NUREG/CR-5555

BNL-NUREG-52232

Aging Assessment of the

Westinghouse PWR Control Rod

Drive System

Prepared by

Prepared y

W. Gunther, K. Sullivan

Brookhaven National Laboratory

Prepared for

U.S. Nuclear Regulatory Commission
AVAILABIUTY NOTICE

Availability of Reference Materials Cited In NRC Publications

Most documents cited In NRC pubilcatlons wil be available from one of the foflowing sources:

1. The NRC-Pubilo Document Room, 2120 L Street, NW. Lower Level, Washington, DC 20555

2. The Superintendent of Documents, U.S. Government Printing Office. P.O. Box 37082, Washington.

DC 20013-7082

3. The NatIonal Technical nformation Service, Springfield, VA 22151

Although the sting that follows represents the majority of documents cited In NRC pubflcations. It I not

Intended to be exhaustive.

Referenced documents available for Inspection and copying for a fee from the NRC Pubic Document Room

Include NRC correspondence and internal NRC memoranda; NRC Office of Inspection and Enforcement

bulletins, circulars, Information notices, inspection and Investigation notices; Lcenses Event Reports; vendor reports and correspondence; Comrisslon papers; and applicant and licensee documents and correspondence.

The following documents In the NUREG series are available for purchase from the GPO Sales Program:

formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and NRC booldets and

brochures. Also available are Regulatory Guides, NRC regulations hI the Code of Federal Regulations. and

Nuclear Regulatory Commission Issuances.

Documents available from the National Technical nformation Service Include NUREG series reports and

technical reports prepared by other federal agencies and reports prepared by the Atondo Energy Commission. forerunner agency to the Nuclear Regulatory Comnmisslon.

Documents available from pubio and special technical ibrarles Include a open Iterature Items, such as

books, journal and periodical articles, and transactions. Federal Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries.

Docurnents such as theses, dissertations, foreign reports and translations, and non-NRC conference proceedIngs are avallable for purchase from the organization sponsoring the pubication cited.

Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the

Office of Information Resources Management, Dlstrbuton Section. U.S. Nuclear Regulatory Comrission,

Washington, DC 20555.

Copies of Industry codes and standards used In a substantive manner In the NRC regulatory process are

maintained at the NRC Ubrary, 7920 Norfolk Avenue, Bethesda. Maryland, and are available there for reference use by the pubic. Codes and standards are usually copyrighted and may be purchased from the

originating organization or, If they are American National Standards, from the American National Standards

InstItute, 1430 Broadway, New York, NY 10018.

DISCLAIMER NOTICE

This report was prepared as an account of work sponsored by an agency of te United States Govanment

Neitelthe United States Goverent norany agency thereo, orany iheir employees. makes anywaanty,

expresed or Irmplied, or assumes any legal liability of responsibility for any third party's use, or te results of

such use, d any Information, apparatus, product or process disclosed hI this report, or represents that Its use

by such third party would not kiffinge privately owned right
NUREGICR-5555

BNL-NUREG-52232

RV

Aging Assessment of the

Westinghouse PWR Control Rod

Drive System

Manuscript Completed: November 1990

Date Published: March 1991

Prepared by

W. Gunther, K. Sullivan

S. K Aggarwal, NRC Program Manager

Brookhaven National Laboratory

Upton, NY 11973

Prepared for

Division of Engineering

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington, DC 20555

NRC FIN A3270
ABSTRACF

A study of the effects of aging on the Westinghouse Control Rod Drive (CRD) System was

performed as part of the Nuclear Plant Aging Research (NPAR) Program. The objectives of the NPAR

Program are to provide a technical basis for identifying and evaluating the degradation caused by age in

nuclear power plant systems, structures, and components. The information from NPAR studies will be

used to assess the impact of aging on plant safety and to develop effective mitigating actions.

The operating experience data were evaluated to identify predominant failure modes, causes, and

effects. For this study, the CRD system boundary includes the power and logic cabinets associated with

the manual control of rod movement, and the control rod mechanism itself The aging-related

degradation of the interconnecting cables and connectors and the rod position indicating system also

were considered. The evaluation of the data, when coupled with an assessment of the materials of

construction and the operating environment, leads to the conclusion that the Westinghouse CRD system

is subject to degradation from aging which, if unchecked, could affect its intended safety function and

performance as a plant ages. The number of CRD system failures which have resulted in a reactor trip

(challenge to the safety system) warrants continued attention.

Ways to detect and mitigate the effects of aging are included in this report. The current

maintenance practices for the control rod drive system for fifteen Westinghouse plants were obtained

through an industry survey. The results of the survey indicate that some plants have modified the

system, replaced components, or expanded preventive maintenance. Several of these activities have

effectively addressed the aging issue. However, maintenance practices appear to vary from one plant to

another, possibly reflecting inadequacies at some plants.

ii
TABLE OF CONTENTS

page

ABSTRAC. .................................................. . iii

FIGURES v. tiii

TABILES .. x

SUMM UMR.................................................... i

ACKNOWLEDGEMENTS .................................. xv

1. IN T R ........................................... O D U CION 1-1

1.1 Background ............................................. 1-1

1.2 Objectives .............................................. 1-3

13 System Boundary ......................................... 1-5

1.4 Analysis Methodology and Format of the Report ........ ......... 1-7

2. CRD SYSTEM DESIGN REVIEW . . .2-1

2.1 Introduction .. 2-1

2.2 Rod Cluster Control Assemblies .. 2-3

23 Control Rod Drive Mechanism .. 2-5

23.1 Operation of the CRDM .2-9

2.3.2 Arrangement of the CRDM .2-9

2.4 Rod Control System .. 2-10

2.4.1 Description of Rod Control System Equipment .2-10

2.4.2 Rod Control System Alarms .2-14

2.5 Rod Position Indication Systems .. 2-14

2.5.1 Individual Rod Position Indication System .2-16

2.5.2 Bank Demand Position Indication System .2-20

3. OPERATIONAL AND ENVIRONMENTAL STRESSES ......... ..... 3-1

3.1 CRD System Operating Stresses .............. .. .............. 3-1

3.2 CRD System Environmental Stresses ............ .. ............ 3-3

3.3 Component Level Stresses and Degradation ..................... 3-4

3.3.1 Rod Cluster Control Assembly ......................... 3-5

33.2 Control Rod Drive Mechanisms ........................ 3-7

3.3.3 Power and Logic Cabinets ............................ 3-10

3.3.4 Rod Position Indication Systems ....................... 3-10

4. OPERATING EXPERIENCE FAILURE DATA ANALYSIS ....... .... 4-1

4.1 Dominant Failure Trends ................... ................ 4-2

4.1.1 Aging Fraction ................................... 4-2

4.1.2 Effects of Failure .4-4

4.1.3 Causes of Failure. 4-6

4.1.4 Modes of Failure. 4-6

4.2 Component Failure Analysis.. 4-8

4.2.1 Rod Cluster Control Assembly. 4-8

42.2 Control Rod Drive Mechanism .4-11

4.2.3 Power and Logic Cabinets ......... 4-12

v
Contents (Cont'd)

Page

4.2.4 Electrical Cables and Connectors ..................... 4-20

4.2.5 Rod Position Indication ............................ 4-21

4.3 Modes, Mechanisms, and Causes of Failure .......... .. ........ 4-22

5. FAILURE MODES AND EFFECTS ANALYSIS ........ .. ........ 5-1

5.1 Control Rod Drive Mechanism ............................. 5-2

5.2 CRD Power Cabinet ..................................... 5-2

5.3 CRD Logic Cabinet ..................................... 5-5

6. REVIEW AND EVALUATION OF INSPECTION, SURVEILLANCE,

MONITORING, AND MAINTENANCE ................. ........ 6-1

6.1 Evaluation of Current Maintenance Practices ......... .. ........ 6-1

6.2 Westinghouse Standard Technical Specifications ........ .. ....... 6-9

6.21 CRD Position Requirements ........... .. ........... 6-9

6.2.2 Control Rod Drop Time ...... ..................... 6-10

6.2.3 Design Requirements ....... .......... ............. 6-10

6.2.4 Operating Practices .......... -10

6.3 Inspection, Surveillance, Monitoring, and Maintenance

(LS,M & M) Techniques ................ . 6-11

6.3.1 CRDM Data Analyzing System ........... .. .......... 6-11

6.3.2 Statistical Techniques ................. ............. 6-11

6.3.3 Monitoring Control Rod Guide Tube

Support Pin Degradation ............................ 6-15

6.3.4 Life Cycle Testing-Monitoring Wear Rates ...... ........ 6-15

6.3.5 Profilometry and Eddy Current Testing ........ .. ....... 6-16

6.3.6 Electronic Characterization and Diagnostics System

(ECAD) ............. .......................... 6-20

7. DISCUSSION OF CRD SYSTEM RESEARCH AND NRC

EXPERIENCE...................... 7-1

7.1 NRC Research and Experience ............................. 7-1

7.2 Industry Research ...................................... 7-9

8. CONCLUSIONS AND RECOMMENDATIONS ................ ... 8-1

a1 Conclusions ....................... .................... 8-1

8.1.1 Susceptibility of System to Aging ..................... 8-1

8.1.2 Operating Experience .............................. 8-2

8.1.3 System Design Review ............................ 8-3

8.1A Maintenance Practices ............................. 8-4

8.2 Recommendations ..................... ................. 8-4

8.2.1 Design ...... 8-4

8.2.2 Maintenance and Monitoring ........................ 8-5

8.3 Future Work .......................................... 8-6

9. REFERENCES ........................................... 9-1

vi
Table of Contents (Cont'd)

Page

APPENDICES

A. WESTINGHOUSE CRD SYSTEM DESIGN REVIEW .... ............ A-l

A.1 Rod Cluster Control Assembly & Reactor Internal Components ..... A-1

A.2 CRDM Operation ....................................... A-2

A3 Rod Control System Operation ............................. A-11

A.3.1 Power Cabinets .................................... A-12

A.3.2 Logic Cabinet .................... ................. A-17

B. SUMMARY OF LICENSEE EVENT REPORTS FOR THE WESTINGHOUSE

CONTROL ROD DRIVE SYSTEM ............................ B-1

C. INDUSTRY SURVEY OF CURRENT MAINTENANCE PRACTICES . . C-1

NPAR Questionnaire-Magnetic Jack Control Drive Systems .... ....... C-1

Westinghouse Pressurized Water Reactors - Background .... .......... C-1

Questionnaire Organization .............. C-1

vil
LIST OF FIGURES

Figure No. Title Pae

1.1 Number of Westinghouse plants per age category .1-3

1.2 CRD system boundary .1-5

1.3 Rod position information system .1-6

2.1 Westinghouse PWR .2-2

2.2 CRd system block diagram .2-3

2.3 Rod cluster control assembly. 2-4

2.4 RCCA spider assembly .2-6

2.5 CRDM 2-7

2.6 CRDM bank and group arrangement .2-11

2.7 Rod control system - block diagram .2-11

2.8 Logic cabinet - block diagram .2-13

2.9 Analog IRPI system - block diagram .2-17

2.10 Digital rod position indication system - block dia. 2-18

4.1 CRD failure distribution. 4-3

4.2 CRD system aging fraction .4-4

4.3 Effects of failure on CRD .4-5

4A Effect of failure on plant operation .4-5

4.5 CRD system failure modes .4-8

4.6 Control rod guide tube support pins .4-10

4.7 Power and logic cabinet subcomponent failures .4-13

4.8 Power and logic cabinet .4-15

4.9 Rod position indication system failure causes .4-21

6.1 CRDM data analyzing system - conceptual .6-12

6.2 Dynamic response of CRDM .6-12

6.3 Example of data generated during CRDM motion .6-13

6.4 CRDM test setup .6-13

6.5 Plot of hazard values for CRD system subcomponent 6-14

6.6 Guide tube support pin and ultrasonic probe .6-16

6.7 Model L106A full length CRDM showing location

of high cobalt parts .......... ........................ 6-17

6.8 Details of high cobalt parts in latch assembly ..... ........... 6-18

6.9 Profilometry for steam generator tube ...... ............... 6-19

6.10 Fuel rod diameter profile ........ ...................... 6-20

7.1 Cutaway of typical fuel assembly with control rod .... ........ 7-3

7.2 CRDM showing location of high cobalt parts ..... .......... 7-12

73 Control rod wear ........... ......................... 7-14

A.1 Individual absorber rod ........ ....................... A-2

A.2 Fuel assembly guide thimbles ....... .................... A-3

A3 Fuel assembly .... A-4

A.4 Control rod guide tube assembly. A-5

vii
List of Figures (Cont'd)

Figure No. Title Pae

ADS Control rod guide tube .............. A-6

A.6 RCCA withdrawal sequence ............................ A-8

A.7 Sequencing of groups within banks ....... ................ A-13

AS Control bank overlap program .......................... A-13

A.9 CRD powerdistribution .......... ..................... A-15

A.10 Thyristor bridge control .......... ..................... A-15

All Logic cabinet block diagram ........ .................... A-17

ix
LIST OF TABLES

Table No. Title Page

1.1 Westinghouse PWRs in the NPAR study .1-2

1.2 Westinghouse CR1) system history .1-4

2.1 Power and logic cabinet urgent failures .2-15

3.1 Significant Westinghouse CRD system

degradation mechanisms ........ ................... 3-12

3.2 CRD system stress summary ....... ................. 3-14

4.1 Summary of human related LERs ...... .............. 4-7

4.2 Power and logic cabinet printed circuit

Card failure summary ......... .................... 4-16

4.3 Operating experience failure summary ..... ............ 4-23

5.1 Westinghouse control rod drive system

FMEA, mechanism .............. 5-3

5.2 Control rod drive system FMEA, power cabinet ..........

5.3 Control rod drive system FMEA, logic cabinet .... ....... 5-14

6.1 Survey respondents .......... .................... 6-2

6.2 Preventive maintenance practices for

mechanical components within containment .6-5

6.3 Preventive maintenance practices for

electrical components within containment .6-6

6.4 Preventive maintenance practices for

components outside of containment .6-7

6.5 Useful means for determining and maintaining CRD

system operational readiness ....... ................. 6-8

7.1 Control rod drive events from NUREG/CR-3950 .... ..... 7-5

7.2 Standard review plan summary for CRD ..... .......... 7-9

B.1 Cable/connector LERs ......... ................... B-2

B.2 Human error LERs .......... .................... B-3

B.3 Power and logic cabinet LERs ...... ................ B4

B.4 CRDM LERs ............. ..................... B-10

B.5 LERs with failure cause not delineated ..... ........... B-12

B.6 Rod position indication LERs ....... ................ B-13

x
SUMMARY

The Westinghouse Control Rod Drive (CRD) system consists of the control rods and the

mechanical and electrical components which control rod motion. General Design Criteria 26 of 10CFR

Part 50, Appendix A, defines the requirements for reactivity controls, stating that, among other things,

the CRD system shall be capable of reliably controlling reactivity changes so that specified fuel design

limits are not exceeded. This study examines the design, construction, maintenance, and operation of the

system to assess its potential for degradation as the plant ages. The extent to which aging could affect

the safety objectives of the system is discussed. NPAR studies are also being conducted for the

Combustion Engineering, Babcock and Wilcox, and General Electric Company designs of the CRD

system.

The review of the operating experience of this system as documented in the License Event

Reports (LERs), Nuclear Plant Reliability Data System (NPRDS), and Nuclear Power Experience (NPE)

data bases resulted in the following observations. (These sources provided an average of 30 unique

failure events per year over the last 10 years of which approximately 35% were directly attributable to

aging related degradation.)

* The majority of the reported failures occurred in the electrical area, namely the power

and logic cabinets, and the rod position indication subsystem.

* Approximately 40%o of the reported failures resulted in a rod drop. This event usually

challenges the reactor protection system which initiates a reactor trip.

* Several failure modes, such as rod position drift, and overheating of the power cabinet,

are common to many plants. This finding could indicate the need for generic resolutions

of these system problems.

The design of the system is described emphasizing components that have experienced age-related

degradation. In general, the design of the Westinghouse CRD system incorporates failure detection

capabilities which adequately address one of the safety concerns uncontrolled rod withdrawal. Those

components whose single failure could lead to this condition are monitored; an urgent' alarm is

activated and rod motion (except trip), is blocked. The design of the system also contains a 'non-urgent'

alarm, which identifies the failure of certain redundant components, such as power supplies.

Determining that other safety objectives are met requires monitoring, testing, and inspections.

The normal operating and environmental stresses experienced by the system components were

assessed to determine their effect on the long term performance of the system. For instance, the regular

stepping action associated with control rod motion results in wear of the latch and drive rod components,

and in electrical surges on the Control Rod Drive Mechanism (CRDM) coils. The amount of latch wear

was measured in another study, and it is described in this report, along with other research related to

aging of the CRD system.

Other examples of aging related degradation identified in this study and the stresses associated

with each are listed below:

xi
* Flow induced vibration Fretting wear of guide tube and rod cluster control

assembly (RCCA)

* Coolant particle debris Latch wear and drive rod binding

* High Temperature Loss of in-containment cable and coil insulation

integrity; degradation of electronics in power and logic

cabinets; and rod position indication drift

A Failure Modes and Effects Analysis (FMEA) of the Westinghouse control rod drive system

was also conducted, and components with a high safety significance identified. For this study, a high

safety significance means that the failure results in:

* a challenge to a safety system, i.e., a reactor trip,

* the inability of the CRD system to achieve its safety function, i.e., stuck rods, or

* a breach of the primary system pressure boundary.

The FMEA also illustrates the likelihood of the failure. This assessment is based on the

operating experience data and the evaluation of the component's susceptibility to age-related

degradation. Based on the FMEA, several components which should receive attention as a plant ages

are:

* cables, coils, and connectors (in-containment)

* latch assembly

* guide tube

* selected electronics within the power and logic cabinets

An evaluation of inspection, surveillance, monitoring, and maintenance was accomplished with

support from industry. Results from the survey were received from fifteen plants representing ten

utilities. Results from most plants agreed that two of the required technical specification tests (rod drop

time test and rod exercising) are beneficial in verifying the operational readiness of the system.

Preventive maintenance activities for electrical components within containment dominate the overall

maintenance resources applied to this system. Only a few plants are using circuit monitoring techniques

or non-destructive testing, such as eddy current or ultrasonic testing to monitor the long-term

operational characteristics of this important system. The fact that a substantial portion of the system is

considered not related to safety may be a factor in that choice.

Techniques to detect and mitigate the effects of aging are described. These methods include a

discussion of the required testing in the technical specification (tech spec), an on-line circuit signature

analysis system being marketed by the Japanese, and life cycle testing performed by Westinghouse and

France.

xii
Previous research and regulatory efforts related to the Westinghouse CRD system are discussed

in this report. Of particular interest, is NRC NUREG-0641 on the wear of control rod guide tubes,

study E613 from the Office for Analysis and Evaluation of Operational Data (AEOD) concerned with

localized wear of RCCAs, and EPRI-sponsored reports on plant life extension and control rod lifetime

determination. Research on the extension of plant life, for example, on a Westinghouse PWR, identifies

the latch, drive rod, and coil stack assemblies as limited-life components. Additional research in the area

of thermal embrittlement, and monitoring CRDM steps are two recommendations from this EPRI

research that have been evaluated.

The findings and recommendations of this aging study may be summarized as follows:

* Aging-related degradation of the Westinghouse CRD system can, and has to a certain

degree, compromised the intended function of the system. This degradation includes

deterioration which results in a stuck control rod or an inadvertent control rod drop.

Therefore, means to detect and mitigate this degradation in the safety and non-safety

portions of the system should be pursued.

* The test requirements on the system (rod drop timing test and rod exercising) are

important in determining the operational readiness of the system. While these tests

cause some incremental wear on the mechanical part of the system, the benefits

outweigh any test-related wear. Therefore, it is recommended that these tests remain in

the tech specs.

* The preventive maintenance, including inspection and testing, of the in-containment

cable, connectors, and coils should be increased as these components age. Consideration

should be given to the use of predictive maintenance concepts such as non-intrusive, online monitoring techniques. Resistance, dissipation factor, and capacitance are three

measurable parameters which can provide important historical data necessary for

maintenance and decisions on life assessment. The pulling of fuses to initiate the rod

drop timing test can create a loose connection between fuse and fuse clip or damage to

the fuse. Consideration should be given to modifying the method of performing this test

or accounting for the degradation which could result.

* The logic associated with the speed and motion control of the system is complex. Errors

in maintaining this portion of the system have resulted in reactor trips and additional

stress to the system. Repair and replacement procedures for this portion of the system

should be evaluated for completeness and accuracy. Training personnel to implement

these procedures should be emphasized.

nii
ACKNOWLEDGEMENT

The authors wish to acknowledge the direction of the NRC Program Manager, Mr. Satish K

AggarwaL We would also like to express our appreciation to Mr. James Thomas of Duke Power

Company, Dr. George Sliter of EPRI, Mr. Alex Marion of NUMARC, and Messrs. W. Grant and M.

Smith of MPR Associates, Inc. for their efforts in obtaining valuable responses from fifteen plants to an

in-depth questionnaire.

We would like to express our gratitude to various members of the Engineering Technology

Division of BNL, including Mr. Robert E. Hall, Dr. John Boccio, Mr. John Taylor, Mr. James Higgins,

Dr. Mano Subudhi Dr. Ralph Fullwood, and Mr. Edward Grove for providing technical assistance,

guidance, and a review of this report. Our colleagues at INEL, PNL, and ORNI, who provided

constructive comments on this report are also acknowledged, as are the Westinghouse Company staff

who provided valuable insights in their review of the draft report.

Fmally, we wish to thank Ms. Ann Fort for her help in the preparation of this manuscript; Ms.

Avril Woodhead for editing it, and the BNL Nuclear Safety Library staff for their assistance in obtaining

the support documentation that made this report possible.

XV
1. INTRODUCMION

The control rod drive (CRD) system plays a vital role in the safe and reliable operation of

nuclear power plants. This report describes the results of an assessment of the CRD system used in

Westinghouse pressurized water reactors (PWRs). Under the U.S. NRC's Nuclear Plant Aging Research

(NPAR) program, CRD systems of other nuclear steam supplier will also be evaluated.'

This section describes the overall objectives of the research and how it relates to other NRC and

industry activities. The system boundary established for this study is described, including justification for

including non-safety components. The organization of the report is illustrated to assist the reader in

finding the material which supports the recommendations and conclusions.

1.1 Background

The effects of aging on the safety of nuclear power plants has become an increasingly important

area of regulatory attention. As directed by the Executive Director for Operations (EDO), the NRC

Office of Regulatory Research (RES) developed and implemented the Nuclear Plant Aging Research

(NPAR) Program to assess the effects of aging on important plant components, structures, and systems.

Brookhaven National Laboratory (BNL) completed a phase 1 aging assessment of the

Westinghouse CRD system in accordance with the guidelines of the NPAR Program Plan and BNL's

Aging and Life Extension Assessment Program (ALEAP) Systems Level Plan. As described in these

documents, the phase 1 CRD system study includes:

* a detailed evaluation of operating experience data,

* an analysis of industry operating and maintenance information,

* an identification of failure modes, causes, and effects, and

* a review of design, operating environment, and performance requirements.

Forty-seven operating nuclear power plants employ a Westinghouse control rod drive system.

These plants are identified in Table 1.1, which categorizes the plants by age (years since initial criticality),

and type (number of loops). The design of the control rod drive system is independent of the number

of loops, varying only in size; that is, a four-loop plant may have 53 control rod drive mechanisms

(CRDMs), while a two-loop plant has only 29. The power and logic cabinets contain the same type of

circuitry, again varying only in the quantity needed to support the number of CRDMs.

Nine Westinghouse plants were not operating as of January 1989 and therefore, were not

included in this study. The operating years accumulated by the other Westinghouse plants are illustrated

in Figure 1.1. As of January 1989, these units accumulated approximately 470 years, with more than half

of the plants having more than 10 years of operational experience.

The Westinghouse CRD system has experienced several problems as documented in Table 1.2.

These documents address a variety of components in this system and provide evidence that supports the

need to examine these components. The history of regulatory activities associated with this system are

described in Section 7 of this report. Section 7 also discusses related research, such as work on plant life

1.1
extension and on core materials. No results exist which use actual operating experience, detailed design

information, and current maintenance practices to predict system degradation with time, thus making the

NPAR Program unique for this system.

Table 1.1 Westinghouse PWRs In the NPAR study

A. Less than 5 years of operation (14)

3 Loop Plants

Shearon Harris

Beaver Valley 2

4 Loop Plants

Byron 1 2

Braidwood 1&2

Catawba 1&2

Vogtle 1

Millstone 3

Diablo Canyon 1&2

Cailaway

Wolf Creek

B. 5 to 10 years of operation (8)

3 Loop Plants

Farley 2

Summer 1

North Anna 2

4 Loop Plants

McGuire 1&2

Salem 2

Sequoyah 1&2

C. 10 to 15 years of operation (10)

2 Loop Plants

Prairie Island 2

Kewaunee

3 LooR Plants

Farley 1

Beaver Valley 1

North Anna 1

4 Loop Plants

D.C. Cook 1&2

Indian Point 3

Trojan

Salem 1

D. 15 to 20 years of operation (12)

2 LooP Plants

Prairie Island 1

Ginna

Point Beach 1&2

3 LooR Plants

Robinson 2

Turkey Point 3&4

Surry 1&2

4 Loop Plants

Zion 1&2

Indian Point 2

1-2
E. Greater than 20 years of operation (3)

3 Loo Plants

San Onofre 1

4 Lon Plants

Yankee Rowe

Haddam Neck

NUMBER OF PLANTS

16-

14-

12-

10-

8-

6-

4 -

2-

0-

'5 6-10 10-15 16-20 '20

PLANT AGE IN YEARS

Figure 1.1 Number of Westinghouse plants per age category

(Data as of 1189, using Initial criticality date as time zero.)

12 Objectives

The objectives of this study are as follows:

1. Identify aging and service wear effects which, if unchecked, could cause degradation of the

system and thereby impair plant safety.

2. Identify methods of inspection, surveillance, and monitoring which will assure timely

detection of significant aging effects prior to the loss of safety function.

3. Evaluate the effectiveness of maintenance practices in mitigating the effects of aging and

in diminishing the extent of degradation caused by aging and service wear.

1-3
Table 1.2 Westinghouse CRD system history

NRC

Reference

CRD

Year Comvonent Age Related Concern

1980 NUREG-641 Control Rod

Guide Tube

Wear; structural integrity

1982

1985

IN 82-29

IN 85-14

IN 85-86

Guide Tube

Support Pins

Breech Guide

Screw

Power/Logic

Cabinets

Stress corrosion cracking

(Recurring problem in France through

1989)

Loose parts in latch assembly

cause stuck control rod

Electrical transient effects on solid

state components

1986 AEOD E613 RCCA Flow induced wear, IGSCC of rodlets,

wear due to rod motion

1987 IN 87-05 Rod Control

System

Interface with protection systems

IN 87-19 RCCA Flow induced vibration caused

perforation

1989 IN 89-31 Control Rods Swelling and cracking of Hafnium rods

To achieve these goals for the Westinghouse CRD system, several subtasks were accomplished.

* a review of the operating experience to identify the dominant failure modes, mechanisms, and

effects.

* a failure modes and effects analysis to identify the components which directly affect the

functional goals of the system, and

* a survey of Westinghouse utilities to ascertain current maintenance testing.

Two preliminary tasks were completed: 1) the system boundary was established and its safety

implications identified, and 2) a methodology was developed for performing the system analysis. These

are discussed in the following sections.

14
1.3 System Boundary

The Westinghouse CRD system consists of power cabinets, logic cabinets, coils, cable, drive

mechanism and control rods (Figure 1.2). For the study, the rod position information subsystem, shown

in Figure 1.3 is also included. The functions of these are described in detail in Section 2.

CONTROL ROD DRIVE SYSTEM

Westinghouse PWRs

ray ------- ~- - _-_-I_

I NPAR SYSTEM BOUNDARY'

I I

* Coils | : Reactor Trip

I ' I Breakers

Power I

Control Rod Rod Cabinets . I

Drive Mechanism I -\ I I-----------

FIgure 1.2 CRD system boundary

Also shown in Figure 12 is the close interface of the CRD system with the reactor protection

system (RPS). Power is supplied from motor generator sets and two reactor trip circuit breakers

arranged in series. The reactor protection system logic causes the reactor trip breakers to open, thereby

interrupting power to the CRDM coils, that releases the control rods to fall by gravity into the core,

which shuts down the reactor. Because other NPAR studies, such as NUREG/CR-4740 address the

reactor protection system and instrumentation and controls, the reactor trip breakers and the RPS sensors

and logic are not included in this evaluation.

1-5
- -

moo POSITON

VEECToq

CONTROL BUviSES

ACTUAL IOIATIN,

Figure 13 Rod position Information system

1-6
1.4 Analsis Methodoloev and Format of the Report

Once the system boundary was established, a detailed study of the system components was made.

The operating characteristics of the system, materials of construction, and design function must be

understood. Material from Final Safety Analysis Reports (SARs), technical reports, and system

descriptions provided background for this portion of the study. Section 2 and Appendix A contain

information on the design for all of the important CRD system components.

The impact that operating demands and the environment have on control rod drive system

performance is evaluated in Section 3. The influence of required testing is considered along with more

obvious factors, such as cyclic wear, high temperatures, and accident conditions. This segment of the

study establishes the dominant stresses responsible for aging-related degradation of the system.

A detailed analysis was performed using various data bases which provide the actual operating

experience of the CRD system:

* Nuclear Plant Reliability Data System (NPRDS)

* Licensee Event Reports (LERs)

* Nuclear Power Experience (NPE)

* Plant Specific Failure Data

* Survey of 15 Westinghouse plants

Section 4 contains the majority of the data analysis, providing comprehensive results on the

dominant failure modes, mechanisms, causes, and effects. The effects of degradation and failure of

components on the system and plant levels reported in these data bases are presented. Appendix B of

this report summarizes the LERs used.

The design review and operating experience assessment are combined into a failure modes and

effects analysis (FMEA). Reduced to the subcomponent level, the FMEA summarizes the component

failures which lead to system or plant level effects, and qualitatively ranks the potential of the event. This

approach is discussed in Section 5.

An important aspect of the phase 1 study is the development of inspection, surveillance,

monitoring, and maintenance (LS, M&M) techniques with potential to detect and mitigate the effects of

aging. Section 6 of this report presents the results of an industry survey, which emphasizes current utility

(ISM&M) practices for the Westinghouse control rod drive system. The questionnaire developed for

this survey is included as Appendix C This study also examines and analyses the effectiveness of the

existing regulatory requirements for testing and inspection, and presents several commercial techniques

applicable to monitoring of the CRD system. These techniques vary due to the different types of

materials and equipment in the CRD system.

The Westinghouse supplied control rod drive system has been the subject of study by industry and

the NRC. Section 7 discusses those studies which provided insights related to the goals of the NPAR

Program. From industry's point of view, the emphasis for research has been on reliability analysis and

plant life extension. The NRCs research and experience have been associated with the interaction of

the CRD mechanism with the nuclear fuel and the analysis of certain significant operating events. The

conclusions and recommendations of this report are in Section 8.

1-7
2. DESIGN REVIEW OF THE CRD SYSTEM

2.1 Introduction

Overall control of reactivity in a Pressurized Water Reactor (PWR) is accomplished by two

independent systems; the Control Rod Drive System (CRD) and the Chemical and Volume Control

System (CVCS). The CRD System positions clusters of neutron absorbing control rods within the core

in response to demand signals generated by the reactor operator and reactor control system. In addition

to executing a plant startup, this system controls relatively rapid changes in reactivity such as those

encountered during plant load variations, and provides a sufficient source of negative reactivity to assure

a rapid shutdown of the reactor (scram). The physical relationship between control rods and their

associated drive mechanisms to other internal components of a typical 4-loop Westinghouse reactor is

illustrated by Figure 2.1.

Although not included in the scope of this report, the CVCS controls the more slowly occurring

changes in reactivity, such as those due to fuel depletion buildup and decay of fission products, by

regulating the quantity of a soluble neutron absorber (boric acid) in the Reactor Coolant System (RCS).

This section also provides a basic, block diagram of the Westinghouse CRD system. More

detailed discussions of certain important equipment, such as a description of the design of the rectifier

circuits of the power cabinet are presented in Appendix A.

The block diagram of Figure 2.2 shows that the Westinghouse CRD system is composed of four

major systems:

* Rod luster Control Assemblies:

Each Rod Cluster Control Assembly (RCCA) consists of several individual absorber rods

connected at one end to a common hub and positioned within fuel assembly guide thimbles by

a dedicated drive mechanism.

a Control Rod Drive Mechanisms:

Electro-magnetic jack mechanisms control the movement of RCCAs in response to command

signals received from the rod control system. Only the 'full-length' mechanisms are described,

since the 'part-length' are not used.

* Rod Control System:

Electrical power and signal conditioning and control circuits within the Power and Logic

Cabinets regulate the operation of the CRDM in response to demand signals generated by the

reactor operator or reactor control system.

2-1
INSTRUMENTATION PORTS

THERMOCOUPLES

LIFTING LUG

DEEP SEA 

CONTROL ROD

DRIVE MECHANISM

CLOSURE EAD

Z/~- ASSEMBLY

TH~~ERHAL LEEVE

ASSEMBLY

i I 1 J I I1

W? OLO-DOWN SPRING

UTROL. ROD

v < ~~~~GIDE TUBE

0 r I~~~XLET OZZLE

CONTROL ROD

DRIVE SHAFT

ONTROL ROD

CLUSTERN ITHDRAWN)

FORMER

-- ~ ~ AFFLE

UPPER

SUPPORT

IRRADIATION

SPECIMEN GUIDES- '-

THERMAL SIELD -

REACTOR VESSELACCESS PORT

CORE SUPPORT

FORGING

RADIAL SUPPORT

SECONDARY SUPPOIT

ASSEMBLY

FUEL ASSEMBLIES

CLOWER ORE PLATE

SUPPORT COLUMN

INSTRUMENTATION

THIMBLE GUIDE5

Figure 2.1 Westinghouse PWR3

2-2
Figure 22 Block diagram of the CRD system

* Rod Position Indication Systems:

Actual rod position information is displayed on the Individual Rod Position Indication System

with an "inferred" indication of rod position provided by the Bank Demand Position Indication

(BDPI) System.

2.2 Rod Cluster Control Assemblies

Rod Cluster Control Assemblies (RCCA), are comprised of several absorber rods. As depicted

by Figure 23, the individual rods or rodlets', are fastened at the top end to a common hub or 'spider'

assembly. The overall RCCA length is such that when the assembly is fully withdrawn the tip of the

individual absorber rods remain engaged in their mating fuel assembly guide thimbles. Therefore,

alignment between the rods and guide thimbles is always maintained. The most widely used material for

control rod absorbers is an alloy of 80% silver, 15% indium, and 5% cadmium (Ag-In-Cd). The absorber

material is in the form of extruded rods that are sealed in Type 304 Stainless Steel tubes. The bottom

portion of each rod is 'bullet-nosed" to reduce hydraulic drag and to permit the rod to travel smoothly

into the dashpot section of the guide thimbles during a reactor trip.

2-3
by DE CONTROL ROD

ASSEMBLY

ROD

ABSORBER

` STOP / 

NOZZLE

, FUEL ROD

GRID

ASSEMBLY

GUIDE

i Y\'WE"", sOf GRID

ASSEMBLY

DASH POT

REGION

-- BOTTOM

NOZZLE

Figure 2.3 Rod cluster control assembly

24
The spider assembly, illustrated in Figure 2.4, is a central hub with radial vanes containing

cylindrical fingers from which the individual absorber rods are suspended. The radial vanes and

cylindrical fingers are joined to the hub by brazing. Handling grooves and internal grooves for coupling

to the drive rod assembly are machined into the upper end of the hub. A coil spring inside the spider

assembly absorbs the impact energy of the rod as it drops. The individual absorber rods are threaded

into the spider fingers and pinned; these pins are then welded in place. In newer plants, a mechanical

lock may exist instead of a weld allowing easier replacement of individual rodlets.

Control Rod Guide Tube (CRGT) assemblies shield and guide the RCCA above the core. They

are fastened to the upper support and are guided by pins in the upper core plate for proper orientation

and support. In the lower portion of the CRGT, sheaths and split tubes provide continuous lateral

support for the control rods between approximately 22 and 40 inches above the upper core plate'.

Above this region of the CRGT, guide plates provide intermittent lateral support for the control rods.

Additional guidance for the drive rods of the control rod drive mechanisms is provided by the upper

extension of the guide tube which is attached to the upper support. The variations in the designs of the

CRGT were found to be dependent on the upper internals design.

