05000346/LER-2003-001
| Docket Numbersequential Rev | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident |
| 3462003001R03 - NRC Website | |
DESCRIPTION OF OCCURRENCE:
System and component design basis calculations were performed and reviewed as part of the development and implementation of an Air-Operated Valve (AOV) Reliability Program as previously committed in Davis-Besse Nuclear Power Station (DBNPS) Licensee Event Report 2002-004. On January 30, 2003, with the reactor defueled, it was determined that four air-operated valve (AOV) actuators had negative operating margins in some limiting conditions. After initially reporting the four deficient valve actuators, a total of eight valve actuators were determined to be deficient. Upon loss of non-safety related instrument air, valves MU3, CC1495, SW1356, SW1357, SW1358, SW1424, SW1429, and SW1434 would not have been capable of performing their intended safety functions for all required conditions during past plant operation. A description of each of these valves is given separately below.
The Safety Features Actuation System (SFAS) [JE] at the DBNPS is designed to automatically prevent or limit fission product and energy release from the core, to isolate the containment vessel [NH] and to initiate the operation of the engineered safety features equipment in the event of a loss-of-coolant accident. The SFAS also initiates protective actions in the event of a Main Steam line break. SFAS protective actions include signaling various valves to stroke to their safety position or sending a confirmatory signal for valves to remain in their safety position.
The Component Cooling Water (CCW) System [CC] circulates water through a closed cooling loop to provide cooling water to safety-related equipment and reactor auxiliary equipment within the Auxiliary [NF] and Containment [NH] Buildings, transferring the heat through the CCW heat exchangers [CC-HX] to the ultimate heat sink [BS] (Lake Erie) via the Service Water (SW) System [BI]. The system pressure is set by the CCW Surge Tank [CC-TK] located upstream of the CCW Pumps [CC-P]. During a Design Basis Accident, CCW supply to non-essential components is isolated, and cooling water is supplied only to essential components, including the Emergency Diesel Generator Jacket Cooling Water Heat Exchangers [LB-HX], Decay Heat Pumps [BP-P] and Bearing Housing Coolers [BP-P-CLR], High Pressure Injection Pumps' Bearing Coolers [BQ-P-CLR], the Decay Heat Removal Heat Exchangers [BP-HX], and Containment Gas Analyzer Heat Exchangers.
During normal plant operation, the Service Water (SW) System supplies SW to the CCW heat exchangers, Containment Air Coolers (CACs), Turbine Plant Cooling Water heat exchangers, and Emergency Core Cooling System (ECCS) room coolers for cooling. Operation of the ECCS room coolers is not required during normal plant operation for heat removal, however, SW flow through the room coolers is required to minimize corrosion of the cooling coils. During emergency operation, automatic valve sequencing aligns a redundant supply path of SW to safety-related components, which include the CCW heat exchangers and CACs. A Safety Features Actuation Signal (SFAS) will cause SW pumps to start and realign valves to supply SW to essential equipment and isolate SW flow to non- essential equipment.
Valve CC1495, CCW Auxiliary Building Non-Essential Header Isolation Valve ICC-ISV1 This 16-inch butterfly valve is normally open to provide cooling water to non-essential components such as the Spent Fuel Pool Heat Exchangers [DA-HX], Reactor Coolant Pump Seal Return Coolers, Reactor Coolant System Sample Cooler, Post-Accident Sample Coolers, Pressurizer Quench Tank Cooler, and various Clean Liquid, Miscellaneous Liquid, and Gaseous Radwaste System [WE] components. On an SFAS Level 3 signal, this valve closes to isolate non-essential loads and ensure that cooling water is available for Engineering Safety Features components and the Makeup pumps' DESCRIPTION OF OCCURRENCE (continued):
gear and lube oil coolers. This valve also closes on low level in the CCW Surge Tank to ensure sufficient CCW flow is available to essential equipment. However, calculations showed that the safety- grade air accumulator installed at the valve to provide a source of motive power in the event of a loss of non-safety related instrument air is undersized. The available air volume was not sufficient to ensure the valve would fully close in the event of a loss of instrument air on an SFAS Level 3 signal or a low CCW Surge Tank level.
