05000259/LER-2012-006

LER-2012-006, High Pressure Coolant Injection System Turbine Failed to Trip Using the Manual Trip Pushbutton

Docket Numbersequential Revmonth Day Year Year Month Day Yearnumber No. N/A 05000
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident
2592012006R02 - NRC Website

I. PLANT CONDITION(S)

At the time of the event, Browns Ferry Nuclear Plant (BFN), Unit 1, was in Mode 1 at approximately 100 percent rated thermal power.

II. DESCRIPTION OF EVENT

A. Event

On April 19, 2012, at approximately 1117 hours0.0129 days <br />0.31 hours <br />0.00185 weeks <br />4.250185e-4 months <br /> Central Daylight Time (CDT), the BFN, Unit 1, High Pressure Coolant Injection (HPCI) [BJ] System was declared inoperable for the performance of surveillance procedure 1-SR-3.5.1.7, HPCI Main and Booster Pump Set Developed Head and Flow Rate Test at Rated Reactor Pressure. During the prerequisite steps of surveillance procedure 1-SR-3.5.1.7, the HPCI turbine stop valve [FCV] 1-FCV-073-0018 was tested and performed as expected. On April 19, 2012, at approximately 1430 hours0.0166 days <br />0.397 hours <br />0.00236 weeks <br />5.44115e-4 months <br /> CDT, at the end of the HPCI pump run for surveillance procedure 1-SR-3.5.1.7, while attempting to trip the HPCI turbine using the manual trip pushbutton 1-HS-073-0018A, the HPCI turbine failed to trip. The manual trip pushbutton 1-HS-073-0018A was pressed four times with no results. Pressing the manual trip pushbutton should have resulted in the closure of the HPCI turbine stop valve 1-FCV-073-0018. As a result of the failure, the capability of electrical and mechanical automatic and manual trip functions of the HPCI System was lost. The HPCI turbine was stopped by securing the HPCI steam supply with the closure of the HPCI turbine steam admission valve 1-FCV-073-0016.

The HPCI turbine stop valve was inoperable until April 24, 2012, when work order 113426235 was performed to rebuild the valve using a different valve disc and cover and post maintenance testing was completed.

B. Inoperable. Structures, Components, or Systems that Contributed to the Event The inoperable component that contributed to this event was the HPCI turbine stop valve 1-FCV-073-0018.

C. Dates and Approximate Times of Major Occurrences April 19, 2012, at 1117 hours0.0129 days <br />0.31 hours <br />0.00185 weeks <br />4.250185e-4 months <br /> CDT The HPCI System was declared inoperable for performance of surveillance procedure 1-SR-3.5.1.7.

April 19, 2012, at 1430 hours0.0166 days <br />0.397 hours <br />0.00236 weeks <br />5.44115e-4 months <br /> CDT During the performance of surveillance procedure 1-SR-3.5.1.7, the HPCI turbine stop valve did not close when the manual trip pushbutton was pressed four times.

April 24, 2012, at 1940 hours0.0225 days <br />0.539 hours <br />0.00321 weeks <br />7.3817e-4 months <br /> CDT The HPCI System was declared Operable after the HPCI turbine stop valve was rebuilt and post maintenance testing was completed.

D. Other Systems or Secondary Functions Affected There were no other systems or secondary functions affected by this event.

E. Method of Discovery This event was discovered during the performance of surveillance procedure 1-SR-3.5.1.7 by Operations personnel when attempting to manually trip the HPCI turbine.

F. Operator Actions Operations personnel stopped the HPCI turbine by securing the HPCI steam supply with the closure of the HPCI turbine steam admission valve 1-FCV-073-0016.

G. Safety System Responses There were no safety system responses for this event.

III. CAUSE OF THE EVENT

A. Immediate Cause The immediate cause was the gap between the piston rod of the actuator stem and pilot valve with stem (valve stem) on the HPCI turbine stop valve 1-FCV-073-0018 being set inappropriately during the performance of mechanical corrective instruction MCI-0-073-VLV001, High Pressure Coolant Injection Turbine Stop Valve - FCV 73-18 Disassembly, Inspection, Rework and Reassembly, in 2008.

B. Root Cause The root cause was determined to be inadequate procedural guidance in MCI-0-073-VLV001.

C. Contributing Factors 1. Personnel performing and supervising work did not adequately identify the unclear procedure guidance in the corrective action program to ensure that MCI-0-073-VLV001 was corrected before an event occurred.

2. Inadequate unit common procedure review failed to provide adequate guidance in MCI-0-073-VLV001 for reassembly of the HPCI turbine stop valve 1-FCV-073-0018.