23 Control Rod Drive Mechanism

The Control Rod Drive Mechanisms (CRDM) are located on the dome of the reactor vessel and

are mechanically coupled to their associated RCCAs located directly below. The primary purpose of the

CRDM is to physically position the rod cluster control assemblies within the core in response to electrical current command pulses generated by the rod control system.

The CRDM is a magnetically operated jack, which contains an arrangement of three

electromagnets that are energized in a controlled sequence to lift, hold, or insert an associated RCCA

within the reactor core. Figure 25 shows a complete CRDM, which consists of the following four major

subassemblies: (1) Pressure Housing, (2) Latch Assembly, (3) Drive Rod Assembly, and (4) Operating

Coil Stack Assembly. Each CRDM is independent and can be separately dismantled or assembled.

CRDM Pressure Housing

The pressure housing forms part of the pressure boundary of the reactor coolant system

and mechanically supports the latch assembly, operating coil stack assembly and the rod

position detector assembly. Al moving parts of the CRDM located within the pressure

housing are completely immersed in the reactor coolant and rely on it for lubrication.

The pressure vessel assembly is fabricated from non-magnetic Type 304SS and

completely encloses the drive rod and latch assemblies of the CRDM.

2-5
COUPLING

SPIDER BODY

TOP VIEW

Flgure 2.4 RCCA spider assembly

2-6
CABLE CONNECTION

ROD TRAVEL

HOUSING

PRESSURE HOUSING,

OPERATING COIL 

STACK ASSEMBLY

DRIVE ROD ASSEMBLY -

DISCONNECT ROD

INTERNAL LATCH

ASSEMBLY

PRESSURE HOUSING

igure 2 CRDM

2-7
The pressure housing consists of two subassemblies; a latch housing and a rod travel housing

which are connected by a threaded, seal-welded maintenance joint. The latch housing is the lower

portion of the pressure housing and contains the latch assembly. The latch housing is threaded and seal

welded to penetrations located on the top of the reactor pressure vessel. The rod travel housing is the

upper portion of the pressure vessel and provides space for the control rod drive shaft during its upward

movement as the RCCA is withdrawn from the core.

Coil Stack Assembly

The coil stack assembly includes a coil housing that is zinc-plated, ductile cast iron,

electrical conduit and connector, and three electromagnetic operating coils: the

stationary gripper coil, the movable gripper coil, and the lift coil. The coil stack

assembly is a separate unit which is installed on the CRDM by sliding it over the outside

of the latch housing. The assembly rests on the base of the latch housing without

mechanical attachment and can be removed when the reactor is pressurized.

Two lead wires per coil are carried through a conduit to the top of the pressure

housing,where they terminate in a single six-pin electrical connector. For proper

operation, the magnetic polarity of each coil must be the same. Energizing the operating

coils creates a magnetic flux field. This flux passes through the non-magneticstainless

steel latch housing and couples with the magnetic steel poles of the latch assembly.

Sufficient force to move the latch vertically is obtained in a manner similar to a solenoid

coil and plunger.

Latch Assembly

The latch assembly is located in the lower portion of the pressure housing, and it

contains fixed and movable magnetic pole pieces which actuate two sets of gripper

latches: the stationary and movable grippers. Each set of gripper latches contains three

latches positioned 120° apart. The gripper latches are linked to the pole pieces so that

movement of the pole pieces causes the grippers and latches to cam in or out, engaging

the drive rod, which passes through the latch assembly.

* Drive Rod Assembly

The drive rod assembly connects the RCCA with the latch assembly and is mechanically

coupled to the RCCA spider during reactor operation. The drive rod has a series of

zero pitch, circumferential grooves spaced at 5-inch intervals, which permit the

attached RCCA to be positioned at any location within the core at 5/8-inch intervals or

'steps". The total travel of the control rod is 142.5 inches or 228 steps. Several older

plants have steps at 3/8-inch intervals.

A coupling, located at the lower end of the drive rod, attaches to a mating coupling of

the RCCA spider. A disconnect rod, locking button, and disconnect button couple and

uncouple the drive rod to the RCCA during installation and refueling.

2-8
CRDM Cooling System

The CRDM cooling system supplements the normal containment cooling system. It

consists of fans and associated ductwork so that ambient air in the containment is drawn

through the CRDM shroud and ejected back into containment. While not considered

part of the CRD system's boundary, the cooling system is briefly described here because

of its effects on the aging of the CRDM.

Typically, four fans provide an air flow of 40,000 to 70,000 CFM; two or three fans are

sufficient to provide the required air flow with the remaining serving as redundant units.

Some plants cool the air with cooling coils after it is drawn through the shroud, while

others discharge the air directly into the containment.

Though this system is non-safety related, each fan is normally supplied from a safetyrelated power source. The fans are controlled and monitored from the control room.

At most plants, the temperature of the discharge air is monitored at both the shroud and

fans, and an alarm occurs upon detection of a high temperature. Vibration, smoke, and

the operational status of each fan also are monitored.

2.3.1 Operation of the CRDM

The stationary, movable, and lift coils of the operating coil stack assembly are energized and deenergized in a controlled sequence by solid state switching devices located in the rod control system

power cabinet. The sequential operation of the three electromagnetic coils induces a magnetic flux field

through the wall of the pressure housing which then causes the stationary and movable internal latching

mechanisms and a ifting pole to operate. Each sequential operation of the CRDM produces an

incremental step motion of 51o (insertion or withdrawal) of rod travel. A detailed description of a

CRDM's stepping sequence is in Appendix A.

During normal, steady-state plant operation, a CRDM holds its attached RCCA withdrawn from

the core. In this mode only one coil, the stationary gripper coil, is energized. The drive rod assembly

and attached RCCA are supported by the three stationary gripper latches. Electro-magnetic forces are

required to hold an RCCA in this position, while rod insertion is accomplished by the force of gravity

acting on the weight of the assembly. Therefore, the CRDM will hold the RCCA in this position until

either a stepping sequence is initiated by the rod control system, or an interruption in the electrical

supply power causes the RCCA to fall, by gravity, into the core. The total insertion time of an RCCA

from a fully withdrawn position is approximately 2.2 seconds. The exact time depends on the type of

fuel and RCCA absorber.

2.32 Arrangement of the CRDM

A typical, 4-loop Westinghouse PWR employs 53 full-length RCCAs with the movement of each

controlled by a dedicated CRDM. The 53 CRDMs are divided into two main divisions or 'banks", with

each bank further divided into one or two 'groups, each containing several RCCAs. Figure 2.6 shows

the arrangement of the CRDM banks and groups of a typical 4-Loop Westinghouse plant. In this

example, the CRDMs are divided into eight symmetrical banks consisting of four shutdown banks (designated Shutdown Bank A, B, C, and D) and four control banks (designated Control Bank A, B, C, and

D). Each shutdown or control bank is further divided into one or two groups, Group I or Group 2.

Each group may have two or more CRDMs that are electrically paralleled to step simultaneously.

2-9
During plant startup the shutdown banks are first moved manually to the fully withdrawn

position. In this mode, they provide a readily available source of negative reactivity if an immediate plant

shutdown (reactor trip) is required.

The control banks provide reactivity compensation during plant startups and power changes and

are the only rods that can be moved automatically. The operator can select any single bank of shutdown

or control rods for manual operation. A bank is selected by a single switch, therefore, the operator can

not select more than one bank (shutdown or control) for manual operation.

2.4 Rod Control System

To obtain the desired position of RCCAs' within the core, demand signals generated by the

reactor operator or the reactor control system, are fed to the rod control system which then supplies

electrical power command pulses of the proper magnitude and sequence to the CRDM operating coils.

During steady state, full power operation the control rods are normally held fully withdrawn from the

core, and the primary purpose of the rod control system is to regulate core reactivity which is required

to maintain a programmed value of average temperature in the reactor coolant system.

Two types of design for the rod control system are currently used at Westinghouse PWRs. A

few older facilities, typically those plants constructed before R.E. Ginna, are configured with an electromechanical rod control system. In this design the required sequencing signals for CRDM operating coil

power signals are derived by an electrically driven motor and cam operated switch assembly.

The larger core size, which evolved in more recent Westinghouse PWR designs demands that the

CRDMs can move heavier RCCAs faster. The newer mechanisms, however, also imposed a

corresponding increase in the operating requirements of the rod control system. The additional design

requirements exceeded the capability of the electromechanical rod control system and, therefore, a new

design evolved,employing solid state electronic switching devices.

The solid state rod control system is used in the majority of currently operating Westinghouse

PWRs, and therefore, it is the focus of discussion. Additionally, it should be noted that the operational

characteristics and component descriptions presented in this report are primarily based on the design of

a 4-loop Westinghouse plant. The basic design concepts, however, are essentially identical in all current

generation Westinghouse 2,3, and 4-loop PWRs, varying only in the number and arrangement of certain

components.

2.4.1 Description of Rod Control System Equipment

Figure 2.7 is a block diagram of the solid-state rod control system for a 4-loop Westinghouse

PWR. It shows that the Rod Control System consists of circuitry associated with the ower to the

CRDM coils and the kic for controlling rod motion. This section provides an overview of the

operating characteristics of the major equipment and discusses its relationship to the operation of the

rod control system.

2-10
CRDM BANK GROUP CRDMs/GROUP

SHUTDOWN A GROUP 1 4 __1C ___ROUP 2 4

SHUTDOWN B-,rGROUP1 4

L- -ROUP 2 4

SHUTDOWN C- GROUP 1 4

SHUTDOWN D- GROUP 1 4

CONTROL A ---- f-GROUP1 4

GROUP 2 4

CONTROL B GROUP 1 2

E GROUP 2 2

CONTROL C GROUP 1 4 - G ROUP2 4

CONTROL D --- GROUP 1 4

L.GROUP 2 6

Figure 2.6 Arrangement of CRDM banks and groups

t j LOGIC CABINET 

POWER

CABINETS SCD 1AC [BD 2AC 2BD

GROUP 1 1 1 2 1 2

A B C D A B C D

SHUTDOWN CONTROL

BANKS I BANKS

Figure 2.7 Block diagram of the solid-state rod control system

211
* Electrical Power Distribution

Three-phase, 260V electrical power is supplied to the rod control system by two

synchronous type Motor-Generator (M-G) sets rated at about 500 KVA. Either M-G set

is capable of fulfilling all power requirements; however, the two are normally operated

in parallel.

Power from the M-G sets is distributed to the power cabinets through two series

connected reactor trip breakers. To facilitate on-line testing of the reactor protection

system, by-pass breakers may be installed in parallel with the reactor trip breakers.

Power to each of the five power cabinets is supplied from the reactor trip breakers

through fused disconnect switches.

Power Cabinets

The power cabinets contain solid-state electronic equipment, which converts the 260V,

three-phase a-c supply power to a d-c current suitable for CRDM coil operation. (This

conversion process, called controlled rectification, is described in Appendix A).

As shown in Figure 2.7, a typical 4-loop facility employs five separate, steel enclosed

power cabinets that are designated SCD, AC, 1BD, 2AC, and 2BD. The electronic

circuitry in each cabinet is functionally identical. In addition, each cabinet can supply up

to three groups of rods with each group consisting of up to four RCCAs.

With the exception of Power Cabinet SCD, the letters in the power cabinet designation

refer to the particular banks which the cabinet is driving. The number defines the group

associated with each control bank. For example, Power Cabinet 1-A-C drives the Group

1 rods of Shutdown Bank A, Control Bank A, and Control Bank C. The SCD

designation means that Shutdown Banks C and D are associated with that cabinet.

* DC Hold Cabinet

A failure in the power cabinet may require replacing a printed circuit card, thyristor,

fuse, or other component. To avoid dropping rods during such maintenance, and to

preclude the need of an external power source, each power cabinet is equipped with

three OFF-LATCH-HOLD switches, which connect an alternate supply of dc voltage

that is produced in the DC Hold Cabinet, to any one of the three groups of stationary

gripper coils. The DC Hold Cabinet contains three dual voltage 125/70V d-c power

supplies.

Power to the DC Hold Cabinet is taken downstream of the reactor trip breakers so that

rods being held by the cabinet during maintenance will still drop on a reactor trip. Each

d-c supply consists of a three-phase transformer and a full-wave, three-phase rectifier

bank. Indicating lights are provided on the cabinet for monitoring the input and output

voltages.

2-12
Logic Cabinet

The logic cabinet contains all the circuitry for low level electronic signals which are

necessary to develop the switching signals required for proper operation of the power

cabinets. The switching signals developed by the logic cabinet are generated in response

to command signals received from the reactor operator or the reactor control system.

As depicted by Figure 2.8, the logic cabinet is comprised of the following major

subassemblies: (1) pulser, (2) a master cycler, (3) a bank overlap unit, (4) slave cyclers,

and () the shutdown bank C and D control. A detailed discussion of each subassembly

is Appendix A.

The design of the logic cabinet uses solid state integrated circuits, mounted on plug-in

printed circuit cards. Relays required to drive equipment that is external to the system,

such as the plant computer, annunciators, and bank demand position indication

equipment, are also located in the logic cabinet.

I

Figure 2.8 Block diagam of the logic cabinet

2-13
2.4.2 Rod Control System Alarms

The rod control system has an internal failure monitoring system. Depending on the severity and

location of the failure, the monitoring system will initiate either an urgent or a non-urgent alarm.

Failures that generate an urgent alarm affect the system's ability to control rod movement. Non-urgent

failures involve failures of redundant power supply modules which do not immediately affect operation,

but compromise the system's ability to respond to further malfunctions or losses. Table 2.1 lists failures

in the power and logic cabinet which generate an urgent failure alarm, and shows their possible causes.

Upon detecting an urgent failure within the power cabinet, the failure detection logic overrides

all current orders from the logic cabinet and, to prevent dropping rods, orders low current on all

movable and stationary grippers assigned to the faulty cabinet. In addition, all rod motion from the

affected power cabinet is automatically stopped, the annunciator, 'ROD CONTROL SYSTEM

URGENT FAILURE", alarms on the main control board, and a local, red indicator light is illuminated

on the front of the affected cabinet.

Non-urgent failures in a power cabinet may occur upon the loss of any one of four d-c power

supply modules (main and auxiliary +24 and -24V d-c). If only one of each redundant pair fails, the

other will continue to supply the cabinet's d-c circuits through a blocking diode arrangement. Upon

detection, however, the failure will energize the annunciator of the control board "ROD CONTROL

SYSTEM NON-URGENT FAILURE", and will also illuminate a local failure alarm. Non-urgent

alarms reset automatically as soon as the malfunction is corrected

The logic cabinet also has an internal failure monitoring system. As described for the power

cabinet, the monitoring system will generate either an urgent or non-urgent alarm, depending on the

severity and location of the failure.

2.5 Rod Position Indication Systems

Westinghouse PWRs have two independent systems to monitor the position of control rods

within the core: an Individual Rod Position Indication System (IRPI), and a Bank Demand Position

Indication System (BDPI). The information provided by the IRPI system is derived from detectors that

are physically mounted on each CRDM and, therefore, represents the actual position of each RCCA

within the core. The rod position indication from the BDPI system, however, is determined by a count

of the number of steps of rod motion that has been demanded by the Rod Control System. As a slave

cycler in the logic cabinet completes a step, a signal is sent to cause movement of a mechanical

add/subtract counter on the control board for that group of rods. The rod position information displayed

on the BDPI, therefore, is highly accurate but represents the position that a group of rods should assume

rather than their actual position. The information provided by both the IRPI and the BDPI systems is

displayed on the main control board and is monitored by the plant computer as part of the program for

monitoring rod deviation.

2-14
Table 2.1 Power and logic cabinet urgent allures7

A. Power Cabinet Failures Cause

1. Regulation Failure

2. Phase Failure

3. Logic Error

4. Multiplex Error

5. Loose or Missing

Printed Circuit Card

Detects that the coil current does not match the current order within

a preset time, OR a full current command signal is on too long. The

detection of this type of failure protects against dropped rods (in the

event the system becomes incapable of regulating the required coil

current),and also protects against overheating the coil if a slave cycler

fails and calls for continuous current.

Senses the level of a-c ripple on the voltage to the coils. An excessive

level of a-c ripple on the d-c output voltage would indicate a failure

had caused one of the three phases of a-c supply voltage to be

processed differently. Possible causes of a phase failure include a

failed thyristor, blown fuse, or a loss of thyristor gate control.

Detects the simultaneous loss of current command signals to the

stationary and movable gripper coil circuits. This detection protects

against dropping rods, howeverthe detection must occur and the

automatic corrective action must be completed before the bridge

thyristors could cut the current to zero.

Senses that a lift coil or movable multiplex thyristor has failed by

detecting a current in the movable or lift coils of any rod or group of

rods not selected by the multiplex function. This failure mode could

energize more than a single detected group of CRDMs.

Checks for current continuity.

B. gic Cabinet Failures

1. Pulser Failure

2. Slave Cycler Input

Failure

3. Loose or Missing Printed

Circuit Card

Detects the failure of the pulser to generate pulses when signaled.

Slave Cycler receives a 'GO' signal before completing the

previous step.

Checks for circuit continuity.

2-15
2.5.1 Individual Rod Position Indication System

The Individual Rod Position Indication (IRPI) System continuously senses and displays position

information for each rod. Either an analog or digital type of system design may be employed. Both

designs are briefly discussed in this section.

2.5.1.1 Analog IRPI System

* Rod Position Detector

In the analog type of IRPI system, shown in Figure 2.9, the primary sensor is a linear

transformer type of detector, which is concentrically mounted outside the CRDM rod travel

housing (upper portion of pressure housing). The detector consists of alternately stacked

primary and secondary coil windings. The control rod drive shaft acts as the armature of the

transformer. The primary coil winding excitation is 118 ± 2.0 VAC with a current of 450 ±

100ma. The amount of magnetic coupling between the primary and secondary windings is

proportional to the vertical position of the top of the control rod drive shaft within the rod

position detector. With the rod drive shaft fully inserted, the magnetic coupling between the

primary and secondary coils is small, and the signal induced in the secondary windings also

is small. As the rod is withdrawn from the core, the relatively high permeability of the drive

rod increases the magnetic coupling between the primary and secondary windings, which

induces an increasingly larger signal voltage in the secondary winding with each step that the

drive shaft is withdrawn. The resulting output voltage from the secondary windings is an a-c

signal, whose amplitude is proportional to the rod's position. This signal is processed and

displayed through the actions of several functional blocks.

* Signal Condltiming Module

The detector output voltage is transmitted to a signal conditioning module which rectifies the

ac signal into a 0 to 3.45 Volt d-c signal required to drive the control board indicator and

plant computer. The module has adjustments to calibrate the channel, and a test-operate

switch, to check the operation of the electronic circuitry.

* Rod Bottom Bistables

The rod bottom bistables are simple level detectors which are used to alarm and indicate the

dropping of a rod below a predetermined position. The bistable output operates a control

relay which generates the ROD BOTTOM ROD DROP alarm. The bistable setpoint is

adjustable over the lower 25% ( to 38") of rod travel.

2-16
SIGNAL CONDlIONIN

TEST/

OPERATE I

41[

tl13 V C

RPI INDICATOR (STEPS) _ CONTROL OARD

CJANALOG MITER

0 PLANT COMPUTER POSITION SIGNAL 0 TO 3.45 VOCRPI IN TEST

SHOV IN

ROD eortou b . CONDITION

H I

ROD OTTOM BISTABLE

OTHER ULL ANNUNOATOR

ILNGTH ROOS

ROD 10T1DM

,W, CONTROL OARD

OTHER AU S3ANNUNCIATOR

LENGTH ROOS

TEST SIGNAL 

TEST SIGNAL e TEST PANEL

to OTHER Ba

#00 CHANNELS~&

Figure 219 Block diagram of the analog IRPI systems

* Test Panel

The test panel, in conjunction with the signal conditioning module TEST/OPERATE switch,

performs on line testing of all rod position channels and output devices. The test panel

supplies a variable a-c test signal (simulated detector output) for checking the operation of

the signal conditioning module and the rod bottom bistable. The plant operator is alerted

to this channel test by a 'RPI IN TEST" control room annunciator.

* DC Power Supplies

Two sets of d-c power supplies, connected in an auctioneered arrangement, furnish the

power required by the signal conditioning modules. Failure of any of the four d-c supplies

actuates a control room annunciator, 'DC POWER SUPPLY FAILURE" and a local

indicator lamp.

2-17
a Control Board Position Indicator

The control board position indicators show the operator the actual position of each rod. The

rod position display is an analog meter calibrated in steps. The indicators are grouped by

banks to show to the operator the deviation of one rod with respect to the other rods in a

bank. Mounted on the bottom of each indicator is the rod bottom light.

2.5.1.2 Digital IRPI System

The digital IRPI system is an evolution in design of the older analog system described previously.

Figure 2.10 is a basic block diagram of this system. Although similar in overall function to the analog

IRPI system, its design has several important technical improvements. Probably the most significant

feature of the digital system is the design of its detector, which is comprised of 42 discrete coils with coil

connections made so that two separate data channels of 21 coils each are formed. Unlike the two

winding transformer types of detectors used in the analog IRPI system, it is possible to continue to sense

the position of a rod on the loss of a single coil.

Figure 2.10 Digital rod position indication system - block diagram

2-18
* Detector

A rod position detector is supplied for each RCCA. Each detector consists of 42 discrete

coils, mounted adally on a hollow, non-magnetic, stainless steel tube and spaced out along

its length at 3.75 inch intervals. The hollow tube fits over the rod travel housing (upper

portion of the CRDM pressure vessel).

The coils magnetically sense the entry of the drive rod shaft through their centerlines.

Because the drive rod shaft is ferromagnetic it disturbs their magnetic field. When a rod is

out of a coil, the voltage across the coil is high; when it is in a coil, the voltage drops.

Data Cabinets

Two data cabinets are located inside containment and contain solid state signal processing

circuitry which is required to detect rod position and transmit this information to the main

control board. Within each data cabinet, the coils of the rod position detector are connected

to a detector/encoder card, which samples or detects' the voltage developed across a coil

terminating resistor. This analog signal is converted or 'encoded" into a digital 'binary word'

and transmitted to the central control unit.'

* Central Control Unit

The central control unit is located in the control board display. This unit controls the

operation of a time-division multiplexing technique that reduces the number of cable

penetrations into containment where the data cabinets are located.

The central control card is the one common tie between the two rod position data channels.

The central control unit uses three control cards to prevent the loss of system position

monitoring on a single failure. If a card's input or output disagrees with the input or output

of the other two cards, it disconnects itself from further operation and generates a disconnect

alarm. The failure of a single central control card, therefore, does not result in a system

failure. In addition to providing control rod position indication, the central control card

generates the following four types of system alarm signals which actuate control room

annunciators by output relays:

1. R.P.I. Rod at Bottom

2. R.P.I. Two or More Rods at Bottom

3. R.P.I. Urgent Failure (A system failure which results in the total loss of position

information for a rod or rods)

4. R.P.I. Non-Urgent Failure (A system failure which results in the loss of one of the data

channels)

2-19
* Control Board Display

Digital rod position information is fed from the central control card to a separate display

card for each rod. The display card consists of forty light emitting diodes (LEDs) mounted

vertically, one above the other, along its front edge. The bottom LED represents the rod

bottom position. The next thirty-eight LEDs cover the total range of rod movement (228

steps). Each LED, therefore, actually represents a 6 step (3.75") increment of rod travel.

The last, or fortieth LED is for a general warning indication. Only one LED is lit to identify

the position of the rod.

2.5.2 Bank Demand Position Indication System

The Bank Demand Position Indication System (BDPI) counts the rod motion command pulses

generated in the logic cabinet of the rod control system. This system, therefore, indicates where a

control rod group shod be, based on the number of insertion or withdrawal steps generated. Since

each rod in a group receives the same signal to move, each rod should be at the position indicated by the

bank step counter for its group. However, if the rod does not move when demanded, or is dropped, the

step counter will not reflect its true position. The BDPI has a high accuracy (+ 1 step), but is not very

reliable because it is an inferred indication of rod position.

There are fifteen step counters in a group on the operator's console. Each counter has five digits

and will indicate the number of So inch steps demanded of that group. Each counter is driven by three

solenoids, one for up", one for "down", and one for reset'.

2-20
3. OPERATIONAL AND ENVIRONMENTAL STRESSES

Operational and environmental stresses can be degenerative forces. Examples of these stresses that

a component experiences are vibration, corrosion, service wear, heat, and transient surges in electrical

supply voltages. In addition to these stresses, externally induced stresses, such as those caused by

abnormal operating conditions, improper or excessive testing, and human errors can accelerate agerelated degradation of the component.

Age related degradation mechanisms such as corrosion, mechanical wear, and the breakdown of

electrical insulating materials develop as a result of long term exposure of a component to operational

and environmental stresses. Such stresses may gradually degrade the component's physical properties

or operating characteristics. The failure to identify and correct degradation mechanisms in a timely

manner causes failures of components and may impair plant safety. The specific type, number, and

intensity of operating and environmental stresses that may be experienced by a particular component are

related to the component's function, its physical configuration within the system, and the characteristics

of its operating environment. The overall effect that a particular stressor may have on a component

primarily depends on the intensity, frequency, and duration of the applied stress, and the endurance limit

of the material. In addition, it is important to note that components are subjected to more than one

single stressor at any one time. Such stresses tend to act synergistically, having a combined effect that

may be greater than the sum of the individual stresses.

This section identifies these degenerative stresses that may act on the major components of the

Westinghouse Control Rod Drive (CRD) System. As discussed in Section 2, the CRD system consists

of four different subsystems which contain components that are constructed from a wide array of

materials, and are operated in a broad range of environmental conditions. Therefore, there may be

rather large variations in the number, type, and magnitude of stresses to which an individual component

may be subjected. For this reason, Section 3.3 discusses the stresses associated with each of the major

system components.

Table 3-1 summarizes the results of an initial evaluation of the specific materials, degradation

mechanisms, and potential failure modes of each component. Following this review, an additional

examination of each major component was performed to identify potential operational and environmental

stresses that, in time, may contribute to developing the degradation mechanisms identified in Table 3-1.

The results of this evaluation are presented in Table 3-2; the potential stresses were assigned a relative

importance ranking to indicate their overall contribution to the age related degradation of the effected

component. This qualitative assessment was based on the review of the experience of the system, and

an analysis of the operating principles and design parameters of its major components.

3.1 CRD System Operating Stresses

These stresses have been identified as potential contributors to component degradation within the

CRD system:

3-1
Cyclic Fatigue

Cyclic Fatigue refers to the repetitive application of an applied force. Such forces may be

mechanical as in the repetitive loading and unloading forces applied to the CRDM gripper latches during

rod insertion or withdrawal sequences; or electrical, as in the repetitive on/off electrical forces applied

to the CRDM operating coils during rod stepping.

Mechanical Interaction

This operating stress is induced by friction that develops as a result of mechanical contact between

two objects. For example, contact between the RCCA and the guide tube during normal operation can

result in wear in the upper internals. A reactor trip exposes the RCCA and CRDM to mechanical

stresses such as friction and vibration, which are induced by the resulting reactor pressure and

temperature transients.

Vibration

Vibration of the components of the CRD system may be generated by several sources, including the

force of primary coolant as it flows up through the core. The motion of the CRDM guide tube caused

by such vibration deteriorates the RCCA.

Water Chemistry and Debris

This refers to the degenerative forces that a component may experience because of its exposure to

impurities in the reactor coolant system. Water chemistry refers to the corrosive nature of the primary

coolant in a PWR due to the boric acid that is added to control reactivity. Leaking instrument sensing

lines or defective seal welds on CRDM pressure vessels could expose components in their vicinity to the

corrosive effects of boric acid present in the primary coolant. Debris in the reactor coolant system can

be transported anywhere in the system by the hydraulic forces and become wedged in the CRDM, which

causes wear and binding.

Voltage Transients

This stress includes disturbances in the electrical voltage or current supplied to a component that are

caused by load changes and electrical system faults.

Maintenance

Maintenance tends to be intrusive, and can rarely be performed without causing some physical

disturbance in the system. An example of maintenance routinely performed on the CRD system is the

uncoupling and coupling of operating coil stack connectors and cables during refueling outages. This

activity may be performed numerous times during the plant's operating life, and contributes to

significantly degenerative stresses.

3-2
Testing

System performance tests that are performed intermittently, such as rod drop timing tests, subject

components to some of the stress experienced during a reactor trip. In addition, the method used for

such tests could contribute further to degrading certain system components. For example, removing fuses

to provide an open electrical circuit during certain tests induces additional levels of mechanical fatigue

in both the fuse and its holder. In time, the additional mechanical stress will cause the electrical

connections to loosen. This condition, if undetected, may initiate an unintentional rod drop which results

in a reactor trip.

3.2 CRD Sstem Environmental Stresses

The environmental stresses that are considered in this section are temperature, humidity, and

radiation. Evaluation of the materials which comprise the major components and the associated

operating experience indicates that these environmental stresses affect the performance of the system.

The power and logic cabinets are located in a mild environment. The temperature and humidity are

generally monitored and controlled and radiation levels are low. Equipment located in a mild

environment is immune from the high radiation or steam and humidity of a harsh environment. The

portion of the CRD system located within the containment, and those components located within the

reactor pressure vessel boundary, exist in a harsh environment. Their requirements for material design

are much more severe than the equipment outside of containment.

Temperature

The dominant environmental stress associated with the CRD system is temperature. Effects of

time-temperature aging deteriorate many organic materials. This degradation process has been modeled

using a temperature dependent function that follows the Arrehenius equation. The findings from testing

performed on electrical power cables, for instance, demonstrated that over a period of several years, high

temperatures resulted in oxidation and embrittlement of the polymer, especially in the presence of

humidity and radiation.

Even in a mild environment, electrical and electronic equipment of the type used in the logic and

power cabinets are susceptible to failure due to increases in ambient air temperatures. Higher

temperatures exist in the in-containment portion of the system, especially the cable and connectors and

the CRDM itself Again, the electrical parts of the system are the most prone to aging related

degradation due to the effects of temperature in containment, particularly above the reactor pressure

vessel head where temperatures may exceed 200F.

The aging effects that may be attributable to temperatures above 150F include the following:

* changes in dielectric properties

* embrittlement and hardening of polymers leading to cracks

* change in mechanical strength and properties of jacketing material

* change in chemical properties of lubricants

3-3
Humidity

High humidity is considered a second environmental stress for the control rod drive system, especially

that portion of the system located inside containment. High humidity can cause changes in cable

dielectric properties which reduces voltage withstand capability for the cable or connector. Similarly, this

stress increases the amount of leakage current, and can even cause partial surface corona discharge.

Continued exposure to moisture can cause corrosion and dimensional deformation. The portions

of the CRD system most likely to be affected by high humidity are the in-containment cables, connectors,

and CRDM coils. The failure mechanisms associated with this stress are discussed in Section 3.3.

Radiation

Radiation is generally not considered to be an important aging factor for the control rod drive system

equipment located in mild environments. However, within the containment, the radiation environment

(predominantly gamma and neutron) must be considered in terms of cumulative dose, dose rate, and

radiation hot spots.

The aging effects on the control rod drive system components due to radiation include:

• changes in dielectric properties of polymer

* softening and reduced strength of cable jacket materials

* modification of the crystalline structure of metals

3.3 Component Level Stresses and Degradation

The operational and environmental stresses which are experienced by the control rod drive system

can cause age related degradation through several different mechanisms, which vary with the materials

used in the component, as well as the level of stress. Information in this section, therefore, focusses on

the aging-related degradation which may occur at the component level due to the stresses placed on the

system. The degradation mechanisms frequently mentioned in the discussion of the degradation of

mechanical component are defined below.

Thermal Embrittlement

Thermal embrittlement, or thermal aging, affects the ductility of Type 304 stainless steel castings.

Embrittlement is a function of time and temperature and reduces the fracture toughness (loss of ductility)

of the material.

Mechanical Wear

Mechanical wear primarily affects the surface of a component and refers to the degradation which

occurs from physical interference, such as rubbing.

34
Stress Corrosion Cracking

Stress corrosion cracking (SCC) is caused by a high level of tensile stress, chemical environment, and

material susceptibility to attack. SCC typically causes the material to become embrittled which reduces

ductility.

Fatigue

Fatigue causes a component to deteriorate due to exposure to repeated or cyclic physical forces over

time.

3.3.1 Rod Cluster Control Assembly

The Rod Cluster Control Assemblies (RCCA) are positioned within the core to control rapid changes

in reactivity during normal plant operation and provide a reactor shutdown (trip) in the event of

off-normal plant transients. To accomplish these objectives, the individual absorber rods of each RCCA

must be capable of continuous free movement and their cladding must prevent the loss of neutron

absorber material. The primary degradation mechanisms of concern for this subassembly, therefore,

include those time dependent stresses which could physically interfere with the motion of an RCCA, a

breach of control rod cladding integrity, or result in a control rod being inadvertently dropped into the

core.

As discussed in Section 2, the major components of the RCCA include the spider assembly and the

individual absorber rods. To minimize the effects of their corrosive environment both components are

constructed from Type 304 stainless steel. Significant stresses related to this subassembly include

vibration, radiation, cyclic fatigue, and friction between this assembly and neighboring components.

Individual Absorber Rods

The identification of control rod cladding wear at Wisconsin Electric Power Company (WEPCO)

Point Beach Units 1 and 2 and the Northern States Power Prairie Island Units 1 and 2 led to an

EPRI sponsored study by Westinghouse on the expected lifetime of silver-indium-cadmium

control rods. That report described the results of hot cell investigations on three rodlets of an

RCCA that were removed from Point Beach Unit 1, and examined the three types of control rod

cladding wear that were observed. These include fretting wear, sliding wear, and cracking of the

control rod cladding surfaces.

Vibrations that are developed by the flow of primary coolant up through the core are a leading

contributor to age related wear of the surfaces of the control rod cladding. The flow induced

vibrations of the RCCA or guide tube cause repetitive contact between the control rod and

adjacent guide blocks of the control rod guide tube assembly located in the upper internals of

the reactor. The mechanical stress caused by the physical impact of the rod with the guide cards

forms localized areas of fretting wear on the cladding surface at points along the length of the

control rod. Fretting wear,' was identified in the Westinghouse study as having the most

limiting effect on the life of control rods. It primarily occurs during steady state plant operations

when the RCCAs are held in the fully withdrawn position for several months. While this aging

mechanism cannot be entirely eliminated, it is possible by periodically changing the axial position

of the RCCA to distribute the wear along the cladding surface.

3-5
"Sliding wear," is caused by individual absorber rods rubbing against guide blocks of the control

rod guide tubes during RCCA stepping and trip insertion. This wear is identified by long axial

grooves worn into the surface of the absorber rod cladding.

A combination of complex stresses contributes to developing Intergranular Stress Corrosion

Cracking (IGSCC) of the cladding. These stresses are caused by 1) mechanical interaction

between the absorber and cladding that occurs because the absorber swells from neutron

exposure, 2) exposure of the cladding to high levels of radiation, 3) cyclic stresses induced by

pressure fluctuations in the primary system, and 4) fatigue of the cladding due to the control rod

making contact with fuel assembly guide thimbles.

Fuel Assembly Guide Thimble

When fully withdrawn, the lower tips of the RCCA absorber rods remain engaged in the fuel

assembly guide thimble. Fretting wear has been observed on the guide thimble inner surface

corresponding to the location of the tip of the absorber rod. The cause of this wear is flow

induced vibration. Through wal wear could result in a stuck rod or structural degradation of the

fuel assembly. As described in Appendix A, Westinghouse uses two guide thimble designs. The

HIPAR design uses stainless steel tubes, as opposed to the Zircaloy tubes used in the LOPAR

design. The stainless steel guide thimble, due to its inherently hard surface, is not susceptible

to wear as is the Zircaloy tube. Tests conducted to characterize the wear concluded that the

wear rate was time dependent and related to the control rod guide tube design.

Westinghouse recommended that the absorber rod position be changed periodically during the

fuel cycle to eliminate any preferential wear site.

* Control Rod Guide Tube Support Pins

As described in Section 4, control rod guide tube support (or split) pins are used to maintain

alignment and support the guide tubes. These split pins are fabricated from Alloy X-750

(Inconel). Stress corrosion cracking failures have been reported, caused by over-torquing the

mating cylindrical nut. Split pin failures, in addition to potentially causing a stuck rod, could

break free and cause steam generator damage as well.

Westinghouse has redesigned the split pins, including revising the heat treatment requirements

and reducing the torque requirement on the nut. No reported problems have been reported

from the domestic plants using the new split pins. However, some French plants have reported

failures in the new split pins. No definitive explanation as to the continued SCC problems has

been given.

* Spider Assembly

Cyclic fatigue, maintenance, improper water chemistry, or reactor trips are leading contributors

to the degradation of the spider assembly.

