ML20036B876
| ML20036B876 | |
| Person / Time | |
|---|---|
| Issue date: | 07/31/1992 |
| From: | Caroline Hsu, Madison A NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | |
| References | |
| NUDOCS 9306030365 | |
| Download: ML20036B876 (24) | |
Text
k, FIELD SURVEY REPORT LICENSEE ACTIONS TAKEN TO ADDRESS PRESSURE LOCKING OF DOUBLE DISK AND FLEXIBLE WEDGE GATE VALVES JULY 1992 Prepared by: Alan L. Madison (Lead)
Chuck Hsu Office for Analysis and Evaluation of Operational Data U.S.
Nuclear Regulatory Commission NOTE:
This report documents results of studies completed to date by the Office for Analysis and Evaluation of Operatiorc.l~Pata with regard to particular operating events.
The findings, conclusions, and recommendations contained in this report are provided in support of other ongoing _NRC activities concerning:these events.
Since the studies are ongoing, the report is not necessarily final, and the findings and recommendations do not represent the positions or requirements of the responsible program office of the Nuclear Regulatory Commission.
O
!sR'888ZE!?2 PDR g.
CONTENTS
.i Page EXECUTIVE
SUMMARY
1 1
INTRODUCTION...............................................
3 2
REVIEW OF PRESSURE LOCKING PHENOMENA.......................
4 3
PLANTS SELECTED FOR THE. SURVEY.............................
5 4
SURVEY RESULTS.............................................
6 5
OPERATING EXPERIENCE REVIEWS..............................
13-6 ENGINEERING INSIGHTS......................................
14 7
CONCLUSIONS...............................................
18 Y
4
?
I r
9 s
9 f
Y E
t e
i
EXECUTIVE
SUMMARY
Recent licensee event reports from the licensee for FitzPatrick and Susquehanna nuclear power plants notified the NRC of significant events concerning pressure locking of flexible-wedge gate valves.
These reports were of safety concern to the NRC staff because of the potential for common-mode failure of these valves during design-basis events.
The reports were also of regulatory concern because the potential for failure had not been effectively evaluated and addressed previously despite extensive dissemination of NRC and industry information on the pressure-locking failure mechanism and experience dating back to 1977.
On the basis of the concern that other licensees also might not have evaluated and corrected this potential common-mode valve failure mechanism, a limited field survey of several representative nuclear power plants was initiated to evaluate A engineering analyses and corrective actions these licensees had taken to eliminate the pressure locking vulnerability.
On the basis of this limited review, it appears that most of the licensees surveyed had not implemented known remedies because they j
lacked available site-specific experience with valve pressure
- locking, even though their engineering' organizations had recommended modifying selected valves to prevent pressure locking.
I Most licensees surveyed had not performed complete or comprehensive engineering reviews or evaluations to fully address pressure-locking concerns.
From this survey, it was found that when conservative and thorough engineering evaluations are performed, the potential for valve pressure locking is apparently identified.
When this identification is coupled with accident or transient scenarios resulting in rapid system depressurization, the licensee recognizes the safety significance of pressure locking thus prompting the licensee to implement modifications to prevent valve pressure locking.
Modifications to prevent gate valve pressure locking involve either drilling a hole in one of the disks or providing a vent path from the valve bonnet.
The choice of modification is dependent upon the licensee's determination of which method would
]
be most effective and other engineering concerns related to the individual valve.
One of the licensees surveyed apparently resolved the issue of gate
)
valve pressure locking during their initial construction by implementing the required modifications as part of a design package.
Others, because they recognized specific events being attributable to gate valve pressure locking, have pursued the issue and are in the process of identifying and implementing corrective actions.
However, none of the plants surveyed had developed a completely comprehensive and rigorous analytical approach capable of identifying and resolving all of the facets involved in valve 1
1 l
pressure. locking.
- Also, none of the licensees surveyed had provided training to their engineering staff to ensure prompt identification and resolution of emergent gate valve pressure-locking events.. Further, current surveillance and testing methods are not directed towards identification of gate valve pressure-locking issues caused ' by the low pressures involved and other inadequacies. Therefore, valve f ailures caused by pressure locking continue to go unrecognized and unresolved.
As a result of this survey, engineering insights were developed concerning the contents of a
conservative and comprehensive engineering analysis and evaluation of gate valve' pressure-locking concerns.
These insights include the identification of all forces acting upon the valve and the use of conservative assumptions with regard to initial pressures, leak
- rates, actuator thrust capabilities, and adjacent system interactions.
Previous NRC and industry feedback efforts have not been successful
~
in resolving and eliminating valve pressure locking concerns. This survey indicates that most licensees appear to continue to be susceptible to common-cause failure caused by gate valve pressure locking.
b t
5 k
I i
2
1 INTRODUCTION On July 17, 1991, the inboard injection valve of the B low pressure coolant injection (LPCI) system at the James A. FitzPatrick Nuclear Power Plant f ailed to open on demand (Table). The failure occurred approximately 9 to 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> after the line between the inboard and outboard valves had been depressurized from an earlier hydrostatic test. The actuator remained energized for approximately 30 seconds before the motor actuator circuit breaker tripped.
The licensee performed a special test to recreate the conditions that existed after completion of the hydrostatic test.
Thirty minutes after depressurization from hydrostatic test pressure, operators attempted to open the valve.
The motor operator went to locked-rotor current and the circuit breaker was manually opened.
Coincident with the valve bonnet being manually vented through the stem packing gland, air escaped and valve position indication changed from closed to intermediate.
The valve was then stroked normally from the control room.
