05000259/LER-2010-003
| Browns Ferry Nuclear Plant, Unit 1 05000259 | |
| Event date: | 10-23-2010 |
|---|---|
| Report date: | 09-30-2013 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor |
| 2592010003R03 - NRC Website | |
A. Event
On October 23, 2010, the BFN Unit 1 Residual Heat Removal (RHR) [BO] Loop II low pressure coolant injection (LPCI) flow control valve [FCV], 1-FCV-74-66, failed to open while attempting to place RHR Loop II in shutdown cooling (SDC). Control Room lights indicated the valve to be open, but no flow was indicated for RHR Loop II with the associated 1B RHR pump in service. RHR Loop I was then successfully placed in service for SDC.
Investigation of the event determined that the 1-FCV-74-66 disc had become separated from the skirt/stem and wedged into the seat, preventing SDC flow.
Investigation of the valve failure to open determined that the direct root cause was a manufacturing defect, undersized disc skirt threads at the disc connection. A brief history of cause-related events for this valve indicates that the original disc-skirt/disc assembly with the defect was installed during construction of BFN Unit 1 in the 1968-69 timeframe. Opportunities to detect the defect prior to the failure included a design change that installed a V-notch disc with linear flow characteristics in 1983 to mitigate flow-induced vibration problems. Additionally, testing opportunities to identify anomalies that could have resulted in valve degradation identification were reduced in 1997 (Units 2 and 3) and 2004 (Unit 1), when, in accordance with Supplement 1 to Generic Letter (GL) 89-10, RHR System Loop I/II Outboard Injection Valves, 1/2/3-FCV-74-52/66, respectively, were determined to be "passive" based on operating in their safety position during normal alignment and were removed from the GL 89-10 program.
Recent valve maintenance history indicated that 1-FCV-74-66 had been refurbished in 2006, prior to the return to service of the Unit 1 RHR System for Unit 1 restart after an extended outage. Based on causal analysis information and MOV performance data taken, the valve stem-to-disc separation occurred sometime before November 2008.
Thus, RHR Loop II was inoperable for a significant period of time.
1-FCV-74-66 is in a portion of the system that is necessary for execution of the Low Pressure Coolant Injection (LPCI) mode for that loop and if closed will block flow to the reactor. This blocked flow condition on Division II RHR, coupled with the strategy for 10 CFR 50 Appendix R postulated fires in the Division I RHR areas, would have led to no shutdown cooling flow in an Appendix R fire event. As such, the ability to achieve and maintain a safe shutdown condition, by removal of residual heat after an Appendix R fire, was lost.
C. Dates and Approximate Times of Maior Occurrences
LPCI flow control valve 1-FCV-74-66.
1983 Manufacturing defect not recognized during 1-FCV-74-66 fit-up reassembly.
1997 The 2/3-FCV-74-52/66 valves were classified as "passive" and removed from the GL 89-10 scope.
2004 The 1-FCV-74-52/66 valves were classified as "passive" and not included in the GL 89-10 scope.
2006 1-FCV-74-66 was refurbished prior to Unit 1 restart after an extended outage.
Before November 2008 1-FCV-74-66 stem-to-disc separation occurred based on MOV performance data (i.e, no unseating force).
March 13, 2009, at 0553 hours0.0064 days <br />0.154 hours <br />9.143518e-4 weeks <br />2.104165e-4 months <br /> During the Unit 1 Cycle 7 refueling outage, RHR Loop II was in service for SDC. When SDC was secured per RHR System Operating Instruction (01) 1-01-74, 1-FCV-74-66 was closed (this was the last confirmed successful operation of the valve).
October 23, 2010, at 1417 hours0.0164 days <br />0.394 hours <br />0.00234 weeks <br />5.391685e-4 months <br /> During the Unit 1 Cycle 8 refueling outage, Operations personnel attempted to place RHR Loop II in service for SDC in accordance with 1-01-74. Flow could not be confirmed.
October 23, 2010, at 1433 hours0.0166 days <br />0.398 hours <br />0.00237 weeks <br />5.452565e-4 months <br /> Operations personnel placed RHR Loop I in SDC in accordance with 1-01-74.
October 23, 2010, at 1505 hours0.0174 days <br />0.418 hours <br />0.00249 weeks <br />5.726525e-4 months <br /> Unit 1 entered Mode 4.
