United States Nuclear Regulatory Commission - Protecting People and the Environment


ACCESSION #:  9708210028

                       LICENSEE EVENT REPORT (LER)



FACILITY NAME: San Onofre Nuclear Generating Station      PAGE: 1 OF 9

               Unit 2



DOCKET NUMBER:  05000361



TITLE:  Charging Subsystem Check Valve Failure



EVENT DATE:  06/26/97   LER #:  97-010-01   REPORT DATE:  08/13/97



OTHER FACILITIES INVOLVED:  Unit 3                  DOCKET NO:  05000362



OPERATING MODE:  1   POWER LEVEL:  100



THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR

SECTION:

50.73(a)(2)(i), 50.73(a)(2)(vii), & Other: Part 21



LICENSEE CONTACT FOR THIS LER:

NAME:  R.W. Krieger, Vice President,        TELEPHONE:  (714) 368-6255

       Nuclear Generation



COMPONENT FAILURE DESCRIPTION:

CAUSE:  B   SYSTEM:  CV   COMPONENT:  V    MANUFACTURER:  K085

REPORTABLE NPRDS:



SUPPLEMENTAL REPORT EXPECTED:  NO



ABSTRACT:



On 6/26/97 while Unit 3 was shutdown for refueling, an investigation of

the cause of high auxiliary spray flow found a check valve in the

Charging Subsystem that would not open completely.  This would cause the

charging flow distribution to the Reactor Coolant System to be different

than that assumed in the safety analysis.  Because of the similarity of

the Unit 2 Charging Subsystem, Edison immediately entered the Technical

Specification action statement for one or more trains of Emergency Core

Cooling System (ECCS) inoperable, but 100 percent of the ECCS equivalent

flow to a single operable ECCS train available.  As a conservative

action, Edison also reduced Unit 2's power to about 90 percent, where

charging flow is not required for accident mitigation.  On 6/28/97,

Edison tested Unit 2 and found that a similar check valve also would not

open completely.  As required by the Technical Specifications, Edison

shutdown Unit 2 to repair the valve.  Completion of that shutdown is

being reported as required by 10CFR50.73(a)(2)(i).  Because this valve

failure was caused by a design defect, Edison is including 10CFR21

information in this report.



Edison replaced the faulty design valves in the charging injection lines

and auxiliary spray line in each unit with another type valve.  Edison's

evaluation of the cause(s) is on-going.  This LER will be revised if the

evaluation determines a cause other than faulty design.



The 1979 computer model requires charging system flow for mitigation of

some small break loss of coolant accidents.  However, this model assumes

plant conditions that are not allowed by the Technical Specifications.

Using an EPRI analysis program and actual, allowed, plant parameters,

Edison concluded that the condition resulted in a negligible increase in

plant risk and had no actual safety significance.



END OF ABSTRACT



NOTE:     This text document was processed from a scanned

          version or an electronic submittal and has been

          processed as received.  Some tables, figures,

          strikeouts, redlines, and enclosures may not have

          been included with this submittal, or have been

          omitted due to ASCII text conversion limitations.  In

          order to view this document in its entirety, you may

          wish to use the NUDOCS microfiche in addition to the

          electronic text.



TEXT                                                          PAGE 2 OF 9



Plant:              San Onofre Nuclear Generating Station, Units 2 and 3

Reactor Vendor:     Combustion Engineering

Event Date:         June 26, 1997

Event Time:         1413 PDT



               Unit 2                             Unit 3

Mode:          Mode 1 (Power operation)           Mode 5 (Cold shutdown)

Power:         100 percent                        000 percent

Temperature:   NOT                                93 degrees F

Pressure:      NOP                                Atmospheric



PURPOSE:



This LER reports Edison's discovery of a design defect in Kerotest [K085]

2 inch Y-type Series 1513 check valves [V].  This design defect was not

known by the vendor and caused two check valves (one in each unit) in the

Charging Subsystem [CV] to be able to open only a small fraction of their

full stroke.  This increased flow resistance and caused the charging flow

distribution to the Reactor Coolant System (RCS) [AB] to be different

than that assumed in the safety analysis.