Following internal force calculations, the licensee concluded that the valve's failure to open had been caused by pressure locking.
The licensee determined that both the A and B LPCI inboard injection valves and the A and B core spray (CS) inboard spray valves were susceptible to this failure mechanism.
The calculations showed that high-pressure fluid trapped in the valve bonnet was sufficient to prevent the valves from opening following a depressurization for low-pressure emergency core cooling system (ECCS) injection.
All four valves were subsequently modified to place a bonnet vent to the high pressure side of the. valves.
On October 18, 1991, Susquehanna Steam Electric Station engineering personnel determined that the motor-operated LPCI and CS injection valves were susceptible to common-cause failure from pressure locking (Table).
Notwithstanding this determination, the licensee considered that the valves remained operable without modifications as a result of analyses performed.
However, they continued to review the issue and evaluate the need for either valve or actuator modifications.
On April 2,
- 1992, the NRC issued Information Notice 92-26,
" Pressure Locking of Motor-Operated Flexible Wedge Gate Valves,"
describing the FitzPatrick valve failure and the report from Susquehanna.
These recent events were of safety concern because of the potential common-mode failure caused by pressure locking of flexible-wedge and double-disk gate valves.
The reports were also of regulatory concern because the potential for failure had not been effectively evaluated and addressed previously despite extensive dissemination of NRC and industry information on the pressure-locking failure mechanism dating back to 1977 (Table).
3
On the basis of the concern that other licensees also might not have adequately evaluated and corrected this potential common-mode
- failure, the AEOD staff conducted a field survey of several representative nuclear. power plant sites to evaluate the engineering analyses and corrective actions these licensees had taken to eliminate the pressure-locking vulnerability. This report documents the results of the survey.
Section 2 of this report provides a brief review of the valve design as it relates to the pressure-locking phenomena.
Section 3 discusses the plants selected for the survey and the basis for their selection.
Section 4 provides the survey results for each plant.
Section 5 discusses a review of selected operating experience reports.
Section 6 provides an integrated analysis of the engineering insights gained from the survey.
Section 7 provides the findings and conclusions of the survey with respect to the adequacy of industry evaluations and actions in response to.the prior operating experience feedback communications.
The table and the figure at the end of this report list the prior feedback communications issued to the industry by NRC and others and show a cross-section of a flexible-wedge and a double-disk gate valve, respectively.
2 REVIEW OF PRESSURE LOCKING PHENOMENA Flexible-wedge and double-disk gate valves are designed to allow their valve disks to seat and be sealed against the seat rings when the valve is closed (Figure 1).
This design provides for a high level of leak tightness in applications where minimum leakage past the valve is desirable.
Consequently, flexible-wedge and double-disk gate valves are used extensively in the nuclear industry in safety-related applications, including interfaces betweer. high pressure and low-pressure piping systems.
An operating characteristic of these valve designs is that fluid enters the bonnet cavity during normal open and close cycling operations.
Additionally, owing to differential pressure across the valve seats,, caused by small but finite leakage past in-line check valves, pressurized fluid will enter the bonnet cavity when the valve is closed.
Depending upon the leak tightness of the valve and the differential pressure across the seat, the pressure force on the high-pressure side of the disk will cause it to flex or move laterally slightly away from its seat,-allowing high-pressure fluid to enter the neck or bonnet cavity.
With time, the bonnet cavity pressure and the line pressure will tend to equalize.
Consequently, flexible-wedge and double-disk gate valve bonnets will normally contain high-pressure fluid.
Additionally, fluid in the bonnet will expand when heated by convection through leakage past in-line check or block valves or 4
conduction heat transfer along the piping wall or from nearby equipment (i.e.,
during normal startup and heatup operations or because of increased ambient temperatures during postulated accident conditions).
If the valve disks are sufficiently leak tight to prevent leakage out of the bonnet when the valve is closed, this thermal expansion will increase the bonnet pressure (Figure 2).
Calculations have shown that this increase in pressure is in excess of 100 psi / F.
Even so, bonnet pressure will tend to equalize with line pressures over time. However, the time required for equalization is dependent upon the leak tightness of the valve.
Therefore, a new or recently reworked valve could require many hours to equalize. The potential for valve pressure locking exists when bonnet pressure is substantially greater than both the upstream and downstream pressures.
Several safety significant system conditions can cause the resultant vertical binding forces to become greater than the stall thrust of the associated motor operator.
This would include, for example, an Automatic Depressurization System (ADS) actuation, which would cause the valve's adjacent piping to suddenly depressurize, or a Loss-of-Coolant Accident (LOCA).
Pressure locking can also occur when the water trapped in the valve bonnet expands and increases bonnet pressure as a result of heatup caused by a postulated nearby line break.
Additionally, when the water trapped in the valve bonnet expands and increases bonnet pressure as a result of heating during a normal plant startup, pressure locking may result.
The heating during startup is due to convection or conduction of heat (1) through leaking in-line check valves or associated piping or (2) from outside heat sources.
Another less risk-significant example of pressure locking occurs when the valve bonnet is pressurized during hydrostatic testing followed by system depressurization, as in the case of FitzPatrick.
- Further, when the valve is used to isolate its system for maintenance, which requires system depressurization during reactor operation, and idle system conditions allow bonnet heatup (as in the case of reactor water cJeanup (RWCU) isolation), pressure locking may occur.
Before pressure equalization occurs, locking, friction, or binding forces acting upon the valve disk seats increase the force required to open the valve.
If these forces are great enough, the motor actuator will stall and the valve will not open.
l 3
PLANTS SELECTED FOR THE SURVEY The AEOD staff selected six operating reactor facilities for the survey. FitzPatrick and Susquehanna were selected because of their recent reports concerning pressure locking.
