05000260/LER-2005-005
| Browns Ferry Unit 2 | |
| Event date: | 09-02-2004 |
|---|---|
| Report date: | 09-26-2005 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(vii)(D), Common Cause Inoperability 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident |
| 2602005005R00 - NRC Website | |
I. PLANT CONDITION(S)
At the time of the event, Unit 2 was in Mode 1 at approximately 100% power (3458 megawatts thermal).
Unit 1 was shutdown and defueled, and Unit 3 was in Mode 1 at approximately 100% power (3458 megawatts thermal). Neither Unit 1 nor Unit 3 were affected by this event.
II. DESCRIPTION OF EVENT
A. Event:
On September 2, 2004, at 0900 hours0.0104 days <br />0.25 hours <br />0.00149 weeks <br />3.4245e-4 months <br /> CDT, with both loops of the residual heat removal (RHR) [BO] system in suppression pool cooling service supporting high pressure coolant injection (HPCI) [BJ] system flow testing, the Unit 2 control room received high level annunciation on the Pressure Suppression Chamber (PSC) head tank. At 0910 hours0.0105 days <br />0.253 hours <br />0.0015 weeks <br />3.46255e-4 months <br />, direct observation of the tank revealed that it was beginning to overflow. RHR Loop I was removed from service, and the tank overflow ceased.
An apparent leakage flow path existed from the operating RHR system into this tank through two series check valves. These check valves are part of the RHR system discharge piping keep-fill system, which is normally supplied from the PSC head tank. The primary containment isolation valve (PCIV) function of these leaking check valves was declared inoperable, and the required actions for Technical Specifications (TS) Limiting Condition for Operation (LCO) 3.6.1.3 were completed.
Given that actual leakage occurred, and that this leakage started and stopped within the time window when RHR Loop I was in service, it was apparent that both of the series keep-fill system check valves had stuck in the open position during stand-by (small forward flow) service, such that they failed to check reverse system flow when the RHR system was started in support of the HPCI system testing.
Subsequent local leak rate testing (LLRT) in accordance with the BFN 10 CFR 50 Appendix J program was performed in an attempt to quantify the system leakage flow rate and to determine the as-found condition of the check valves. One of the two series valves passed the as-found leak rate testing, while the second series valve failed. It is believed that pressure pulsations involved with the starting and stopping of the RHR system were sufficient to free the internal movement of the valve which passed the post-event LLRT. During the interval when the check valves were apparently stuck in an open condition, had an actual event occurred which involved significant fuel damage, utilization of this loop of RHR could have resulted in a release of radioactive material to the secondary containment beyond that analyzed in the BFN design and licensing bases for post-accident emergency core cooling system (ECCS) leakage.
Because the RHR system at BFN serves as an extension of primary containment, this condition could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident, and is therefore reportable in accordance with 10 CFR 50.73 (a) (2) (v) (D). Reporting under 10 CFR 50.73(a)(2)(vii)(D) also applies as this condition affected redundant components in a system designed to mitigate the consequences of an accident.
B. Inoperable Structures, Components, or Systems that Contributed to the Event:
None C. Dates and Approximate Times of Major Occurrences:
September 2, 2004 0825 hours0.00955 days <br />0.229 hours <br />0.00136 weeks <br />3.139125e-4 months <br /> CDT Operations placed RHR Loops I and II in service for suppression pool cooling in support of scheduled HPCI system flow testing control room 0910 hours0.0105 days <br />0.253 hours <br />0.0015 weeks <br />3.46255e-4 months <br /> CDT PSC head tank beginning to overflow as observed locally at the tank 0928 hours0.0107 days <br />0.258 hours <br />0.00153 weeks <br />3.53104e-4 months <br /> CDT RHR Loop I removed from service; PSC head tank overflow stopped 1054 hours0.0122 days <br />0.293 hours <br />0.00174 weeks <br />4.01047e-4 months <br /> CDT LCO for inoperable PCIVs entered (made effective retroactive to 0900 hours0.0104 days <br />0.25 hours <br />0.00149 weeks <br />3.4245e-4 months <br />) 1151 hours0.0133 days <br />0.32 hours <br />0.0019 weeks <br />4.379555e-4 months <br /> CDT Check valves isolated from system September 3, 2004 0937 hours0.0108 days <br />0.26 hours <br />0.00155 weeks <br />3.565285e-4 months <br /> CDT As-found testing, corrective maintenance, and post maintenance and surveillance testing completed. Check valves declared operable, and PCIV LCO exited.