As discussed below, to resolve this issue, Edison:



o    Proactively evaluated vendor supplied valve information to determine

     the impact on the charging subsystem and is continuing its

     evaluation of the design defect.



o    Immediately discussed the issue with the NRC Staff.

o    Tested both units to determine the impact on actual plant

     operations.

o    Shut down Unit 2 and delayed startup of Unit 3 to effect system

     repairs.

o    Identified and is correcting deficiencies in the In-Service Testing

     (IST) and Technical Specification (TS) Surveillance Requirements

     (SR) testing which prevented earlier detection.



Because Edison determined that the valve failure was caused by a design

defect, 10CFR21 information is being included in this report.



BACKGROUND:



The Charging Subsystem (Figure 1) is part of the Chemical and Volume

Control System (CVCS) [CB].  During normal plant transients, the CVCS

maintains RCS inventory.  Following a Safety Injection Actuation Signal

(SIAS), charging is used to supplement the Emergency Core Cooling System

(ECCS) flow.



The three charging pumps (Train A, Train B, and a swing pump) discharge

to a common header.  A single line from the header enters containment and

splits into three lines; one charging line to each of RCS loops 1A and

2A, and one auxiliary pressurizer spray line.  Each charging line has a

check valve (2(3)MU020 and 2(3)MU021) and a normally open motor operated

block valve.  The auxiliary spray line has a check valve (2(3)MU019) and

a normally closed motor operated block valve.  These check valves isolate

the RCS from the CVCS in the event of a pipe break in the CVCS or when

charging is not running.



The limiting licensing basis Small Break Loss of Coolant Accident

(SBLOCA) assumes only one charging pump is providing flow, and that the

flow from only one charging line is discharged into the RCS (see the

Safety Significance section, below).  To maintain these two assumptions,

the flow through the two charging lines must be balanced (at least 15.8

gpm per line with one pump operating).



TEXT                                                          PAGE 3 OF 9



DESCRIPTION OF CONDITION:



On 6/19/97, while bringing Unit 3 to Mode 6, RCS pressure control did not

respond as the operators [utility, licensed] expected.  When auxiliary

spray valve 3HV9201 was opened with both charging injection valves

3HV9202 and 3HV9203 open, the operators expected to be able to maintain

pressure.  However, RCS pressure started to decrease.  Engineering's

investigation determined that, while fewer pressurizer heaters were

available than in previous cycles, the available heaters were operating

as expected, and should have been adequate to control pressure.  However,

auxiliary spray flow appeared to be higher than expected.  Increased

auxiliary spray flow would likely be caused by the flow resistance of the

two parallel charging lines being higher than expected.  The result would

be some charging flow would be diverted into the auxiliary spray line.



One immediate difference between the two charging lines was check valves

3MU020 and 3MU021.  3MU020 was the originally installed Kerotest valve,

while 3MU021 was a Kerotest redesigned equivalent replacement valve.

Based on vendor supplied design information, Edison decided the higher

resistance was caused by 3MU020 having a significantly higher cracking

pressure (pressure required to open the valve from its closed position)

than 3MU021.  (This Kerotest information was later found to be incorrect.

See the Additional Information section, below.) With a single charging

pump running, 3MU020 was postulated not to open.  All charging flow would

be divided between one charging line and auxiliary spray.



At the time of discovery (1413 on 6/26/97), Unit 2 was in Mode 1, power

operation, at 100 percent power.  Unit 3 was in Mode 5, cold shutdown,

for refueling.



Realizing that unbalanced charging flow did not satisfy the assumptions

of the licensing basis SBLOCA analysis and that Unit 2 had the same valve

types, Edison immediately:



1.   Entered Unit 2 into Condition A of TS 3.5.2.  See the Technical

     Specifications and Additional Information sections, below.



2.   Conservatively reduced Unit 2 to about 90 percent power.  At this

     power level, charging flow is not required to mitigate the

     consequences of a SBLOCA.  Additional information regarding the

     power reduction to 90 percent is provided in the Safety Significance

     section, below.



