ML18092A786
| ML18092A786 | |
| Person / Time | |
|---|---|
| Site: | Salem  |
| Issue date: | 07/25/1985 |
| From: | Freeman R NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | |
| Shared Package | |
| ML18092A783 | List: |
| References | |
| TASK-AE, TASK-E509 AEOD-E509, NUDOCS 8509190560 | |
| Download: ML18092A786 (11) | |
Text
AEOD TECHNICAL REVIEW REPORT*
UNIT:
DOCKET NO.:
LICENSEE:
NSSS/AE:
Sal em 2 50-311 Public Service Electric and Gas Company Westinghouse/Public Service Electric and Gas Company EE REPORT NO. AEOD/.[509.
DATE: July 25, 1985** -
EVALUATOR/CONTACT: R. Freeman
SUBJECT:
SALEM UNIT 2 DEPRESSURIZATION EVENT EVENT DATE:
July 25, 1984
SUMMARY
On July 25, 1984, with Salem Unit 2 at 66 percent power (Ref. 1), while performing pressurizer power operated relief valve (PORV) testing, inad-vertent reactor coolant system (RCS) depressurization occurred upon opening the PORV block valve.
This depressurization was caused by a failed-open relief valve.
This relief valve provided low temperature overpressure protection (LTOP).
The LTOP relief valve was supposedly disabled.
The RCS depressurized to the reactor trip and subsequently to the safety injection setpoints because the motor operator control circuitry for the PORV block valve prevented the valve from closing against system differential pressure in the required time.
Failure of the PORV block valve motor operator to allow closure against system differential pressure appears to have been caused by an attempt to close the block valve while it was still traveling in the open direction.
The combined forces of momentum, friction, and flow that resulted from valve reversal operation caused torque switch actuation with the valve in mid-position.
The torque switch contacts later reclosed as the spring pack gradually unloaded and the block valve then traveled to the closed position.
Accidental depressurization of the RCS is an analyzed condition II fault in the licensee's Updated Safety Analysi~ Report (USAR).
The resultant depressurization transient from the failed-open LTOP valve would be a conservative case compared to the analyzed transient for this accident.
Thus, the Salem depressurization event of July 25 was bounded by the accident analysis.
Corrective actions taken by the licensee and Region I were judged to be appropriate and, therefore, no further action by this office is deemed necessary.
- This report supports ongoing AEOD and NRC activities and does not represent the position or requirements of the responsible NRC program office.
8509190560 850725 PDR ADOCK 05000311 S
2 -
I NTRODU CT I 01~
AEOD identified an event at Salem Unit 2 possibly having generic safety implications in its review of Reference 1.
This event involved a PORV block valve which failed to isolate a stuck-open LTOP relief valve and resulted in uncontrolled RCS depressurization.
This event is significant because the failure of a PORV block valve, coupled with a stuck-open LTOP relief valve, could result in an unisolable reactor coolant leakage path.
Such an event would challenge plant safety systems and could result in an extended outage for cleanup and repair.
The control circuitry permitted block valve reversal at anytime, which is an undesirable design that could possibly lead to damage of the motor operator and result in a loss of the valve's safety function.
Control circuitry that permits motor-operated gate valves to be reversed in mid-stroke could be used in many pressurized water reactor (PWR) and boiling water reactor (BWR) systems.
AEOD conducted an evaluation to review the safety significance of the Salem event and to identify any generic implications and their impact on plant safety.
EVENT DESCRIPTION On July 25, 1984, with Salem Unit 2 at 66 percent power, while performing the final steps of a PORV functional test, RCS pressure rapidly decreased upon opening the train A PORV block valve.
The reactor operator immediately initiated a close signal to the tratn_A PORV block valve, whi_le the valve -
was still opening.
This valve failed at its partially open position when the operator tried to close it.
The reactor operator verified that the PORV in train A and the PORV and associated block valve in train B were closed.
However, a supposedly nonfunctional LTOP relief valve in train A was open in*
addition to the train A failed block valve.
A centrifugal charging pump was started and load shedding was commenced to reduce the effects of the tran-sient~ RCS pressure continued to decrease, and at 1865 psig, the reactor tripped.
Pressure continued to decrease, and at 1765 psig, automatic safety injection occurred.