Ginna, Nine Mile Point, Salem, and Hope Creek were selected in order to provide a 5
a-r-3 4
balanced review of boiling water reactor (BWR) and pressurized water reactor (PWR) facilities.
For the plants selected, the staff interviewed licensee personnel directly involved with the earlier and more recent analyses and evaluations and with the corrective action decision-making processes.
These personnel included members of the engineering, operations, maintenance, and training departments, and site and corporate managers.
The staff reviewed licensee documents related to pressure locking, including engineering analyses, position
- papers, responses to NRC and industry notifications, system drawings, and procedures, if applicable.
The purpose of these site visits was to a) understand the past and recent licensee evaluations and corrective actions concerning valve-pressure locking and the reasoning supporting those evaluations and actions, and b) identify any nonconservative or incomplete aspects of these licensee assessments.
The staff asked licensee personnel about their methods of testing for leakage and operability, their methods of training the operations, maintenance, and engineering staffs to recognize and compensate for pressure-locked valves, and their methods for analyzing pressure-locking potential, including assumptions.
The staff also reviewed reports of previous valve failures for evidence of unrecognized pressure-locking events.
The site visit at Nine Mile Point was eliminated from the survey process because of an ongoing outage and other NRC inspections.
However, the staff requested, received, and reviewed documentation from Nine Mile Point.
The results of this review are included in this report.
4 SURVEY RESULTS
'4.1 JAMES A.
FITZPATRICK In 1985, in response to industry communications on pressure-locking issues, the licensee had performed an engineering review of all flexible-wedge and double-disk gate valves. Licensee engineers concluded at that time that several safety-related valves were susceptible to pressure locking and recommended modifications to those valves.
The recommended modifications were similar to modifications mentioned in GE SIL 368, " Recirculation Discharge Isolation Valve Locking," issued in 1981.
However, plant managers did not perceive valve pressure locking as a credible problem at the James A. FitzPatrick station at that time because of a lack of site-specific operational experience.
The licensee had concluded that these modifications were not warranted.
Site managers also concluded, at that time, that placing the industry communications in the " Required Reading List" constituted adequate training for 6
l all personnel.
On July 17, 1991, with the unit shutdown and following maintenance on the outboard LPCI injection valve, the licensee performed a hydrostatic test of the piping between the outboard and inboard LPCI injection valves. Upon completing the test,they depressur17..d the piping between the valves and initiated a fill and vent of the i
system.
Approximately 9
to 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> after completing the hydrostatic test, the operators attempted to open the inboard LPCI injection valve. The actuator remained energized for approximately 30 seconds, af ter which the motor actuator circuit breaker tripped.
The licensee replaced the actuator motor, and the valve tested functional 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> later.
The licensee performed a special test to recreate the conditions that existed af ter completion of the hydrostatic test and performed
.l a VOTES test of the actuator and a Type C local leak rate test (LLRT) to verify that there was no valve damage.
They performed i
another hydrostatic test while the strain gage on the valve yoke was monitored.
)
1 As test pressure in the line increased to 500 psig, sounds were reported coming from the valve.
At the same time, the net compressive stress on the valve yoke dropped from 62,000 to 42,000 l
lbf; this was the most dramatic change during the test.
At 850 psig test pressure, the rate of depressurization dropped to zero for approximately 30 minutes, indicating compression of air in the bonnet.
A target pressure of 2100 psig was held for 10 minutes and released.
I Thirty minutes after line depressurization, operators attempted to open the valve from the control room.
The actuator went to locked-rotor current and an electrician monitoring line current manually l
opened the circuit breaker.
The bonnet was vented through the stem i
packing gland and air escaped.
Coincident with the bonnet depressurization, the valve position indication in the control room i
changed from closed to intermediate.
The valve was then stroked normally from the control room.
The data from the special test corroborated rough calculations that showed flexing of the valve disk owing to differential pressure across the disk would allow high pressure fluid to enter the valve bonnet.
The data further showed that a pressure of 2000 psig in the valve bonnet would result in a net downward (closing) force on the disk caused by (1) the differential pressure between the valve bonnet and the body of the valve along the horizontal projected area of the two sides of the inclined disks, and (2) the frictional drag forces of both sides of the disk, of approximately 120,000 lbf.
This force was well above the maximum thrust capability of the motor actuator.
Licensee engineers reviewed the test data and determined the cause 7
l l
l
of the valve failure to be pressure locking.
Additionally, the licensee recognized the potential for heatup of the bonnet volume, which would increase the likelihood of pressure locking during normal and accident conditions.
The licensee also recognized that valve pressure locking potentially would block low-pressure ECCS systems from performing their safety functions under transient or accident conditions involving rapid depressurization of piping adjacent to the affected valves.
With the aid of an outside consultant, the licensee performed an in-depth engineering analysis of all flexible-wedge and double-disk gate valves to determine their susceptibility to pressure locking under normal reactor operating pressures and the safety significance associated with each valve and its safety function.
The licensee's analyses assumed Reactor Recirculation system back-leakage past in-line check valves, recirculation pump discharge pressure in the valve bonnets, and conservative values for the coefficient of f riction based on the materials involved.
They further assumed worst-case conditions with regard to differential pressure across the valve disks and incorporated known actuator data with regard to the normal unseating forces required.
From the analyses they concluded that valve pressure. locking was a credible consideration. They further concluded that bonnet pressures in the range of 600 to 700 psig were sufficient to prevent the inboard LPCI injection valves from opening.
However, they also concluded that leakage out of the valve bonnet past the valve disks could mitigate the actual consequence of pressure locking in certain cases.
