IR 05000289/1993025
| ML20059G244 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 01/04/1994 |
| From: | Kennedy J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML20059G221 | List: |
| References | |
| 50-289-93-25, NUDOCS 9401240068 | |
| Download: ML20059G244 (28) | |
Text
y
..
I
-
L U. S. NUCLEAR REGULATORY COMMISSION L
REGION I
Report No.
93-25
-
Docket No.
50-289 l
l L
License No.
Licensee:
GPU Nuclear Corporation P.O. Box 480 Middletown, PA 17057 Facility:
Three Mile Island Station, Unit 1
..
.
Location:
Middletown, Pennsylvania Inspection Period:
October 26,1993 - December 6,1993 j
.
Inspectors:
Michele G. Evans, Senior Resident Inspector
,
David P. Beaulieu, Resident Inspector
-
l Approved by:
dA3 h b.
OffL-
//4//93 Janet L. Kennedy, Acting Chief '
Date '
Reactor Projects Section No. 4B
Insoection Summary The NRC Staff conducted safety inspections of Unit 1 power operations. The inspectors reviewed plant operations, maintenance, engineering, radiological controls, and security activities as they related to plant safety.
Results: An overview of inspection results is in the executive summary.
9401240068 940113 PDR ADOCK 05000289
,
PDR-l
.
--
_..
.
EXECUTIVE SUMMARY Three Mile Island Nuclear Power Station Report No. 50-289/93-25 Operations The licensee conducted overall plant operations in a safe and conservative manner.
On November 14, 1993, the licensee shut down the unit to attempt to rescat or to replace the pressurizer code safety valve. While shut down, the licensee properly implemented the Outage
"
Fuel Protection Criteria. On November 19,1993, the licensee restarted the unit. The shutdown and restart were performed in a controlled manner and there was good management oversight.
Maintenance Overall, the licensee's conduct of maintenance activities was good.
Engineering The licensee's performance related to their plans to attempt to stop the pressurizer code safety valve leakage was weak. The licensee planned to slightly lift the valve manually without having a sound technical basis for why the valve would not fully lift and without sufficient consideration to the relative risks of performing the evolution at power versus hot shutdown.
After the licensee found that the manner in which a modified declutch lever was installed for several Limitorque motor operated valves potentially affected the operability of the valves,' the licensee was aggressive in repairing the inoperable valves and testing all modified valves to verify operability.
The failure of the licensee to identify that one of the pressurizer code safety valves that was installed during Cycle 9 had not been properly setpoint tested by the vendor following the " jack
'
and lap" process is considered a weakness. The setpoint for one of the removed safety valves '
exceeded the Technical Specification limit. Following notification by the NRC (Information Notice 91-74) of the potential for out-of-tolerance setpoints, the licensee focused on the future
,
prevention of the setpoint problem but did not sufficiently address whether the problem existed
{
on the installed safety valves. As a result, the licensee did not evaluate whether continued operation with this condition was acceptable.
The performance of Plant Engineering was weak in that they were not aggressive in pursuing why a decay heat removal check valve failed to properly seat on a consistent basis by inspecting-the valve during the 9R refueling outage. Although the valve passed the Technical Specification required surveillance, the ability of the valve to reliably perform its design function was in question. Prior to the 9R refueling outage, there were at least two instances where the core flood tank level decrease indicated that the check valve may be leaking greater than the Technical Specification limit. However, the licensee chose not to inspect the valve until the 10R refueling outage, after the valve failed the qualified test.
ii
P 4-
!
SUMMARY OF FACILITY ACTIVITIES 1.1 Licensee Activities Unit I remained at 100% power through November 14,1993, when the licensee shut down the
'
unit to replace the leaking pressurizer code safety valve.. On November 19,1993, the licensee restarted the unit and remained at 100% power for the remainder of the inspection period.
1.2 NRC Staff Activities
'
The inspectors assessed the adequacy of licensee activities for reactor safety, safeguards, and radiation protection, by reviewing information on a sampling basis. The inspectors obtained information through actual observation oflicensee activities, interviews with licensee personnel, and documentation reviews.
.
The inspectors observed licensee activities during both normal and backshift hours: 49 hours5.671296e-4 days <br />0.0136 hours <br />8.101852e-5 weeks <br />1.86445e-5 months <br /> of direct inspection were conducted on backshift. The times of backshift inspection were adjusted weekly to assure randomness.
2.0 PLANT OPERATIONS (71707,93702,90712,90713)
The inspectors observed overall plant operation and verified 6at the licensee operated the plant safely and in accordance with procedures and regulatory reqununats. The inspectors conducted regular tours of the following plant areas:
--Control Room
--Auxiliary Building-Switch Gear Areas
--Turbine Building
--Access Control Points
--Intake Structure
--Protected Area Fence Line
--Intermediate Building
--Fuel Handling Building
--Diesel Generator Building The inspectors observed plant conditions through contiol room tours to verify proper alignment of engineered safety features and compliance with Technical Specifications. The inspectors reviewed facility records and logs to determine if entries were accurate and identified equipment status or deficiencies. The inspectors conducted detailed walkdowns of accessible areas to inspect major components and systems for leakage, proper alignment, and any general condition that might prevent fulfillment of their safety function.
On November 14, 1993, the licensee shut down the unit to attempt to reseat or replace the leaking pressurizer code safety valve. While shut down, the inspector found tLt the licensee properly implemented the Outage Fuel Protection Criteria. The inspector observed the shutdown
.
e
and restart and found that they were performed in a controlled manner and there was good -
management oversight. The inspector concluded that the licensee conducted overall' plant operations in a safe and conservative manner.
3.0 MAINTENANCE (62703, 71707)
The inspector reviewed selected maintenance activities to assure that: the activity did not violate Technical Specification Limiting Conditions for Operation and that redundant components were operable; required approvals and releases had been obtained prior to commencing work; procedures used for the task were adequate and work was within the skills of the trade; maintenance technicians were properly qualified; radiological and fire prevention controls were adequate; and, equipment was properly tested and returned to service.
