Near-Miss Summary
The Near-Miss
The Nuclear Regulatory Commission (NRC) sent special inspection teams to the Perry Nuclear Power Plant in Perry, Ohio and to the Edwin I. Hatch Nuclear Plant near Baxley, Georgia early this year. Both plants feature boiling water reactors (BWRs) and both experienced problems with safety relief valves that prompted the NRC’s reactions.
Eleven SRVs opened at Perry when they should not have while three SRVs failed to close at Hatch when they should have. The NRC’s special inspection team identified two green findings (the least severe in the green, white, yellow and red hierarchy) in the Perry event and none from the Hatch event.
How the Perry Event Unfolded
Perry was operating at full power on February 8, 2016, when 13 of the 19 safety relief valves (SRVs) opened at 3:00 pm for no apparent reason. Eleven SRVs reclosed almost immediately while two SRVs remained open. Steam flowed through the open SRVs from the reactor vessel to the suppression chamber. The water inside the suppression chamber cooled the steam, turning it back into water. The suppression chamber water temperature, initially at 79°F, increased rapidly. The operators manually scrammed the reactor three minutes later when the suppression chamber water temperature reached 95°F. Rapid insertion of control rods into the reactor core stopped the nuclear chain reaction. The pressure inside the reactor vessel dropped as the reactor’s shutdown significantly reduced the amount of steam being produced. The remaining two SRVs reclosed when the reactor vessel pressure decreased.
Fig. 1 (Source: Nuclear Regulatory Commission)
Perry has four large-diameter pipes connected to the reactor vessel that transport steam through the containment wall into the adjacent turbine building. While the graphic only shows 11 SRVs, Perry has 19 SRVs somewhat equally installed on the four steam pipes.
Fig. 2 (Source: Nuclear Regulatory Commission)
Safety Relief Valve design and operation
Each SRV contains a large metal spring that keeps the valve closed even though steam at nearly 1,020 pounds per square inch pressure flowing through the pipes tries to push the valve open. But should the pressure increase about 10 percent above normal, the spring force is overcome and the SRV opens to allow steam to flow through a pipe down into the suppression chamber. The spring force recloses the SRV when the pressure drops low enough.
Each SRV is also equipped with a solenoid valve that can be automatically or manually opened to admit nitrogen gas that overcomes the spring force and opens the SRV. Closing the solenoid valve stops the flow of nitrogen gas and the spring force recloses the SRV (if the pressure inside the steam pipe is low enough).
False signal
The post-event evaluation concluded that a false indication of high pressure inside the reactor vessel resulted in a signal being sent to 18 SRVs to open. The false indication was so brief (lasting only about 0.09 seconds) that the signal “cleared” before 5 SRVs had time to open. 11 of the 13 SRVs that did open almost immediately reclosed.
The two SRVs remained open because they were designed to stay open. To protect against SRVs simmering (opening and closing repeatedly) some of the SRVs are designed to remain open until the reactor vessel pressure has decreased substantially below the pressure setpoint for opening SRVs. After 11 SRVs reclosed, the reactor vessel pressure stabilized at close to normal operating pressure. This was to be expected for the steam flowing through the two SRVs merely represented steam “robbed” from flow to the main turbine. After the reactor’s shutdown, the reactor vessel pressure dropped low enough for these final two SRVs to reclose.
The false indication of high pressure was attributed to a gas bubble in the instrumentation used to determine the water level inside the reactor vessel. The reactor vessel water level is not directly measured, but is inferred from the differential pressure between two columns of water. The reference column, or leg, is filled with water while the variable leg’s level changes as the water level inside the reactor vessel increases and decreases. While not shown in the graphic, the level instrumentation has a connection supplying a constant flow of water (about 0.08 gallons per minute) to keep the reference leg filled.