Leakage values were based on LLRT results.
This LLRT test applies 45 psig across the valve disk in order to measure valve leakage.
For the pressure-locking analyses the licensee utilized the most recent valve-specific as-found/as-left test data to determine the time for bonnet depressurization and compared this with the required actuation time assumed in the most limiting accident scenario. On the basis of these engineering analyses, the licensee concluded that an increased rate of pressure equalization was required to ensure opening within the time requirements.
Accordingly, the licensee added vent lines with block valves between the valve bonnet and body to LPCI and CS injection valves (manufactured by Powell and Velan, respectively).
The licensee also planned to evaluate the necessity of similar modifications to reactor core isolation cooling, high-pressure - coolant injection (HPCI),
containment
- cooling, and sump isolation valves for modifications.
The licensee did not believe that valve modifications for these additional applications were necessary l
owing to the calculated short time required for leak-off of bonnet pressure.
- However, the licensee's consultant recommended modifications at the next opportunity to eliminate the possibility that corrective maintenance on the disks and seats of the subject valves would reduce the leak rate and increase the bonnet pressure decay (bleed-off) time to an unacceptable level.
]
)
0
The licensee had also reviewed the training provided to operations and maintenance personnel and was in the process of developing and implementing training for these departments.
This training included detailed information about the pressure-locking phenomena, identification and recognition of pressure-locked valves, and corrective actions and mitigating actions to take in the event valves become pressure locked.
Information on the phenotaena was to be provided during initial, requalification, and periodic training.
As a result of the site visit, the licensee agreed to continue the review and include considerations for the ef fects of maintenance on valve disks and the effects of degraded voltage and live-load packing forces on the affected motor operator.
The licensee also agreed to provide training for engineering personnel.
4.2 R.E.
GINNA In 1969, the licensee for the Robert E.
Ginna Nuclear Power Plant reported gate valve pressure locking of the residual heat removal (RHR) system containment sump isolation valves (Table).
On December 16, 1969, during power operation, operations personnel attempted to open the B RHR containment sump isolation valve as part of the monthly surveillance program.
The valve is an Anchor Darling double-disk gate valve.
However, the valve would only open one-third of its total travel.
The licensee notified the Atomic Energy Commission and placed the unit in hot shutdown.
Upon disassembly, the valve disks were found to be bowed outward, preventing full opening.
The direction of the bowing indicated that the large net positive force causing this condition was between the two disks.
Form the engineering analysis of the valve disks, the licensee determined that the force was a result of a large pressure increase between the disks, caused by heatup of the water volume trapped between the two disks during operation (pressure locking).
The licensee requested assistance from Westinghouse and Anchor Darling to investigate the cause and recommend corrective actions.
All Anchor Darling and Alloyco double-disk gate valves were included in this review.
Following the engineering review, Westinghouse and Anchor Darling recommended that vent lines with block valves be installed on both A and B RHR containment sump isolation valves to preclude pressure locking.
Years later, in response to industry communications on pressure-locking issues, the licensee assumed that Anchor Darling valves were the only susceptible valves and, therefore, determined that the actions taken subsequent to their 1969. event were adequate.
However, at the Ginna plant, valves other than those manufactured by Anchor Darling are installed in safety-related applications.
For example, the low head safety injection (LHSI) isolation valves were manufactured by Velan.
These valves had not been reviewed to determine susceptibility to pressure locking.
1 9
As a result of this survey, the licensee initiated a review of all double-disk and flexible-wedge gate valves for susceptibility to pressure locking.
In addition, the licensee agreed to reconsider the assumptions used in previous engineering evaluations of the phenomena.
For example, the licensee had assumed leak-tight in-line check valves as a result of local leak rate data showing zero leakage when 45 psi air is applied.
Further, the licensee had not considered the effect of heatup on the volume of water trapped in the valve bonnet.
In response to industry communications on pressure-locking issues, the licensee had implemented training for all operations and maintenance personnel similar to that provided at FitzPatrick.
- However, engineering personnel were not mentioned in these communications, therefore, the licensee had not considered training necessary for them.
As a result of this survey, the licensee was in the process of developing training for engineering personnel.
4.3 NINE MILE POINT The licensee provided documents that revealed it had reviewed all double-disk and flexible-wedge gate valves manufactured by Anchor
- Darling, Rockwell, Crane, and Powell in response to industry communications on pressure-lockin.g issues.
Additionally, the engineering organization supporting Nine Mile Point had recommended modifications to prevent valve pressure locking.
However, plant managers did not approve the implementation of the recommended modifications because valve pressure locking was not perceived as credible because they lacked site-specific experience with the phenomena. Therefore, no modifications were performed at Nine Mile Point.
The licensee had provided training to operations and maintenance personnel but did not appear to have provided training for engineering personnel.
4.4 SALEM During the site visit, the licensee indicated that in 1977, during initial construction of the Salem Generating Station, Westinghouse had issued a design change that required review and modification of all Westinghouse-supplied gate valves to prevent valve pressure locking.
The licensee conservatively chose to expand this review-to all motor-operated gate valves and subsequently. modified all motor-operated gate valves identified as susceptible to pressure locking by installing vent lines with isolation valves from the valve bonnets.
During startup testing and initial operation, the licensee experienced leakage through the boron injection tank (BIT) isolation valves.
They determined that the open vent line isolation valves associated with the bonnets of these valves were 10
-s-
--a-
the path for leakage.
The. licensee eliminated the vent lines for the BIT isolation valves and replaced them with small weep holes in the upstream disks of each valve to preclude valve pressure locking.
