reactor trip at 1421:15 (RT 00) and
for the starting of the two motor driven auxiliary feedwater pumps.
The reactor trip resulted in a trip of the main turbine generator. The
stopping of steam flow to the main turbine by the MSTVs closing caused
the S/G pressures to increase. As C MSTV had closed first, its pres-
sure increased first. This increase in pressure collapsed the bubbles
in its S/G which caused the level to decrease to the reactor trip low-
Iow level setpoint.
At RT +03, the CR0 manually tripped th'e reactor. One control rod
(M-10) indicated that it had inserted from 228 steps to 35 steps.
Reactor power was verified to have decreased to normal post-trip decay
l
values.
At RT +04, the CRO, noting that the S/G code safety valves were
lif ting, took the S/G Power Operated Relief Valves (PORV) out of manual
and began to regulate S/G pressure through this atmospheric dump mode.
S/G pressures had increased from their initta) values of 820, 814 and
! 1
I
i * .
,
'
! l -
~
.
.
-
6
815 psig and were 936, 979, and 1055 psig.* The S/G pressures all
responded to the individual MSTV closings, and since C MSTV had been
closed longest, it caused the C S/G to reach the highest pressure.
The AFW flows were greatest to the S/G with the least pressure. AFW
flow was 344, 300 and 98 gpa. .
Pressure downstream of the MFW FCVs increased to 1054, 1042 and
1090 psig.
1421:(30 -45)
Pressure downstream of the MFW FCVs decreased to 1008, 1015 and
1028 psig. S/G pressures were 1028, 1013, and 1055 psig. The C S/G
PORV was being used to control primary temperature and C S/G pressure
remained constant.
Low-low levels occurred in the A and B S/Gs in response to their
increasing pressure which caused the automatic initiation of the third
auxiliary feedwater pump. The steam inlet valve to the turbine driven
auxiliary feedwater pump opened and the pump started. S/G 1evels as
a percent of wide range instrumentation were 74, 73 and 75 versus
a normal operating level of 84 percent. AFW flow was 337, 317 and
109 gpm.
1421:(45-1422:00) .
The three MFW FCVs received an automatic signal to close and in a few
seconds were closed. This signal is generated to minimize primary
system cooldown following a reactor trip and is generated when the
primary temperature decreases to less than 554 degrees F. The MFW pump
recirculation valves (FCV-FW-250A and 2508) for A and 8 MFW pumps auto-
opened a few seconds later. Each recire valve opens when flow from its
MFW pump decreases to less than 2800 gpm.
Pressure downstream of the MFW FCVs increased on A to 1059 and
decreased on B and C to 812 and 949 psig. Pressure in the S/Gs
remained constant at 1028, 1013 and 1065 psig. The A MFW FCV may have
been slightly slow in closing, and as the discharge pressure of the
MFW pumps was increasing to its high of 1290 psig, the pressure down-
stream of the A MFW FCV would have increased.
The unit's electrical busses auto-transferred to offsite power at
RT +32, when the main generator, as is normal, auto-transferred on
a 30-second delay signal following a main turbine generator trip.
1
*When pressures, flows, etc., are listed in sequence, the order refers
respectively to the A, 8, and C steam generatob.
'
.
,
d
u
. . - . _
_ _ . . . _ - . _________._._._--.__ - ,._ ______._ _ _.- _
_
__m, - _ . _ _ - _ _ _ _ _ _-- - .. _ -.. , . -. -
.'
'
.- 7
Five seconds later at RT +37, a small steam release was seen and heard
in the vicinity of the A MFW pump and the first point heater steam-side
safety relief.
1422:(00 -15) .
., .
Pressure downstream of the MFW FCVs decreased to 445 psig which
indicates that the downstream MFW check valves were operating and the
pressure of the water in the lines was decreasing to its saturation
pressure. The S/G pressures decreased to 997, 1003 and 1020 psig and
levels remained in the 74 percent range. The AFW flow was 342, 317 and
98 gps. The MFW pump discharge pressure reached a peak of 1290 psig
and the suction pressure rose to 550-600 psig as the condensata pumps
responded to the minimal recirculation flow conditions.
The noise of a small steam release was followed at approximately RT +42
by a very loud noise from the vicinity of the MFW pump suction piping.
The primary system responded normally to the loss of load transient.
Reactor coolant system temperature was stabilized at 552 degrees F and
pressurizer level was recovered as it reached the low level setpoint.
Reactor coolant system pressure decreased from 2235 to 2015 psig in
response to the cooldown.
The probable time for the piping break appears to have occurred at
RT +42. The break occurred in an elbow where the 24-inch MFW suction
header splits off at a tee to an 18-inch branch line in an elbow toward
the suction of the A MFW pump. About ten feet farther down the 24-inch
header toward the suction of the 8 MFW pump is where the high pressure
heater drain pumps' discharge flow is combined with the condensate
, flow.
Approximately 15 seconds after the large pipe rupture, at RT +57, the A
, '
MFW pump tripped due to low suction pressure. The time delay relays
which operate in conjunction with a suction pressure of less than
and the SOE alarm printer agrees
55 psig
with wereoffound
the time pump set
trip.atThe
15Bseconds,V
MF pump rectre valve indicated that
,
it closed while the A rectre valve remained open, as it should have,
i
for 60 seconds after the pump trip. A reason for the 8 recirc valve
r closing is that the B MFW pump continued to run and the flow in that l line increased to greater than the rectre re-setpoint of 4000 GPM. , This increase in flow was caused by a backward flow path through-the
- tripped A MFW pump. It was later found that this pump's discharge
j check valve was disabled. The 8 MFW pump continued to run for 23 l seconds.
!
!
.'
&
O
t
-
.
.
-
8
1422:(15-30)
An operations supervisor was in the turbine building observing construc-
tion activity around the MFW pumps. He heard and saw the large steam
break, And immediately ran to the control room to alert the operators.
He also' told them that people had been injured. The shift supervisor
then ordered that all secondary pumps be secured.
1422:(30-45)
When the CR0s began to secure the secondary pumps, the B MFW pump
was found " auto-off" with its yellow disagreement light on, which
occurred at RT +81, or about 1422:36. Its time delay relays were also
i
found set at 15 seconds. Therefore, its trip point of 70 psig was
reached at RT 66 or about 24 seconds after the break. The high pres -
sure heater drain pump was running and had to be turned off, and both
low pressure heater drain pumps had tripped. After all secondary pumps
were secured, the steam release stopped.
The ERFC and SOE alarm printer agreed with the operators on the above
time sequence.
1424
The CR0 noted that primary temperature was stable at about 550
degrees F.
'
The NRC Senior Resident Inspector arrived in the Control Room.
! 1425
The CR0 secured the B RCP to avoid adding heat to the reactor coolant
system. Plant conditions were stable with RCS temperature being
l maintained at approximately 540 degrees F by releasing decay heat
through the C S/G power operated relief valve (PORV).
'
1427
An Unusual Event was declared.
1430
l Ground and air ambulances were called.
The CR0 changed the normal suction of the charging pumps to refueling
water storage tank.
The B and C S/G low-low level alarms cleared and the steam driven APW
pump was secured. !
The Regional response center called the c,ontrol room. ,
,
b en
_. _
~
.
,
.
, 9
1440
An Alert was declared to assist in personnel accountability.
1445 .
_
The CR0 secured the A RCP.
The Shift Supervisor noted that the condenser still had a vacuum and as
'
there was no steam for the main turbine gland seal, opened the vacuum
breaker.
State and local authorities were notified of the Alert.
1500
NRC Operations Center was notified of the Alert.
Reactor coolant system temperature was 530 degrees F, pressurizer level
was 25 percent, and pressurizer pressure was 2160 psig.
1506
The CR0 secured B auxiliary motor driven feedwater pump.
1514
'
The CR0 began emergency boration to cold shutdown concentration as part
of the normal post trip procedure.
1518
. '
Personnel accountability initiated.
I 1535 i The corporate Emergency Response Cente'r was activated.
1539
The CR0 secured emergency boration.
i !
1548
Personnel accountability completed.
1625
The Alert was terminated. The control rod (M410) which had indicated
that it inserted only to 35 steps now was noted to indicate fully
inserted.
.'
-
!
..- . . - - -
- . . . . - _ .
-
.
.
.
-
10
:
1821
Cooldown at 50 degrees F per hour was initiated.
,
2130 , .
<
t ,
NRC team arrived on site.
0355 December 10, 1986
Unit placed on residual heat removal system with ter.perature at
350 degrees F and pressure at 450 psig.
0704
i The unit achieved cold shutdown conditions.
'
8. Effects of Fai1'ure
! a. Pipe Rupture
The rupture of the 18-inch A MFW suction pipe occurred on a 90 degree
! elbow at a point about one foot from where the suction pipa joins the '
, condensate supply header. The point at which the break occurred
relative to the main feedwater pump is indicated on Figure 1, which is
a picture of the identical undamaged Unit 1 piping configuration.
Figure 2 shows the rupture location from the condensate supply header
,
side. Figure 2 clearly indicates that the rupture was a catastrophic,
- 360 degree circumferential break. Figure 3 shows the broken pipe from
- the MFW pump suction side.
!
b. Pipe Whip
i
Observation of the damaged A MFW pump suction piping indicated sig-
nificant movement of the piping following the rupture. The piping,
attached to the pump suction, dropped and rotated away from the break
,
point, pivoting on the elbow near the pump suction. Although the
piping came to rest against a prtion of the B MFW pump discharge
l piping it did not appear to have damaged it significantly. ! Inspection of the area following the event also revealed that one
piece of suction piping had ripped off and was blown some distanca from
'
the break point. The piece was about two feet by three feet in size.
It appears that the joint between the' suction pipe and condensate
supply header provided lateral support of the suction piping assembly
including the suction isolation valve. The loss of this support along
,
with the weight distribution of the suction pipe assembly probably
i
contributed to the pivot and rotation of the assembly. It is also
'
likely that back flow by the B MFW pump througli the damaged A MFW
pump discharge check valve and out the broken suction pipe contributed
to pipe whip motion of the feed pump suct, ion pipe.
*
l '
,
~
l .
. ---,--r-- - , , - -m-r-- ..,,ew ,----+-+--m ,-m- w
~
.
.
.
11
c. Personnel Injury
Those injured were eight contractor employees who were working in
the general area, but not on the affected pipe itself. Six of these
individuals were hospitalized f.or treatment of severe burns. Three
were evacuated directly from the site by helicopter, and three others
were taken off site by ambulance. The other two, who were less
severely injured, were treated at a clinic and released.
One of those hospitalized died the afternoon of the following day and
another victim died two days after the accident. Two others. died
several days later. The others remained in serious to critical condi-
tion. One of the two hospitalized improved and was later released,
but the other was still in serious condition more than a month after
the accident.
These contractor personnel were employed by Daniel Construction Company
of Greenville, South Carolina, and by Insulation Specialties Inc., of
Hopewell, Virginia. They were doing instrument line relocation and
pipe insulation work,
d. Plant Cooldown
The loss of the suction, piping to the A MFW pump and subsequent steam
release had no adverse effects on the plant cooldown. The MSTVs had
closed as had the MFW FCVs before the pipe rupture. These actions -
isolated the S/Gs from the rupture. The normal cooldown mode for a
MSTV closure event is steam release by the code safeties, and S/G PORVs
and continued feedwater flow from the auxiliary feedwater system.
e. Employee Concerns
On December 11, 1986, a former employee at Surry (a carpenter)
,
contacted the NRC and expressed concern about grinding activities at
} Surry. The employee said that during June 1986, he and four other
carpenters were directed to grind on p,ipe in the containment building.
'
He stated that his foreman advised his crew that they were carpenters
- and not qualified to perform this work activity. They were terminated
for refusing to do the work. A case was filed with the Department of
- Labor (DOL). The employee did not know the current status of his DOL
- issue. The employee stated that the group of carpenters who remained
i did perform grinding activities at various locations, including in the l turbine building. He did not know if they actually performed gririding i
on the pipe that ruptured but wanted the NRC to determine if the pipe
rupture was connected with the carpenters' grinding work.
J As discussed in paragraph 9 below, preliminary investigations show ! that the pipe rupture was caused by a corrosion / erosion mechanism on i the inside surface of the pipe. It is clear tfhat the rupture was not ! related to grinding on the outside of the pipe.
,'
w
n
.
.
.
