05000250/LER-2008-003

From kanterella
Jump to navigation Jump to search
LER-2008-003, Inoperable Steam Generator Blowdown Containment Isolation Valve in Excess of Technical Specification Required Isolation Time-Supplement
Docket Number
Event date: 06-01-2008
Report date: 08-11-2009
Reporting criterion: 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat
2502008003R01 - NRC Website
v • d • e

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3)

A. INITIAL CONDITIONS

On June 1, 2008, Turkey Point Unit 3 was in Mode 1 and operating at 100% Reactor Power.

B. DESCRIPTION OF EVENT

On June 1, 2008, the accumulator check valve for the 3C Steam Generator (SG) [AB:sg] blowdown containment isolation valve [WI:CJ:cv], CV-3-6275C, was being tested using procedure 3-OSP-200.3, Secondary Plant Periodic Tests, Section 7.21.7, Test Accumulator Check Valve for CV-3-6275C. [The accumulator for CV-3-6275C is in the valve actuator, as presented in the functional diagram in the attached Figure 1.] As part of the test procedure, instrument air was isolated and pressure was bled upstream of the actuator check valves. After a period of 10 minutes, the valve was signaled to close by de-energizing the solenoid valve, SV-3-6275C.

At approximately 1844, it was identified in the Operating Logs that during the performance of the surveillance testing, the 3C Steam Generator (SG) blowdown containment isolation valve CV-3-6275C failed to close. Instrument air was restored to the valve, Condition Report (CR) 2008-18474 was initiated to document the unsatisfactory accumulator check valve test and a work request was generated to repair the condition which caused the failure.

The SG blowdown system is described in the Updated Final Safety Analysis Report (UFSAR) in section 10.2.4.3:

A steam generator blowdown recovery system is installed to assist in maintaining required steam generator water chemistry by providing a means for removal of foreign matter which concentrates in the evaporator section of the steam generator. The system is fed by three independent blowdown lines (one per SG) which tie into a common blowdown flash tank. The steam generator blowdown is continuously monitored for radioactivity during plant operation. A radiation monitor is provided for the steam generator blowdown sample lines in each unit. The blowdown sample lines can be isolated using the manual isolation valves downstream of the motor operated isolation valves. The SG Blowdown Isolation By-pass valves have their operators removed and are maintained in a permanently closed position. This design maintains containment integrity and prevents a loss of SG inventory after an auxiliary feedwater system start.

Containment isolation is described in Section 6.6 of the UFSAR. Table 6.6-1 of the UFSAR indicates that for valve CV-3-6275C Notes 23 and 26 apply. Note 23 of Table 6.6-1 states that "These valves are secondary system barriers. Where applicable, they are subject to secondary system/component requirements. Testing and leak tightness of these valves are not required for the LOCA events for which containment isolation is needed." Note 26 states: "Valves CV-*6275A, CV-*6275B, CV-*6275C "fail-as-is" on loss of instrument air and "fail-closed" on loss of electrical power.

The safety related functions of CV-3-6275C are to:

  • Prevent unrestricted release of radioactivity from the containment to the outside environment following a LOCA.

DOCKETFACILITY NAME (1) LER NUMBER (6) PAGE (3)NUMBER (2) 2008 - 01

The steam generator blowdown system is not explicitly addressed in the Technical Specifications (TS).

Because these valves are listed in UFSAR Table 6.6-1 as containment isolation valves, and because they receive a (Phase A) containment isolation signal, these valves are subject to the requirements of TS 3.6.4.

The Turkey Point TS 3.6.4 states in part that:

Each containment isolation valve shall be OPERABLE with isolation times less than or equal to required isolation times.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTION:

With one or more isolation valves inoperable, maintain at least one isolation valve OPERABLE in each affected penetration that is open and either:

a. Restore the inoperable valve(s) to OPERABLE status within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, or b. Isolate each affected penetration within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> by use of at least one deactivated automatic containment isolation valve secured in the isolation position, or c. Isolate each affected penetration within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> by use of at least one closed manual valve or blind flange, or d. Be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

On June 9, 2008, the technical evaluation screening performed on CR 2008-18474 identified that CV- 3-6275C should have been declared inoperable because it would no longer be able to perform its safety related containment isolation function (the valve's accumulator and associated check valves perform the safety related function to close the valve).

