05000259/LER-2015-005
| Browns Ferry Nuclear Plant (Bfn), Unit 1 | |
| Event date: | 10-29-2015 |
|---|---|
| Report date: | 12-28-2015 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(vii)(C), Common Cause Inoperability 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability |
| 2592015005R00 - NRC Website | |
I. Plant Operating Conditions Before the Event
At the time of discovery, Browns Ferry Nuclear Plant (BFN) Units 1, 2, and 3 were operating in Mode 1 at approximately 100 percent rated thermal power.
II. Description of Events
A. Event:
On October 29, 2015 at 1149 Central Daylight Time (CDT), it was discovered upon receipt of a vendor report that the Main Steam Isolation Valve (MSIV) accumulators [ACC] on all Browns Ferry Nuclear Plant (BFN) inboard MSIVs [ISV] are of insufficient size to provide the MSIV actuators adequate air volume, at the required pressure, to close the MSIV during a Loss of Coolant Accident (LOCA). Therefore, availability of Drywell Control Air (DWCA) [JM] nitrogen from the Containment Inerting system or from the Containment Atmospheric Dilution system was determined to be a requirement for operability of inboard MSIVs. From December 1, 2012, to the time of discovery, there were multiple occasions where BFN Unit 1, 2, or 3 DWCA systems were aligned to receive nitrogen from the Plant Control Air (PCA) [LE] system, resulting in the inoperability of multiple MSIVs for longer than allowed by BFN Technical Specification Limiting Conditions for Operation (TS LCO) 3.6.1.3. TS LCO 3.6.1.3, Condition A applies when there is one or more penetration flow paths with one primary containment isolation valve (PCIV) inoperable except due to MSIV leakage not within limits. The required action is to isolate the affected penetration flow path by use of at least one closed and de-activated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured and verify the affected penetration flow path is isolated. These actions were not taken. The aforementioned TS was not satisfied; therefore, the shutdown TS should have been entered. Additionally, on multiple occasions, Unit 1, 2, or 3 changed Modes with at least one MSIV inoperable which was required to be operable in the Mode that the Unit was entering. These actions were in violation of Unit 1, 2, or 3 TS LCO 3.0.4, which requires that when an LCO is not met, entry into a Mode or other specified condition in the Applicability shall only be made when the associated actions to be entered permit continued operation in the Mode or other specified condition in the Applicability for an unlimited period of time; or after performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering the Mode or other specified condition in the Applicability, and establishment of risk management actions, if appropriate; or when an allowance is stated in the individual value, parameter, or other Specification.
B. Status of structures, components, or systems that were inoperable at the start
of the event and that contributed to the event:
There were no structures, components, or systems that were inoperable at the start of the event that contributed to the event.
C. Dates and approximate times of occurrences:
This condition was identified and entered into the Corrective Action Program (CAP) on October 29, 2015 at 1149 CDT.
D. Manufacturer and model number (or other identification) of each component that failed during the event:
No components failed during the event.
E. Other systems or secondary functions affected:
There were no systems or secondary functions affected by this situation.
F. Method of discovery of each component or system failure or procedural error:
The station MSIVs were recently categorized as Category 1 Air Operated Valves (AOV) [V]. As such, they require the development of a component level review calculation. The purpose of this calculation is to evaluate the required thrust to operate the valve, actuator capability, and the resulting margin between the two under the limiting system conditions identified in the system level review calculation.
An external vendor was contracted to perform the calculation. The results show that the inboard MSIV actuators for all units do not have sufficient capability to close their associated valve under worst case limiting conditions identified in the system level review calculation.
G. The failure mode, mechanism, and effect of each failed component, if known:
The MSIV accumulators are too small in volume to provide the MSIV actuator enough air volume at the required pressure to close the MSIV during a LOCA. This is primarily due to the MSIV below piston volume, or opening volume, is exhausted directly to the drywell. Therefore, increases in drywell pressure during a LOCA create a large force attempting to hold the valve open. This requires more air mass to be pushed from the accumulator into the closing side of the actuator. Since the starting pressure for the accumulators is a set pressure and the volume of each accumulator is fixed, the accumulators have a set amount of energy stored in them.
There is insufficient force to close the valve in this condition.
H. Operator actions:
There were no immediate operator actions required.
I. Automatically and manually initiated safety system responses:
There were no automatic or manually initiated safety system responses as a result of the discovery of the MSIV design condition.
III. Cause of the event
A. The cause of each component or system failure or personnel error, if known:
The causes of limited actuator capability were the failure of the original design of the MSIV actuators and accumulators to account for elevated drywell pressure during the time that the MSIVs are required to stroke for a Design Basis Accident (DBA) LOCA, and the failure to incorporate internal and external operating experience into AOV program.
B. The cause(s) and circumstances for each human performance related root cause:
The design failures which led to this event were part of the original plant design and are considered legacy issues. Corrective actions will focus on restoring positive margin to the actuator capability of the inboard MSIVs.
