05000346/LER-2015-002

LER-2015-002, Improper Flow Accelerated Corrosion Model Results in 4-Inch Steam Line Failure and Manual Reactor Trip

Davis-Besse Nuclear Power Station
Event date:	05-09-2015
Report date:	07-08-2015
Reporting criterion:	10 CFR 50.73(a)(2)(iv)(A), System Actuation
Initial Reporting
ENS 51061	10 CFR 50.72(b)(2)(iv)(B), RPS System Actuation, 10 CFR 50.72(a)(1)(i), Emergency Class Declaration, 10 CFR 50.72(b)(3)(iv)(A), System Actuation
3462015002R00 - NRC Website

Energy Industry Identification System (EIIS) codes are identified in the text as [XX].

System Description:

The Davis-Besse Nuclear Power Station (DBNPS) Steam and Feedwater Line Rupture Control System (SFRCS) [JB] is a protection system that initiates the Auxiliary Feedwater System [BA] and isolates the affected Steam Generator [AB-SG] on a steam or feedwater line rupture. The SFRCS is required to ensure an adequate feedwater supply to the steam generators to remove reactor decay heat during periods when the normal feedwater supply and/or the electric power supply to essential auxiliaries has been lost. The design of the SFRCS is to mitigate release of high energy steam, to automatically start the Auxiliary Feedwater System in the event of a main steam line or main feedwater line rupture, or on the loss of both main feed pumps or the loss of all four Reactor Coolant Pumps [AB-P], and to prevent steam generator overfill and subsequent spillover into the main steam lines. The SFRCS also provides a trip signal to the Anticipatory Reactor Trip System (ARTS). In the event of a main steam line rupture, the SFRCS will close both Main Steam Isolation Valves (MSIVs) [SB-ISV] and all main feedwater control [SJ-LCV] and stop valves [SJ-ISV] and trip the main turbine [TA-TRB].

As part of the Main Steam Turbine System power conversion unit, steam is exhausted from the High Pressure Turbine and passed through Moisture Separator/Reheater (MSR) [SB-MSR] units to reduce the steam moisture content and increase the steam heat energy level before entering the Low Pressure Turbines. The moisture separator portion of the MSR removes moisture from the steam flow via a stationary series of chevron shaped baffles so that the steam is essentially in a dry and saturated state.

The steam then flows through the first and second stage reheaters comprised of horizontal tube bundles through which reheating steam flows. The first stage reheater receives its reheating steam supply from the steam extracted from the High Pressure Turbine following the second stage of blading, and the second stage reheater receives its reheating steam supply from the main steam line upstream of the Main Turbine Stop Valves [TA-ISV]. The condensed steam from the reheaters flows into the feedwater heating system [SN]. A small quantity of steam, limited by an orifice, is drawn from each reheater tube bundle outlet header at all times when the reheaters are in operation to assist the water drainage from the reheater tubes. This scavenging steam is routed to the feedwater heating system.

DESCRIPTION OF EVENT:

On May 9, 2015, the DBNPS was operating in Mode 1 at approximately 100 percent full power. At 1856 hours0.0215 days <br />0.516 hours <br />0.00307 weeks <br />7.06208e-4 months <br /> an abnormal noise sounding like air or steam flow was heard from the Control Room. At 1859 hours0.0215 days <br />0.516 hours <br />0.00307 weeks <br />7.073495e-4 months <br /> field operators reported a steam leak in the Turbine Building in the vicinity of MSR 1. A Rapid Shutdown was initiated, and the reactor was manually tripped at 1909 hours0.0221 days <br />0.53 hours <br />0.00316 weeks <br />7.263745e-4 months <br /> from approximately 30 percent power. The Steam Feedwater Rupture Control System was manually initiated to isolate the leak by closing the MSIVs and starting the Auxiliary Feedwater System to provide cooling via the Atmospheric Vent Valves.

At 1910 hours0.0221 days <br />0.531 hours <br />0.00316 weeks <br />7.26755e-4 months <br /> an Unusual Event was declared on Emergency Action Level HU4, Explosion, due to the steam leak. Unit response to the manual reactor trip was as designed, and plant parameters stabilized within their normal post-trip values. At 2121 hours0.0245 days <br />0.589 hours <br />0.00351 weeks <br />8.070405e-4 months <br /> the Unusual Event was terminated based on stable plant conditions.

DESCRIPTION OF EVENT: (continued):

The steam leak was due to failure of a 4-inch elbow [SN-PSF] in MSR 1 Second Stage Reheater vent piping. The failure occurred on the extrados of the elbow, and was approximately three inches in length and two and a half inches in width. The steam leak resulted in damage to several non-safety related cables [EC-CBL] in an adjacent cable tray. One of these damaged cables resulted in the tripping of Station Air Compressor 2 [LF-CMP] following the reactor trip; Station Air Compressor 1 automatically started to maintain Station Air System pressure. Additionally, the Fire Suppression System [KP] in the area of the steam leak actuated due to the leak, resulting in the wetting of several motor control centers [EC-MCC] in the area.