Following the safety injection, the PORV block valve closed and the plant recovered to normal operating conditions.
DISCUSSION Figure 1 shows a schematic of the Salem Unit 2 pressurizer overpressure protection system (POPS) relief system.
As shown in the Figure, the Unit 2 design initially utilized two Maratta pilot-operated solenoid relief valves connected in parallel with the existing PORVs for overpressure protection at low temperature.
The depressurization was caused by the inadvertent opening and failure to reseat of relief valve 2PR47 in train A when block valve 2PR6 was open.
The reason for initially having a separate set of relief valves for pl ant 1 ow temperature overpressure protection was that Unit 2 did not have a safety-grade air system for the PORVs.
Because of repeated problems with the indicating sensors on the solenoid valves, these valves were removed from service several months prior to the depressurization event by
F1GuRe I.
v
. S1.,;p\\1{1.:C{ Sc~c.. o' &l\\eM Un.it r: PoP, R6LtGF- ~l\\'SYGI'\\
1PR1.
2PR2*
2PR..1.
-* disconnecting the solenoid leads from the.fr power sources.
In addition, during the previous plant outage just prior to this event,* additional maintenance was done on the solenoid valves to prevent leakage to the containment.
The relief function of these valves was replaced by the PORVs after some modifications to the system.
The 11nonfunctional 11 LTOP valves were scheduled to be removed from the system during the next refueling outage.
The PORV block valve that failed to close in the required time is a Velan motor-operated gate valve whose function is to isolate both the PORV and the LTOP valve in the event either of these valves had excessive leakage or failed open.
During the course of the event~ repeated attempts to close the block valve failed until the RCS pressure had decreased to the safety injection setpoint.
This took approximately 4.5 minutes.
Plant records indicated that the valve disk and Limitorque operator were replaced in April 1984.
The newly installed motor operator contained a spring pack with a slightly lower spring constant than the operator it had replaced.
It was determined that several years had passed between the time the valves were procured and the order fo.r the spare operator. During this time, the vendor incrirporated small design changes into the spring pack even though the part numbers had not changed.
Thus, the new motor operator gave different valve characteristics for the same torque switch setting.
The procurement of the replacement motor opePa-tor-i-nd;kated-thaL,,it. was purchased as a commercial catalog item (i.e., non-safety related) several years ago; the replacement was required to be the same as the original operator as identified by serial number.
The licensee had no means of*
knowing that a spring pack change had been made by Limitorque and that a different torque switch setting would be required because the licensee does not require supplier documentation for non-safety related equipment.
Our review of Salem 1s quality assurance (QA) program Q List (Ref. 2) indicates that PORV block valve motor operators are covered under the operational QA program, but the equipment is classified as non-safety related.
Internal inspection of the motor operator revealed that the Limitorque operator contained a broken wire in the power supply for controlling voltage to the valve opening and closing ciri:uits.
Two of the seven strands broke due to oxidation while the remaining five were broken due to motor operator movement/vibration.
The break was located in the sheathing allowing the wire to make contact during valve vibration.
The PORV block valve control circuitry permitted reversing valve direction at anytime.
This control circuitry was designed by Public Service Electric and Gas Company, the architect engineer for Salem.
Limitorque indicated that this was an undesirable design due to the potential of shearing the keyway on the pinion gear of the motor operator.
In addition, it is believed that the required torque during valve reversal operations may be greater than
- that calculated while the valve is in mid-stroke position. The licensee has identified 27 additional valves with *similar control circuitry which are located in the emergency core cooling system (EGGS).
v Corrective actions taken by the licensee included removal of the 11 nonfunctionaiu Maratta LTOP relief valves and replacing them with welded plugs, fixing the broken wire in the PORV block valve Limitorque operator, increasing the closing torque switch setting from 1.5 to 2.5 (8000 pounds of thrust), and
- modifying the control circuitry on the PORV block valves to prevent valve reversal until after the valve has completed its stroke.
Salem plant engineering is reviewing the other 27 identified valves with similar control circuitry in the ECCS.
ANALYSIS Accidental depressurization of the RCS is an analyzed condition II fault of moderate frequency in Salem's USAR (Ref. 3). Faults that fall into this category result in reactor shutdown, do not propagate to more serious faults and no fuel damage is expected.
