Part 21 Report - 1997-631

ACCESSION #: 9708210028 LICENSEE EVENT REPORT (LER) FACILITY NAME: San Onofre Nuclear Generating Station PAGE: 1 OF 9 Unit 2 DOCKET NUMBER: 05000361 TITLE: Charging Subsystem Check Valve Failure EVENT DATE: 06/26/97 LER #: 97-010-01 REPORT DATE: 08/13/97 OTHER FACILITIES INVOLVED: Unit 3 DOCKET NO: 05000362 OPERATING MODE: 1 POWER LEVEL: 100 THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR SECTION: 50.73(a)(2)(i), 50.73(a)(2)(vii), & Other: Part 21 LICENSEE CONTACT FOR THIS LER: NAME: R.W. Krieger, Vice President, TELEPHONE: (714) 368-6255 Nuclear Generation COMPONENT FAILURE DESCRIPTION: CAUSE: B SYSTEM: CV COMPONENT: V MANUFACTURER: K085 REPORTABLE NPRDS: SUPPLEMENTAL REPORT EXPECTED: NO ABSTRACT: On 6/26/97 while Unit 3 was shutdown for refueling, an investigation of the cause of high auxiliary spray flow found a check valve in the Charging Subsystem that would not open completely. This would cause the charging flow distribution to the Reactor Coolant System to be different than that assumed in the safety analysis. Because of the similarity of the Unit 2 Charging Subsystem, Edison immediately entered the Technical Specification action statement for one or more trains of Emergency Core Cooling System (ECCS) inoperable, but 100 percent of the ECCS equivalent flow to a single operable ECCS train available. As a conservative action, Edison also reduced Unit 2's power to about 90 percent, where charging flow is not required for accident mitigation. On 6/28/97, Edison tested Unit 2 and found that a similar check valve also would not open completely. As required by the Technical Specifications, Edison shutdown Unit 2 to repair the valve. Completion of that shutdown is being reported as required by 10CFR50.73(a)(2)(i). Because this valve failure was caused by a design defect, Edison is including 10CFR21 information in this report. Edison replaced the faulty design valves in the charging injection lines and auxiliary spray line in each unit with another type valve. Edison's evaluation of the cause(s) is on-going. This LER will be revised if the evaluation determines a cause other than faulty design. The 1979 computer model requires charging system flow for mitigation of some small break loss of coolant accidents. However, this model assumes plant conditions that are not allowed by the Technical Specifications. Using an EPRI analysis program and actual, allowed, plant parameters, Edison concluded that the condition resulted in a negligible increase in plant risk and had no actual safety significance. END OF ABSTRACT NOTE: This text document was processed from a scanned version or an electronic submittal and has been processed as received. Some tables, figures, strikeouts, redlines, and enclosures may not have been included with this submittal, or have been omitted due to ASCII text conversion limitations. In order to view this document in its entirety, you may wish to use the NUDOCS microfiche in addition to the electronic text. TEXT PAGE 2 OF 9 Plant: San Onofre Nuclear Generating Station, Units 2 and 3 Reactor Vendor: Combustion Engineering Event Date: June 26, 1997 Event Time: 1413 PDT Unit 2 Unit 3 Mode: Mode 1 (Power operation) Mode 5 (Cold shutdown) Power: 100 percent 000 percent Temperature: NOT 93 degrees F Pressure: NOP Atmospheric PURPOSE: This LER reports Edison's discovery of a design defect in Kerotest [K085] 2 inch Y-type Series 1513 check valves [V]. This design defect was not known by the vendor and caused two check valves (one in each unit) in the Charging Subsystem [CV] to be able to open only a small fraction of their full stroke. This increased flow resistance and caused the charging flow distribution to the Reactor Coolant System (RCS) [AB] to be different than that assumed in the safety analysis. As discussed below, to resolve this issue, Edison: o Proactively evaluated vendor supplied valve information to determine the impact on the charging subsystem and is continuing its evaluation of the design defect. o Immediately discussed the issue with the NRC Staff. o Tested both units to determine the impact on actual plant operations. o Shut down Unit 2 and delayed startup of Unit 3 to effect system repairs. o Identified and is correcting deficiencies in the In-Service Testing (IST) and Technical Specification (TS) Surveillance Requirements (SR) testing which prevented earlier detection. Because Edison determined that the valve failure was caused by a design defect, 10CFR21 information is being included in this report. BACKGROUND: The Charging Subsystem (Figure 1) is part of the Chemical and Volume Control System (CVCS) [CB]. During normal plant transients, the CVCS maintains RCS inventory. Following a Safety Injection Actuation Signal (SIAS), charging is used to supplement the Emergency Core Cooling System (ECCS) flow. The three charging pumps (Train A, Train B, and a swing pump) discharge to a common header. A single line from the header enters containment and splits into three lines; one charging line to each of RCS loops 1A and 2A, and one auxiliary pressurizer spray line. Each charging line has a check valve (2(3)MU020 and 2(3)MU021) and a normally open motor operated block valve. The auxiliary spray line has a check valve (2(3)MU019) and a normally closed motor operated block valve. These check valves isolate the RCS from the CVCS in the event of a pipe break in the CVCS or when charging is not running. The limiting licensing basis Small Break Loss of Coolant Accident (SBLOCA) assumes only one charging pump is providing flow, and that the flow from only one charging line is discharged into the RCS (see the Safety Significance section, below). To maintain these two assumptions, the flow through the two charging lines must be balanced (at least 15.8 gpm per line with one pump operating). TEXT PAGE 3 OF 9 DESCRIPTION OF CONDITION: On 6/19/97, while bringing Unit 3 to Mode 6, RCS pressure control did not respond as the operators [utility, licensed] expected. When auxiliary spray valve 3HV9201 was opened with both charging injection valves 3HV9202 and 3HV9203 open, the operators expected to be able to maintain pressure. However, RCS pressure started to decrease. Engineering's investigation determined that, while fewer pressurizer heaters were available than in previous cycles, the available heaters were operating as expected, and should have been adequate to control pressure. However, auxiliary spray flow appeared to be higher than expected. Increased auxiliary spray flow would likely be caused by the flow resistance of the two parallel charging lines being higher than expected. The result would be some charging flow would be diverted into the auxiliary spray line. One immediate difference between the two charging lines was check valves 3MU020 and 3MU021. 3MU020 was the originally installed Kerotest valve, while 3MU021 was a Kerotest redesigned equivalent replacement valve. Based on vendor supplied design information, Edison decided the higher resistance was caused by 3MU020 having a significantly higher cracking pressure (pressure required to open the valve from its closed position) than 3MU021. (This Kerotest information was later found to be incorrect. See the Additional Information section, below.) With a single charging pump running, 3MU020 was postulated not to open. All charging flow would be divided between one charging line and auxiliary spray. At the time of discovery (1413 on 6/26/97), Unit 2 was in Mode 1, power operation, at 100 percent power. Unit 3 was in Mode 5, cold shutdown, for refueling. Realizing that unbalanced charging flow did not satisfy the assumptions of the licensing basis SBLOCA analysis and that Unit 2 had the same valve types, Edison immediately: 1. Entered Unit 2 into Condition A of TS 3.5.2. See the Technical Specifications and Additional Information sections, below. 2. Conservatively reduced Unit 2 to about 90 percent power. At this power level, charging flow is not required to mitigate the consequences of a SBLOCA. Additional information regarding the power reduction to 90 percent is provided in the Safety Significance section, below. On 6/27/97, while attempting to measure and then balance the charging flow distribution in Unit 3, Edison discovered that the increased flow resistance was actually caused by 3MU021 not opening completely. Edison immediately tested Unit 2 and found that 2MU021 also would not open completely. on 6/29/97 at 1102 PDT, in anticipation of entering Condition B of TS 3.5.2, Edison began to shutdown Unit 2 to repair 2MU021. A 1-hour telephone report was made as required by 10CFR50.72(b)(1)(i) (NRC