Maintenance activities reviewed included:
,
Preventive Maintenance Procedure E-1, " Vibration Monitoring for Rotating Equipment."
o Preventive Maintenance Procedure E-36, " Control Rod Drive Trip Breaker Inspection."
e Corrective Maintenance Procedure 1420-LTQ-8A, "Limitorque Operator (SMB-000)
e Disassembly / Reassembly."
- Corrective Maintenance Procedure 1420-LTQ-1,
"Limitorque Valve Operator Maintenance."
The inspector found that the overall performance of Preventive Maintenance Procedure E-1 and E-36 was good. The licensee's performance of Corrective Maintenance Procedures 1420-LTQ-8A and 1420-LTQ-1 is described in detail in section 4.2.
4.0 ENGINEERING (40500,71707)
4.1 Pressurizer Code Safety Valve Leakage On October 14,1993, one day prior to the startup from the 10R refueling outage, the licensee noted that one of the two reactor coolant system (RCS) pressurizer code safety valves, RC-RV-IB, was leaking at 25 gallons per hour (gph). The leak rate gradually increased to 58 gph and on November 14, the licensee placed the plant in hot shutdown to attempt to rescat the valve.
Since the attempts at stopping the leakage while in hot shutdown were unsuccessful, the licensee placed the plant in cold shutdown to replace the valve. The valve is a Dresser, 2% inch, Model
.
31739A, spring loaded safety valve.
Each refueling interval, the Vicensce replaces both pressurizer code safety valves with the two spare valves that have been as-found tested, refurbished, leak tested, and setpoint tested at Wyle l2boratory. The nominal setpoint for these valves is 2500 25 psi. The safety valves discharge to the reactor coolant drain tank, which is located within the Reactor Buildin w
4.1.1 Sequence of Events In October 1991, the licensee replaced both pressurizer code safety valves and sent the replaced valves to Wyle Laboratory for refurbishment and testing. After finding the as-found setpoint for RC-RV-1B to be acceptable (2504 psi), Wyle Laboratory replaced the valve disk and polished the seat and nozzle. After refurbishment, the as-left setpoint was 2506 psig and there was no leakage with saturated steam. There is no report of mishandling of the valve between
,
testing and installation on the pressurizer. On September 10,1993 the 10R refueling outage began and in early October the licensee replaced both safety valves, RC-RV-1 A and RC-RV-1B, with the spares from Wyle. Following the plant heatup at the end of the refueling outage, both -
safety valves were leak tight at normal operating pressure (2155 psi.)
On October 14, the licensee raised reactor coolant system (RCS) pressure to 2290-2300 psig to satisfy Technical Specification 4.3, " Testing Following Opening of System." This test caused RC-RV-1B to start leaking at 25 gallons per hem (gph). The licensee estimated the leak rate by evaluating the rate of level increase in the reactor coolant drain tank. Since the reactor coolant pump seal leakage also drains to the reactor coolant drain tank, the licensee estimated the seal leakage rate and accounted for this in the leak rate calculation. The safety valve tailpipe differential temperature (difference between tailpipe temperature and Reactor Building ambient temperature,) which provides an indication (not a measurement) of valve leakage, also increased from 10 F to 80*F. The Technical Specification (TS) ::mit for identified leakage is 10 gallons per minute (gpm). The TS limit for leakage plus recoverable losses (safety valve leakage is considered a recoverable loss) is 30 gpm. Plant Engineering contacted Dresser Industries, who recommended an RCS pressure reduction to 2000 psi to attempt to seat the valve. The licensee reduced RCS pressure to 2000 psi for 3 minutes but the leakage continued.
On October 15, the licensee decided to start up the plant with the valve leaking in hopes that the leakage would eventually decrease on its own or that some action could be taken to stop the leakage. In addition, the licensee thought the leakage was not significant enough to delay plant startup because they had operated with a small amount ofleakage in the past. The reactor was taken critical at 8:52 a.m.. At noon, the Shift Foreman entered the Reactor Building and struck the valve with a hammer in five locations, but this did not reduce the leak rate. The licensee had not consulted with Dresser Industries regarding striking the valve. Plant Engineering later contacted Dresser Industries concerning the possible courses of action to stop the leakage.
On October 16, a feedwater transient occurred with the plant at 40 percent power which resulted in an RCS pressure fluctuation between 2130 and 2200 psig. Following this transient, the leakage stopped. For unknown reasons, after 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> the leakage resumed at 24-28 gph. On October 22, full power level was established and RC-RV-1B was leaking at 23 gph. On October 23 and 24, the leak rate increased to 34 gph.
On October 25, as recommended by Dresser Industries, the licensee lowered RCS pressure to 2000 psig ft 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to try to rescat the valve. The leak rate dropped to 27 gph at 2000 psig but returned to 34 gph at normal operating pressure. The licensee continued consulting with
- l
l Dresser Industries and Wyle Laboratory to determine the best way(s) to stop the leakage.
Dresser advised GPUN that if this leakage persisted for more than about 30 days, then seat damage would likely occur.
On October 26, the Plant Review Group (PRG) met and recommended the following options for '
,
,
I seating the valve: 1) reduce RCS pressure to 2000 psig for 3 to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />; 2) tap the valve with a hammer; 3) install a hydroset and lift the valve off its seat slightly - a Safety Evaluation would be prepared to address whether the evolution could be done at power, and; 4) shut down the plant and install a gagging device to close the valve. Following the meeting, the licensee lowered RCS pressure to 2000 psig for about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, then tapped the valve with a hammer in
,
a manner recommended by Dresser Industries. Leak rate decreased to 22 gph at 2000 psig but I
returned to 33 gph when normal RCS pressure was reestablished.
