Information Notice No. 93-56: Weakness in Emergency Operating Procedures Found as result of Steam Generator Tube Rupture

                                 UNITED STATES
                         NUCLEAR REGULATORY COMMISSION
                     OFFICE OF NUCLEAR REACTOR REGULATION
                            WASHINGTON, D.C.  20555

                                 July 22, 1993


NRC INFORMATION NOTICE 93-56:  WEAKNESS IN EMERGENCY OPERATING PROCEDURES 
                               FOUND AS RESULT OF STEAM GENERATOR TUBE RUPTURE


Addressees

All holders of operating licenses or construction permits for pressurized
water reactors (PWRs).

Purpose

The U.S. Nuclear Regulatory Commission (NRC) is issuing this information
notice to alert addressees to a weakness in emergency operating procedures
(EOPs) found as a result of a steam generator tube rupture event.  It is
expected that recipients will review the information for applicability to
their facilities and consider actions, as appropriate, to avoid similar
problems.  However, suggestions contained in this information notice are not
NRC requirements; therefore, no specific action or written response is
required.

Description of Circumstances

On March 14, 1993, Palo Verde Unit 2, was at 98 percent power and near the end
of the operating cycle.  Unit 2 is a two loop PWR designed by Combustion
Engineering and has process radiation monitors located on the main steam
lines, the steam generator blowdown lines and the condenser vacuum exhaust. 
At approximately 4:34 a.m., a tube in the No. 2 steam generator ruptured and
began to release approximately 910 liters [240 gallons] per minute of primary
coolant to the secondary side of the steam generator.  About 10 minutes later,
the operators manually tripped the reactor because of decreasing pressurizer
level and pressure.  The safety injection actuation system and the containment
isolation actuation system automatically initiated.  The indicated level for
the pressurizer fell below zero percent but returned to approximately  
4 percent as coolant was added by the charging pumps and the high pressure
safety injection (HPSI) system.  The shutoff head for the HPSI pumps is below
normal operating pressure and indication of HPSI flow ceased when the reactor
coolant system (RCS) pressure increased to approximately 12.96 MPa [1880
psia].  All safety systems functioned as required and all plant equipment
needed to diagnose or mitigate the event was in service.  Plant personnel
later determined that the condenser exhaust radiation monitor was not within
calibration tolerances.

Before the reactor trip, several conditions caused the control room operators
to suspect that a tube rupture was in progress.  One of these conditions was 


9307160033.

                                                            IN 93-56 
                                                            July 22, 1993 
                                                            Page 2 of 5


an alarm for the radiation monitor on the main steam line for the No. 2 steam
generator.  The monitor was in alarm status from a time near the beginning of
the event until shortly after the reactor was tripped.  Apparently, the alarm
was caused by nitrogen-16 in the primary coolant which had entered the steam
generator.  The alarm cleared a short time after the reactor trip because of
the short half-life and decreased production of nitrogen-16.  

After the reactor trip, the operators used the EOP diagnostic logic tree to
diagnose and mitigate the event.  However, the operators twice failed to
diagnose a tube rupture because the radiation monitors that would have led to
that diagnosis were not in alarm status when the applicable step in the logic
tree was reached.  As a result, the logic tree directed the operators to use
the procedure for a reactor trip without complications to begin recovery
actions.  The operators could not enter that procedure because the pressurizer
level was below 10 percent.  Therefore, at 5:02 a.m., the control room
supervisor directed the operators to begin the functional recovery procedure.

The first EOP steps to mitigate the event were taken when the long-term
actions in the functional recovery procedure directed the operators to begin
plant cooldown and depressurization.  Reducing RCS pressure below the HPSI
shutoff head allowed pressurizer level to be restored.  With the pressurizer
level above 33 percent, all of the functional recovery procedure exit
conditions were met and the procedure was exited at 6:24 a.m.  The control
room supervisor then directed the operators to reperform the steps in the
diagnostic logic tree.  The logic tree now directed that the optimal recovery
procedure for a tube rupture should be used because the steam generator
blowdown and condenser exhaust process radiation monitors were in alarm
status.  Following this procedure, the operators isolated the steam generator
with the tube rupture at 7:28 a.m. (2 hours and 53 minutes after the rupture
had occurred).  The operators then took the plant to cold shutdown.

Discussion

Licensee review of the EOPs and the process radiation monitor setpoints found
that the logic tree would not identify a tube rupture unless activity in the
RCS was very high.  Three aspects of the EOPs contributed to this problem (1)
the logic tree used alarms from the process radiation monitors to identify a
tube rupture, (2) the logic tree decision points were made using a "snapshot"
of plant conditions that existed as each step was read (parameter trending and
past abnormal conditions were not considered), and (3) the steps that
evaluated radiation monitor status were not continuously applicable.  The
process radiation monitors used in the logic tree for identifying a tube
rupture were:

o    Steam Generator Blowdown Radiation Monitors  The alarm for these
     monitors was set based on the activity level in the steam generators and
     should have detected a tube rupture within several minutes.  However,
     these monitors had been isolated by the containment isolation signal
     when the applicable step in the logic tree was read.  Apparently, the
     blowdown monitor for the steam generator with the tube rupture did not
     alarm before the reactor trip because the tube rupture occurred at a high
.