3-6
The mechanical forces developed during refueling mantenance, which require coupling or

uncoupling of the CRDM to the spider assembly, contribute to the degradation of spider

assembly drive rod couplings. Operation experience data at one facility cites the degradation of

spider assembly couplings after 15 years, which resulted in a dropped rod.

Cyclic fatigue, radiation, water chemistry, and mechanical impact are all potential contributors

to the degradation of spider assembly vane welds. Cyclic fatigue is primarily induced by load

changes that occur during stepping insertion and withdrawal sequences. If a rod drops or a plant

trips, the spider assembly absorbs any remaining impact energy after the rods enter the dashpot

region of the fuel assembly guide thimbles. In addition, the vanes are susceptible to stress

corrosion cracking from their exposure to radiation, material stress, and chemistry of the

reactor's internal environment. As noted in Section 4, a spider assembly vane weld failure

resulted in a stuck control rod at one plant.

33.2 Control Rod Drive Mechanisms

The Control Rod Drive Mechanisms (CRDM) are mounted on top of the reactor and

control the motion of RCCAs within the core. Therefore, the various subcomponents of this assembly

play an important role in controlling core reactivity and mitigating plant transients. Parts exposed to the

reactor coolant are constructed from corrosion resistant materials, such as stainless steel and alloy X-750

(Inconel). All parts of the CRDM, which are exposed to the reactor coolant, are fabricated from

corrosion resistant stainless steel, Inconel or cobalt based alloys. Only austenitic and martensitic stainless

steels are used"1. The primary degradation mechanisms of concern for the CRDM are those that can

rupture the pressure housing or prevent free movement of control rods within the core.

* Pressure Housing

The pressure housing is part of the primary pressure boundary between the reactor coolant

system and the containment. Therefore, the principal stresses of concern for this assembly are

those that can contribute to a rupture of this boundary. The pressure housings are made from

Type 304 stainless steel, either cast or forged. CRDM pressure housings made from ast

stainless steel are a particular concern because of this material's susceptibility to thermal

embrittlement (thermal aging), which is a function of time, temperature and material, and affects

stainless steel castings having a relatively high ferrite content. Thermal aging reduces fracture

toughness of the cast stainless steel which may lead to the development of small cracks in the

pressure housings. Although the worst case failure scenario for the CRDM pressure housing

could result in the simultaneous occurrence of a small break loss of coolant and a rod ejection

accident, more likely CRDM leakage events involve the development of small leaks. Such leaks

would be difficult to detect and would expose neighboring components to additional chemical

stress from their exposure to the corrosive boric acid in the primary coolant.

3-7
Drive Rod Assembly

The drive rod assembly is constructed from a Type 410 stainless steel. It contains precise

circumferential grooves, which permit the RCCA to be positioned at any core location. A

coupling that allows for attachment to a mating RCCA spider is machined from Type 403

stainless steel. All other parts are fabricated from Type 304 stainless steel, except the springs,

which are alloy X-750 (Inconel), and the locking button which is made from Haynes 251.

This assembly is subjected to the same stresses as the latch assembly, namely cyclic fatigue,

primary coolant chemistry, mechanical binding, wear, and testing.

Latch Assembly

The latch assembly contains fixed and movable magnetic pole pieces which actuate two sets

(stationary and movable) of gripper latches. Each set contains three latches positioned 120'

apart, which engage grooves in the CRDM Drive Rod to move or hold the position of an RCCA.

Magnetic pole pieces are fabricated from Type 410 stainless steel, while all non-magnetic parts,

except springs and pins, are made from Type 304 stainless steel. Haynes 25, in the solution

treated and cold worked condition, is used to fabricate the link pins. Springs are fabricated from

Inconel. For improved wear, the tips of the latch arm are clad with Stellite6, while hard chrome

plate and Stelite-6 are used selectively for bearing and wear surfaces"1 .

Operating stresses for this assembly include cyclic fatigue, primary coolant chemistry, and

mechanical binding. Such stresses are a direct result of loading forces developed during the

numerous insertion and withdrawal stepping sequences, which occur during the operating life of

a CRDM.

The mechanical degradation of other reactor internal components and poor housekeeping during

refueling outages contribute to the creation of small particle debris within the primary coolant.

Since the CRDM must always be filled with coolant, small particles present in the coolant may

become lodged in the latch assembly, causing mechanical binding or jamming of the mechanism

and resulting in a stuck control rod. In addition, the friction developed between the debris in

the coolant and the small components of the latch assembly might increase the wear of the latch

assembly.

* Operating Coil Stack Assembly

The operating coil stack assembly consists of three electromagnetic coils contained within a

separate housing. This assembly is mounted externally to the CRDM Latch Housing. Six lead

wires (two wires from each coil) are routed through a separate conduit and terminate at a single,

six-pin electrical connector. Operational and environmental stresses include thermal stress,

moisture, corrosion, mechanical wear, and radiation.

3-8
The coil housings are fabricated from ductile iron which is zinc plated for corrosion resistance.

The coils are wound on bobbins of molded Dow Corning 302 material, with double glass

insulated copper wire. The coils are then vacuum impregnated with silicon varnish. A wrapping

of mica sheet is secured to the outer diameter of the coil resulting in a well insulated coil capable

of sustained operation at 200"C"I.

High ambient temperatures (thermal stress) primarily affects the insulation quality of the

operating coils and their connected cabling. Over several operating cycles, thermal stress may

lead to an electrical short circuit. The adverse effects of thermal stress on insulation quality are

further enhanced when temperature is combined with other operational and environmental

stresses of vibration and humidity. In addition, long term energization of a coil, such as that

experienced by the stationary gripper coil, may induce additional thermal stress in localized areas

due to ohmic heating of the windings. Changes in coil temperature affects the coil resistance.

The review of operating experience data found electrical connectors at the operating coil stack

to be the leading contributor of failures within this assembly. The significant stresses identified

for this component include maintenance, and corrosion from boric acid. Such stresses may

contribute to the development of open electrical circuits due to mechanical fatigue or corrosion

of connector pin mating surfaces. The type of connection used was modified by Westinghouse

for newer plants.

CRDM Mechanical Clearances"

The CRDM must function over a wide temperature range. Therefore, mechanical clearances

must be maintained throughout its life. Such clearances are present in three main areas.

* Latch Arm

During movement of the RCCA, load is transferred between the movable and stationary

gripper latches. When the RCCA is in position, there is clearance between the movable

gripper and the drive rod. With the lift coil off, the clearance decreases from .055 in. at

room temperature, to .051 in. at 6507F. With the lift coil on, the clearance decreases from

.055 in. at room temperature, to .034 in. at 650*F.

During rod movement, clearances between the stationary gripper and drive coil varies from

.008 in. at room temperature, to .029 in. at 650°F with the lift coil off. When the lift coil is

on, the clearances vary from .008 in. at room temperature, to .046 in. at 650'P.

* Coil Stack Assembly

The coil stack assembly can be removed from the latch housing at all temperatures. - At

room temperature, the ID of the coil stack is designed to be 7.303 ±: .005 in. Thermal

expansion due to operation results in a coil stack minimum ID of 7.310 in., with a maximum

latch housing OD of 7302 in. Therefore, under the extreme operating temperature range,

a coil housing which is at room temperature must be allowed time to heat during

replacement so that it will fit.

3-9
* Coil Fit in Core Housing

To facilitate heat transfer and coil cooling in a hot CRDM, the CRDM and coil housing

were designed with minimum clearances.

3.3.3 Power and Logic Cabinets

The power cabinets contain solid-state electronic switching devices, called thyristors, and associated

power circuits that convert the three-phase, 260V a-c voltage fed from the reactor trip breakers to a

pulsed d-c voltage required by the operating coils of the CRDMs. The low levelAow power signal

processing and control circuits are contained in separate, steel-enclosed logic cabinets. Control circuits

of the power and logic cabinets are mounted on plug-in printed circuit cards.

Heat, humidity, supply voltage transients, vibration, and corrosion are significant stresses. During

the review of operational data, an elevated level of ambient temperature was identified as the leading

contributor to the failure of components within the power cabinet. High ambient temperature directly

affects solid state electronic devices, such as integrated circuits and transistors. The power cabinets are

typically located in the Control Building switchgear rooms and, therefore, are not in unusually harsh

environments. Heat dissipated from thyristors, transformers and other components used for electrical

power conversion in this cabinet, however, will increase any potentially adverse, ambient temperature

conditions, and increase the thermal stress experienced by its temperature sensitive components. Forced

air circulation derived from outside may not always be adequate for properly addressing this concern.

Depending on the geographic location of the plant, and the season, outside air temperature and relative

humidity may already be elevated. Thus, several plants have installed additional air conditioning to

ensure a better operating environment for the power and logic cabinets.

Mechanical vibrations from external forces such as improperly closing cabinet doors, or vibrations

that are induced internally by certain components such as transformers affect the physical integrity of

soldered and plug-in electrical wiring connections.

In addition, testing and maintenance involving the mechanical disturbance of any component or

wiring device, such as pulling fuses during tests for rod drop timing, or lead lifting and jumpering during

maintenance cause additional mechanical loads on this subsystem that should be minimized whenever

possible.

3.3.4 Rod Position Indication Systems

The Individual Rod Position Indication System (IRPI) provides a direct, continuous indication of

control rod motion and, as discussed in Section 2, may be either an analog or digital type of design. In

both designs, the detector coils are concentrically mounted over the rod travel housing of each CRDM

and, therefore, experience many of the same environmental stresses described for the operating coil stack

assembly. However, the consequences of stresses that may lead to detector coil failure are more

significant in the analog type of IRPI system. Since the detector used in the analog system is a linear

variable differential transformer (LVDT), a single open coil winding occurring in

3-10
either the primary or secondary side will initiate a false rod drop signal and cause a loss of all position

information for the affected rod. As described in Section 2, the digital system incorporates a number of

individual, alternately connected, detector coils. Therefore, a single coil winding that fails open will result

in a loss of accuracy of the displayed position information, but should not cause a loss of all position

information or generate a false rod drop alarm.

From the review of operational data discussed in Section 4, the analog IRPI system also appears to

be less resistant to changes in the operating temperature of the detector coil. Such fluctuations in

temperature may be induced by changes in the CRDM housing temperature during heatup of the primary

system. Temperature variations cause the output signal of the detector to fluctuate, resulting in

instrument drift related problems during plant startup.

The Bank Demand Position Indication System (BDPI) derives its position information from step

counting circuits located in the logic cabinet. Therefore, those stresses identified previously for the

Power and Logic Cabinets may also impact the availability of this system. Since the BDPI basically

consists of solenoid driven electromechanical counters, this system is also susceptible to mechanical wear

and cyclic fatigue.

Tables 3.1 and 3.2 summarize the analysis of the stresses, which can contribute to the aging related

degradation of the control rod drive system. Table 3.1 identifies each major CRD system component,

the materials used, the primary degradation mechanisms, and the most likely failure mode. Table 3-2

qualitatively evaluates the significance of each of the operational and environmental stresses that have

been discussed. It also focuses on the areas where predictive maintenance can be applied. This

evaluation is based on an engineering analysis of the materials of composition, design environmental and

operational conditions, and the operating experience of the CRD. Generally, a high' (H) ranking

indicates that operating experience supports the assessment, while a 'low" ranking (L) shows that neither

experience nor an analysis of engineering design provide evidence to deem this an important aging

concern. An (M) represents a moderate aging effect due to the particular operational or environmental

stress.

3-11
Table 3.1 SigniflIcant Westinghouse CRD system degradation mechanisms

SUBSYSTEM/

COMPONENT MATERIAL

DEGRADATION

MECHANISM

POTENTIAL FAILURE

MODE

1. RCCA AND RELATED REACTOR iNTERNAL COMPONENTS:

a) Spider Assembly 304SS * Fatigue

* Mechanical Wear

* Stress Corrosion

Cracking (SCC)

* Dropped Rod

* Stuck Rod

b) Absorber Rods 304SS * SCC * Rupture of control rod cladding

* Mechanical Wear

c) Control Rod

Guide Tube

Alloy X750

(Inconel)

* Mechanical Wear * Stuck control rod

d) Split Pin Alloy X750

(Inconel)

* SCC * Loose parts in reactor coolant

system

* Stuck control rod

e) Guide Thimble Alloy X750

(Inconel)

* Mechanical Wear * Fuel assembly mechanical

degradation

* Stuck control rod

2. CRDM

a) Pressure Housing 304SS * Thermal Embrittle- * RCS Leak

ment

* Corrosion

* Fatigue Crack Growth * Rupture of primary pressure

boundary

b) Latch Assembly Stellite 6,

Haynes 25,

and 304SS

* Mechanical Wear

* Fatigue

* Dropped Rod

* Stuck Rod

c) Drive Rod 410SS * Mechanical Wear

* Fatigue

* Dropped Rod

* Stuck Rod

3-12
Table 3.1 (Cont'd)

SUBSYSTEM/

COMPONENT

DEGRADATION

MATERIAL

POTENTIAL FAILURE

MECHANISM MODE

d) Coil Stack

Assembly

Electrical

insulation

and

connectors

* Corrosion * Dropped Rods

* Corrosion * Stuck Rods

(connectors, housing)

* Mechanical Wear

(connectors)

* Insulation Breakdown

* Fatigue (connectors)

* Thermal Embrittlement

(housing)

3. ROD CONTROL

SYSTEM &

LOGIC

CABINETS

4. ROD POSITION

INDICATION

SYSTEMS

Semiconductor

devices,

electronic

components,

connectors

Electrical

wiring,

insulation,

connectors

semiconductor

devices &

electromechanical

components

* Corrosion

* Fatigue

* Mechanical Wear

* Corrosion

* Mechanical Wear

* Fatigue

* Insulation Breakdown

* Single/Multiple rod drop

* Inability to move

rods on demand

* Erroneous rod

movement

* Incorrect or spurious

rod control system

failure alarms

* Incorrect Rod Position

Indication

* Incorrect/Inaccurate

Rod Position Information

* False dropped rod indication

(Analog RPI)

3-13
Table 3-2 CRD System Stress Summary

Operaling Srises Envirnmental

Strefies Potential Aging Mechanism

RCCA

SpiderAmend* M H M L M L N/A L M L M N/A M H L M L M L L N/A

Abeouber Rods H H H M M L N/A L M L M N/A M H L H M M L L N/A

Guide Thlmble H M M L L L N/A L L L L N/A L M L L L L L L N/A

CRDM

Guide Tube H M H L M L N/A M L L L N/A L H L L L L L L N/A

SpUt Pin L M L H M L N/A M M L L N/A L L L H L M L L N/A

Drhe Rd M H L M L L N/A L M L M N/A M H L L L H L L N/A

Latch Aembly M H L M L L N/A M M L M N/A M H L L L H L L N/A

CW Sc Acmb. L H L L M - H - L M L H M M L H M L L H H H

Pressr Husing L M L M M H N/A L L L H M M L H H L L H H N/A

C _CI~ L L L L L H M M L M M H M H H L L 11 L L H

POWIER/LOGIC

T rs L L M N/A L L H M L M 11 Hf L L M L L M L L HI

Dlscrete Components L L M N/A L L H M L M H H L L M L L M L L H

P.C Lgc Cards L L M N/A L L H M L M H H L M M L L M L L H

d.c. Power Supplies L L M N/A L L H M L M 11 H L L M L L L L L H

Relays L -1 M N/A L L H M L L M M L H H L L H L L M

Fuse/Nause Holders L L M N/A L L H M L M M M L H H L L M L L L

InternadWling L L M N/A L L L M L M M M L L M L L L L L H
Table 3.2 CRD system stress summary (Cont'd)

Ope.ng Strese EnIomeutal

Sreses Potential Aging Meebansni

Component £ '. Z ii JI, 1 1 W hi 1 '4

ROD POSITON IND_

Detcr L H M N/A L H H L M L H M M L M L L M L L n

Electuwnks L L M N/A L L H M L M H H M L M L L M L L H

Reb," L H M N/A L L H M M L M M L H M L L M L L H

Idktos M M M N/A L L H M L M M L L M M L L M L L

th M M M N/A L L M M L L L L L H M L L H L L L

NOTES: 'H' - High significance of stress on aging of the component

'M' - Moderate aging effect due to that stress

'L' - Not an important aging concern

'N/A'- Component not eaposed to that stress

w

I-L

tA
4. OPERATING EXPERIENCE FAILURE DATA ANALYSIS

This section presents the results of an analysis of operational eperience associated with the

performance of the Westinghouse Control Rod Drive (CRD) system. The information is based on a

detailed review of CRD system failure data obtained from three national sources of nuclear plant

operating experience. These sources are the Nuclear Plant Reliability Data System (NPRDS), Nuclear

Power Experience (NPE), and Licensee Event Reports (LERs). The scope of the data search conducted

for this study includes CRD system related failures, which have occurred at domestically operated

Pressurized Water Reactors (PWRs) employing the Westinghouse CRD system. Failure data obtained

from NPRDS and NPE includes CRD system failures, which were reported during a nine year period

between January 1, 1980 and December 1988. Information obtained from the Sequence Coding and

Search System, which contains the LER database, includes failure reports submitted during a five year

period between January 1, 1984 and December 1988.

NPRDS is a computerized information retrieval system currently maintained by the Institute of

Nuclear Power Operations (INPO). This source of system performance is based on reports of failures

of key components, which are submitted to INPO by the nuclear industry. NPRDS provides access to

historical engineering failure data that reflects a broad range of operating experience. In addition, this

database typically provides more comprehensive information on the failure of components than is

available in other national databases.

The search of the NPRDS database identified 172 failure event reports of the Westinghouse CRD

system. In general, these reports contain sufficient details to readily identify the basic characteristics of

system and component malfunctions such as the failure mode, method of detection, and the effect the

failure bad on both the system's operation and the plant's performance. Through the application of

engineering judgement and detailed analysis of the failure information, other significant characteristics,

such as the cause and mechanisms of failure, were determined.

Nuclear Power Experience (NPE) is a commercial technical publication service that summarizes

significant events which have occurred at operating reactors and provides an indexed reference of all

pertinent occurrences. Although much of this information is derived from Licensee Event Reports, the

NPE data also includes utility operating reports and a wide variety of applicable literature. A computer

assisted search of this database identified 147 summaries of CRD system related failures that were

compiled during the nine years reviewed.

A search of the Sequence Coding and Search System (SCSS) revealed 125 LERs related to the

Westinghouse CRD system from January 1, 1984 to December 1988. Each LER was reviewed to identify

the failed component, the cause of failure and the effect the failure had on the operation of the CRD

system. The data obtained from this five-year period, when coupled with other data searches (NPRDS

and NPE), provides a good basis for understanding the safety significance of CRD failures. Some

duplication exists among the three databases; double counting' was avoided by examining each failure.

Approximately 300 unique events were identified.

Although a great deal of useful information is available from the databases, there are limitations

and weaknesses to it which must be recognized. In general, the databases do not contain a complete

record of all failures. The result is that failure frequencies determined directly from the database

information will be lower than actual. However, using the data for analyzing failure characteristics, such

4-1
as causes, modes and mechanisms, should not be severely affected by this deficiency. Using the data for

evaluating aging effects is, therefore, a valid application.

To facilitate the classification of reported failures during this study, each failure record obtained

from the three national databases was individually reviewed and encoded into a computerized database

developed by BNL using d-Base III software. Failure reports were categorized in accordance with the

subassembly in which the failure occurred (Figure 4.1). As noted in the figure, the subassemblies selected

for a detailed review by this study include:

1. Rod Cluster Control Assembly (RCCA)

2. Control Rod Drive Mechanism (CRDM)

3. Power and Logic Cabinets

4. Cabling and Connectors

5. Rod Position Indication (RPI)

In addition, events whose root cause of failure was attributed to errors by plant's staff, such as the

improper installation, operation or maintenance of equipment, have been classified separately as "human

error".

4.1 Dominant Failure Trends

4.1.1 Aging Fraction

A primary objective of this study is to assess the impact of aging related component degradation

on system performance and reliability and provide recommendations to mitigate its effects. To

accomplish this task, a comparison was made between the information obtained from NPRDS and the

NPAR definition of an age related' failure presented in NUREG-1144. Before a failure could be

classified as "aging related", it had to satisfy the following criteria:

1. The failure must be the result of cumulative changes with the passage of time which, if not

mitigated, may cause loss of function and impairment of safety. Factors causing aging can

include:

* Natural, internal chemical or physical processes which occur during operation.

* External stresses (e.g., radiation, heat, humidity) caused by the storage or operating

environment.

2. The component must have been in service for at least six months (to eliminate infant

mortality failures).

The data were then individually reviewed and sorted to determine the events that were age related.

The results are presented in Figure 4.2, which shows that the Westinghouse CRD system is susceptible

to age related degradation. A minimum of 37% of all failures fall into this category. Figure 4.2 also

shows that a large fraction (29%) of reported failures could not be directly attributed to the age related

degradation of components as defined in NUREG-1144, and, therefore, are categorized as "potentially

age related".

4-2
POWER L LOGIC 48%

CABINETS _e

HUMAN ERROR 1

RODPOSITION 1 v 1,_ 7

INDITION - RDM 10

CABLE/CONNECTOR 121

NPRDS DATA

POWER LOO LeS

RO PSITION WS! H N ERROR 

INDIOCION NLEIOCTOR %

RA n

L E R DATA

35

ROD POSITION 21

INDICATION

HUMAN ERROR S

ROCA 71

CABLE / CONNECTOR 141 ORDM 101

N P E DATA

Figure 4.1 CRD failure distribution

4-3
NON AGING RELATED 33%

AGE RELATED 37%

POTENTIALLY 29%

AGE RELATED

NPRDS DATA

Figure 4.2 CRD system aging faction

The inability to specifically categorize the aging contribution of certain component failures is

primarily due to reporting limitations in the data. For example, the power and logic cabinet subassembly has been identified as a leading contributor to failure of the Westinghouse CRD system. In several cases,

however, power and logic cabinet failure records only indicated the type of component (e.g., logic card)

that had failed and the corrective action taken (e.g., replaced card). When records of this type are

evaluated, other non-age related causes of failure, such as spurious power transients, must be considered,

in addition to the age of the component at the time of failure. Inadequate root cause analysis by the

utilities may also contribute to the weak data.

4.1.2 Effects of Failure

An evaluation of the Westinghouse CRD system operating experience data was performed to

determine the effects on system performance. Figure 4.3 shows the results of this evaluation; over half

(63%) of all events reported in the NPRDS resulted in degraded system operation which, if uncorrected,

could adversely affect safety.

Nineteen percent of events reported to NPRDS resulted in a loss of component redundancy (Figure 4.3). While the failure of a redundant component may not appear to adversely impact the system's

operation, from a PRA standpoint it would decrease the availability in the overall system, and therefore,

represents a potentially significant failure effect.

4-4
NO EFFECT

18% X

LOSS OF REDUNDANCY

19%

DEGRADED OPERATION

63%

NPRDS DATA

Fgure 4.3 Effets of falure on CRD

Reactor Trip (Power)

40

Turbli

\ =W Reactor Trip (Startup)

ne Runback

10 Power Reduction

6

Number of Events

LERs 1984-1989

Figum 4A Effect of fur on plant operation

4-5
Unplanned, automatic trips challenge the operation of the plant's safety systems. Consequently,

their occurrence represents a potentially significant increase in plant risk. Figure 4.4 shows the effects

of failure on plant performance that were identified in the LER data. Of the 125 LERs obtained, 40

described system failures that resulted in a reactor trip from power operation. Additionally, the NPRDS

data identified several important plant/system interactions. . The results of this review show that a

significant fraction (32%) of CRD system failures reported to the NPRDS directly affected plant

performance by either an unplanned shutdown or reducing power.

4.1.3 Causes of Failure

The cause of failure is the actual malfunction or event that resulted in component degradation or

failure. The somewhat limited technical detail in the data, however, precluded in many cases, an accurate

determination of a specific root cause" of failure. Therefore, for this study, each failure record was

reviewed to determine the general condition or event which caused the component to fail. The overall

results of this review indicate that the majority of the failures of the Westinghouse CRD system are

caused by component degradation that has occurred during normal operation.

The portion of the CRD system bounded by this study consists of a combination of mechanical and

electronic subassemblies which perform diverse functions and operate in widely differing environments,

making each subassembly susceptible to its own set of failure mechanisms. Therefore, specific causes of

component failure within each subassembly are discussed separately in Section 4.2.

Human error was the cause for approximately 5% of the failures reported in each database

reviewed and does not appear to be a leading contributor to failure of the CRD system. The infrequency

of reported human errors, however, should not mask their significance. Table 4.1 presents a summary

of human related failures identified during the review of LER data which shows a high level of plant

sensitivity to such failures.

4.1.4 Modes of Failure

A failure mode is a description of the basic manner in which a malfunction in the CRD system was

detected. The predominant failure modes of the CRD system that were identified during the review of

the NPRDS data are shown in Figure 4.5. The most frequently observed failure modes include the

inability to move rods on demand (35%), and unintended rod insertion (27%). Abnormal system

operating characteristics of this type are typical consequences of component malfunctions within the

power and logic cabinets and are consistent with the identification of this subassembly as the leading

contributor to failure of the CRD system.

System failure modes categorized as "abnormal characteristic" include instances of unexpected

component degradation that was detected during in-service inspections, surveillance, and routine

observations.

Failure modes identified as "alarm" include component failures that do not represent an immediate

adverse effect on plant operation and, by design, actuate a "non-urgent" alarm upon failure. An example

of such an event would include the failure of a single, redundant, dc power supply within the power

cabinet. In addition, this category of failure mode includes events that were detected by a spurious or

incorrect alarm.

4-6
Table 4.1 Summary of human related LERs

Plant LER #

Age at

Time of

Failure

(years)

Failure Description

1. Cook 2

2. Indian Point 2

3. McGuire 2

86-028

86-031

84-026

8

13

1

Calibration procedure error resulted

in an inoperable rod insertion limit

monitor.

Error in biweekly rod exercise test

caused rod drops and reactor trip.

Troubleshooting error made due to

a procedure deficiency resulted in a

rod drop and subsequent reactor

trip from 100% power.

4. Point Beach 1 97-001 17 Test lead

preparation

dropped.

incorrectly placed in

for testing - 22 rods

5. Summer 1

6. Surry 1

7. Wolf Creek 1

87-O4

86-003

87-041

5

14

1

Technician inadvertently deenergized 2 power supplies resulting

in 12 dropped rods and a reactor

trip from 10lo power.

Jumper came off and shorted the

logic circuitry resulting in 4 dropped

rods.

Fusible link disconnect switch on

control rod movable gripper coil was

bumped" - resulted in a rod drop

and reactor trip from 86% power.

4-7
INABILITY TO MOVE

ON DEMAND 35%

UNIN TENDED

INSERTION OHR1

27% 

ABNORMAL

CHARACTERISTIC 15%

INCORRECT POSITION ALARM

INDICATION 23% 7%

NPRDS DATA

FIgure 4.5 CRD system failure modes

4.2 Component Failure Analysis

This section presents the results of a detailed review of available data for specific failure

characteristics of each subassembly of the CRD system. As discussed previously, the Westinghouse CRD

system consists of the following five major assemblies:

1. Rod Cluster Control Assembly

2. Control Rod Drive Mechanism

3. Power and Logic Cabinets

4. Electrical Cables and Connectors

5. Rod Position Indication

4.2.1 Rod Cluster Control Assembly

The Rod Cluster Control Assemblies (RCCAs) provide a rapid means for reactivity control

during normal operating conditions and accidents. Several, potentially generic, age significant failure

mechanisms have been identified during the review of operational performance data related to the

individual absorber rods which comprise the RCCA in the Westinghouse CRD system. Results from

testing revealed a significant amount of wear on the absorber rod cladding surfaces of the RCCAs. This

problem was described in four NPE articles and two NPRDS records, and was also addressed in IE

Information Notice 87-19 'Perforation and Cracking of RCCAs".

4-8
From the review of available failure data and related documents containing information on the

results of an analysis performed by Westinghouse and the licensees, cladding surfaces of control rods are

susceptible to three independent types of age related degradation. The specific types of wear include

sliding wear, fretting wear, and stress corrosion cracking of the stainless steel cladding, which encases the

absorber materiaL

In addition to sliding and fretting wear described in Section 3, cracking of lype 304 stainless steel

control rod casing material was identified by eddy current tests at one facility after approximately 12 years

of operation. In this case, the cracking was located in an area just above the rodlet end plug and was

fairly widespread. Thirty-two RCCAs were affected; the worst RCCA had cracks in 13 rods. Further

analysis of the effected rods revealed that cracking of the rod was initiated by irradiation induced swelling

of its absorber which is a silver, indium, cadmium material. The subsequent absorber/clad contact

induced a high level of stress in the casing which resulted in Intergranular Stress Corrosion Cracking

(IGSCC) of the Type 304 SS cladding material.

Primary water stress corrosion cracking of two fuel assembly holddown spring clamp screws was

identified as the root cause of a stuck control rod discussed in one NPE article. The failed screws caused

a spring clamp to work loose and become lodged in the RCCA. The control rod was not movable, which

required an unplanned shutdown of the reactor. The NPE article also stated that this failure had

occurred on at least two other occasions at Westinghouse PWRs.

Control Rod Guide Tubes

According to informaton in four NPE articles and two LERs, stress corrosion cracking has caused

control rod guide tube support pins to degrade. Support pin cracking at Westinghouse PWRs is

addressed in E Information Notice 82-29.

The support pins of the control rod guide tubes align the bottom of the control rod guide tube

to the top of the upper core plate relative to the fuel assembly. They provide lateral alignment and

support for the guide tube (Figure 4.6). The pins are constructed of Alloy X-750 which, depending on

the manufacturer and the date of fabrication, may have been subjected to solution heat treatment

temperatures and times ranging from 1625'F to 2100F and one-half hour to twenty-four hours,

respectively. Based on a Westinghouse analysis cited in the NPE failure summaries, support pins that

were solution annealed at less than 1800F may be susceptible to failure from stress corrosion cracking.

Westinghouse recommended that the pins be solution heat treated at 2000F for one hour and age

hardened at 1300'F for twenty hours to minimize stress corrosion 2. This recommendation has since

been modified, but is considered to be proprietary.

Two facilities that reported failures of support pins detected the broken pins following alarms

in the loose parts monitor of the steam generator. One failure damaged the steam generator tube ends.

Ultrasonic and visual examinations at another facility revealed 67 of 74 support pins in a degraded

condition. Three of the pins were missing parts, which were retrieved from a steam generator.

A potential consequence of a failure of the support pins is the misalignment of the guide tubes,

which could prevent control rod insertion. Westinghouse does not consider this to be credible. Upper

Head Injection plants (Sequoyah, McGuire, Catawba, and Watts Bar) have a special retainer welded to

the bottom of the guide tube flange that prevents the support pin shoulder from dropping out of the

counterbored hole in the guide tube flange.

4-9
Nut

locking

FIgure 4.6 Control rod guide tube support pins

Control Rod to Mechanism Coupling

The review of NPRDS data identified two age related failures of the RCCA spider assembly. This

assembly mechanically couples the individual absorber rods to the Control Rod Drive Mechanism

(CRDM). A failure in the vane weld of the spider assembly reported by one facility was initially detected

as a stuck control rod that became free after several insertion and withdrawal stepping sequences.

Subsequent core surveillance, however, showed differences in flux level and temperature at that core

location. During the next refueling outage, it was confirmed that a weld failure of the spider assembly

had occurred. This failure caused an absorber rod to discharge from the mechanism and drop into the

core. It is interesting to note that this type of rod drop is not detected by an alarm, which is derived from

detectors located on the control rod drive mechanism.

Mishandling during refueling operations was the probable cause of several, widely spread rod

drive shaft couplings at one facility. The spread couplings were detected by an inspection that was

prompted by latching problems encountered during a previous reactor reassembly. The spread couplings

had caused misalignment of the coupling and hub which prevented proper latching of the coupling to the

rod hub.

4-10
422 Control Rod Drive Mechanism

The Control Rod Drive Mechanism (CRDM) operates as an electromechanical jack to control

the position of an RCCA within the core. As discussed in Section 2, the CRDM is comprised of five

subassemblies and includes an operating coil stack, rod position detector coils, internal latch mechanisms,

a drive rod assembly, and an external pressure housing.

Coils

The operating coil stack assembly consists of three independent coils, the stationary, movable,

and lift coils, which are concentrically mounted outside the pressure housing. Based on sequential control

signals received from the power cabinet, the operating coil stack provides the magnetic forces necessary

to actuate internal CRDM latching devices which engage a grooved control rod drive shaft to control the

physical position of an associated RCCA.

Operational data related to the historical performance of the operating coil stack assembly were

found to be dominated by failures of the connectors. Failures of electrical cables and connectors are

classified as a separate subsystem for this report (Section 4.2.4).

NPRDS and LER data describe failures of the operating coils. All but one of the events were

the result of a failure of the stationary gripper coil, which is normally energized to hold its associated

RCCA in a desired position. De-energizing the stationary coil at any time during plant operation, other

than those required to perform a rod insertion or withdrawal stepping sequence, will result in dropped

rods which may cause an automatic trip of the reactor. All reported failures of stationary gripper coils

occurred in coils with more than 10 years of operating life.

The predominance of failures of stationary coils, when compared to other coils of this

subassembly, may be due to aging related degradation of the stationary coil's electrical insulation. This

increased level of thermal stress could be derived from ohmic heating of the coils during long term

energization. The sensitivity of stationary coil insulation to the effects of thermal stress was also the

subject of an NPRDS failure record. A malfunctioning CRDM shroud cooling fan caused two stationary

coil failures. The loss of the cooling fan caused shroud air outlet temperatures to exceed 220F during

reactor coolant system heatup. A special inspection revealed inoperable stationary gripper coils on two

CRDMs.

One NPE failure summary, which described the simultaneous failure of 12 stationary coils, 1 lift

coil, and 1 movable gripper coil serves as an example of a coil's susceptibility to failure following

exposure to the steam or boric acid environment of the primary system. The coil failures were caused

by an RPV level instrument piping leak, which occurred approximately one year before the coil failures.

CRDM Latch Assembly

Problems related to mechanical binding of the CRDM latch assembly were discussed in three

failure events contained in the data. In all three cases, small particle debris in the primary coolant caused

latch assembly binding that resulted in a stuck control rod. Two of the related LERs clearly defined the

debris as corrosion products. One LER indicates that emergency boration was required to compensate

for a filly withdrawn rod.

4-11
CRDM Vent Valves

The failure of CRDM pressure vessel assembly vent valves was the subject of three NPE articles

and two NPRDS reports. Two vent valve failures caused moisture contamination of CRDM operating

coil stack connectors during normal plant operation. In both cases, the contaminated connectors initiated

a rod drop, which ultimately resulted in an unplanned shutdown of the reactors. One additional NPE

failure summary attributed human error as the cause of vent valve leakage that was observed during

heatup of the primary system. In this case, an investigation revealed an improperly torqued vent valve

on a CRDM that had undergone extensive maintenance during the just completed refueling outage.

CRDM Drive Rod

Failures of guide screws on the drive rods of the CRDM were discussed in three NPE articles

and two LERs, and have also been documented in Information Notice 85-14. Drive rod assembly guide

screw failures were first identified at Korea Nuclear 5 where it caused a stuck CRDM drive rod.

Subsequent investigations by Westinghouse at this facility determined that the CRDM drive rod assembly

guide screw, which aligns and guides drive rods during coupling and uncoupling from the RCCA, had

rotated out of position. The guide screw fell from the drive rod, and landed on top of the latch assembly,

where it lodged. Reverse torque tests on the remaining screws at this facility identified three additional,

faulty guide screws. This event initiated the inspection of drive rod assemblies at two domestically

operated facilities which were of similar design. Reverse torque tests at one facility identified 14

unacceptable drive rods, while similar tests at another facility found five drive rods which did not meet

the acceptance criteria established by Westinghouse. In all cases, the cause of failure was attributed to

the improper installation of locking pins at the time of manufacture. The locking pins were designed to

intersect the mating threads of the guide screw and, if properly installed, would have prevented the screw

from rotating out of position.

4.2.3 Power and Logic Cabinets

The power and logic cabinets of the Westinghouse solid-state rod control system contain

electronic equipment and components necessary to operate the CRDMs. Demand signals received from

the reactor control system and the main control board are processed by this equipment. The power

cabinet contains electronic circuitry and equipment to convert the electrical power from the rod control

system M-G sets to a pulsed d-c voltage required for operating the CRDM. All low-level timing and

control circuits are located in the logic cabinets.