Therefore, because of the Westinghouse design change and the conservative actions of licensee engineering personnel, the licensee for Salem appeared to have taken adequate corrective actions to prevent valve pressure locking.
In response to NRC and industry reports on valve pressure locking, the licensee had provided extensive training to operations and maintenance personnel similar to that provided by FitzPatrick.
As a result of this survey, the licensee recognized the need to provide training to engineering personnel and was developing this training.
4.5 HOPE CREEK The licensee did not consider gate valve pressure locking to be a credible problem owing to the lack of site-specific experience with the phenomena.
Therefore, in response to engineering reviews performed as a result of industry communications on pressure-locking issues, the licensee did not modify any valves.
Licensee engineering personnel had recommended modifications to various double-disk and flexible-wedga gate valves as a
result of performing these engineering reviews.
However, rather than modify the valves, the licensee chose to modify various operating and emergency procedures to require removal of insulation, initiation of cooling of valve bonnets, and manual operation of affected valves in the event valve pressure locking were to occur.
Note that the licensee for Hope Creek Station is the licensee for the Salem Generating Station, which, as discussed in Section 4.4 of this report, modified all gate valves determined to be susceptible to pressure locking at Salem during initial construction.
As a result of the feedback provided during this survey, the licensee planned to perform additional engineering evaluations of all double-disk and flexible-wedge gate valves at Hope Creek to reevaluate their susceptibility to pressure locking and to review the need for valve modifications.
Training for Hope Creek and Salem personnel was provided by the corporate training department.
Therefore, similar training was provided to operations and maintenance personnel at both stations, including the actions previously discussed in the event of a valve pressure-locking occurrence.
As a result of this survey, the licensee was developing training for engineering personnel.
4.6 SUSOUEHANNA 11
Before the 1991 event reported by the licensee for the James A.
FitzPatrick station, the licensee had not considered valve pressure locking to be a credible problem owing to the lack of site-specific experience with the phenomena.
Therefore, in response to NRC and industry feedback, the licensee had chosen not to modify any double-disk or flexible-wedge gate valves. As with other licensees surveyed, their engineering personnel had reviewed the phenomena and recommended valve modifications to preclude valve pressure locking.
- However, rather than implement these modifications, licensee managers had chosen to modify various procedures to allow for removal of insulation, cooling of valve bonnets, and manual operation in the event valve pressure locking were to occur.
Following the FitzPatrick valve-failure
- event, Susquehanna engineering personnel, in conjunction with an outside consultant,-
performed additional engineering analyses of all motor-operated flexible-wedge and double-disk gate valves.
These analyses addressed the phenomena of valve pressure locking as a motor actuator thrust issue and compared the thrust capability of the installed motor actuator with the calculated thrust required to open the valve under conditions resulting in bonnet pressurization.
The licensee assumed the maximum starting pressure in the valve bonnet to be equivalent to the highest associated system pressure experienced during normal or accident conditions with no consideration given for bonnet volume heatup.
Credit for mitigating the ef fects of valve bonnet pressurization was taken for leakage out of the valve bonnet based on the most recent as-found/as-left LLRT data results where 45 psid was applied to t'ne valve disks.
The available actuator thrust was based on vendor-supplied data rather than actual test data and did not allcw for forces related to live-load packing or' stem drag.
However, the licensee did consider the effects of degraded voltage on the actuator motor.
The licensee's calculations showed that the LPCI injection valves (manufactured by Anchor Darling) were susceptible to pressure locking and that 98 percent actuator motor voltage was required i
even if reactor recirculation flow was maintained at 88 percent to j
reduce the pressure in the bonnet.
These calculations also showed that CS injection valves (manufactured by Anchor Darling) were susceptible to pressure locking and that 83 percent actuator motor voltage was required. Further, the calculations identified opening time delays of 1 second and 4 seconds, respectively, during LOCA scenarios in which the valves were actuated concurrent with RHR and emergency service water (ESW) pump start voltage transients.
As a result of these calculations, the licensee had modified these valves on Unit 1 by drilling weep holes in the upstream disks and planned to make similar modifications to Unit 2's valves during the next refueling outage.
The licensee had implemented additional precautions to require that 12
the speed of the reactor recirculation pumps be limited to less than 88 percent by procedure and manual operator actions to address any system voltage degradation below 96.5 percent.
Additional calculations had shown that other valves were also potentially susceptible to valve pressure locking and that degraded voltage at the 80 percent threshold may significantly impact their ability to function as required.
Therefore, the licensee was continuing their engineering evaluations on the need to modify these valves.
During the site visit, non-conservative aspects of the calculations were identified and discussed.
These included (1) the lack.of bonnet volume heatup considerations; (2) utilization of actuator nameplate values for available actuator torque instead of actuator force based upon actual measured values and diagnostic errors; (3) failure to consider the affects of live-load packing forces on available actuator thrust; (4) reliance on leak rate testing data utilizing low applied pressures to determine the rate of bonnet leakage; (5) failure to account for significantly decreased bonnet leakage as a result of maintenance on valve internals, and (6) failure to consider additional forces resulting from thermal binding, double disc drag, and bonnet pressurization as additive.
As a result of the feedback and the questions raised by this survey, the licensee initiated a re-evaluation of the assumptions and values used in the calculations concurrent with previous concerns related to degraded voltage.
The results of these engineering evaluations were to be used to determine if modification of additional valves were required.
In response to industry communication on pressure-locking issues, the licensee had implemented training for operations and maintenance personnel similar to that implemented at FitzPatrick.
i However, as with all licensee's surveyed, no such training was of fered for the engineering staf f.