On 6/27/97, while attempting to measure and then balance the charging

flow distribution in Unit 3, Edison discovered that the increased flow

resistance was actually caused by 3MU021 not opening completely.  Edison

immediately tested Unit 2 and found that 2MU021 also would not open

completely.  on 6/29/97 at 1102 PDT, in anticipation of entering

Condition B of TS 3.5.2, Edison began to shutdown Unit 2 to repair

2MU021.  A 1-hour telephone report was made as required by

10CFR50.72(b)(1)(i) (NRC Operations Log #32545).  Completion of that

shutdown is being reported here as required by 10CFR50.73(a)(2)(i).



TECHNICAL SPECIFICATIONS:



TS Limiting Condition for Operation (LCO) 3.5.2, ECCS-Operating, requires

two operable trains of ECCS in Modes 1 and 2, and in Mode 3 whenever the

pressurizer pressure is greater than or equal to 400 psia.  If one or

more trains are inoperable, but at least 100 percent of the ECCS flow

equivalent to a single operable ECCS train is available, Condition A

requires the inoperable train(s) be restored to operable within 72 hours.

If that action is not met, Condition B requires the unit be in Mode 3

within 6 hours and pressurizer pressure reduced to less than 400 psia

within 12 hours.



The Bases of TS 3.5.2 describes an ECCS train as a train of high pressure

safety injection (HPSI) [BQ], a train of low pressure safety injection

(LPSI) [BP], and a



TEXT                                                          PAGE 4 OF 9



train of the Charging Subsystem.  A charging train consists of a charging

pump with the capability of taking suction from the refueling water

storage tank or the boric acid makeup tank, and a flow path to the RCS

via the normal charging lines.  Due to the single containment

penetration, the two normal charging lines are common to both Train A and

Train B.



CAUSE:



While Edison's evaluation of the valve failures is on-going, the limited

travel of the piston assembly of 2(3)MU021 is believed to be caused by a

faulty design of the new style disc assembly.  This LER will be revised

if the evaluation determines a cause other than faulty design.



CORRECTIVE ACTIONS:



With the assistance of the valve vendor, Edison attempted to repair

2MU021 with a redesigned piston assembly with a longer length-to-diameter

ratio.  However, the valve still failed to open properly.



2(3)MU019 and 2(3)MU021 were replaced with 2 inch Borg-Warner "Y" type

lift check valves, either Mark #558 or #559.  These valves are used

successfully in similar applications at another nuclear unit.  The

hydraulic parameters of the Borg Warner valves for 2(3)MU021 were

verified to be similar to 2(3)MU020.  Also, the charging line flows were

balanced by throttling HV9203 before returning the unit to service.



SAFETY SIGNIFICANCE:



In 1979, Combustion Engineering's (CE) SBLOCA calculations predicted fuel

cladding temperature would exceed 10CFR50.46 limits (2200 degrees F) for

three break sizes (0.025 sq.  ft., 0.05 sq.  ft., and 0.075 sq.  ft.)

without crediting charging flow.  In response, the NRC approved analysis

credits 15.8 gpm charging flow to supplement HPSI flow, and complies with

10CFR50.46.



For larger breaks (0.1 sq.  ft.  and 1.0 sq.  ft.), charging flow is not

required because RCS depressurization is rapid enough that HPSI alone can

provide sufficient ECCS flow prior to initiation of safety injection tank

(SIT) flow.  SIT flow rapidly refloods the core and maintains cladding

temperatures well below 2200 degrees F.  For smaller breaks (0.01 sq.

ft.), break flow is low enough that HPSI alone is sufficient to limit or

even prevent core uncovery and maintain acceptable cladding temperatures.



The 1979 SBLOCA analysis results are overly conservative because:



o    The computer model uses a positive moderator temperature coefficient

     (MTC) even though TS 3.1.4 prohibits a positive MTC above 70 percent

     power.  A non-positive MTC would decrease or eliminate the

     calculated power increase at the start of the transient.  This would

     result in a faster depressurization, earlier reactor trip and SIAS

     on low pressure, and less RCS inventory lost.



o    The computer model uses 15.0 kW/ft for the peak linear heat

     generation rate (PLHGR) even though TS 3.2.1 limits PLHGR to 13.0

     kW/ft.  Using the lower value in the hot rod heatup analysis would

     result in a lower calculated peak cladding temperature.



o    The SBLOCA methodology itself contains additional conservatisms.