,
On October 27, in a conference call between the licensee, the Office of Nuclear Reactor Regulation, NRC Region I management, and the resident inspectors, the licensee outlined a 2
)
phase program to reduce the leakage: 1) While at full power, install a hydroset and lift the valve off its seat slightly. Lifting the valve seat to where the valve simmers, but does not fully lift, could clear the valve seat of any possible debris and allow the seat and disk to realign themselves, and; 2) Shut down the plant and gag the valve to force it closed. The staff questioned why the first test had to be done at power. No specific reason was given for staying at power for this test, but the licensee stated that this would be addressed in their Safety Evaluation. Later that day, the resident attended a licensee management meeting in which the-l licensee stated that instead of installing a hydroset to slightly lift the valve, the valve would be lifted using the manual lever. The licensee planned to use an extension bar on the manual lever to provide additional lifting force.
On October 29, the licensee informed NRC Region I management that they planned to have an 11:00 a.m. PRG meeting to review the Safety Evaluation and at 2:00 p.m. they planned to conduct the test to manually lift the valve while at full power. The Regional Administrator then contacted the Vice President of TMI-2 (who was acting for the President of GPUN) to inform him that the staff's position was that the test should not be performed with the plant at power.
The licensee's senior management directed that the manual lifting of the valve be delayed to accommodate an independent review. The licensee established a Special Review Committee of 9 people to review the Safety Evaluation and Special Temporary Procedure. GPUN agreed not to conduct this test until the special review was completed and the NRC was notified of the results.
On October 30, the PRG met again to review the Safety Evaluation and the Special Temporary Procedure so that they could be reviewed by the Special Review Committee. The PRG discussed the reasoning behind the proposal to perform this evolution at power, rather than at hot shutdown or cold shutdown. The PRG emphasized that megawatt generation was not a
'
factor in their decision. The PRG determined that their decision would be based on the risk of performing the manual lever exercise at power, versus the known concerns of a plant thermal cycle as a result of the plant shutdown. The PRG then reviewed the Safety Evaluation for
.
-_
_.
. _.
.
,
manually lifting the valve at full power and they had two concerns. The first PRG concern was that they were uncertain whether the valve could fully lift when the valve is lifted slightly off its seat. [When steam passes the valve seat, it enters a huddle chamber and then exits the valve.
If there is sufficient steam flow (valve disk lifts enough,) the huddle chamber pressurizes and a larger valve disk area is exposed to the steam pressure. This provides a greater upward force that causes the valve to pop fully open.] Technical Functions had performed calculations which showed that if the valve was manually lifted only 0.015 inches, this would allow the valve to fully lift. Based on this calculation, the licensee had asked Wyle Laboratory to conduct manual -
lift testing on the sister valve which had been sent to Wyle for refurbishment. The second PRG concern was that they were uncertain if the manual lift was an unreviewed safety question, thereby requiring prior NRC approval to conduct this test. Assuming the valve could lift, the licensee evaluated whether "the probability of occurrence of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be
'
increased." The PRG could not achieve a clear consensus on this question and they expected
,
that the manual lift testing that was being conducted at Wyle could resolve the issue.
,
Wyle Laboratory contacted the PRG with the test results. Wyle stated that, using a surging motion on the manual lever, the maximum that the valve would open was 0.019 inches and this did not cause the valve to pop open. A steady force of 294 lbs was required to lift the valve 0.004 inches. Wyle stated that steam could not enter the huddle chamber fast enough to provide a momentum component of force to pop open the valve. Based on the Wyle test, the PRG concluded that the Technical Functions calculation did not accurately represent the situation.
The PRG concluded that it would be physically impossible to manually lift the valve enough to cause the valve to pop fully open and therefore, the test at power did not create an unreviewed safety question.
On November 1, the Special Review Committee conducted a review of the Safety Evaluation and Special Temporary Procedure. After delibe.ations, the committee voted on the question "Can this evolution be performed safely at power with consideration to nuclear, radiological and industrial safety consequences?" The committee concurred unanimously that the evolution could be performed safely at power as long as an extension bar was not used on the manual lever and the test was performed with an RCS pressure of 2000 psig. The committee determined that the force required to lift the valve to the point that it would fully stroke open would be significantly larger than that required to cause the valve to simmer. Therefore, it would be physically impossible to fully lift the valve without the aid of an extension bar. In addition, if the valve fully opened, it would most likely immediately close when the manual lever is released because the evolution is performed at a reduced RCS pressure.
The Special Review Committee then voted on the question of "Should this evolution be performed at power considerinP the associated risks and the probability for success?" Six of the nine committee members recon.
against performing the evolution at power. The issues identified as favoring the evolution m r - were: the leak rate is increasing; the plan is in accordance with vendor guidance; cycling the valve is pmW and may completely correct the
.anical Specifications, and; problem; the evolution is within the bounds of IN L a
t
-
.
,
.
y P
,
the alternative is to take the plant offline which results in a thermal cycle to plant components.
'
The issues identified as HQt favoring the evolution at power were: the valve seat may already be damaged and therefore the evolution may not be successful; the restriction to preclude use of an extension bar adds industrial safety risk and limits the chance of success; if the reactor coolant drain tank rupture disk failed, there would be a significant decontamination effort, and; the chances of success are greater at hot shutdown, because an extension bar could be used and a
'
gag could be installed to limit stem travel to prevent a full lift.
On November 5, the licensee informed the NRC that on November 14 they planned to place the plant in hot shutdown and attempt to rescat the valve by manually lifting the valve. If leakage
,
did not stop, they planned to cool down the plant and replace the valve.
,
On November 9, the licensee finalized the Safety Evaluation and Special Temporary Procedure to be used for the evolution. The procedure specified the installation of the gag to limit the stem travel to approximately 0.015 inches. After reducing pressure to 2000 psi, the procedure allowed the use of a 4 foot extension bar to manually lift the valve. If the valve did not rescat, the gag could be used to close the valve.
On November 14, the licensee shut down the plant. Prior to the test, the licensee briefed control room operators on the operator actions for a loss of coolant accident, the high pressure injection
-
initiation criteria, and the effects on instrumentation on a sudden RCS depressurization. After reducing pressure to 2000 psig, the licensee manually lifted the valve four times but was unsuccessful in stopping the leakage. The maximum RCS pressure reduction during lifts was
31 psi and the valve always closed when the manual lever was released. The licensee decided to place the plant in cold shutdown to replace the valve. The licensee plans to prepare a Plant Experience Report to evaluate this incident.
