05000254/LER-2009-002

LER-2009-002, Quad Cities Nuclear Power Station Unit 1 05000254 1 OF 5

Docket Number
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident
2542009002R00 - NRC Website

PLANT AND SYSTEM IDENTIFICATION

General Electric - Boiling Water Reactor, 2957 Megawatts Thermal Rated Core Power Energy Industry Identification System (EIIS) codes are identified in the text as [XX].

EVENT IDENTIFICATION

Inoperable RCIC Turbine Exhaust Primary Containment Isolation Valves (PCIVs) Result in an Event or Condition That Could Have Prevented the Fulfillment of the Safety Function of Structures or Systems That Are Needed to Mitigate the Consequences of an Accident.

A. CONDITION PRIOR TO EVENT

�Unit: 1 Event Date: May 24, 2009� Event Time: 0937 hours0.0108 days <br />0.26 hours <br />0.00155 weeks <br />3.565285e-4 months <br /> � Reactor Mode: 1 Mode Name: Power Operation�Power Level: 15%

B. DESCRIPTION OF EVENT

On May 24, 2009 at 0937 hours0.0108 days <br />0.26 hours <br />0.00155 weeks <br />3.565285e-4 months <br />, approximately 20 minutes into the performance of QCOS 1300-05, "Quarterly RCIC Pump Operability Test", the RCIC system tripped on high exhaust pressure resulting in the RCIC system being declared inoperable in accordance with Technical Specification (T.S.) 3.5.3. A loud noise was heard originating from the turbine steam exhaust check valves, swing check valve 1-1301-41 and stop check valve 1-1301-64, just prior to the system tripping.

In preparation for subsequent troubleshooting/ inspections, operators hanging the clearance order to isolate the RCIC system were only able to partially close the handwheel on the containment inboard stop check isolation valve 1-1301­ 64. As a result, at 2115 on May 24, 2009, the stop check valve 1-1301-64 was declared inoperable in accordance with T.S. 3.6.1.3, Condition A (one PCIV inoperable in a flowpath with two or more PCIVs). At that time it was believed the problem was isolated to the stop check valve 1-1301-64 and the containment outboard swing check isolation valve 1-1301-41 was still fulfilling the requirement of primary containment isolation for the RCIC steam exhaust line.

On May 25, 2009 at 0000 (midnight), a shut down of Unit 1 was initiated to repair the stop check valve 1-1301-64. At 1650 hours0.0191 days <br />0.458 hours <br />0.00273 weeks <br />6.27825e-4 months <br /> on May 25, 2009, the disassembly and inspection of the stop check revealed the reason the operators were unable to fully close the stop check valve 1-1301-64 with the handwheel was because the valve plug was being held open by a nut that had likely separated from the upstream swing check valve 1-1301-41 during the RCIC test.

Based on the stop check valve 1-1301-64 inspection results, the swing check valve 1-1301-41 was also disassembled later that day (May 25, 2009). The swing check valve 1-1301-41 inspection confirmed that the disc stud, with the retaining nut still attached, had fractured allowing the valve disc to become detached from the hinge arm. The valve disc was found lying in the bottom of the swing check valve 1-1301-41. The fractured disc stud assembly migrated downstream to the stop check valve 1-1301-64 and became lodged between the disc and the seat, preventing the downstream valve from fully closing. The failed disc stud and nut assembly were retrieved from the stop check valve � 1-1301-64. The thrust washer, which is normally located between the disc nut and the hinge arm, was retrieved from the Unit 1 torus.

The failed condition of the swing check valve 1-1301-41 combined with the stuck open condition found on the stop check valve 1-1301-64 created a situation where both containment isolation valves in the RCIC turbine exhaust line would not have performed their primary containment isolation function.

An Emergency Notification System (ENS) phone call was initiated at 2032 on May 25, 2009, as required by 10CFR50.72 to report this event.

The inboard and outboard containment isolation valves in the RCIC turbine exhaust line were subsequently repaired, and RCIC was returned to operable status at 1324 on May 30, 2009, prior to Unit 1 restart.

C. CAUSE OF EVENT

The failed swing check valve 1-1301-41 valve components were retained to support an evaluation. A qualified metallurgist from Exelon Power Labs arrived at Quad Cities on June 2, 2009, and performed an inspection of the disc stud fracture surface. Based on the inspection it was concluded that the failure occurred due to high cycle fatigue, most likely as a result of the repeated impacting between the disc stud and the valve backstop. The fracture surface showed evidence of long-term degradation, with multiple initiation points around the perimeter of the stud. The multiple initiation sites are consistent with the disc being free to rotate relative to the hinge arm and likely helped extend the service life to the 27 years that was experienced. NOTE: The 27 years is based on service life following disc replacement in 1982. The swing check valve 1-1301-41 disc was last replaced in 1982 following an LLRT failure for which maintenance history notes indicate the disc was pitted.