The limiting condition analyzed for this type of a fault was the inadvertent opening and failure to close of a pressurizer safety valve.
Core protection for this event is supplied by pressurizer low-pressure reactor trip, overtemperature-delta-temperature reactor trip, and low pressurizer pressure safety injection.
Results from Salem's USAR show that the minimum departure from nucleate boiling ratio (DNBR) value remains in excess of the required value of 1.30.
The relieving capacity of the pressurizer safety valve in this analysis is 420,000 lbs/hr of saturated steam.
The accidental depressurization in this event was caused by the inadvertent opening of an tTOP valve.
The relieving capacity of this valve is the same as that for the PORVs, which is 210,000 lb/hr of saturated steam or half of the capacity of the pressurizer safety valve.
The depressurization transient from a stuck open LTOP valve (or PORV) would not be as severe and, therefore, would be a conservative case compared to the transient analyzed in the USAR for this accident.
The inadvertent opening of the 11nonfunctional 11 LTOP valve was initiated by the performance of the POPS functional test, but would not have occurred if the valve had been removed rather than made 11nonfunctional.
11 The licensee's action to remove the nonfunctional LTOP valves eliminat~s any further concerns for this failure mode to recur.
Concerns do arise, however, on the reliability of the PORV block valve to close against the dynamic forces associated with a stuck-open PORV.
There are two possible scenarios which could explain why the PORV block valve failed to close.
The first has to do with the broken control circuit wire in the motor operator which could have provided a loose connection. This could have resulted in intermittent electrical contact such that it took the valve approximately 4.5 minutes to close.
The second concerns the attempt to close the valve while it was traveling
6 -
in the open direction.
The combined..-.'fetfces7:0Fmomentum, friction, and flow that resulted from valve reversal operation may cause the torque switch to actuate while the valve was in mid-position.
The torque switch contacts later reclosed as the spring pack gradually unloaded, and the block valve then traveled to the closed position. Although the first scenario seems plausible, it assumes that the loose connection affected the motor operator control only the instant the reactor operator decided to close the valve upon noticing RCS pressure rapidly decreasing.
No motor operator control problems were noticed during the PORV testing which required the block valve to travel to the closed and open positions.
The sequence of events.
described in the licensee event report supports the second scenario, i.e.,
the combined forces of flow, valve momentum, and friction from valve reversal operation caused the torque switch to actuate with the valve in mid-position.
Due to their nonlinear flow characteristics, gate valves such as the ones used for PORV block valves, are primarily used for isolation instead of flow throttling.
In such valves, the system flow is appreciably reduced during the last 1/4 distance of valve travel. Thus, almost full system flow through the block valve would be established within the first 1/4 distance of travel upon the valve opening.
Based on EPRI Marshall Facility test results (Ref. 4), this would occur approximately 3 seconds after the valve receives an open signal. Total opening time of the block valve against
.static system pressure is about 10.6 seconds.
Even though it was established that a relatively light torque switch spring pack was installed in the motor operator, this could not be the cause of torque switch actuation, if it did occur.
Motor Operated Valve Analysis and Testing Systems (MOVATS) tested the block valve and determined that the Valve had a closure thrust of 6700 pounds, which corresponds to a close torque switch setting of 1.5. This exceeded the.closure thrust of 4900 pounds corresponding to 1.25 close torque switch setting required by the manufacturer.
Tests conducted by EPRI on the identical block valve, motor operator, and piping configuration similar to Salem's design show that the identical block valve was capable *Of closing against the dynamic forces associated with a stuck-open PORV at system pressures up to 2490 psig and closing torque switch settings between 1.0 to 1.7. It is concluded that adequate closure thrust existed for the PORV block valve to close against system differential pressure even though a relatively light torque switch spring pack was installed in the motor operator.
Thus, torque switch actuation occurred primarily due to the additional forces associated with the instantaneous reversal-of block valve direction.
One of the TMI action plan requirements (Ref. 5) for the licensees of PWRs was to demonstrate that the PORV block valves function properly over the range of expected operating and accident conditions.
A test program was formalized and conducted by EPRI at the::Ma~tralT.Test Facility to obtain information regarding the performance of PORV blcrc:::*'*.*~'.:E-1-ves.