     ABB-CE has submitted for NRC approval an improved SBLOCA model which

     will demonstrate that charging is not required at San Onofre to

     mitigate the consequences of any SBLOCA.  (Reference letter, C.  B.

     Brinkman, ABB-CE, to NRC, Revision to Small Break LOCA Evaluation

     Model, CENPD-137, Supplement 2-P, May 23, 1996.



TEXT                                                          PAGE 5 OF 9



Best estimate LOCA analyses performed for Edison's PRA/IPE using EPRI's

Modular Accident Analysis Program (MAAP) code indicate that one train of

ECCS without charging will maintain peak cladding temperatures below 1500

degrees F.



Therefore, while the current computer model predicts unacceptable results

for some SBLOCA sizes without charging flow, Edison concludes that

2(3)MU021 not completely opening resulted in a negligible increase in

plant risk and had no actual safety significance.



ADDITIONAL INFORMATION:



Different Valve Designs:



2(3)MU019, 2(3)MU020, and 2(3)MU021 originally installed in both units

were 2 inch Kerotest Y-type Series 1513 valves (See Figure 2).  In 1985,

2MU021 was replaced and, because the original style valve was no longer

available, Edison used a redesigned series 1513 valve recommended by the

vendor (See Figure 3).  3MU021 and 2(3)MU019 were similarly replaced with

the new style valve.



During the investigation of the high auxiliary spray flow, Edison

obtained design information from Kerotest, including details of the

valves' closing springs.  Based on that information, Edison concluded

that the cracking pressures for the old and new style valves were 20 psid

and 2.5 psid, respectively.  If valves with different cracking pressures

are used in parallel flow paths, a flow imbalance can be created in low

flow conditions (i.e., when the valves are not fully open).  Because the

SBLOCA analysis assumes balanced flow and low flow (one pump running),

Edison concluded this was a condition that alone could have prevented the

fulfillment of a safety function required to mitigate the consequences of

an accident.  A 4-hour telephone report was made on 6/26/97 at 1803 PDT,

as required by 10CFR50.72(b)(2)(iii) (NRC Log #32545).



On 7/14/97, while continuing the review of this event, Edison noticed

that the vendor-supplied design information was incorrect.  The cracking

pressure for the old style valve was re-calculated to be about 3.0 psid,

essentially the same as the new style.  Edison concluded that the

as-designed and built charging design did comply with the licensing basis

of the SBLOCA analysis.  Therefore, this was not a condition that alone

could have prevented the fulfillment of a safety function required to

mitigate the consequences of an accident and Edison is retracting the

4-hour report made on 6/26/97 (NRC Operations Log #32545).



Generic implications:



Edison reviewed other uses of the new style Kerotest check valves in the

plants.  Seventeen safety related applications have been identified.

Fifteen of these, ranging in size from 1/2 inch to 1 inch, provide

pressure boundary isolation functions only and have no forward flow

safety function.  Their failure to open would not prevent the fulfillment

of any safety function.  The observed failures of the new style check

valve did not prevent the valves from closing.



There are two similar 2 inch check valves, 3MU067 and 2MU017, which have

a forward flow safety function (see Figure 4).  The use of these valves

in the charging pump discharge piping has been evaluated as acceptable

for the following reasons:



o    The application is in a single line so that a failure to open

     completely does not affect the flow distribution in the charging

     system.



o    The valves have been and continue to be tested quarterly by the IST

     Program.  Both valves have passed their IST by passing full flow at

     normal pump discharge pressure.  One of these valves (3MU067) has

     been in service since 1987 without incident.  Some seat back leakage

     has been observed.  This is acceptable



TEXT                                                          PAGE 6 OF 9



     because the back flow requirement is to assist in isolating the

     charging pump for on-line maintenance and does not affect charging

     pump operation.



o    The charging pumps are positive displacement pumps and will deliver

     their required flow up to the piping system's relief valve set point

     (2735 psig).  The observed check valve failures were the valves not

     opening enough to maintain balanced flow.  If these valves failed to

     fully open (as 2(3)MU021 failed), the affected pump would still have

     adequate pressure margin to deliver full flow (about 40 gpm) through

     the partially open valve.  In addition, in the SBLOCA analysis which

     credits charging flow, the RCS pressure is substantially below

     normal operating pressure, providing additional pressure margin.



o    The charging pumps themselves are protected from overpressure by a

     relief valve in the unlikely event these valves should fail to open.