*
12
As further followup to the employee's concern, the inspector discussed
grinding practices at the site with licensee officials. The licensee
was aware of the employee's concern based on the individual's DOL case
in June 1986, and the employee's contacts with the news media after the
pipe rupture. The licensee stated that the work to which the former
employee-referred was buffing or cleaning pipe welds in preparation for
non-destructive examination (NDE) and was not grinding. The licensee's
representative said their practice had always been to use carpenters or
laborers to help pipe fitters clean or buff pipe welds in preparation
for NDE. The carpenters or laborers worked under direction of the pipe
fitters and were never allowed to grind pipe.
The inspectors interviewed both the foreman who had terminated the
carpenters in June, and a carpenter who was on shift at the time the
other carpenters were terminated. Both agreed with the Itcensee's
statements about carpenters being used only for cleaning or buffing
pipe welds in preparation for NDE. They both also stated that the
issue was that the carpenters who were terminated wanted pipe fitters'
pay. When they refused to buff pipe without pipe fitters' pay, they
were terminated. The foreman was the same foreman, who the concerned
employee stated, had advised his crew that they were carpenters and not
qualified to perform this work activity. During the interview, the
foreman stated that, at the time of the termination he advised the
carpenters only that the work they were requested to perform (buffing
pipe welds) was not outside their work classification.
The inspectors also reviewed U. S. 00L letter dated November 21, 1986,
relative to the employee's concern. The letter states in part:
"
... it is our conclusion that your allegations are unprovable
for the following reason: Your termination, although officially
recorded as involuntary, arose from a refusal to accept a work
assignment arising from previous and ongoing personal and
jurisdiction disputes with supervisor (s). These disputes were
unrelated to any safety and health issue."
~
The inspector also reviewed the licens e's program for control of
! grinding on pipe. During fabrication of piping systems, grinding !
is controlled by Volume 2 of the Corporate Welding Manual including
Procedure P-101, Revision 2, " General Piping and Pressure Vessel
, Welding Procedure," and Attachment A to P-101, " Weld Grinding Standard '
and Techniques." For NDE, surface preparation is covered by NDE proce-
dures. The inspectors reviewed a number of NDE procedures from the
NDE Manual and found that the procedures specify the surface condition
i required but do not always clearly specify the method of surface i preparation required to obtain the surface condition. NDE Procedure .
NDE-3.1, Revision 3, Preparation, Issue and Control of Nondestructive
Examination Procedures, requires in paragraph 4.3.2.5 that NDE proce-
dure list all actions which should be completeif prior to implementing
the procedure, such as surface condition and preparation, temperature
j of parts, etc. The licensee agreed to ev,aluate NDE procedures and
-
- ,
\ [
-- - - . - - - -. - ---.
-
.
.
*
j .
13
-
determine if clarification is needed in specifying required surface
preparation methods. Pending review of the licensee's evaluation,
!
Inspector Followup Item 280, 281/86-42-01, Clarification of Surface
Preparation Methods in NOE Procedures, is identified.
-
.
4
9. Metallurgical Aspects
As noted in paragraph 8.a. above, the 18-inch suction line to the A main
i feed pump failed catastrophically completely severing the line from the !
24-inch header (see Figures 1, 2 and 3). The failure occurred in an 18-inch
90 degree elbow approximately one foot downstream of a tee in the 24-inch >
header. The suction line was completely separated and dislocated from the
header. Immediately after the failure, the licensee initiated a comprehen-
sive analysis to determine the reasons for the failure and the necessary
corrective actions. The following summarizes the licensee's analysis: -
a. Initial Observations
. ] The failed 18-inch suction line was fabricated from ASTM A-106, '
Grade B, Extra Strong carbon steel seamless pipe and ASTM A-234,
- Grade B, Extra Strong, WP8 carbon steel wrought fittings with a
j nominal wall thickness of 0.500 inches.
4
When the 18-inch elbow failed, a fragment approximately two feet by
, three feet was ejected from the outside of the elbow. The free end of j the severed line was displaced in a horizontal direction approximately
6.5 feet and was wedged against the bottom of the B main feed pump
discharge line. During the displacement, the A suction line rotated
around the point of connection at the inlet to the pump, severely ,
- deforming that portion of the line. The failed elbow, the short
section of pipe between the elbow and the 24-inch header, and a short
'
section of pipe downstream of the elbow were removed for a detailed
i study. The three parts were re-assembled as close as possible to
- understand better the failure origination point and the sequence of
l the failure after origination. The licensee performed a field i metallurgical investigation of the fai, led elbow as detailed below. ! (1) The investigation consisted of the following:
-
Visual inspection of the system failure location.
-
Removal of the fractured elbow from the suction line. .
-
Visual 5X magnification evaluation and photography of
fracture surfaces, and elbow surface conditions.
'
-
Ultrasonic wall thickness measurements, on a two-inch grid
pattern, of the failed elbow.
,'
sem
.
-,------m._ ~ ,
.
O
-
. 14
-
Metallurgical replicas taken on the elbow at several surface
locations.
-
Mechanical measurements of elbow thickness.
(2) Th'e_ investigation resulted in the following observations:
-
Visual inspection of the inside surface of the elbow revealed
a dimpled surface appearance, generally thinned wall and a
number of localized very thin areas. The localized thin
areas were small in area, usually less than one inch across,
with remaining wall thickness as small as 1/16-inch. The
areas were fairly smooth and blended smoothly into the
surrounding material. Ultrasonic thickness measurements
showed the wall thinning to be a gradual sloping change over'
most of the surface of the elbow. The general thickness of
the elbow varied from 0.120 inches to 0.390 inches. The
short section of upstream pipe varied in thickness from
0.150 inches to 0.450 inches. Near the elbow, thickness
measurements on the section of downstream pipe revealed
thicknesses from 0.295 inches to 0.405 inches. The wall
thickness of pipe a short distance downstream of the elbow
was within manufacturer's tolerance.
As noted above, the nominal wall thickness should have been
0.500 inches.
-
Field metallurgical replicas taken on the surface of the
elbow revealed a microstructure typical of ASTM A-106 Grade 8
material with no signs of strain.
-
The fracture surface was typical of a ductile tearing mode
failure. Tears, which appeared to be fracture origination
points, were noted at two localized thin cavity areas of the
fracture. Small defects, indicative of laps, laminations
and inclusions, typical for A-106, Grade B, materials, were
noted at the fracture surface. One of these small defects
was noted at one of the thin overload tear areas and could
j have been the start of the fracture. l (3) The licensee's analysis revealed the following probable scenario ! for the pipe failure:
,
-
The pipe failed because of a thinned wall. A corrosion /
l erosion mechanism is the probable cause of the wall loss. l Wall loss by this mechanism occurs by a gouging out pattern _
on the carbon steel surface under the action of a flowing
i
medium and an electrochemical action. This phenomenon has .
been well documented for two phase fIow such as extraction ,
steam systems. The licensee has an inspection procedure
documented for monitoring the t,hickness of its two phase
.
.
O
..- . . - - . .- .
.
, - _ _ . . . _ - - - . . , - - , , , , , . . . _ _ . - , , - - , , _ . . . . . . , _ . . . - . _ _.., --.--,,-, - _ .--
.
O
.
-
15
systems (see Surry Administrative Procedure SUAD-M-33,
No. ADM-89.13. " Secondary Piping Inspections"). However,
for single phase flow in systems, such as feedwater and
condensate, the problem had not been recognized. The only
,
'
place where the phenomenon has been documented in a single
phase flow system is in the steam generator feed ring
J-tubes. The design geometry of the failed elbow in the
feedwater suction line is similar to the design geometry of
the feed ring J-tubes. Both consist of a header or large
diameter pipe and a right angle discharge pipe with a 90 or
ISO degree turn. The licensee concluded that the turbulent
flow created by the geometry and the low oxygen feedwater
probably contributed to the corrosion / erosion thinning of the
pipe wall.
-
Because of the thinned wall (as low as 0.048-inches in a
localized area and 0.100-inch over a more general area),
' local membrane stresses were near yield at system pressure
and temperature of 367 psig and 374 degrees F, respectively.
The system underwent an upward pressure transient (see para-
graph 7.c. above) resulting in a localized tensile overload
failure in a thin wall cavity. Using the ASME Code minimum
wall equation, and assuming an internal pipe pressure of
600 psig, a temperature of 370 degrees F, and an ultimate
strength of 60,000 psi, results in a calculated burst thick-
, '
ness of 0.090 inches and a yield thickness of 0.173 inches.
Therefore, with a local cavity thickness of 0.048 inches,
l a general thickness of 0.100-inch, and a upward pressure I transient, the material easily exceeded its burst strength.
The initial tensile overload tear was considered to have
arrested and not to have developed into an unstable tearing
mode. Water flashing to steam was heard by station person-
nel. As water continued to flash to steam for a few seconds
and pressure continued to increase in the elbow, an unstable
tear developed in a second t,hin walled area. The pipe then
ruptured, ejecting the fragment from the elbow.
- b. Metallurgical Analysis
(1) VEPCO
VEPC0 has hired Failure Analysis Associates (FAA) to perform a
complete metallurgical analysis of the failed elbow. The
following is a summary of the work to be performed and the
.
preliminary results as of January 14, 1987:
l l (a) Phase 1 - Scheduled for completion a, bout February 1, 1987
-
Tensile Tests
.' -
>
_
,
, _ , . . . - - - --. . . - .,- - --, . - - - - - - . , - - - - - , - - - - - - - ~ ~
. .
.
O
.- 16
Tee, elbow and across the weld tested. Results
complete. Acceptable to specifications.
-
Charpy Impact Tests
'
~
Elbow tested. Small specimens used due to thickness of
material. Results appear to be satisfactory. Complete
curve will be generated to correlate results with full
size specimens.
-
Hardness Tests
Elbow base material, elbow heat affected zone (HAZ),
tee base material, tee HAZ and weld material tested.
Results complete and appear to be satisfactory.
-
Chemistry
Elbow base material, tee base material, and weld
material tested. Results complete and appear to be
satisfactory. Trace elements are almost nonexistent.
-
Micro and Macro Examinations
Work partially complete. At 50X, inside surface
dimpled, outside surface smooth. Structure typical -
Pearlite / Ferrite.
-
Scanning Electron Microscope Examination
Started.
-
Oxide Layer Micro Probe Study
Started.
(b) Phase 2 - Scheduled for compietion about the end of February,
1987.
l l
-
Finite Element Analysis
-
Basic Stress Analysis
-
.
Complete. Primary stresses 8500 psi, secondary thermal
,
stresses 5000 psi. Code allowable 15,000 psi primary,
j 22,500 psi primary plus secondary. _ , i
*
.
i
g
'
.
- - -- _-- -
. _ _ . _ . . . _ . . _ ._ _ _
'
.
~
-
17
f
(c) Phase 3 - Scheduled for completion about mid-March,1987.
-
Establish J-Resistance Curves tad perform detailed
,
fracture mechanics analysis.
'
!
_ Contract is being finalized. FAA will have basic
contract. Material Engineering Associates (MEA) will
be used as a subcontractor.
I
(2) NRC
The NRC has hired Brookhaven National Laboratories to perform an
independent metallurgical analysis of the failed elbow. The
tests being conducted are essentially the same as the VEPCO
Phase 1 tests. Tests are scheduled for completion about the same
time as the VEPCO Phase 1 tests.
10. Chemistry - Corrosion
a. Introduction
A Region II chemistry specialist / inspector visited the Surry site
on December 22-23, 1986 to examine the sections of the feedwater
suction lines from both units that had been exposed by the licensee
subsequent to the rupture in Unit 2. The inspector also reviewed
chemistry data that had been documented since the startup of Unit 2
in 1973 to assess the chemistry control of the secondary water system
during the operational history of this unit. Based on the information
that is summarized below, the inspector evaluated the licensee's
-
'
preliminary theory that the pipe rupture was the result of extensive
erosion / corrosion of the 18-inch suction line to a feedwater pump,
- especially in the vicinity of the intersection of this pipe and the
i
feedwater header.
b. Inspection
"
(1) Visual Inspection
! (a) Unit 1 - On December 21, 1986, the licensee had cut out
'
the suction line to A feedwater pump from, and including,
the junction with the feedwater header to, and including, the
isolation valve. The upstream portions of this pipe had been
further separated and stored indoors while the downstream
segments had been stored in'the open overnight.
The most significant observations were as follows:
-
An adhesive black film, conside, red to be Fe 034
i (magnetite), covered the inner ' surface of the junction
segment (i.e., approximately four feet of the header and
'
the 18-inch pipe past the. initial 90* bend) except in a
'
, .-
9
. . . , _ _. . _ . _ _ _ . . _ _ . , _ _ _ . _ _ _ _ _ . _ _ - _ . _ _ _ . , _ . , _ _ - . . - . _ . _ , _ , , _ _ _ _ _ . - . _ _ - . _ -_ _ _ _ , , _ . - .