Fig. 3 (Source: Nuclear Regulatory Commission)
When Perry was shut down on April 14, 2015, during its most recent refueling outage, workers connected nitrogen gas to the lines that supply makeup water to the reference legs. These lines are equipped with check valves that open to allow flow to the reference legs but automatically close to prevent flow from the reference legs. Workers used nitrogen gas to verify that the check valves functioned properly. During this test, unexpected alarms sounded in the control room including one that falsely indicated that water level in the reactor vessel was too low. These alarms were attributed to pressure fluctuations in the level instrumentation legs caused by the nitrogen gas applied during the test. A work order was initiated to vent the legs and fill them with water. But when workers performed this work on April 18, 2015, the procedures they used did not include any steps to vent and fill the reference legs.
Gas left in the instrumentation system after the April 14, 2015, test is believed to have bubbled to the surface of the condensing chamber at 3:00 pm on February 8, 2016, to cause a momentarily indication of high pressure inside the reactor vessel.
The NRC’s special inspection team assigned one green finding for the inadequate procedures that failed to properly vent and fill the water level instrumentation reference legs.
How a water level leg anomaly triggered a pressure spike
Although not shown in the graphic, the connection between the reactor vessel and the condensing chamber also has a pressure sensor on it. Multi-tasking this connection reduces the number of holes cut in the reactor vessel, helping to minimize the chances of a pipe rupture.
Operating procedure glitch
The NRC’s special inspection team learned that the operators manually scrammed the reactor when the suppression pool temperature reached 95°F because a “hard card” (a single page of warnings posted in the control room) directed them to do so. The NRC’s team learned that this hard card had not been reviewed as required by station procedures prior to being posted and contradicted other operating procedures that had been properly reviewed and approved. For example, Emergency Operating Procedure 2 (EOP-2, “Primary Containment Control”) guide the operators through steps to handle multiple open SRVs. Should these steps prove unsuccessful, EOP-2 directs the operators to manually scram the reactor when the suppression pool temperature reaches 110°F. But properly reviewed and approved EOP-2 is not entered and used until suppression pool temperature exceeds 95°F, whereas the improperly reviewed and approved hard card trumped the right response. The NRC’s team assigned one green finding for improper issuance and use of the hard card.
Safety analyses
The NRC’s special inspection team found that the safety studies summarized in the Updated Final Safety Analysis Report (UFSAR) for Perry included the inadvertent opening of a single SRV that stuck open, but had not considered multiple inadvertent openings as happened on February 8. But other scenarios summarized in the UFSAR, such as the closure of the main steam isolation valves in all four steam lines, bounded the load on the suppression pool from this event.
Suppression pool temperature rise
The NRC’s special inspection team found that the plant’s operating procedures included a rule of thumb for estimating how rapidly the suppression pool water would heat up: 3°F per minute per open SRV. During the February 8 event, the suppression pool water heated up at about 5.3°F per minute; reasonably close to the 6°F per minute rate forecast by the rule of thumb for two open SRVs. When this event was recreated on the Perry control room simulator, the suppression pool water heated up at about 3.7°F per minute.
How the Hatch Event Unfolded
In late March 2016, workers conducted a test to determine when the SRVs for the Unit 1 reactor would open. The safety studies assume that the SRVs open at certain pressures and the reactor’s operating license specifies minimum and maximum opening pressures. The workers were testing the SRVs to verify they opened within the allowable ranges established in the operating license.
The good news is that all 11 SRVs passed the opening test.
The bad news is that 3 SRVs failed to reclose.
The operators had shut down the Unit 1 reactor on February 8, 2016, to enter its 27th refueling outage. During the refueling outage, workers removed all 11 SRVs and shipped them offsite to a testing laboratory. Workers installed different SRVs because the laboratory would not test and return the other SRVs before the scheduled end of the outage. The operators restarted Unit 1 on March 4, 2016, to begin its 28th operating cycle.
On March 30, 2016, two SRVs failed to reclose after successfully opening within the allowable pressure range. The following day, a third SRV failed to reclose after its successful opening test.