July 28, 2005 Following further review of the event, it was concluded that the flow rate out of the RHR system most probably exceeded the BFN ECCS leakage analyzed limits
D. Other Systems or Secondary Functions Affected
None
E. Method of Discovery
The keep-fill flow path check valve leakage was identified following the receipt of control room annunciation and subsequent visual verification locally at the PSC head tank. During subsequent review of the event associated with Maintenance Rule actions, it was concluded that the leakage flow rate had most probably exceeded licensing and design bases assumptions, thereby making the event reportable as a failure of the primary containment extension function of the RHR system.
F. Operator Actions
Operator actions in response to this condition were appropriate in regard to the recognition of the issue, the identification of the primary containment isolation valve LCO impact, and taking the actions necessary to implement the TS requirements.
G. Safety System Responses
N/A
III. CAUSE OF THE EVENT
A. Immediate Cause
The immediate cause of this event was the sticking open of redundant, series check valves such that reverse flow occurred from the RHR system back to the PSC head tank via the normal keep-fill flow path.
B. Root Cause
The root cause of the check valve degradation was the development of corrosion on the valve guide pin and disc surfaces which inhibited free disc motion. The development of this corrosion was inadvertently exacerbated by cleaning activities, undertaken to remove sediment build-up within the valve bodies, which disturbed a pre-existing protective oxidation layer on the material. Corrosion development is also affected by the use of different metals for the guide pin (carbon steel) and disc (stainless steel).
C. Contributing Factors
Previous failures of these and other valves in similar applications to pass LLRT had resulted in two types of completed corrective actions:
1) installation of sediment traps in the keep-fill piping upstream of the valves to keep them free of sedimentation 2) vigorous cleaning of the valve internals to get rid of sedimentation already present The trap installation was successful in minimizing sedimentation in the valve bodies. However, the cleaning methods and materials used on the valve internals contributed to the root cause stated above.
IV. ANALYSIS OF THE EVENT
Each BFN unit has four RHR trains, divided into two loops, with each train consisting of a pump and heat exchanger. The pumps provide low pressure coolant injection (LPCI) flow to the reactor during accident scenarios, and the heat exchangers are used to reject reactor coolant or primary containment heat to the RHR service water (RHRSW) [BI] system during both normal operations or accident conditions. Each BFN unit also has two core spray (CS) [BM] loops, with each loop having two pumps, which are designed to provide low pressure spray directly onto the reactor core during accident conditions. The RHR and CS systems are normally in a standby readiness configuration during reactor power operation, and the PSC head tank (one per unit) provides a means to ensure the elevated portions of the systems' discharge piping are kept full. The PSC head tank is physically located in the reactor building at a plant elevation sufficient to allow gravity flow from the tank to the RHR and CS system discharge piping as needed to replace water which gradually drains from the systems' discharge piping back into the suppression pool.
PSC head tank pumps provide the motive force to transfer water from the suppression pool back to the head tank to compensate for the small, but continuous, keep-fill flow. These pumps automatically cycle on and off as required by the PSC head tank water level. When in service, the RHR and CS pumps' discharge pressure is sufficient to force water back into the vented PSC head tank, therefore the keep-fill supply lines for each loop contain two series check valves designed to prevent such reverse flow.
In the subject event, both of the check valves associated with RHR Loop I apparently stuck for a period in the open position, and when RHR Loop I was started in support of HPCI flow testing, reverse flow occurred from this RHR loop to the PSC head tank and thence out of the tank vent. Since the tank is located in the reactor building, all of the water exiting the tank flowed into the radwaste floor drain system.
Water entering the reactor building radwaste floor drains from any source is collected in the reactor building sumps and from there pumped to the radwaste building for reclamation processing. No flow path existed for the water originating in the RHR system to reach the environs.
When the leakage flow path was identified via alarms and subsequent direct observation, the flow path was isolated through the use of manual isolation valves. This action restored the primary containment extension function of the RHR system. The check valves were leak rate tested, and corrective maintenance (inspection and cleaning) was performed on both valves. Following appropriate post maintenance and surveillance testing, the valves were declared operable and the system was returned to the normal standby alignment. As of the writing of this report, there has been no recurrence of this type event at BFN.