As a result of this survey, the licensee was developing training for the engineering staff.
5 OPERATING EXPERIENCE REVIEWS Several licensees surveyed also reported that reviews of operating experience reports indicated that some previous valve failures could be attributed to valve pressure locking.
For example, Susquehanna reported that a review of Station operating occurrence Reports (SOORs) revealed that, in 1987, the Unit 1 LPCI outboard injection valve had failed to open electrically or manually when attempting to enter shutdown cooling as reported in S00R 1-87-205.
No damage or obvious cause for the failure was found, and the S00R evaluation concluded that thermal binding was the cause.
Station engineering personnel now attribute the cause to pressure locking.
AEOD staf f reviews of other licensee's event reports also indicated 13 I
(
e
1 this possibility.
For example, a review of licensee event reports from Pilgrim Nuclear Etation indicates four previous, unexplained valve failures were potentially caused by valve pressure locking.
l These reports further indicate that routine cycling, preoperational testing, and surveillance testing may not provide a reliable means of ensuring valve operability during all transient or accident conditions.
During these typical plant evolutions, system pressures generally change slowly.
During plant shutdowns, the
)
internal pressure of the gate valve bonnet should have a longer time to equalize with line pressure.
The pressure differentials required for pressure locking the valve closed would not necessarily develop in such instances or could be dissipated prior to operation of the valve during the investigation of valve failures.
Therefore, if valve pressure locking is not fully considered by operations, maintenance, and engineering personnel as L
a potential common-cause failure mechanism, it will not be recognized and reported as such.
During accidents or transients,.
however, the magnitude and rate of pressure change-in the line may be sufficiently rapid to prevent the valve internal pressures from quickly reaching equilibrium, which may make the valve incapable of opening at the required time.
t 6
ENGINEERING INSIGHTS Information obtained from licensee engineering organizations during the site visits revealed a_ number of engineering insights related to the analysis and evaluation of the pressure locking phenomena.
This section presents a comprehensive and systematic review of the information presented in previous sections in terms of the analysis bases, assumptions, and methods that would be appropriate for a conservative assessment of gate valve pressure locking.
This section also provides a summary of the modifications made to correct the problem at the sites visited.
6.1 Valve Tvoos and Applications From the sites visited, the staff confirmed that the valve types which are susceptible to valve pressure locking include both double-disk and flexible-wedge gate valves.
'That both types are susceptible is evident from the FitzPatrick event which involved pressure locking of the inboard LPCI (flexible-wedge) injection d
valve and the Salem (double-disk and flexible-wedge) valves, which I
were modified before plant operation.
Suppliers of the gate valves installed at the plants surveyed included Anchor Darling, Alloyco, Crane, Lunkenheimer, Pacific Valves, Powell, Rockwell, Velan, and Westinghouse.
The identified operating experience and engineering studies 14 i
reviewed during the site visits indicated that a wide range of applications are involved.
This is evident from the FitzPatrick LPCI valve failure and the sump suction' valve failure at Ginna.
Additionally, for the plants visited, applications that were viewed as potentially susceptible in licensee engineering assessments included gate valves in the injection and recirculation flow paths for both BWR and PWR front-line safety systems (e.g., LPCI, LHSI, CS, HPCI, containment sump suction).
Other systems such as RWCU, RHR, and RHR service water were also included in the vulnerability assessments.
The diversity of systems potentially involved in pressure locking is further supported by the valve modifications actually made, as in the case of those at Salem.
6.2 Safety Analysis Considerations Information collected from the site surveys shows that two principle safety issues are involved in valve pressure locking.
The first involves the potential for valve motor failure owing to extended operation of the motor operator at locked rotor current.
The second safety issue involves the acceptability of any added time delay in opening a safety-related valve following a rapid depressurization or a temperature increase transient in and around the valve.
The time delay is associated with the time required for H
pressure in the valve bonnet and the pressure differential across i
the valve to decay to a point where the valve motor operator is capable of overcoming the combined valve / disk forces discussed _in Section 6.3 of this report.
This time delay is directly affected by the bonnet fluid (out) leakage rate across the valve seats.
Several safety-significant transient conditions can cause the resultant forces to become greater than the stall thrust of the valve's associated motor operator.
For example, an ADS actuation or a LOCA would cause the piping adjacent to a closed inboard LPCI injection valve to rapidly depressurize.
This is.especially significant in the case of a safety-system valve that must open to perform its design safety function.
Pressure locking may delay or prevent timely operation of these safety-related valves and, therefore, delay or prevent emergency coolant injection.
The calculated time required for valve internal pressure to equalize with the line pressure suf ficiently to allow valve operation should be less than the time required for valve opening in the most limiting accident or transient.
Pressure locking may occur that is of lesser risk importance when a valve is used to isolate its system for maintenance, and the system conditions allow bonnet heatup, as in the case of RWCU.or HPCI isolation.
This could necessitate unplanned system or plant shutdowns.
Another less risk-significant case is when the valve bonnet is pressurized during hydrostatic testing followed by system depressurization.
In this case, procedures should require bonnet 15
depressurization before subsequent valve cycling or system operation.
6.3 Valve Disk Force Combinations Based on integration and extrapolation of information compiled during the site visits, a conservative assessment of pressure locking involves consideration of a number of forces that act cumulatively on valve disks.
The combined forces which would have to be simultaneously overcome to open the valve would include (1) frictional drag forces of both disks in a double-disk valve or both sides of a flexible-wedge valve, (2) the net downward closing' force -
on the disk'or wedge caused by the differential pressure between the bonnet and the body of the. valve, acting along the horizontal projected area of the (two) sides of the inclined disks (nominally 5
for flexible wedge type gate valves),
(3) normal unseating forces (nominally 80% of seating force) caused by packing drag, stem drag, etc.,
and (4) the frictional forces associated with thermal binding, if applicable.