-l 4.1.2 Event Followup The inspector reviewed various draft versions of the Safety Evaluation and Special Temporary
]
Procedure that were written to perform a manual lift at power. Although none of these draft j
documents for a test at power were signed off and approved by the licensee, the discussions with the NRC management demonstrated that the licensee planned to perform the evolution in the manner described by the procedures.
-
The inspector had several concerns with performing the evolution at power. The following is i
an assessment of the licensee's Safety Evaluation and Special Temporary Procedure which were
-
provided to the Special Review Committee. In the draft test procedure, there was a Caution to not lift the manual lever more than one inch after removing the mechanical play from the lever.
This step was written before the licensee had completed the calculations to show how much disk movement is required for the valve to fully open by steam pressure. The licensee determined that the maximum amount that the valve disk could physically travel was 0.4 inches and this
'
corresponded to 4 inches of lever motion. The licensee wanted to prevent the operator from j
.
mechanically lifting the valve fully open so they decided to administratively limit the lever j
,
.
-
-
..
.
.
motion to one inch, which corresponds to 0.1 inches of disk movement. Therefore, the one inch limit did not account for the fact that steam pressure could fully lift the valve with a disk movement of much less than 0.1 inches. In addition, the Safety Evaluation states that the valve would only be lifted 0.015 inches.
The PRG determined that the manual lift at power was not an unreviewed safety question. The PRG based their decision on the Wyle test results which showed it would be physically impossible to fully lift the valve. However, Wyle dia not use an extension bar during the test.
The draft test procedure allowed the use of a 4 foot extension bar, which made it physically possible to fully lift the valve. Therefore, the PRG did not adequately address whether using the extension bar created an unreviewed safety question.
The licensee was unable to calculate the amount of disk lift that would be required to fully lift the valve. Since the calculations performed by the licensee and Dresser yielded different results, the PRG determined that the calculations did not accurately represent the situation, and therefore, relied on the Wyle test results. Since Wyle did not lift the manual lever to the point that the valve popped open, the amount of lever motion / disk movement required for a full lift is unknown. After the Wyle test, the procedure still allowed one inch of lever movement (0.1 inches of disk movement) which exceeds the maximum amount that Wyle lifted the valve (0.019 inches.) Even if the licensee had determined the amount of lever motion required for a full lift, there is no way to measure or precisely control the lever movement.
During the Wyle test, the operator was able to hand lift the valve 0.019 inches by using surging motion on the manual lever. Continuous hand force could not maintain this lift. The maximum amount that Wyle held the valve open was 0.004 inches by using a mechanical means. The draft '
Safety Evaluation states that during the brief duration that the surging manuallift takes place, it is impossible for enough steam to accumulate in the huddle chamber for the valve to fully lift.
However, using an extension bar, it is possible to lift and hold open the valve. Since the amount of sustained disk lift required for the valve to fully open is unknown, it is not known if the valve could fully lift if manually held open at 0.015 inches (Safety Evaluation value) or 0.1 inches (test procedure value.)
The inspector agreed with the licensee that the plant experiences a thermal cycling during a shutdown. However, the inspector does not consider the thermal cycling to be a sufficient technical basis for avoiding a necessary plant shutdown. In addition, this concern is not
,
eliminated with the at-power test because an RCS pressure drop of only 100 psi would result in a reactor trip.
The inspector agreed with the licensee that the possibility of the valve lifting and sticking open was remote. However, performing the evolution in hot shutdown eliminates this possibility by limiting stem travel with the gagging device. Therefore, performing the evolution while in hot
.
shutdown is preferred from a technical and safety perspective.
,
. _ -
.
.
.
.
!
.
The inspector agrees with the licensee that lifting of the safety valve is not inherently unsafe.
When the safety valve is called upon, there is a controlled loss of coolant which is designed to
.l prevent a larger uncontrolled loss of coolant accident elsewhere in the RCS. Therefore the J
lifting of the valve is preferred from a safety perspective. However, in this situation the choice is between performing an evolution in a manner which could result in a loss of coolant versus performing it in a manne in which a loss of coolant is prevented.
Based on the above uncertaiu u, the inspector determined that the licensee did not provide an adequate technical basis that the valve would not lift and therefore, it was not acceptable to perform this evolution at power. NRC senior management expressed their concerns to the licensee who then formed the Special Review Committee. The inspector agreed with the majority of the committee members who determined that although the valve is unlikely to fully lift without the aid of an extension bar, it was still best to perform the evolution in hot shutdown.
The inspector concluded that the licensee's performance was weak in that they planned to perform the evolution at power without having a sound technical basis for concluding the valve would not fully lift and without sufficient consideration to the relative risks of performing the evolution at power versus hot shutdown.
4.2 Limitorque Valve Operator Failures In response to a Part 21 notification from Limitorque dated December 7,1992, the licensee replaced the manual declutch lever on 30 motor operated valves with new levers supplied by Limitorque. The Part 21 report concerned the possible malfunction of models SMB/SB/SBD-00 or SMB/SB-000 during a seismic event due to an imbalanced declutch system. On November 12, 1993, the licensee replaced the levers on eight valves. The new levers had paint in the machined hole which prevented the lever from easily slipping onto the shaft and therefore, the i
maintenance personnel used a hammer to tap the lever onto the shaft. The next day, during the scheduled performance of an operations surveillance, one of the eight valves (nuclear river pump
'C' discharge valve), could not be closed or opened electrically.
The manual handwheel is engaged and the motor is disengaged by depressing the declutch lever.
The valve is designed to automatically disengage the manual handwheel and engage the motoi when the valve is operated remotely from the control room. The licensee found that tapping the lever onto the declutch shaft moved the shaft into the housing and caused a misalignment of the
-
tripper fingers (which remained stationary) in relation to the declutch tripper cams (which moved with the shaft.) When the valve was operated from the control room, the declutch tripper cams rotated but did not contact and move the tripper fingers which prevented the handwheel from disengaging and the motor operator from engaging.