CAUSE OF EVENT:

The failure of the MSR 1 Second Stage Reheater vent piping elbow was due to two-phase flow accelerated corrosion (FAC). Carbon steel piping components in power plants exposed to flowing water, wet steam, or a combination of both are susceptible to FAC, which leads to wall thinning of the piping. The nuclear power industry has worked steadily since a catastrophic failure at a domestic plant in 1986 to develop and refine monitoring programs in order to prevent FAC-induced failures.

The failed elbow in the 4-inch piping was 10.25 inches downstream of a restricting orifice [SN-OR].

This orifice, which restricts the amount of scavenging steam drawn from the second stage reheater tube bundle outlet header, was modeled in the FAC software as having an opening 3.0 inches in diameter when vendor drawings showed an orifice opening of 0.859 inches. The incorrect orifice opening size was entered in the FAC software in the 1987 to 1989 time frame during initial FAC software database development, and caused the FAC software to incorrectly calculate the wear rate of the elbow.

Because of this incorrectly calculated wear rate, no wall thickness measurements were performed directly on the failed elbow.

Industry document NSAC-202L, Recommendations for an Effective Flow-Accelerated Corrosion Program, was issued in 1993 to provide recommendations for an effective FAC program. However, a means was not established to systematically ensure the NSAC-202L recommendations were met. One of these recommendations was to measure wall thickness of piping directly downstream of control valves and orifices due to their high susceptibility to FAC. This recommendation was not satisfied for the two MSR Second Stage Reheater Vents nor the two MSR First Stage Reheater Vents that contained orifices.

In 2006 a steam leak at the DBNPS was identified in the 8-inch MSR 1 First Stage Reheat Drain line to High Pressure Feedwater Heater 1-5 due to FAC. The hardware issue was reviewed in one Condition Report (CR) at the "Fix" level of evaluation, and a second CR evaluated the reason the FAC program failed to identify the failed line as a FAC monitoring location at the Root Cause evaluation level. The cause for the leak from the Fix evaluation was determined to be that the FAC software model for the piping did not include the appropriate pressure drop inputs downstream of the level control valves. This was due to not performing a comprehensive validation of the model inputs to the FAC software model as it has evolved over the years to ensure that all physical, thermohydraulic, and chemistry inputs were correct. Planned corrective actions included performing a validation of the software model.

CAUSE OF EVENT: (continued) The Root Cause process is designed to methodically process an event through a structured investigation system to identify causal factors, failed barriers, and root and contributing causes. Proper implementation of Root Cause methodologies will generally drive the investigation to evaluate latent organizational weaknesses or drivers and safety culture issues. By performing the Root Cause evaluation on a perceived cause of the 2006 event verses the terminal event, the investigation overlooked program implementation details that were crucial to establishing effective corrective actions.

The Root Cause was determined to be the failure to establish a proper level of verification to ensure the quality of an engineering tool commensurate with ensuring safety, and the preventive action for this cause was to perform an independent horizontal review of the modeling data. This preventive action was to be implemented as part of a vendor project to convert the FAC software to the latest version.

Since the Root Cause evaluation was focused on identifying organizational and programmatic issues, it did not investigate the fundamentals of the FAC software project to identify that the software conversion project did not include validating all data inputs.

ANALYSIS OF EVENT:

Due to the steam leak, the Steam Feedwater Rupture Control System was manually initiated, closing the MSIVs and the starting the Auxiliary Feedwater System to provide reactor cooling. The Steam Generator outlet pressure increased due to the closing of the MSIVs, and the Main Steam Safety Valves (MSSVs) [SB-RV] lifted in response to the increasing secondary system pressure. The MSSVs re-closed as Steam Generator outlet pressure decreased, and the Atmospheric Vent Valves [SB-VTV] were used to control secondary system pressure. There were no significant deviations in Reactor Coolant System pressure, temperature, inventory control, or in Steam Generator pressure or inventory control. No personnel injuries occurred as a result of the steam leak.

Once the failed piping was manually isolated, vacuum was again established in the Main Condenser [SG-COND], and the Main Feedwater System was placed in service to provide cooling. The station remained in Mode 3, Hot Standby, following the plant trip until the reactor was restarted. Besides the trip of Station Air Compressor 2 due to damaged cables as a result of the steam leak as described above, all other equipment responded to the event as required. There were no nuclear safety concerns identified during or as a result of this event; therefore, this event had very low safety significance.

Reportability Discussion:

An Unusual Event was declared due to the steam piping rupture / explosion, which was reported to the NRC in accordance with 10 CFR 50.72(a)(1)(i) at 1945 hours0.0225 days <br />0.54 hours <br />0.00322 weeks <br />7.400725e-4 months <br /> on May 9, 2015 (Event Number 51061).