Valves SW1356. SW1357, and SW 1358, Service Water (SW) Return Valves from Containment Air Coolers (CAC) IBK-CLRI These 8-inch ball valves are normally open on operating CACs to provide a flow path of SW from the operating CACs to the SW return header outside containment. The CACs provide a containment atmosphere cooling function during both normal operation and accident conditions. During normal operation, these valves provide temperature control for their respective operating CAC. In the event of a design basis accident, an SFAS Level 2 signal will automatically place the two operating CAC fans in low speed. Fan operation in low speed initiates an electrical signal to stroke the control valves in the SW return lines to full open to allow maximum SW flow through the operating CACs. In the event of loss of instrument air, an actuator spring provides the motive force to open the valves. However, these valves have a dual safety function.
For both normal operation and accident conditions, two of three CACs are in operation. The third (spare) CAC is placed in standby. While the SW outlet valve of the spare CAC is normally open, it must be able to be closed and remain closed during emergency operations in order to fulfill its containment isolation function. These valves are located outside containment. The valves are held in the closed position by air pressure. Since the design basis accident analysis considers a 30-day accident duration, the SW return valve on the spare CAC must be able to stay closed to fulfill its containment isolation function for 30 days. With a loss of instrument air, the air accumulators for these valves did not have sufficient capacity to meet this 30-day closure requirement.
Valves SW1424, SW1429, and SW1434, CCW Heat Exchanger SW Outlet Valves These 12-inch ball valves are located on the SW return piping from the CCW heat exchangers. During normal operation, they serve as temperature control valves by throttling SW flow. During emergency operation, the outlet control valves for both the operating and standby CCW heat exchangers go to their full open position upon receipt of an SFAS Level 2 signal in order to maximize SW flow through the CCW heat exchangers. The valves are also to fail open upon loss of instrument air. These valves hdve a double-acting with spring assist cylinder actuator which requires the presence of air to stroke to its safety position. These valves were not provided with an air accumulator to assist in valve stroking.
Based upon the results of a dynamic differential pressure test performed on SW1434, this spring force, alone, was determined to be inadequate to stroke the valves to their full open position.
Valve MU3, Reactor Coolant System (RCS) Letdown Isolation Valve [CB-ISVI This 2.5-inch gate valve is normally open to allow letdown flow to pass from the Letdown Coolers [CB- CLR] to the purification demineralizers [CB-DM]. A small portion of reactor coolant is letdown for purification, chemical control, and degasification purposes during normal plant operation. This isolation valve closes on an SFAS Level 2 signal to isolate letdown flow as well as to provide for (outside) DESCRIPTION OF OCCURRENCE (continued):
containment isolation. This valve is also designed to fail closed upon a loss of instrument air. An internal actuator spring will take this valve to its failed position. Calculations performed showed that the isolation valve would not fully close against a maximum Reactor Coolant System pressure of 2500 psig.
APPARENT CAUSE OF OCCURRENCE:
Lessons learned from the nuclear power industry's motor-operated and air-operated valve programs indicated that AOV performance could be enhanced by improvements in valve and actuator sizing, setting, testing, and maintenance. It was found that during the original procurement cycle, many AOV actuators were undersized. This was a result of vendors being provided with inaccurate system conditions in combination with less than conservative sizing methodology used at the time, and a lack of formal calculations supporting the design basis and appropriate settings for AOV actuators. There was also the practice of sizing AOV actuators with minimum built-in margin. Similar analytical deficiencies resulted in the design of the air accumulators, used to provide a source of motive power in the event of a loss of non-safety related instrument air, not being sufficient to ensure the valves would perform their intended safety function under all design conditions. This apparent cause applies to valve CC1495.
Valves SW1424, SW1429, and SW1434 were originally designed with air accumulators to assist in valve stroking. Plant Modification 87-1315 replaced the valve assemblies in 1991, which included removal of the accumulators. These valves have a double-acting with spring assist actuator. The modification that installed these actuators stated that these valves are taken to their safety position by a mechanical spring. It was therefore concluded that the valves' accumulators were not needed and were removed. The apparent cause of this condition was an incorrect engineering assumption based on deficient design information.