On November 13,1993, the licensee evaluated the remaining seven valves. The licensee found that two of the eight valves (NR-V-1C and EF-V-1 A) did not operate electrically; two of the eight valves (NR-V-l A and NR-V-1B) operated electrically initially but would not operate
.
__
,
l
.
l
.!
.
!
electrically after being manually cycled, and; the remaining four valves (RR-V-1 A/B, RR-V-5, EF-V-1B) operated electrically both before and after manual operation. The licensee found that the tripper fingers were misaligned on the four valves that failed to operate as designed.
NR-V-1 A/B/C are the nuclear river water pump discharge valves which are normally open when the pump is operating, and normally closed when the pump is not operating. These valves receive an engineered safeguards signal to open. There is no automatic signal to close. During the period in question, NR-V-1 A/B/C were open which is the position required for the nuclear river water system to perform its safety function. The inability to close the discharge valves electrically when the pumps are secured does not render the pumps inoperable because the discharge check valves will prevent reverse flow through the pumps.
EF-V-1 A/B are the suction valves for the two motor-driven emergency feedwater pumps. They are required to be open, and do not receive any automatic signals. During the period in i
question, vahes EF-V-1A/B were open which is the position required for the emergency feedwater system to perform its safety function. Even though EF-V-1 A could not be operated electrically, there is no operating procedure or emergency procedure that closes the suction valve.
RR-V-1 A/B are the reactor building emergency cooling water pump discharge valves which are normally closed. The valves receive an engineered safeguards signal to open. RR-V-5 is a reactor building emergency cooling water system valve that can be used to control back pressure in the Reactor Building fan coil units. Even though the tripper fingers were misaligned on these valves, testing showed that the valves still would have operated as designed and therefore, the operability of the system was not effected.
As the declutch lever shaft exits the housing, there is a machined groove around the shaft.
There is a retaining ring that fits in this groove which is designed to prevent the movement of the shaft into the housing. Since the shaft did move into the housing, the licensee inspected EF-V-1A (which failed electrically), to determine if the retaining ring had been dislodged or deformed. The licensee found that the retaining ring was properly in place.
Plant Engineering contacted Limitorque who stated that they have no prior information concerning an event of this type. They also confirmed that the lever arm should slip onto the shaft and should not need to be tapped on.
The PRG evaluated the list of 22 additional Limitorque operators which were similarly modified during the 10R refueling outage. The PRG determined that the alignment problem does not exist on these valves because 1) the paint was removed from the lever arm socket prior to installation and no tapping was needed, and 2) most or all of the valves were operated electrically following the replacement of the lever arm. However, the PRG recommended that all 22 of these valves
.
.
be tested to confirm their operability. The licensee operated all 22 valves electrically, then
'
manually, and then electrically again and found that all valves operated as designed. Based on this test, the licensee concluded that all 22 valves were operable and that disassembling any of these valves to check the alignment of the tripper fingers was not necessary.
.
The licensee performed the lever replacement in accordance with Corrective Maintenance Procedures 1420-LTQ-8A, "Limitorque Operator (SMB-000) Disassembly / Reassembly", and Corrective Maintenance Procedure 1420-LTQ-1, "Limitorque Valve Operator Maintenance."
The licensee did not specify any post-modification testing because they did not expect the
,
operation of the valve to be affected.
The Plant Review Group (PRG) determined that the Technical Specification requirements for operability of the valves / systems were met at all times since the valves that failed to operate were in their required engineered safeguards position. Since some of the eight valves could not be operated electrically following the declutch lever replacement, and since the misalignment was found in all four valves that failed, the PRG concluded that this event was reportable under 10 CFR 50.72 b.2.iii and 10 CFR 50.73 a.2.v as an event or condition which alone could have prevented the fulfillment of the safety function. The licensee notified the NRC of the incident j
on November 17, 1993.
j The inspector questioned the licensee why it took four days from the time of discovery to make the 4-hour report per 10 CFR 50.72 b.2.iii. The licensee stated that time was needed to
,
determine why NR-V-lC did not operate electrically; what caused the declutch shaft movement since this had never been experienced at TMI; which valves had the declutch lever tapped on;
)
did the tapping affect the operability of these other valves; did the inoperable valves affect the operability of the system for the period in question, and; what other valves also had the modification and was the operability of these valves / systems affected? After all 30 modified valves had been tested, the PRG had a full understanding of the extent and the significance of the problem and the licensee made the Emergency Notification System call within one hour after the PRG meeting. Since time was needed to evaluate all the valves to determine if the deficiency could have prevented the fulfillment of a safety function, the inspector determined that the delay in reporting was not unreasonable.
The inspector evaluated the performance of the maintenance technician who tapped the declutch lever. The technician stated that he did not believe that the amount of force he used was unreasonable. Since this problem had never occurred at TMI or any other plant, neither the licensee's procedures nor the Limitorque vendor manual cautioned against using impact. The
,
i inspector determined that the consequences of using a hammer to tap the lever on the shaft could not have been foreseen.
,
e
_.
i
.
.
.
i
The inspector evaluated the licensee's decision to not perform post-modification testing on the valves. The modification involved loosening a set screw, removing the declutch lever, installing.
i the new lever, and tightening the set screw.
The inspector determined that it was not unreasonable for Plant Engineering to expect that the operation of these valves would not be affected by this simple modification.
The inspector concluded that once the licensee became aware of the problem, they were aggressive in repairing the inoperable valves and testing all the modified valves to verify operability. In addition, the technicirn who used the hammer to install the declutch levers could not have foreseen the negative impact of this action on plant safety and the licensee's decision not to perform post-modification testing of the valves was not unreasonable. After the licensee completes the Licensee Event Report, the inspector will evaluate their plans to prevent recurrence of a similar incident.