D. Other Systems or Secondary Functions Affected
None
E. Method of Discovery
The valve failure was discovered during the performance of BFN Unit 1 system operating instruction 1-01-74, "Residual Heat Removal System," Section 8.12.2, "Initiation/Operation of RHR Loop II in Shutdown Cooling.
F. Operator Actions
Operations personnel declared RHR Loop II inoperable for ECCS and placed RHR Loop I in service for SDC.
G. Safety System Responses
None
III. CAUSE OF THE EVENT
A. Immediate Cause
The immediate cause for this condition was separation of the valve disc from the stem/skirt, with the disc wedged into the seat in the closed position.
B. Root Cause
Root cause evaluations identified three root causes.
Root Cause - Valve Failure 1. An undersized thread barrel (manufacturing defect), when subjected to system differential pressure greater than the capacity of the reduced thread engagement, caused skirt/disc separation in 1-FCV-74-66.
Root Causes - Failure to Detect Valve Failure 2. Lack of requirement for verification of thread dimensions during reassembly of 1-FCV-74-66 using a new disc with the old disc-skirt in 1983 resulted in failure to identify and correct the undersized thread barrel leading to the valve failure.
3. Misapplication of criteria for determination of active/passive function of 1-FCV-74-66 resulted in inappropriate classification and removal from the GL 89-10 program. This resulted in missed opportunities to identify and correct the valve failure.
IV. ANALYSIS OF THE EVENT
The condition being reported is a defect in a basic component, 1-FCV-74-66, and the operation of Unit 1 in a manner prohibited by TS and the loss of a safety function as a result of this defect.
The RHR system consists of two essentially complete and independent loops identified as Loop I and Loop II. The RHR system is a multipurpose system designed to remove stored and decay heat from the reactor and containment during normal, shutdown, and accident conditions.
The RHR system consists of five modes of operation:
1. LPCI,
2. Containment Spray Cooling (CSC) and Suppression Pool Cooling (SPC), 3. Standby Cooling, 4. SDC, and 5. Supplemental Fuel Pool Cooling.
The RHR System Loop I/11 Outboard Injection Valves, 1/2/3-FCV-74-52/66, respectively, have an active safety function to open in order to maintain a flow path for LPCI injection during normal operation. Also, the subject valves are throttled in SDC and vessel make up and are fully closed when used in CSC and SPC modes of RHR operation.
necessary for vessel injection and has the ability to prevent flow from reaching the reactor if closed or blocked. When the valve disc separation eventually led to the blocked flow condition identified on October 23, 2010, it would have rendered the Appendix R strategy for fires in the Division I RHR areas unusable. Had the valve remained closed during a fire event, the plant operators would have had to exit from the Safe Shutdown Instructions (SSIs) procedures and either re-energize components in the fire affected areas or implement alternate plans for establishing flow from other low pressure sources.
Under all other (non-Appendix R) conditions the redundant loop of RHR would have been available to provide the LPCI function needed for adequate core cooling.
On October 23, 2010, BFN Unit 1, 1B RHR pump was started to provide SDC of the reactor core in support a refueling outage. After 110 seconds of observing no flow to the reactor, the pump was secured. Subsequent investigation discovered the 1-FCV-74-66 disc had become separated from the stem and disc skirt and lodged into the valve seat preventing flow to the reactor. Operations personnel secured RHR Loop II SDC and established SDC using RHR Loop I in accordance with 1-01-74. Following preliminary investigations, the failed valve was reworked and tested, and RHR Loop II was returned to service.
The TVA investigation determined the root cause of the stem-to-disc separation was a manufacturer's defect, undersized disc skirt threads at skirt/disc connection. The failure mechanism was opening thrust exceeding the strength of the threaded connection between the disc skirt and disc. The over thrust condition was in the axial direction in which back pressure on the top of the valve disc exceeded the capacity of the threaded connection, allowing the valve skirt and stem to pull-out of the valve disc. This resulted from pressure entrapment between the inboard and outboard injection valves during surveillance testing resulting in failure of the valve disc to lift off of the valve seat when the valve operator was given an open signal. If the threaded connection met design specifications, it could withstand system back pressure.
The disc could not be removed from the body by conventional means (e.g., chain falls) with the operator removed. A combination of hydraulic jacks and heating the valve body to prevent galling the seats freed the disc. It should be noted that the valve operator was stroked one time after securing from attempting shutdown cooling and at least three additional times before the valve was disassembled for inspection. The impact force of the valve stem in the closed direction lodged the disc into the seat. The required unseating force after one stem stroke would prevent removal of the disc from the seat by conventional means with the operator removed.
transmission of water supply to the reactor for a mission time up to 30 days for core cooling following initiation. Unit 1 TS LCO 3.5.1 requires both RHR loops of LPCI to be operable for ECCS in reactor Modes 1, 2, and 3. Thus, RHR Loop II was inoperable for a period longer than the 7 days allowed by TS 3.5.1.