                                                            IN 93-56 
                                                            July 22, 1993
                                                            Page 3 of 5


     location in the steam generator.  However, even if this monitor had
     alarmed before the reactor trip, the alarm may not have been considered
     because of the "snapshot" method used to perform the EOPs. 
     
o    Main Steam Line Radiation Monitors  The alarm point for these monitors
     was set at approximately three times background activity.  Although the
     monitor for steam generator No. 2 did alarm before the reactor trip, the
     alarm cleared shortly after the reactor was tripped and the monitor was
     not in alarm status when the applicable step was read.  The alarm that
     occurred before the reactor trip was not considered because of the
     "snapshot" method used to perform the EOPs.

o    Condenser Exhaust Radiation Monitor  The alarm point for this monitor was
     set at a projected site boundary dose rate of 5.0 milliSievert (mSv) 
     [500 millirem] per hour rather than on the activity levels in the primary
     and secondary coolant.  Because of this setting, the monitor would not
     have provided reliable and timely indication of a tube rupture.  This
     monitor did not alarm until about 1 hour after the rupture occurred. 
     Later, the licensee found that this monitor was not within calibration
     tolerances and was reading 1/4 to 1/6 of actual condenser exhaust
     activity.  The licensee calculated that if the monitor had been in
     calibration it would have alarmed about 20 minutes after the rupture
     occurred.  

An NRC Augmented Inspection Team (AIT) reviewed the event and determined that
the lack of a continuous action step in the EOPs to evaluate whether a process
radiation monitor had alarmed was a significant contributor to the delay in
isolating the faulted steam generator.  When the operators performed the step
in the functional recovery procedure that would have led them to diagnose a
tube rupture, the process radiation monitors were not in alarm.  This occurred
because (1) the radiation monitors on the steam generator blowdown lines were
isolated by the containment isolation signal, (2) the radiation monitor on the
steam line for steam generator No. 2 was no longer in alarm, and (3) the
radiation monitor on the condenser exhaust was not in alarm because, in part,
it was set to alarm based on a projected site boundary dose rate rather than
on the activity levels in the primary and secondary coolant.  Therefore, the
procedure did not direct the operators to follow the guidance in that
procedure to mitigate a tube rupture.  

Approximately 5 minutes after the operators performed the step in the
procedure that assessed the status of process radiation monitor alarms, two
independent monitors alarmed.  Those alarms would have led the operators to
implement the tube rupture recovery guidance in the procedure but the EOPs did
not allow the operators to repeat steps in the procedure after the steps had
been completed.  The training that the operators received for implementing the
EOPs promoted strict procedural compliance and reinforced their decision not
to repeat the step that evaluated for a tube rupture because it was not 
continuously applicable.  Also, the EOPs did not allow the operators to
rediagnose an event after the operators had entered a functional recovery
procedure until all of the exit conditions for that procedure were met.  
.

                                                            IN 93-56 
                                                            July 22, 1993
                                                            Page 4 of 5


The AIT reviewed the operator training for implementing the EOPs relative to a
tube rupture and, in general, found the training to be adequate.  However, the
AIT found that the simulator scenarios for a tube rupture have at least one
radiation monitor in alarm status as indication of a tube rupture.  The AIT
considered that the operators had learned to expect a radiation monitor to
alarm to indicate a tube rupture. 

In summary, the diagnostic logic tree was based on the incorrect assumption
that a tube rupture would always result in one or more process radiation
monitors alarming.  This assumption may be applicable as well to the detection
of small-break or inter-system loss-of-coolant accidents because the logic
tree uses process radiation monitor alarms as the basis to diagnose those
occurrences.  The licensee is evaluating whether this logic is used in the
diagnostic logic tree for diagnosing other events.

The AIT reviewed the licensee EOP development process and found another
contributor to the failure of the EOPs to identify a tube rupture in a timely
manner.  The owners group generic emergency procedure guidelines (EPGs) states
that "activity in the steam plant" should be used as a basis for diagnosing a
tube rupture.  The licensee implemented this guidance and based the EOPs for
diagnosing a tube rupture on process radiation monitor alarms in the steam
plant but did not fully evaluate the bases of the alarm setpoints.  The
licensee documented that this implementation did not deviate from the EPGs. 
When the reactor vendor reviewed the licensee EOP to EPG deviation
documentation, the vendor also did not identify this as a deviation. 
Regarding the use of radiation monitor alarms to diagnose a tube rupture, the
licensee has revised the "snapshot" methodology and is considering changes to
procedures and hardware to correct problems in implementing the EOPs.

NRC Information Notice (IN) 91-43, "Recent Incidents Involving Rapid Increases
in Primary-To-Secondary Leak Rate," and IN 88-99, "Detection and Monitoring of
Sudden and/or Rapidly Increasing Primary-To-Secondary Leakage," specifically
discussed the use of radiation monitors to detect abnormal plant events.  In
these information notices the NRC discussed several incidents, both foreign
and domestic, of rapid increases in primary-to-secondary leak rates.  The NRC
also discussed the fact that data from air ejection radiation monitors and
nitrogen-16 monitors can aid in the early detection and response for such
increases and help minimize the number of actual steam generator tube
ruptures..

                                                            IN 93-56 
                                                            July 22, 1993
                                                            Page 5 of 5


This information notice requires no specific action or written response.  If
you have any questions about the information in this notice, please contact
the technical contact listed below or the appropriate Office of Nuclear
Reactor Regulation (NRR) project manager.


                                       ORIGINAL SIGNED BY


                                    Brian K. Grimes, Director
                                    Division of Operating Reactor Support
                                    Office of Nuclear Reactor Regulation

Technical contact:  Dennis Kirsch, RV
                    (510) 975-0290

Attachment:  
List of Recently Issued NRC Information Notices.