4.3 (Closed) Licensee Event Report (LER 93-007-00) Decay Heat Removal Check Valve Leakage On September 11,1993, while performing Surveillance Procedure 1300-3T, " Pressure Isolation Test of CF-V-4A/B, CF-V-5A/B, and DH-V-22A/B," the licensee found that the leak rate for DH-V-22B, the 'B' decay heat removal (DHR) pump discharge check valve, exceeded the Technical Specification limit (exact Icak rate was not quantified.) The Technical Specification limit for DH-V-22B leakage is 1 gallon per minute (gpm) or up to 5 gpm if the increase in leakage from the past test is less than 50% of the difference between 5 gpm and the previous leak rate value.
DH-V-22B is a 10 inch tilting disk check valve manufactured by Crane / Chapman. When the licensee disassembled and inspected the valve, they found there was
excessive looseness in the hinge pins.
For the two operating cycles prior to the 10R refueling outage, DH-V-22B had a history of not seating properly when DH-V-4B was opened. DH-V-4B is a normally closed containment isolation valve on the discharge of the decay heat removal (DHR) pump, DH-P-1B. DH-V-22B is a check valve downstream of DH-V-4B. There are two check valves in the piping that connect the core flood tank to the reactor vessel. The DHR system discharges to the reactor coolant system between these two check valves. DH-V-22B is normally exposed to the pressure in the core flood tank (600 psi). When DH-V-4B is opened and DH-V-22B leaks, me core flood tank flows into the DHR system. Since the Techaical Specification limit is based on normal reactor coolant system (RCS) pressure on the downstream side, the DH-V-22B leak rate values provided in this section were corrected to normal RCS pressure where appropriate. The design pressure for the DHR system is 505 psi, the hydrostatic test pressure is 637 psi, and the relief valve on the DHR pump discharge is set for 520 psi.
<
.
.
On August 14,1991, when the licensee opened DH-V-4B for MOVATS testing, the DH-V-22B leak rate was estimated at 6.95 gpm based on the rate of core flo(xl tank level decrease. The-licensee then opened DH-V-4B using the motor operator, rather than the manual handwheel that was used during testing, and sudden release of pressure between DH-V-4B and DH-V-22B caused the valve to properly rescat.
On September 27,1991, while performing Surveillance Procedure (SP) 1303-5.2, Emergency Loading Sequence and High Pressure Injection Logic Channel / Component Test," the licensee opened DH-V-4B and the DH-V-22B leak rate was estimated to be 7.02 gpm based on core flood tank decrease (the licensee's value of 4 gpm core flood tank decrease in the LER was not the correct value.) During the 9R refueling outage which began on September 27,1991, the licensee precisely measured DH-V-22B leakage per SP 1300-3T, " Pressure Isolation Test of CF-V-4A/B, CF-V-5A/B, and DH-V-22A/B," and the leak rate was 0.53 gpm. The licensee chose not to inspect DH-V-22B duririg this outage because the valve passed the qualified leak rate test, SP 1300-3T. In addition, the inspection of the valve requires the plant to be in mid-loop operation which is a higher risk plant condition.
On April 12, 1993, while performing SP 1303-5.2, core flood tank level again decreased when the licensee opened DH-V-48, but there was insufficient data to estimate DH-V-22B leak rate.
After questioning by the inspector, on April 13, 1993, the licensee again opened DH-V-4B and the DH-V-22B leak rate was estimated to be 4.44 gpm.
On September 11,1993, during the 10R refueling outage, the licensee again performed SP 1300-3T. The licensee did not quantify the leakage but it was greater than 5 gpm. Based on these results, the licensee decided to disassemble and inspect DH-V-22B. The licensee's inspection showed that the hinge pins had excessive freedom of movement such that the valve would not
,
consistently seat tightly if the valve closed gently. The licensee found no unusual corrosion or
'
erosion, no missing or broken parts, and the seats were in good condition. In addition, the visual inspection showed that there may have been leakage past the seat ring gasket. The licensee does not know to what extent the seat ring gasket leakage contributed to the test failure,
!
if at all.
The licensee replaced the DH-V-228 internals and, with manufacture's concurrence, installed
!
two additional o-rings at the seat ring gasket. The replacement internals supplied by tnc manufacturer are different from the original design in that the hinge mechanism has a single j
hinge pin rather than two hinge pins (a pin at the attachment on either side of the valve body.)
i The one hinge pin design provides a tighter hinge mechanism. The licensee tested the. valve following the repair per SP 1300-3T and there was no leakage.
-l On October 8,1993, the licensee completed their review of the visual inspection and the test
'
history of DH-V-22B. The licensee determined that a condition may have existed during operation where DH-V-22B leakage would have exceeded the Technical Specification 3.1.6.10.a limit. The licensee reported this incident under 10 CFR 50.73.a.2.i.B as a condition or i
i operation prohibited by plant Technical Specifications. The licensee decided to report this
j
l'
incident based on 1) the SP 1300-3T test results on September 11,1993, exceeding the Technical Specification limit; 2) manually exercising the valve during the visual inspection showed that the -
)
disc did not consistently seat; and, 3) the core flood tank level decrease showing that the condition existed during plant operation.
The licensee's corrective actions included replacing the internals of DH-V-22B. In addition, the licensee plans to add a precaution in SP 1303-5.2 and SP 1300-3B to monitor core flood tank level. If the level changes significantly, the licensee plans to evaluate this.
