05000289/LER-2009-001
| Docket Numbersequential Revmonth Day Year Year Month Day Yearnumber No. N/A 05000 | |
| Event date: | |
|---|---|
| Report date: | |
| 2892009001R01 - NRC Website | |
There were no structures, systems, or components out of service that contributed to this event.
Event:
Between October 21 and 25 in 2009, lift setpoint verification IN SITU testing was performed by mechanical maintenance in accordance with 1303-11.3 "Surveillance Test and Set Main Steam Safety Valves." Six Main Steam Safety Valves [MS-V-19A, 17C, 18C, 19C, 21B and 19D] *[SB/RV] were identified with lift pressures above the IST acceptance criteria (i.e., more the 3% above setpoint). Each valve is tested to determine lift setpoint at least twice before any adjustments are performed. Each valve was declared inoperable until the setpoint had been adjusted and repeated tests demonstrated lift pressures within +/- 1% of setpoint. An additional valve [MS-V-21A] was quarantined to preserve evidence of the problem, declared inoperable, and not tested at that time.
At 2:29 PM on 10/21/09, MS-V-19D did not lift at 6% above setpoint. TMI-1 Technical Specification (TS) 3.4.1.2.3 requires all eighteen MSSVs to be operable above 5% reactor power. With one MSSV inoperable, Tech Spec 3.4.1.2.3 requires that reactor power be reduced below 92.4%. When the MS-V 19D was declared inoperable, reactor power was - 85%. The reactor was coasting down toward refueling outage 1R18. On 10/23/09, MS-V-19C failed to lift at 6% above setpoint as well. With two MSSVs inoperable on one Once Through Steam Generator (OTSG), TS 3.4.1.2.3 requires that reactor power be reduced below 79.4%. At 1:52 PM, reactor power had been reduced from approximately 83% to 74% to ensure compliance with TSS. MS-V-19C setpoint was adjusted; the valve was tested satisfactorily and declared operable. At 5:41 PM, when testing of MS-V-18C identified that a third valve had failed, and each valve that failed had been refurbished in the previous outage, the additional valves refurbished in the previous outage were declared inoperable. In the previous outage (1R17 November 2007), six MSSVs [MS-V-19A, 21A, 18C, 19C, 21B and 19D] were refurbished. With more than three MSSVs inoperable on one OTSG, TS 3.4.1.2.3 requires the MSSVs be restored to operable within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> or the reactor be placed in Hot Shutdown within an additional six hours. By 7:12 PM, following setpoint adjustment and satisfactory testing activities, only three valves remained inoperable [MS-V-19A, MS-V-21A, and MS-V-21B] and reactor power had been lowered to 65% (below the TS maximum power level for the three inoperable MSSVs - 79.4% reactor power). By 10/25/09, adjustments and testing were completed, and MS-V-19A and MS-V-21B were restored to operable status.
The extent of condition is limited to the eighteen MSSVs. Seventeen of eighteen MSSVs were tested IN SITU. MS-V-21A was quarantined and sent to NWS Technologies LLC (NWS) for testing. Eleven valves performed satisfactorily during testing. There are no other Dresser 3700 series steam safety valves used at TMI-1. Thus, it is assumed that seven of the eighteen MSSVs were inoperable at some time during the last operating cycle. This condition did not meet the requirements of TS 3.4.1.2.3, and therefore this event is reported as a 60 day LER in accordance with 10 CFR 50.73 (a)(2)(i)(B).
V The primary root cause is a design deficiency, in that the design does not prevent the formation of an oxide bond between the valve disc and seat, which results in unacceptable valve performance.
Additional causes for specific valve problems will be established based on inspection and failure analysis that is being performed at a certified off-site test facility.
C. ANALYSIS / SAFETY SIGNIFICANCE
The safety significance of seven inoperable MSSVs (MS-V-21A, MS-V-21B, MS-V-19A, MS-V-17C, MS- V-18C, MS-V-19C and MS-V-19D) was reviewed. To assess the safety significance of the cycle 17 condition, an existing analysis of the RCS, OTSG & MS pressure response with inoperable MSSVs (AREVA 86-9052402-001) was reviewed. This document summarizes the results of a new design analysis performed in 2009 to support a future Tech Spec change to the MSSV operability requirements.
The limiting design event for MSSV capacity is a loss of electrical load. In the analysis of this event the turbine is tripped and an Anticipatory Reactor Trip due to a Turbine Trip (ARTTT) does not occur. The analysis models the real event where the turbine control valves close to prevent turbine overspeed but the condition does not initiate an ARTTT. The MSSV and RCS code safety valve capacity must be sufficient to ensure RCS pressure remains less than 110% of design (2750 psig) and OTSG pressure remains below ASME code maximum of 1169.7 psia.
In this existing analysis (AREVA 86-9052402-001), the peak RCS, OTSG and MS pressures were determined for a case with six inoperable MSSVs (three inoperable on each OTSG). This similar case was used to evaluate the potential consequence of the actual cycle 17 condition. In cycle 17, two of the affected valves were small MSSVs (three inch valve). The capacity of a small valve is approximately 25% of a large valve. The total capacity of the seven inoperable valves during cycle 17 was less than that of the six large valves. The analyzed case did not address the specific configuration of inoperable MSSVs that existed in cycle 17 but this uncertainty is more than offset by other differences where the analyzed case is more conservative than the cycle 17 condition.