Operations Log #32545). Completion of that shutdown is being reported here as required by 10CFR50.73(a)(2)(i). TECHNICAL SPECIFICATIONS: TS Limiting Condition for Operation (LCO) 3.5.2, ECCS-Operating, requires two operable trains of ECCS in Modes 1 and 2, and in Mode 3 whenever the pressurizer pressure is greater than or equal to 400 psia. If one or more trains are inoperable, but at least 100 percent of the ECCS flow equivalent to a single operable ECCS train is available, Condition A requires the inoperable train(s) be restored to operable within 72 hours. If that action is not met, Condition B requires the unit be in Mode 3 within 6 hours and pressurizer pressure reduced to less than 400 psia within 12 hours. The Bases of TS 3.5.2 describes an ECCS train as a train of high pressure safety injection (HPSI) [BQ], a train of low pressure safety injection (LPSI) [BP], and a TEXT PAGE 4 OF 9 train of the Charging Subsystem. A charging train consists of a charging pump with the capability of taking suction from the refueling water storage tank or the boric acid makeup tank, and a flow path to the RCS via the normal charging lines. Due to the single containment penetration, the two normal charging lines are common to both Train A and Train B. CAUSE: While Edison's evaluation of the valve failures is on-going, the limited travel of the piston assembly of 2(3)MU021 is believed to be caused by a faulty design of the new style disc assembly. This LER will be revised if the evaluation determines a cause other than faulty design. CORRECTIVE ACTIONS: With the assistance of the valve vendor, Edison attempted to repair 2MU021 with a redesigned piston assembly with a longer length-to-diameter ratio. However, the valve still failed to open properly. 2(3)MU019 and 2(3)MU021 were replaced with 2 inch Borg-Warner "Y" type lift check valves, either Mark #558 or #559. These valves are used successfully in similar applications at another nuclear unit. The hydraulic parameters of the Borg Warner valves for 2(3)MU021 were verified to be similar to 2(3)MU020. Also, the charging line flows were balanced by throttling HV9203 before returning the unit to service. SAFETY SIGNIFICANCE: In 1979, Combustion Engineering's (CE) SBLOCA calculations predicted fuel cladding temperature would exceed 10CFR50.46 limits (2200 degrees F) for three break sizes (0.025 sq. ft., 0.05 sq. ft., and 0.075 sq. ft.) without crediting charging flow. In response, the NRC approved analysis credits 15.8 gpm charging flow to supplement HPSI flow, and complies with 10CFR50.46. For larger breaks (0.1 sq. ft. and 1.0 sq. ft.), charging flow is not required because RCS depressurization is rapid enough that HPSI alone can provide sufficient ECCS flow prior to initiation of safety injection tank (SIT) flow. SIT flow rapidly refloods the core and maintains cladding temperatures well below 2200 degrees F. For smaller breaks (0.01 sq. ft.), break flow is low enough that HPSI alone is sufficient to limit or even prevent core uncovery and maintain acceptable cladding temperatures. The 1979 SBLOCA analysis results are overly conservative because: o The computer model uses a positive moderator temperature coefficient (MTC) even though TS 3.1.4 prohibits a positive MTC above 70 percent power. A non-positive MTC would decrease or eliminate the calculated power increase at the start of the transient. This would result in a faster depressurization, earlier reactor trip and SIAS on low pressure, and less RCS inventory lost. o The computer model uses 15.0 kW/ft for the peak linear heat generation rate (PLHGR) even though TS 3.2.1 limits PLHGR to 13.0 kW/ft. Using the lower value in the hot rod heatup analysis would result in a lower calculated peak cladding temperature. o The SBLOCA methodology itself contains additional conservatisms. ABB-CE has submitted for NRC approval an improved SBLOCA model which will demonstrate that charging is not required at San Onofre to mitigate the consequences of any SBLOCA. (Reference letter, C. B. Brinkman, ABB-CE, to NRC, Revision to Small Break LOCA Evaluation Model, CENPD-137, Supplement 2-P, May 23, 1996. TEXT PAGE 5 OF 9 Best estimate LOCA analyses performed for Edison's PRA/IPE using EPRI's Modular Accident Analysis Program (MAAP) code indicate that one train of ECCS without charging will