Resolution of Generic Safety Issues: Issue 127: Maintenance and Testing of Manual Valves in Safety-Related Systems (Rev. 1) ( NUREG-0933, Main Report with Supplements 1–35 )
In order to export or print, this web site requires you to enter text displayed in the distorted image on the left, which is known as Captcha, into the text field below the image.
DESCRIPTION
Historical Background
This issue was identified in the U.S. Nuclear Regulatory Commission (NRC) incident investigation team (IIT) report on the loss of integrated control system (ICS) power event at Rancho Seco Nuclear Generating Station (Rancho Seco) on December 26, 1985 (NUREG-1195, "Loss of Integrated Control System Power and Overcooling Transient at Rancho Seco on December 26, 1985," issued February 1986).1006 Following the event, it was requested that the adequacy of the maintenance program for manual valves be prioritized as a generic issue.1007 In addition, an information notice1008 was drafted by the staff and was later issued as IE Information Notice 86-61, "Failure of Auxiliary Feedwater Manual Isolation Valve,"1010 on July 28, 1986.
Safety Significance
In the Rancho Seco event, when power was lost to the ICS, the plant responded as designed— the auxiliary feedwater (AFW) ICS flow control valves as well as other valves went to the 50-percent open position. However, AFW flow was excessive and an unsuccessful attempt was made to manually close the flow control valve to the "A" once-through steam generator. The operator then attempted to close the manual isolation valve and failed to do so because the valve was frozen in the open position and could not be moved even when a valve wrench was used. Consequently, the inability to reduce AFW flow resulted in an overcooling event. The IIT found that the failure of the AFW manual isolation valve was the result of a lack of preventive maintenance (including lubrication) on this valve during the entire operational life of the plant (about 10 to 12 years).
The manual isolation valve is a locked-open valve located in the AFW discharge header to the "A" once-through steam generator. During the IIT investigation, a Sacramento Municipal Utility District (SMUD) representative stated that the entire AFW system, which would include this manual isolation valve, is safety-related. However, from other discussions with SMUD personnel, it appeared that this valve was only intended to be used to isolate the AFW (ICS) flow control valve for maintenance. The valve is categorized as an American Society of Mechanical Engineers (ASME) Category E valve (i.e., it is normally locked open to fulfill its function). The 1974 edition of the ASME Boiler and Pressure Vessel Code (ASME Code), Section XI, requires no regular testing of Category E valves. The position of the valves is merely recorded to verify that each valve is locked or sealed in its correct position. The current edition of the ASME Code, Section XI, no longer includes a Category E for valves.
Following the incident, it was found that licensees did not have a regular maintenance program that applies to every manual valve. The NRC did not have a requirement for maintenance and testing of convenience valves such as the locked-open manual valve involved in the Rancho Seco incident. The ASME Code, Section XI, specifies inservice inspection, testing, repair, and replacement of valves that are components in systems classified as ASME Classes 1, 2, and 3 and are required to perform a specific function in shutting down a reactor to a cold shutdown condition or in mitigating the consequences of an accident. Manual valves in safety-related systems that are classified as Quality Group A, B, or C in conformance with Regulatory Guide 1.26, "Quality Group Classifications and Standards for Water-, Steam-, and Radioactive-Waste-Containing Components of Nuclear Power Plants,"233 are constructed to ASME Code, Section III, Classes 1, 2, or 3 or to earlier codes and standards, as appropriate. These manual valves may be fill, vent, drain, or convenience valves and are constructed to the same code class as the system, or part of a system, of which they are a part. Such valves are not included in the inservice testing (IST) program for valves that are in conformance with the ASME Code, Section XI, as noted above because they are not required to change position to perform a safety function. In the event that a manual valve is required to change position to perform a safety function, it is included in the ASME Code, Section XI, IST program and classified as a safety-related valve.
At the time, the NRC requirements for valve testing were contained in Title 10 of the Code of Federal Regulations (10 CFR) 50.55(a)(g,) which incorporates the ASME Code, Section XI. Therefore, regulatory requirements for valve testing extend only to valves that are within the IST program. The quality group (safety class) and construction code of each valve are verified, and the valve category is also verified for conformance with the ASME Code, Section XI, Subsection IWV-2000. In addition, the Office of Nuclear Reactor Regulation staff performed a completeness review to assure that all appropriate valves that are within the scope of the ASME Code, Section XI, were included in the IST program. The licensees are responsible for performing the testing, repair, and maintenance of the valves that are within their IST and maintenance programs.