*
.,
*
.
18
limited region in the lower part of the 90' bend. A
-
similar patch of black oxide was located on the surface
of the second bend. Although there were small areas of
. black oxide in the other portions of the suction line,
,
*
most inner surfaces were covered with a thin layer of
_
red powder that was assumed to be Fe O2 3 (hematite).
-
The weld bead that formed the inner junction of the
header and 18-inch pipe had been worn smooth on the
downstream side, and significant (approximately
one quarter-inch) amounts of weld metal had been lost.
-
The weld bead joining the upstream segment of the
18-inch pipe to the first elbow had also been worn
smooth except in the quadrant approximating the outer *
portion of the bend in the elbow.
-
The weld discussed above also exhibited a scallop shaped
depression that indicated a limited region of signifi-
cant loss of metal. This gouged area was located
in both the weld bead and adjacent pipe approximately
90 degrees from the direction of flow in the header.
-
An indication of a scratch or gauged area, approximately
0.5 inch x 12 inches was observed in the isolated black
region on the top (horizontal) side of the second elbow
from the header.
(b) Unit 2 - After tne 18-inch suction line ruptured the licensee
had cut out this line at the tee weld at the header and five
feet downstream of the first elbow from the header. The
section of pipe that was removed included the failed region
and the 2-ft. x 3-ft. hole formed by the expulsion of the
! weakest section of the first elbow.
The exposed openings in the header and the 18-inch suction
line had been capped with plastic for protection against
dust.
The most significant observations relating to the feedwater
header and the remaining section of the suction pipe are
listed below:
-
Approximately one inch *of water remained at the bottom
( of the header, and evidence of fresh rusting was
observed beneath the water.
I
!
'
,
Q
, - . . . - , . - - . , . . - , , , . , , .
*
.
*
, 19
-
The entire length of the header from the upstream
elbow to the most distant section downstream that
was visible with a flashlight was coated with red
iron oxide. The layer of oxide was not deep,
, however, and appeared as a film over roughened iron
+
_ and was easily wiped off.
-
The nearest elbow on the header upstream from the
opening was black in color.
-
The downstream region of the inside bead of the weld
head that held the 18-inch pipe to the header was gouged
out in the same manner and location as observed in
Unit 1. Also, as in Unit 1, this weld bead had been
worn smooth with the pipe except on part of the upstream
side.
-
A concave area of approximately two inches in diameter
had been formed immediately below the weld in the
remaining stub of the 18-inch pipe.
-
The inner surface of the initial foot of the downstream
run of the suction pipe was red in color while the
remainder of the visible portions were black. The line
of demarcation was very sharp.
(c) Evidence of thinning
The licensee had completed detailed ultrasonic tests of the
Unit 1 suction line to A pump so that profiles of pipe
thickness were available to the inspector. These profiles
and visual evidence of thinning at the ends of cut out
sections of this 18-inch pipe showed clearly that widespread
wastage had occurred from the header to several (approxi-
mately 5) feet downstream of the first elbow from the header.
However, the thinning was no,t evident from the inner surfaces
of the pipe beer.use the loss of metal had been very uniform,
as if polished with coarse emery cloth, even where the pipes
were red in color. The degradation of the welds at the tee
junction and the single gouged region in each unit were the
only obvious indications of metal having been removed in a
non-uniform fashion.
(2) Audit of Chemistry Records ,
The inspector reviewed archived documentation of daily analyses of
the condensate, feedwater, and reactor coolant from the startup of
Unit 2 (March 1973) until the unit was sh,utdown in February 1979.
,'
+o
- - - - - - - - - , . ,
. -. .
.
.
'
.
20
Through previous inspections, the inspector was already familiar
'
with the licensee's chemistry control subsequent to the replace-
ment of the steam generators in Unit 2; i.e., from 1980 to the
present time.
'
4
As'_one of the first nuclear power plants constructed in the United
States, both units at Surry began operation with a chemistry
control program that included the use of hydrazine to control the
- detrimental effect of dissolved oxygen - as an oxidant of carbon
steel pipe. For two years the licensee also had added phosphate
salts to the feedwater to control pH and to prevent attack of the
carbon steel by hydrogen ions. In 1975 the phosphate control
l
program had been discarded in favor of the use of ammonia in an
effort to minimize or eliminate denting of the tubes in the steam
generator. During part of 1976-1977 cyclohexamine had been also -
added for pH control but was soon replaced by the use of morpho-
l i ne.. When the units started up after replacement of the steam
generators, the licensee, following the recommendation of the
Steam Generators Owners Group (SG0G), based the chemistry control
on all-volatile-chemical treatment (AVT) with hydrazine and ammonia.
'
Because of the original design of the Surry units (copper-alloy
condenser tubes, absence of a condensate cleanup system, copper-
alloy feedwater heater tubes) and the relatively high salinity of
the condenser cooling water, control of secondary water chemistry
had been difficult, as indicated by the following examples:
l
-
Intrusions of chloride ions in concentrations of tens of
i
parts per million (ppm) occurred several times in 1973,
I 1975, 1977, and 1978 as the result of condenser tube
failures. (The current upper limit recommended by the SGOG
to prevent corrosive attack of iron pipe is 20 parts per
billion (ppb)).
' -
During four weeks in 1975 the pH of the feedwater remained
below a value 8, and thus ingreased the vulnerability of
carbon steel pipe to corrosion by hydrogen ions (acid). The
SGOG recommends that the pH of the feedwater be maintained
between 8.8-9.2 in ferrous / copper systems such as were
present in the Surry units prior to 1980. In systems that
do not contain copper components, the SGOG recommends that
the feedwater be maintained in a more basic condition (pH
of 9.3 to 9.6) to increase the electrochemical stability'of
iron in water and to minimize the dissolution of iron through
reaction with hydrogen ions (acids).
-
During the period when cyclohexamine was used, the pH of
the feedwater exceeded 9.5 and, occasionally even 10.0.
Although the higher pH benefited the! reduction of iron
corrosion, it also caused accelerated corrosion of the
copper-bearing alloys in the co,ndenser and feedwater heater
'
.
. - --,~._,_____-_,,,,_ . - _ . _ - _ _ _ ...__ _ __ , - _ . __ _ _ -_.-
. .- .- .
.
.
.
-
21
tubes. Inasmuch as copper ions in solution exacerbate
.several forms of chemical corrosion of carbon steel and alloy
600 (Inconel), the SGOG recommends that the concentration of
copper in feedwater be kept below 2 ppb. The presence of
, higher concentrations of copper in the feedwater of the Surry
_ units before 1980 was considered to be a major cause of the
degradation of the original inconel steam generator tubes.
The licensee replaced the copper alloy condenser tubes with
titanium during the steam generator replacement outage but is
only now planning the replacement of the feedwater heater
tubes with non-copper alloys.
-
Throughout the operational history of Unit 2 the licensee had
observed the concentration of oxygen in the condensate and
feedwater to have been less than the limit detectable by the
most sensitive analytical instrumentation (except during 10
days in 1975 when, because of seal failures, the concentra-
tion of oxygen increased to approximately 20 ppb.) The
inspector considered that the lowest detectable limit had
been 0-10 ppb during this period - which is consistent with
the limiting concentration, 5 ppb, currently recommended by
the SGOG. Control of oxygen had been maintained by the
addition of hydrazine; however, during much of the early
operating history the residual concentration of hydrazine had
been close to the detectable limits (approximately 5 ppb).
Currently the licensee adds sufficient hydrazine to ensure -
that the residual is greater than 20 ppb, as recommended by
the SGOG, so that oxygen is quantitatively reduced and elimi-
nated as an oxidant.
(3) Conclusions
l The tee and upper elbow of the 18-inch pipe to the A feedwater l
pump in both Surry units were visually observed to have been
! degraded through extensive thinning and severe, but localized, ( gouging. However, the interrelationship between the roles of l corrosion and erosion was not clear. The degree to which the I feedwater pipe had been protected against general corrosion by a
film of magnetite was difficult to establish because the pipes
had been opened and exposed to moist air. Although general
corrosion, as well as more localized forms of chemical attack,
may have been aggravated by the occasional presence of corrosive
impurities in the feedwater during the initial seven years of
plant operation, there was no visual or ultrasonic evidence to
support this speculation. A more comprehensive analysis of this
subject is presented in the Appendix to this report.
!
.-
.
,
, . - . . , - - .-
_ . _ . , - - , . - .--,-,.,-.--,-.---.-_-------- --_- .-- ,
-
*
.
.
*
22
11. Items Which Could Have Contributed to the Likelihood or Severity of the
Event
, a. General
'
The inspectors reviewed system operating procedures, system maintenance
history and the operating status of selected systems to determine those
factors which contributed to the closure of the C steam generator
main steam trip valve (MSTV TV-MS-201C) and the subsequent reactor trip
and feedwater pipe ruture.
(1). Plant Service Air / Instrument Air System (SA/IA)
The inspectors reviewed control room logs, interviewed control
i
room operators and examined equipment in the plant associated
with SA/IA system. This system supplies air to the air operated
MSTVs. The air pressure supplied to the air operated cylinders
associated with each MSTV holds the MSTV open during normal plant
operation. The air pressure is automatically vented off the
operating cylinders following a trip signal or manually vented by
the operator action. The MSTV will then shut, assisted by the
steam flow acting on the value disc. Prior to the reactor trip,
the operating status of the SA/IA system was as follows:
,
SA/IA blue auxiliary air compressor was in operation; the three
turbine building air compressors were in automatic mode, one was
off; one of the condensate polisher air compressors was floating
i on the SA/IA system. System pressure indications as observed from
the control room was approximately 100 psig (normal operating
range is 95-110 psig).
I
Planned maintenance was being performed on the SA/IA grey
auxiliary compressor which consisted of the installation of a new
temperature sensing element. Following this maintenance, the grey
compressor was scheduled to be placed in service. Both the blue
and grey air compressors share a. single power source. In order to
position the transfer switch from the operating blue compressor to '
the grey compressor, the electrical power supply is required to be
deenergized. Control room operators were aware of these operations
and were adjusting air flow from the condensate polisher air
system. System pressure decreased to approximately 85 psig as both
blue and grey compressors were deenergized.
At the time of the reactor trip, control room operators noted that
SA/IA system pressure was approximately 78 psig. Subsequent to
the reactor trip, the blue air compressor was placed back into
service.
!
! ,'
.
_
_ , _ _ _ . . - - _
_ .. . ,m_ . - _ _ . _ - . . _ . , - - - . - . . , , - - - - - - . - - , . - - - . - - _ - - _ _ _ . - - - - - . . - -
_ _ _ _ _ _ ___ _ _ _ _ _______ _ _ _ __ _ _ _ . _
'
.
.
'
23
1
Discussions with control room operators indicated that operating ;
, experience has shown that SA/IA receiver pressure has decreased as ' low as 55 psig without any MSTV closing. As noted by this
event, the only MSTV to close as a result of the lower instrument
air pressure was the C MSTV.
I
, The inspectors reviewed operating procedures for the SA/IA system.
Discussions were also held with operators to determine adherence
to procedures; no problems were identified.
' During December 15-19, 1986, the licensee tested and opened for
inspection the C steam generator MSTV. The detailed inspection
and testing of the valve and the results are discussed in a
separate paragraph in this report. The problem discovered during ,
this inspection, however, showed that the valve disc operator -
.
assembly had previously been assembled incorrectly and permitted
the~ valve disc to be positioned in the steam flow path at an
angle greater than that allowed by design. This condition,
j coupled with the drop in SA/IA system air pressure prior to the
reactor trip, appeared to have allowed rapid closure of the MSTV
by steam flow forces. '
'
Following the event, soap bubble air leak testing of instrument
air piping and components to the C MSTV was conducted under
normal system pressure condition. No significant leakage was
identified that would have affected MSTV air operated cylinder
,
operation.
(2) C Main Steam Trip Valve (MSTV).
The action which initiated the reactor trip and subsequent
i feedwater rupture was the inadvertent closing of the C MSTV. I A review of the maintenance history indicated this valve was I
overhauled during the most recent refueling outage in November
i i
1986. On November 27, 1986, following the overhaul, the valve
'
position limit switch was adjusted and the valve was cold-cycled
satisfactorily per Periodic Test 14.2. On November 29, 1986, with
Unit 2 in hot standby, the C MSTV was again cycled, and the
valve failed to open fully. The reactor operator generated a Work
Order 046251, which indicated that the C MSTV was binding and
capable of only partially opening. That same day, November 29,
1986, it was determined that the cause of the C MSTV was nots
fully opening because of water in the valve. The next operating
shift drained the water and successfully cycled the valve on '
November 30, 1986. However, Work Order 046251 remained open
because the valve appeared to operate somewhat differently from
the other MSTVs, even though it met its intended safety function
as required by Technical Specifications.