At 1700, Operations declared CV-3-6275C inoperable and entered TS 3.6.4. At 1807, Operations promptly isolated the penetration and met the TS 3.6.4.c action requirements within the four hour required isolation time. A night order was issued to increase Operations awareness of this event.

Troubleshooting discovered that CV-3-6275C failed to close due to a small instrument air leak on the inlet swage fitting (Figure 1) upstream of the solenoid valve SV-3-6275C. The slow instrument leak at the fitting allowed the 3-way pilot valves to move to an intermediate position that bled some of the accumulator volume. It was determined that the small air leak was due to the time related work hardening of the tubing from vibration, which had loosened the fitting connection.

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) The failure investigation indicated that there was no indication of degradation or out of service condition that would have resulted in a loss of instrument air during the period of concern. Only the function of the air accumulator for CV-3-6275C to serve as backup to the instrument air was adversely affected by the identified air leak. On June 10, 2008, the air leak was corrected. On June 11, 2008 at 0037, CV-3-6275C was tested satisfactorily. At 0106, Operations declared the valve operable and exited the Technical Specification TS 3.6.4 Action c.

During the preparation of the Licensee Event Report (LER) supplement, additional review of the Turkey Point Units 3 and 4 Operator logs identified that the effects of the inoperable SG blowdown isolation valve, on June 9, 2008, created a condition for 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and 37 minutes, which could have prevented the fulfillment of the valve's safety function to support SG pressure integrity during plant transients that require Auxiliary Feedwater (AFW) system operation.

Reportability Turkey Point Unit 3 was operating in a condition prohibited by TS from the time CV-3-6275C failed to close (failed to meet its safety related containment isolation function) during the performance of its surveillance test on June 1, 2008, until June 9, 2008, when action was taken to comply with TS 3.6.4 action requirements. This event is reportable in accordance with 10 CFR 50.73 (a)(2)(i)(B) as any operation or condition which is prohibited by Technical Specifications. This event had no corresponding 10 CFR 50.72 immediate reporting requirements.

This event is also reportable under 10 CFR 50.73(a)(2)(v)(B) and (D) as an event or condition that could have prevented fulfillment of a safety function for removing residual heat and/or mitigate the consequences of an accident.

C. EVENT ANALYSIS

Design Change The original design of the SG Blowdown Isolation Valves was to "fail-close" on a loss of instrument air.

The valve design did not include a check valve upstream of the solenoid valve. Accordingly, on a loss of instrument air, the 3-way selector valve would actuate and close the valve. On July 20, 1982, the Nuclear Regulatory Commission (NRC) issued Information Notice (IN) 82-25 describing concerns pertaining to Hiller actuators that could be prevented from going to their fail-safe position on a slow loss of instrument air. It was noted that in the event of a slow loss of instrument air, the selector valve will bleed the accumulator air to the atmosphere rather than to the actuator cylinder, thus prohibiting the valve from going to its fail-safe, i.e., "fail-close" position.

In response to the concerns of NRC IN 82-25, Turkey Point modified the valve accumulator design and added a check valve upstream of the solenoid valve in the instrument air supply tubing to the solenoid valve (Figure 1). The effect of this modification was to change the failure position to "fail-as-is" on a loss of instrument air. This added check valve allows the accumulator to remain pressurized by preventing the pilot operated 3-way valves from moving to an intermediate position and avoid bleeding the accumulator to atmosphere on a slow loss of instrument air.

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) Since the instrument air is considered the non-safety related source of power, the accumulator became the safety related source of power to close the SG blowdown isolation valve. The motive force to close the valve is the stored pneumatic pressure in the valve's accumulator. The design modification did not identify the need to periodically test the safety related function of the accumulator.

The testing criteria for the valve to meet its mission statement, Post Maintenance Testing (PMT), and its periodic testing to verify maintenance of the accumulator volume were not established as part of the design modification.

Not determining the volume needed for the valve to meet its mission statement and not designing the accumulator to that volume, resulted in a design with erroneous assumptions regarding the ability of the accumulator to store pneumatic pressure for an undefined time without leaks.