Possible Solutions
The two possible solutions are (1) to develop or revise regulatory requirements relating to the inspection, testing, and maintenance of those fill, vent, drain, and convenience valves in safety-related systems that do not change position for the systems to perform their safety function, or (2) to identify this as an item for which the NRC has concern, notify the licensees by an information notice, and let them determine the maintenance practices they wish to implement.
PRIORITY DETERMINATION
In December 1987, the staff assigned a LOW priority ranking to this issue because of the minimal estimated reduction in public risk resulting from the resolution of this issue. This section presents the NRC staff analysis for prioritizing this issue, which was published in 1995. This analysis, which includes frequency, consequence, and cost estimates and a value/impact assessment, has not been updated in the 2011 revision of this issue.
Frequency/Consequence Estimate
To determine the reduction in core-melt frequency that could result from improving the maintenance of manual valves, the Arkansas Nuclear One, Unit 1, Interim Reliability Evaluation Program (IREP) analysis was used.366 This plant risk study provides a very detailed list of the cutsets and component failures that could result in system unavailability.
In retrospect, the absence of any identified failure modes concerning the inability to close a manual valve is not surprising; manual valves are, for the most part, installed to permit the isolation of other components (i.e., pumps and motor-operated valves) to permit testing or maintenance without the necessity of shutting the plant down. Hence, they are generally not used for normal or planned emergency operations to control fluid flow. The principal modes of failure associated with manual valves that are identified in risk analyses are either the blockage of a valve or the failure to restore a valve to the open position after it was closed for test or maintenance. In general, most manual valves of the category being considered in this issue are locked in the open position to minimize the chances for inadvertent closure.
Another reason for not finding the failure mode for manual valves in the IREP study366 is that credit was not given for unplanned recovery actions. Planned operations, as used in this report, include both normal and emergency operations that are directed by procedures. Hence, valve use as was attempted at Rancho Seco would be considered an unplanned recovery event.
Last, the expected frequency of any identified cutsets in which the failure mode included the failure to close a manual valve may have been less than the selected cutoff or truncation value. Considering the failure combinations necessary to involve a manual valve, such may be the case.
It should not be concluded that there is no contribution to core melt and risk by failures that prevent the closure of manual valves (as was the case in the Rancho Seco event) because of their absence from available risk studies or probabilistic risk assessments (PRAs).
As is evident from the Rancho Seco event, the inability to close a manual isolation valve contributed in part to an overcooling event. However, it is probably justifiable to conclude that the inability to close a manual valve contributes only a small amount (i.e., less than 10-6) to core melt and hence to risk. Due to the lack of any identifiable failure or fault combinations in the PRAs, there is no practical basis on which to quantify in this limited analysis the contribution to core melt and risk resulting from these valve failures.
Cost Estimate
Industry Cost: Approximately 100 manual isolation valves of the ASME Class of the AFW manual isolation valves were identified by SMUD that did not receive periodic preventive maintenance. One valve manufacturer recommends lubrication checks at 6-month intervals and actuations (if only partial) on a monthly basis. It is estimated that 4 man-hours will be expended annually per valve performing preventive maintenance and actuation. Assuming that 100 valves are involved, 400 man-hours will be expended each year at each reactor maintaining this class of manual valves. At $35/hour for maintenance personnel,1009 the direct maintenance cost amounts to $14,000 per reactor-year (RY). In addition, assuming that 20 hours/RY of additional supervisory time at $45/hour will be directed toward added valve maintenance results in $900 of increased costs. Further, assuming an added $100 for additional administrative costs, the total cost for added valve maintenance will be $15,000/RY. Assuming a 30-year plant life and a 5-percent discount rate, the lifetime plant costs associated with the added maintenance of manual valves would be approximately $230,000.