The manual actuation of the Reactor Protection System [JC] was reported in accordance with 10 CFR 50.72(b)(2)(iv)(B) at the same time as the Unusual Event (1945). The manual initiation of the Steam Feedwater Rupture Control System resulted in actuation of the Auxiliary Feedwater System, which was reported in accordance with 10 CFR 50.72(b)(3)(iv)(A) at 2201 hours0.0255 days <br />0.611 hours <br />0.00364 weeks <br />8.374805e-4 months <br /> in conjunction with termination of the Unusual Event.

The manual actuations of the Reactor Protection System and the Auxiliary Feedwater System are reportable as a Licensee Event Report per 10 CFR 50.73(a)(2)(iv)(A) within 60 days of occurrence. All safety systems performed as required in response to the event, and no loss of safety functions occurred.

CORRECTIVE ACTIONS:

The failed MSR 1 Second Stage Reheater vent piping elbow was replaced. The similar elbow for MSR 2 Second Stage Reheater vent piping was inspected and found to be degraded with an average pipe wall thickness of 0.115 inches compared to a nominal thickness of 0.207 inches, so the MSR 2 elbow was also replaced. A further extent of condition was performed on similar systems and no additional issues were identified.

The following actions will be taken to improve and maintain the fidelity of the data in the FAC software model:

1. A review of the FAC software model will be performed to determine which inputs are critical to the determination of fitness for service and which inputs are non-critical. This action will document the listing of all input fields within the software, and whether their accuracy affects the output of the model.

2. A validation of the data inputs into the FAC software will be performed. This task will include the validation of any input which would have consequence, as used by the FAC software in the determination of fitness for service of piping and components for the FAC program. Data contained within the FAC software model that does not impact fitness for service will be annotated during this validation as being non-critical to the function of the software, while still attempting to validate it.

3. The results of the validation of the FAC software database will be documented by creating a document (Reference Material, Program Manual, etc.) that will be used to serve as a listing of inputs into the FAC software database and maintained as a quality record.

4. The FAC software model will be revised to correct the restriction orifices' size/dimension for the orifice and flow elements identified in the steam line failure root cause evaluation.

5. A list of components for the site that meet the bulleted items within Section 4.4.4 of NSAC-202L, Revision 4, will be established. The inspection history of the relevant components will be compiled, and an evaluation for any components without inspection data will be performed.

Components requiring inspection will be added to the next refueling outage scope. These locations are to specifically include:

• Locations downstream of orifices, flow elements, venturis, thermowells, angle valves, flow control valves or level control valves,

• Locations or lines known to contain backing rings or counterbore,

• Field-fabricated tees and laterals,

• Nozzles,

• Complex geometric locations such as components located within two diameters of each other (e.g., an elbow welded to a tee),

• Components downstream of replaced components (upstream if expander), and components that have been replaced in the past if not upgraded to resistant material,

• Components (including straight pipe) immediately downstream of FAC-resistant components (e.g., containing chromium greater than 0.10%),

• Locations immediately downstream of turning vanes,

• Expansion joints.

CORRECTIVE ACTIONS: (continued) 6. The Flow Accelerated Corrosion Management Program procedure will be revised as follows:

• Requirements will be added to the procedure that would involve review and selection of examination scope based on recommendations from NSAC-202L, Rev 4, Section 4.4.4. This action requires documentation of the basis for selection or exclusion of the scope for the given outage. Documentation would be in the form of discussion in the Outage Technical Report (pre-outage) and Outage Summary Report (post-outage).

• A step will be added that would require review, approval, and documentation of updates to the FAC software database. The scope of these changes would exclude data collected and evaluated during outages, but would be inclusive of all others (such as plant uprates, plant modifications, engineering change packages, etc.). Documentation for this step would be through an Engineering Evaluation Request.

The following actions will be taken with respect to the Corrective Action Program:

1. A lessons-learned presentation will be provided to the Site Continuous Improvement Committee regarding the need to ensure root causes are performed on terminal events, and to perform effectiveness reviews on preventive actions, not on suspected causes. This presentation will emphasize the importance of the problem description in determining the proper scope of an investigation.

2. An Extent of Cause Review will be performed which will review Root Cause evaluations performed in the past ten years to:

• Identify those that were not performed on a terminal event (i.e., the problem statement was written for a perceived cause instead of an event),

• Identify those that do not have a root cause directed toward the terminal event,

• Identify those that do not have an effectiveness review on the preventive action(s).

PREVIOUS SIMILAR EVENTS:

There have been no Licensee Event Reports (LERs) at the DBNPS involving FAC-induced steam leaks in the past three years.

As described previously, a steam leak was identified in 2006 in the MSR 1 First Stage Reheater Drain line to High Pressure Feedwater Heater 1-5. The cause for the leak was determined to be that the FAC software model did not include appropriate pressure drop inputs downstream of the level control valves.

The failure to correct the FAC software model due to this 2006 event is addressed by the current corrective actions listed above.