'
.
e
=
_. . _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ -_ _ _ _ _. _ ._ _ _
___ _ _ _ - _ _ , _ _ .
.
.
.
.
24
Following the event and the initial AIT inspection, the C MSTV
,
was released to the licensee for inspection and testing. The
licensee developed a detailed testing and inspection program
to determine the cause of the valve's inadvertent closure.
The results of this program are as follows:
Prior to disassembly, the valve was cycled and determined
to only open approximately 62 degrees. Normal full open
position should be 80 +2 degrees. Disassembly of the valve
revealed the valve cover had been installed one stud or
approximately 15 degrees off. This cover has a stop tube
welded to it which normally limits valve disc travel to 80
+2 degrees when going full open. With the cover installed
approximately 15 degrees off, the stop tube was positioned
such that it limited the disc travel to only 62 degrees which
left the disc approximately 25% from the full open position,
exposing the disc to the closing force of main steam flow.
This pragram also revealed that the radius lever had been
i installed on the rock shaft one spline tooth off, which would !
have limited valve travel to 75 degrees had it not been for
the valve cover misalignment. This also would leave a
portion of the disc exposed to the closing force of the steam
flow. The misalignment of the radius lever also contributed
to the failure of the C MSTV closed limit switch to indicate
that the valve had closed. During testing, the licensee
determined that placement of the radius lever up one spline
tooth prevented the limit switch from fully engaging in the
closed position. A maintenance history review revealed that
l the limit switch was adjusted before the valve was retested
after maintenance. This adjustment appeared to be on the
i '
lower limit switch, but a complete determination of what was
actually adjusted could not be made dua to lack of documenta-
tion. The operation of the closed limit switch was deter-
mined to be intermittent. During the cold and hot cycle, the
switch was depressed enough ,to actuate. But during and
following the event, the switch, even though engaged, was not
depressed enough to actuate, although only slight additional
movement caused the closed limit switch to actuate.
Several observations can be made based on the licensee's inves-
tigation into the C MSTV closure. The maintenance procedure
MMP-C-MS-002 used for overhaul of C MSTV was not correctTy '
followed. The procedure was inadequate in that it did not
prevent, nor did the post maintenance testing discover the
improper assembly of the C MSTV. The licensee failed to
document all the non-routine work associated with this valve
overhaul. A review of MMP-C-MS-002 shows that step 5.4.8 which
reinstalls the radius levers does not prdvide adequate instruc-
tions to maintenance personnel or quality control (QC) inspectors
*
.
~~
.
__ __ _ _ _ _ . _ _ _ _ _ . _ __ = _ . _ - . - _ , , _ . _ . _
-
_ _ . - _ _ _ , , _ . _ _ _ , _ _ . - _ _ - _ _ _ _ . , . _ , , - - _ _ _ - . - , , _
'
.
.
-
25
as to the proper reinstallation alignment. Investigation by the
licensee revealed that the maintenance person reinstalling the
valve decided, based on comments from a QC inspector, to reinstall ,
the radius lever up one spline tooth from the previous installa-
ti,on. This decision was made without any documentation or
engineering review. This decision alone resulted in limiting
valve travel to only 75 degrees exposing the disc to steam flow
and appears to be the cause of the failure of the closed limit
switch to operate.
Step 5.4.12 required the QC inspector to check and record the arc
of valve travel. The recorded data was 80 degrees - although
the licensee determined after the event that it was only 75
degrees. The inaccurate documentation appears to be a result of
the QC inspector performing this verification by visual check <
only. Since the step calls for a quantitative result, the step
should have required that some type of instrumentation be used to
determine the arc of the valve travel. Also, the QC inspector
should not have documented it as 80 degrees unless there was a
means of precise verification.
Although Step 5.4.15 required replacement of the valve cover, the
step does not mention anything about cover alignment; specifi-
cally, there is no mention of any problem that cculd result from
cover misalignment. This would have illustrated the importance of
proper alignment. The inadequacy of the step resulted in the
misalignment of the cover, preventing full travel of the valve
disc, and leaving the disc exposed to the closing force of steam
flow.
Finally, step 6.3 requires a post maintenance test be performed
which only tested the operation of the valve based on the open and
closed limit switches. This test, PT-14.2, does not verify full
valve disc travel, and therefore was not adequate to verify proper
valve reassembly. However, it should be noted that the test was
adequate to verify the safety function of the valve which is to
close. Also this test was used to verify that the valve was in
compliance with Technical Specifications.
The fact that the C MSTV was reassembled so that the disc was
always exposed to the closing forces steam flow, coupled with the
'
low air pressure, resulted in the inadvertent closure of the C
MSTV. This inadvertent closure of the C MSTV resulted in a
reactor scram but did not contribute to or cause the rupture of
the main feed piping. This rupture would have happened during any
normal pressure transient of the feedwater system. Even though
- the inadvertent closure of the C MSTV did not cause the feed
! line rupture and the safety function of t,he valve along with
-
.
3
9
. - - - - . - - . - _ . - - . _ , _ - - . . - - . - _. .
_ . __
*
.
'
.
26
compliance witti Technical Specifications were verified, the
fact.that the valve was reassembled in such a way that it resulted
in an inadvertent reactor scram and a challenge to the unit's
safety system is still a significant problem.
TkchnicalSpecification6.'4.Arequiresthatdetailedwritten
procedures with appropriate check-off lists and instructions shall
be provided for preventive or corrective maintenance operation
which would have an effect on the safety of the reactor. The
failure of the licensee to fully follow procedures, provide
adequate instruction for and document the performance of maintence
operations involved in the performance of the procedure to over-
haul the C MSTV will be identified as Violation 50-281/86-42-02.
(3) Feedwater Pump Discharge Check Valve (No. 2-N-127)
Dur,ing the initial investigation of the feedwater pipe rupture
event, an abnormal pressure transient of the A MN pump suction
piping was suspected to be the cause of the rupture. For such a
pressure transient to occur, the A MN pump discharge check
valve (2-N-127) would have had to be permitted flow in the
reverse direction. Since this was a potential cause of the pipe
rupture, a review of the maintenance history and an internal
inspection was conducted on the check valve (2-N-127).
A review of the maintenance history on this particular check valve -
revealed that the valve was scheduled to be inspected in late
'
1984. The licensee decided not to inspect the valve, based
on a satisfactory inspection perforced on a Unit 1 feed pump
discharge system check valve and on the operational history of the
valve. It should also be noted that during the startup prior to
this event, the B main feed pump was operated with the A main
feed pump secured. There was no mention of a problem with high
feed pump suction pressures, and the A main feed pump was
started successfully on December 5, 1986.
The licensee disassembled 2-N-12'7 after the event. Inspection
of the internals showed the disc was not fully seated. One of the
two hinge pins was missing, and the valve seat was displaced. The
condition of the check valve at the time of the inspection would
have allowed for flow in the reverse direction. The licensee has
been able to determine, based on the operation of the A and B
main feed pumps, that reverse flow tarough the A main feed p~ ump
did not occur at the time of the' event. As discussed in the
sequence of events paragraph that the A main feed pump was still
operating after pipe rupture. Therefore, flow past the check
valve into A feed pump suction piping could not have occurred
prior to the pipe rupture. This conclusion strengthens the
supposition that the feed water pipe ruptfured during a normal
pressure transient and that back flow past the chec' valve did
not cause a pressure spike which resulted in the pipe rupture.
.
t
- . -. ,_ , _ - - . . . - _ ,
.-7 - ,_
__ _ _
-
.
*
.
27
However, the condition of the check valve would have contributed
to the amount of feed water which exited the feed line break
and possibly the extent of the pipe whip after the event. The
licensee has inspected the other Unit 1 and Unit 2 feed pump
ch;eck valves and discovered additional discrepancies (see para-
graph 15.c.). The condition of each of these valves at the time
of inspection was such that they would have performed properly and
not allowed significant reverse flow.
(4) Feedwater System Maintenance History
A review of recent feed water system maintenance history did not
reveal any identified problems with the A or B main feed pump
suction piping. The licensee has identified some problems with
the feed water system such as pin hole leaks which were associated
'
with erosion, but these problems were located in the feed water
pump, discharge recirculation piping. While the licensee did not
have a program to inspect the feedwater piping for thickness, it
does have a formal ultrasonic inspection program to determine
thickness for the following secondary system areas:
-
Turbine Exhaust Cross Under Piping
-
1st and 2nd Point Extraction System
-
3rd and 4th Point Extraction System
-
Moisture Separation Drain Liner
-
Moisture Separator Reheater Inlet Piping
- (5) Safety System Equipment Review
! A discussion with the Superintendent of Operations and a review of
i
pertinent documents - i.e., plan of the day, the tagging log, the
reactor operator's log, the shift. supervisor's log and the minimum
equipment list for criticality and power operation checklist--
indicated that all safety-related equipment required to support
unit operation was operable. The only safety-related equipment
problems indentified prior to the event were (1) the inoperability
of one of the three charging pumps (only two are required to be
operable by technical specifications); and (2) a service water
pump which was operable but listed in an alert condition. '
During the event, all safety systems responded as required.
These systems include the operation of the reactor protection
a
'
system (RPS), the steam generator safety relief valves and the
auxiliary feedwater system. The secondary power-operated relief
-
.
Q
.e>-ww- w---- - - - v-v--
_ _ _ . _ _ __ . _ _ _ _ _ _ . . -
. _ _ __ _ .- _ ._
*
.
*
.
'
28
valves (PORVs) were in the manual mode of operation. The opera-
tors.took manual control of the secondary PORVs to control steam
generator pressure, allowing the secondary relief valves to shut
and to control the removal of decay heat in the primary plant.
_
,
- The only equipment which did not respond as required was (1)
'
.
control rod (M-10) which indicated 35 steps for a short time
following the reactor trip before indicating fully inserted;
! (2) the fire protection system which spuriously initiated as
discussed in paragraph 13; (3) the instrumentation which failed
,
to indicate closure of the C MSTV as discussed in paragraph
6
11.a.(2); and (4) the security door card readers which failed as
discussed in paragraph 13.b.
t b. Review of Maintenance Activities Being Performed Prior to the Event
Discussions with licensee personnel and review of the maintenance
- activities being conducted prior to the event did not indicate any
]' maintenance activities which would have contributed to the initiation
or resulted in the feed water pipe rupture. Maintenance activities
j being conducted by the individuals who were injured were unrelated to l the feed water system rupture and would not have contributed to the
cause of the event.
i
12. Licensee's Response to the Event
4
a. Operator Response
The response of the operators to the initial reactor trip and later
pipe rupture was excellent. The break was isolated rapidly. The only
! problem that occurred was a control rod gave an indication of not
i being fully inserted by 35 steps. Emergency procedures were followed i quickly and orderly to assure adequate shutdown margin. It should be
noted that the licensee has conducted tests with the plant in a cold
condition, but has been unable to duplicate this rod position
i ' anomaly. The licensee intends to conduct additional testing during
startup.
b. Emergency Response
The inspectors discussed various aspects of the licensee's response
~
to the feedwater pipe rupture with licensee employees. The first
person responding to the accident was a senior instrument technician
who had been perfor'ning quarterly calibrations on security equipment.
He responded to a station security call for first aid assistance to the
Unit 2 truck bay. Upon arrival, one injured employee was observed
leaving the accident area. The technician escorted the individual to
the high level intake structure and set up a triage area. Three .
additional personnel subsequently exited the decident area and were '
.
.
6 .n
_ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ ___ _- _ _
l
.
.
.
-
29
. i
given first aid by the team that was present. The technician unsuc-
cessfully attempted to contact the Unit 2 Control Room using a security
radio. The technician then proceeded to the maintenance services area
to call for assistance. Upon arrival, the technician discovered two
additional accident victims. The technician used the plant page system
,
'
j
to notify the control room who called in offsite medical support, i
including two medical evacuation helicopters and two local rescue
squads.
The licensee prepared the victims for transport and moved them to the
licensee's heliport, located behind the training building. The three
i
most seriously injured personnel were air evacuated to hospital burn
units while three were transported by ambulance.
Licensee personnel interviewed following the event have stated that < !
, the site's emergency team functioned extremely well and was well -
coordinated. Further, licensee representatives have stated that the
i Alert was declared so that a personnel accountability could be made i because it was not kncwn at the time of the event how many people
had been in the area when the feedwater pipe ruptured.