As depicted in Figure 4.1, malfunctions within this subassembly were found to be the dominant

contributors of reported failures of the CRD system. Of the 163 hardware related NPRDS failure reports

reviewed during this study, 83 (51%) were attributed to failures within this subassembly. The review of

NPE and LER data produced similar findings, with 51 of the 147 NPE reports (35%) and 45 of the 125

LERs (36%) relating to this subassembly.

A further review of the data was performed to evaluate the distribution of failures within the

power and logic cabinets and to identify any dominant failure trends in the subcomponents. Figure 4.7

shows the results of this review; printed circuit logic cards are the most frequently failed component,

followed by fuses, d-c power supplies, and discrete components. As can be seen in this figure, the

distribution of subcomponent failures closely agreed for each database reviewed.

4-12
LOGIC CARDS 5%

~~iIIIIIIIIIIIIIIII1I'JOTHER 4%

NDISCRETE COMP. 5%

d-c POWER SUPPLY 18%

FUSE 18%

NPE DATA

LOGIC CARD 48%

DISCRETE COMP. 8%

FUSE 30% DC POWER SUPPLY 15%

NPRDS DATA

Figure 4.7 Power and logic cabinet subcomponent failures

4-13
The dominance of printed circuit logic card failures may be related to their relatively large

population within this subassembly. Additionally, printed circuit logic cards consist of an array of discrete

electronic devices mounted on a single board. The entire board is usually replaced upon the failure of

a single component. From the review of available failure data, however, certain logic cards may have a

higher susceptibility to failure than other components located within the same cabinet.

The distribution of NPE summaries related to the failure of power and logic cabinet printed

circuit logic cards is depicted in Figure 4.8 As illustrated by this figure, the most frequent circuit board

failures involved "firing circuit' cards of the power cabinet and slave cycler counter' cards located in the

logic cabinet. Similar failure frequencies were also revealed during the review of LER and NPRDS data.

Integrated circuits and semiconductor devices, which comprise the logic card circuitry, are

susceptible to premature failure when exposed to environmental stresses of heat and humidity in excess

of their rated design operating range. Of the 27 logic card failures identified during the review of NPE

data, 9 (33%) attributed the root cause of failure to an elevated level of ambient temperature within the

cabinet. One NPE failure summary indicated that operational testing, performed by Westinghouse on

a slave-cycler counter card, found temperature to directly influence the performance of the card. All 9

failures which identified excessive ambient temperature as the cause of logic card failure, occurred at

plants less than 5 years old. Corrective actions taken by licensees to improve the ventilation may have

reduced the temperature related stresses in this area.

Logic card failures significantly affect CRD system and plant performance. Of the 17 circuit

board failures described in the LER data, 10 resulted in reactor trips. Similarly, the review of NPE data

found 23 of the 27 reported logic card failures caused a reactor trip.

Table 4.2 summarizes the analysis of the failure data on printed circuit boards. Although the

table is based on component failures contained in the NPE data, there is relative consistency with the

other sources of data. This table briefly describes the function of each card. It should be noted,

however, that since the failure data did not generally specify the cause of logic card malfunctions at the

subcomponent level, modes of logic card failures identified in the table have been described in terms of

the method in which the failure was detected (i.e., system failure mode), rather than the actual manner

in which the logic card may have failed (i.e., open, shorted etc.).

Fuses

Fuses were the second leading contributor of failures within the power and logic cabinets. Of

the 83 NPRDS failure reports, 24 (29%) were related to fuses which provide electrical protection for

CRDM operating coils and power supply circuits.

Nine LERs, issued between January 1, 1984 and October 1, 1988, were associated with fuse

failures of the power cabinet, which caused dropped rods and subsequent turbine runbacks or reactor

trips. Point Beach 2 noted that a fuse failure, which occurred 15 years after initial criticality, was due to

fatigue. North Anna 1, which experienced an unplanned trip due to a fuse failure in the power cabinet

after only 6 years of operation, indicated that fuses for the operating coils of the CRDMs were scheduled

for replacement. Additionally, Diablo Canyon also reported that they planned to replace all CRD fuses

with an improved type because of degradation.

4-14
PHASE CONTROL 10%

FIRING CAL17% REGULATION CARD 3%

ALARM 1X X§E~tUNRUREPRED CARD 17% ALARM CARD 10%

TYPE

RELAY DRIVER 3%

SLAVE .........

CYCLER COUNTER 17

BUFFER MEMORY 10%

I/O AC AMP 7% PULSER 7%

NPE DATA

FIgure 4.8 Power and logic cabinet circuit board failures

Nearly one-half of the fuse failures identified during the review of NPRDS data occurred at plants

with less than years of operating life. One NPRDS failure summary, submitted by a facility less than

3 years old, attributed the cause of fuse failure as a 'normal end of life' event.

Of the 10 NPE articles related to fuse failures in the power cabinet, 3 were found to be caused

by a degraded condition of the associated fuse hardware rather than an actual fuse failure. In one event,

the corrosion of the metallic contacting surfaces of the fuse caused an excessive voltage drop across the

fuse. This resulted in an urgent failure alarm for the rod control system that prevented normal

movement of all rods associated with the effected power cabinet. The inspection of power cabinets

following an unplanned automatic trip at another facility found 23 fuses in a degraded condition. A third

NPE summary identified loose electrical connections as the root cause of several fuse failures in the

power cabinet, which resulted in an unplanned trip of the reactor.

Power Supplies

The power and logic cabinets are provided with redundant sets of d-c power supplies. The loss

of a single power supply in either cabinet, therefore, should not adversely affect the performance of the

CRD system. The simultaneous loss of these d-c supplies has occurred, however, and has significantly

affected system and plant performance.

4.15
Table 42 Power and logic cabinet printed circuit card failure summary

(NPE data)

Logic Card Function Reported Failure Modes Revorted Failure Effects Mechanism No. of Failures Aze (In Yearsl

1. Regulation Regulates amount of

Card current supplied to

life cods of CRDMs

Rods would not respond to demand signal.

Rods could be moved in but not ouL

Inability to locate and correct failure

within specified time frame required

reactor shutdown per tech. specs.

Normal Wear/Age 1 9

2. Phase Determines correct

Control firing point for bridge

thyristoms

Failures generated rod control urgent

failure alarm which precludes normal

movement of rods associated with the

affected power cabineL

Same as 1. Normal Wear/Age 3 9,15,15

3. Faring Provides proper waveCard shape & amplitude for

firing thyristors

a. Complete failure resulted in a loss of

signal to associated stationary gripper

coils

Group rod drop with subsequent reactor

trip

Normal Wear/

High ambient

conditions in

vicinity of

power cabinet

4 6,11,8,8

0%

b. Partial failure of card resulted in a

continuous signal to lift coils keeping

them energized & preventing completion of

rod withdrawal sequence.

Manual Reactor Trip Normal Wear 1 2

4. Alarm Card Generates an urgent

failure alarm and

associated signal to

provide reduced current

a. Control rod drop without an urgent failure

alarm

Manual Reactor Trip

b. Failed card did not maintain position of Manual Reactor trip

Normal Wear/Age

Normal Wear/Age

Normal Wear

1 8

1 7

to moveable & stationary its associated groups of rods

gripper coils of all

groups controlled by c. Card failure caused rod drop by not

that power cabinet on

a detected failure

Manual Reactor trip 1 2

5. Slave

cycle

Counter

One of 6 PC cards a. Rod control urgent failure alarm precluded Same as 

associated with the slave normal rod movement

cycler which sequences

its associated power

cabinet, & hence, the

mechanisms through

one step "in" or out"

for each o" pulse from

the master cycler

Elevated ambient

temperature in

vicinity of rod

control cabinets

I I
Table 4.2 Power and logic cabinet printed circuit card fallure summary (Cont'd)

Lmic Card Function Reoorted Failure Modes Reported Failure Effecs Mechanism No. of Failures Aze fn YeRMs

b. Group 1 rods of SD Bank A, cont. Bank A

& oL Bank B would not move in during

operability teats

C. Card failure triggered a logic error resulting in Meo current to gripper coils

of affected CRDMs

d. All rods powered from the same power

cabinet failed to move during test.

No urgent failure alarm Failed card

caused erroneous signals to power cabinet

gripper coils

Same as 1, however, problem was

corrected within specified time

Rod droptbigh negative flux rate

reactor trip

Dropped rodrkescor trip

Normal Wear

Same as 5a

Normal Wear

1 1

1 1

1 I

c Rod control system urgent failure alarm

precluded normal rod movement. Rods

would not step in" with control In manuar I-A

-4

Manual Reactor Trip

Manual Reactor Trip

Same as Sa

Normal Wear/Age

1 1

6. IO AC Pwdes AC coupling

of al output signals

to power cabinet.

Sends current conmands

for CRDM lift coils to

power cabinet

a. No RPI indication of rod movement during

manual rod insertion for any od Card

failure caused oss of drive signal

to lift coils of power cabinet

b. All rods powered from a single power

cabinet failed to move on demand

2 11,1

Same as 1 Normal Wear

7. Puber Generates pubes that a. Card failure generated an urgent failure

are sent to the master alarm which predudes normal rod movement

cycler at a rate proportional to the preset b. Control ods failed to reapond to demand

or variable speed signal signal during manipulation for a flux

Same as li however, problem corrected Normal Wear/Age

Normal Wear/Age

2 123

Manual Reactor Trip

control due to puber card that was out

of calibration
Table 4.2 Power and logic cabinet printed circuit card failure summary (Cont'd)

Loic Card Function Reported Failure Modes Reported Failure Effects Mechanism No. of Failures Ae (In Years)

8. Supv.

Buffer

Memory

Card

Prevents a change in a. Failed card generated false error signal

command while an oper- which initiated a rod control

ation is being per. urgent failure alarm

formed based on direction

& bank selection infor- b. Card failure resulted in immovable rods

mation received from on any control bank selected

the main control board

Same as la, Manual ReactorTurip Normal Wear 3 3,1,2

Same as la, however, problem corrected Normal Wear

in specified time

c. Bank of rods would not move when selected. Same as la, however, reactor trip occurred Normal Wear

No urgent failure alarm during subsequent troubleshooting activities

9. Relay Provides signal

Driver conditioning necessary

to operate all relays

located in logic cabinet. Control board

step counters are

driven directly from

logic cabinet through

relay drivers

Card failure resulted in loss of I of 2

counter indications for a bank of control

rods

Manual Reactor Trip Normal Wear/Age 1 7

00
All 10 failures related to d-c power supplies identified in the NPE data caused rods to drop and

resulted in an unplanned trip of the reactor. Nine NPE summaries descrbed the simultaneous loss of

redundant d-c supplies. One summary identified the failure of a single logic cabinet supply as the

initiator of an electrical noise spike in the rod control logic. This failure caused rods to drop due to

erroneous signals to the stationary gripper coils.

Power supply failures accounted for 8 LERs (9 events) with redundant supplies failing in 5 cases

due to external stresses, such as lightning (4) and high ambient temperature (1). In 8 of the 9 events,

the power supply failures caused an unplanned trip of the reactor. Five LERs were associated with plants

in their first or second year of operation, including those events involving lightning surges.

Discrete Components

As depicted in Figure 4.7, the failure of discrete components located within the power and logic

cabinets have also appeared in the data. These components are independently mounted devices such as

thyristors, relays, and transformers.

Six NPRDS reports were related to the failure of discrete components. Of those, four described

failures of thyristors which control and regulate the current to associated CRDM lift, movable, and

stationary gripper coils. In addition, two NPRDS failure reports addressed events initiated by

malfunctioning relay circuits of the power cabinet. Discrete components were also identified as the cause

of problem in the control rod drive system in five LERs and three NPE failure summaries. Two LERs

and three NPE summaries identified thyristors as the cause of failure, while two transformer failures and

one event involving multiple degraded components, accounted for three additional LERs.

Two of the 4 thyristor failures described in the NPRDS data occurred during refueling and,

therefore, did not significantly affect plant performance. However, two additional NPRDS records and

all thyristor failure events described in the NPE and LER data (two LERs and three NPE articles),

resulted in an unplanned trip of the reactor.

Connectors and Wiing

Six LERs were related to wiring and connector failures within the power and logic cabinets. Four

LERs describe degraded electrical connections that caused rods to drop and resulted in an unplanned

trip of the reactor. Two additional events related to internal wiring contained in the LER data did not

result in any unsafe operation; however, the potential existed for an undetected condition, which may

have affected plant safety. In one case the failure of a soldered connection caused the loss of a

protection circuit at a plant with 14 years of operation. At a plant with 21 years of operation the 'control

rod drop' circuit was not properly connected to the reactor protection system logic.

Loose electrical connections at a facility with 3 years of operation contributed to an unplanned

trip described in one NPE failure summary. In this instance, an inspection of the power cabinets

following an automatic trip from full power identified 48 connections in a degraded condition. Such

failures highlight the importance of routine testing of this part of the CRD system to ensure that this

interface is properly maintained.

4-19
External Equipment

The failure of equipment and systems located outside the power and logic cabinets was the

subject of two NPE summaries reviewed. The inadvertent actuation of a fire suppression system near

the rod control cabinet, caused by human error, was cited in one NPE summary and resulted in an

unplanned trip of the reactor. A second NPE summary described an unplanned trip that was caused by

the loss of a ventilation fan in the area of the rod control cabinet. The inoperable fan caused a high

room temperature, which initiated a trip of thermal protection circuits for the redundant d-c power

supplies.

4.24 Electrical Cables and Connectors

The failure of electrical cabling and connectors, which link the power cabinets to their associated

CRDM operating coil stack assembly, was identified in 21 NPE summaries, 18 NPRDS records, and 8

LERs.

An additional sort of the data also identified cable connectors and receptacles, located at the

CRDM coil stack assembly, to be the dominant cause of failures within this section of the CRD system.

Failures of coil stack connectors contributed to 15 of the 18 related reports obtained from NPRDS and

11 of the 21 NPE articles. Additionally, 4 of the 8 LERs issued as a result of failures within this

subassembly were due to defective electrical connections at the operating coil stack assembly.

The primary degradation mechanisms of coil stack connectors include mechanical wear of the

plug contacts and corrosion in the area of the mating surfaces of the connector pin. Of the 11 related

failures described in the NPE data, 7 were caused by open electrical circuits resulting from mechanical

wear of the connector mating surfaces. Additionally, the reported failures occurred at plants that were

in operation for more than 5 years. This observation may indicate a need for improving the current

inspection methods or the frequency of inspection, since wear related problems of electrical connectors

are due to repeated connections over time. Design changes have been made by Westinghouse which

could also improve the performance of these connectors.

As may be expected, the failure of coil stack connectors, during periods of operation, significantly

impacted system operability and plant performance. Of the 11 NPE summaries reviewed, 8 attributed

failures of coil stack connector failures as the cause of dropped rods. Six of the events caused an

unplanned trip of the reactor. Three additional NPE summaries identified faulty connectors as the cause

of an inability to move rods on demand.

Cable failures contributed to six events contained in the NPE data. Two summaries described

the failure of electrical penetration modules. In both cases the faulted penetration modules caused a

short between conductors on the operating coils of the CRDM, and resulted in an unplanned trip of the

reactor. Kapton insulation damage, on containment electrical penetration pigtails located outside

containment, caused low insulation resistance test readings on 22 CRDM coil circuits at one facility.

Subsequent analysis identified mechanical stress as the root cause of insulation degradation. This caused

the conductor to corrode due to the intrusion of moisture.

Age degraded cable insulation caused a short circuit between coil leads in a section of cable

located near the CRDM. The faulted cable, which was estimated to be 8 years old, caused the stationary

coil fuse to open, resulting in a dropped control rod.

4-20
4.2.5 Rod Position Indication

Westinghouse PWRs have two independent systems for monitoring control rod position: a Bank

Demand Position Indication System (BDPI) and an Individual Rod Position Indication System (IRPI).

As shown in Figure 4.1, the rod position indication system was a leading contributor of reported failures.

Of the 147 failure reports obtained from NPE, 43 (29%) were related to this system. The review of LER

data revealed a comparable failure frequency with 45 of the 125 (36%) LER reports issued as a result

of malfunctions within this system. The review of NPRDS data revealed a somewhat lower, but still

significant, failure frequency with 31 of the 163 (19%) reports on equipment failure reports relating to

this subsystem.

The distribution of reported component failures within this subsystem is shown in Figure 4.9.

As indicated in this figure, problems related to instrument calibration drift primarily involving signal

conditioning modules and associated circuitry of the analog IRPI system, were the dominant contributors

of failures identified in the NPE data. Additionally, the majority of analog IRPI failures occurred at a

component age of greater than 10 years.

CALIBRATION DRIFT 44%

COIL (ANALOG 2%

POWER SUPPLIES 21% SIG-ONDMODUE 2

ROD0 BOTTOM IND. 5%

STEP COUNTER 7%

INDICATOR 9% LOGIC CARD (DRPI) 9%

NPE DATA

FIgure 4.9 Rod position Indication system failure causes (1180 to 12

4-21
Of the 43 NPE articles reviewed, 19 (44%) cited instrument drift as the cause of failure.

Problems related to instrument drift of the analog type of IRPI system appear to be affected by

temperature variations that are induced in the CRDM during the heatup of the primary system. Such

temperature fluctuations are suspected to cause a corresponding variation in the thermal equilibrium of

the linear variable differential transformer (LVDT) detector coils, which are concentrically mounted on

the CRDM pressure housing. Four NPE articles indicated that analog IRPI system drift is a known

generic Westinghouse concern", however, failure reports describing problems related to instrument drift

were not widely distributed among reporting facilities as would be expected. For example, all four NPE

articles which stated this to be a generic concern, describe problems related to instrument drift

encountered at the same plant. A further review of the available data revealed that 16 of the 19 events

related to instrument drift contained in the NPE data occurred at only four plants. Of the 31 failures in

the RPI system that were identified in the NPRDS data, 5 were due to instrument drift. However, only

3 were related to the conditioning circuitry for the rod position signal.

Power supplies, which provide a regulated source of a-c and d-c voltage for operating the RPI

system were leading contributors of component failures contained in the NPE data and accounted for 9

(20%) NPE failure summaries. It is interesting to note, however, that the review of NPRDS data did not

identify any failure related to a power supply.

The majority of RPI system failures identified during this analysis did not significantly affect

system or plant operation. However, the potential safety significance of misleading rod position

information resulting from failures within this system should not be overlooked. For example, the failure

of an analog IRPI detector coil, erroneously indicated a dropped rod, which led to a turbine runback from

full power to 37%. The NPE failure summary that described this event indicated that the combined

effect of a false rod drop signal and automatic turbine runback hampered the operator's attempts to

stabilize the plant.

4.3 Modes. Mechanisms, and Causes of Failure

Table 4.3 summarizes the entire review and analysis of operational experience data related to the

Westinghouse Control Rod Drive System and briefly describes the failure modes, causes, and mechanisms

for each subcomponent identified in this study. Appendix B includes a summary of the LER data used

in this study.

4-22
Table 43 Operating experience failure summary

1. RCCA Subassembly

Component Failure Mode Failure Cause Failure Mechanism

Individual Absorber

Rods

Abnormal/unexpected

cladding wear

Mechanical &

fatigue

Hydraulically in contact

with CR guide blocks

CR clad contact with guide

blocks during insertion and

withdrawal

Intergranular stress

corrosion cracking of CR

casing material due to

irradiation induced swelling

of absorber

CRGT Support Pin

Spider Assembly

Rod Shaft Coupling

CR Guide Tube

Degradation/cracking

of Inconel X-750

material

Dropped rods due to

vane weld failure

Improper rod coupling/

latching

Stuck control rod

Inadequate heat

treatment of Alloy

X-750 (Inconel)

material during

fabrication

Mechanical/material

fatigue

Spread Coupling

Mechanical misalignment of CRGT

Stress corrosion cracking

Normal wear/age

- cycling fatigue

- mishandling during refueling

Support Pin Failure

2. CRD Subassembly

Operating Coil Stack Open circuit Normal wear/age - vibration

- fatigue

- mechanical wear

Corrosion - environmental stress

(steam/boric acid)

- fatigue

- mechanical wear

Pressure Vessel Vent

Valve

Leakage Normal wear/age

Human error - improper maintenance

4-23
Table 43 (Cont'd)

2. CRD Subassembly (Cont'd)

Comoonent Failure Mode Failure Cause Failure Mechanism

Operating Coils Short Degradation of

coil insulation

Normal wear/age

Environmental stress (steam/

boric acid, absorption, heat)

- conductor material fatigue

- thermal stress

Open

Latch Assembly Control rod mis-stepping Foreign material/

crud buildup

-small particle debris present

in RCS

Failure to withdraw Binding Thermal cycling

Drive Rod Assembly

Shroud Cooling Fan

Stuck drive rod

Fails to operate

Drive rod assembly Ma

guide screw rotated insi

out of position and loc.

became lodged in CRDM

latch assembly

- Mechanical wear - A

- Fatigue

nufacturing error during

tallation of guide screw

king pins

,ge/normal wear

3. Power and Logic Cabinet Subassembly

P.C. Logic Card Incorrect output Subcomponent failure -environmental stress (heat/

humidity)

- vibration

- voltage/current transients

- changes in components

substrate material or perfonnancecharacteristics due

to age

Connector pin - corrosion/oxidation

- vibration

- mechanical wear

4-24
Table 43 (Cont'd)

3. Power and Logic Cabinet Subassembly (Cont'd)

ComiDonent Failure Mode Failure Cause Failure Mechanism

Thyristor Incorrect output - loose terminal - vibration

- mechanical wear

- incorrect maintenance

- substrate degradation- overheating

- voltagecurrent transients

Short to ground Degraded insulating

mounting bushing

- material fatigue due to

heat/age

Fuse Fails open Fusible link material

fatigue - age

- vibration

- cyclical load transients

- heat

- spurious current transient

Excessive voltage Degraded condition

of fuse contact

material

- age

- corrosion

DC Power Supply Loss of output voltage - Trip of thermal protection circuits

- Environmental stress (heat)

- Internal component

failure

- Overvoltage protection circuit

actuation

- Environmental stress (heat)

- Overvoltage/overcurrent

transient

- Lightning induced

voltage surge

Relay Loss of relay contact

continuity

Open coil

Degraded relay

connection

- Environmental stress (heat)

- Mechanical stress

- Corrosion

4-25
Figure 4.3 (Cont'd)

4. Cables/Connectors

Comonent Failure Mode

CRDM Operating Coil Open circuit

Stack Connection

Failure Cause

Normal wear/age

Corrosion

Failure Mechanism

- Mechanical fatigue

- Vibration

- Environmental stress (heat,

boric acid)

- Environmental stress

- Vibration

- Mechanical stress

Containment.

Electrical

Penetration

Shorted Insulation breakdown

Insulation wear

5. Rod Position Indication

Analog RPI Signal Incorrect output

No output

Analog IRPI indicator Incorrect rod position

Analog Detector Coil

(LVDT)

Open

Instrument calibration drift

Internal component

failure

Instrument calibration

Meter failure

Normal wear/age

Degradation of coil

insulation

Internal component

failure

Internal component

failure

Thermal variations in CRDM

during primary system heatup

- Age/normal wear

- Overcurrent/overvoltage

transient

Thermal variations in CRDM

during primary system heatup

Age/normal wear

- material fatigue

- Thermal stress

Thermal stress

- Normal wear

- Age

- Overcurrentlovervoltage

transient

- Normal wear

- Age

- Overcurrent/overvoltage

transient

Shorted

DC Power Supply No output

Degraded output

4-26
Figure 43 (Cont'd)

5. Rod Position Indication (Cont'd)

Component Failure Mode

Inverter No output

Digital RPI Logic Incorrect output

Failure Cause

Internal component

failure

Subcomponent

failure

Warped card

Relay contact

oxidation

Calibration drift

of rod bottom

bistable

Failure Mechanism

- Normal wear

- Age

- Overcurrentlovervoltage

transient

- Thermal stress

- Age/normal wear

Environmental stress (heat,

humidity)

Corrosion

Dirty potentiometer

Rod Bottom Indicator No rod bottom light

Rod bottom light would

not clear

4-27
S. FAILURE MODES AND EFFECTS ANALYSIS

In addition to the evaluation of the operating history of the CRD system, as presented in the

previous section, it is important to evaluate the system design for component interfaces and safety impact.

For this aging study, a failure modes and effects analysis (FMEA) was implemented. Due to the

unavailability of a PRA model and the availability of a Westinghouse failure analysis, this approach was

employed rather than a specific plant PRA model, as was developed in previous system aging studies by

BNL Both approaches satisfy BNL's Aging and Life Extension Assessment Program (ALEAP) Plan for

prioritizing components within the system.

The FMEA is a structured methodology for demonstrating the importance of components within

the three major portions of the CRD system (the CRDK, power cabinet, and logic cabinet). This FMEA

provides a qualitative assessment of parts interaction and safety impact; it also has the capability to

quantify aging effects. However, the NPRDS and LER data bases for the CRD system did not provide

the quantity and level of detail required to exercise this option. While there is nothing new about a

FMEA that quantifies a component train, this FMEA introduces the failure rates as variables. As

additional data are obtained, failure rates and frequency may be inserted into the FMEA to perform

parametric studies of interest. In the mean time, an estimate of failure frequency is expressed in broad

terms, as high, medium, or low and is noted. This estimate is based on the actual operating experience

data described in Section 4.

A Westinghouse report' on the CRD system was the primary reference for this FMEA It

provided a great deal of useful information pertaining to the expected function of each of the

components. However, independent evaluation was necessary in some areas due to the following

limitations of the Westinghouse report:

1. System faults attributable to operator error were established as being outside the bounds

of the study.

2. The main concern of the analysis was to determine the potential for a fault that could

inadvertently withdraw a control rod bank.

3. The analysis conducted was oriented towards the electrical and electronic control aspects

and not to its mechanical operational characteristics.

As illustrated in Table 5.1, the FMEA lists each of the primary components and briefly describes

its function. It then identifies the failure cause, failure mode, and failure effects at both a system and

plant level.

The qualitative assessment of safety impact is made based on the following guidelines:

High Safety Impact: The failure results in an uncontrolled change in reactivity which could

challenge the plant's safety systems (reactor trip), or the failure results in

the inability of the system to perform its safety function (rod insertion).

5-1
Moderate Safety Impact: The failure results in undesirable system response to command; i.e., rod

speed too fast, too many steps moved, incorrect position displayed.

The failure causes long term deterioration of the system, which could lead

to a high safety impact if not detected and corrected in a reasonable time

frame.

Low Safety Impact: The component failure does not affect the performance of the system nor

its ability to perform its safety function. Annunciation is often provided to

insure timely correction.

Westinghouse has recently provided data to the NRC which may permit plants to modify the

negative flux rate trip in the Reactor Protection System, so that a dropped rod will not result in a reactor

scram. The safety significance of a rod drop would then be considered low.

Similarly, the estimate of failure frequency is categorized as high, medium, or low based on the

following observations:

High: Component failures have been experienced at more than six plants. This

represents about 15% of the population.

Medium: Component failures have been experienced by at least three plants or multiple

failures have occurred at one plant.

L~ow Failures of this component have not been experienced or have been

experienced on a very limited basis.

5.1 Control Rod Drive Mechanism

Table 5.1 summarizes the analysis for components associated with the mechanism itself.

Highlighted here are the latch assemblies, which have a limited service life based on the number of

control rod stepping operations; the coil assemblies, whose insulation is subject to age related

degradation; and the interconnecting cables and connectors, which have also experienced the effects of

aging.

Half of the components have a high safety impact due to the likelihood of their failure challenging

the reactor protection system. A rod drop occurs in these cases which, under most power operating

conditions, leads directly to a reactor trip. A high negative flux rate is the sensed condition which leads

to the scram. In the other cases, a moderate safety impact is assigned based on the fact that the failure

mode (a single stuck rod) has little impact on the shutdown capability of the rod drive control system.

However, if multiple rods became stuck, the design bases of the system would be compromised.

5.2 CRD Power Cabinet

The power cabinet contains several discrete components. Many of these are assembled on circuit

boards which perform well defined functions within the control rod system. For this reason, the FMEA

for the power cabinet (Table 5.2) consists of components and groups of components sometimes identified

by function rather than by type.

5-2
Tabe 5.1

Uestinghouse control rod drive syatem FEA; echaniam _ _

:ailure Freq. o. Functlon FalluroIC lure Cme Fal e F r ode Failure Effect(sys/ptmnt) estimate Safety Impect Remarks __i ___ . -:s __ _r __ __ _. __ _.____L_ __ _ _ -__ __ ___

1 tatcn/grip u(u

shaft

wear or tatwn surface, fracture

changing angle of

surface

wear of the shaft

gripped surfaces,

rod fracture

faiture to nota shaft

failure to support control rods

aropped custer/negat1ve reactivity transient nion

",A

W

CR0 shaft/support

control rod

clusters

latch pin/hold

latch in place

stationary gripper

coll/close latch on

CRD shaft

stationery gripper

armature/close and

release latches

movable gripper

armture/elose

latches for lift

movable gripper

colt/close latches

for lift

Lift coil/tift

movable armature

pin fracture, pin failure

free to escape latch

open circuit,

short circuit

foreign material

between movable

surfaces

foreign material

between movable

surfaces

open or short

circuit

open or short

circuit

failure to achieve

and hold magnetic

field

Immovable

lrovable

failure to step

failure to step

to hold

Same as #1

Same as 1

Same as #1

control rod cluster fixed in

position/reduced reactivity

control and flux distortion

cannot lft CR

cluster/reduced reactivity

control and flux distortion

cannot close Lift

latches/reduced reactivity

control.

Cannot reduce reactivity of

one eluster/reduced

reactivity control and flux

distortion

Low

tow

tow

high

medium

low

tow

low

high Ste as #1

The ingte rod crop accident s a design

besis accident and is

anticipated. A reactor

trip signal may be

initiated due to a high

negative flux.

Same as #1

high

moderate

moderate

moderate

moderate

Same as #1

There is adequate

negative reactivity to

overcome one stuck CR

cluster.

An mmovable cluster

results in a flux

depression & excessive

rod cluster burnup. Rod

will still trip if

necessary.

Same as 6

Same as #6

high

- - . 4 4
Table 5.1

Uestinghouse contr L rod drive system FEA; Mec* ois_

_______________ _ stFailure Freq.a k

bO.jCooponent/Functio Failure Cause Failure fode ailure Effect~sys/plant) estimate e safety Impact earks

9F

10

11

12

tA'

Cables connecting

coils to power

cabinets/ carry

current for holding

coils

Cables connecting

coils to power

cabinets/ carry

current for gripper

and lift coils

Cable connectors

carrying current to

the holding coils

Control rod binding

in the thimbles

insulation

failure

insulation

failure

corrosion,

overheating,

improper assembly

foreign material

between the

sliding

surfaces;loss of

clearances

short circuit

open or high

resistance circuit

unable to move a

rod cluster

short circuit Loss of power to the holding

coils/rod drop

Loss of power to the gripper

or lift coils/inability to

lift or lower one rod

cluster.

Loss of one or more cables

supplying power to the

holding coils/rod drop

cannot change neagative

reactivity of one

cluster/reduced reactivity

control and flux distortion

medium

medium

medium

low

hhigh Same as #1

moderate

high

moderate

Same as #6

Same as #1

Same as #5

_ i I I A A
The FMEA identifies failure modes postulated for single failure within a power cabinet that results

in erroneous operation of the control rods. The analysis disclosed four categories of failure effects.

These are identified below along with the FMEA identifying number (1st column of table) which applies.

1. Rod motion blocked: 1, 2, 12, 13B, 15B, 17B, 19

2. Erroneous stepping of a rod or bank of rods: 3, 4, 5, 6, 14B, SA, 16, 17A

3. Rod drop leading to reactor trip: 7, 8, 9, 10, 11, 14A, 14C 18

4. Alarm only 13A, 20, 21, 22

The seven failures, which result in a rod drop and reactor trip, are classified as having a high safety

impact. Of these, however, only the phase sensing circuit function (item 11) has a high estimated failure

frequency based on the operating experience data. As illustrated in Figure 4-8, failures in the phase

control circuitry have accounted for ten percent of the power cabinet failures.

Fuses (items 8 and 10) have failed at only a moderate rate, but with important safety significance.

The failure of the fuse for overload protection of the CRDM coils caused a rod drop on several

occasions, although the data was not always clear about the root cause of the event. Pulling this fuse to

perform a rod drop test has also resulted in a long term reduction in the force between the fuse clip and

the fuse. The resulting open circuit has the same effect as a blown fuse, causing an inadvertent rod drop.

Finally, the failure of several other components within the power cabinet also results in a rod drop.

To date, however, the operating experience data has shown these components to be very reliable. These

components are the isolation diodes (item 7), the sampling resistor (item 9), the lamp and relay driver

board (item 14), and the relays (item 18). However, it should be noted that twenty percent of the failures

in the power cabinet, which resulted in a rod drop, did not contain adequate information to determine

what caused the component to fail.

5.3 CRD Logic Cabinet

The logic cabinet supplies current order signals to the power cabinet and data logging signals to

the demand step counters in the control room. The FMEA for the logic cabinet is presented in Table

5.3 and consists of the major functional blocks and discrete components which comprise this portion of

the CRD system.

Generally, only a limited number of component failures within the cabinet result in challenges to

the safety systems. The failure effects are categorized below along with the numbers in Table 5.3 that

are associated with that failure.

1. Rod drop and reactor trip: 1, 2A, 7

2. Rod motion blocked: 2B, 3, 4, SB, 8

3. Improper rod movement: 5A, 6

4. Alarm only: 9, 10, 11, 12, 13

5-5
Table 5.2

Control rod drive system FEA; ower cabinet

VI

Failure Freq.

No. aponent/Function Failure Cause Failure Mode Failure Effect(sys/plant) estimate Safety Impact Remarks

I Colt power corrosion of open circuit Loss of one or more phases tow Reduced current to the

disconnect switch / contacts, fatigue of ac power to the half wave low stationary, movable, or

provides a manual of mechanical thyristor bridge results In lift coils. Blocks

disconnect. parts excessive ripple and stepping action on this

erroneous control of drive CRD cluster. Detection

mechanisms. by annunciator "Rod

Control Urgent

Failure."

2 Stationary coil fatigue of fuse open circuit Loss of one or more phases Low Same as #1

power line fuse/ element, of ac power to the half wave medium

protect power vibration of fuse thyristor bridge results in

cabinet from element, high excessive ripple and

shorts. resistance erroneous control of drive

heating and mechanisms.

thermal effects

on fuse.

3 Line filter (choke) aging corrosion, open circuits Loss of a phase of ac power low This fault initiates a

to sooth ripples cyclic fatigue to a half wave results in an low power cabinet urgent

for coil current incorrect current profile alarm which blocks rod

(excessive ripple)with motion.

possible concomitant

erroneous stepping of the

drive mechanisms

4 Surge protection aging of short circuit Phase imbalance, no voltage low Same as #3.

(Voltrap)/for semiconductor, across shorted surge medium

stationary,lift and temperature protector, excessive ripple movable coil power effects, moisture

ingress
Table 5.2

Control rod drive system FEA; power cabinet

oopnui uu | ieu Efetsspat) | ied Falure Freq. _________________n Faiture Cause I Faltr "oe' Falture Efet'spet estitate __SaftyI__ct_ Remarks

5

6

7

Half wave thyristor

bridge rectifier/

provide d power to

the coils

Multiplex thyristor

switch for coils.

Isolation diodes

for the stationary

coils/ Provides

circuit isolation

during reactor trip

and rod stepping to

prevent

interactions

between stationary

or movable coils of

different rods

Overload fuse for

the coils/provides

power overload

protection of the

components

installed in series

with the coil

manufacturing

defect in

semiconductor,

moisture ingress,

defective heat

sir* with

excessive

temperature

aging of

semiconductor,

temperature

effects, moisture

ingress

aging of

semiconductor,

temperature

effects, moisture

Ingress

fatigue of fuse

element,

vibration, high

resistance

heating and

thermal effects

thyristor switch

fails open or

shorts

diode fails open

fails open

open or short

circuit

Incorrect current profile, excessive ripple/inability

to properly move effected

rod cluster

A loss of profiled current

to coils of rod drive

mechanism results in

erroneous stepping.

Loss of holding current to

the rod mechanism thus

allowing the rod to drop.

Failure results in an open

circuit that blocks profiled

do current flow to the

stationary coil which

releases the rod

high

Low

tow

medium

tow

tow

high

high

Same as #3.

The single rod drop

accident is a design basis accident and is

anticipated. A reector

trip signal may be'

initiated due to a high

negative flux.

Same as 7

Same as #3

tA

-4

8

.4 .4 4. 1 .4 .4
(A

00

Table 5.2

Control rod drive syste FEA: power cabinet

Failure Freq.

