05000301/LER-2002-002
| Docket Number | |
| Event date: | 04-30-2002 |
|---|---|
| Report date: | 10-28-2002 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| Initial Reporting | |
| 3012002002R01 - NRC Website | |
FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6 PAGE (3) Point Beach Nuclear Plant Unit 2 05000301
Event Description:
On April 24, 2002, with the Point Beach Nuclear Plant (PBNP) Unit 2 in Mode 6, the Nuclear Management Company (NMC) was notified that one of the two pressurizer [PZR] safety valves [RV] failed to lift during testing. The valve was being tested off site by a vendor (Crane Nuclear, INC.). The vendor reported that the valve (Serial # N82732-00-0001) formerly in position 2RC-435 failed to lift at test pressures up to 2660 psig. The RCS safety valves at PBNP are Crosby Model HB-86-BP E valves. Testing pressure was limited to 2660 psig due to the boiler limitation and capacity of the test facility. The as found lift pressure specification for this valve is from 2440 to 2551 psig. In accordance with code requirement, the second in-service Unit 2 RCS pressurizer safety valve (Serial # XX05950199) was sent to the vendor for set point testing. The vendor initiated an investigation to determine why the first valve failed to lift.
On April 29, 2002, the NMC engineering department received a report of the vendor's initial investigation. The valve from position 2RC-435 had last been tested in November 2000 by the same vendor. The valve set point was determined to be within specification during the November 2000 test. In accordance with the vendor's normal practice, the valve was then checked for post set-point testing seat leakage. The valve was identified to have some seat leakage. Accordingly, a jack and lap procedure was done following the leak check to lap the valve disc and nozzle.
This process provides assurance that the valve will remain leak-tight with undamaged seats during the operating cycle.
It was during this process that the valve became incapable of lifting at the specified pressure, when the spindle threads were inadvertently left engaged in the disc holder threads. The valve assembly was corrected and the set point retested with satisfactory results. The other safety valve, from position 2RC-434, that was shipped for testing after failure of the first valve had also been tested and was found to lift within the specified range.
Based on our evaluation of the information we had received from the vendor regarding their investigation of the failed first valve, NMC concluded that PBNP Unit 2 had operated with one inoperable pressurizer safety valve for the past operating cycle from December 2000 to April 2002. This event was determined to be reportable both as a condition prohibited by the Technical Specification (LCO 3.4.10) and as an event or condition that resulted in an unanalyzed condition that had the potential to significantly degrade plant safety. The NRC was called with an event notification (EN# 38887) in accordance with 10 CFR 50.72(b)(3)(ii)(B) at 1626 CDT on April 30, 2002.
Cause:
The vendor has determined that the cause of this failure of a pressurizer safety valve to lift at the appropriate test pressure was due to improper reassembly of the valve following the previous valve testing in November 2000.
Following as-left set point testing of the valve, the valve is tested for seat leakage at 90% of test pressure. If the valve fails this leak test, the valve disc and nozzle are typically lapped, or polished, to remove any slight steam cutting of the valve which can occur during the lift point testing. The valve is then reassembled and leak tested again to ensure that the valve will remain leak tight following reinstallation in the plant. The lapping requires partial disassembly of the valve to separate the valve body from the bonnet. This can be accomplished without affecting the spring setting or lift set point of the valve. However, during the reassembly of the valve following the lapping in November 2000, the technician failed to ensure that the spindle and disc holder were fully engaged, leaving the spindle threads engaged in the disc holder threads (See drawing attached). This caused the actual lift point of the safety valve to exceed the allowable limits. No measurements or testing was conducted following the reassembly to ensure the valve set point was unaffected by the disassembly. The valve manufacturer has estimated that the actual lift point of the misassembled valve would have exceeded 3000 psig, rendering the valve inoperable during the past operating cycle.
The act of ensuring proper disc holder to the spindle engagement was not considered by the vendor to be a complex task or an error prone activity. The technician who preformed the testing and reassembly of this valve has had extensive experience with the testing and overhaul of these Crosby steam safety valves and other types of steam safety valves which involve similar disc holder to valve spindle configurations. Two other RCS safety valves from PBNP were tested during and prior to this spring 2002 outage. Both of those valves were successfully tested and lifted within the acceptable set-point range. The same technician had also previously overhauled these valves.
FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6 PAGE (3) Point Beach Nuclear Plant Unit 2 05000301 �
Corrective Actions:
Crane Nuclear, the valve testing and overhaul contractor, is a fully qualified 10 CFR 50 Appendix B vendor and holds National Board NR and VR stamps for testing, overhaul, and repair of safety/relief valves. Crane has concluded, based on an investigation and evaluation under their corrective action program, that this event is an isolated instance of human error involving only this valve. The vendor has worked approximately 80 similar safety valves involving this post testing assembly, including three other pressurizer safety valves from PBNP during November 2000 when this error occurred, one of which was successfully tested this spring. This is the only incidence of this assembly error identified by the vendor. Based on this investigation and the performance history of the vendor, we concluded that this is indeed an isolated incident.
Both of the Unit 1 pressurizer safety valves were removed for testing during the PBNP Unit1 Fall 2002 refueling outage.
The test results were satisfactory and confirmed that the Unit 1 valves were capable of lifting at their design pressure.
Following the identification of the cause of this valve failure to lift within its prescribed set-point range, Crane has revised their testing and overhaul procedures to require a dimensional check of the valve before and after any disassembly to perform valve lapping. The dimensional check, taken from the top of the valve spindle to the top of the adjusting nut, provides a verification that the valve has been correctly reassembled, and that the spindle threads are not engaged in the disc holder, and the spring setting adjustment bolt, which sets the valve lift point, has not been disturbed.
As discussed previously, the second inservice Unit 2 RCS safety valve was sent to the vendor for as found set point testing and found to be satisfactory. That valve has been overhauled, retested and verified dimensionally and returned to the PBNP as a spare. The previous spare valve was set point tested in January satisfactorily and required no seat lapping following the test. That valve (Serial XX059500174) is now installed as 2RC-435.
The NMC root cause evaluation was completed and concluded that the cause of the event was human error due to inattention to the job at hand. Corrective actions identified in the RCE included:
- Adding procedural guidance on the proper engagement of the disc holder to spindle,
- Adding a procedural requirement that dimensional checks be preformed pre and post lack and lap" to insure proper assembly of the disc holder to spindle, and
- Adding a required nitrogen pop test to verify valve operability post "jack and lap.
These corrective actions have been completed.
Component and System Description:
The Reactor Coolant System is protected against overpressure by safety valves located on the top of the pressurizer.
The safety valves on the pressurizer are sized to prevent system pressure from exceeding the design pressure by more than 10%, in accordance with the applicable Edition of Section III of the ASME Boiler and Pressure Vessel Code. The capacity of the pressurizer safety valves is determined from considerations of: (1) the reactor protective system, and (2) accident or transient conditions which may potentially cause overpressure. The combined capacity of the safety valves is equal to or greater than the maximum surge rate resulting from complete loss of load without a direct reactor trip or any other pressure control safety function, except that the safety valves on the secondary plant are assumed to open when the steam pressure reaches the secondary plant safety valves' set-points.
FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6 PAGE (3) Point Beach Nuclear Plant Unit 2 05000301 Each valve has a capacity of 288,000 lbsm/hr at the ASME Code allowable accumulation pressure of 103 percent of set pressure. (The required design capacity assumes the use of 2 valves for a total relief capacity of 2 x 288,000
=576,000 lbsm/hr.) The nominal 2485 psig set pressure is based on the RCS design pressure. The design capacity is based on RCS pressure not exceeding the maximum code allowable 110 percent of design pressure for the maximum calculated insurge of reactor coolant into the pressurizer. This insurge results from the plant condition where an instantaneous loss of turbine-generator load occurs with no immediate reactor trip on the turbine trip, and with no steam dump (i.e., no atmospheric or condenser steam dump). The sizing analysis also assumes continued main feedwater flow with no credit taken for primary and secondary PORVs, pressurizer level control, and pressurizer spray.
It is assumed, however, that secondary-side (main steam) safety valves operate.
Safety Assessment:
The Final Safety Analysis Report (FSAR) event that challenges the RCS pressure boundary due to pressure is the Loss of External Load event (FSAR 14.1.9). Although the Loss of Normal Feedwater (FSAR 14.1.10) and Loss of AC Power to the Station Auxiliaries (FSAR 14.1.11) do result in an increase in RCS pressure, these events are bounded by the Loss of Load event in terms of RCS pressure. There are two cases analyzed for Loss of Load event in FSAR 14.1.9.