The analysis showed a peak RCS pressure of 2583 psia and peak OTSG pressure of 1169.1 psia.
The differences between the analyzed case and the results of a postulated loss of electrical load had it occurred during cycle 17 include:
- The analysis assumed Reactor power was 102% of 2568 MWt. Reactor power was less than this at all times during cycle 17.
- The analysis did not assume any reduction in reactor power due to core physical response to rising RCS temperature as would have occurred during cycle 17.
- The analysis did not assume any reduction in reactor power due to Integrated Control System (ICS) action to insert control rods as would have occurred during cycle 17.
- The six inoperable MSSVs were assumed to remain shut. Cycle 17 testing showed that each valve did open prior to 110% of setpoint. This steam relief capacity was not credited.
6 The results of the analysis of that similar case (i.e. peak RCS pressure was 2583 psia and peak OTSG pressure was 1169.1 psia) and the knowledge that this analysis used a very conservative model compared to the event if a loss of electrical load had occurred provide the basis to conclude that the analysis results are at least representative if not bounding for the condition in cycle 17.
The affect of MSSV capacity on each of the Updated Final Safety Analysis Report (UFSAR) Chapter 14 analyses was reviewed. Each of the analyses is bounded by the analysis of three events (1) Loss of electrical load, (2) Anticipated Transient Without Scram (ATWS), and (3) OTSG heat removal via the MSSV following a Reactor and Turbine Trip. The cycle 17 condition only affected the loss of electrical load event. In the UFSAR Chapter 14 ATWS limiting event (Loss of Main Feedwater), the turbine trip follows the reactor trip. Because of this sequence, the secondary side peak pressure and required MSSV capacity are bounded by the turbine trip event. A conservative computation performed in support of a planned MSSV TS change shows that one large MSSV on each OTSG (two valves in total) is sufficient for RCS heat removal after the reactor is shutdown. This assessment was performed for a 2772 MWt core design and included reactor coolant pump heat.
In summary, the seven inoperable MSSVs would not adversely affect RCS, OTSG or Main Steam system Integrity.
The impact of seven inoperable MSSVs (i.e. lifting above acceptable pressure set point) on the TMI Probabilistic Risk assessment (PRA) was reviewed. The MSSVs provide OTSG heat removal for ATWS and non-ATWS cases. MSSVs are credited when Atmospheric Dump Valves (ADV) and Turbine Bypass Valves (TBV) are not available. For non-ATWS cases, one MSSV on one OTSG is needed to remove adequate decay heat. A common cause failure of all MSSVs must occur to have any impact on risk. The failure of several valves will not have a measurable impact on risk. For ATWS cases, two MSSVs on each OTSG are required to open to remove decay heat. Again, common cause failures are needed to have any impact on risk, although fewer valves need to fail to have a risk impact compared to the non- ATWS case. The extent of cause for the cycle 17 MSSV failures is limited to the MSSVs refurbished in 1R17. However, a majority of the valves would need to fail before there would, be any measurable impact on risk. The condition during cycle 17 at TMI would have no noticeable impact on success criteria or timing for the TMI PRA. There is no measurable increase in risk; therefore, the increase in Core Damage Frequency (CDF) is less than 1E7.
D. CORRECTIVE ACTIONS
MS-V-19D and MS-V-21B were removed and shipped to NWS for inspection, disc analysis by Altran Labs, valve refurbishment by NWS including use of pre-oxidized discs and nozzle passivation, and post refurbishment certified lift pressure testing. (This action has been completed.) failure analysis, valve refurbishment including use of pre-oxidized discs and nozzle passivation, and post refurbishment certified lift pressure testing. (This action has been completed, except for failure analysis.) MS-V-21A was removed and shipped to NWS for as found lift pressure testing, inspection, valve refurbishment including use of pre-oxidized discs and nozzle passivation, and post refurbishment certified lift pressure testing. (This action has been completed.) Material changes and process control improvements will be established, which have been shown to be the most effective means for preventing unacceptable Main Steam Safety Valve (MSSV) lift pressures. A plant procedure will be revised to ensure passivation of nozzle/seat is required for all MSSV refurbishments.
E. PREVIOUS OCCURENCES
The oxide bonding phenomenon is well known in the industry. Industry efforts to eliminate this problem have been evolving since the mid 1990s. Today, a definitive solution has not been promulgated by the original equipment manufacturer and industry peers have reached various conclusions on how to resolve the issue. Industry efforts include change of material for the discs, use of a pre-oxidation process for the disc surface, modification of the nozzle/seat finish, and treatment of the finished seat. In two recent tests (one in 2005 and one in 2007), TMI-1 had experience with valve lift tests indicative of oxide bonding. In each case, the valve had not been refurbished in the prior outage. This made the cause determination less certain. There was no prior TMI-1 history with high lifts due to oxide bonding. Although TMI-1 didn't have significant oxide bonding related test failures, process improvements (pre-oxidize the disc material) were implemented in 2005. After the 2007 event, TMI-1 conducted further analysis of TMI-1 and industry experience. Additional process improvements were initiated (require nozzle passivation after refurbishment). However, this analysis and these improvements were not implemented before 2007 refurbishments were completed.
Therefore the seats of the valves refurbished in 2007 were not passivated to mitigate oxide bonding.
- Energy Industry Identification System (EllS), System Identification (SI) and Component Function Identification (CFI) Codes are included in brackets, [SI/CFI] where applicable, as required by 10 CFR 50.73 (b)(2)(ii)(F).