No. Component/Function Failure Cause Failure Mode Failure Effect(sys/plant) estimate Safety Ipact Remarks

9 Sanpling resistor aging due to fails open Failure blocks current flow high The control system is

for current moisture ingress, to the CRDN coils causing low feedback regulated.

measurement for thermal or toss of holding current to The auctioneering

coils, provides a chemical effects the CRDN thereby allowing aeplifier selects the

measurement of the rod drop into the core. highest current

coil current to an feedback signal from

auctioneering on of 4 sampling

amplifier for the resistors from a group

regulation of CRDM of CRDOs with a

coil currents. reference signal

indicating the desired

current.

10 Overload fuse for aging of fuse open circuit Failure results in a loss o high Same as #7

the phase sensing element, the sample voltage to the medium

transformer. vibration, high phase control pulse

Provides power resistance generators. This results in

overload protection heating, thermal erroneous SCR firing in the

to the phase effects, regulator supplying the

sensing transformer corrosion. profiled d current to the

and phase shifting stationary, movable and lift

components. coils. The effect on system

operation is that rod drop

may occur.

11 Functional block: aging due to fails to provide same as 10 high Same as #7

phase sensing and operation in the phase control high

phase shifting excessive ambient signal

circuit. Provides temperatures,

sample voltage moisture,

signals to the chemical action

phase control in the semifiring of the SCRs conductors.

in the regulator

bridge.
Table 5.2

Control rod drive syste power cabinet

Failure Freq

o._Cponent/FunctfnI Failure Cause Failure Node Failure Effect(sysuplent) estinste 1Sfety Iact Reemarks

12

13

Functioncl block:

failure detector #1

for stationery

cofis. Samples

errors in system

performance of the

firing of SCRs in

the regulator

bridge.

Functional block:

alarm circuits.

Provides non-urgent

and urgent alarm

signals to initiate

actuation of plant

annunciator for

failure of a 24 Vde

power supply (nurgent), alarm

error signel (E)

from failure of

detectors I nd 2

(urgent) and for a

regulation failure

of zero current to

the stationary and

movable coils at

the same time

(urgent). Also

provides logic

control to com.,nd

urgent orders to

the stationery,

movable and lift

coils of the CRD14s.

Same as # 11

same as #11

High error signel

output

A. Low non-urgent alarm signal

output

B. High urgent

alarm signal

output

Erroneous alarm signal to

alarm circuitry card

resulting in a power cabinet

alarm condition that

supplies reduced current to

the stationary and movable

coils of the CRDOf and block

stepping of drive mechanisms

for rod movement.

Erroneous alarm signals to

the firing circuit card. o

iwmediate effect on stepping of the drive mechanism for

rod movements.

Erroneous alarm signals to

firing circuit card and to

regulation card resulting in

a power cabinet alarm

condition that applies

reduced current to the

stationary and movable coils

of the rod drive mechanisms

for rod movement.

tow

medium

mediui,

low

low

tow

Stepping action of the

CRDMs is blocked.

Detected by a separate

phase and regulation

failure by PC board for

monitoring commutation

of each thyristor

bridge supplying

current to CRODs.

Alarmed as "urgent"

A failure detector s provided by monitoring

of the zero current to

the stationary and

movable coils.

Urgent alarm due to

reduced current to the

stationary and movable

coils and zero current

to the lift coils of

the rod drive

mechanisms

__________________________ A. I I _____________________ I I
Table 5.2

Control rod drive system FNEA; pouer cabinet

So~~bspcnent/Fuio ~o.1Ccsonent/Function Fat lure alure Cause Cause I FaIlure Failure Mode ods Fat Fallure lure Effect~syslplant) Efect(SyS/ptent) I Failure estimate Freq ety IpactI Remarks

., .

14

Is

Functioa Blockf

mp/relay driver

end lerm circuits.

Provides for the

processing of

rultiplex signals

and cycling signals received from the

Logic Cabinet (via the firing circuit

cord) to energize multiplex relays

and a cycling indicator lap.

Also provides logic control to process

an alarm reset from

the Logic Cabinet.

Functional Block:

10 receiver and

SCR gate firing circuits for the

stationary coils,

movable coils or

lift coils.

"a as 11 A. Mion ariver

output. Signal

processing card

failure

Faiture results In LOSS of

multiplexing control and

loss of local monitoring capabilities for cycling

indication of a slave

cycler. A los of multiplex control causes a tos of

profiled dc current to the

mechanism resulting in

erroneous stepping and

consequent rod drop.

Failure results in erroneous

multiplexing leading to the

profited current being applied at the ane time to

two groups of rod drive

mechanism resulting In

Incorrect stewing of the

rod drive mechanism that

block rod movement.

low

ion mame as P r

tA

I-0

B. Low Driver

Output. Signal

processing card

failure.

C. Low reset

signal output.

A. Erroneous gate

control output,

firing card

failure.

low

low

low

moderate

Failure results in a

constant colland for full do

current to the stationary

coils resulting in erroneous

stepping.

Same as # 3

Stationary coils are

alarmed to detect full

current being applied

to the stationary coils

for too long.

Three gate firing

transformers circuits

are provided on the PCboard for separate

firing of the bridge

SCRs and 3 1/0

transformers provide

coupling to the Logic

Cabinet.

Sam aS # 11 Failure results in no or

spurious firing of SCR

bridge current regulator

resulting in excessive

ripple and erroneous rod

stepping.

high

I S S A I
Table 5.2

Control rod drive ystem FEA; power cabinet __

Failure Freq.

No.4Coponent/Functlon I Failure Cause I Failure Mode Failure Effect(sys/plant) estimete Safety Impact Remarks

15 (Continued)

16

¶7

qA

LI."

Functional block:

phase control pulse

generator for

coils.

Functional block

auctioneering

amplifier and

saturation ripple

voltage detectors

for the stationery

coils.

Same as 11

Same as # 11

B. Erroneous

reference current.

Firing circuit

card failure.

Erroneous control

signal output.

Phase control card

failure.

A. Incorrect dc

error voltage

output (VERR).

Regulation card

failure.

B. High sensing

voltage output.

Regulation card

failure.

Failure causes incorrect

current control to the

auctfoneering amplifier with

Iproper error signals for

generation of the phase

control firing pulses for

the SCR bridge with wrong

current to the coils. CR

movement is blocked and a

rod drop is possible.

Failure results in improper

firing of SCR phase

p oducing a wrong output

from the CR bridge

resulting In erroneous

stepping of rods.

Failure results in early or

late firing of the bridge

SCRs resulting in full or

zero current to the coils.

Wrong current waveform and

erroneous stepping of CRDOs

for rod movement.

Failure results in a

spurious alarm condition at

the power cabinet resulting

in reduced current being

applied to the stationary

and movable coils and zero

current to the lift coils to

block stepping of the CRDMs.

moderate

high

mediwu

low

low

low

moderate

low

Detection: the output

weveform of the

regulator Is alarm

monitored. CR failure

Initiates a Power

Cabinet alarm.

Three phase sense and

control circuits on the

PC board provide a

control signal for

phase firing of SCRa.

Detection by bridge

current alarm monitor

to initiate a Power

Cabinet urgent alarm.

The error voltage

(VERR) Is proportional

to the difference

between the comaended

current and the highest

of the auctioneered

feedback signals. The

comsanded current is a"

analog of the digital

command from the Logic Cabinet. Failure

initiates a Power

Cabinet alarm.
Table 5.2

Control rod drive system lHEA; poer cabinet

Failure Freq

No. I Componant/Function IFaureCameI Failure Fode I Failure Effect(sys/plant) estimate Safety I Remarks

is

iA

19

20

21

22

Functional block

relay switching of

movable and lift

coils, relay and

arc suppressor.

Functional block

multiplexing gate

firing circuit for

the lift coils

Auctioneering diode

assembly for the

+/-24 VDC cabinet

power/auctioneers

power from 4

suppLies

Positive and

Negative DC power

supplies/provide

power to alarm and

control circuits in

the Power Cabinet.

Overload fuse for

the +/-24 DC power

supplies/provide

overload protection

for the power

supplies

Aging of relay

insulation,

contact welding,

humidity and

corrosion on connections and

insulation

Same as # 11

same as # 7

Same as # 7

Same as # 2

Low gate current

output, trigger

chassis component failure.

Diode opens

Power supply

failure

open fuse

Normally open

contacts fail

open, relay

failure.

LOSS of IZUVAC power to the

gate firing transformers of

the multiplexing gate firing circuit results in loss of

SCR firing to allow a group

of rods to drop.

Failure results in a loss of

do current to the lift

coils.

Reduction of redundancy for

24 VDC for power cabinet

circuits/ detected as a nonurgent failure.

Loss of one power supply

reduces the redundancy of

that voltage in the Power

Cabinet/ arunciated as a

non-urgent failure.

Same as #21

low

medium

low

high

medium

nign Sas as r

low

low

low

Gate firing transformer

provides gate turn-on

current to the SCRs.

Annunciation only.

Annuncation only.

Annunication only.

.1 A & ______________ _________________________
There are three logic cabinet failures which lead to a rod drop and subsequent reactor trip;

therefore, they are classified as a high safety impact. These are failure of the pulse shaper circuit board,

the supervisory memory card, or one of the slave cycler boards. As observed from the operating

experience data (Figure 4.8), the input/output (I/O) circuitry and the supervisor buffer memory functions

each comprised nearly 10% of the reported failures associated with the logic cabinet. The slave cycler

board was the cause of failure for 17% of the logic cabinet failures. Therefore, it is categorized as a high

failure frequency, while the first two are estimated as medium failure frequencies.

5-13
Table 5.3

Control rod drive system FeA; ogic cabinet

_,1Coaqionent/Fw~ction Pal Lure Cause Psi lre Mode Pal Lure Effct~sys/p~aflt) { ~ Freq Isafety actRemFailure 

l o lComponent/Function Failure Caue I Fsilure ode IFiueEffect(sys/p ant) Iestimate 1 aftynpact Remarks

%ft

OLI A.-

I

2

1/0 input circuit

provides signal coupling between

the Logic Cabinet

(LC) and the INHOLD-UT Lever

switch on the

control board for

manual rod

movements.

Supervisory memory

buffer and control/

Provides functions

that nclude: 1)

stops the system after ensuring that

all stove cyclers

are allowed to

finish, 2) provides pulses to drive the

mster cycler until

the first save

cycler begins, 3)

processes command

signals for manual

operation.

Aging due to

moisture ingress,

defective hat

sink, excessive

ambient operating

temperature.

Possibly a

manufacturing

defect.

same as # 1

Pulse shaper card failure

A. Memory card

failure (high output).

S. Lou bank

overlap inhibit

output/supervisory

logic card failure

constant nign not- signal for rod movemonts results in

unidirectional movement of

control rod banks with

improper reactivity control

for load following/ detected

as a rod insertion Limit

alarm by the rod position

indicating system and a

reactor trip on

overteperature.

Failure results in a

spurious command signal with

Same effect as item 1

Spurious command signals inhibit control bank

operation

medium nign

medium

medium

The circuit consists of

a PC-board pulse shaper which provides 8

circuits into the logic

cabinet. The circuits

are identical but share

a common supply.

Two types of PC boards

are used for the buffer

memory and control

circuit and the buffer

memory s two cards.

Each card contains 4

separate buffer

memories which share a

coon board power

source.

high

Low

I 1 .1 & .1 I
Table 5.3

Control rod drive system FlEA: Logic abinet

No. mponent/Function | Failure Cause Failure Mode Failure Effect~sys/ptant) | estimate Safety tIpecj Remarks

3

4

5

Puser, oscillator

and strobe

generator/ provide

10 clock pulses for

initiation of stave

cycler to control

rate of rod bank

stepping.

Local alarm reset

switch/ provides

for local reset of

alarm circuits in

the LC.

Rester

cycler/provides

group 9o pulses

to bank overlap

circuit and gom

pulses to the save

cyclers for the

selection of a rod

group or groups

within a rod bank

selected for

movement.

Same as # 1

Aging, contact

welding, spring

fatigue or

corrosion,

Lubricant

Same as 1

No clock pulse

from pulser/pulser

card failure.

Shorted

contacts/pushbutton switch

failure.

A. High fast pulse

*go notm

output/master

cycler logic card.

B. Slave cycler

0gog low/same as D

or master cycler

card failure.

Loss of clock pulses results

In blocking rod movement.

Short applies a reset signal

to the supervisory memory

buffer and control logic

resulting in spurious reset

signals. Control rod

operation is blocked.

Constant logic high signet

to pulser circuit

supervisory buffer memory

and control circuits.

Results In slow response to

rod command.

A constant goo low causes a loss of slave cycler

operation and blocked rod

movement.

medium

low

low

medium

tow

low

Low

low

The pulser card has two

relaxation oscillators

that free run if an inhibit signel is not

applied. One of the

oscillators sets the

time for a rod group

step and the other sets

the time between

stepping.

Four types of PC boards

are used to form the

master cycler.

tA

kA
Table 5.3

Cgantral r driwe avatem FIAEA ooic cabinet

il | ure Freq. No.ICoirpwent/FunctionI Fai lure Cause I Failure ode I Failure Effect~sys/pl ant) jestimate 6fety Ipat I Remarks

6 Local bank overlap

reset switch

on

7

8

Slave cycler

Alarm circuit for

the logic cabinet/

processing of

urgent and nonurgent alarm

signals entering the logic cabinet

from the power

cabinet, processing

of urgent alarms

from the stave

cycler and

oscillator and

fault detection for

removal of a PC

board & logic power

supply failure.

Aging o contact, corrosion,

arcing, wear

fatigue,

moisture.

Same as # 1

Same as # 1

contacts

short/pushbutton

switch failure.

Circuit board

failure.

Supervisory logic

card failure or

failure detector

card, high or low

alarm output.

Snorted stcn applies a

reset signaL to all counter

cards and the decoder card

that resets the bank overlap

control circuit to a startup sequence for moving

control banks out of core.

lproper rod movement may result.

Incorrect current order to

power cabinet with wrong stepping of CRDMs. Failure

can lead to an alarm at the

PC that blocks rod movement

and drops rod group.

Spurious urgent alarm signal

actuating annunciator and an

inhibit signal blocking control rod movement.

Low

moderate

high

low

high

tow

If system s in

operation when switch

falls, there Is no

effect until rod

movement ceases.

The stave cycler

generates commands to

the power cabinet for

decoding into dc

profile currents. Six

PC boards for the slave

cycler decode the

binary numbers

generated by the slave

cycler to develop the

current commands.

Two boards form the

alarm circuit. The

supervisory logic card

processes internally

generated urgent starm

signals and provides control logic for

processing urgent alarm

signals from the power

cabinet.

a a - a-
qA

4

4

Table 5.3

_ Control r drive system FEA; logic cabinet

Failure Freq.

No. Cowponent/function Fai lure Cause Failure Node Failure Effectisystplmnt) estimate fety Impact Remarks

- Data logging Aging of relay Relay failure Loss of address inputs to tow Formed of PC boards:

relays/provides insulation, the plant computer and to low Each relay card

step pulses to contact welding, the rod position Indicator provides 6 driver

indicate when a rod humidity and causing erroneous operation circuits for a relay or

bank is started or corrosion on of the rod deviation a step counter. They

finishing a bank corrections and monitor. Rod deviation share the same power

movement step. insulation. alarm to alert the operator supply.

of a fault.

10 DC power supplies, Aging of Filter opens or Loss of 120 VAC to main 100 low Power supplies receive

120 VAC source dielectric filter shorts/ VDC and +-15.5 VDC power medium power from RS sets.

voltage filters; filter inductor or supplies reduce rednundancy If the M power fails,

noise suppressionof capacitor failure, of power supplies. o the aux. power will

main end auxiliary imiediate effect on system assume the logic

power feeding for rod movement/ output of cabinet toed without

redundant lCOY and do supply is monitored. los of control.

+/- 15.5 VOC power Failure results in a non- supplies. urgent alarm condition.

11 Power supplies main aging of Loss of main 15.5 Loss of .15.5 VOC supply tow The redundant supplies

+15.5 VDC/ power to transformer VOC power/ fuse reduces the redundancy. NO medium are auctioneered to

logic cabinet alarm insulation due failure, failure immediate system effect non- select the most

and control to humidity, of electronic urgent alarm. positive voltage. Both

circuits. excessive components, over AC lines are fused.

operating voltage protection

temperature, failure

manufacturing

defect, fuse

fatigue,

corrosion.
Table 5.3

Control rod drive system FNEA: logic cabinet

fallure Freq. t _mk

No. Coaponent/Function Failure Cause I Failure ode IFiueEffect(sym/ tent) estMiate I aftyIpact Remarks

12

13

Capacitor filter

ssubLy/ fIltering

of +/- 15.5 VDC

output of suplies.

Capacitor filter

gasebly/ filtering

of* 100 VC output

of supplies.

Aging of

electrolyte,

fatigue.

Filter shorts/ Sae as 11

capacitor fails

Filter shorts/

capacitor fails

Loss of or 15.5 VOC

reduces the redundancy of

logic poser. No immediate

system effect.

Loss of + 100 VDC reduces

the redundancy of relay

power. No immediate system

effect.

medium

medium

low

Aging of low

electrolyte,

fatigue.

Same as 10

00

I .
6. REVIEW AND EVALUATION OF NSPECTION, SURVEILANCE, MONITORING AND

MAINT ANCE

Existing methods for inspection, surveillance, monitoring and maintenance (ISM&M) were

evaluated to determine their effectiveness for detecting and mitigating the effects of aging of the

Westinghouse Control Rod Drive System. This section includes a discussion of the results of an industry

survey on the subject of I, S, M&M, analyses of the existing regulatory requirements for testing and

inspection (technical specifications), and presents several potential techniques for detecting degradation

of the CRD system.

6.1 Evaluation of Current Maintenance Practices

Industry Survey Results

After reviewing the design of the Westinghouse CRD system and assessing the operating experience

with this system, a questionnaire was developed. The purpose of this survey was to expand the

information base to include insights from as many specific plants as possible, including more detailed

information on system modifications, maintenance, and operations.

Responses to the questionnaire were received from ten utilities representing fifteen operating units.

These responses were coordinated and compiled by the EPRI Equipment Qualification Advisory Group

and were transmitted to the NRC and BNL through NUMARC. The results reflect input from older

plants offering their considerable operating experience and from newer plants reflecting design

refinements. One utility also forwarded a system description and a maintenance procedure. A copy of

the questionnaire is in Appendix C.

The first section of the questionnaire contained detailed questions about operating and maintenance

experience and was divided into subsections by component and location - inside or outside containment.

Before describing these results, it is important to list some background on the respondents (Table 6.1).

It is also important to put into perspective the degree of repairs, replacements or modifications

which have been made to various segments of the CRD system at these plants.

1. RCCA and Guide Tube

Eight of the 15 plants responded positively to indications of RCCA and guide tube wear. Of

particular interest is the following

* Three plants (A, B, and C) reported replacing all rods within the last three years due to

excessive wear.

* One new plant (E) reported replacing 5 RCCAs after only 2 cycles due to guide card wear.

One RCCA had to be replaced due to bulging (hafnium hydride).

* Two plants (I and J) indicated that about 5% of the rods had experienced cracking of the

rodlet tips.

6-1
Table 61 Survey respondents

Operating Time Rod Position

W # of Age of Accumulated on Indicator

Plant CRDMs ?hnM Present CRDMs System Rod Tvpe

A 29 18 14 Analog Silver/Indium/Cadmium

B 29 18 14

C 29 15 13.2 "

D 52 3 2.5 Digital Hafnium

E 61 3.8 3.1 "

F 29 20 17.5 " Silver/Indium/Cadmium

G 53 10 2 Hafnium

H 53 9 1 Hafnium

I 53 16 15 Analog Silver/Indium/Cadmium

J 53 16 15 R a

K 53 10 2.3 Digital Hafnium2

L 53 11 4.4 "

M 48 2 2 Analog Silver/Indium Cadium

N 48 2 2 Digital "

0 24 29 293 Analog "

1 Years since initial criticality.

2 Changing to _ enhanced Silver/Indium/Cadmium in future (chromium plated tubing).

3 One drive mechanism at year 12 replaced due to galling of internal mechanism.

* Four plants (C, E, K & L) relocated their fully withdrawn position for shutdown bank rods by

3 steps to avoid localized fretting wear. (Westinghouse recommendation to distribute" wear)

* Two plants (A and B) circumvented guide tube wear problems by replacing all of the upper

reactor internals within the last three years.

2. Pressure Boundary Components

Information was requested on the welds associated with the latch housing to pressure vessel

head, and the rod travel housing to latch housing.

* Plant (I) indicated that a seal weld on a housing for a partial length RCCA housing had to be

repaired due to leakage.

* Plant D modified the design of the vent valve.

* A pinhole leak in the weld at the top of the guide tube housing was discovered at Plant E.

This was repaired by welding.

6-2
3. Coil Stack Assembly

* One stationary gripper coil, after 13 years of service, was replaced at Plant A due to a failure.

* Twelve stationary gripper coils were replaced after 9 years of service at Plant J.

* All coils were replaced on one mechanism at Plant I due to a reactor coolant leak.

4. Cables and Connectors

* Plants A and B noted that a total replacement of cables and connectors is planned for

1990/1991.

* Plants M and N stated that changes in containment temperature have caused connector

problems, especially with the rod position indication system.

* Plant C reported that the original rubber cables were replaced with an asbestos type when they

became brittle.

* Cable ends at Plant E were redressed due to ground loops which developed.

* Plants K and L reported cases where connector pins required straightening.

* Plant 0 replaced cables and connectors; a silicone rubber insulation is used.

5. Rod Position Indicator Coils and Wiring (In containment)

* Plant D noted that the connection pins required tightening and that one cable was replaced

after one cycle.

* Plants K and L replaced cables due to cracking insulation; bent pins were also straightened.

* Plants D and F reported modifications to the RPI subsystem; Plant D added more coils

because 4 rods were changed from a shutdown to a control bank, and plant F upgraded their

system to a multiplexing system. Plant 0 indicated that while the basic design remains unchanged, a different wire, winding process, insulation and varnish are used.

6. Outside Containment Comnonents (Cable. Power and Logic Cabinets)

* Plant C reported that the power supplies required refurbishment by Westinghouse during the

refueling outage in 1989.

* Plants I and J reported failures of power supplies following lightning strikes at the site.

6-3
* Plants A, B, C, 1, J M, and 0 have an analog rod position indication system, while the

remaining plants use a digital system.

* Plant E stated that a Westinghouse field change notice (FCN) was implemented on the RPI

logic cabinet to allow connection of test equipment to record rod drop data.

* Plants K and L indicated that portable air conditioning units are used to cool the rod drive

cabinets during the summer.

* Plants A, B, C, and 0 reported that the forced ventilation system was modified. Plants A and

B altered the direction of air How in order to provide cooler air to the coils, and plant C

installed a shroud cooling system. Plant 0 reported that the system was converted from

natural to forced convection cooling. The air flow was also "channeled' to high temperature

areas. On occasions where cooling was lost, the resultant overheating required coil replacement.

The survey results which address preventive maintenance (PM) for the CRD system have been

separated into three categories:

* mechanical components within containment,

* electrical components within containment, and

* components outside of containment.

The mechanical components within containment are the CRD mechanism (drive rod and latch), the

control rod (RCCA and guide tube), and the ventilation system. The ventilation system is not within the

boundary of this study, however its operability directly affects performance and aging of the CRD system.

In addition, the review of operating experience indicated several occurrences related to problems with

seal welds and vent valves. The questionnaire, therefore, was directed to solicit information on these

areas.

Table 6.2 is a summary of the survey results for PM on the mechanical components. t is interesting

to note that one of the newer plants (E) is employing both eddy current testing and profilometry in its

preventive maintenance program. Eddy current testing uses a probe which produces an alternating

electromagnetic field. This field induces eddy currents in a conductive material which can reveal

differences in the physical properties. Plants I and J noted that eddy current testing was used to detect

excessive fretting wear on the RCCAs. Profilometry uses an instrument for measuring the roughness of

a surface and dimensional changes by a diamond pointed tracer arm attached to a coil in an electric field.

Movement of the arm across the surface induces a current proportional to the surface roughness or

diameter. These methods are discussed further in Section 63.5.

The questions for electrical equipment within containment dealt with the coil stack assembly (lift,

stationary gripper, and movable gripper coils), the cable and connector assemblies for the coils, and the

rod position indication subsystem wiring. The preventive maintenance on this equipment (Table 6.3) is

performed during refueling outages and consists primarily of insulation resistance checks (megger),

conductor resistance tests, and visual inspections for signs of degradation such as wear, corrosion, or

looseness.

6-4
Table 6.2 Preventive maintenance for mechanical components within containment

Component Maintenance Practice Plants Involved & Frequency

RCCA

Latches

Eddy current testing

Profilometry

None

Visual inspection for wear and

crud buildup

EIrJ

E

N/A

Drive Rod F

Seal Welds NDE

Hydro

Remote visual

M,N,C-10% every 10 years

A,B,C;F,KL

Ili

Vent Valves/Plugs Hydro A,B,I,J

Ventilation Clean and inspect

Lubricate fan bearings

Megger motors

All

AD,E,FIMN

D,F,IJ,K,L,M,N

'Interval is refueling unless otherwise noted.

Of a more unique nature is the monitoring of coil stack degradation by plants A, B I and J. Coil

traces of the in and out control rod motions are taken before startup, following a refueling outage. This

technique can be performed at any time during operation as well to detect changes in coil characteristics.

Plants I and J also perform an inspection of all electrical watertight seal connections during each

refueling outage.

Table 63 summarizes the preventive maintenance for the CRD system electrical components within

containment. It should be noted that all plants (except E) reported that they perform some form of

electrical testing on the CRDM and rod position coils. All plants (except E) reported that they routinely

inspect the electrical connectors for any signs of degradation.

6-5
Table 63 Preventive maintenance practices for electrical components within containment

Comonent Practice

Plants Involved

& Frequency

Coil stack assembly Insulation resistance

Coil resistance

Coil timing signature traces

Polarity check

D,F,G,H,I,J,O

All except E

A,B,IJ

F,K,L

Cable Insulation resistance

Visual A,BgEM, N

Connectors Inspect for tightness

Check watertight seal

All except F

Ij

A,B,I,J

ABCDF,I,JKI,0

F,1i,

Rod Position

Indication subsystem wiring

Visual

Resistance measurements

Insulation resistances

*AU frequency intervals are refueling outage.

The power sources and logic necessary for properly operating the system are generally located

outside of containment. This equipment is, therefore, accessible to personnel during power operation.

As described in Section 2, this portion of the system is continuously monitored during operation to a

certain degree through sensors which communicate with annunciators in or near the control room.

Abnormal conditions in the power supply output, for instance, produce an alarm which would result in

corrective actions. A unique practice among the surveyed plants exists at Plants K and L Their

preventive maintenance program includes replacing all of the 10 ampere fuses of the stationary and

moveable gripper coils at a three-year frequency. Plants I and J replace selected control fuses in the

logic cabinets every refueling outage. This replacement mitigates the effects of aging, which may cause

the fuses to prematurely fail.

The preventive maintenance for CRD system components outside of containment are summarized

in Table 6.4. The preventive maintenance of the MG Set, while not a part of this study, is included here

for background information. While this equipment is not considered to be safety related, its failure

results in a loss of power to the coils and a reactor trip.

6-6
Table 6A Preventive maintenance practices for components outside of containment

Component Practice

Plants Involved &

Frequencv*

Cables, Connectors

and Terminations

Power Supplies

Control/Logic

Cabinets

Insulation resistance

Resistance check

Visual inspection

Calibrate protective devices

Vendor refurbishment

Functional test

Visual inspection

Vendor refurbishment

Replace fuses

Measure cabinet temperature

Timing/functional test

D,F,G,HKIL,O

D,F,O

AB,O

FIJXL

C

F,IJ,KLMN,O

A,BEG,H

IJ,KL - 3 yrs

GH,KL

KL

MG Set Grease bearings

Check vibration

A,B,E

A,B

'A1 PM intervals are refueling unless specifically stated otherwise.

As part of the survey, the utilities were asked to indicate whether they had initiated a reliability or

trend analysis program for the system. Eight of the fifteen plants responded affirmatively with the

following additional information:

* One plant trends CRDM coil temperatures.

* One uses the NPRDS program for detecting trends plant-wide.

* Six plants use their work request system to monitor component and system failures.

* Two plants also obtain reliability information from their parts replacement program.

* Two plants include surveillance test results in their trend analysis in addition to the work

requests.

The survey also asked for the utility's opinion regarding the monitored parameters, tests or

inspections which are most important for assuring the operational readiness of the CRD system. The

results are depicted in Table 6.5 and clearly reveal the opinion that testing which is required by the

technical specifications is useful for determining system performance. These specific requirements, and

how they are addressed by utilities, are discussed further in Section 6.2. Other favorable means for

determining and maintaining the operational readiness are through circuit tests, calibrations of

components, and thorough visual inspections.

6-7
Table 6.5 Determining and maintaining CRD system operational Readiness

(15 respondents - most Identified 3 useful means)

Number of Respiondents

Surveillance Testing 13

- Rod Exercise

- Rod Drop Timing

Electrical Preventive Maintenance 9

- Insulation Resistance Tests

- Coil Signature Traces

- CRDM Coil Fuse Replacement

Inspection/Calibration 4

- RPIS Calibration

- Power Supply Checks

- 18-month Rod Control System Inspection

Summary of Current Practices

A survey of the current practices at nuclear power plants related to the Westinghouse supplied

control rod drive system has been completed. Responses obtained from 15 plants were evaluated and

are summarized as follows:

• The utilities agree that the activities required by the technical specifications (rod drop timing

test and rod exercise test) are beneficial in determining the operational readiness of the system.

* Preventive maintenance for electrical components within containment (cable, connectors, and

coils) dominate the overall maintenance resources applied to this system.

* A few plants are using relatively advanced techniques for detecting mechanical and electrical

degradation. These techniques include eddy current testing, profilometry, and circuit signature

analysis.

• Most of the utilities modified various components of the system.

Those modifications which address the mitigation of aging effects include:

1. Replacement of the upper reactor vessel internals in response to degrading support pins on the

control rod guide tubes.

2. Upgrade ftom an analog rod position indication system which was subject to drift problems, to

a digital multiplexing design.

68
3. Replacement of the original rubber jacketed cables with an asbestos type.

4. Permanently installed equipment to facilitate required/desired system testing. This modification

addresses the influence of testing on aging (disconnecting/

reconnecting), as well as the effect of human interaction (minimizes the potential for test and

maintenance error).

6.2 Westinghouse Standard Technical Specifications

The reactivity control systems for Westinghouse plants must conform to specific design, operating,

and surveillance criteria as established by the technical specifications (tech specs). These specs establish

requirements for assembly position, drop time, and design, as well as the minimum surveillance required

to demonstrate compliancen.

6.2.1 CRD Position Requirements

The reactivity control system is required for reactor control and shutdown, therefore it is essential

that the control rods be positioned correctly and that instrumentation be available and operational to

accurately determine their positions. The tech specs require that all control rods, which are inserted in

the core, be operational and that the indicated position be within ± 12 steps (approx. 7.5 in.) of the

demand position of the group step counter. Likewise, the control rod and the demand position

indication system is required to be operable and capable of determining the control rod position within

± 12 steps. If a rod is inoperable or unable to trip, the shutdown margin must be recalculated and

verified to be sufficient within 1 hour, or the plant must be brought to hot standby within 6 hours. If

more than one rod is mispositioned, the plant must also be in hot standby in 6 hours.

The control rod positions and indicating system are verified to be correct and operational once

every 12 hours. Normally this is done by comparing the readouts from both. If the rod position

deviation monitor is inoperable, verification is performed every 4 hours by alternate means until the

system is repaired and operable. Also, the tech specs require that each full length control rod not

inserted be demonstrated to be operable at least once every 31 days by moving them at least 10 steps in

any one direction.

During hot standby, hot shutdown, and cold shutdown, one rod position indicator, excluding the

demand position indicator, shall be operable and capable of determining rod position within ± 12 steps.

This is verified by performing a channel functional test once every 18 months.

In addition to the requirements for general position indication, all shutdown rods are required to

be fully withdrawn. This is verified once every 12 hours after reaching criticality and every 15 minutes

during reactor startup.

Limitations on the use of part length control rods are included in the tech specs, but since these are

no longer used, they are not included in this discussion.

6-9
6.2.2 Control Rod Drop Time

The standard tech specs require that the drop time be less than or equal to 2.2 seconds for all full

length shutdown and control rods, with all reactor coolant pumps operating and with the average coolant

temperature greater than or equal to 541TF. The 2.2 seconds shall be measured from the beginning of

decay of stationary gripper coil voltage to dashpot entry. If a rod fails this drop time requirement, then

the cause must be identified and corrective action taken prior to startup or continued power operation.

If all the reactor coolant pumps are not operational at the time of the test, then limits are placed on

reactor thermal power.

Drop time tests are performed on all rods at least once every 18 months, as well as each time work

is performed on the CRDMN which could affect drop time and following the removal of the reactor head.

6.23 Design Requirements

The standard tech specs require that all full length control rods contain a nominal 142 inches of

absorber material. Additionally, the nominal values of absorber material shall be 80% silver, 15%

indium, and 5% cadmium. The control rods shall be stainless steel clad.

The tech specs reference the ASME Boiler and Pressure Vessel Code as applicable to Class 1

components. Section XI Rules for Inservice Inspection of Nuclear Power Plant Components, requires

that the welds on 10% of the peripheral CRD housings be subjected to a surface inspection each

inspection period. In addition, the CRD housing bolts, studs, and nuts must be visually inspected

following each disassembly. As per the tech specs, any component failing an inspection must be returned

to full operability before any increase in coolant temperature, above the minimum temperature required

for non-destructive testing (NDT), can occur.

6.2.4 Operating Practices

Typically, utilities adopt individual procedures to perform tests which demonstrate compliance with

specific tech spec requirements, such as drop time, control rod stepping, and operability verification of

rod positioning systems. Procedures for operation dictate rod group positioning, withdrawal, or insertion

requirements.

The procedure for verifying control rod drop time uses a high speed recorder, which produces a

chart depicting rod position and stationary gripper current. The initiation of the rod drop can be seen,

as well as the entry of the rods into the dashpot, by observing the induced voltage trace. Only one bank

of rods is withdrawn at a time, and each rod is tested individually. Some plants utilize a Rod Drop Test

Cart which provides testing of multiple rods.

Verification and calibration of the rod position indication systems following refueling consist of a

series of specific control bank insertions and withdrawals. The rod position is measured in terms of DC

voltage. The position as indicated by the group step counters is compared to the rod position

measurement to determine if the position indication system is accurate to the ± 12 steps.

Generally, during normal plant operation the required verifications for rod positioning are

accomplished without rod movement. Rod exercising, required at least every 31 days, only minimally

impact control rod wear, and may provide a benefit of relocating the rod, and thereby limiting any flow

induced wear with the guide thimbles or upper internals.

6-10
6.3 Inspection. Surveillance Monitoring, and Maintenance (I. S. M & M) Techniques

The IS,M & M techniques which are applicable to the CRD system, were evaluated to determine

those that are most effective in detecting aging degradation in an incipient stage. Visual and instrument

aided methods, including on-line techniques, are discussed with consideration for practicability.

A review of artificial or accelerated aging techniques is made and compared to data available on

naturally aged hardware. Included here is an analytical technique which uses actual experience in a

predictive model to determine optimum intervals for maintenance.

6.3.1 CRDM Data Analyzing System 4

The Japanese developed a system which detects degradation in the CRDM through on-line analysis

of current signals and noise that is generated during rod motion. As shown in Figure 6.1, the system

analyzes five parameters for each CRDM: current data from three coils (lift coil, movable gripper coil,

and stationary gripper coil); sound data, which can be monitored by an accelerometer mounted on the

top of the CRDM pressure housing; and a logic signal generated from the rod drive timing circuit.

The movement of the magnetic pole pieces through the magnetic field produced by the energized

coils induces a current which appears as a dip on the coil current plot (Figure 6.2). By analyzing the

degree of dip on each current curve together with the sound data, information on drive rod, coil, and

magnet performance is obtained. Input to preventive maintenance needs on the CRDM is achieved by

this system. The system has on-line capability which permits continuous monitoring of the rods during

normal power operation. Figure 6.3 is an example of the data obtained during rod motion.

Material received with the industry survey results indicates that this type of system is being used at

some plants. A preventive maintenance procedure entitled Operational and Timing Check of the Full

Length Control Rod Drive Mechanisms' uses a high speed recorder, microphone, and appropriate signal

conditioning equipment (Figure 6.4) to monitor traces during rod movement. The procedure is only

performed when the reactor is shutdown and the results are forwarded to Westinghouse for review and

evaluation. No acceptance criteria were provided in the procedure.