IV. Analysis of the event:
The Tennessee Valley Authority is submitting this report in accordance with Title 10 of the Code of Federal Regulations (10 CFR) 50.73(a)(2)(i)(B), as any operation or condition which was prohibited by the plant's Technical Specifications; and 10 CFR 50.73(a)(2)(vii)(C) and (D), as any event where a single cause or condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to control the release of radioactive material, and mitigate the consequences of an accident. An external vendor was contracted to perform a component level review calculation for the station MSIVs which was performed using the methodology specified in EPRI 1022646, Air-Operated Valve Evaluation Guide, Revision 1. Upon delivery of the results, it was discovered that the inboard MSIV accumulators for all units do not have sufficient capability to close their associated valve under worst case limiting conditions identified in the system level review calculation. The primary cause of limited actuator capability is that the MSIV actuator pistons are vented to the drywell atmosphere which is at an elevated pressure during a DBA LOCA. Since the primary motive force for moving the actuator piston is the difference in pressure between the accumulator supply pressure and the drywell atmospheric pressure, the motive force decreases as drywell pressure increases.
A Prompt Determination of Operability (PDO) concluded that during a LOCA there would be adequate air supply and pressure to the inboard MSIV Accumulators via the DWCA system. A Past Operability Evaluation (POE) determined that the Inboard MSIVs were inoperable when DWCA was aligned to PCA while the unit was in Mode 1, 2, or 3 since PCA is not a safety-related or quality-related system and Unit 1, 2, and 3 would not have been assured of meeting the requirements of 1/2/3-SR-3.6.1.3.6, Main Steam Isolation Valve Fast Closure Test. Since the MSIVs were inoperable during times when DWCA was aligned to PCA while in Modes 1, 2, and 3, there are several periods of MSIV inoperability for each unit over the past 3 years. The highest power level during any of these periods was 92%. While peak containment pressure resulting from a DBA LOCA would lower as power level lowers, it would not be expected to lower below 26.9 psig to allow the MSIVs to go fully closed in 5 seconds at 92% power. The evaluation shows that while the Inboard MSIVs were inoperable because they would not have closed within the time assumed in the DBA Analysis and required by 1/2/3-SR-3.6.1.3.6 during a DBA LOCA, they still would have closed before the Gap Release phase of the accident began at 120 seconds after event initiation. Therefore, the consequence of this condition is low.
V. Assessment of Safety Consequences
A Probabilistic Risk Analysis (PRA) Evaluation was performed on this condition and concluded that the Inboard MSIVs would have met their credited functions in the BFN PRA model.
Therefore, the above condition would have no impact on Core Damage Frequency or Large Early Release Frequency and is considered very low safety significance.
A. Availability of systems or components that could have performed the same function as the components and systems that failed during the event:
Two MSIVs provide redundancy in each steam line so that either can perform the isolation function, and either can be tested for leakage after closing the other. The inside valve, the outside valve, and their control systems are physically separated.
The Outboard MSIVs are not affected by this condition and were not evaluated. They are normally aligned to the PCA main header, and the air accumulators on each of the outboard MSIVs contain adequate air volume to close the MSIVs. This satisfies the requirement to close the steam lines when required despite single failure in either valve.
A PDO determined that during a LOCA there would be adequate air supply and pressure to the MSIV Accumulators via the DWCA system.
B. For events that occurred when the reactor was shut down, availability of systems or components needed to shut down the reactor and maintain safe shutdown conditions, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident:
This event was not discovered when the reactor was shut down.
C. For failure that rendered a train of a safety system inoperable, an estimate of the elapsed time from discovery of the failure until the train was returned to service:
There were several periods of inoperability of the inboard MSIVs for each unit over the past 3 years. The longest period of inoperability which was discovered was from August 2, 2014, at 1749 CDT to August 7, 2014, at 1527 CDT.
VI. Corrective Actions:
Corrective actions are being managed by TVA's CAP under Condition Report (CR) 1098857. The following corrective actions are in progress:
1. Issue and implement design change to resolve negative margin issue with Units 1, 2, and 3 inboard MSIVs.
2. Review calculation for accumulators associated with the Automatic Depressurization System relief valves to ensure they address LOCA conditions.
3. Ensure design basis calculations are developed for all Category 2 AOVs at BFN.
VII. Additional Information:
A. Previous Similar Events:
A search of BFN LERs for Units 1, 2, and 3 did not identify any previous similar conditions in LERs.
A search was performed on the BFN corrective action program. The search did not identify any CRs as being similar to the condition identified in this LER.
B. Additional Information:
There is no additional information.
C. Safety System Functional Failure Consideration:
The safety function of the Primary Containment System, including the MSIVs, is to provide a minimum of one protective barrier between the reactor core and the environmental surroundings subsequent to an accident involving failure of the piping components of the reactor primary system. A certain degree of additional reliability is added if a second valve located outboard on the containment, and as close as practical to it, is included. If a failure involves one valve, the second valve is available to function as the containment barrier. The two valves in series are provided with independent power sources and are actuated by separate Control Air systems. In the event of a failure which occurs within the drywell while the inner isolation valve is inoperable, the reactor steam will blow down into the primary containment. The outer isolation valve will close upon receipt of the low water level signal, and the reactor becomes isolated within the primary containment. Therefore, because sufficient systems were available to perform the same functions of preventing release of radioactive material and mitigating the consequences of an accident, this event is not considered a Safety System Functional Failure in accordance with NUREG-1022.
D. Scram with Complications Consideration:
This event did not result in a reactor scram.
VIII. COMMITMENTS
There are no new commitments.