NRC Cost : The NRC cost is estimated to be similar to that incurred in processing a multiplant action per NUREG-0737, "Clarification of TMI Action Plan Requirements," issued November 198098: $6,000).1009
Value/Impact Assessment
Due to the inability to ascertain the expected reduction in public risk, the staff did not calculate a value/impact score; however, the risk from this issue was judged to be very low.
Other Considerations
Due to the low costs associated with maintaining the manual isolation valves, it would appear to be cost effective for plant operators to maintain them as a good practice without a regulatory requirement. The power replacement cost for one day of plant outage that may result from the inability to isolate would pay the plant life costs for isolation valve maintenance. In view of this cost-saving potential, the release of the information notice may resolve this issue.
CONCLUSION
The NRC staff conducted a review of this issue in 2010 to determine whether any new information would necessitate reassessment of the original prioritization evaluation.1964 The staff determined that the existing regulations and guidance adequately address this issue and the operating experience has not indicated a change in the significance of this issue. The following discussion demonstrates the application of the NRC regulatory framework to this issue.
As published in 1991, paragraphs (a) and (b) of the Maintenance Rule (10 CFR 50.65, "Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," state the following:
a)(1) Each holder of an operating license for a nuclear power plant under this part and each holder of a combined license under part 52 of this chapter after the Commission makes the finding under § 52.103(g) of this chapter, shall monitor the performance or condition of structures, systems, or components, against licensee-established goals, in a manner sufficient to provide reasonable assurance that these structures, systems, and components, as defined in paragraph (b) of this section, are capable of fulfilling their intended functions. These goals shall be established commensurate with safety and, where practical, take into account industrywide operating experience. When the performance or condition of a structure, system, or component does not meet established goals, appropriate corrective action shall be taken. For a nuclear power plant for which the licensee has submitted the certifications specified in § 50.82(a)(1) or 52.110(a)(1) of this chapter, as applicable, this section shall only apply to the extent that the licensee shall monitor the performance or condition of all structures, systems, or components associated with the storage, control, and maintenance of spent fuel in a safe condition, in a manner sufficient to provide reasonable assurance that these structures, systems, and components are capable of fulfilling their intended functions….
(b) The scope of the monitoring program specified in paragraph (a)(1) of this section shall include safety related and nonsafety related structures, systems, and components, as follows:
(1) Safety-related structures, systems and components that are relied upon to remain functional during and following design basis events to ensure the integrity of the reactor coolant pressure boundary, the capability to shut down the reactor and maintain it in a safe shutdown condition, or the capability to prevent or mitigate the consequences of accidents that could result in potential offsite exposure comparable to the guidelines in Sec. 50.34(a)(1), Sec. 50.67(b)(2), or Sec. 100.11 of this chapter, as applicable.
(2) Nonsafety related structures, systems, or components:
(i) That are relied upon to mitigate accidents or transients or are used in plant emergency operating procedures (EOPs); or
(ii) Whose failure could prevent safety-related structures, systems, and components from fulfilling their safety-related function; or
(iii) Whose failure could cause a reactor scram or actuation of a safety-related system.
The regulations at 10 CFR 50.65(b)(2)(i) and (b)(2)(ii) address the event presented in this generic issue and, as demonstrated above with applicable operating experience, has addressed similar subsequent events. Moreover, the Standard Review Plan11 (NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition") was revised in 2007 to include Section 17.6, "Maintenance Rule," which outlines the criteria for evaluating licensee applications for the scope, monitoring, evaluation, and risk assessment and management of implementing 10 CFR 50.65, including Section III, 1.B, which outlines the criteria for including nonsafety-related structures, systems, and components (SSCs) in accordance with 10 CFR 50.65(b)(2). Criterion iii of this section applies directly to this generic issue, stating that the description of the maintenance rule scoping process should address the following:
SSCs whose failure could prevent safety-related SSCs from fulfilling their safety-related functions in accordance with 50.65(b)(2)(ii). The applicant should describe how the process considers system interdependencies, including failure modes and effects of nonsafety-related SSCs (e.g., support systems) that could directly affect safety-related functions.
Based on the review of the NRC’s regulations and guidance related to this issue, the staff concluded that existing regulations and guidance adequately address this issue. Therefore, the staff changed the status of Generic Issue 127 and DROPPED this issue from further pursuit.
REFERENCES
|