The inspector addressed DH-V-22B leakage in Inspection Report 50-289/91-21 and Inspection Report 50-289/93-11. In these reports, the inspector agreed with the licensee that DH-V-22B was operable based on the inability to precisely determine whether leakage exceeded the Technical Specification value by using the decrease in core flood tank level. However, the l
performance of Plant Engineering was weak in that they were not aggressive in pursuing why DH-V-22B failed to properly seat on a consistent basis by inspecting the valve during the 9R
.
refueling outage. Although the valve passed the Technical Specification required surveillance, i
the ability of the valve to reliably perform its design function was in question. Prior to the 9R refueling outage there were at least two instances where the core flood tank level decrease
,
indicated that the check valve may have been leaking greater than the Technical Specification limit. However, the licensee chose not to inspect the valve until the 10R refueling outage, after the valve failed the qualified test. The licensee's corrective actions are adequate to prevent l
recurrence.
l 4.4 (Closed) Licensee Event Report (LER 93-008-00) Pressurizer Code Safety Valve Setpoint On November 3,1993, the licensee received a vendor test report that the pressurizer code safety l
valve which had been in operation in Cycle 9 and was removed in September 1993, had an as-l found setpoint which exceeded the Technical Specification requirement. The as-found setpoint of 2617 psi was 3.7 percent higher than the Technical Specification allowable lift pressure of 2500 1 percent. The licensee owns four Dresser Industries, 2.5 inch, spring loaded safety valves and two of these are in service during operation. During each refueling outage, the
!
licensee replaces both pressurizer code safety valves with the two spare valves that have been l
refurbished and tested at Wyle Laboratory. The setpoint error was due to incomplete setpoint testing by Wyle.
In October 1991, the licensee replaced both pressurizer code safety valves and sent the removed l
valves to Wyle for refurbishment and testing. The licensee started up the unit on November 14, i
1991.
Based on problems with pressurizer code safety setpoints at other utilities, the NRC issued l
Information Notice 91-74, " Pressurizer Safety Valve Setpoints," dated November 25, 1991, which notified licensees that the procedures used by Wyle laboratory may have resulted in out-of-tolerance setpoints after the valve has been returned to the plant for installation. Prior to
1
<
_.
- _ _
d
.
1991, Wyle Laboratory would perform an as-found setpoint test, refurbish the valve, leak test the valve with saturated steam, set the setpoint, and leak test the valve with nitrogen. If the valve leaked with nitrogen, Wyle would perform a " jack and lap" process which involves partially disassembling the valve while maintaining spring pressure in order to polish the valve seats. After reassembling the valve, Wyle had not been rechecking the setpoint before returning the valve to the utility.
In November 1992, Plant Engineering prepared a memorandum that addressed Information Notice 91-74. The memorandum incorrectly concluded that Wyle reverifies the setpoint of TMI valvec after all safety valve maintenance. The basis for this conclusion was that the instructions provided to Wyle in TMI's Specification 1101-12-103, states that "If refurbishment is required, the valve shall exhibit an "as-left" setpoint pressure verification of 2500 1 percent for three consecutive actuations using saturated steam." The engineer who wrote the memorandum stated that he never asked Wyle if the valves that were installed in October 1991, had been " jacked and lapped."
In October 1993, during the 10R refueling outage, the licensee replaced both safety valves and sent the removed valves to Wyle for refurbishment and testing. Wyle tested one of these valves and determined that the as-found setpoint was 2617 psi which is higher than the Technical Spec 9 cation limit of 2500 1 percent. The other valve has not yet been tested.
On November 3,1993, the licem,ee received the Wyle test report concerning the high setpoint.
After reviewing past Wyle Laboratory Test Reports, the licensee found that both valves that were removed during the 10R refueling outage had been " jacked and lapped." The licensee determined that the out-of-tolerance setpoint condition could have existed during Cycle 9 and therefore was reportable under 10 CFR 50.73.a.2.1.B, as an operation or condition prohibited by the plant's Technical Specifications.
The licensee's corrective actions include revising the Pressurizer Ccde Safety Specification such that it cannot be interpreted to allow the release of a safety valve without a setpoint test following the " jack and lap" process. The previous procedure contained the requirement to test the valve after refurbishment, but Wyle did not consider the " jack and lap" process to be refurbishment. In addition, the licensee plans to report the test results of the other valve that was removed during the 10R refueling outage in a supplement to LER 93-008-00.
Ti'e failure of the licensee to identify that the safety valves that were installed during Cycle 9 had not been setpoint tested following the " jack and lap" process is considered a weakness. The licensee focused on the future prevention of the setpoint problem but did not sufficiently address whether the problem existed on the installed safety valves. As a result of this, the licensee did not evaluate whether continued operation with this condition was acceptable. The licensee's corrective actions are adequate to prevent recurrence.
.
.
5.0 PLANT SUPPORT (11707)
5.1 Radiological Controls The inspectors examined work in progress in both units to verify proper implementation of health physics (HP) procedures and controls. The inspectors monitored ALARA implemen-r tation, dosimetry and badging, protective clothing use, radiation surveys, radiation protection instrument use, and handling of potentially contaminated equipment and materials. In addition, the inspectors observed personnel working in RWP areas and verified compliance with RWP re-quirements. During routine tours of both units, the inspectors verified a sampling of high radiation area doors to be locked as required. The inspector concluded that overall, radiological controls were good.
5.2 Security The inspectors monitored security activities for compliance with the accepted Security Plan and associated implementing procedures. The inspectors observed security staffing, operation of the Central and Secondary Alarm S*ations, and licensee checks of vehicles, detection and assessment
aids, and vital area access to verify proper control. On each shift, the inspectors observed pro-tected area access control and badging procedures. In addition, the inspectors routinely inspec-ted protected and vital area barriers, compensatory measures, and escort procedures. The inspectors had no concerns and concluded that overall, the Security Plan was being properly implemented.
6.0 NRC MANAGEMENT MEETINGS AND OTIIER ACTIVITIES (30702)
6.1 Routine Meetings At periodic intervals during this inspection, meetings were held with senior plant management
'
to discuss licensee activities and areas of concern to the inspectors. At the conclusion of the reporting period, the resident inspector staff conducted an exit meeting with licensee management summarizing inspection activities and findings for this report period. Licensee
comments concerning the issues in this report were documented in the applicable report section.
No proprietary information was identified as being included in the report.
6.2 TMI-1 SALP Meeting On November 2,1993, the Systematic Assessment of Licensee Performance (SALP) meeting was held for NRC management and licensee management to discuss the results of SALP Report No. 50-289/91-99. The NRC's slide presentation is provided as an attachment to this inspection report.
.
. _.
.
. _...
..
.
.
-
-..
_
_
..
.
.
-,
.