Although swing check valves are susceptible to disc stud failures, and fatigue cracks may take several years to initiate, full disassembly to perform NDE on the swing check valve 1-1301-41 (Unit 1) and the corresponding swing check valve 2-1301-41 (Unit 2) had been discontinued at Quad Cities in 1996 because fatigue cracking had not been observed on the disc stud after 12 years in service. As a result, the preventive maintenance activities for the swing check valve 1-1301-41 were not adequate to prevent a fatigue related failure of the disc stud. The failure of the disc stud rendered both PCIVs (1-1301-41) and (1-1301-64) inoperable.

D. SAFETY ANALYSIS

The valve disk failure and resulting loose parts caused blockage of the RCIC exhaust path such that RCIC tripped on high exhaust pressure. In addition, the valve failures and loose parts resulted in both the inboard valve (stop check valve 1-1301-64) and outboard valve (swing check valve 1-1301-41) to be unavailable to perform their containment isolation function. As such the RCIC turbine exhaust check valves (1-1301-41 and 1-1301-64) have a safety function to open (RCIC exhaust) and a safety function to close (containment isolation). This event is being reported under this LER since the safety function to close for these valves was not met when required.

The RCIC turbine exhaust check valves (1-1301-41 and 1-1301-64) have a safety function to open to allow spent steam from the RCIC turbine exhaust to discharge to the suppression pool ensuring that spent steam does not remain in the turbine exhaust line causing the exhaust pressure to increase, resulting in a turbine trip [UFSAR 5.4.6.2]. The loss of the disc on the swing check valve 1-1301-41 created a blockage in the exhaust line, which led to a high exhaust pressure turbine trip and rendered RCIC inoperable. The safety significance of RCIC being inoperable is � minimal since HPCI was available at the time. An SDP evaluation of the one (1) day blockage duration of the RCIC exhaust line was determined to result in a delta CDF of 2.3E-8/yr and a delta LERF of 4.7E-9/yr. These results are also below the incremental change limit for CDF of 1.0E-06 (non-risk significance criterion for Delta CDF), and below the incremental change limit for LERF of 1.0E-07 (non-risk significance criterion for Delta LERF). As a result, the safety significance of the failure of the RCIC turbine exhaust line to open is very low.

The RCIC turbine exhaust check valves (1-1301-41 and 1-1301-64) also have a safety function to close to provide containment isolation for Containment Penetration X-212. These check valves are not explicitly modeled in the PRA for the containment isolation function because they exist in a "closed loop" system. As provided in the Quad Cities Level 2 PRA, these valves are screened from the evaluation because a failure of the "closed loop" piping (i.e., the RCIC turbine exhaust path) is required in addition to failure of the discharge check valves to isolate to lead to a containment bypass path.

The safety significance of having both containment isolation valves inoperable is negligible based on an SDP analysis that shows that even with the discharge check valves in an un-isolable state, the probability of a pipe or valve rupture in the RCIC exhaust path is calculated to be several orders of magnitude below the base containment isolation failure probability from existing failure modes. Random containment isolation failure is a small contribution to the Level 2 LERF. The increase in LERF due to the unavailability of the RCIC turbine exhaust check valves to isolate would be negligible.

The failure of the PCIVs, although impacting the containment integrity safety function, did not create any actual plant or safety consequences, since Unit 1 was not in an accident condition requiring containment integrity for the RCIC steam exhaust line during this event.

Other redundant safety systems, such as High Pressure Coolant Injection (HPCI), were available at the time RCIC was declared inoperable, and Unit 1 was subsequently shut down so that repairs to the disabled check valves could be performed.

Based on the above, the increase in risk due to the unavailability of the RCIC turbine exhaust check valves for containment isolation was negligible, therefore, the overall safety significance of this event is minimal.

E. CORRECTIVE ACTIONS

Immediate:

1. The swing check valve 1-1301-41 disc and hinge arm were replaced and the seats were reconditioned.

2. The stop check valve 1-1301-64 disc was replaced and the seats were reconditioned.

Follow-up:

1. The PM activities associated with swing check valves 1(2)-1301-41 will be revised to include a periodic replacement of the valve internals.

2. The PM activities for other susceptible check valves will be revised to include a periodic non-destructive examination (NDE) or a periodic replacement of the valve internals.

_

F. PREVIOUS OCCURRENCES

The station events database, EPIX, NPRDS, and LERs were reviewed for similar events. This event was caused by inadequate preventive maintenance activities on the swing check valve 1-1301-41 did not prevent a fatigue related failure of the disc stud.

• Station Event Database — None identified.

• EPIX/ NPRDS — None identified.

• LER — No relevant Station LERs were identified.

There have been no previous fatigue fractures associated with swing check valve disc studs at Quad Cities Station.

The swing check valves 1(2)-1301-41 both experienced fatigue related fractures of the hinge arm in the mid-1970's after 2-3 years of service, but NDE tasks performed in 1994/1995 on both valves showed that no further fatigue cracking of the hinge arm was occurring even after 20 years of service.

G. COMPONENT FAILURE DATA

This event has been reported to EPIX as Failure No. 969.

The swing check valve 1-1301-41 is an 8-inch Crane model 147-1/2U, swing style check valve, component Part No.

D34568.

The stop check valve 1-1301-64 is an 8-inch Edward model 606NY, stop check valve.