An effectiveness review for corrective actions taken for previously incurred LLRT failures on these type valves was undertaken in June 2005. The subject event was reconsidered as part of this review, and at that time the aspect of ECCS leakage potentially beyond analyzed amounts was first recognized. While the exact leakage flow rate for the September 2, 2004 event could not be quantified, it was qualitatively determined that the flow rate most probably exceeded the value analyzed in the BFN design and licensing basis for ECCS leakage. This determination was completed on July 28, 2005, and this LER is therefore being submitted. Following completion of the effectiveness review, including the consideration of the September 2, 2004 event, the BFN Maintenance Rule Expert Panel concluded that the RHR and CS system keep-fill system check valves should be reclassified as (a)(1) components under 10 CFR 50.65.
V. ASSESSMENT OF SAFETY CONSEQUENCES
To perform its LPCI and containment cooling functions, the RHR system pumps water from the reactor (via suction from the reactor recirculation system piping) or the suppression pool, through the associated heat exchangers, and back into the reactor, suppression pool, or drywell (via spray). The CS system pumps water from the suppression pool and sprays it directly onto the core. In a post-accident environment involving fuel damage, the reactor and suppression pool water will be highly contaminated with radioactive elements released from the damaged fuel, and therefore limitations must be placed on possible leakage of the water from these systems into the secondary containment (the reactor building) where the RHR and CS systems are located. During the subject event, the leakage from the RHR system into the secondary containment via the PSC head tank vent most probably exceeded the flow rate analyzed in the BFN design and licensing bases for ECCS leakage. Prior to the subject event, RHR Loop I had been last operated on August 6, 2004, and the keep-fill check valves functioned properly at that time. A maximum time frame in which the keep-fill check valve function may have been failed is therefore approximately 27 days.
If an event involving significant core damage is postulated to have occurred during this relatively small timeframe, radioactive releases directly into secondary containment via this ECCS leakage path could have increased above the amounts assumed in the control room habitability dose calculations. The BFN Unit 2 baseline core damage frequency (CDF) from all internal event causes is 1.25E-6 events/year.
Over the approximate 27-day interval where leakage to the secondary containment from the RHR system could have occurred during a core damage event, the estimated event frequency is: 27/365 x 1.25E-6 = 9.2E-8 events. Stated as a probability, this corresponds to 1 chance in approximately 11 million of a core damaging event occurring within this 27-day span of time. Since this frequency estimate encompasses all incidences of core damage, including those where the core damage is minor in a relative sense, it is intuitive that the probability of an accident involving significant core damage is therefore even less likely than cited above. Additionally, two other mitigating factors are present:
1)not all accident events require both RHR loops to be placed into service, and in some cases this service is intermittent. Therefore it can be stated than an RHR loop having such a leakage flow path would not necessarily be operating continuously.
2) as evidenced by the as-found LLRT results obtained following the subject event, pressure pulsations caused by starting/stopping the RHR pumps can free the internals of a stuck valve, at least in some cases. Such starting/stopping of RHR pumps would be typical in many post event scenarios.
Considering the extremely low probability of any core damage event occurring during this limited period of time, and recognizing the typically non-continuous operation of a given RHR loop in such situations, it is concluded that this condition had a negligible impact on the health and safety of the public.
VI. CORRECTIVE ACTIONS
A. Immediate Corrective Actions
- The leakage path through the check valves was isolated
- Corrective maintenance was performed on the valves as necessary to restore their function B. Corrective Actions to Prevent Recurrence)
- replace the internals of valves in this application on Unit 2 and Unit 3 with stainless material that is not susceptible to corrosion
- evaluate the different valve design being utilized on Unit 1 in light of this event
VII. ADDITIONAL INFORMATION
A. Failed Components
PSC head tank check valve — Hancock 5580W lift check B. Previous LERs on Similar Events none
C. Additional Information
Browns Ferry corrective action document PER 68160
D. Safety System Functional Failure Consideration:
The condition being reported involves a safety system functional failure which is being reported as a performance indicator data element in accordance with NEI 99-02. One safety function of the RHR system is to act as an extension of primary containment, and the condition identified herein represents a failure of this function.
(1) TVA does not consider these corrective actions regulatory commitments. The completion of these actions will be tracked in TVA's Corrective Action Program.
E.� Loss of Normal Heat Removal Consideration:
N/A. The condition being reported did not involve a reactor scram.
VIII. COMMITMENTS
None