maintain peak cladding temperatures below 1500 degrees F. Therefore, while the current computer model predicts unacceptable results for some SBLOCA sizes without charging flow, Edison concludes that 2(3)MU021 not completely opening resulted in a negligible increase in plant risk and had no actual safety significance. ADDITIONAL INFORMATION: Different Valve Designs: 2(3)MU019, 2(3)MU020, and 2(3)MU021 originally installed in both units were 2 inch Kerotest Y-type Series 1513 valves (See Figure 2). In 1985, 2MU021 was replaced and, because the original style valve was no longer available, Edison used a redesigned series 1513 valve recommended by the vendor (See Figure 3). 3MU021 and 2(3)MU019 were similarly replaced with the new style valve. During the investigation of the high auxiliary spray flow, Edison obtained design information from Kerotest, including details of the valves' closing springs. Based on that information, Edison concluded that the cracking pressures for the old and new style valves were 20 psid and 2.5 psid, respectively. If valves with different cracking pressures are used in parallel flow paths, a flow imbalance can be created in low flow conditions (i.e., when the valves are not fully open). Because the SBLOCA analysis assumes balanced flow and low flow (one pump running), Edison concluded this was a condition that alone could have prevented the fulfillment of a safety function required to mitigate the consequences of an accident. A 4-hour telephone report was made on 6/26/97 at 1803 PDT, as required by 10CFR50.72(b)(2)(iii) (NRC Log #32545). On 7/14/97, while continuing the review of this event, Edison noticed that the vendor-supplied design information was incorrect. The cracking pressure for the old style valve was re-calculated to be about 3.0 psid, essentially the same as the new style. Edison concluded that the as-designed and built charging design did comply with the licensing basis of the SBLOCA analysis. Therefore, this was not a condition that alone could have prevented the fulfillment of a safety function required to mitigate the consequences of an accident and Edison is retracting the 4-hour report made on 6/26/97 (NRC Operations Log #32545). Generic implications: Edison reviewed other uses of the new style Kerotest check valves in the plants. Seventeen safety related applications have been identified. Fifteen of these, ranging in size from 1/2 inch to 1 inch, provide pressure boundary isolation functions only and have no forward flow safety function. Their failure to open would not prevent the fulfillment of any safety function. The observed failures of the new style check valve did not prevent the valves from closing. There are two similar 2 inch check valves, 3MU067 and 2MU017, which have a forward flow safety function (see Figure 4). The use of these valves in the charging pump discharge piping has been evaluated as acceptable for the following reasons: o The application is in a single line so that a failure to open completely does not affect the flow distribution in the charging system. o The valves have been and continue to be tested quarterly by the IST Program. Both valves have passed their IST by passing full flow at normal pump discharge pressure. One of these valves (3MU067) has been in service since 1987 without incident. Some seat back leakage has been observed. This is acceptable TEXT PAGE 6 OF 9 because the back flow requirement is to assist in isolating the charging pump for on-line maintenance and does not affect charging pump operation. o The charging pumps are positive displacement pumps and will deliver their required flow up to the piping system's relief valve set point (2735 psig). The observed check valve failures were the valves not opening enough to maintain balanced flow. If these valves failed to fully open (as 2(3)MU021 failed), the affected pump would still have adequate pressure margin to deliver full flow (about 40 gpm) through the partially open valve. In addition, in the SBLOCA analysis which credits charging flow, the RCS pressure is substantially below normal operating pressure, providing additional pressure margin. o The charging pumps themselves are protected from overpressure by a relief valve in the unlikely event these valves should fail to open. The resultant low charging system flow