63.2 Statistical Techniques

Methodologies have been developed for predicting the frequency of maintenance or the

replacement of components. These statistical approaches should not be overlooked when evaluating IS,

M&M techniques. In fact, the survey of industry practices discussed in Section 6.1 revealed that seven

of the fifteen plants monitor CRD system failures to identify trends that indicate decreasing reliability.

6-11
Concept of CRDM Data Analyzing System

CRDM control unit

Power cabinet

Logic cabinet

Acceleration sensor

Charge Amp. -G Logic signa

Coil current data

DC Amp. AD converter Data recorder

CROM Krnter prter

Mini-computer

CROM Data Analyzing System

FIgure 6.1 CRDM data analyzing system - conceptual

I'mI

'm)

3

40 r ~rt

it

figure . ynamic response of CRDM

6-12
Example of CRDM Data Analyzing

o Coil current signal

o Filtered signal

6 Sound signal

a o

I II

I I 

II

I I

'I I A

I...

I

I

d lI

Closing sound Release sound

Figure 63 Example of data generated during CRDM motion

Figure 6.4 CRDM test setup

6-13
One of the methods reviewed has been directly applied to the Westinghouse CRD systems. This

method uses data on operating experience to create a model for predicting the future performance of

the CRD system at a specific plant. This predictive model, based on a Weibull distribution, requires the

large data base which Westinghouse has to obtain accurate results. The Weibull distribution can be

made to model a wide range of life distribution characteristics for different classes of items. For each

failure of a subcomponent within the CRD system, the failure time and the number of survivors up to

that time is computed. A number known as the hazard value is calculated for each failure (100 x

1/survivors). The cumulative hazard value is the sum of all previous hazard values up to that given time.

These are plotted on a log-log scale as illustrated in Figure 6.5.

A least squares fit line drawn through the points yields two Weibull parameters, alpha and beta.

Alpha is commonly known as the expected life of a component (62% probability of failure) and can be

found at the intersection of the line with a cumulative hazard value of 100. Beta is the classic measure

of wearout or aging and is the inverse of the slope of the fitted line. For this actual example of a

Westinghouse CRDM subcomponent, alpha = 1.23 million hours and beta = 1.244 indicating that this

particular subcomponent is expected to exhibit a slowly increasing failure rate with time. All of the

subcomponent models are then summed to create an overall failure model for the CRDM. Recommendations are then possible for repair or replacement actions.

o 1.OE06

P

E

R

A

T 1.OE05

N

H

o 1.OE+04

U

R 0

S

1.OE+03 - , , , , , , , , , , , , , , , , ,

0.01 0.1 1 10

CUMULATIVE HAZARD

Figure 6.5 Plot of hazard values for CRD system subcomponent

6-14
633 Monitoring Control Rod Guide Tube Support Pin Degradation

The French have had repeated problems with control rod guide tube pins. These problems have

been detected only after an actual failure has occurred. This problem is generally indicated by a 'loose

parts monitoring system' alarm, or after the loose parts have caused damage to steam generator tubes.

This same problem was also experienced to a lesser extent by the Japanese in the late 1970s, and in the

United States in the early 1980s.

To minimize the risk of a pin rupture during power operation, the French are conducting

inspections at each refueling cycle to detect the presence of cracking, and to evaluate the potential for

the crack to lead to a rupture during the next operating cycle. This is accomplished by visual

(underwater TV camera) and ultrasonic techniques supported by accelerated aging test loops. The need

to inspect every cycle is due in part, to the uncertainties associated with ultrasonic testing, although

recent results from ultrasonic testing have compared favorably with conclusions derived from destructive

testing.

The French have also established a test loop in which the pins are subjected to the representative

temperature and flow conditions experienced in the Framatome PWRs. These pins have 10,000 more

hours of simulated operation than any pin in the Framatome plants. By this simulation, the French

expect to detect any developing problem due to aging in the test loop before it occurs in the operating

plants. Since there is no radiation, laboratory metallurgical examination techniques can be easily

employed.

At the Ringhals PWR plant in Sweden, a means of combining the ultrasonic and visual inspection

needs for the guide pin was enhanced by development of a jig. The inspection of the guide tube pin

is performed with the upper internals positioned on a stand in the portion of the refueling level pool

reserved for it. A manipulator arm, with ultrasonic probe and TV camera attachments, can be moved

radially and axially so that each of the 106 pins can be closely inspected. As illustrated in Figure 6.6, the

ultrasonic probe can be brought into direct contact with each pin and rotated. This should facilitate

accurate and repeatable readings.

63.4 Life Cycle Testing-Monitoring Wear Rates

Programs aimed at reducing the cobalt inventory in a nuclear plant have identified the

Westinghouse CRDM as one of the significant contributors due to the wear of its subcomponents 9 . As

illustrated in Figure 6.7, the CRDM latch assemblies and the locking button at the base of the drive rod

are the parts with a high cobalt content that are subject to wear.

The latch and link pins, as well as the latch arm and link, shown in Figure 6.8, are either hard faced

with Stellite 6 or are made of Haynes 25. There are six sets of these parts for each CRDM. There is

one locking button for each CRDM, which is made of Haynes 25.

Life tests have been conducted in which the wear of the high cobalt material was measured. These

life tests represented 20 years of plant operation and indicated that the wear of the high cobalt material

could range from 265 grams to 751 grams for 53 CRDMs. It should be noted that the life cycle testing

assumed a high (conservative) number of steps over the 20 year cycle but does not include a loss of

material due to corrosion.

6-15
'4ih ..; -

FIgure 6.6 Guide tube support pin and ultrasonic probes

635 Profilometry and Eddy Current Testing

Profilometry and eddy current testing are wear detection techniques which have been successfully

employed in nuclear plants. Steam generator tubes, fuel rods, and rotating shafts are examples of these

applications. These same techniques can also be used to monitor control rod drive mechanisms for wear

and cracking.

Profilometers generally consist of two linear variable differential transducers (VDT) placed 180

apart. They are then moved axially over the full length of the specimen. The inside of a steam

generator tube or the outside of a fuel rod are two surfaces of interest where accurate data have been

obtained. Sensing heads contact the surface and monitor changes in the surface or diameter. The

responses are converted into an electrical signal which can be displayed on a strip chart recorder.

6-16
CANOPY

NOTE: HIGH COBALT PARTS

UNDERLINED

CANOPY LWER JI

IFIELD WELD)

READ ADAPTER

(NOT suPPUIO

BY WEMD-----

Mgure 6.7 Model LIO6A full length CRDM

showing location of high cobalt

parts1 '

6-17
Figure 6.8 Details of high cobalt parts In latch assembly"

Some profilometry systems use a rotating sensor. As the probe head is rotated and moved along

the axial length, a helical image of the tube geometry is obtained. A profilometiy output using the

rotating sensors is illustrated in Figure 6.9. A steam generator tube is the subject of examination, and

is used to track dent growth. The profile can be used to calculate strains, and to assess the potential for

tube eaks'A

6-18
Itow* CoiP2 PlAtent

Rowil CoiIe2 platedi

Max Strain

Min Dimer

Nom iamer

Max Diametr

Reduction

.1 inctes

15.2 %

692 mits

781 mils

816 mili

83 mi

flew(in) Vs Radius(rni)

Couponents at Maximm Principe Sbain

CIrcuar Strain 15.2

AxI Strain: 1.4

Sheer Strain: 2.5

Cro Section at Ebation:O.100

iche

2

I

0

1

0 400

Figure 6.9 Profilometry for steam generator tuber

Figure 6.10 illustrates the use of profilometry for comparing the diameter of a fuel rod along its

entire length, between the beginning of the operating cycle (BOL) and the end of its operating life

(EOL). Its ability to accurately detect changes to the .001 of an inch, makes profilometry a viable

technique for monitoring the thickness and wear of control rod guide tubes.

Eddy current testing can also be used to detect and locate incipient defects in the CRD system.

This test involves the simultaneous excitation of a probe coil at two different frequencies (hundreds of

KHz). The resultant flux induces current to flow within a confined volume, and the magnitude and

phase of these currents are reflected in electrical voltages. In a nuclear fuels application, defects in the

cladding (i.e., stress corrosion cracking) disrupt the flow of eddy currents. This disruption changes the

flux near the test coil, which alters the output voltage. Similar changes of eddy current would occur due

to defects in the control rod drive mechanism.

6-19
1.077

(0.4241

Preirradiation Diameter

1.072

(0.4221 BOL

21.067

-(0.420)

1.062

0.418)

1.056

(0.416)

1.052 . ..

(0.414) cm 50.80 101.60 152.40 203.20 254.00 304.80 355.60

in. 120) (40) (60) (80) (100 (120) (1401

Axial Location, cm (in.) From the Bottom of the Rod

Figure 610 Fuel rod diameter prorfled

6.3.6 Electronic Characterization and Diagnostics System (ECAD)

The ECAD system uses electronic instrumentation to characterize circuit continuity and insulation

integrity. It can be used to detect degrading circuits by examining several common electrical parameters.

It has the ability to acquire, store, analyze, and trend large quantities of data over several monthsA.

6-20
In a control drive system application, ECAD has been used to measure coil resistance, insulation

resistance, capacitance, and dissipation factor. he DC coil resistance measured at one plant using

ECAD was consistently higher than 1.0 ohm. One coil's resistance was significantly lower than the

others, indicating the potential for a short circuit in the coil windings. This lower resistance was also

reflected in a lower coil inductance. The intent of the inductance in conjunction with the measurement

of dc resistance is to identify the condition of the coil.

Moisture intrusion has been a common cause of cable and connector degradation. ECAD uses

capacitance and dissipation factor to determine the presence of moisture. As moisture penetrates into

a cable, the dissipation factor and capacitance increase.

6-21
7. DISCUSSION OF CRD SYSTEM RESEARCH AND NRC EXPERIENCE

The Westinghouse control rod drive system has been the subject of study by industry and the NRC.

Those studies which provided insights related to the goals of the NPAR program were reviewed in depth

and are summarized in this section. From the industry side, the research emphasis has been on reliability

analysis and plant life extension. The NRC's research and experience have been associated with the

interaction of the CRI) mechanism with the fuel and analysis of a small number of CRD system

operating events. All of this information was evaluated as part of this aging study.

7.1 NRC Research and Experience

In the last decade, several reports, bulletins and information notices have been issued by the NRC

related to the Westinghouse control rod drive system. These documents vary in complexity from a very

detailed evaluation of control rod guide tube wear (NUREG-0641) to a cursory discussion of the

problems of the control rod drive mechanism as covered in the NRC's annual fuel performance report

(NUREG/CR-3950). Also reviewed were the information notices and bulletins pertaining to various

subcomponents of the CRD system, as well as a case study report by the Office for Analysis and

Evaluation of Operational Data (AEOD) of localized wear on rod cluster control assemblies

(AEOD/E613). Portions of these documents which are pertinent to this study, are summarized here.

NUREG-0641. Control Rod Guide Tube Wear In Operating Reactors'

Published in June 1980, this report describes evidence on the wear of control rod guide-tubes,

which has been observed in operating PWRs, and describes measures being taken by Westinghouse, the

utilities, and the NRC to deal with this generic problem.

As described in Section 2 of this report, the control rod guide tube assembly is part of the upper

core structure and provides the housing and guide path for the control rods. The guide tube thimbles

are an integral part of the fuel assembly and interact directly with the RCCA. According to the NRC

staff, the structural integrity of the guide tubes is required under both normal and accident conditions in

order to:

1. maintain a coolable core geometry, and

2. permit control rods to scram, as required by the safety analyses.

This report describes the results of several Westinghouse inspections in which the wear of control

rod guide-tubes was noted. The first inspection which was conducted in a hot cell, examined specimens

from two assemblies. Westinghouse also performed inspections and eddy current testing on the wear of

guide tubes at two operating facilities. Their results are summarized as follows:

1. the wear is localized at the axial elevation corresponding to the fully withdrawn position of

the RCCA,

2. the wear depth is time-dependent,

3. the core location (radial position) had no effect on the amount of wear, and

4. no through-wall wear is projected for the guide tubes for 250 weeks of continuous operation

under a parked RCCA.

7-1
The NRC agreed with the wear model developed by Westinghouse in that the major variable was

believed to be control rod vibration. However, the NRC did not feel the results were directly applicable

to 15 x 15 and 17 x 17 fuel designs and recommended further inspections and analysis. This concern for

wear was limited to the Westinghouse fuel design which uses zircaloy control rod guide tubes. The

stainless steel control rod guides used in a second fuel assembly design have an inherently harder wear

surface that is not susceptible to significant wear.

After the publication of this report, the NRC's Reactor Safety Branch recommended approval of

the analysis for Westinghouse 15 x 15 fuel designs. They did recommend some limitations on the 17 x

17 fuel designs; primarily associated with limiting times on the first operating cycle.

AEOD Enolneering Evaluation Report - E6133

In December 1986, the Office for Analysis and Evaluation of Operational Data (AEOD) published

an engineering evaluation report, which described localized wear of the rod cluster control assembly

(RCCA). This study was initiated because of the discovery of wear-related degradation at two

Westinghouse plants, Point Beach Unit 2 and Kewaunee. Three types of degradation were noted:

1. wear due to rod motion,

2. wear due to flow-induced vibration, and

3. intergranular stress corrosion cracking of the rodlets.

As illustrated in Figure 7-1, and described further in Section 2, the RCCA consists of a hub and

spider arrangement with the neutron absorber contained in stainless steel tubes, which fit in the control

rod guide tubes within the fuel assembly. During normal control rod stepping or reactor scrams, wear

of the RCCA can occur due to its sliding interface with the guide plates. When the RCCA is fully

withdrawn, wear can occur due to the flow-induced vibration. The third type of degradation described

in the AEOD study was discovered at Point Beach where a 2-inch longitudinal crack was found on one

rodlet. This was initially determined to be a localized tubing defect. Subsequent to the AEOD report,

it was determined that the crack was, in fact, axial hairline tip cracking due to the interaction between

the absorber and the cladding, and radiation induced effects in the tip region of the rodlet'.

This AEOD report concluded that wear and degradation of the RCCA occurs due to normal

operating stresses, and that the damage mechanism appears to be long term. This wear is a safety

concern because it could cause the loss of absorber material from the rodlet, or binding of the control

rod. Information Notice 87-19 was issued to alert all Westinghouse licensees of the problems

experienced, and the need to schedule inspections to detect the extent of degradation.

Two supplemental issues were raised as a result of this study. The first was whether a tech spec

change was required to accommodate a modification to the fully withdrawn control rod position.

(Westinghouse recommended that localized wear could be minimized by periodically changing the fully

withdrawn position, especially for the shutdown rods.) The second issue was that neither of the two

incidents had been reported via the LER or NPRDS databases; similar wear degradation may have

occurred at other sites.

7-2
Control Rod

Assembly

Rod

Absorber

Fuel Rod

Absorber Rod

Guide Thimble

Bottom

Nozzle

Top

Nozzle

Grid

Assembly

Grid

Assembly

Dash Pot

Region

Figure 7.1 Cutaway of typical fuel

assembly with control rod3

7-3
NUREG/CR-3950. Fuel Performance Annual Report. Vols. 1-62'

The NRC has issued an annual report since 1978 summarizing the performance of nuclear fuel in

commercial light water reactors. While the report emphasizes fuel, other topics relevant to control rod

drives are discussed as summarized below1. Control Rod Guide Tube Support Pins The 1987 annual report states that while broken

control guide tube support pins continue to be found, the number of such events should

decrease in the future because of the corrective actions that have been implemented. The

report identifies the Westinghouse PWRs which have had support pin failures, including the

following:

* the first pin failures in a domestic plant occurred at North Anna 1 in 1982,

* the largest number of pin failures to date have occurred at Point Beach 1,

* at Prairie Island-1 a complete changeout of reactor internals was made rather than just

repairing the pins, and

* the 102 guide tube split pins at Turkey Pointy were replaced.

The report points out that the replacement split pins installed on Electricite de France's (EDFs)

older PWRs have begun to crack. In 1988 a split pin broke loose at Gravelines-1, and ultrasonic

inspection revealed that the pins contained stress corrosion cracks. All 122 split pins were replaced;

however, the French reported in June 1988 that fresh cracks were discovered. The on-going problems

that the French have had with control rod guide tube split pins are discussed further in Section 4 of this

report.

Events related to Westinghouse control rod drive system cited by NUREGICR-3950 are

summarized in Table 7.1.

NUREG/CR4731, Residual Life Assessment of Malor Llght Water Reactor Com=onents." 2

In a study performed by Idaho National Laboratory (INEL) for the NPAR Program, some

observations and recommendations were made regarding the aging of PWR control rod drive

mechanisms. This research included an overview of the age-related degradation mechanisms with the

potential for affecting the life extension of PWR CRDMs and reactor internals.

The major sources of age-related degradation for CRDMs as cited by this study are thermal

transients, such as plant heatups and cooldowns, latchings and unlatchings, and the high temperature

corrosive environment. The two CRDM failure modes, which are a major safety concern, are pressure

boundary leakage and failure to insert control rods.

The study concludes that many of the factors relating to lifetime predictions of CRDMs are

unknown.' It recommends that several activities be conducted on CRDM aging related issues, including:

74
Table 7.1 Control rod drive events from NUREG/CR395011P - EVENT CAUSE

*44

Year Plant CRDM Debris MG Set Rod Drop Control Mlsulwgn. Loom or Pow Seat

Cooling In CRDM Failure Ca"e Boards ment Broke Cabet Wldd

Unkno" Set Faire Failure

r8 Diablo X

________ _ Ca n

198 Turkey X

Point 3

198 Turkey

Point 4

1986 MeGnire 2 X

Farby 2 X

Beaver X

_____ ____ Callaw ay I __ _ _ _ ___ _ _ _ __ _ _ _ _ _

Indian X3

Point 2

1985 McGuiT. 2 X

1984 Catewba 1 X

Point Beach X

Surry 1 X

1933 Turkey X

Point 3

t Boric add cryts cowed corrosion of CRDM for ductwork

2 Iwo events attributed to eleted amblent temperature

3 One rod was Inoperable dne to misaligrnent.

4 Pin on connector for moeble gripper coil pusbed out of engagement.
* A program to determine the integrity of the CRDM seal welds which are not readily

accessible.

* Periodic electrical diagnostic tests to determine changes in electrical parameters that indicate

the degree of wear or binding in CRDMs.

* CRDMs be periodically pulled to measure the wear. Consideration should be given to

rotating them to other core locations.

Information Notice 89-31. Swellin2 and Crackint of Haffium Control Rode

This notice describes abnormal wear and swelling, which were identified in Hafnium RCCAs at the

Wolf Creek and Callaway Plants. Some foreign experience with this phenomenon is also noted.

The principal safety concern associated with this effect is the inability of a control rod to fully insert

into the core because of interference between control rods and guide tubes. The NRC stated that it is

concerned about the long-term continued operation of nuclear reactors with swollen or cracked Hafnium

control rods. They emphasize the importance of detecting this degradation early so that corrective action

may be completed to preclude any deterioration of the safety function of the control rods.

Information Notice 87-19, Perforation and Crackdne of Rod Cluster Control Assemblies"

This notice describes events at Point Beach, Kewaunee, and Haddam Neck where fretting wear and

cracks occurred in the RCCA. While Westinghouse had conservatively estimated that this type of wear

would not cause excessive thinning for at least 15 years of operation, the three reactors where problems

were discovered had been operating for less than 13 years.

The safety concern addressed by the NRC in this case is that a breach of the RCCA tubing could

release activation products into the reactor coolant. This release could reduce shutdown margin due to

the decrease in control rod worth.

This notice refers to the AEOD study E613 related to the fretting wear resulting from the flow

induced vibration between the rods and guide supports during several months of steady state operation.

According to Westinghouse, this fretting wear encompassed one-third of the circumference of the rod,

and the depth varied with the amount of time RCCAs were in the withdrawn position.

Information Notice 87-05. "Miswiring In a Westin2house Rod Control System"

An error in the wiring of circuit cards in the Westinghouse-supplied rod control system at Beaver

Valley Unit 1 was the subject of this notice. This miswiring resulted in movement of an incorrect bank

of rods, thereby violating the tech spec rod insertion limits. This limit ensures that the reactor will be

placed in hot shutdown following a reactor trip. This problem was determined to exist since initial

installation and was plant-specific. Drawings provided by Westinghouse were found to be correct.

7-6
Information Notice 86-103 Dearadation of Reactor Coolant System Pressure Boundary from

Boric Acid Corrosion"

While this notice addressed itself to problems which had occurred at plants designed by

Combustion Engineering (C-E), the concerns expressed are also valid for Westinghouse PWRs. In fact,

a supplement to IN 86-108 issued in April 1987, described leakage of boric acid which plugged the cooling

ducts for the CRDMs at a Westinghouse PWR. Corrosion of connectors was also noted.

Infornation Notice 854. "Lghtning Strikes at Nuclear Power Generatin2 Stations"

This notice describes several incidents of electrical surges caused by lightning which caused

failures in the rod drive control system. The loss of power to multiple rods caused them to drop and led

to reactor scrams.

At Zion units 1 and 2, the electrical transient from a nearby lightning strike blew fuses in the rod

drive power cabinet disabling several dc power supplies. Subsequent testing verified that noise induced

on the ac input to one power supply would trip the main and auxiliary power supplies.

At Byron Unit 1, induced voltage from a lightning strike caused the failure of four rod drive

power supplies. Ten control rods dropped into the core resulting in a reactor scram.

In the above cases, as well as several other examples provided in the notice, modifications to the

lightning protection system were made to preclude reoccurence.

Information Notice 85-14. 'Failure of a Heavy Control Rod (BC) Drive Assembly to Insert on

a Trip Signal"

A drive rod at a Westinghouse plant overseas became stuck due to a disengaged breech guide

screw. Subsequent testing at similar U.S. plants revealed multiple examples of inadequate applied torque.

The potential for a similar event was evident if the condition was permitted to remain. Westinghouse,

therefore, developed a procedure for inspection and repair to stop the screw from coming loose.

Information Notice 82-29. "Control Rod Drive (CRD) Guide Tube Support Pin Failures at

Westinghouse PWRs'

This notice discusses several control rod drive guide tube support pin failures which occurred

between 1978 and 1982. While the safety consequence of a single pin failure was found to be limited,

multiple pin failures could affect redundant safety systems. Considering the potential common-mode

failure mechanism of stress corrosion cracking, the NRC expressed concern that several pins could fail.

This was considered to be a safety concern due to the existence of loose parts rather than possible

misalignment of the CRDM.

Westinghouse analyzed the failed pins and revised the heat treatment technique. Westinghouse

now recommends that the pins be solution heat treated at 2000F for 1 hour and age hardened at

1300F for 20 hours to minimize the stress corrosion cracking problem. A reduction of the torque on

the lock nut to 130 ft. lbs. was also specified. It should be noted that Westinghouse has revised its

recommendation for heat treatment and that the torque values vary among plants due to the variations

in applied operational loads#.

7-7
NRC Standard Review Plan2 '

Four sections of the standard review plan (SRP) address the control rod drive system as described

in this aging study. They cover the structural and material aspects of the CRDM and guide tubes, as well

as the function and operation of the system. Both normal and adverse operating conditions are addressed

as described below.

Section 3.9.4 Control Rod Drive Systems

For electromagnetic systems, such as the Westinghouse design, the review under this SRP section

is limited to the mechanism portion of the system. The Mechanical Engineering Branch (MEB) of the

NRC reviews the non-pressurized portions of the system to 'determine the acceptability of design margins

for allowable values of stress, deformation, and fatigue used in the analyses."2

' The loadings identified

in the SRP, which are imposed during normal plant operation, include pressure and temperature effects.

These are added to loadings associated with other dynamic events, including seismic. The resulting

response must be within certain stress or deformation limits to assure operation of the system during and

after the event.

Operability assurance is addressed in the SRP through review of the life cycle test program and

mechanism functional tests. The SRP directs that the life cycle test program determine the ability of the

drive mechanisms to function over the full range of temperatures, pressures, loadings and misalignments

expected in service. These programs should include functional tests to determine rod insertion and

withdrawal times, latching operations, and scram times. The testing should also demonstrate the ability

to overcome a stuck rod and wear.

Excessive wear, malfunction of components, and operating times beyond determined limits would

be cause for re-testing.

Section 3.9.5 Reactor Pressure Vessel Internals

This review plan addresses the structural and mechanical elements inside the reactor vessel

including the CRDM guide tubes. Of particular interest is its reference to Section 3.9.2 regarding flowinduced vibration testing. Based on the unexpected wear of the CRD system, which has occurred due

to this phenomenon, it is conceivable that the original tests and analyses were not as conservative as

assumed. Of a more generic nature, this review plan requires that the design of the CRD guide tube

must withstand the most adverse loading postulated "without loss of structural integrity or impairment

of function."

Section 4.5.1 Control Rod Drive Structural Materials

This segment of the SRP is directed towards the CRDM up to the coupling interface with the

control rod, and does not include the electrical system for actuating the CRDM. General Design Criteria

(GDC) 26 is referenced as it relates to the control rods reliably controlling reactivity changes so that fuel

design limits are not exceeded.

Specific guidance is provided to the reviewer concerning the material specifications that should

be evaluated, including heat treatment and requirements for ferrite content. Of interest here are the

specific concerns regarding stress corrosion cracking, which has occurred in several subcomponents of

the CRD system. The SRP further directs that all materials selected for application in the CRDM

conform with the applicable code case in Regulatory Guide 1.85, Materials Code Case Acceptability,

ASME Section m Division 1.

7-8
Section 4.6 Functional Design of Control Rod Drive System

This section of the SRP addresses the following

* control rod drive cooling systems,

* supporting instrumentation to verify CRD system operability,

* the ability to meet the single failure criteria, i.e., demonstration of the ability of the

control rods to insert upon any failure of the drive mechanism or induced failure (loss

of power, fire, radiation),

* the ability to control reactivity changes, and

* the ability to withstand postulated reactivity accidents including rod ejection, rod drop,

and cold water addition.

Table 7.2 Standard review plan summary for CRD

Primary Aging Aspects

Section Responsibility Requirements Addressed

3.9.4 CRDM mechanical Life cycle test program Wear, functional

l____________________ test stressors

3.95 Guide Tube Mechanical strength- ability Flow induced

to withstand postulated vibration

loadings .

4.5.1 CRDM Materials ASME Code class, material Stress corrosion

composition, heat treatment cracking

4.6 CRD Support Subsystems Meet single failure criteria Design/operability

concerns

7.2 Industry Research

Several industry research reports were reviewed as part of this aging study. Perhaps the largest

area of on-going research for the control rod drive system is for plant life extension (PLEX). Work

sponsored by EPRI and DOE at the Surry Plant resulted in several recommendations for monitoring and

maintenance, which are further evaluated in this report. This section summarizes these results from

EPRL as well as other industry sources, including Westinghouse.

7-9
EPRI NP-6232-M "PWR Pilot Plant Life Extenslon Study at Surry Unit I - Phase 2"2

This report identifies the data acquisition tasks that were implemented to collect data on the

operating environment for the control rod drive mechanisms and cables inside containment.

Three issues identified which require further characterization to alleviate life extension concerns

are:

1. Thermal embrittlement of the CRD housing. Cast stainless steel with a ferrite content

of approximately 20% is vulnerable to thermal embrittlement. Some of the housings at

Surry possess a ferrite content ranging from 13% to 21%. Accurate measurement of the

temperature of the CRDM housing has been recommended to better assess this

degradation mechanism.

2. Thermal fatigue of CRDM subcomponents. An evaluation of the CRDM pressure vessel

housing indicated that fatigue is not a concern based on the assumed thermal gradients

and transients. The report does recommend, however, that actual temperatures of the

CRDM should be recorded to 'verify conservatism in the fatigue waiver calculations and

thereby support life extension for the fatigue-sensitive CRDM subcomponents.'

3. The report identifies the CRDM coils as being susceptible to aging degradation

mechanisms. Specifically, it calls out exposure of insulation to high temperatures, which

could lead to shorting of the coil. Monitoring of the coil temperature is recommended

to provide data for determining the life expectancy of coils.

EPRI NP4512, Lifetime of PWR Silver-Indlum-Cadmium Control Rods"

This report describes the results of examinations of control rods taken from the Point Beach Unit

1 reactor. These examinations, conducted in hot cell facilities, focused on the inspection of rods that had

been used for 11 reactor cycles. Based on the cladding wear and cracking detected, an estimate of 10

calendar years is made for the service life of control rods, as compared to a 15-year service life

traditionally estimated by manufacturers.

The hot cell investigations show that flow-related vibration of the control rod causes fretting wear,

as a result of interaction with the guide structure of the upper core. The maximum wear limit of 15.0

mils has been established based on a minimum wall thickness of 18 mils. This means that a wall

thickness of 3 mils is adequate to prevent the absorber material from adversely contaminating the coolant.

For a typical plant, it is expected that this limit will be achieved on one or more RCCAs after

approximately 74,000 hours (8.5 years) of reactor critical operation.

Cracks similar to those investigated in this research occurred in rodlets at other Westinghouse

reactors. These axial, hairline cracks have been caused by cladding stresses, radiation damage of the

cladding, and waterside environmental effects.

Electron microscopy of the cladding specimens identified silicon-rich impurities at the grain

boundaries. Impurities such as silicon are embrittling agents in stainless steel and promote stress

corrosion cracking in the presence of corrodents and at low levels of stress.

This report concludes that these hairline cracks do not necessarily require the plant to be shut down.

It recommends that additional data be obtained to define the bounds of acceptable operation with hairline

cracks and to determine the susceptibility of other RCCA designs to cracking.

7-10
i

EPRI NP-4312-SR, %LWR Core Materials Proeram: Proess In 1983-1984" e

EPRI initiated the LWR research program for core materials in mid-1974. The program originated

with emphasis on fuel problems. Since 1979, however, increased attention has been directed to other

core components including control rods. In fact, one of the six areas of emphasis cited is extending

control rod life.

The report states that for PWRs, the lifetime of control rods is based on considerations related to

the mechanical integrity of the stainless steel cladding. The limiting factors are cracking of the cladding

due to radiation damage and absorber swelling and wear due to interaction with upper core internals.'

Models to predict the fluence necessary to cause failure are under development.

The report notes that the cause of cracking in the high fluence part of the control rods appears to

be related to irradiation-assisted stress corrosion cracking (IASCC). Work is progressing to resolve this

issue because it also has implications for assessing the lifetime of other components. The report does

state that Type 304 stainless steel, while resistant to intergranular stress corrosion cracking (IGSCC) in

high purity water, has been known to crack when loaded in tension. This may be due to the presence

of oxygen produced from radiolysis and impurities. In general, it is felt that the radiation increases the

range of conditions for which IGSCC will occur. The extent and severity of IASCC has not been

determined.

EPRI NP-2681. 'Evaluation of Cobalt Sources In Westinthouse Deslened Three and Four Loot

Plants"1 '

In this study, which was conducted by Westinghouse, CRDM wear was evaluated because of its

cobalt contribution to coolant activity levels. Corrosion and wear release rates were determined based

upon the expected cycling of rods in a typical Westinghouse plant. The locations of the high cobalt parts

are the latch assembly and locking button, which are illustrated in Figure 72.

The report describes several 'life tests' of CRDMs in which the wear on the high cobalt parts have

been measured. In two different tests, wear of the high cobalt material could have ranged from 265

grams to 751 grams for 3 x 106 steps for 53 CRDMs. This translates into 3 to 852 grams of cobalt per

CRDM. Other information of interest cited in this report are the costs associated with replacing a

CRDM latch assembly.

Removal: 3 man-days

Installation: 8 man-days

Change-out cost 40K (1982 dollars)

Man-rem per CRDM: S

EPRI NP-3912-SR. Vol. 'Proceedings: International Toplcal Meeting on Probabilistic Safety

Methods and Applicatons'29

A paper presented at the above conference covered the failure analysis of steel pins in the

control rod assemblies at French nuclear plants. The purpose of the study was to define a probabilistic

approach to determine the risk of rupture of a pin as a function of operating time.

7-11
CANOPT MIDOLE JOINT

"0UWalk

' SHIM

oRIPPER POLE

GRIPPER POLE

CIPPER SIIG

NOTE: HIGH COBALT PARTS

UNDERLINED

ImageS FM STI'1011ARY LAMC

rum

T tuI MRISTnnAR bLet

1 1TAlleft

Figure 7.2 CRDM showing location of

high cobalt parts9

MT?

7-12
The paper presents a derivation of the statistical laws which describe the pin characteristics. Certain

features were incorporated into the model including the beginning of corrosion, "aging speed," and the

time between the appearance of the crack and the rupture. The second part of the study used a test loop

to validate the model. This portion of the research is continuing, and is directed towards determining

the length of time between the appearance of a crack and the rupture of the pin.

Conference Paper. Recent Development for Improvlng PWR Flexbility to Load Follow and Freuuencv

Control Operation"

The author described the French research on the additional stresses that would be placed on the

control rod system if the utilities were to employ automatic load following. Load following requires that

the power level of the plant respond to demands for electrical load as directed by a central dispatcher.

This change in operations would generate additional mechanical and thermal stresses due to the frequent

motion of the control rods. Mechanical fatigue cycling and wear were the specific degradation and

thermal mechanisms noted.

Test loops were used to simulate various stresses that would be imposed by this operating condition,

namely wear on the sliding surface of the CRDM, as well as wear and fatigue at the interface of grippers

with the grooves of the drive shaft. Wear on the cladding of the control rods due to friction with the

guide tubes and fuel assemblies was also monitored. The results obtained from this endurance testing

(-10' cycles) of interest to this aging study are:

1. Complete breakthrough of the rodlet cladding (47mm thickness) occurred after 3 x 10' steps.

2. Failure of several single tip grippers occurred at 6 x 10' cycles, resulting in a loss of function of

the mechanism. (1mm of wear)

3. Wear resistance and fatigue resistance were improved by two modifications (illustrated in Figure

7.3):

a. For the CRDM, the single tip gripper was replaced by a double tip gripper.

b. For guide tubes, hydraulic flow holes were added to reduce the differential pressure at the

lower part of the guide tube.

4. The cycle testing was equivalent to approximately 20 years of continuous operation under daily

load follow mode.

7-13
Cladding thickness breakthrough limit

1 2 3 4 5

CYCLES

(x 101)

FIgure 73 Control rod wear"

7-14
8. CONCLUSIONS AND RECOMMENDATIONS

The control rod drive system used in Westinghouse pressurized water reactors performs functions

which are important to plant safety and availability. These are to: (1) shut down the reactor in the

event of an unsafe condition, as sensed by the reactor protection system; (2) provide small changes in

reactivity in response to plant load variations; and (3) continuously indicate control rod positions.

Operating experience data indicates that failures of the CRD system have resulted from age-related

degradation, that age-related degradation could prevent the system from performing its safety function;

and that CRD system failures have resulted in reactor trips.

To identify and characterize the effects of aging and service wear, which could degrade the control

rod drive system, a study has been completed of the design functions of the major system components,

and the operating and environmental stresses to which they are exposed. An evaluation has been

completed of related research results, such as life cycle tests, a plant life extension assessment, and a

statistical technique for determining CRD system wear out.

Nuclear power plant operating experiences and survey responses from 15 nuclear plants are cited

in support of the conclusions and recommendations presented in this section. Further analysis of the

methods and techniques for detecting and mitigating aging effects is expected to yield testing and maintenance practices which are technically feasible and practical.

8.1 Conclusions

These conclusions are related to the susceptibility of CRD components to aging degradation and

the safety significance of this phenomena. Observations from operating experience data and from a

survey of 15 Westinghouse nuclear plants has led to several findings regarding system vulnerability and

maintenance, respectively. The evaluation of the system's design to detect and mitigate the effects of

aging has also led to some of the observations included in this section.

8.1.1 Susceptibility of the System to Aging

Based on the results of this study, the following components of the Westinghouse CRD system

have exhibited aging characteristics worthy of continued attention. These components, and the primary

aging mechanism affecting them, are:

1. cable - insulation degradation

2. coils - insulation degradation

3. Zircalloy guide tube - wear

4. drive rod and latch assembly - wear and fatigue

5. rod position indication detector - calibration drift

6. rod cluster control assembly - cracking and wear

7. fuses - fatigue

8. power electronics - overheating

Some of these components are not classified as safety-related.' However, because each can

contribute to a rod block, rod drop, uncontrolled reactivity change, or tech spec violation, this report

treats them as important to safety and plant availability.