The test results obtained in the study would lend support in the qualification of PORV block valves as required by item II.D.l of NUREG-0737.
Salem 1 s response to this requirement (Ref. 6) indicates that the basis for qualifi-cation of their block valves was the test results obtained by the EPRI study.
Review of the EPRI PWR safety and relief valve test program (Ref. 4) revealed that all tests which were conducted always allowed the block valve to complete its opening or closing stroke prior to changing direction.
No testing was done by EPRI which evaluated block valve performance under valve reversal conditions similar to that described in this event.
Control circuitry which allows the instantaneous reversal of valve direc-tion is an undesirable design for valves whose purpose is system isolation.
These valves are generally gate valves, fast acting, and have strict time requirements to isolate or unisolate system trains, components, or buildings.
Instantaneous reversal of valve direction while the valve is traveling could cause motor operator mechanical damage such as shearing the keyway on the pinion gear or cause motor operator burnup due to excessive electrical current required to change the direction of the valve.
This.
would result in valve failure and could make trains and components of the systems inoperable, or buildings unisolable.
Valve reversal could be initiated by:.{l}. improper operation of valve by the reactor operator, (2) bounce back past. the neutral switch position for -
spring return handswitches, and p) valve direction*reversaTby'"'an engineered safeguards signal while the valve.wa£*.... trave1ing. There are numerous appl i-cations of such valves in BWR and PWR safety-related systems which could be subject to this potential failure mode if the control circuitry allowed*
valve reversal at anytime during valve travel.
OPERATING EXPERIENCE AEOD conducted data searches and found one similar event in which valve failure was attributed to the instantaneous reversal of valve direction during valve travel.
The event occurred at a BWR facility, Oyster Creek (Ref. 7), and involved a core spray system isolation valve which became.
inoperable in a partially open position when its motor circuit breaker tripped.
The cause of the breaker opening was attributed to an inadvertent initiation of a valve closure signal during the time when the valve was still traveling toward its open position.
The instantaneous reversal of the valve motor operator required greater than normal torque causing an I
i I
- increase in current which tripped the motor circuit breaker.
Plant engi-neering conducted a test simulating the event and found that the current during an.instantaneous reversal in motor direction was 30 to 60 percent higher than normal starting current for the motor operator.
Had the circuit breaker not tripped, valve motor burnup could have occurred due to the excessive electrical current drawn by the motor.
This event shows that excessive electrical current is required to change valve direction which could cause motor operator burnup, and that this type of control circuitry exists in other valve applications in safety-related systems for other plants.
Although a review of the operating experience did not reveal similar failures, it is not clear whether valve reversal is a recognized failure mode since this failure mode involves the tripping of the motor operator due to misoperation of the valve. Thus, it cannot be determined if the lack of reported operating experience in this regard is representative of actual operating experience.
A sample survey was conducted of other plants to determine if control circuitry for the PORV block valves exists which may permit valve reversal at anytime.
For the seven facilities contacted, no PORV block valves were identified which could operate in this fashion.
However, resident inspectors indicated that it would take a considerable amount of effort to review motor-operated valves to determine with certainty if the control.circuitry_
permits valve reversal when stroking the valve.
Thus*;- we,we*re--'*not*-able to conclude that the control circuitry that permits valve reversal does not exist in* other operating plants.
FINDINGS AND CONCLUSIONS The root cause for this event was failure of the licensee to effectively disable the LTOP valves.
If the licensee had removed the LTOP valves, this event would not have occurred.
It appears that problems still exist between the vendor-licensee relationship concerning receipt and maintenance of vendor information.
This is evident by the fact that inadequate documentation existed for the new motor operator '
to determine that it had slightly different performance characteristics than the motor operator it replaced, even though both had identical part numbers.
However, the burden of responsibility for verification of proper replacement parts is ultimately up to the licensee, regardless of the procurement classification. This is indicative of a deficiency in the vendor-licensee relationship to assure reliable distribution, maintenance, and verification of current replacement part information. This deficiency was previously identified in the investigation of the anticipated transients without scram (ATWS) events at Salem {Ref. 8), and resulted in Generic Letter 83-28 (Ref. 9) issued to all licensees.
The Vendor Program Branch is reviewing this event for generic implications and is considering including this event in an IE Information Notice and/or future licensee inspection.