~ l
'
U. S. NUCLEAR REGULATORY COMMISSION
REGION I
,
_
SYSTEMATIC ASSESSMENT OF LICENSEE PERFORMANCE (SALP)
j
,
"
THREE MILE ISLAND NUCLEAR STATION - UNIT 1 ASSESSMENT PERIOD:
'
NOVEMBER 17,1991 -' JULY 31,1993
,
MANAGEMENT MEETING: NOVEMBER 2,1993
,
TMISlide 1
>
,
y, n
~
v
-~.
-
,-w
,
.
..
.
.
,
AGENDA SALP MANAGEMFRI' MEETING NOVEMBER 2,1993 10:00 AM
.
o NRC INTRODUCTORY REMARKS:
W. F. KANE, DEPUTY REGIONAL ADMINISTRATOR-GPUN INTRODUCTORY REMARKS:
'
T. G. BROUGIITON, VICE PRESIDENT AND DIIECTOR NRC SALP PROCESS:
W. F. KANE
.
NRC SALP REPORT PRESENTATION:
-
A. R. BLOUGII, CIIIEF, t
PROJECTS BRANCII
!
DISCUSSION AND GPUN COM1\\ENTS
i GPUN CLOSING REMARKS: T. G. BROUGTON-
'
NRC CLOSING. REMARKS: W. F. KANE
.i
.
>
,
TMI Slide 2
,
i
. -
_
..
-
.-
..
.
.-
.
.
_.
--
...
.
.
PERFORMANCE ANALYSIS AREAS
-
'
FOR OPERATING REACTORS A.
PLANT OPERATIONS B.
ENGINEERING
,
C.
MAINTENANCE
,
D.
PLANT SUPPORT
)
.
i
-.
l TML Slide 3
.
l
.
-
.
.
., _,, _
-,.
..
.. - -
- - -
.
.
..
. _.
.
._
,.
.
l PERFORMANCE CATEGORY RATINGS l
CATEGORY 1 -
SUPERIOR PERFORMANCE CATEGORY 2 -
GOOD PERFORMANCE l
CATEGORY 3 - ACCEPTABLE PERFORMANCE
'
l
.
s l
L l
TMI Slide 4
.
__
..
.
-.
,_
_..
..
_
..
-
PERFORMANCE' ANALYSIS SUMMARY PREVIOUS SALP PERIOD RATING, FUNCTIONAL AREA PERIOD ENDING 11/16/91
)
1.
Plant Operations 1, declining R
2.
Radiological Controls
3.
Maintenance / Surveillance
4.
5.
Security
6.
Engineering and Technical Support 1-7.
Safety Assessment / Quality Verification l'
- l TMI Slide 5 l
.
.
-
-.
....
.
.
.
-_
_
_
..
_
.
.
..
.
..
PLANT OPERATIONS
STRONG OPERATOR PERFORMANCE
EXTENSIVE MANAGEMENT OVERSIGHT
- .
COMMUNICATION PROBLEMS CONDENSER PRESSURE SWITCH
-
REACTOR TRIP FUEL HANDLING BUILDING
-
VENTILATION FLOW
,
DIESEL GENERATOR RUN TIME
-
INADEQUATE PROCEDURAL GUIDANCE AND CONTROL BYPASSING RIVER WATER TO THE -
-
DECAY IEAT CLOSED COOLING WATER HEAT EXCHANGER SYSTEM ALIGNMENT OF STATION
-
BLACKOUT-DIESEL RATING: CATEGORY 2
'
TMI Slide 6
,
i e
w
-
.
.
..
.
_.
._
_
-
__
.
-
,
,
ENGINEERING
'
.
STRONG SAFETY PERSPECTIVE SPENT FUEL POOL RERACKING
-
-
STEAM GENERATOR SLEEVING
-
-
REACTOR COOLANT PUMP VIBRATION.
'l
-
EROSION-CORROSION PROGRAM l
PROCUREMENT ENGINEERING i
OUTSTANDING DESIGN BASIS RECONSTITUTION
.
.*
MORE TIMELY AND DETAILED TEST DATA REVIEW NEEDED
'
HIGH QUALITY EVALUATIONS
EXCELLENT ENGINEERING' CLOSE OUT RATING: CATEGORY 1 TMISlide 7
.i
-
.
a
..
e
-
.,
-
.
[
MAINTENANCE
EXPERIENCED MAINTENANCE STAFF.
,
STRONG-CORRECTIVE AND PREVENTIVE MAINTENANCE
,
GOOD DIAGNOSTIC TECHNIQUES
EXCELLENT PLANT CONDITION
-
MAINTENANCE PROCEDURE UPGRADE r
EQUIPMENT RETURN TO SERVICE ERRORS b
GREATER IN LAST SIX MONTHS-
-
l INSTRUAENT AND CONTROL
-
TECHNICIANS-
RATING: CATEGORY 1
.
-.
TML Slide 8
?
..
-.
..
.-
_.
_.
_.
.
.
.
.
i-PLANT SUPPORT
SIGNIFICANT CONTRIBUTION TO SAFETY-
WELL TRAINED AND QUALIFIED STAFF l
EXCELLENT ALARA PERFORMANCE
BETA RADIATION FIELD MEASUREMENT
GOOD EMERGENCY PREPAREDNESS AND SECURITY PERFORMANCE WITH AREAS
,
FOR IMPROVEMENT CALLOUT
-
INTRUDER DRILL
-
PERIMETER STRENGTHENED
-
i
GOOD FIRE PROTECTION AND HOUSEKEEPING
RATING: CATEGORY 1
!
TMI Slide 9 j-l l
'l
._
.
. -.,
.
__
..
_.
.
..
.-
.
.
-.
'
t
OVERALL CONCLUSION
.
PLANT SAFELY OPERATED e
STRONG MANAGEMENT OVERSIGHT
GOOD ROOT CAUSE AND OPERABILITY-DETERMINATIONS
OPERATIONS COMMUNICATION PROBLEMS
,
-!
i f
,
,
!
-t c
i TMl Slide 10
-
.
..