8-1
The safety significance of the control rod drive system and the need to address aging degradation

in the incipient stage is expressed in NUREG-1185, 'Integrated Safety Assessment Report' for one of

the oldest Westinghouse PWRs. This report concluded that aging 'may be a factor in the perpetuation

of control rod drive problems,' and that failure or improper operation of the drive mechanism are safety

concerns." Following a discussion of operational problems experienced at this plant, which are similar

to the failures identified in Section 4 of this report, the authors of NUREG-1185 further concluded that

failures of the control rod drives 'constitute a symptom of a plant problem which has safety

significance".'

&1.2 Operating Experience

The evaluation of Licensee Event Reports (LERs), Nuclear Plant Reliability Data System

(NPRDS) records, and Nuclear Plant Experience (NPE) summaries has provided the following findings:

1. Failures in the power and logic cabinets comprise approximately 40% of the reported

failure data. The primary contributor to these failures is high ambient temperature.

2. Approximately 30% (i.e., 40 of 125 LERs) of the failures in the CRD system result in a rod

drop leading to a reactor trip. The rod drop is presently a safety concern because of the

flux depression introduced, and the challenge to the reactor protection system.

Westinghouse has recommended changes to the protection system so that a rod drop will

not initiate a reactor trip. This action will reduce the safety significance of a rod drop.

3. Wear of the rod cluster control assemblies is due to several independent types of agerelated degradation: sliding wear, fretting wear, and cracking due to the interaction between

the absorber and the cladding, and radiation induced effects in the tip region of the rodlet.

4. Stress corrosion cracking has been identified as a source of degradation in two areas, fuel

assembly hold down spring clamp screws and control rod guide tubes, including the split

pins.

5. The normally energized stationary gripper coils have experienced a much higher failure rate

(order of magnitude) than the movable gripper and lift coils. Therefore, thermal stress

from ohmic heating may be an important contributor to coil degradation.

6. Certain circuit boards in the power cabinet are more susceptible to failure than others

located in the same cabinet. The firing circuit card is an example, with about 20% of the

reported failures attributed to it. This card contains thyristors which are susceptible to

damage from overheating.

7. Approximately 30% of the combined failures in the power and logic cabinets were

associated with the fuse protection circuits, including the fuse and its associated mounting

hardware (fuse clip). Several instances of observed fuse degradation, such as 'fatigue" or

'normal end-of-life', were found in the operating experience data.

8-2
8. The cables and connectors, which link the power cabinets to the CRDMs, accounted for

about 15% of the system failures, with connector problems being the dominant contributor.

Mechanical wear of the plug contacts and corrosion in the area of the connector pin mating

surfaces were the degradation mechanisms identified. All of the reported failures occurred

at plants in operation for more than five years.

9. A generic problem with calibration drift of the analog rod position indication subsystem

during reactor heatups and cooldowns was identified by evaluating the data. However, this

problem does not appear to be affected by plant age.

8.13 System Design Review

The detailed review of the design of the Westinghouse CRD system, supplemented by the results

of the industry survey, led to several findings related to aging degradation, which could be attributed to

deficiencies in design in the CRD system or its interfaces.

1. Several utilities have experienced CRD system cable insulation or jacket material degradation sufficient in magnitude to justify replacement of these cables. This degradation is

attributed to the inability of the cable system to withstand the high temperatures

experienced in the upper head region.

2. Modifications to the cooling of the power and logic cabinets has been necessary at several

plants. Temperatures as high as 125F have been recorded in the cabinets. This will

deleteriously affect many of the components, which are typically designed for 90 F. The

temperature of the cabinet is largely dependent on the ambient temperature in the area.

3. The number of connector problems in the upper head region due to moisture ingress or

contamination from borated water leakage indicates the need for a more substantial

connector design. The stresses from this relatively severe environment appear to be

underestimated. Westinghouse has, in fact, changed the connector design in its newer

installations and is reporting success, especially with the ability of the connector to

withstand successive disconnections and reconnections3.

4. The rod drop timing test is required to be performed once per cycle in accordance with the

plant technical specifications. Pulling this fuse to perform a rod drop test reduces the force

between the fuse clip and the fuse, which has resulted in spurious open circuits and

subsequent rod drops. le design should include a more permanent means for satisfying

this required testing.

5. A positive aspect of the Westinghouse CRD system design is that it contains sensors which

detect certain component failures. An urgent alarm, which results in a rod block, or a nonurgent alarm, indicating a loss of redundancy, provide an important input to the control

room operators.

8-3
8.1.4 Maintenance Practices

The review and evaluation of current maintenance and available inspection and monitoring

methods has resulted in the following conclusions:

1. Preventive maintenance practices varies substantially from one plant to another, with some

plants relying on the tech spec required testing to provide indication of system degradation.

2. Most preventive maintenance resources are applied to electrical components within the

containment.

3. Based on the favorable responses from the utility survey, it is concluded that tech spec

required activities (rod drop timing test and rod exercise) are beneficial in determining the

operational readiness of the system.

4. The complexity of the system logic warrants specific procedures and detailed training for

the personnel associated with maintaining it. It could not be concluded from the operating

experience data or the results of the survey that this area is adequately addressed.

8.2 Recommendations

To more effectively detect and mitigate the effects of aging in the Westinghouse control rod drive

system, it is recommended that changes be made in the areas of design, maintenance, and monitoring.

8.2.1 Design

Mitigation of the effects of aging may be successfully addressed through changes to the system

design. The goals of these modifications are to reduce or eliminate the stresses which contribute to

aging degradation or improve the materials to better withstand the existing stresses.

Ventilation

The ventilation systems in the upper head region and in the area where the power and logic

cabinets are located should maintain low ambient temperatures. It is important that operating personnel

be made aware of unsatisfactory conditions so that prompt action can be taken. Maximum temperatures

of 150 F and 80F for these two areas are reasonable design goals for the ventilation systems.

Similarly, operating personnel should be aware of the importance of the ventilation system on CRD

performance.

Components

The integrity of the control rod drive system cables located in containment can be improved by

using higher temperature rated assemblies. Several plants have upgraded their cable system to Tefzel

insulation with a chlorosulfonated polyethylene jacket rated at 194F. Other cable systems offered for

the CRDMs are rated as high as 1000T.

8-4
While this study did not reveal any problems with the control rod drive housing (primary system

pressure boundary), it is recommended that research continue because of the failure consequences. As

delineated in the pilot life extension study at Surry, cast stainless steel with a ferrite content of

approximately 20%6 is vulnerable to thermal embrittlement. Ten of the control rod drive housings at

Surry possess a ferrite content ranging from 13% to 21%.

The coils are designed for a temperature of 400F. It is not clear why the stationary gripper coils

are failing at a much higher rate than the movable or lift coils. The only apparent difference is that

current (4.4 amps) is continuously applied to the stationary gripper coil to hold the control rods in

position. The ohmic heating generated may contribute to the coil's degradation.

8.2.2 Maintenance and Monitoring

Because of the inaccessibility during operation of the mechanical and structural portions of the

CRD system, it is extremely important to conduct and document a thorough inspection during refueling

outages. Using underwater TV cameras, areas of wear should be noted and their cause determined.

While it may be advantageous to contract some of this work to the nuclear steam supplier, it is imperative that records be maintained on site to document the conditions of critical parameters such as:

* guide tube wear,

* drive rod and latch wear,

* rodlet fretting, cracking, or bulging, and

* cable, connector, coil appearance.

In addition, techniques are being successfully implemented at some utilities to supplement these

visual inspections. As discussed in this report, ultrasonics, eddy current, and profilometry are three of

these techniques which could effectively determine the rate of component degradation as a plant ages.

The proper use of wear management guidelines (including axial repositioning of the RCCAs) can

distribute the wear along the cladding surface and extend the operational availability of the RCCAs In

fact, for plants with accelerated wear rates, Westinghouse recommends frequent (once per month) single

step repositioning'.

The ASME inservice inspection requirement specifies that welds on 10% of the peripheral CRD

housings be inspected. This does not adequately assess the weld integrity for the interior housings.

NDT techniques and equipment should be developed to allow for the remote inspection of the interior

housings as well.

Monitoring the CRD system mechanical and electrical integrity is justified based on its safety

significance and operational performance. It is recommended that a current signature analysis technique

being used at one plant be evaluated by other utilities. With this technique, each coil current is traced

during rod motion. Analysis of the recorded data determines the acceptability of the power and logic

circuitry and the coil integrity. In addition, a rough indication of mechanical interferences can be

ascertained. Refinement of this technique for on-line monitoring has been completed and is being

marketed commercially.

A common maintenance practice of measuring the resistances of cables, connectors, and coils

resistances at regulated conditions (base-line temperature) is also recommended following each refueling.

Measurements of loop inductance or dissipation factor as provided by commercial systems, such as

ECAD, may also be useful to monitor degradation.

8-S
Other functional indicators of possible value in detecting degradation of the CRD system are:

1. CRDM Cycle Counter Since the amount of wear on components, such as the drive rod

and latch, is directly related to rod movement, it is recommended that the number of

control rod steps for each of the rods in the control bank(s) be counted.

2. CRD Housing Temperature Thermal embrittlement of the pressure boundary may be a

problem as plants age. To more accurately predict the performance of these materials, it

is recommended that the temperature of selected housings be monitored at power

conditions.

3. Operating Experience: With essentially fifty plants using the same CRD system design,

tremendous benefits can be derived from shared information. Degradation experienced at

older plants, for example, should influence the maintenance at newer plants.

8.3 Future Work

This study identified components within the Westinghouse control rod drive system whose

performance is affected by aging. Recommendations have been made for detecting and mitigating aging

effects. To determine the effectiveness of the recommendations presented, future work should consist

of the following

* Evaluation of plant-specific data for the testing and monitoring methods identified. The

practicality of the testing as well as the technical benefits will be considered.

• An in-depth review of licensee activities in response to past NRC regulatory actions (i.e.,

Information Notices) to determine if the long-term aging effects of the problems have been

addressed.

It is further recommended that any continued study of the Westinghouse CRD system be deferred

until the phase 1 study of the Babcock and Wilcox and Combustion Engineering CRD systems are

completed. It is expected that further evaluation of monitoring techniques and age-susceptible

components would address applications in all three designs.

8-6
9. REFRENCES

1. Vora, J.P., Nuclear Plant Aging Research (NPAR) Program Plan," NUREG-1144, Rev. 1,

September 1987.

2. Fullwood, R., et al., Aging and Life Extension Assessment Program (ALEAP) Systems Level

Plan,' BNL Report A-3270-12-86, December 1986

3. Final Safety Analysis Report, Consolidated Edison Company of New York, Indian Point Unit 2,

Docket Number 50-247.

4. Riggs, R., Control Rod Guide Tube Wear in Operating Reactors,' NUREG-0641, June 1980.

5. Final Safety Analysis Report, Sequoyah Units 1 and 2, Docket Nos. 50-327 and 328.

6. Blanchard, A., and Katz, D.N., 'Solid State Rod Control System - Full Length,' WCAP-7778,

Westinghouse Electric Corp., January 1972.

7. Shopsky, W.E., Failure Modes and Effects Analysis of the Solid State Full Length Rod Control

System,' WCAP-8976, Westinghouse Electric Corp.

8. Blanchard AE., Topical Report - Rod Position Monitoring,' WCAP-7571, Westinghouse

Electric Corp., March 1971.

9. Blanchard, A-E. and Calpin, J.E., Digital Rod Position Indication.

10. Sipush, P., et al., Lifetime of PWR Silver-Indium-Cadmium Control Rods," EPRI NP4512,

Westinghouse Electric Corp., March 1986.

11. Final Safety Analysis Report, Vogtle Electric Generating Plant, Georgia Power Co., Docket No.

50-424.

12. USNRC Information Notice 82-29, 'Control Rod Drive (CRD) Guide Tube Support Pin Failures

at Westinghouse PWRs," July 1982.

13. NUREG-0452, Standardized Technical Specifications for Westinghouse Pressurized Water

Reactors," Revision 4, August 1981.

14. Miyaguchi, J., "Development of a PWR CRDM Data-Analyzing System" Mitsubishi, Kobe-Japan,

Transactions, 1989 Winter Meeting, American Nuclear Society (ANS), November 1989.

15. Engel, RJ., 'Application of a Weibull Hazard Analysis to an Aging/Wearout Model,"

Proceedings of ANS Topical Meeting on Nuclear Power Plant Life Extension, August 1989.

16. Hedin, F., et al., EDF Revisits The Guide Tube Pin Problem," Nuclear Engineering

International, November 1989.

9-1
17. Ericsson, E., Guide Tube Support Pin Experience at Ringhals Plant, Sweden,' Proceedings of

International Nuclear Power Plant Thermal Hydraulics and Operations Topical Meeting, October

1984.

18. Gustafsson, J., Inspecting Guide Tube Support Pins in Swedish PWRs," Nuclear Engineering

International, November 1984.

19. -Evaluation of Cobalt Sources in Westinghouse Designed Three-and Four-Loop Plants,' EPRI

NP-2681, Westinghouse Electric Corporation, October 1982.

20. Glass, S.W., Profil-360 High Resolution Steam Generator Tube Profilometry System," Babcock

& Wilcox Co., 7th International Conference on NDE in the Nuclear Industry, February 1985.

21. Pasupathi, V., et al., Determination and Microscopic Study of Incipient Defects in Irradiated

Power Reactor Fuel Rods,' BCL-585-1, Battelle's Columbus Laboratories, August 1977.

22. "Condition Monitoring Used at San Onofre,' Nuclear News, January 1990.

23. Brown, EJ., 'Localized Rod Cluster Control Assembly (RCCA) Wear at PWR Plants," AEOD

Engineering Evaluation Report E613, December 1986.

24. Barley, WJ., and Wu, S., 'Fuel Performance Annual Report for 1988,' NUREG/CR-3950, Vol.

1-6 (PNL-210) U.S. Nuclear Regulatory Commission and Pacific Northwest Laboratory, March

1990.

25. Ware, A.G., Pressurized Water Reactor Control Rod Mechanisms and Reactor Internals,"

Chapter 7 of NUREGICR4731, Vol. 2, November 1989.

26. Standard Review Plan, NUREG-800, U.S. NRC, Rev. 1, July 1981.

27. 'PWR Pilot Plant Life Extension Study at Surry Unit 1: Phase 2,' EPRI NP-6232-M, March 1989.

28. Franklin, D.G., et al., LWR Core Materials Program: Progress in 1983-1984, EPRI NP4312-SR,

October 1985.

29. Piepszownik, L and Procaccia, M, 'Failure of the Rupture in Steel Pin of the Control Rod

Assemblies in French Nuclear Plant,' Paper 124 of EPRI NP-3912-SR, Volume 2, February

1985.

30. Dubourg, M., Recent Development for Improving of PWR Flexibility to Load Follow and

Frequency Control Operation,' Conference on Structural Mechanics in Reactor Technology,

August 1983.

9-2
31. 'Integrated Safety Assessment Report - Haddam Neck Plant,' NUREG-1185, Vol. 2, July 1987.

32. Gunther, W., et al., "Operating Experience and Aging-Seismic Assessment of Battery Chargers

and Inverters, NUREG/CR-4564, Brookhaven National Laboratory, June 1986.

33. Correspondence from WJ. Johnson to S.K Aggarwal, 'Westinghouse Comments Regarding

Draft NUREGICR-5555," NS-NRC-90-3531, November 21, 1990.

9-3
APPENDIX A

Westinghouse CRD System Design Review

Section 2 of this report presents a broadly based, functional block diagram of the design of the

Westinghouse CRD System. While this type of review is sufficient to gain a general understanding of

system operation, in many cases it does not adequately describe the specific operating methods of certain

components and subassemblies. Therefore, to adequately assess the implications of the operating

experience failure data obtained for this NPAR study, a more in-depth review of the Westinghouse CRD

system design was necessary. This review provided additional insight into the specific operating

characteristics of certain components and subassemblies. The detailed information obtained during this

review is presented in this appendix.

A Rod Cluster Control Assembly and Reactor Internal Components

Figure A.1 shows an individual absorber rod. The number of individual absorber rods contained

in an RCCA will vary with the size of the fuel assembly. Current Westinghouse fuel assembly designs

include 14x14, 15x15, and 17x17 arrays. (Westinghouse also has a 16x16 design; however, it is not used

in domestic plants.) In a 15x15 fuel assembly array, the fuel rods are arranged in a square pattern with

15 rod locations on each side. Of the 225 possible fuel rod locations for each assembly, 20 are occupied

by guide thimbles for individual absorber rods of the rod cluster control assembly. Similarly, the number

of guide thimbles is 16 for the 14x14 fuel array and 24 for the 17x17 arrays.

As illustrated by Figure A.2, the fuel assembly guide thimbles form an integral part of the

assembly and occupy locations within the regular fuel rod pattern where fuel rods have been deleted.

Figure A.3 shows the basic elements of a typical fuel assembly. As shown in this figure, the guide

thimbles, in conjunction with the grid assemblies and top and the bottom nozzles, comprise the structural

skeleton of the fuel assembly. Each guide thimble is fabricated from a single piece of tubing which is

drawn to two different diameters. The larger diameter at the top provides a relatively large annular area

for rapid insertion during a reactor trip. The bottom portion of the guide thimble is of a reduced

diameter which provides a dashpot to absorb the energy of a control rod as it falls into the core

following a reactor trip. Flow holes above the dashpot provide a path for displaced water during a

reactor trip and permit cooling water to enter during normal operation. To prevent a rapid change in

tube diameter, the transition zone between the two diameters is gradually tapered. The tubing material

may be either stainless steel, used in Westinghouse HIPAR fuel assemblies, or Zircaloy4 used in

Westinghouse LOPAR fuel assemblies. The bottom ends of the guide thimbles are closed off by a

welded end plug and are fastened to the bottom nozzle of the fuel assembly during fabrication. The top

ends of the guide thimbles are expanded into stainless steel sleeves, which are welded to the top grid of

the fuel assembly. The sleeves are fitted through individual holes in the adaptor plate of the fuel

assembly and are located above the position of the control rod tips when the RCCA is in the fully

withdrawn position.

Control Rod Guide Tube (CRGT) assemblies, shown in Figure A.4 and A.S shield and guide the

RCCA above the core. They are fastened to the upper support and are guided by pins in the upper core

plate for proper orientation and support. In the lower portion of the CRGT, sheaths and split tubes

provide continuous lateral support for the control rods over a length of approximately 40 inches above

the upper core plate. Above this region of the CRGT, guide plates provide intermittent lateral support

for the control rods. Additional guidance for the drive rods of the control rod drive mechanisms is

provided by the upper guide tube extension, which is attached to the upper support.

A-1
iTOP END PLUG .d- 142.0 ABSORBER MATERIAL

|~ -.3 90 

.~~~~ ~~~~~~~ _1 I 

-91 -- I --- AiP -W i- --- --- -- - ----- --- 1

t

TYPE 304 STAINLESS

STEEL

id _ -lc , _ 

|5 B M ENAg-Pn-Cd G

ISS ~BOTTOM END PLUGT 151.8:

Figure A.1 Individual absorber rod

A.2 CRDM Ooeration

During normal steady-state plant operation, a CRDM holds its attached RCCA withdrawn from

the core in a static position. In this mode only one coil, the stationary gripper coil, is energized. The

drive rod assembly and attached RCCA hang suspended from three stationary gripper latches. Electromagnetic forces are required to maintain an RCCA in a position above the core while insertion is

accomplished by the force of gravity acting on the weight of the assembly. Therefore, the CRDM will

remain in this position until a stepping sequence is initiated by the Rod Control System or an

interruption in electrical power causes the RCCA to fall, by gravity, into the core. Upon removing

electrical power, the RCCA total insertion time is designed to be less than 2.2 seconds.

A-2
000000000000000.

0 000000

0 0. 0 000000

0 0 00000

0 0 00000 0 0 000

0 0

0 0 0 0 0

0 0

0 0 00 0 0 100 0

0 UGuide 0 Thimble 0

0 01

o0oooooooooooooI

FUEL ASSEMBLY

15 X 15

CROSS SECTION

PATTERN

Figure A Fuel assembly guide thimbles

A-3
I

a

.9

a

.

41

CZ

I

41 1

0A [ I lI I J 1i T 1

A4
to WtI

A not 

ngumA.4contol rod gide tube assembly

A-5
CRDM

Drive Rod Assembly

-RCCA Withdraw

RCCA Inserted

RCCA

Guide Tube Assembly

Fuel

FIgure A5 Control rod guide tube

A-6
* RCCA WITH DRAWAL

This section describes the sequence of events required to accomplish a single 'step' (5/8-inch) of

RCCA withdrawal. Each cycle is shown in Figure A.6.

Starting with the RCCA held in a static position, with. its stationary gripper coil energized, the

withdrawal sequence is as follows:

1. Position Movable Gripper Latches

(MOVABLE GRIPPER COIL - ON)

The armature of the movable gripper raises and swings the latches into a drive rod assembly

groove. A 1/16-inch clearance exists between the movable gripper latch teeth and the drive rod.

2. Transfer Load to Movable Gripper Latches

(STATIONARY GRIPPER COIL - OFF)

The force of gravity, acting upon the drive rod assembly and attached RCCA, causes the

stationary gripper latches and armature to move downward 1/16 of an inch until the load of the

drive rod assembly is transferred to the movable gripper latches. The armature continues to

move downward and swings the stationary gripper latches out of the drive rod assembly groove.

3. Raise RCCA One Step (8")

(LFT COIL - ON )

The 5/8-inch gap between the lift armature and the lift pole closes and the drive rod assembly

raises up one step (5/8-inch).

4. Transfer Load to Stationary Gripper Latches

(STATIONARY GRIPPER COIL - ON)

The armature of the stationary gripper raises and closes the gap below the stationary gripper

pole. The three links, pinned to the plunger, swing the stationary gripper latches into a drive rod

assembly groove. The latches contact the drive rod assembly and lift it 1/16 of an inch,

transferring the load from the movable gripper latches to the stationary gripper latches.

A-7
RETURN.

SPRINGS

HOLD

;AP

LE 'N

R

CLEARANCE

4. LOAD TRANSFER

1. POSITION MOVABLE LATCHES

5. DISENGAGE MOVABLE LATCHES

2. LOAD TRANSFER

'OFr

LIFT COIL "ON

- S/8r CAP CLOSES

6. RETURN TO HOLD

Figure A.6 RCCA withdrawal sequence

3. RAISE ONE STEP

A-8
S. Disengage Movable Gripper Latches

(MOVABLE GRIPPER COIL - OFIF)

Under spring and gravity force the armature of the movable gripper separates rom the lift

armature. The three links pinned to the armature swing the three movable gripper latches out

of the drive rod assembly groove.

6. Return to Hold

(LIFT COIL - OFF)

The gap between the lift armature and lift pole opens. The movable gripper latches drop 5/8 of

an inch to a position adjacent to the next rod drive assembly groove.

The sequence described above is completed for each step of RCCA withdrawal. The sequence

may be repeated at a rate of up to 72 steps per minute (45 inches/minute) with the rate of

motion continuously variable from this maximum rate to a typical minimum rate of 6 steps per

minute (3.75 inches/minute). The speed of RCCA withdrawal is controlled by varying the

repetition rate of the current pulses to the coil. The magnitude of the required coil current is

fixed at 7 1j2 amps for the movable gripper coil while the magnitude of operating coil current

supplied to the stationary gripper and lift coils is profiled according to the specific function to be

performed. For example, the stationary gripper coil requires 7.5 amps to perform a stepping

sequence, but only 4.2 amps are required to hold an RCCA in a fixed position. This reduced

level of stationary coil current reduces thermal heating of the coil. Additionally, the lift coil

requires an initial current of 40 amps to operate. However, since the magnetic air gap is closed

once the lift coil is in the raised position, less current is required to hold it. Therefore, only 16

amps of current are necessary for the lift coil to complete its cycle once energized. This lower

value of the current to the lift coil permits a faster decay of current when release is desired.

* RCCA INSERTION

The sequence for RCCA insertion is similar to that for withdrawal. Starting with the stationary

gripper coil energized, the insertion sequence, is as follows:

1. Position Movable Gripper LAtches (Raise One Step)

(LIFT COIL- ON)

The 5/8 of an inch gap between the lift armature and lift pole closes. The movable gripper

latches are raised to a position adjacent to a drive rod assembly groove.

A-9
2. Engage Movable Gripper latches

(MOVABLE GRIPPER COIL - ON)

The armature of the movable gripper rises and swings the latches into a drive rod assembly

groove. A 1/16 of an inch axial clearance exists between the latch teeth and the drive rod

assembly.

3. Transfer Load To Movable Gripper Latches

(STATIONARY GRIPPER COIL - OFF)

The force of gravity acting on the drive rod assembly causes the stationary gripper latches and

armature to move downward 1/16 of an inch until the load of the drive rod assembly is transferred to the movable gripper latches. The armature continues to move downward and swings

the stationary gripper latches out of the drive rod assembly groove.

4. Insert RCCA One Step (5/8")

(LIFT COIL - OFF)

Under the combined forces of gravity and springs, the lift armature separates from the lift pole

and the drive rod assembly drops down 518 of an inch.

S. Transfer Load To Stationary Gripper Latches

(STATIONARY GRIPPER - ON)

The armature raises and closes the gap under the stationary gripper pole. The three links,

pinned to the armature swing the stationary gripper latches into a drive rod assembly groove.

The latches contact the drive rod assembly and lift it 16 of an inch, which transfers the load of

the drive rod assembly from the movable gripper latches to the stationary gripper latches.

6. Return to Hold

(MOVABLE GRIPPER COIL - OFF)

The armature of the movable gripper separates from the lift armature under the combined forces

of a spring and gravity. Three links, pinned to the armature, swing the movable gripper latches

out of the drive rod assembly groove.

The single insertion cycle described above will cause the RCCA to insert into the core by one

step or 518 of an inch. As for withdrawal, this sequence may be repeated at a rate up to 72

steps/minute (SPM) (45 inches/minute).

A-10
* REACTOR TRIP

The removal of electrical power at any time during the operating sequence allows the drive rod

to drop by gravity. For example, if power to the stationary gripper coil is removed while the

RCCA is being held in a static position, the combined weight of the drive rod assembly and

RCCA is sufficient to move the latches out of the drive rod assembly groove and the control rod

will fall into the core. The trip occurs as the magnetic field, which holds the armature of the

stationary gripper against the pole, collapses and the armature is forced down by the weight

acting upon the latches. The latch return springs are not required for tripping since the linkage

geometry is not self locking. After the drive rod assembly is released by the mechanism, it falls

freely until the individual absorber rods enter the dashpot portion of their guide thimble tubes.

A.3 Rod Control System Operation

During plant startup, the shutdown banks of control rods are the first rods to be withdrawn and

are moved to their 'full out! position manual control. Criticality is always approached with a control

bank group of rods after the shutdown banks have been fully withdrawn. The control banks are

withdrawn in a predetermined programmed sequence (i.e., Control Bank A, B, C, D). Control banks are

inserted in the reverse sequence (i.e., D, C, B, A,)

When reactor power is between 15 and 100 percent, the rod control system may be placed in the

"Automatic mode of operation. In this mode, the operating speed and direction of control bank

CRDMs is automatically determined by the rod control system in response to demand signals received

from the reactor control system. Control rod positioning may be performed automatically whenever the

reactor power is above 15% and manually at any time. During normal, steady state plant operations, the

primary function of the reactor control system is to regulate the operation of the rod control system, as

required to maintain a programmed average temperature in the reactor coolant system. The control

system will also provide initial compensation for reactivity changes caused by fuel depletion or xenon

transients. Final compensation for these effects is performed by periodically adjusting the boron concentration of the reactor coolant system)

The average coolant temperature varies linearly from 0 to 100% power, and they are measured

from the hot and cold leg (steam generator inlet and outlet) of each reactor coolant loop. An average

temperature (Th + Te)/2 for each loop is then determined. The average of these four measured average

temperatures becomes the main control signal of the reactor control system to command the direction

and speed of control rod motion.

* Sequential Group Movement and Rod Speed

A variable speed, sequential method of rod positioning permits the reactor control system to

finely control the average temperature of the reactor coolant system by inserting small amounts of

reactivity at low speed. Upon receipt of a command signal for 'IN' or W'OU rod motion, the control

banks move at a predetermined speed with staggered stepping of the groups within the same bank.

Staggering the movement of the groups of rods within a bank permits smaller incremental changes in

reactivity. The staggered movement of groups is illustrated in Figure A.7. In the example shown it is

assumed that at time=0, the Group 1 rods of Control Bank A are withdrawn at a rate of 6 steps/minute.

After a five second delay, the Group 2 rods of Control Bank A will start to withdraw. The length of

delay depends upon the rod speed, and is equal to 12 of the total stepping time. For a rod speed of 6

A-1l
steps per minute, one step is performed every 10 seconds. Therefore, Group 2 movement is delayed 5

seconds. At the maximum speed (72 SPM), the second group starts its step, while the first group is

completing its step. Upon removal of the command signal, all rod motion stops. However, a group that

is still in sequential motion will complete its entire step before halting. Reversal of direction is

programmed such that the last group to stop will now be the first group to move in the new direction.

In the manual mode the rod speed or stepping rate' of the control or shutdown banks of rods

is adjustable between 9 and 72 steps per minute (5 to 45 inches/minute). However, the stepping rate of

the shutdown banks is normally preset at 72 steps per minute. In the automatic mode, the stepping rate

of the control banks is controlled over a range of 6 to 72 steps per minute, in response to a rod speed

demand signal generated by the reactor control system.

The time required for a CRDM to complete a single step (i.e., 51r withdrawal or insertion) is

fixed at 780 milliseconds. This is the maximum reliable sequencing speed of the electro-mechanical

components of the mechanism. Therefore, a desired rod speed may only be obtained by varying the time

interval between coil sequencing operations. For example, a rod speed of 6 steps per minute

corresponds to one step every 10 seconds. The actual mechanism operation, however, is completed in

the first 780 milliseconds of this 10 second cycle which leaves a 'dead time' of 9.22 seconds before the

next coil sequence or step is initiated. Similarly, the fastest available rod speed of 72 steps per minute

corresponds one step every 834 milliseconds. Again, the CRDM completes its operation in 780

milliseconds leaving a 'dead time' of 54 milliseconds before the initiation of the next step.

* Bank Overlap

To compensate for the reduced effectiveness of the control rods at the top and bottom of their

travel and to maintain a relatively smooth constant reactivity addition rate, the control banks are

programmed so that bank movement is overlapped (Figure A.8). On a reactor startup, Control Bank A

is withdrawn until it reaches a preset position (approximately 115 steps). At this point, Control Bank B

starts moving out in synchronism with Bank A. Control Bank A stops when it reaches the top of the

core; Bank B continues until it reaches a preset position near the top of the core, at which time Bank

C begins to move out in synchronism with Bank B. This withdrawal sequence continues until the plant

reaches the desired power level. The overlap setpoints are preset by thumbwheel switches located in the

logic cabinet of the rod control system. For example, a bank overlap setpoint of 100 steps means that

the last 100 steps of a banks withdrawal travel will be overlapped by the next bank in the withdrawal

sequence. In the overlap region, the Group 1 rods of each of the two overlapped banks step

simultaneously; similarly, the Group 2 rods of the two overlapped banks also step simultaneously.

A.3.1 Power Cabinets

The power cabinets contain solid-state electronic components, which convert the 260V threephase a-c supply power fed from the MG sets to pulses of d-c current suitable for operation of the

CRDM coils. The electronic circuitry contained in each steel enclosed cabinet is functionally identical,

with each cabinet supplying up to three groups of rod banks, each group consists of up to 4 RCCAs. To

provide a clearer understanding of the operation of the power cabinet circuit, the following section

describes the basic principles and methods of a-c to d-c voltage conversion. It also discusses specific

details related to the operation of the power cabinet circuits.

A-12
t a 83' M* 72 SIN

t 10.000 Ms 6 S/

Id TIME FOR ONE O

STEP = 780 s

GROUP I _ _ - I L _. s VARIABLE -

th2 -DEAD TIME <- -

GROUP 2

L._ __j

-

-

Il . L

Figure A.7 Sequencing of roups vitln banks

FULL CUT

230 STEPS

FUlL IN

ZERO STEPS

128 22 2 3a 8

OIAL SP COUNT

Figure A.8 Control bank overlap program

484

A-13
* A-C TO D-C Conversion Circuits

The process of converting an a-c input voltage to a d-c output voltage is known as rectification.

In its simplest form, the rectification of a single phase of a-c voltage may be accomplished by a

single diode.

A diode is an electronic device which permits normal current flow in only one direction. Current

is allowed to flow only during those periods that the polarity of a-c input voltage is positive

(above zero). When the a-c input reverses polarity (during the second 180 of its cycle), the

diode is "cut-off", essentially blocking all current flow. No d-c voltage will appear at the output

terminals. The output voltage will remain off until the input voltage again rises above zero. This

type of voltage conversion, where the output voltage appears only during one-half cycle (180 )

of the applied a-c input voltage is called half-waW rectification. It should be noted that the

level of d-c output voltage available from this type of circuit is "uncontrolled". That is, the

average value of the d-c output voltage is either at some full maximum value, or zero. The

inability to control the range in magnitude of output voltage makes this circuit unsuitable for use

in the Rod Control System since, as discussed previously, the operating coils require a profiled"

pulse of current for proper operation.

By simply replacing the diode with another type of electronic device called a thyristor, however,

a fully controllable a-c to d-c rectification circuit may be achieved. When a thyristor is forced

into conduction, its operation is basically very similar to a diode. As illustrated by Figure A.10,

a thyristor has an additional terminal called a "gate". A thyristor will block current flow in either

direction (remain oft) until a small pulse of current, or trigger, is applied to its "gate" terminal.

The application of this trigger pulse forces the thyristor into conduction. The thyristor operates

similarly to the diode.

By controlling the time at which the gate trigger is applied, in relation to the positive half cycle

(O to 180') of the applied a-c waveform, the conduction time of the thyristor may be controlled. The

ability to control the amount of time that the thyristor is conducting enables the magnitude of the

average value of its d-c output voltage to be regulated. The point on the applied a-c waveform that the

trigger pulse is applied is called the "phase angle" or "firing point". Triggering the thyristor during small

phase angles (i.e., close to 0' of the applied a-c waveform) permits it to conduct for a longer period of

time and the average value of its d-c output will be high. Conversely, the application of a trigger pulse

with a large phase angle (close to 180() will permit it to conduct for a much shorter period of time,

producing a relatively small average value of d-c output voltages.

Taking this basic, single-phase, thyristor rectifier circuit one step further produces a three-phase,

half wave, fully controllable bridge rectifier circuit similar to the type used in the power cabinets of the

rod control system. Since, in a three-phase supply, there is a 120 phase difference between each phase,

a forward voltage is simultaneously applied to two of the three thyristors at any given time. The average

level of d-c voltage that is applied to the CRDM coils may, therefore, be varied between a maximum and

minimum value by controlling the firing point of each thyristor.

A-14
Figure AS CRD power distribution

FROM SLAV CYCLER

PROPOR1ONAL TO DIFFERENCE DElTEN THE REFERENCE SINDAL

AND HIGHEST CURRENT FEEDBACK SIGNAL

Figure A10 Thyrlstor bridge control

A-1S
S Power Cabinet Operation

A typical 4-loop plant uses five separate power cabinets which distribute d-c current command

signals to 53 CRDMs. In the this section a single power cabinet (Power Cabinet AC) is described.

Although the operation of only one cabinet is described, the circuits contained in each cabinet are

functionally identicaL

The power cabinet in Figure A.9 uses 5 phase controlled, half-wave, thyristor bridge circuits

which provide power to the stationary, movable, and lift coils of the Group 1 rods located in Shutdown

Bank 1, Control Bank A, and Control Bank C.

Three bridge circuits supply the three groups of stationary gripper coils (one bridge circuit per

group). A separate bridge is required for each stationary coil group because two groups will need to be

held in the hold' position while the other group is cycling through a withdrawal or insertion sequence.

One bridge circuit supplies all three groups of movable gripper coils through three multiplexing

thyristors. In this case, only one bridge is required because only one of the three groups in this cabinet

can be moving at one time.

The three groups of lift coils are also supplied from a single bridge, with the lift coil power

supplied through a separate multiplexing tyristor located in series with each coil. As for the movable

coils, only one set of bridge thyristors is provided for the lift coils because only one of the three groups

in this cabinet can be moving at one time.

The multiplexing thyristors are actuated by rod group selection signals generated in the logic

cabinet and act as on/off switches to block current to all but the selected rod group.

The thyristor bridge circuits supply a predetermined, regulated current to the CRDM operating

coils. This current is established by a thyristor bridge control circuit (Figure A.10), which automatically

varies the firing point (phase angle) of the thyristors in response to command signals generated by a

slave cycler circuit located in the logic cabinet.