For Design Basis Accidents, in the event of the failure of 1-FCV-74-66, the remaining ECCS subsystems (i.e., LPCI associated with RHR Loop I, two CS subsystems, High Pressure Coolant Injection (HPCI) [BJ] and the Automatic Depressurization System (ADS) [SB]) would be able to fulfill the ECCS safety function associated with RHR Loop II. ADS would be manually actuated in accordance with Emergency Operating Instructions. Long term decay heat removal would be available using RHR SPC.
The last confirmed successful operation of 1-FCV-74-66 was on March 13, 2009, during the Unit 1 Cycle 7 refueling outage when RHR Loop II was in service for SDC. However, motor- operated valve performance data indicates that the stem-to-disc separation occurred some time before November 2008. Since either time, it is recognized that one or more of the remaining low pressure ECCS subsystems were inoperable for maintenance or testing.
Therefore, TVA is also reporting the failure of 1-FCV-74-66 in accordance with 10 CFR 50.73(a)(2)(v), any event or condition that could have prevented fulfillment of the safety function or structures or systems that are needed to: (A) shut down the reactor and maintain it in a safe shutdown condition, (B) remove residual heat, and (D) mitigate the consequences of an accident.
For 10 CFR 50 Appendix R considerations, based on the results of testing and analyses, TVA has determined that RHR Loop II would have been able to fulfill its fire safe shutdown function by system pressure and vibration causing the release of the valve disc from the seat allowing makeup flow. These results indicate that the valve disc would have been released from its wedged position within seven minutes such that the required injection flow could be established. The seven-minute time period is within the time required for injection using RHR Loop II to ensure that Appendix R Fire Safe Shutdown requirements are satisfied. This time period also fully complies with the Appendix R SSIs, which the operator would be using.
However, in the event 1-FCV-74-66 and RHR Loop II are unable to fulfill the fire safe shutdown makeup function, alternate flow paths for makeup water needed for fire safe shutdown would be available for each applicable Fire Area (FA). Although the Appendix R SSIs do not direct the operator to use these alternate flow paths in the event of a component failure not caused by fire damage, these alternate flow paths for makeup would be available using the CS System or the Condensate System [KA] (for FAs other than FA 25). In addition, for some of the affected FAs, including FA 25, HPCI and/or Reactor Core Isolation Cooling [BN]) would be available.
An evaluation was performed for the past concurrent inoperabilities of safety systems for the period of the time period that Loop II LPCI was inoperable. The following conditions were considered:
LPCI Loop I (RHR Pump 1C) inoperable from November 2008, to November 16, 2010 (Available) Loop I RHR Pumps 1A and 1C inoperable from March 20, 2009, at 2055 hours0.0238 days <br />0.571 hours <br />0.0034 weeks <br />7.819275e-4 months <br /> to March 22, 2009, at 1414 hours0.0164 days <br />0.393 hours <br />0.00234 weeks <br />5.38027e-4 months <br /> (Available) Unit 1/2 A Emergency Diesel Generator inoperable from July 25, 2009, at 1127 hours0.013 days <br />0.313 hours <br />0.00186 weeks <br />4.288235e-4 months <br /> to November 16, 2010 (Available) Loop II RHR Pumps 1B and 1D inoperable for approximately 1 minute on March 21, 2009, at 0406 hours0.0047 days <br />0.113 hours <br />6.712963e-4 weeks <br />1.54483e-4 months <br /> (Unavailable) HPCI inoperable from September 1, 2009, at 1614 hours0.0187 days <br />0.448 hours <br />0.00267 weeks <br />6.14127e-4 months <br /> to September 3, 2009, at 0500 hours0.00579 days <br />0.139 hours <br />8.267196e-4 weeks <br />1.9025e-4 months <br /> (Unavailable) Core Spray Loop II inoperable from September 1, 2009, at 1210 hours0.014 days <br />0.336 hours <br />0.002 weeks <br />4.60405e-4 months <br /> to September 2, 2009, at 1741 hours0.0202 days <br />0.484 hours <br />0.00288 weeks <br />6.624505e-4 months <br /> (Unavailable) RCIC System Inoperable approximately 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> from February 5, 2010, to February 7, 2010 (Unavailable) RCIC System Inoperable approximately 35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> from August 30, 2010, to August 31, 2010 (Unavailable) HPCI inoperable from July 24, 2009, at 1130 hours0.0131 days <br />0.314 hours <br />0.00187 weeks <br />4.29965e-4 months <br /> to July 25, 2009, at 0125 hours0.00145 days <br />0.0347 hours <br />2.066799e-4 weeks <br />4.75625e-5 months <br /> (Unavailable) Risk significant systems (or portions of risk significant systems) unavailable for extended periods of time reduces the margin of safety in the plant. A Probabilistic Risk Assessment (PRA) was performed which calculated the Incremental Core Damage probability Deficit (ICDPD) and Incremental Large Early Release Probability Deficit (ILERPD). The ICDPD was determined to be 2.75E-7 and the ILERPD was determined to be 2.66E-8.