- The difference in motor operator performance could have been detected if correct torque switch settings were confirmed through actual measurements of delivered thrust and compared to the recommended settings by the manu-facturer.
AEOD has previously recommended (Ref. 10) that signature tracing techniques (such as measurement of electrical current and voltage applied to the motor or the measurement of the actual valve stem torque or thrust during valve operation) be part of the periodic inservice testing program.
Such a program would detect changes in valve operator performance due to aging, maintenance, or in this case, design.
This program could assist in detennining root causes of valve operability problems and avert potential valve failure.
Control circuitry which permits reversal of valve direction at anytime is an undesirable design for gate valves which have the purpose of system isolation.
Reversal of valve direction while the valve is in motion could cause:
o motor operator mechanical damage o motor operator burn-up o inadvertent torque switch actuation o motor operator circuit breaker trip This would result in valve failure and could make trains and compo~ents of systems inoperable, or buildings, systems or components unisolable.
In addition, current torque switch se.tti.ngs. would be in error because calculated thrust 1 oads for detenni ni ng correct torque switch settings do not take into account valve reversal conditions while the valve is in mid-position.
In review of the licensees' submittal in response to NUREG-0737 requirement item II.D.1, qualification of reactor coolant system relief, safety, and block valves (Ref. 6), the licensee references the test results conducted by EPRI (Ref. 4).
However, no testing was conducted by EPRI which evaluated block valve perfonnance under valve reversal conditions similar to that described in this event.
All block valve testing conducted always allowed the valve to complete its opening or closing stroke prior to changing direction.
Attempts were inconclusive to determine if control circuitry that permits valve reversal exists at other facilities.
Due to the large number of motor-operated valves in use at a nuclear plant, it was unreasonable for the inspector to perform such a review.
This is better performed by the licensees.
The sample survey indicated that this control circuitry is not in use for PORV block valve control at the surveyed PWRs.
It could exist, however, in other safety-related systems in PWR and BWR facilities where it may be inappropriate.
An industrial organization has issued a report addressing the safety implications of improper control circuitry for motor-operated gate valves.
Licensees are currently following up on its recommendations.
Also, Region I is closely following Salem's safety
I I
- l 0 -
evaluation of the remaining 27 valves located in the ECCS identified having the same control circuitry.
Thus, corrective actions were judged to be appropriate and no further action by this office is deemed necessary at this time.
., 'I
'.. REFERENCES lo Licensee Event Report 84-018, Public Service Electric and Gas Company, Salem, Unit 2, Docket No. 50-311, dated August 24, 1984.
- 2.
NUREG-0977, 11 NRC Fact-Finding Task Force Report on the ATWS Events at Salem Nuclear Generating Station, Unit l, on. February 22 and 25, 1983, 11 dated March 1983.
- 3.
Updated Safety Analysis Report (USAR), Salem Units 1 and 2, Docket Nos.
50-272 and 50-311, Rev. 0, dated July 22, 1982.
- 4.
Letter from R. C. Youngdahl, Consumers Power Company, to Harold Denton, NRC,
Subject:
Submittal of PWR Valve Data Package, dated June 1, 1982.
- 5.
NUREG-0737, "Clarification of TM! Action Plan Requirements, 11 dated November 1980.
- 6.
Letter from E. A. Liden, Public Service Electric and Gas Company, to Steven Varga, NRC,
Subject:
NUREG-0737 Item 11.D.1, Plant Specific Report on PWR Safety and Relief Valve Test Program, Units 1 and 2, Salem Generating Station, January 3, 1983.
- 7.
Licensee Event Report 81-072/03L, General Public Utilities,--Oyster Creek, Docket No. 50-219, dated January 28, 1982.
- 8.
NUREG-1000, 11Generic Implications of ATWS Events at the Salem Nuclear Power Plant, 11 Volume 1, dated April 1983.
- 9.
Subject:
Required Actions Based on Generic Implications of Salem ATWS Events, dated July 8, 1983.
1 O. Memorandum for Karl Seyfrit from Earl Brown and Frank Ashe, NRC, "Survey of Valve Operator-Related Events Occurring During 1978, 1979, and 1980,"
AEUD/C203, dated May 1982.