     The resultant low charging system flow alarm would immediately alert

     plant operators in the control room.  Excessive discharge pressure

     is also indicated in the control room.



o    These two valves will be replaced during the next unit outage of

     sufficient duration, currently expected to be the scheduled

     mid-cycle outages.



Entry into TS 3.5.2 Condition A:



On 6/26/97, Edison management was briefed on the status of the charging

subsystem check valves and the impact on the plant.  At that meeting,

Edison management concluded that only one train of charging was

inoperable (cognitive personnel error) and that entry into TS 3.5.2

Condition A was the appropriate action.  That action was taken at 1413

PDT that day.  The following day, operations determined that, due to the

balanced flow requirement, both trains of charging should have been

declared inoperable.  Nevertheless, because the TS 3.5.2 Condition A

applies for one or two trains of ECCS inoperable, the actions already

taken by Operations were in compliance with the TS and no further actions

were required.



To ensure a correct understanding of TS 3.5.2, Edison will clarify its

Bases to address charging flow considerations and will review this

information with appropriate personnel.



Preoperational Testing, Technical Specification Surveillance Requirements

and In-Service Testing Program: It is not known when the check valves

first failed to open.



During preoperational testing in the early 1980s, the minimum charging

pump flow was verified.  However, the flow split between the two charging

lines was determined by analysis only, and was never tested.  The flow

split would be tested only if design changes were made to the lines which

would alter the flow split.  Because the replacement of MU021 was with a

"like-for-like" valve, the flow distribution was not tested at that time.



The surveillance requirements of TS 3.5.2 specifies the correct positions

and surveillance frequency of numerous ECCS valves.  Although not

specifically named, HV9202 and HV9203 are included in TS SR 3.5.2.3,

which verifies that "each ECCS manual, power operated, and automatic

valve ...  is in the correct position." MU020 and MU021 have no specific

TS SR requirements, and there is no specific SR in section 3.5.2 for the

charging flow split.  However, the Bases section does identify the

charging flow commitment of 44 percent of 36.2 gpm (15.9 gpm) to each

line.



TS 3.1.9, Boration Systems - Operating, requires two RCS boron injection

flow paths (one path via the charging system and one path via the HPSI

header) to be operable, primarily for shutdown margin (SDM)

considerations.  TS SR 3.1.9.3 requires that each boration flow path be

verified operable each 31 days.  Although Edison had been



TEXT                                                          PAGE 7 OF 9



complying with the literal requirements of TS SR 3.1.9.3 for a boration

flow path, the TS SR did not ensure that the required ECCS flow balance

was maintained.  One of



these two SR sections (3.5.2 or 3.1.9) should include verification that

each charging line is operable.



TS SR 3.5.2.6 requires each charging pump develop at least 40 gpm.  The

IST program performs this test.  Because the two parallel flow paths are

tested together during the pump IST, a closed check valve in one line

could not cause a test failure (opening the pump discharge safety valve

thereby reducing charging flow).  The test for the open function does not

specify the differential pressure for developing the acceptance flow.

Because the charging pumps are positive displacement pumps and the

testing is normally completed at an RCS pressure of 350 psia, adequate

pump discharge pressure (up to the discharge safety valve set point) is

available to pass the acceptance flow through a partially open valve.



The IST Program and TS SR procedure will be revised to ensure these check

valves operate as intended and that the charging line is operable.



Similar previously reported conditions:



In the past three years, Edison has not reported the failure of an ECCS

system because of the failure of a single component or component design

change.



Figure 1 "Charging Subsystem:" omitted.



TEXT                                                          PAGE 8 OF 9



Figure 2 "Original Style Check Valve:" omitted.



Figure 3 "New Style Check Valve:" omitted.



TEXT                                                          PAGE 9 OF 9



Figure 4  "Charging Pump Diagram (typical of each unit):" omitted.



*** END OF DOCUMENT ***





Page Last Reviewed/Updated Thursday, March 29, 2012