alarm would immediately alert plant operators in the control room. Excessive discharge pressure is also indicated in the control room. o These two valves will be replaced during the next unit outage of sufficient duration, currently expected to be the scheduled mid-cycle outages. Entry into TS 3.5.2 Condition A: On 6/26/97, Edison management was briefed on the status of the charging subsystem check valves and the impact on the plant. At that meeting, Edison management concluded that only one train of charging was inoperable (cognitive personnel error) and that entry into TS 3.5.2 Condition A was the appropriate action. That action was taken at 1413 PDT that day. The following day, operations determined that, due to the balanced flow requirement, both trains of charging should have been declared inoperable. Nevertheless, because the TS 3.5.2 Condition A applies for one or two trains of ECCS inoperable, the actions already taken by Operations were in compliance with the TS and no further actions were required. To ensure a correct understanding of TS 3.5.2, Edison will clarify its Bases to address charging flow considerations and will review this information with appropriate personnel. Preoperational Testing, Technical Specification Surveillance Requirements and In-Service Testing Program: It is not known when the check valves first failed to open. During preoperational testing in the early 1980s, the minimum charging pump flow was verified. However, the flow split between the two charging lines was determined by analysis only, and was never tested. The flow split would be tested only if design changes were made to the lines which would alter the flow split. Because the replacement of MU021 was with a "like-for-like" valve, the flow distribution was not tested at that time. The surveillance requirements of TS 3.5.2 specifies the correct positions and surveillance frequency of numerous ECCS valves. Although not specifically named, HV9202 and HV9203 are included in TS SR 3.5.2.3, which verifies that "each ECCS manual, power operated, and automatic valve ... is in the correct position." MU020 and MU021 have no specific TS SR requirements, and there is no specific SR in section 3.5.2 for the charging flow split. However, the Bases section does identify the charging flow commitment of 44 percent of 36.2 gpm (15.9 gpm) to each line. TS 3.1.9, Boration Systems - Operating, requires two RCS boron injection flow paths (one path via the charging system and one path via the HPSI header) to be operable, primarily for shutdown margin (SDM) considerations. TS SR 3.1.9.3 requires that each boration flow path be verified operable each 31 days. Although Edison had been TEXT PAGE 7 OF 9 complying with the literal requirements of TS SR 3.1.9.3 for a boration flow path, the TS SR did not ensure that the required ECCS flow balance was maintained. One of these two SR sections (3.5.2 or 3.1.9) should include verification that each charging line is operable. TS SR 3.5.2.6 requires each charging pump develop at least 40 gpm. The IST program performs this test. Because the two parallel flow paths are tested together during the pump IST, a closed check valve in one line could not cause a test failure (opening the pump discharge safety valve thereby reducing charging flow). The test for the open function does not specify the differential pressure for developing the acceptance flow. Because the charging pumps are positive displacement pumps and the testing is normally completed at an RCS pressure of 350 psia, adequate pump discharge pressure (up to the discharge safety valve set point) is available to pass the acceptance flow through a partially open valve. The IST Program and TS SR procedure will be revised to ensure these check valves operate as intended and that the charging line is operable. Similar previously reported conditions: In the past three years, Edison has not reported the failure of an ECCS system because of the failure of a single component or component design change. Figure 1 "Charging Subsystem:" omitted. TEXT PAGE 8 OF 9 Figure 2 "Original Style Check Valve:" omitted. Figure 3 "New Style Check Valve:" omitted. TEXT PAGE 9 OF 9 Figure 4 "Charging Pump Diagram (typical of each unit):" omitted. *** END OF DOCUMENT ***

Page Last Reviewed/Updated Tuesday, March 09, 2021