.
The inspector reviewed the actions required by the licensee's emergency
plan and determined that the actions taken by the licensee were in
4
accordance with the actions specified in the plan.
! c. Emergency Information Activities '
The accident spurred extensive interest from the media in the immediate
plant area, throughout Virginia,=and-nationwide. Virginia Power issued - -
its first press release slightly more than an hour after the declara-
! tion of the alert. This initial announcement was followed by several
others later in the day and into the evening. Follow-up announcements
were issued the next few days. In accordance with the company emer-
gency information policy, Virginia Power began steps to open the
near-site media center in the Surry, Virginia, Community Center.
4
! Because the Alert was cancelled before,the media center was fully
l operational, reporters were briefed at the emergency operations !
facility at the site. Virginia Power also opened its main media center
i at company headquarters in Richmond and issued information from there
for several days thereafter.
The day after the accident press conferences were held at noon at.the
on-site training facility and at the Richmond media center. An NRC
l public affairs officer went to the site with the Augmented Inspection i Team. He answered telephone media inquiries from the resident
inspector's office and participated in three press conferences with
- Virginia Power. NRC also responded to inquiries received by the public
affairs offices in the Region II office and in, Headquarters.
1 . .
'
.
-
,
,
-----.,,n---,-,_,.-- -,,
'
.
.
.
30
In addition to written announcements, news briefings, and answers to
telephone inquiries, Virginia Power also made available to reporters
both videotapes and still pictures of the accident scene.
Both NRC and Virginia Power continued for several weeks to respond to
media 'imquiries about the accident and the followup investigations. A
briefing of NRC by Virginia Power on January 12, 1987, attracted media
coverage, as did a technical meeting convened in NRC Headquarters on
January 15. Virginia Power on January 22 held a special media briefing
on the results of its investigation. NRC received numerous requests
from reporters and for copies of the AIT report.
13. Aspects That Made Handling The Event More Difficult
a. Security System / Personnel Actions
(1) At,the time the pipe ruptured, water and steam saturated a
security card reader located approximately fifty feet from the
break point and shorted out the entire plant card reader system.
As a result, key-cards would not open plant doors. Security
personnel responded to the control room and provided access
control while doors into the control room were opened for easy
access and to improve control room ventilation. Guards admitted
personnel on the basis of personal recognition. The Senior
Resident Inspector reported observing that plant management and
operations personnel were immediately admitted by the guards and
nonessential personnel were excluded. The card reader system
returned to service approximately 20 minutes after the pipe break
and functioned normally thereafter. An operator reported being
delayed in the stairway outside the control room as a result of
I the card reader failure. Due to the hot water conditions on the
turbine building basement floor and the discharge of Halon fire
suppression system in the emergency switchgear rooms below the
! control room and the carbon dioxide fire suppression system in the
cable tray rooms above the control room, the operator had no safe
way to exit the stairway other than the control room itself. The
l operator was admitted to the control room by someone opening the l door from inside the control room. The licensee is considering * ! installing electronic override switches which would permit the ( opening of electronically locked doors in emergency situations. l l Plant management personnel reported that security provided fast
and excellent support during the emergency.
'
(2) The security radio repeater is. located in cable tray room 1
(turbine building elevation 45), which is equipped with a Cardox
fire suppression system. As a result of steam infiltrating
various electrical systems this Cardox system was activated and
the full volume of Cardox was discharged!into the room. The
security repeater, located approximately five feet from a Cardox
discharge nozzle, failed and was la,ter found to be covered with a
.
l
._- ___ _ -__ _ _ _ _ - _
. ___ _.. _ -___-_.-. - _ _ _ _ - - _ _
- _ - - _ . . - --
*
.
.' 31
thick layer of ice. As a result, security communications were
limited to the non-repeater or " simplex" mode. Since the hand-
held security radios have only four watts of transmitting power,
,
'
some communications clarity was lost between units inside
buildings. Loss of the radio repeater may also have prevented
cohtact with the Unit 2 control room by the first responder as
described in paragraph 12.b.
(3) A truck carrying water coolers containing ice was the only
vehicle admitted to the protected area during the emergency.
While the truck was processed expeditiously, it was not processed
as an emergency vehicle, which would have allowed its immediate
entry. This resulted from the lack of information available to
security personnel at the vehicle gate about the exact nature
of the emergency and lack of understanding that the truck was
bringing in ice and ice water for use in treating the burn
v i ct,i m s . The licensee has recognized the importance of ensuring
that personnel functioning in a supporting role know what is
happening so they may better understand and, therefore, better
respond to tasks they are given or situations as they arise.
(4) One security badge /keycard was temporarfly lost during the
emergency. Badges were retrieved from five victims before they
were transported from the site, but the badge on one individual
was overlooked. As part of the personnel accountability process,
security realized that one badge, belonging to one of the -
victims, was unaccounted for. That badge was deleted from the
access control computer and computer records were checked to
ensure that the badge had not been.used since the accident. The
individual's wife found the badge on his shirt at the hospital
and the badge was returned to the plant the morning following
the accident.
'
(5) At the time of the pipe break, two security shifts were on duty,
which permitted security to provide a great deal of manpower to
support the plant. The inspector, determined that one security
shift could have provided the manpower to perform the actions
taken by security during this event. The security force, however,
'
would have had to suspend all routine activities if only one
shift had been available.
'
.
(6) The Surry security organization has examined its performance
and identified ten areas in which improvements can and should be
made. Recommendations in these areas were submitted to both
security and plant management for evaluation and possible
implementation on December 19, 1986.
b. Fire Protection System Actuations and Main Control Room Habitability
l
Within minutes of the feedwater pipe rupture event in the Unit 2
turbine building, portions of the Unit 2 turbine building sprinkler
I
system actuated. Sixty-two sprinkler hea'ds opened in the immediate
.
- - _ - , . - - .- - - - - _ _ --
. . _ _ - _
- . - . - - - -. ~. . - - . - - . - - - - - - - - . - _ - - .
, -
,
4
!
-
,
32
i
i area of the feedwater pipe rupture due to the high heat levels !
3 ' associated with the event. As they opened, these sprinkler heads ' immediately began discharging water to cool the turbine building
atmosphere.
, ! As a result of the sprinkler wa'ter and feedwater discharge, the carbon
dioxide and the Halon fire suppression system control panels were
affected. The carbon dioxide fire suppression system control panels
- for both Units 1 and 2 cable tray rooms are located near the Unit 2
i cable tray room access door along the column line 9 wall on elevation j 45'-0". The sprinkler water discharge from the sprinkler heads
directly over and adjacent to these panels intruded into the carbon
,
1
'
dioxide fire suppression system control panels through multiple open
i '
conduit ends which extend from the panels to the cable tray raceway
above. As a result, the water intrusion into these panels caused the -
time limit switches to short-circuit in the closed position. When
!
these switches closed the carbon dioxide fire suppression systems, at
i approximately 2:32 p.m. (12 minutes into the event) the Robertshaw fire l protection panel / printer in the main control room recorded the initial
discharge of the Unit 2 cable tray room carbon dioxide fire suppression
j system. In addition, at approximately 2:34 p. m. (14 minutes into the l'
event) the Robertshaw panel recorded the second discharge of carbon
'
dioxide into the Unit 2 cable tray room. It should be noted that the
bulk of carbon dioxide discharge was in the Unit I cable tray room,
-
which was noticed by the licensee's loss prevention staff who c'onducted
i '
the personnel search and initiated the venting of carbon dioxide from
the cable tray rooms. The Robertshaw fire protection panel / printer did
not register a Unit I discharge throughout the duration of the pipe
.
rupture event. Thus, as a result of the water affecting the time
!
limit switches in the carbon dioxide control panels, the discharge
timers did not function as designed. As a result, a total of 17 tons
. of carbon dioxide was discharged into the cable tray rooms, i '
In addition, the Halon fire suppression system protecting Units 1
l and 2 emergency switchgear rooms on elevation 9'-6" actuated at approx-
imately 3:02 p.m. (42 minutes into the, event as documented by the
! Robertshaw panel printer). The Halon system actuation was caused j by sprinkler water discharge and feedwater runoff which flowed under
- the elevation 27'-0" fire door No. 30 installed in the column line 9
- wall. The water runoff cascaded down the column line 9 wall, which
separates Units 1 and 2 turbine buildings, on the Unit 1 side, entered
a Halon system conduit through a conduit fitting which had the fitting
cover plate removed at the time of the event. The specific conduit
3 fitting is located directly below the open grating floor on the Unit 1
side of the elevation 27'-0" column line 9 wall fire door No. 30. The
l runoff water which entered the subject conduit flowed through the j conduit and into Halon control panel 1-FPH-CP-1 located on the Unit 1 J side of the column line 9 wall on elevation 9'-6". This water intru- ! sion caused short-circuiting of the time limit!, battery charger and the t
*
.
4=
.
- - -
'
.
.
. 33
dual zone modules. With the shorting of the dual zone modules, which
are associated with the manual remote actuation circuit located in
the control room, the Halon system actuated discharging 7 percent to i
10 percent Halon concentration into the emergency switchgear rooms. !
'
Since H'alon extinguishing agent is heavier than air, thi, discharge
into the emergency switchgear rooms on elevation 9'-6" had essentially
no effect on the habitability of the main control room. Upon the
initial discharge of the emergency switchgear Halon fire suppression i
system some Halon leakage into the main control room through floor
penetrations in the Unit I computer room and through the control room
emergency air bottle discharge piping was noticed. However, it should
be noted that these concentrations of Halon which resulted from the
emergency switchgear room discharge would not have put the control room
personnel at risk.
Upon verification of the carbon dioxide system discharge by the main
control room personnel, two nembers of the licensee's loss prevention
staff entered the cable tray rooms with self contained breathing
apparatus to conduct a search for personnel. As a part of this search,
measures were tsken to vent the carbon dioxide from the cable tray ,
rooms by opening the doors to the Units 1 and 2 mechanical equipment '
rooms and the respective cable tray room access doors located on
elevation 45'-0" of the Units 1 and 2 turbine buildings. In addition,
while the carbon dioxide was being vented from the cable tray rooms,
the main control room annex door in the turbine building / control room
complex wall and the main control room door separating the annex from
the main control room were blocked open. Thus, carbon dioxide being
heavier than air, flowed down from elevation 45'-0" to elevation 27'-0"
and into the main control room annex and the main control room through ,
the open doors. In addition, during the time the carbon dioxide was
being vented from the cable tray rooms, the main control room exhaust
- fan (1-VS-F-15) was operating. The operation of this fan created e
i negative pressure in the main control room and the main control room
annex thus, causing the vented carbon dioxide to be drawn into the
control room complex. ,
i
1 ' Presence of carbon dioxide in the control room can also be attributed i
to the fact that at the time of the event control room ventilation L
~
unit 1-VS-AC4 was out of service for design modifications and that a l
temporary unit which obtained its makeup air from mechanical equipment
, room I was in service. Therefore, when carbon dioxide vented from the !
l respective cable tray room came into the mechanical equipment room', l this allowed the te.nporary control room HVAC fan unit to draw the gas r I
into the control room ventilation system.
Control room personnel in the main control room annex and near the
1 main control room door experienced shortness of breath, dizziness and
nausea. But it should be noted that once theyl recognized that carbon :
dioxide was present the control room operators took the appropriate '
corrective actions and initiated control , room emergency air supply
'
.-
,
I--~~.. _ _ - _ _ m , _.- - - ...__,,_..._,_-m.__.~... _ _ _ _ . _ . , _ , _ - _ ,
. m_-.
_. .__. __ _ . _ . _ . _. ..
'
.
.
.
34
fans 1-VSF-41 and 2-VSF-41. The starting of these fans placed the main
control room at a higher pressure than the turbine building. This
'
action assisted in diluting and exhausting the existing carbon dioxide
levels and kept any additional carbon dioxide from infiltrating into
themajncontrolroom. .
As a result of the spurious fire protection system actuations associ-
ated with the feedwater pipe break event, the licensee has proposed
the following carbon dioxide /Halon fire protection system modifica-
tions:
(1) Seal the open ends of all conduits leading to the carbon dioxide
system control panels throughout the plant.
(2) Replace all components within both the Unit 1 and Unit 2 cable
tray room carbon dioxide control panels that show visible signs
q of corrosion. . !
(3) Fully test both systems to confirm proper system operation.
1 l (4) Seal the Unit I control panel. A 1-1/2-inch hole and a 1 inch
hole exist in the right side wall near the bottom of the panel.