Based on the PRA, this event posed minimal reduction to public health and safety; however, this PRA does not consider fire protection strategy impacts. TVA recognizes that failure of 1-FCV-74-66, when combined with the Appendix R impact, would yield a finding of greater safety significance.
VI. CORRECTIVE ACTIONS - The corrective actions are being managed by TVA's Corrective Action Program.
A. Immediate Corrective Actions
Key corrective actions from Problem Evaluation Reports (PERs) 271338 and 369800 are listed below.
The following immediate/interim actions have been provided:
The initial 10 CFR Part 21 notification was made by LER 50-259/2010-003, Revision 1 on April 1, 2011.
1/2/3-FCV-74-52/66 assembly drawings were updated to correct historical issues.
B. Corrective Actions to Prevent Recurrence
Corrective Actions to prevent recurrence include the following.
1-FCV-74-66 was repaired to vendor specifications during the U1R8 refueling outage.
Gussets with structural welds were installed on 1/2/3-FCV-74-52/66 to preclude the need for the correct thread engagement.
Procedures governing reassembly of safety-related valves were revised to provide verification and inspection of critical dimensions when load bearing threaded connections involve the use of replacement parts.
I Regulatory programs were reviewed to verify that applicable scoping criteria have been correctly applied to establish program scope.
A. Failed Components
The RHR Loop II LPCI flow control valve, 1-FCV-74-66, was manufactured by the Walworth Company. The valve is a 24-inch No. 5297PS, 600-lb MSS SP-66 Rating cast carbon steel, butt welded, pressure-seal angle globe valve operated by a Limitorque SMB-5T-350 motor operator.
General Electric (GE) provided the valve as the Nuclear Steam Supply System Supplier via TVA/GE Contract No. 66C60-90744 (Units 1 and 2) and 67C60-91750 (Unit 3) as meeting all requirements of GE Co. Specification No. 21A1047, Miscellaneous Gate and Globe Valves, and GE Purchase Specification 21A1047AS, Globe Valves - Motor Operated (GE Parts List No.10-154) B. Previous LERs or Similar Events NA BFN Abnormal Occurrence Report (LER) No. BFAO-50-260/7432W, event date of December 4, 1974, details a similar, but different failure of 2-FCV-74-66. In that event, flow-induced vibration caused the failure of small tack welds, intended to prevent rotation between the valve disc and the stem guide ring. The tack weld failure allowed the disc to unscrew from the stem guide ring and become wedged in the seat opening.
Corrective actions for this event included the addition of a larger, stronger retaining weld to prevent separation of the parts. The undersized threads were not identified as a causal factor for that event. Mating threads on the disc and disc guide were cleaned, inspected, and found satisfactory.
C. Additional Information
The corrective action documents for this report are PER 271338 (mechanical failure mechanisms of the valve) and PER 369800 (broader issues associated with programs).
D. Safety System Functional Failure Consideration
Because of the defect, the fulfillment of a safety function (i.e., LPCI injection) could have been prevented; therefore, in accordance with NEI 99-02 guidance, this event is considered a safety system functional failure.
E. Scram With Complications Consideration
This event did not include a reactor scram.
F. 10 CFR Part 21 Reporting Requirements:
The following information is provided at this time to meet the requirements of 10 CFR Part 21.21(d)(4)(i) through (viii).
(viii) Any advice related to the defect or failure to comply about the facility, activity, or basic component that has been, is being, or will be given to purchasers or licensees.
None
VIII. COMMITMENTS
None