The two cases that are analyzed consist of one case for DNB and one for RCS pressure. No credit is taken for the operation of the condenser steam dump system or steam generator PORVs. The reactor is assumed to be in manual control. No other design basis events are assumed concurrent with the loss of external load. The Loss of Load case that is analyzed for RCS pressure bounds the case analyzed for DNB with respect to the RCS pressure transient.
For the case analyzed for RCS pressure without automatic pressure control, no credit was taken for the effect of pressurizer sprays and PORVs in reducing the system pressure. This analysis assumes both pressurizer safety valves are operable and are modeled assuming a +3 percent set point tolerance and a +0.9 percent set pressure shift. In the most recently analyzed case, with an up-rated core power assumed to be 1650 MWt, the calculated peak RCS pressure is less than the Tech Spec safety limit of 2735 psig. With one safety valve inoperable, the RCS pressure would exceed the 2735 psig safety limit. However, the PORVs were determined to be available during the operating cycle. With a relief capacity for each PORV of 179,000 lbsm/hr, the availability of the PORVs would more than compensate for the 288,000 lbsm/hr relief capacity of the inoperable pressurizer safety valve over the short duration of the transient. One can therefore conclude that with two PORVs operable, the RCS Tech Spec safety limit of 2735 psig would not have been exceeded following a loss of external electrical load transient.
While performing the risk significance calculations for this issue, the PORV support systems (including instrument air, DC power, and control systems) were reviewed for their inclusion in the PRA assessment model for this condition.
During this review, the dependency of the PORVs on Instrument Air and the possible loss of Instrument Air due to a SI/Containment Isolation signal were explored. To meet the ATWS rule, the station depends upon a generic Westinghouse analysis. This analysis credits both pressurizer safety valves and pressurizer PORVs to limit the RCS pressure response within design limits. During the first part of the ATWS event, a large amount of inventory is released into containment from the PORVs and safety valves. This fluid release will exceed the capacity of the pressurizer relief tank and cause a rise in containment pressure. This pressure increase will exceed the safety injection containment isolation set point. On a containment isolation signal, the instrument air supply to the containment would be isolated.
Since the pressurizer PORVs are dependent upon instrument air, they will close soon after the containment isolation signal.
In order to assess the potential impact of the unavailability of the PORV after an ATWS transient and the failure of one of the pressurizer safety valves to lift, the NSSS vendor, Westinghouse, performed a unit and cycle specific analysis for the Loss of Normal Feedwater ATWS scenario. Three cases involving combinations of available and unavailable PORVs and safety valves were evaluated. This analysis identified that early in the fuel cycle, when the moderator FACILITY NAME (1) DOCKET NUMBER (2) � LER NUMBER (6 1 REVISION temperature coefficient (MTC) is less negative, meeting the ATWS analysis acceptance criteria of maintaining RCS pressure less than or equal to 3200 psig, requires the availability of both safety valves or one safety valve and both PORVs. After 117.6 days of the cycle, or approximately 23.8% of the cycle, the increased negative reactivity due to MTC is sufficient to limit the power excursion for the event such that the ATWS acceptance criteria can be met with only one pressurizer safety valve available. A PRA evaluation for that interval of the cycle when two safety valve were needed to be available was performed. That evaluation calculated that the change in core damage frequency (CDF) for operating with only one operable pressurizer safety valve for PBNP Unit 1 Cycle 25 was very low and would equate to a green significance on the NRC's scale. We therefore conclude that the impact on the health and safety of the public and plant staff due to this event was not significant.
This event has also been evaluated against the definition of a Safety System Functional Failure as defined in 10 CFR 50.73(a)(2)(v) and NUREG 1022. Since redundant equipment in the pressure control system, the PORVs, was operable and available to perform the required pressure control safety function and it is not necessary to assume additional random single failures in that system, the NMC has concluded that this event did not result in a safety system functional failure.
Similar Occurrences:
A review of recent LERs (past three years) identified the following event, which involved an out of tolerance safety valve setting.
LER NUMBER � Title