(5) Replace missing 2-inch conduit cover under the elevation 27'-0"
, '
turbine building column line 9 wall platform and walk down all
other conduits to ensure that covers to conduit, pull boxes, and
junction boxes are in place and properly sealed.
i
(6) Repair door seal on the Halon control panel and relocate
! identification sign, i !
(7) Replace all existing Halon panel modules which are no longer
i manufactured and upgrade these modules to current state-of-the-art
equipment
< j (8) Perform functional tests of the H.alon system for both units 1
and 2 emergency switchgear rooms to ensure proper operation.
(9) Replace Halon system check valves in discharge lines or replace
j rubber seals. l (10) Have all Halon cylinder heads replaced or reworked to ensure, , bottles will not leak and that seals are in good condition.
(11) Have Halon bottles filled and placed in discharge header.
(12) Have Halon pressure switch covers and solenoid covers removed and
I
inspect for corrosion or water damage. ,
.
.
4
..
l '. * I <
-- - - . - _. . _ . -_. - . . - . - - - _ . _ - - . - - _ _ _ . . .. - _ _ _ . _ _ _ _ -
.. . ,. - . _ - . - - - - -
-
'
.
,- 35
Based on our review of the above modifications, it appears that upon
their completion the probabilities of spurious cable tray room carbon
dioxide and emergency switchgear room fire suppression system actua-
tions due to water / steam intrusion will be greatly reduced. However,
it is our recommendation that the licensee, in addition to implementing
the abo,ve proposed modifications, consider the following with respect
to ensurthg control room habitability and personnel safety:
-
Install a wintergreen odorizer on the Units 1 and 2 cable tray
room carbon dioxide system,
-
Install a permanent oxygen analyzer with a control room audible
alarm in the main control room annex,
-
Develop a procedure which will require the control room operators-
' to pressurize the control room in the event of a gaseous fire
suppression system actuation in either the cable tray room or the
emerge.ncy switchgear rooms, and
-
Install predischarge visual and audible warning devices near the
Units 1 and 2 cable tray room doors and inside the cable tray
rooms which will activate to alert personnel prior to a carbon
dioxide system discharge.
,
c. Other System Interactions
. i There does not appear to have been other significant system interac-
tions which impeded the safe shutdown of the plant. All shutdown
systems responded as designed, and an orderly plant cooldown was
accomplished.
l l 14. Consideration of Shut Down of Unit 1
At 12:30 p.m. on December 10, licensee management decided to shut down Surry
Unit 1 and operation of the unit was placed on power ramp down at 5:30 p.m.
The unit was subsequently cooled down and pl, aced on residual heat removal
and is currently in a cold shutdown condition.
The decision to shut down the unit was based on preliminary findings
resulting from the Unit 2 main feed pump suction pipe rupture. These
findings indicated that there might have been significant thinning of the
l pipe wall due to a corrosion / erosion mechanism not fully understood at the
time. The shutdown plan included inspections of selected Unit 1 piping.to
ascertain its condition with regard to pipe wall thinning.
Subsequent ultrasonic examination of the identical elbow that failed in
Unit 2 revealed similar but not as severe pipe wall thinning.
!
*
.
O
O
e
- . _ .- . _ .- .- - . - . - -
.
.
.
-
36
The licensee gave priority to Unit 1 inspection and hardware replacement in
parallel with its investigation to determine the root cause of the Unit 2
pipe rupture. This was done in order to facilitate restart of Unit 1.
15. Investigatipns and Corrective Actions Taken
~
a. Initial Activity
The licensee agreed to a quarantine of all equipment and systems
, which could be significant to the ongoing investigation of the event.
Consequently, all activities undertaken with regard to restoration work
or investigations were done with the concurrence of the NRC team on
site. During the first week following the event, . concurrence was given
for some turbine generator work on the turbine deck which was not
relevant to the investigation and work involving cleanup and restora--
tion of the damaged area. The following equipment was inspected:
, (1) A main feed pump suction indication in the control room pegged at
1000 psi. The pressure transmitter associated with this indica-
tion was inspected to determine operability. Subsequently, it
was determined that the transmitter housing was 1/3 full of water
and it appeared that the electrical portion of the transmitter
was not operable due to shorting.
(2) A calibration and circuit check was performed on pressure cutoff
switch for the high pressure heater drain pump. This was done to -
determine if the section of line leading from the HP heater drain
pump discharge to the condensate header had been pressurized to
at least 600 psi. The switch was designed to cut off the pump if
'
a 600 psi pressure was exceeded. The switch was calibrated and
found to be operable indicating that a line pressure of greater
l than 600 psi was not present.
5
On December 16, 1986, this quarantine was lifted.
l b. Piping Systems ,
- Based on the failure of Surry Unit 2 main feedwater pump suction line
,
and the fact that the Surry Unit 1 suction line design was similar to
-
Surry Unit 2, the licensee decided to shut down Surry Unit I and
- inspect the main feedwater pump suction line. The Surry Unit 1
, suction line was found to have reduced wall thicknesses similar to i Surry Unit 2. When pipe wall thinning was found in Surry Unit 1,' l the licensee decided to inspect similar piping at North Anna Unit 1.
Approximately 4900 ultrasonic inspections were made on North Anna
- Unit 1 piping. No measurements indicated pipe wall thickness below
,
the required minimum. The feedwater pump suction piping and header
wall thicknesses were within original pipe manufacturing specifica-
l tions, and the high pressure drain pump dischdrge piping was no more
than 15 percent below the original specifications.
.'
l
#
.
f
, - - * - - - - - ,m-., . - - , - - - . , , . , - , - ~ , - - , - - - - - - - - - - - ,,,,,--,,,--,-+.-,.m. _ _ , , --
. - - - - - - , , - -, , ,, - - - - . , . - - - - - - - + - ---s------
.
.
.
-
37
As a result of finding thinned pipe at both units, the licensee
initiated a pipe wall thickness measuring inspection program to
define the extent of pipe wall thinning at Surry Units 1 and 2. The
following summarizes the criteria for the program, the acceptance
criteria, and the inspection results to date.
(1) Corrosion / Erosion Parameters
In the review to determine the parameters affecting corrosion /
erosion, the licensee found limited data available from industry
experience with bulk single phase corrosion / erosion. The
available literature correlates single phase corrosion / erosion to
two phase wet steam corrosion / erosion. The parameters that
appear to affect corrosion / erosion in single phase flow are:
.
-
Material -
Phenomenon occurs in carbon steels. The
resistance to corrosion / erosion
'
increases with alloying.
-
Fluid Velocities - High fluid velocities increase
corrosion / erosion.
-
Temperature -
Corrosion / erosion takes place batween
195 and 440*F.
-
High Water Purity- Corrosion / erosion.affected by oxygen
content.
These parameters and the corrosion / erosion process relate to the
rate of buildup and removal of the protective magnitite (Fe34 0)
layer.
Based on the above information, the licensee established the
following criteria to select systems to be inspected:
-
System handles water or steam
-
System piping is carbon steel
-
System temperature is greater than 195"F
-
System is deoxygenated (low ppb range)
As added verification of these criteria, the licensee also
included in the program specific locations within systems outside
the criteria, including safety-related systems, such as, the'
auxiliary feedwater system (oxygenated and less than 195*F),
charging system (stainless steel) and condensate system prior to
the point heater (less than 195*F).
(2) Rating Scheme
Within a system, a rating scheme, based oh temperature, velocity,
and geometry, was used to identify potentially high corrosion /
erosion wear regions. .. .
,
.-
9
.
.
*
. 38
After consideration of the above criteria and rating scheme, the
licensee decided to inspect components beyond those identified
as priority by the rating scheme. In addition to the components
picked for the auxiliary feedwater system, charging system, and
condensate system to the 4th point heater, the following compo-
nents were included in the wall thickness inspection program for
both Surry 1 and Surry 2:
-
Every fitting and selected locations on straight pipe from
the inlet of the 4th point heaters to the feedwater pumps
and from the feedwater pumps to the feedwater regulating
valves.
-
Selected locations along sweeps and straight lengths of pipes
from the feedwater regulating valves to the containment for'
loops A, B and C. There were no priority points in these
sections of pipe using the rating scheme.
-
High priority points on B feedwater loops from the contain-
ment to the steam generator. The points picked were
representative of similar configurations in loops A and C
and also included some unusual configurations.
(3) Acceptance Criteria
The licensee developed an acceptance criteria to provide guidance
in determining whether a fitting or section of pipe needed to be
replaced immediately, replaced at some future time in its operat-
ing life, or monitored by inspection during its operating life.
The acceptance criteria were based on the existing wall thickness,
as measured by the inspection program, the calculated corrosion
wear rate, and the Code minimum required wall thickness. The
wear rate was calculated by dividing the wear to date (assumed
to be the nominal specification thickness plus manufacturer's
tolerance minus the existing as measured thickness) by the number
of years of operating history. ,
The following acceptance categories were defined:
(a) Immediate Replacement -
Existing thickness below
minimum Code or below 0.100
inches. ,
(b) Engineering Evaluation -
Existing thickness greater
than Code minimum but
calculated (based on wear
rate) to still be acceptable
at the time to next outage
plus I/2 year.
.'
_ -. . . . . .-
. *
.
39 *
.
(c) Potential Next Outage -
Existing thickness greater than
Replacement acceptable thicknest at time to
next outage plus 1/2 year but
less than acceptable thickness
, , at time to next two outages
a
plus 1/2 year. Inspect at
_
next outage.
(d) Each Outage Inspection -
Existing thickness greater
than acceptable thickness at
time to next two outages plus
1/2 year but less than
acceptable to next three
outages plus one year.
,
(e) Place Component in -
Existing thickness greater
Station's Inspection than acceptable thickness at
Program time to next three outages
plus one year.
(4) Summary of Inspection Results and Replacement as of January 8,
1987
Unit 1 Unit 2
Components to be Inspected 588 588
Inspection Requests Issued - - - -
515- 208
Inspections Complete 427 150
Components Designated for Immediate 48 7
Replacement
Components Designated for Potential 8 4
Replacement at Next Refueling Outage
Components Designated for Inspection 40 8
at Next Refueling Outage
Components Removed 38 7
Components Installed 8 0
b. Main Steam Trip Valve
Because of deficiencies found in the Unit 2 C MSTV (see paragraph
11.a.(2), the licensee inspected the internals of the remaining Unit 2
MSTV and the three Unit 1 MSTVs. No assembly deficiencies were found.
In addition, each pair,of air actuating cylinders for each valve was
rebuilt.
.'
9
_ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ . _ . . _ _ _
. . __ _ __.
~
.
'
.
-
40
c. Main Feed Pump Discharge Check Valve
'
The remaining three main feed pump discharge check valves were
inspected. The results were as follows: ,
5
Unit 2 8 Check Valve -
Both c' lamp assemblies had loose bolts and the
lock wires for these bolts were missing. The
lock plates exhibited some erosion but the
- disc / seat assembly was not displaced.
t
Unit 1 B Check Valve -
Both clamp assemblies had loose bolts and the
lock wires for these bolts were missing. The
lock plates exhibited extensive erosion but
the disc / seat assembly was not displaced.
The left side hinge pin was missing.
Unit 1 A Check Valve - No defects found. This valve was overhauled
- -
in May 1986.
'
The check valves will be modified as follows:
(1) New hinge pins will be installed that are secured in place by a
lock pin which is welded in place. The lock pin will project
through a hole in the hinge pin. This modification will be
completed prior to startup of the units.
(2) The clamp assembly which holds the seat to the valve body will be
eliminated by welding the disc / seat assembly onto the valve body. "
This modification required a material change. Due to the unavail-
- ability of this material, the modification will be made at the
l next scheduled outage of sufficient duration when the material is
available or during the next refueling outage.
(3) The check valves will be periodically inspected in accordance
with an inspection plan to be developed by the licensee.
'
16. Safety Considerations for Station Restart
By letter dated January 14, 1987', the licensee submitted a report entitled
"Surry Unit 2 Reactor Trip and Feedwater Pipe Failure." This report
provides detailed information on the December 9, 1986 event and a recovery
plan and corrective actions for NRC review and concurrence prior to station
restart.
The AIT has reviewed this report and has conducted an independent inspection
effort which provides the bases for our concurrence with the licensee's
restart plan.
I
*
.
ee.
.. ~ . . - _ _ _ _ _ , , . _ .
_ _ _ _ _ _ _ _ _ .
.
> .