Fig. 4 (Source: Nuclear Regulatory Commission)
Workers disassembled the SRVs and discovered some of the internal parts damaged. The damage prevented the valves from reclosing during the test. The NRC’s special inspection team concluded that the damage was most likely inflicted by the test itself.
Prior to the test, workers installed a metal plate (called a “flow gag”) on the outlet side of the SRV. This plate restricted the rate at which steam flowed through the SRV. The primary purpose for the flow gag was to maintain a constant inlet steam pressure, since it is the parameter being tested. A secondary purpose of the flow gag was to limit the amount of radioactive material blown out of potentially contaminated SRVs. The undesired consequences from the flow gag were larger forces on the SRV’s internal parts, making them vulnerable to damage.
Operability determinations for Unit1 and 2
The damaged SRVs were no longer installed in the Unit 1 reactor and could not possibly undermine safety levels. But the replacement SRVs on Unit 1 and the SRVs on Unit 2 had been tested using flow gags and therefore might be damaged to the point where their reclosing was uncertain.
The company performed an evaluation, confirmed by the NRC’s special inspection team, that concluded the SRVs are unlikely to become damaged by opening/closing when installed at the plant because of lesser forces on internal components without the flow gag’s effect. In addition, the evaluation concluded that the SRVs, even with damaged internal parts, would most likely reclose if opened at the plant due to increased steam flow through ungagged discharge portals.
The company elected to shut down Unit 2 on May 20, 2016, to replace all 11 SRVs and inspect the removed SRVs for signs of damage inflicted during past testing. The operators restarted Unit 2 on May 25.
The NRC’s special inspection team reported that NRC staff within the Component Performance, Non-Destructive Examination, and Testing branch within the Office of Nuclear Reactor Regulation will raise the testing method that damages SRVs during the next meeting of the ASME Code Committee.
NRC Sanctions
The NRC identified two violations, both characterized as green (the least severe in the green, white, yellow, and red classification scheme) from the February 8, 2016, SRV event at Perry.
The NRC found no violations from the March 2016 SRV event at Hatch.
UCS Perspective
The NRC’s announcements it was dispatching special inspection teams to Perry and then Hatch due to SRV problems certainly drew my attention. SRV problems factored significantly in another BWR (Pilgrim) working its way clear over into Column 4 of the NRC’s Action Matrix. The SRV events at Perry and Hatch might portend either a broadening BWR affliction or more volunteers proposing to pursue Pilgrim’s path.
But the NRC’s special inspection teams convincingly distinguished the SRV events at Perry and Hatch from those at Pilgrim. True, the SRV event at Perry could have been avoided had better procedures and work control practices been in place just as better procedures and work control practices could have avoided at least one and perhaps both of the SRV events at Pilgrim. But the deficiencies at Perry did not adversely affect safety margins while they did undermine safety margins at Pilgrim. I cannot say whether it’s like the difference between a misdemeanor and a felony, but it’s certainly a difference between Column 1 and Column 4 of the NRC’s Action Matrix.
Both of the NRC special inspection teams conducted thorough inquiries. At Perry, the NRC’s team determined that the operating procedures improperly had the operators manually scram the reactor when the suppression pool water temperature reached 95°F. The NRC’s team cited another procedure that could have allowed the temperature to reach 110°F before manually scramming the reactor. Sooner rather than later seems, on its surface, to be the better option. But the NRC’s team clearly established that the 110°F limit was solidly backed by rigorous science whereas the 95°F limit was essentially pulled from the air. The NRC’s team was right in judging surer to beat sooner.
At Hatch, the NRC’s team verified that a problem found on SRVs at an offsite testing facility did not also afflict SRVs installed on two operating reactors.
SRV events occurred at Pilgrim, Perry, and Hatch in the past three years. Pilgrim is in Column 4 of the Action Matrix while Perry and Hatch are in Column 1. I’d say that the NRC is three for three in scoring SRV events. It’d be nicer if they did not get to practice so often, but until then I hope the NRC sustains its winning streak.