As noted in the Description of Occurrence, valves SW1356, SW1357, and SW1358 have a safety function to provide containment isolation for non-operating CAC(s) following a LOCA. The accumulators for these valves were determined to have insufficient air capacity to keep the valves closed for a 30-day period, consistent with accident analysis assumptions. The apparent cause of this condition was an apparent lack of understanding at the time of plant's construction of the design and licensing basis and to correlate this information into the design of the accumulators for these valves and lack of design evaluation for the sizing of the accumulators.
As noted in the Description of Occurrence, the actuator for MU3 was designed with an internal actuator spring to stroke the valve to its fail closed position upon loss of instrument air. During normal plant operation when this valve is open, the spring is in a state of compression. Over time, this led to the degraded condition of "spring relaxation," a reduction in spring length caused by creep of the spring material under load. This spring relaxation reduced the free length of the spring, which resulted in a degraded capability to close MU3 against the force of its higher range of design operating pressure.
This spring relaxation phenomenon, which is caused by normal equipment operation over time, was not recognized for purposes of preventive maintenance.
ANALYSIS OF OCCURRENCE:
At the time of discovery there were no applicable Technical Specification operability requirements for the affected systems with the reactor defueled. However, the plant operated in this condition when the CCW System was required to be operable per TS 3.7.3.1, the SW System was required to be operable per TS 3.7.4.1, and Containment Isolation Valves were required to be operable per TS 3.6.3.1.
Therefore, this issue represents a condition prohibited by the Technical Specifications, and is reportable in accordance with 10CFR50.73(a)(2)(i)(B).
While the reactor coolant Letdown Outlet Isolation Valve (MU3) would not have closed against a maximum RCS pressure of 2500 psig, a preliminary engineering evaluation determined that the valve would have closed against a differential pressure of 2030 psi. If a leak in the RCS caused pressure to decrease to the SFAS Level 2 actuation setpoint of 1600 psig, MU3 would have closed to perform its safety function of isolating containment and reactor coolant Letdown flow.
Additionally, valve MU2A is located inside of containment in compliance with General Design Criterion 55 to isolate letdown flow upon receipt of the same SFAS Level 2 signal. This motor-operated valve remained fully capable of isolating letdown flow at full RCS pressure. Therefore, containment isolation capability of Letdown flow was degraded but maintained.
The CCW Auxiliary Building Non-Essential Header Isolation Valve CC1495 would not have fully closed in the event of a loss of non-safety related instrument air in conjunction with either an SFAS Level 3 signal or a low CCW Surge Tank level. This latter event would likely be mitigated by automatic actions.
In the event of a leak in non-essential equipment, a low level in the CCW Surge Tank would signal motor-operated valves CC5096 and CC5097, which are upstream of CC1495, to close. These two valves would then isolate the non-essential header regardless of the capability CC1495 to fully close in the event of a leak in non-essential equipment. In the event of an SFAS Level 3 signal in conjunction with a loss of non-safety related instrument air, the valve's safety grade air accumulator would not have had sufficient capacity to fully close the valve. Therefore, this issue with valve CC1495 represents a condition that could have prevented the fulfillment of the safety function of a system needed to mitigate the consequences of an accident, and is reportable in accordance with 10CFR50.73(a)(2)(v)(D).
However, motor-operated valves CC5096 and CC5097 noted above are available to provide remote manual isolation of the non-essential CCW header.
As discussed in Description of Occurrence, the respective SW return valves from the operating CACs, SW1356, SW1357, and SW1358, would not have been capable of maintaining containment isolation capability consistent with accident analysis assumptions. However, this SW piping is a closed fluid system inside containment (not connected to the Reactor Coolant Pressure Boundary nor connected directly to the containment atmosphere). Therefore, failure to maintain the containment isolation function would not create a release pathway for post-accident radioactive material.