. ,
-
41 '
The Itcensee's report outlines a program which has been implemented for
initial inspection, hardware replacement and periodic inspection of the
main feed and condensate piping systems. This program provides for
development of a model which is believed to predict the erosion-corrosion
mechanism and the rate of pipe wall thinning in a conservative manner. The
licensee, ush g this model, developed an inspection / replacement program
for various fittings in the feed / condensate systems. This program defines
conservative acceptance criteria for the fitting replacement which predict
the time that would elapse before minimum allowable wall thickness would
occur (see Section 15.b). In addition, a periodic inspection program has
been established. The periodic inspections would provide information to
continually reaffirm or modify the model. Thus, the present inspection /
replacement program would permit a satisfactory knowledge of the present
state of the plant's condensate /feedwater systems. Future inspections
together with the current information would continually provide assurance
j that the loss of wall thickness is not occurring at the rate which could
result-in prem.ature failure. These actions provide additional confidence in
the startup and permits the carrying out of a conservative inspection
program which adequately defines weak points in the feed and condensate
systems.
l This replacement / inspection program is an interim measure to be utilized
as more information_is developed with regard to the mechanism of erosion /
'
corrosion. The licensee intends to develop a long range program of correc-
tive action that includes geometry as well as material changes to the feed
and condensate systems. *
Inspection performed on the other single phase systems in the plant showed. -
no indication of the type of failure experienced in the feed / condensate
system (i.e., wall thinning due to corrosion / erosions). In addition, the
licensee will continue the inspection program previously developed for two-
phase flow systems.
The AIT has also reviewed the licensee's corrective actions with regard to
the MSTV maintenance procedures and the proposed short-term and longer term
hardware improvements for the main feed pump discharge check valves, and
concludes that the licensee actions are satisfactory.
In addition, as a result of the AIT inspection and re. view of the licensee's
program, the following conclusions and findings were developed.
a. Sequence of Events
.
The inspectors performed an independent evaluation of the event
scenario, including the sequence of events and their cause of the
events. The inspectors' conclusions are that the reactor primary
system and all safety-related components reacted properly to a loss of
load transient initiated by the closure of one of the main steam trip
valves. The pipe rupture occurred before the bain feedwater discharge
l ;
>
_
9
- , - . - - ..-,c------- - ., - - - - . - - - - - ---,- ,- _ _ ---- .. -- - .
. - _.
.
.
*
.
-
42
check valve could malfunction. The only contribution to the event was
that the malfunction of the MFW pump discharge check valve caused
steam / water to be discharged from the break. We concur with the
- licensee's evaluation of the sequence of events.
'
b. WaterbammerOccurrence
Inspection of the Surry Unit 2 condensate and feedwater piping
conducted following the pipe rupture event did not indicate that
feedwater system water hammer occurred during the event. Reviews of
PWR operating experience regarding water hammer in feedwater systems
indicate that severe water hammer loads usually result in extreme
damage to pipe nanger supports and instrumentation and are usually
the result of feedwater control valve instability. The Surry Unit 2
feedwater piping from the containment penetration back through the A
main feedwater pump, haater drain pump and condensate pumps have been
inspected by the team, and there is no indication of this type of
damage anywhere but in the vicinity of the rupture. Inspection by
the licensee has also indicated no such damage. In addition to this,
measurements of pressure between the steam generator and feedwater
control valves indicate there was no leakage from the steam generator
back through the feedwater system.
c. Metallurgical
The pipe rupture occurred due to severe pipe wall thinning. The
general thinning condition appears to have been caused by a corrosion /
erosion mechanism with thinner localized areas related to high
turbulent flow. The fracture appeared to have originated at one of the
local severely thinned areas. The licensee's preliminary metallurgical
analysis indicated that the material met all specification require-
ments. Additional tests are in process by the licensee and the NRC to
fully define all material properties. The licensee has outlined an
inspection program for the feedwater and condensate piping systems,
based on conservatively predicting the corrosion / erosion mechanism and
the rate of wall thinning which should, ensure that the wall thickness
is monitored adequately to preclude premature failure. The licensee's
results and inspection program are outlined in their report, "Surry
Unit 2 reactor trip and feedwater pipe failure" submitted by letter
dated January 14, 1987. We concur that the report covers the metallur-
gical aspects of the problem adequately,
d. Chemistry
'
The methodology used to control secondary water chemistry to prevent
localized corrosion of stea:n generator components (as recommended by
the Steam Generator Owners Group) may result in " aggressive" water
chemistry conditions that favor general corros, ion of carbon steel.
I I ;
-
*
.
*
. _ . ,_.._,____._x _ .__.._____,__ ._. ,_,.. _ ,_________.___ ,.___ ,_. _.,___, . _____.__ __.__ - ._._____._ _.~_
._ _ .- . _ - _ _ . ._ .
.
.
.
*
43
.
The formation and retentien of an adhesive film of magnetite on the
inner surfaces of carbon steel pipe, in regions of single phase and
turbulent flow, may be affected by variables other than regeneration
by oxygen.
'
e. Emergen'cy Preparedness
The facility's emergency organization responded to the pipe rupture
event in a commendable manner. The plant staff worked together effi-
ciently to minimize personnel injuries and to mitigate the consequences
of the event. Offsite support requested for the injured personnel
responded to the call for assistance expeditiously to transport the
injured personnel to area medical facilities. Verbatim compliance
.
with the actions specified in the Emergency Plan appears to have been ;. exercised by the plant staff in responding to the event. <
- f. Public Information
<
Virginia Power implemented an aggressive and candid program to inform
'
news agencies - and, through them, the public - of the basic facts
concerning the accident and of continually updated findings as the
Company's own investigation went forward. Key ranking company execu-
tive spent an unusual amount of time in briefing reporters in several
; news conferences. Reporters were taken on several tours for a first-
! hand look at the accident area and at pieces of the broken pipe.
I ! g. Plant Systems
(1) The inspectors reviewed the' licensee's program for determining
the cause of the C MSTV closure and also the failure of the MFW
pump discharge check valve to fully close during the event. The
licensee's technical evaluation and the corrective actions taken
to restore the above components to normal operation were deter-
mined to be comprehensive and acceptable.
(2) An apparent violation of Maintenance Procedure MMP-C-MS-002 which
initially overhauled the C MSTV wits identified. This procedure
lacked detailed instructions, was not fully followed and did not
provide adequate documentation to show the repair of the MSTV
was accomplished in a quality manner. The licensee was informed
that similar problems may exist with other system maintenance
procedures and licensee review should be conducted. ,
(3) The inadequate maintenance performed on the C MSTV did not prevent
the valve from performing its safety function or cause it to be in
l
noncompliance with Technical Specifications.
(4) The reactor trip was a direct result of the improper overhaul of
the C MSTV in conjunction with the lower than normal instrument
, l
air pressure. However, the MFW line rupture was not caused by
the MSTV closure but occurred due to the normal pressure transient
which followed the reactor trip. ;
'
'
,_
,
, - , . - - - - - . - - , - - , - - - . - - - - - , - - . . - , - ~ , . - - - - - - - - - , - - - - . . - ~ - - - - - - - - ~ ~ - - - - -
-
- - - -
.
.
~
-
44
.
(5) The maintenance performed on the C MSTV indicated several cases
where anomalies were resolved without either proper documentation,
notification of supervision or engineering review. Examples are
the changing of the radius levers on the rock shafts and the
need to adjust the MSTV lijnit switch following maintenance. Had
these problems received the proper attention and evaluation, the
improper reassembly of the C MSTV could have been identified
'
.
before causing a reactor trip and a challenge to the reactor
safety systems.
(6) The post maintenance test used to check the operation of the
MSTVs following maintenance only verified their safety function
and compliance with Technical Specification. Additional testing
,
should have been required to verify full are travel of the valve
disc and therefore proper reassembly of the valve would have been
confirmed.
h. Security
The actions of security personnel during the event provided prompt
personnel access to sensitive operational areas including the control
room. As a result of evaluating the security aspects of the event,
the licensee is considering additional training and hardware changes
to further facilitate emergency access to restricted areas.
1. Fire Protection
4
As a result of the feedwater pipe rupture event in the Surry Unit 2
turbine building, Units 1 and 2 cable tray room carbon dioxide fire
suppression systems and emergency switchgear room Halon fire suppres-
sion systems spuriously actuated causing control room habitability
problems during the event. Based on our review, we conclude that the
l
licensee's staff has properly analyzed what caused the spurious fire
! '
protection system actuations and has initiated modifications to the
subject fire suppression systems which will greatly reduce the prob-
, abilities that these systems will spur,iously operate due to water / steam j intrusion. In addition, it should be noted that once carbon dioxide !
leakage into the control room was recognized, the licensee's control
room operations staff initiated prompt corrective actions to maintain
control room habitability. However, with respect to ensuring control
room habitability and personnel safety we recommend that the licensee
consider the following:
-
The installation of a wintergreen odorizer on the Units 1 and 2
cable tray room carbon dioxide system,
-
The installation of a permanent carbon dioxide analyzer with a
control room audible alarm in the main co,ntrol room annex,
.'
4
,- - _ _ _. .. _ -_ _ _ __ .._,.___m...,_,
l
.
.
* '
.
45
i
!
-
The development of a procedure which will require the control
room operators to pressurize the control room in the event of a
gaseous fire suppression system actuation in either the cable
tray room or the emergency switchgear rooms, and '
,
-
Th'e_ installation of predischarge visual and audible warning
devices near the Units 1 and 2 cable tray room doors and inside
the cable tray rooms which will activate to alert personnel prior
to a carbon dioxide system discharge.
a
.
O
, I .*
*
i ,
w
e
.
. -.- , - , - - - - -- .n , , y .,, - .,-. - . ,, .-- - , , ,- ,en,- n--- , _ ---, -w,-_.,-- - - - - . - - -- _ - - - , - - - - - . _ - _ . _ _ _ . - -
. _ _ _ -_. . . _ ._. _ . _ - _ _ -. .
.
.
~
.
t
APPENDIX
.
,
CHEMISTRY-CORROSION CONSIDERATION OF THE SURRY
UNIT 2 FEEDWATER P.IPE RUPTURE EVENT
1. Fundamentals of Generalized Corrosion
Although the eventual rupture of the 18-inch suction pipe may have been
initiated at a point on the upper-inside region of the first elbow down-
stream of the header, both visual evidence and ultrasonic measurements
,
showed that generalized wastage of the pipe, with resulting thinning from
the nominal 0.5-inch wall thickness, had been the obvious precursor to the
pipe failure. Because of the uniform nature of the thinning there was no
evidence of other types of mechanical or chemical attack.
Generalized thinning of iron surfaces is considered to be caused by erosion /
- '
corrosion processes, with either process being dominant. The potential for
mechanical and hydraulic erosion is greatest in regions of turbulence and
non-single phase flow and is enhanced by increased flow and temperature.
Consequently, erosion mechanisms can be expected in the regions of the
tee junction of the feedwater header and suction pipe, and, to a lesser
degree, in the elbow regions of the suction pipe. The role of corrosion,
specifically in the Surry feedwater system, is more speculative because of
the multiple chemical reactions that might have occurred during the thirteen -
years of normal and abnormal chemistry control. The licensee has tenta-
tively assumed that general corrosion occurred because the carbon steel
! pipes had been in contact with ' aggressive' (low dissolved oxygen) water. ' Removal of iron from a carbon steel pipe is thought to occur through
oxidation processes that establish a corrosion electropotential between
i
metallic iron (as an anode) and an oxidant in the water layer adjacent
- to the metal surface (cathode). Depending on the magnitude of the corrosion
i potential the oxidant in feedwater could have been hydrogen tons, cupric or
cuprous ions, or oxygen. All of these cathodic reactions are enhanced by
j the presence of chloride ions. l In stagnant water systems the ferrous ions (Fe++) generated at the metal / l
water interface are amenable to further oxidation by dissolved oxygen to
j produce insoluble iron oxides such as Fe 02 3 (hematite) and Fe 03 4 (magnetite) l as well as other, less stable, hydrous oxides of iron. The formation of
magnetite also can occur in the absence of. measurable amounts of dissolved
t
oxygen. One mechanism that has been prop ~osed is further electrochemical
reaction of hydrogen ions (H+) and the trace concentrations of soluble
ferrous hydroxide in the aqueous layer adjacent to the metal surface.
The formation of magnetite rather than hematite is favored by increased
[ temperature (especially between 300-350 degrees F) ,and again under stagnant
conditions. Under optimum conditions, a non-porous', adhesive film of
magnetite forms on iron or steel surface. The film eventually terminates
'
;
.
* eo
, , - - r
.
.
Appendix 2
further removal of iron by electrochemical attack by eliminating the anodic
reactor (Fe*+ Fe++). The oxide is in chemical equilibrium with the adjacent
water and will degrade if the equilibrium is impacted by chemical and/or
hydraulic factors.