Surveillance Testing In 1988, the NRC issued Generic Letter (GL) 88-14, Instrument Air Supply System Problems Affecting Safety-Related Equipment, which required verification that maintenance practices, emergency procedures, training and design of the entire instrument air system, including air operated valves or other pneumatic accumulators could perform their safety-related function on a loss of instrument air.

During the GL 88-14 plant evaluation, it was identified that there were no testing requirements verifying the functionality of the accumulator check valve of the SG blowdown isolation valves. At that time a procedural change was initiated to have a surveillance added to 3/4-0SP-200.3, Secondary Plant Periodic Tests. The accumulator function with the loss of instrument air was not tested as part of the Inservice Testing (1ST) program since the SG blowdown valves were designated "fail-as-is" on loss of instrument air testing.

The intent of the accumulator check valve test was simply to validate that upon a loss of instrument air the valve will "fail-as-is" proving that the check valve did not leakby, permitting the pilot operated 3-way valves to actuate and close the blowdown isolation valve. Operators would signal the valve to close after 10 minutes, demonstrating that there is enough air in the accumulator to close the valve. On a test failure, the test procedure requires operations to ensure a work order is generated to repair or replace the accumulator check valve. However, the surveillance testing procedure did not include sufficient guidance or references to any TS requirements for declaring the SG blowdown valve inoperable upon test failure.

The incorrect and incomplete procedure provided the wrong mindset for evaluating the test failure and questioning the valve's operability during the initial screening of the test failure. As a result, operators did not recognize that upon a loss of instrument air, the accumulator assumes the safety function, by providing the closing force for the valve, and that the failure of the accumulator rendered the SG blowdown isolation valve inoperable.

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) Turkey Point Unit 3 05000250 Impact on Auxiliary Feedwater System Operation An additional impact attributable to the inoperability of CV-3-6275C during the period from June 1 to June 9, 2008 (period of TS 3.6.4 non compliance) is the effect on SG pressure boundary integrity during plant transients requiring AFW system operation to support decay heat removal.

The limiting events described in the Turkey UFSAR Chapter 14 accident analyses for which the AFW system is directly relied upon to remove core residual heat following a reactor trip are the Loss of Normal Feedwater (LONF) and the Loss of Non-Emergency AC Power to Plant Auxiliaries (LOAC) events. As described in the UFSAR, the accident analyses demonstrate that following a LONF or LOAC, the AFW system is capable of removing residual and decay heat from the core, thus preventing primary and secondary system over-pressurization, pressurizer overfilling, and core uncovery.

At Turkey Point, there are three turbine driven AFW pumps with the steam supply and pump discharge flow paths divided into two independent trains that are shared between Units 3 and 4. A single AFW pump is sized to provide adequate flow to satisfy the minimum AFW flow requirements for the limiting LONF and LOAC events. Thus each of the two AFW trains must have at least one associated operable AFW pump to be considered operable [normal alignment for Train 2 is with two AFW pumps].

The second operable AFW train and associated pump is required to satisfy the single active failure criterion. The third operable pump provides additional assurance of AFW system availability.

The SG blowdown valve CV-3-6275C is credited in the accident analyses for the LONF and LOAC events to isolate the 3C SG blowdown line on a containment isolation signal or on AFW pump automatic start signal. A failure of the valve to close on an AFW pump start signal could reduce AFW system performance, and potentially reduce the capacity of the available AFW pumps to below the minimum values credited in the accident analyses and could have prevented the fulfillment of the valve's safety function to support steam generator pressure integrity during the limiting plant transients that require AFW system operation.

During the preparation of the LER supplement, a review of the Unit 3 and Unit 4 Operator logs was conducted for the period from 1844 on June 1, 2008, until 1807 hours0.0209 days <br />0.502 hours <br />0.00299 weeks <br />6.875635e-4 months <br /> on June 9, 2008, and found that on June 9, 2008, Train 2 of AFW for Units 3 and 4 was taken out of service at 1130 hours0.0131 days <br />0.314 hours <br />0.00187 weeks <br />4.29965e-4 months <br /> and 1246 hours0.0144 days <br />0.346 hours <br />0.00206 weeks <br />4.74103e-4 months <br />, respectively for surveillance testing. This resulted in having two AFW pumps being out of service concurrent with the SG blowdown valve CV-3-6275C being inoperable, for a period of approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and 37 minutes on June 9, 2008. As such, the AFW system could not be relied upon to satisfy the minimum flow requirements for fulfillment of its post accident safety function to prevent RCS over-pressurization and limit peak clad temperatures.