The " double disk drag" effect mentioned in item (1) in this.Section, 6.3, is caused by the differential pressure across the wedge or disks and the frictional-force between the disks and their seats.
This is generally the most significant force acting upon the valve when pressure-locked.
6.4 Initial Pressure in the Bonnet The initial pressure in the bonnet should be assumed to be at least as high as the highest adjacent system pressure (e.g., reactor recirculation pump discharge pressure for BWR LPCI injection valves) during steady-state operations.
This reflects the assumption that the in-line check valves leak at least to a small degree. Current LLRT practices, utilizing low pressures to measure check valve leak rates, may mask actual leakage through these valves.
Further, as previously stated, all flexible-wedge and double-disk gate valves will allow leakage into the valve bonnet because of their design. Therefore, all flexible-wedge and double-disk gate valve bonnets will contain pressurized-fluid.
Additionally, licensees should consider heatup due to convection or conduction caused by adjacent system piping or increased ambient temperature conditions during transients or accidents (i.e., high-energy line breaks or nearby equipment).
6.5 Bonnet Pressure Decav Rate Following a line (system) depressurization, pressure on either side of the valve disks will be lowered below the pressure in the valve bonnet.
Engineering evaluations reviewed during the site visits 16
~ _ _ _ -
indicate that the rate of out-leakage from the valve bonnot becomes the key factor in the pressure-locking assessment.
Thu event at FitzPatrick was evidence that the out-leakage rate can be extremely low, requiring many hours for pressure in the bonnet to decrease sufficiently to allow the valve to be opened.
At the same time, assuming a significant rate of out-leakage and pressure decay in the valve bonnet has been used by licensees to show a reduced potential for valve pressure-locking.
To ensure that the pressure decay rate is not overestimated, licensees should make a
conservative engineering analysis of the bonnet out-leakage rate.
In this regard, one approach used by licensees surveyed is to extrapolate the actual leak rate across the valve, measured at low pressure, to a valve bonnet out-leakage rate to be assumed at hiah differential pressure, keeping in mind that higher differential pressures will cause the disks to seat and seal more tightly, further reducing fluid leak-off from the bonnet.
An alternative approach, not used by licensees surveyed, would be to use an assumed bonnet out-leakage rate based on an actual test with a hiah differential pressure across the valve.
In either. case, a
conservative assessment should assume valve bonnet out-leakage rate based on a gate valve with a new, rebuilt, or reworked valve disks and seats.
Additionally, licensees should appropriately consider the contribution to increase or sustained bonnet pressure due to a bonnet temperature increase by heat convection or conduction caused by adjacent system piping or increased ambient temperature conditions during transients or accidents (i.e., nearby high-energy line breaks or equipment).
6.6 Internal valve Force Calculations The calculations used to predict the time-dependant internal forces acting to prevent valve opening should be comprehensive and rigorous, considering all forces acting upon the valve as additive.
Conservative assumptions and values should be used, including the initial starting pressure, in-line check valve leak rates, valve disk leak
- rates, convection / conduction heatup
- rates, normal unseating forces, and a conservative coefficient of friction based on the actual materials involved.
The resultant binding (pressure locking) plus normal unseating forces should then be compared with available motor-operator thrust after applying an appropriate factor of safety.
6.7 Motor-operator Thrust Capability Motor-operator tPr.t capability assumptions should be based on actual diagnostic testing results and not on actuator nameplate or vendor-supplied data.
The resultant values should incorporate considerations for diagnostic errors, live-load packing, stem and stem nut drag, stem rejection load, etc.
Special consideration 17 1
v-
=
I i
i i
should be given to degraded voltage concerns (nominally 80%).
l 1
6.8 Valve Modification Approaches On the basis of the site visits and a review of recommended modifications from valve suppliers, the staff believes that two basic options for valve modifications may be used to prevent valve prcssure locking.
One method is to drill a small hole in either the upstream or downstream disk (or wedge) to relieve bonnet pressure.
The second method is to install a vent line from the bonnet with a normally open isolation valve.
Either option appears to provide adequate assurance of proper operation of valves susceptible to pressure locking.
The choice of modification is dependent on the licensee's determination of the option's effectiveness and other engineering concerns related to an individual valve's function, physical location, system interaction, adjacent systems, etc.
For example, the BIT injection valves at Salem were originally modified by installing vent lines with open isolation valves from the bonnet of each valve.-
However, boron leakage into the primary system necessitated a change to the disk weep-hole option.
Conversely, a valve located in a high radiation area may not be a good candidate for the vent line with an isolation block valve modification.
Note that engineering evaluations and operating experience at FitzPatrick and Salem have shown that concerns about the disk vent hole option adversely affecting LLRTs were unjustified.
7 CONCLUSIONS The common-cause failure of flexible-wedge and double-disk gate valves owing to pressure locking continues to be reported at U.S.
nuclear power plants, even though the phenomena and the remedies needed to prevent the problem have been known for many years.
Flexible-wedge and double-disk gate valves are used extensively in safety-related applications throughout the nuclear industry in both BWR and PWR facilities.
Many of these applications are in safety-related systems and many of these safety-related valves are required to open during or immediately following the postulated design basis events.
Further, the events that most severely challenge plant safety usually involve the most rapid system cooldown and depressurization rates and, potentially, the largest pressure differentials in and around these valves.