2. Role of Pass'ivity and Corrosion in the Thinning of the Feedwater Pipes
a
a. Observations
As the result of his visual inspection the inspector could not
establish the extent to which the chemistry of the feedwater abetted
the thinning process or provided protection against the continuous
removal of iron from regions of turbulence and single phase flow.
The appearance of the pipe in Unit 1 was significantly different from
Unit 2; however the extent of thinning was similar in both units, but <
it was less severe in Unit 1. The presence of.a thin layer of red
hematite in.the region of the rupture in Unit 2 can be attributed
to removal of any previous magnetite film during the expulsion of
water / steam followed by inflow of moist air while the pipes were hot.
Upstream and downstream of the rupture the pipes appeared to have
retained a magnetite film.
The appearance of the pipe in Unit I was considered to be more repre-
sentative of the true condition of the inner surface of the feedwater
system during plant operation, although most the suction line had been
exposed to air for 24 to 48 hours before being insps:ted. However,
this unit was shut down normally and the pipes drained at ambient
temperature before the pipes were cut u Such conditions.are less
conducive to conversion of magnetite to hematite.
The most significant nbservation was that in Unit 1 the suction pipe
tee with the header and the first elbow had a black coloration although
, l extensive thinning had occurred. Conversely, downstream sections of
the suction lines that experienced much less thinning had a thin layer
of red, non passivating, hematite.
'
b. Effect of Chemical Variables
The role of chemistry control, especially before the original steam
generators were replaced, is also not clear. The very large amounts of
iron oxide sludge that has been periodically removed from all of the
! steam generators throughout the thirteen years of operation is proof
that wastage was occurring. However, this oxide sludge is thought'to
have originated predominantly in the high pressure pipes of the second-
ary water system which have been subjected to both dry and moisture
l
laden steam.
l
!
l
-
- - - - - _ - - - , , _ _ _ _ , _ _ , , _ _ _ , _ , _ _ _ _ _ _ _
.
.
*
Appendix 3
During the last four years the deposition of sludge in the steam
generators had decreased considerably, a phenomenon that has been
attributed to higher purity condensate and feedwater and to AVT
chemistry control following the criteria of the Steam Generators
Owners Group (SGOG). .
Before 1980 several relatively brief periods of inleakage of James
River water upset chemistry control and allowed ppe amounts of chloride
to enter the secondary water system. Consequently, stress corrosion of
carbon steel and inconel components of the steam generator occurred as
well as denting of the inconel steam generator tubes through formation
of magnetite in the tube / tube sheet regions. The effect of these
transients on the general wastage of carbon steel pipe is not obvious.
The licensee's tentative scenario stresses the capability of pure,
deaerated water to attack carbon steel:
'
!
Fe*+ Fe*+ + 2e-
2e- +2H+ + 20H" + H 2 + 20H'_
~ -
Fe* (solid) + 2H+ + 20H + Fe++ + 20H +H 2 (gas)
The trace amount of Fe (OH)2 is continuously removed from the region of
formation before it can be further converted (oxidized) to adhesive and
passivating magnetite.
(1) Effect of pH
l It is the purpose of pH control, however to minimize this 1 mechanism of attack by reducing the concentration of hydrogen
ions. During the first seven years of operation the licensee
controlled pH with several chemicals; i.e., sodium phosphate,
cyclohexamine, morpho 11ne, and ammonia, and the pH of the feed-
water and condensate varied from less than 8 (conducive to general
corrosion of iron) to greater tha,n 10 (not conducive to general
corrosion of iron - although conducive to loss of copper from
condense and feedwater tubes.) Since startup after the steam
generator replacement outages the pH has been maintained between
8.8 and 9.2, as recommended by the SGOG, as a compromise range to
minimize the corrosion of copper and iron in both the low and high
pressure lines in the secondary system.
(2) Effect of Dissolved Oxygen
The licensee, as well as various investigators of corrosion
mechanisms, considers very low concentrations of oxygen to be
, detrimental to control of generalized thinning of carbon steel. 1
In steady state conditions diffusion of dxygen to the metal -
water interface aids in the initial formation of magnetite and its
continued replacement. Under such conditions redLcing agents are
'
--
-- . - , . _ , - - - . . , , - - , - - - , , . - - - - - - - , - - - - - - - - - - - - - - - - - - - - - - - - - - - , - - - - - , - - - - - - - - - - - - - - - - - -
_ _ , - _ - .__ -
,
..
'
* Appendix 4
harmful since they tend to reverse the formation of ferrous ton
through the reactions written above. However, this argument must
be balanced against the cathodic attack of oxygen on iron (if the
iron surface is not isolated by impervious Fe 03 4 (magnetite).
8
In' a dynamic environment, such as in the feedwater pipe, all
.
equilibria are changed because of the high probability that the
products of electrochemical reactions will be removed immediately.
3. Conclusions
On the basis of current technology and the understanding of the mechanisms
of localized corrosion, the damage experienced by the or'31nal steam
generator tubes during the initial seven years of plant operation is
understandable. However, the inspector has not been able to correlate the -
cause of steam generator tube denting to the generalized thinning of the A
feedwater suct, ion pipe. Also, the inspector has not been convinced that the
feedwater system was ever coated completely with magnetite, or if it were,
that the magnetite protected the pipe from erosion / corrosion. It is evident
that thinning occurred in regions of hydraulic turbulence, and consequently
erosion appears to have been the dominant cause of thinning.
The degree to which generalized corrosion mechanisms abetted the transfer of
- metallic or ionic iron from the pipe surface has not been established.
.
.
I
. . _
1 ,
"
! g <
,n.- -- , , - - , , ,- ,,,r,_n.,,, ,,-n__-_ nn,- n.- -.,_,n ,n . , - - - , ,-n. , .n.,,--..n-.,-- --.,,.----n.- ,,,,.---,,.m--. , - _ , .
___.___ ____ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ ___ _ __ _ _ _ _ _ .. -- -
'
.,e eemf * ':
;; , ;; *
~
< -
.
, . . : ., ,
,
,
'
. . 1
'
\
.
g'__.
/
-
4
,
s ; :-
-
^
,
f .
~ <
,
e
Y , ~, '
,
_
,-, .
.
a+s
g .
'
1
7[ '
I -
-
'
% '
, [ _7
.
-
-
l
,
, .
3,. g ,
g '
. . l .
:
'
-: . ' ,
. > .<
\
.v
-
..., . .o ,
, . < .
,
.
,
'
* i / /
.. , .j .
p.-
.
.
,
-
,
.
3
'
w -
,.
'
: 'M /, ,' ,
, ,_
, ,
: .
,
4
'
' '
, . .
' ,
' i
,
*
l i "B" "A" Location 24" Condensate l MFW Pump MFW Pump of Rupture Supply Header
in "A" Suction
Pipe
.
Figure 1
__ __
. _ - _ _ _ _ _ _ ._ _ _ _ _ _ _ .
< l
- '
;
.. l-
.
77 7 -
-
- *
.
g
,
t
,.
- . . <,3 / .e- . .
.
<c (,
..
;
.
y.:
y
-
.1
','
'
l ~
._
T* i g --
'
-
&* -
f-
~
s .
.
l
:
_
:
.
4 _.
!
.
'
%
? r >
s -
\ ,.
-
. , , . . ~'$ ~ % >
~ l} i
! . ' , ,,
l ,
...
* ' * - -
f .,. l. ,
i
e J _ summme-
-
'
M 'W!9 M , _ . ,
',
<
. .
-
- .
_..
.
"B" "A'" Location 24" Condensate
MFW Pump MFW Pump of Rupture Supply Header
in "A" Suction
Pipe
i
Figure 1
_ _ _ . . _ - - - . . . . _ . -. . -__
. _ _ . . _
. _ _ _ _ - ._. .
- - - - - - A - ' -- . - - - . - - - - . . . - , -
- - - - . - - -
=
!
i
nypw
'
. , ?Ji-
, l' .t
4% 1 4
. s. *:m &'..
,
*-Y1 * .t
,
.,
y , .wK .. .-
. , ~g
jy
g' . 8 '/ 7 % s'
- %g[pq m) 'ktJi [4
- u ,1; :) y ' :"*-
Qf3;p* '%,1 ' Wy'- . 's
'
,-7 ' ' ' ' . -; _,w %j {+, ( .. -, 3[, i
,
<w-am
- c..
w:1" <. t 9*' G;wikhiar&,W, m "x'
'
'
? *;
(yOf+'f'( - :,
-
, , ,
i occ ,, .
s
s ~ .
f y ?
-
gpg+'
;ye ; < .
,<
. .;'
-
l
I , av 4. -
V -: y~^ 'an 1,
*
j,,'U ., ,~. , (;t
-
1 r . ,
'!
; ;n:$f.%; 'u ;.g gy ...
.
< n , ' t' : -a- / .
.
- ,
i .Yh
;;
_.
n, s
\ yh'%k'i%.h
'
v .-
-
+
;g n
, ., -
'\
'
.
'
. i n
gs #3 s
-
;
f4 3 2
,
,
.\,
.a .
7. a '
.
-Q,L f
,
'
ci e
\. *3f *
, s +m- ., y s ,
'.
'
.] N'
<;,..e- N - ,
fj
, ; . , . ,
V !! f ,
~
f._ \. -
,
4
,,_,,
< l
v -
.
-
:;,
y
m
<
. -
- *;
m
-
,
.
'E,'<
. - '_- '
,, , f
l
-
\ _ t.
&;* h f ff Q Q ',\
'
.if?b b ' '; ,
q E O.tk
~'
p,?e
, Aq,7
,m,. 4uc g^ 4 :,
.,
$.W;f h p];q j&
'
"hkh IM
-
m .
A- s\
.
Al
, wen,.c.e4In f
.
* '
'
2h
-
- - - . _ _ _ _ _ _ . _ _ _ .
O
r> -
,.
7 _ YNY;$%@ gv., y g ,; bj
y e
i%?Q *
J;Jgg ty;,.. + ;; 4 g.g 7. t y9
~. .. 4;l, ,. l *
'
~- O'"klR f '" , . .'
!id
~. N sy ,og ,
--
,.;f:;,
:~ . ,, ,
n e
,
t - . ;; 3 t, .
a ':.L . '
~.5' ; .jf f.I;q)?2'"
- .
b y-
.-
. . ,
j;;L ,
-
. =y
.y . 1'
s, g
-
.
,7
'hNfI;f.; .t ';; bl. }R
1
~
OA'F ' '{, J. .,[[? N
yp;,g.,
-
.
,
- ', ..
i ~
,
_
.
- ..
,,
-
e
[- ' -
~
,
-
7 a
!-
,x .
e. ,. j m
s, ~. }
#
# .
*'
ia%
f
( $ s
f'
h
'
D
.+; ,
i,
,,
?:
;. ,
%
I .
$
ay
'
,.'; , Fl$
cg w ~ [
'
.
.
.
_
,
ep .
7
v arg .: ~
- .
- _ _ _ _ . _ . . . _ _ _ . _ _ . _ _. __ __
e
, l
-e -
em w- . . . . .
l . ,
'
i 4. . ,
_
4 ' f
l s ..
,
1 '
. g -
~
. _ -t
- '
, .
.
....'
-
.
i *-
'..
~
Ruptured 'A" MFW Suction Pipe
l' '
g\ ,~
* ' fiesting Against "B" MFW Pump
% Discharge Pipe. (Post Rupture '
.
.
4 Configuration)
. -
*
. e ,
,
-
'
i..' 4., .. ._
.
& 'e -
.
#
h,[ ,, ' ,
'
~. ,
e' <:
'
: ' ,
, .
'
/
* %
,
-
.
=
. .
'
'
' : ~ - -
- .
4 .
.
. .
>
1 .
. * ' -
-
-
,
.
e .- ,
* -
,
l 8 e. e. /
I g Y f ,
> ,
l
.
) M
.- .
l
i
'
Figure 3
'
_. . ._ _ .--
a ...,m.,.-maa_ _-_a_.Au___.h._a__-2 . _____m- a .a--_.-.,44 4_am___2,_____s. ma _ _ . .__ . _ _ _ _ _ _ . 4 .___..am .mam._ __ _,, m2,.m _ ,.,
'
.l ,
*
*
,
, .. 9
-
,
. i
! ,
'
-
-
.
.
! *
, ,
.
,
,
:.
3- /
a .
%.- -
-
..
. .
r :
l
.
.
-
, .; -
.
,
,
e "a
^
-
c
\ .
..
.
,
W_ ?', ^
:: . -
i
-
}}