A calculation was performed for this LER supplement to determine the minimum AFW flow required for the limiting LONF and LOAC events assuming one SG blowdown valve was inoperable and could not be isolated. It was determined that the capacity of two AFW pumps would be required for the limiting LONF and LOAC events to satisfy the residual and decay heat removal requirements and to accommodate the leakage from one unisolated SG blowdown valve. To prevent having two AFW pumps being out of service concurrent with SG blowdown valve being inoperable, procedures have been revised to require a minimum of two AFW pumps to be operable during the SG blowdown isolation valve surveillance testing.

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3)

D. ROOT CAUSE

The root cause of the event is a latent design omission. The design process should have identified the need to periodically test the accumulator's safety related function to close the valve without the availability of instrument air. Not determining the volume needed for the valve to meet its mission statement and designing the accumulator to that volume is considered a latent design omission.

Inadequate procedural testing and inadequate procedural guidance are contributing factors for this event.

E. CORRECTIVE ACTIONS

Corrective actions included:

  • Discovered and repaired the small instrument air leak that caused the test failure.
  • Provided communications to Operations regarding the significance of the safety related function of the accumulator and the impact it had in rendering a containment isolation valve inoperable.
  • Incorporated the SG blowdown accumulator check valve surveillance in the In-Service Testing program and provided TS references and appropriate guidance to identify required action upon test failure.
  • A valve design modification is being processed to improve the isolation capability on loss of instrument air.
  • Procedures have been revised to require a minimum of two AFW pumps to be operable during the SG blowdown isolation valve surveillance testing.

F. SAFETY ASSESSMENT

The SG blowdown loops are classified as closed systems inside the containment. The CV-3-6275C Phase A containment isolation function is classified as a secondary barrier for 3C SG blowdown loop penetration isolation. The primary isolation barrier for the 3C SG blowdown loop penetration is the associated closed system inside the containment, which was unaffected by the identified condition.

Since the closed system inside the containment for the 3C SG blowdown is a passive isolation barrier, it would have prevented releases from containment during accident conditions. Based on an intact passive primary barrier remaining available, the safety significance of the identified condition is considered low. In addition, manual isolation capability still existed, and procedural direction was provided (and continues to be provided) for manual isolation of the 3C SG blowdown penetration as an alternative.

The failure of CV-3-6275C to close is the same failure that is assumed in the Turkey Point Probabilistic Risk Assessment (PRA) model. The risk significance of the failure was evaluated using this model.

The increase in Core Damage Probability (CDP) for a period of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and 37 minutes is 5.0E-11.

The increase in Large Early Release Probability (LERP) for a period of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and 37 minutes is 2.8E-11. Both of these risk measures are well below the Significance Determination Process (SDP) thresholds for risk significance of 1E-06 for an increase in CDP and 1E-07 for an increase in LERP.

DOCKETFACILITY NAME (1) LER NUMBER (6) PAGE (3)NUMBER (2) Based on the above, the risk significance of the identified condition is considered low. This event did not compromise the health and safety of plant personnel and of the general public.

G. ADDITIONAL INFORMATION

  • The condition reports for this event are 2008-18474, 2008-24596, and 2009-2551.
  • EIIS codes are shown in the format [EIIS SYSTEM: IEEE Component function identifier, second component function identifier (if applicable)].

H. SIMILAR EVENTS

  • No similar events were found for the past two years.

FACILITY NAME (1)

DO KET

LER NUMBER (6) Figure 1 CV-3-6275C Functional Diagram Check Valve installed by Design Modification Location of Small Instrument Air Leak Solenoid Valve SV-3-6275C SV shown in energized state Accumulator 1 1 � Bottom Cylinder 3-way valve Plot operated CV-3-6275C retracted (valve open) F LT/

REG

3-40- 708C

Retrieved from "https://kanterella.com/w/index.php?title=05000250/LER-2008-003&oldid=200273"