Accordingly, for such events, valve pressure locking may be characterized as a consecuential failure mechanism that can be a
significant contributor to common-mode valve failure during accidents or severe depressurization transients.
The primary concern is the inability of safety systems to perform their intended safety function if 18
1 required during design basis transients or accidents caused by isolation or injection gate valves that fall to open properly because of pressure locking.
A secondary concern is the potential inability to return to service systems removed from service and isolated for maintenance and-required for continued safe operation, resulting in unplanned reactor shutdowns.
On the basis of this survey, it was concluded that most of the licensees have chosen not to implement these known remedies because they lacked available site-specific experience with valve pressure
- locking, despite recommendations from their engineering organizations to modify selected valves to prevent pressure locking.
Most licensees surveyed had not performed complete or comprehensive engineering reviews or evaluations to fully assess.
pressure locking concerns.
From this survey, the staff learned that when adequate engineering evaluations were performed, the potential for valve pressure locking was identified and, when coupled _ with certain accident scenarios, the safety significance was recognized, thus prompting i
the licensees to implement valve modifications to prevent valve pressure locking.
These modifications involve either drilling a hole in one of the disks or providing a vent path from the bonnet section of the valve.
One of the licensees surveyed (Salem) apparently resolved the issue of gate valve pressure locking during their initial construction by 1
implementing modifications as part of a design package.
- Others, because they recognized specific events being attributable to gate valve pressure locking, as in the case of FitzPatrick, have pursued the issue and were in the process of identifying and implementing corrective actions.
However, none of the plants surveyed had developed a completely comprehensive and_ rigorous analytical.
approach capable of identifying and resolving all of the forces involved as outlined in the previous section.
Further, none of the licensees surveyed had provided training to their engineering staff to ensure prompt identification and resolution of emergent gate valve pressure-locking events. Therefore, valve f ailures caused by pressure locking continue to go unrecognized and unresolved.-
Current testing and surveillance methods are not directed at identifying valves susceptible to pressure locking.
For example, the low pressures used during leak rate testing do not develop suf ficient pressures within the valve bonnet area to cause pressure locking, in most cases.
Also, as in the_ case of Salem and Hope
- Creek, some licensees have no requirement to cycle valves immediately following hydrostatic testing.
Furthermore, the relatively slow system depressurization rate associated with normal shutdown evolutions would not be expected to allow bonnet pressure to be sustained long enough to detect pressure locking during later 19
valve operations.
Previous NRC and industry feedback ef forts have not been successful in eliminating valve pressure-locking concerns. Licensees continue to experience valve pressure-locking events (even though many events go unrecognized).
Most licensees surveyed have not adequately reviewed or evaluated pressure-locking issues. And most licensees surveyed have chosen not to implement adequate remedies to eliminate gate valve pressure locking. Licensees ' plants appear.
to continue to be susceptible to common cause failure caused by gate valve pressure locking.
20
TABLE CHRONOLOGY OF OPERATIONAL EXPERIENCE AND FEEDBACK REPORTS INVOLVING PRESSURE LOCKING OF DOUBLE-DISK OR FLEXIBLE-WEDGE GATE VALVES June 18, 1964 BUSHIPS 9480.72, " Surface Ship Steam System Valves, Operation of Prior to Warmup."
December 16, 1969 Valve MOV-850 B (RHR Sump Suction) Failure to Operate at R.E.
Ginna.
Circa 1977 Westinghouse Issues Design Change to All Westinghouse Supplied Gate Valves Requiring Vent Lines at Salem.
March 9, 1977 IE Circular 77-05, " Fluid Entrapment in Valve Bonnets."
September 3, 1981 Two Safety Injection Valves Fail to Open at San Onofre Unit 1.
s October 8, 1981 IE Information Notice No. 8 1 - 3.1, " Failure of Safety Injection Valves to Operate Against Differential Pressure."
Circa 1981 Two Recirculation Discharge Isolation Valves Fall to Open After a Scram at a BWR.
December 1, 1981 General Electric Service Information - Letter No.
- 368,
" Recirculation Discharge Isolation Valve Locking."
q August 7, 1982 Two RHR Suction Line Isolation Valves Fall to Open at a Foreign PWR (also six previous similar events).
Circa 1982 Forlegn Regulatory Authority Orders Valve Design Changes at All Power Reactors to Prevent Pressure Locking.
November 30, 1983 INPO Significant Event Report 77-83, " Failure of Residual Heat Removal Suction Valves."
September 20, 1983 RHR Heat Exchanger Outlet Valve Fails to Open at LaSalle 1.
November 12, 1983 RHR Heat Exchanger Outlet Valve Falls to Open at LaSalle 1.
21 1
i
CHRONOLOGY (CONT'D)
July 6, 1984 AEOD Reissue of Study on Pressure Locking of Flexible Disk Wedge-Type Gate Valves.
December 14, 1984 INPO Significant Operating Experience Report 84-07, " Pressure Locking and Thermal Binding of Gate Valves."
February 3, 1988 Both RHR Cross-connect Tie Valves Fail to Open at Vogtle 1.
December 19, 1988 "Potentially Inoperable Containment Spray Valves in Both Safety Divisions Due to Misinterpretation of Purchase Specification" at James A.
Fitzpatrick.
September 14, 1991
" Bonnet Pressure Locking of Low Pressure ECCS Injection Valves" at James A.
Fitzpatrick.
November 18, 1991
" Potential for Pressure-Locking of RHR LPCI and Core Spray System Injection Valves" at Susquehanna.
April 2, 1992 NRC Information Notice 92-26,
" Pressure Locking of Motor-Operated Flexible Wedge Gate Valves."
22
-