As discussed in the Description of Occurrence, the SW return valves from the CCW heat exchangers, SW1424, SW1429, and SW1434, would not have been capable of stroking to their full open position upon receipt of an SFAS Level 2 signal. Therefore, this issue with these valves represents a condition that could have prevented the fulfillment of the safety function of a system needed to mitigate the consequences of an accident, and is reportable in accordance with 10CFR50.73(a)(2)(v)(D). Based on the results of a dynamic differential pressure test, it was concluded that the valves would only be able to stroke about 28 degrees from the closed position. Air accumulators which served to assist the safety ANALYSIS OF OCCURRENCE (continued):
function of the valves were removed in 1991 on the assumption that the actuator internal spring was sufficient to stroke the valves full open. The vendor information provided at the time of this modification suggested that the spring was strong enough to provide adequate torque. This assumption was incorrect and resulted from a lack of design'bases for the valves and lack of calculations to support valve orientation, set-up, and sizing for risk significant AOVs.
Revision 00 of LER 2003-001 had additionally identified valves CC1467 and CC1469, Decay Heat heat exchanger isolation valves [BP-HX-ISV], as potentially incapable of performing their intended safety function. Engineering calculation C-ME-016.04-035, Rev. 0, determined that the actuators for these two valves had positive margin for proper valve operation. Therefore, these valves would have been capable of performing their intended safety function under all postulated plant conditions.
Engineering calculation C-NSA-099.16-080 Revision 0, was developed to determine the increase in Core Damage Frequency (CDF), the Core Damage Probability (CDP), the increase in Large Early Release Frequency (LERF), and the Large Early Release Probability (LERP) for the conditions described in LER 2003-001. The results of this calculation determined that the increase in CDF associated with this event was 4.57E-7 / year. The increase in LERF associated with this event was 2.18E-11 / year. Based on the total operating time the condition was determined to have existed, the increase in CDP was 4.85E-6 and the increase in LERP was 2.31E-10. Therefore, these valve conditions were considered to have minimal safety significance.
CORRECTIVE ACTIONS:
An AOV Reliability Program is being implemented, in part, to ensure that AOV actuator sizing and setpoints are reviewed to verify and document their adequacy. As previously committed in DBNPS requirements, including the correct installed orientation, have been established in accordance with the AOV Reliability Program Manual. The requisite engineering documents have been developed to implement changes for category 1 and 2 AOVs. Modifications needed to restore these components to their design requirements were completed prior to restart. Post-modification testing was performed to verify compliance with design bases for the completed modifications. Identification of the AOV conditions presented in this LER are the direct result of implementation of the AOV Reliability Program which is intended to preclude recurrence of these conditions in the future. In addition, the 1991 modification to valves SW1424, SW1429, and SW1434 removed the air accumulators for these valves based upon an incorrect design/licensing assumption. The recently instituted Design Interface Evaluation process is intended to preclude future occurrence of similar conditions that can result from inadequate communications among organizations affected by a plant modification.
For valves CC1495, SW1424, SW1429, and SW1434, modifications have been implemented to install properly sized safety-related air accumulators. For valves SW1356, SW1357, and SW1358, modifications have been implemented to Install properly sized safety-related high pressure nitrogen bottles. For valve MU3, a modification has been implemented to install a new valve actuator (which does not utilize spring force) and an additional safety-related air accumulator capable of closing the valve against maximum RCS differential pressure.
FAILURE DATA:
DBNPS LER 2002-004 documents similar problems discovered with air-operated valves for which the actuators did not have the capability to properly position the associated valve for all postulated conditions. It was during the performance of the corrective actions as stated in LER 2002-004 that the problems associated with the eight valves described above were discovered as an extent of condition.
Energy Industry Identification System (EIIS) codes are identified in the text as [XX].
NP-33-03-001-02 PCAQR 97-1082 CR 99-2111 CR 02-07750 CR 02-07781 CR 03-00830 CR 03-01040 CR 03-01253 CR 03-02475 CR 03-04158 CR 03-04878 CR 03-05628 CR 03-07859 CR 04-06802