* Thyristor Bridge Control

As shown in Figure AlO, the four coils in each group are connected in parallel. This connection

causes an equal amount of voltage to appear across each coil. The stationary coils are provided with

blocking diodes located in the supply line of each coil. These diodes prevent collapsing magnetic fields

from interacting with the gripper latches when power is suddenly removed from the coils (as during a

reactor trip).

Current to each coil passes through a series connected sampling resistor. The voltage developed

across each sampling resistor is fed back to an auctioneering amplifier. This circuit compares the

feedback signal to a reference signal developed from the current command of the slave cycler. Based

on this comparison, the auctioneering amplifier generates an error signal that is proportional to the

difference between the reference signal and the highest current feedback signal. This error signal is

applied to a phase control pulse generator, which determines the correct firing point for the bridge

thyristors and provides a thyristor trigger pulse of the proper waveshape and amplitude. Since the control

system is feedback regulated, the system compensates for large changes in coil resistance with

A-16
temperature. The circuit arrangement for the movable and lift coils is similar, however, the lift coils do

not actuate drive latches and, therefore, do not require blocking diodes.

A.32 Logic Cabinet

The logic cabinet contains all the low level electronic signal processing circuitry. In response to

demand signals received from the reactor control system and the main control board, this unit develops

and transmits the applicable power cabinet switching commands. The logic cabinet is comprised of the

following subassemblies: (1) Pulser, (2) Master Cycler, (3) Bank Overlap Unit (4) Slave Cyclers, and (5)

the Shutdown Bank C and D Control (Figure A.11).

The logic cabinet uses solid state integrated circuits, mounted on plug-in printed circuit cards.

Relays required to drive equipment external to the system, such as the plant computer, annunciators, and

equipment for the bank demand position indication, are also located in the logic cabinet.

Figure A.11 Logic cabinet block diagram

A-17
* Pulser

In response to rod speed command signals received from the reactor control System, the pulser

converts the steps-per-minute speed order to six times as many pulses per minute (e.g., 72 SPM in = 432

PPM out) and transmits this signal to the master cycler. The pulser begins operating immediately upon

receiving a command signal for IN or OUT rod motion and generates a strobe pulse that causes the

master cycler to count forward for outward rod motion or backward for inward rod motion. The pulser

also contains an oscillator circuit, which generates timing control clock pulses that are transmitted to the

slave cyclers to ensure that they operate at the correct time.

* Master Cycler

The master cycler receives the converted rod speed timing pulses from the pulser (48 to 432

Pulses/Min) and produces a cycling command count sequence for slave cyclers associated with each

power cabinet. This subassembly is basically a reversible counter, which operates over a 0 to 5 count

range. The outputs to the slave cyclers are in the form of 'GO' pulses that are taken at counts 0 and

3. Based on the sense of a rod direction strobe (also developed by the pulser) each timing pulse either

advances the counter by one count for OUT rod motion or reduces the counter by one count for IN rod

motion. Since six counts are required to obtain each "GO' pulse to a particular slave cycler, the slave

cycler is pulsed at a rate between 6 GO pulses/minute (for a rod speed of 8 steps/minute) and 72 GO

pulses/minute (for a rod speed of 72 steps/minute).

48 pulses/minute a 432 pulses/minute 72

6 pulses/GO pulse 8 spi 6 pulses/GO pulse 7 spi

A "fast pulse! control pulses the master cycler at a rapid rate until a GO pulse to a slave cycler

is obtained. The CRD System then operates at the normal rate. This feature provides immediate rod

motion on instruction from an IN or OUT command before the pulser can integrate the speed signal

from the reactor control system to pulse at the required rate.

A slave cycler associated with Group 1 rods is connected to operate at count zero and a second

slave cycler associated with Group 2 rods is connected to operate at count three. This arrangement

results in the sequencing of groups within banks.

Because of the reversible feature of the counter the last rod group that moved is the first group

to move in the new direction. Pushbuttons are provided in the logic cabinet for manually presetting or

resetting the master cycler counter.

* Slave Cycler

There is one slave cycler for each power cabinet. It sequences its associated power cabinet, and

hence the CRDIs, through one step IN or OUT for each GO pulse from the master cycler.

GO pulses from the master cycler start the operation of the slave cycler counter. Clock pulses

from an oscillator on the pulser drive the seven bit binary counter from 0 to 127 in 780 milliseconds

(time to complete one step). At the end of 780 nisec the counter is reset to zero to await another GO

pulse. The lift, movable, and stationary coil current decoder cards of this subassembly can be set to give

A-18
outputs corresponding to full (HI), reduced (LO), or zero (OFF) current orders to the CRDM coils at

any count between 0 and 127. Since the cycling sequence takes 780 milliseconds, the outputs can be

adjusted every 7801128 (or 6.1) milliseconds. The current orders are transmitted to the firing control

circuits of the thyristor bridge located in the power cabinet.

* Bank Overlap Unit

The bank overlap unit receives counts from the master cycler and records one count IN or OUT

for the insertion or withdrawal of the two groups making up a bank. The counts are recorded on a

decimal counter that counts up to 999 and back down. The decimal counter is advanced one step up or

down by the master cycler counting through 0 forward or backward.

The bank overlap unit directs the master cycler GO pulses to the proper slave cycler and

multiplexes the power cabinets at the predetermined overlap setpoints. Six 3-digit thumbwheel switches

set the bank overlap points.

Selection of individual banks for motion out of the normal programmed sequence is accomplished

with the bank selector switch through the bank overlap unit. When an individual bank is selected, the

counting feature of the bank overlap unit is locked out. Before the system is put back into overlapped

bank operation, by selecting MANUAL or AUTOMATIC on the bank selector switch, the banks must

be manually returned to the positions held before they were moved. Individual bank motion is not used

for normal operation except for mechanism testing, special physics testing, and recovery of dropped rods.

* Shutdown Bank C and D Control.

This control operates the two additional shutdown banks (C and D) required by the rod grouping

on four-loop plants. The two banks are selected by the bank selector switch, and are manually controlled

by the IN-HOLD-OUT lever.

The control consists of three units: logic, pulser and slave cycler. The logic consists of timing

circuits for the slave cycler, input/output circuits for direction and position signals and alarm detection

and processing circuits. he pulser and slave cycler units are identical to other units. The outputs of

Shutdown Bank C and D are fed (AC coupled through AC amplifiers) to the Power Cabinet. The speed

rate is generated from the pulser unit and is normally set at 72 steps per minute.

A-19
APPENDIX B

SUMMARY OF LICENSEE EVENT REPORTS FOR THE

WESTINGHOUSE CONTROL ROD DRIVE SYSTEM

January 1984 - December 1988

Table B.1 Cable/connector LERs

Table B.2 Human error LERs

Table B.3 Power and logic cabinet LERs

Table B.4 CRDM LERs

Table B.5 LERs with failure cause not delineated

Table B.6 Rod position indication LERs

B-1
Table B.1 Cablelconnector LERs

Plant LER 

Age at

Time of

Failure

(years)

Failure Description

1. Farley 1

2. Farley 1

3. Salem 2

4. San Onofre 1

5. Surry 1

6. Turkey Point 3

7. Turkey Point 4

85-012

86 004

86-008

85-009

87-008

86-026

88-001

85-021

8

9

5

20

14

16

11

Cable short circuit on supply to

stationary gripper. Two control

rods dropped which caused a

reactor trip from 99% power.

Short circuits in electrical

penetrations (2 events) resulted in

blown fuse rod drops, and reactor

trips. Low resistance was found in

several conductors. (All CRD

system electrical penetration

modules to be replaced during

outage.)

High resistance connection in cable

to stationary gripper coil found

during testing. Dropped rod

resulted in a reactor trip from 100%

power. (Improved connector design

being sought.)

Kapton insulation damage due to

mechanical stress on polyolefin

jacket. Low insulation resistance

found on 22 CRDM coil circuits.

Bad connector at vessel caused rod

drop. A rod drop and manual

reactor trip from 0% power

occurred.

Pin on connector for the movable

gripper coil was found defective. A

dropped rod resulting in a turbine

runback from 100% to 70% power

followed. This occurred during

periodic exercising of rod.

Bad connection at vessel caused rod

drop. A reactor trip from 100%

power resulted.

B-2
Table B.2 Human error LERs

Age at

Time of

Failure

(Years)

Plant Failure Description

1. Cook 2

2. Indian Point 2

3. McGuire 2

4. Point Beach 1

5. Summer 1

6. Surry 1

7. Wolf Creek 1

86-028

86-031

84-026

87-001

87-024

86-003

87-041

8

13

1

17

S

14

1

Calibration procedure error resulted

in an inoperable rod insertion limit

monitor.

Error in bi-weekly rod exercise test

caused rod drops and reactor trip

from 100% power.

Troubleshooting error made due to

a procedure deficiency resulted in a

rod drop and subsequent reactor

trip from 100%/6 power.

Test lead incorrectly placed in

preparation for testing - 22 rods

dropped. This required a shutdown

from a startup condition.

Technician inadvertently deenergized 2 power supplies resulting

in 12 dropped rods and a reactor

trip from 100% power.

Jumper came off and shorted the

logic circuitry resulting in 4 dropped

rods. This initiated a turbine

runback and loss of rod movement

capability.

Fusible link disconnect switch on

control rod movable gripper coil

was "bumped" - resulted in a rod

drop and reactor trip from 86%

power.

B-3
Table B.3 Power and logic cabinet LERs

A. Fuse Failures

Age at

Time of

Failure

(Years)

Plant LER # Failure Description

1. Braidwood 1 88-016 1 Two fuses blew which resulted in an

urgent alarm. Subsequent trouble

shooting caused a reactor trip.

2. Byron 1

3. Byron 2

4. Catawba 1

S. Connecticut

Yankee

6. Diablo Canyon 1

7. North Anna 1

85-042

88-006

86-026

87-008

87-016

874004

1

1

1

20

3

9

Degraded fuses caused four rods to

drop which resulted in a reactor trip

from 18% power.

Degraded fuse in the power

cabinets caused a rod drop. This

resulted in a reactor trip from 94%

power.

When replacing blown fuses a

power transfer caused 10 rods to

drop. A reactor trip from 44%

power occurred.

Blown fuse in stationary gripper

power supply resulted in a rod drop

and turbine runback from 98% to

93% power.

Fuse failure resulted in 4 rods

inserting 1 step. Power was

reduced until fuses could be

replaced. (Fuse modification to be

made.)

Blown fuse in the stationary

circuit resulted in a rod drop

reactor trip from 67% power.

fuses to be replaced during

refueling outage.

coil

and

AU

the

B4
B. Circuit Board Failures

Age at

Time of

Failure

(Years)

Plant LER # Failure Description

1. Beaver Valley 1

2. Beaver Valley 2

3. Beaver Valley 2

4. Byron 

5. Callaway 1

6. Callaway 1

7. Callaway 1

8. Diablo Canyon

85-011

87-013

88-009

86&028

85-048

86-024

86-029

86-007

10

11

1

1

1

2

2

1

Failure of the firing and regulation

boards caused 4 rods to drop. The

reactor was manually tripped from

1% power.

The firing circuit board overheated

which resulted in a rod drop and

reactor trip from 33% power. A

modification to improve area

ventilation was initiated.

A loss of rod movement occurred

without an alarm due to a failed

buffer card. Subsequent

troubleshooting caused rods to

drop. This resulted in a reactor trip

from 100% power.

A circuit board failure caused a rod

control urgent failure rod drip, and

manual Rx trip from 3% power.

A failed slave cycler card triggered a

logic error and zero current demand

to both the stationary and movable

coils. Rods dropped and a reactor

trip from 100% power occurred.

Overheating lead to a faulty slave

cycler counter card. Design change

to increase cooling was initiated.

Overheating caused a failed slave

cycler card which led to reactor trip

from 51% power.

Faulty logic module caused 2 rods

to drop. A reactor trip from 100%

power resulted.

B-S
B. Circuit Board Failures (Cont'd)

Plant LER #

9. Ginna 85-017

10. North Anna 1

11. North Anna 1

84-026

85-017

12. Salem 2

Age at

Time of

Failure

(Years)

16

6

7

8

3

3

12

15

13. Summer 1

14. Summer 1

85 001

(2 events)

85-011

85-014

Failure Description

Faulty firing circuit rod control

system failed. This was found

during post maintenance testing.

A failed firing card resulted in 4

rods dropping. This caused a

reactor trip from 100% power.

Three faulty alarm cards resulted in

dropped rods. A manual reactor

trip from 16% power resulted.

Circuit board failure caused a rod

drop which led to a reactor trip

from 97% power.

Failures of a pulser oscillator circuit

and erratic output of the

supervisory memory circuit resulted

in 2 separate shutdowns from 100%

power due to tech spec

requirements on movable control

assemblies.

A defective slave cycler counter

card plus human error resulted in a

rod drop and reactor trip from

100% power. The licensee

established a PM Program for the

Rod Control System Cabinets.

Pulser card failure in logic cabinet.

Alarm only.

Manual power reduction due to

failed circuit board which resulted

in a control rod urgent alarm. An

unusual event was declared.

15. Surry 2

16. Surry 2 88-005

17. Wolf Creek 1 85-079 1 A faulty supervisory memory buffer

card caused control rods to be

immovable but not untrippable.

B-6
B. Circuit Board Failures (Cont'd)

Age at

Time of

Failure

(Years)

Plant LER # Failure Description

18. Zion 1

19. Zion 1

84-027

85.025

11

12

Alarm card failure prevented rod

motion (urgent alarm). A manual

trip was initiated during startup

since the reactor was on a positive

period (increasing power).

Alarm card failure resulted in the

need for a manual reactor trip due

to change in RCS temperature.

C. Power Supply Failures

1. Beaver Valley 2

2. Braidwood 2

3. Byron 1

4. Byron 1

5. Farley 2

87-018

88 009

85-068

87-017

85-010

Power supply overvoltage limiter

failed. Rod drops and reactor trip

from 20% power occurred during

subsequent maintenance.

Power supplies failed on thermal

overload. The high temperature

was due to failure of the area

ventilation system.

Lightning surge caused the failure

of power supplies; reactor trip from

11% power occurred.

Lightning surge, failed power

supplies; two reactor trips from

98% power occurred. Modification

to grounding system being

investigated.

Lightning induced voltage surge

tripped both the normal and

redundant power supplies. A

reactor trip from 99% power

resulted. An unusual event was

initiated because of other

simultaneous problems.

B-7
C. Power Supply Failures (Cont'd)

Plant LER #

Age at

Time of

Failure

(Years)

Failure Description

6. McGuire 1

7. Salem 1

& Turkey Point 4

9. Vogtle 1

88-013

86-001

86-016

88-025

7

10

12

1

Auxiliary and primary power supply

failures resulted in a rod drop and

reactor trip from 100% power.

Internal fault in a power supply

caused loss of power to logic cards,

rod drop and reactor trip from

100% power resulted.

24V dc supply failed which caused a

rod drop a manual reactor trip was

initiated during startup.

Lightning surge caused failure of

power supplies; a reactor trip from

16% power occurred. An

evaluation of plant surge protection

was initiated.

D. Discrete Components Identified

1. Beaver Valley 2

2. Callaway 1

3. Indian Point 2

4. North Anna 1

5. Wolf Creek 1

87-012

(2 events)

86-026

88-009

86-018

87-017

1

1

15

8

2

Failed thyristor in movable gripper

circuit board; rods dropped and

manual reactor trips from low

power were initiated.

Thyristor failed in a power supply

causing a rod drop and reactor trip.

Failed input transformer caused

false rod positions.

Failed transformer on the firing

card for lift coils caused loss of rod

withdrawal capability during startup.

Multiple degraded components; rod

drop and reactor trip from 60%

power resulted.

B-8
E. WidnglConnectlons

Plant LER #

Age at

Time of

Failure

(Years)

Failure Description

1. Braidwood I

2. Byron 

3. Callaway I

4. Connecticut Yankee

5. North Anna 2

87-032

88-002

85-034

88-004

86-005

1

3

1

21

6

Loose connections resulted in

intermittent alarms; a manual Rx

trip from 1% power was initiated.

Loose connections in power cabinet

caused rod drop and a reactor trip

from 98% power.

Open circuit due to overheating in

cabinet. Rods dropped and a

reactor trip from 100% power

occurred.

Improper wiring was found in RPS

and Rod Control System interface.

This could have prevented

fulfillment of a safety function.

Momentary open circuit (loose

connection) on supply to stationary

gripper coil. This caused a rod

drop and reactor trip from 100%

power.

B-9
Table 1.4 CRDM LERs

Plant LER #

Age at

Time of

Failure

(Years)

Failure Description

1. Braidwood 1

2. Catawba 1

3. Catawba 1

4. C

5. McGuire 2

87-015

84-003

84-029

85-008

84-032

Crud buildup in the latch area

caused mis-stepping during rod

withdrawal.

Locking mechanisms on 2 drives

were defective. Required

replacement during the refueling

outage.

Fourteen unacceptable rods were

found during an inspection. These

were sent to Westinghouse for

repair. (Problem with drive rod

breech guide screws.)

Control rod guide tube pin broke

and found its way through the

primary system to the steam

generator. This occurred during a

startup and was detected by the

loose parts monitor.

Five of 53 breech guide screws did

not meet the acceptance criteria.

These were redrilled and repinned

or replaced.

6. McGuire 2

7. North Anna 2

& Point Beach 1

86-008

84-002

84-001

3

4

14

Small particle debris caused a stuck

rod. A manual shutdown ensued

during which the problem cleared.

A control rod stuck in the fully

withdrawn position which resulted

in the initiation of emergency

boration. A manual trip from 2%

power occurred.

Three nuts were missing from the

control rod guide tube split pins.

Ultrasonic testing identified cracks

in 67 of the 74 pins.

B-10
Table BA (Cont'd)

Age at

Time of

Failure

(Years)

Plant LER # Failure Description

9. Turkey Point 4

10. Turkey Point 4

11. Surry 1

12. Yankee Rowe

85-021

86-002

(2 events)

86-025

87-003

12

13

14

27

A shorted stationary gripper coil

caused a rod drop and reactor trip

from 100% power.

A faulty stationary gripper coil

caused turbine runbacks from 100%

to 68% power and from 68% to

49% power.

A failed stationary gripper coil

caused a rod drop. The coil was

replaced during a short outage.

A failed stationary gripper coil

caused a reactor trip from 100%

power. The coil stack was replaced.

B-1l
Table B5 LERs with failure cause not delineated

Age at

Time of

Failure

(Years)

Plant LER # Failure Description

1. Byron 1

2. Indian Point 2

3. Indian point 2

4. Turkey Point 4

854063

85-008

86-024

88-012

1

12

13

is

Reactor trip from 8% power.

Inadvertent rod drop caused a flux

tilt which required a power

reduction to correct.

Rods dropped resulting in a reactor

trip. Voltage from the MG set may

have been low.

A rod drop caused a turbine

runback from 100% to 60%. A

strip recorder was connected to the

circuitry to determine the cause.

B-12
Table B.6 Rod position Indication LERs

Age at

Time of

Failure

(Years)

Plant LER # Failure Description

1. Beaver Valley 1

2. Braidwood 1

3. Braidwood 1

4. Byron 1

5. Byron 2

6. Catawba 1

7. Catawba 1

8. Cook 2

9. Diablo Canyon 2

10. Ginna 1

85-017

87-013

88&004

84-040

86-002

85-057

87-016

84-018

85-018

84-011

9

1

2

1

1

1

2

6

1

15

Wiring interface problem between

the process computer and RPIS

caused false rod indication.

Manual reactor trip during startup

due to incorrect position indication.

Detector/encoder card failure

caused incorrect rod position during

startup. A manual reactor trip was

initiated.

Sticking step counter - demand

position and actual position differed

by more than 12 steps.

A detector/encoder card failed

during startup. A manual reactor

trip was initiated.

The rod position deviation monitor

was inoperable due to an electronics

failure.

During startup, the rod position

indication failed on one rod. A

manual reactor trip was initiated.

Indicated position was greater than

demand position. Shutdown from

3% power was necessary.

Digital rod position, indication

failed. A manual trip from 20%

power was initiated. An inadvertent

safety injection actuation occurred.

A loose connection in a power

supply caused the RPIS to be

inoperable.

B-13
Table B.6 (Cont'd)

Age at

Time of

Failure

(Years)

Plant LER # Failure Description

11. Ginna 1

12. Indian Point 2

13. Indian Point 2

14. McGuire 1

15. McGuire 2

16. McGuire 2

17. McGuire 2

18. Millstone 3

19. Point Beach 2

84-016

84-003

86-039

84015

84-006

85-021

87-005

88-007

86-002

16

1

13

3

1

2

4

2

14

A 13V dc power supply failure

resulted in a rod position deviation

alarm.

A RPI channel drift condition

required that a controlled shutdown

from 100% power commence.

Misalignment between

position and demand.

actual

A detector/encoder card failure

resulted in the incorrect rod

position being displayed.

(Discovered during testing.)

Central control card of DRPI failed.

Manual trip of reactor during

startup.

DRPI encoder card failed. Manual

trip of reactor during startup due to

loss of rod position indication.

DRPI failed. Power reduction

initiated until the circuit board was

repaired.

Warped circuit board caused a poor

connection which resulted in faulty

position indication. A manual

reactor trip during startup was

initiated.

The actual and demand rod

positions were different due to a

failure of the mechanical demand

counter.

B-14
Table B.6 (Cont'd)

Plant LER #

Age at

Time of

Failure

(Years)

Failure Description

20. Salem 2

21. Salem 2

22. San Onofre 1

23. San Onofre 1

24. Sequoyah I

84-006

85-010

85-013

87-013

85-009

4

5

18

20

5

A power supply failure occurred

which resulted in all rod position

and indicators failing to zero, and

all rod bottom lights coming on

while the plant was at 100% power.

During startup, the actual rod

position differed by more than 12

steps from the indicated position.

A manual shutdown was initiated.

A spurious rod bottom light

indication.

Failure of two rod bottom lights to

illuminate on a reactor shutdown.

A failure of the voltage regulator

resulted in a change in indicated rod

position of about 20 steps.

25. Sequoyah 2 88.013 7 During startup,

demand step

required that

manually shutdo

a failure in the

counter circuitry

the reactor be

26. Surry 1

27. Surry 

28. Surry 1

29. Surry 1

84-020

85-019

(2 events)

86 028

87-015

12

13

14

15

A rod bottom light failed during a

reactor trip.

Indicated rod position differed

from the actual rod position by

more than 12 steps.

Failures of 2 power supplies

resulted in the indicated change of

rod position by more than 25 steps.

Dirty contacts in a DC power supply

resulted in a change in indication of

26 steps.

B-15
Table B.6 (Cont'd)

Age at

Time of

Failure

(Years)

Plant LER # Failure Description

30. Surly 1

31. Surry 2

32. Turkey Point 3

33. Turkey Point 4

34. Turkey Point 4

35. Vogte 1

88-002

88-006

88-010

88-024

88-026

86 009

86-019

86-003

86-007

86-012

86-016

86-020

85-044

86-021

86-019

87-038

16

16

16

16

16

13

14

16

16

16

16

16

13

13

14

1

Indicated rod position was different

than actual rod position by more

than 12 steps "Generic Westinghouse

concern" cited in LERs.

Indicated rod position differed from

the actual position by more than 12

steps.

Failure of the primary detector coil

gave a false rod drop signal. This

resulted in a turbine runback from

100% to 37% power.

A voltage regulator failed which

resulted in a shutdown from 100%

power due to spurious rod

indications.

A turbine runback from 89 to

84% occurred due to a spike in the

RPI system which was caused by a

loose solder joint in a cable

connector.

A detector/encoder card failed

making the DRPI system

inoperable. A manual reactor trip

was initiated (S/U).

B-16
APPENDIX C

INDUSTRY SURVEY OF CURRENT MAINTENANCE PRACICES

NPAR Questionnaire - Magnetic Jack Control Rod Drive Svstems

Westinghouse Pressurized Water Reactors

Background

This questionnaire requests information from utility engineers concerning maintenance and operating

experience with Westinghouse magnetic jack control rod drive systems. Details on inspections and

preventive maintenance, as well as repairs and modifications will assist the NRC Nuclear Plant Aging

Research (NPAR) program. One goal of the program is to identify inspection and maintenance

methods that assure detection of aging effects prior to loss of safety functions.

Ouestionnaire Organization

To facilitate completion, the questionnaire is divided into three main sections. The first section

contains detailed questions about operating and maintenance experience amd is divided into subsections

by component locations, inside or outside of containment. The second section addresses general

system tests. The third section contains general questions, and requests that information copies of

various system descriptions and procedures accompany the completed questionnaire. Please note that

any computer printouts that describe preventive or corrective maintenance or calibrations would also

be appreciated to supplement responses in the questionnaire.

C-1
Table of Contents

CRD System Inspections, Maintenance and MOdifications

A. CRD System Components Inside Containment

1. Rod Control Cluster Assembly and Guide Tube

2. Latches and Drive Rod

3. Pressure Boundary Components

a) Seal Welds

b) Vent Valve

c) Other Pressure Boundary Features

4. Coil Stack Assembly

a) Coil Stack Components

b) Coil Stack Forced Ventilation Cooling

5. Cables and Connectors

6. Rod Position Indicator System Coils and Wiring

7. Other

B. CRD ystem Components Outside Containment

1. Cables, Connectors and Terminations

2. Power Supplies

3. Control/Logic Cabinets

4. Other

II. CRD System Tests

A. Rod Position Verification Test

B. Rod Position Indicator Channel Functional Tests

C Rod Drop Time Test

D. Other Tests

III. General

A. Rod Exercising

B. Reliability and Trend Analyses

C. Overall Ranking

D. Supporting Documents

C-2
NPAR Questionnaire

Plant Name:

Plant Contact: . Phone #

(Please circle Yes or No and provide additional information where appropriate. If additional space

is required, please attach additional sheets or use back of form (ensure question is clearly identified).

What CRDM Model # is installed at your plant?

How many such CRDMs are installed at your plant?

How long has it been since these CRDMS were

initially installed?

How much operating time has accumulated for

these CRDMs (i.e., hours, months=ears of

operation)?

I. CRD S2stem Inspections. Maintenance & Modifications

A. CRD System Components Inside Containment

1. Rod Control Cluster Assembly and Guide Tube

* Please briefly describe the full length RCCAs used in your plant (absorber material,

structural material, unique design features)

* Please summarize any indications of unusual RCCA wear or crud buildup or any

corrective maintenance related to RCCA travel (location on assembly, when)

* Please summarize any indications of Guide Tube wear, crud buildup, cracking or their

damage and any corrective maintenance, modifications or replacements (location on

tube, when)

C-3
2. Latches and Drive Rod

* Are inspections/preventive maintenance performed on:

Latch Mechanisms (wear or crud buildup)? Yes No

Frequency Describe

Drive rod (wear or crud buildup)? Yes No Frequency

Describe

* Summarize corrective maintenance or replacements of latch components or drive rods

(component, when, reason)

3. Pressure Boundary Components

a) Seal Welds

In responding to the following questions, please indicate which weld is affected:

1 - Latch housing-to-pressure vessel head

2 - Rod travel housing-to-latch housing

Are the following inspections performed on seal welds?

NDE? Yes No Frequency Which

Description

Hydrostatic? Yes No Frequency -Which

Other? Which Frequency Describe

How many seal welds have been cut and rewelded___ None

Frequency_ _ Which Reason

Has design of seal weld been modified? Yes No Which

Nhen Describe

C4
b) Vent Valve

Are valves opened and closed for any maintenance operations?

Yes No Frequency_ _ Reason

Are valves hydrostatically tested? Yes No Frequency

Has any vent valve leakage (or signs of leakage) been noted Yes No How Many?

Describe (severity, effects)

Summarize corrective maintenance or replacement of valves.

Has the design of the vent valve been modified? Yes No When

Describe

c) Other Pressure Boundary Features

Please briefly discuss any other inspections, maintenance, replacements or modifications

not addressed above.

4.

a)

Coil Stack Assembly

Coil Stack Components

Are the following inspections or tests performed on the coils?

Physical inspections? Yes No Frequency_

Features examined

Electrical tests? Yes No Frequency

Describe (test equipment, procedure)

C-S
Summarize corrective maintenance or replacements of coils or assembly wiring

(component, when, reason)

Has the coil stack assembly (or individual coil) design or operating parameters (e.g.,

voltage, current) been modified? Yes No When Describe

b) Coil Stack Forced Ventilation Cooling

Is the forced ventilation cooling system performance monitored during operation?

Yes No Descnbe (parameters, frequency alarms)

Are inspections, tests or preventive maintenance performed on forced ventilation

systems? Yes No Describe

Has the forced ventilation system been modified? Yes No Describe (include effect

on coil cooling)

Are measured coil stack assembly/coil temperatures available? Yes No

Location Temperature _ _ Measurement Method

Estimated coil stack temperature, if no measurements

Have there been any incidents of loss of the forced air cooling system? Yes

Describe (# of incidents, duration, evaluation of CRDM effects)

No

5. Cables and Connectors

Are the following inspections/tests/preventive maintenance performed?

Insulation degradation or wear? Yes No Frequency

Describe (visual, electrical test?)

C-6
Connector pin condition (e.g., corrosion or looseness)? Yes No Frequency

Connector watertight seal? Yes No Frequency

Other? Yes No Describe

Summary corrective maintenance or replacements of cables or connectors (component,

when, reasons)

If cables or connectors were replaced, please indicate manufacturer and model # of

originals and replacements

original

replacement

Have cables or connectors been modified? Yes No Describe _

6.

What is the measured or estimated (please indicate which) head area ambient

temperature? Temperature Location

Rod Position Indicator System Coils and Wiring

Are the following inspections or tests performed?

Physical inspections? Yes No Frequency

Features examined

Electrical tests? Yes No Frequency

Describe test equipment, procedure)

Other? Yes No Describe_

Summary corrective maintenance or replacements (component, when, reason)

Has the design of the RPI coils or wiring been modified? Yes No Describe

C-7
Have any unusual RPI drift or calibration problems been experienced? Yes No

Describe

7. Other

Please summarize any inspections/preventive maintenance of CRDM components inside

containment that were not addressed above (component, frequency, description of

activity)

Please summarize any modifications or corrective maintenance of CRDM components

inside containment that were not addressed above (components, when, reason)

Please summarize any incidents which may have affected CRD system performance

(e.g., spills, mechanical interactions, impacts, overheating)

B. CRD System Components Outside Containment

1. Cables, Connectors and Terminations

Inspection/Preventive Maintenance? Yes No Frequency Describe

Summarize corrective maintenance performed (number, type of repair)

2. Power Supplies

Inspection/Periodic Component Testing/Preventive Maintenance?

Yes No Frequency

Describe

Monitored during operation? Yes No Describe

C-8
Summarize corrective maintenance performed (number/type of repair)

3. Control/Logic Cabinets (thyristors, circuit boards)

Inspection/periodic Component Testing/Preventive Maintenance?

Yes No Frequency _ _ Describe (components, activity)

Monitor during operation? Yes No Describe

Summarize corrective maintenance performed (number/type of repair)

What is the average ambient temperature in the cabinets?

Estimated Measured Not Available Temperature

Location

Is the ambient temperature in cabinets monitored? Yes No Method

Is the Rod Position Indication digital or analog? Digital Analog

4. Other

Please discuss briefly any inspection/periodic component testing/preventive maintenance

of CRDM components outside containment that were not described above (component,

frequency, description of activity)

Please discuss briefly any modifications to the portion of the original CRDM system

located outside containment that were not discussed above

Please summarize other CRDM system parameters that are monitored during operation

that were not discussed above

C-9
II. CRD Sstem Tests

A. Rod Position Verification Test

Is this test required by the Technical Specifications?

Is this test performed? Yes No Frequency

What parameters are monitored?

Yes No

B.

C.

Rod Position Indicator Channel Functional Tests

Are these tests required by the Technical Specifications? Yes No

Are these tests performed? Yes No Frequency

What parameters are monitored?

Rod Drop Time Test

Is this test required by the Technical Specifications? Yes No

Is this test performed? Yes No Frequency

What parameters are monitored?

D. Other Tests

Are any other system tests required or routinely performed that were to addressed above?

Yes No

Identify key parameters evaluated

III. General

A. Rod Exercising

During operation, are individual rods periodically exercised if they have not been moved in

normal operation for some period? Yes No Frequency 'Procedure

C-10
B. Reliability and Trend Analyses

Is a reliability or trend analysis program in place for the CRD system? Yes No

Identify key parameters evaluated

C. Overall Ranling

In your opinion, what three parameters monitored, inspections performed or tests conducted

are most important to ensure operational readiness of the CRD system?

D. Supporting Documents

1. Please provide an information copy of the following to aid in understanding the operational

and maintenance of the system (please indicate if a copy is attached):

a. Calibration and functional test procedures for the rod position and rod drive control

subsystems

Attached? Yes No

b. Rod drop time test procedure

Attached? Yes No

c. CRDM inspection procedure

Attached? Yes No

d. System description (to identify plant unique features, e.g., cooling system configuration)

Attached? Yes No

2. Please attach any computer printouts that describe preventive maintenance practices and

schedules, component calibration inteals, and/or corrective maintenance that has been

performed, if possible.

3. Please add any information which may help in understanding the responses to this

questionnaire, or which you feel is pertinent to the study of CRD system aging.

C-11
NRC FORM 335 US. NUCLEAR REGULATORY COMMISSION I. REPORT NUMBER

124891 (Asslgned W NRC. Add Vol,. Sulpp, Rev..

NRCM 1102. and Aderxdum Numbers. If an.1

3201.3202' BIBUOGRAPHIC DATA SHEET NUREG/CR-5555

_ isrcon one BNL-NUREG-52232

2. TITLE AND SUBTITLE

Aging Assessment of the Westinghouse PWR Control Rod Drive

System 3. DATE REPORT PUBLISHED

MONTH YEAR

March 1991

4. FIN OR GRANT NUMBER

A-3270

S. AUTHOR(S) 6. TYPE OF REPORT

W. Gunther , K. Sullivan Formal

7. PERIOD COVERED tindive atesl

S. PERFORMING ORGANIZATION -NAME AND ADDRESS {NCT Odfoes t" Ceon. A N w~god rcommsmn tttut #nts~ctrmr

magve An Rnhn adiwss

Brookhaven National Laboratory

Upton, N.Y. 11973

9. SPONSORING AND ORGANIZATION ADDRESS -NAME (IINRC. type eat above'; II onuac rot. p~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ov We NRC Oi~~~~~~vb~~on. Office aRagloei. U.L Dlndew~~~~~~~~~~~~~~agulatoty ~~~~~rnmbs~~~t

Division of Engineering

Office of Nuclear Regulatory Research

U.$. Nuclear Regulatory Commiksion

Washington, D.C. 20555

10. SUPPLEMENTARY NOTES

11. ABSTRACT Owont sHo)

A study of the effects of aging on the Westinghouse Control Rod Drive (CRD) System was

performed as part of the Nuclear Plant Aging Research (NPAR) Program. The objectives

of the NPAR Program are to provide a technical basis for identifying and evaluating.

the degradation caused by age in nuclear power plant systems, structures, and

components. The information from this and other NPAR studies will be used to assess the

impact of aging on plant safety and to develop effective mitigating actions.

The operating experience data were evaluated to identify predominant failure modes,

causes, and effects. For this study, the CRD system boundary includes the power and

logic cabinets associated with the manual control of rod movement, and the control rod

mechanism itself. The aging-related degradation of the interconnecting cables and

connectors and the rod position indicating system also were considered. The evaluation

of the data, when coupled with an assessment of the materials of construction and the

operating environment, leads to the conclusion that the Westinghouse CRD system is

subject to degradation from aging, which could affect its intended safety function as

a plant ages. The number of CRD system failures which have resulted in a reactor trip

(Chall nie to the safety system) warrants a higher level of regulatory and industry

12. KEY WORDSIDESCRIPTORS kiLt wdserg ns tha sewe vl e rnwhe acts a the poWtJ 13. AVASLABIUTY STATEMENT

Control Rod Drives--Aging; PWR type reactors--Aging; PWR type reactor

Reactor components; reactor components--aging; reactor safety; 14. SECURITY CLASSFICATION

control rod drives--failures; failure mode analysis; thermal de-rk Pao

gradation; wear; system failure analysis; operation; data analysis; Unclassified

nuclear power plants-engineered safety systems; SRAM; US NRC; BNL, (TMRenIPK'

reactor components--failures; nuclear power plants; failures Unclassified

15. NUMBER OF PAGES

16. PRICE

NRC FORM 35 42491
THIS DOCUMENT WAS PRINTED USING RECYCLED PAPER.
UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20555

OFFICIAL BUSINESS

PENALTY FOR PRIVATE USE, $300

SPECIAL FOURTH-CLASS RATE POSTAG & FEES PAIDI

USNC

PERMIT No. G7