IV. ANALYSIS OF THE EVENT

The Tennessee Valley Authority (WA) is submitting this report in accordance with 10 CFR 50.73(a)(2)(v)(B) and (D), as any event or condition that could have prevented fulfillment of a safety function of structures or systems that are needed to remove residual heat and mitigate the consequences of an accident.

On March 23, 2004, MCI-0-073-VLV001, High Pressure Coolant Injection Turbine Stop Valve - FCV 73-18 Disassembly, Inspection, Rework and Reassembly, Revision 8, was issued with a change made to the amount of clearance for BFN, Unit 3, that is to be set between the valve stem and the piston rod of the actuator. This change was made to compensate for a valve stem that was acquired from another utility which was believed to be approximately 3/16" shorter than the valve stem that was removed. Prior to this revision, all three BFN units had a common gap setting guidance of 1/32 inch (") to 1/16" per the Electrical Power Research Institute (EPRI) guidelines and General Electric (GE) Service Information Letter (SIL) 306, HPCI Turbine - Stop Valve Hydraulic Cylinder Seal Failure, Revision 1. Therefore, this revision to MCI-0-073-VLV001 changed a unit common procedure to specify a BFN, Unit 2, gap and a BFN, Unit 3, gap between the valve stem and piston rod of the actuator. Since BFN, Unit 1, was shut down at the time, no guidance was added to MCI-0-073-VLV001 to clarify how much of a gap between the valve stem and piston rod of the actuator should be included during reassembly of the BFN, Unit 1, HPCI turbine stop valve. The BFN, Unit 1, was restarted in May 2007, three years after the difference in stem gap settings was inserted into MCI-0-073-VLV001. Mechanical corrective instruction MCI-0-073-VLV001 was listed for review during BFN, Unit 1, restart activities, but no revision was made to incorporate BFN, Unit 1, guidance. Despite the lack of BFN, Unit 1, guidance in MCI-0-073-VLV001 with regard to the size of the gap between the valve stem and piston rod of the actuator, personnel that performed the work during the BFN, Unit 1, restart set the gap at 0.040".

The proper gap is between 1/32" and 1/16" (0.03125" - 0.0625"). Thus, from the time that BFN, Unit 1, was restarted, until the first BFN, Unit 1, refueling outage after restart in 2008, the HPCI turbine stop valve stem assembly was installed with the appropriate clearances.

On November 19, 2008, during the BFN, Unit 1, refueling outage, the piston rings on the HPCI turbine stop valve actuator were replaced due to its failure of the seal leak test performed during the refueling outage. The stems were separated to facilitate piston ring replacement. During reassembly, when the piston was relaxed in its lowest position, the gap between the valve stem and the piston rod was 5/8". The procedure being used did not specify the gap that should be used for BFN, Unit 1, since it was written as a unit common procedure, but instead only listed BFN, Units 2 and 3, gap information. As a result, Maintenance personnel signed the procedure step that required the use of a jack to properly position the piston, yet installed the split coupling with the gap at 5/8". Since the recommended setting is 1/32" to 1/16", the as-left measurement during this evolution was approximately 9/16" greater than it should have been. When the HPCI turbine stop valve strokes open, the disc travels upward into the guide of the top cover. However, increasing the length of the valve stroke by this amount pushes the HPCI turbine stop valve disc into a section of the top cover guide that narrows as it slopes inward. During the time period between November 19, 2008, and April 19, 2012 (when the valve failed to close), more than 350 valve strokes occurred with this extended stem length. The majority of these valve strokes were in support of system and maintenance testing, including oil sampling. With each stroke, the disc and cover guide wore against each other increasing the wear on each component until the friction between the two became greater than the force supplied by the closure spring inside the actuator and the valve failed to close.

Extent of Condition The extent of condition was determined to be all valves that provide an active safety significant function. All valves that provide an active safety significant function were verified to be Operable.

Extent of Cause The extent of cause was determined to be all BFN unit common procedures with systems that provide a safety significant function.

V. ASSESSMENT OF SAFETY CONSEQUENCES

The HPCI System permits the nuclear plant to be shut down while maintaining sufficient reactor vessel water.inventory until the reactor vessel is depressurized. The HPCI System continues to operate until the reactor vessel pressure is below the pressure at which Low Pressure Coolant Injection (LPCI) [BO] operation or Core Spray (CS) [BM] System operation maintains core cooling. If a Loss of Coolant Accident (LOCA) occurs, the reactor scrams upon receipt of a low-water-level signal or a high-drywell-pressure signal. The HPCI System starts when the water level reaches a preselected height above the core, or if high pressure exists in the primary containment (drywell). The HPCI should automatically stop when a high water level in the reactor vessel is signaled.

With the HPCI turbine stop valve bound open, this could not have occurred. After a trip, the HPCI System is supposed to automatically reset and restart if vessel water level again reaches the pre-selected height above the core. This restart capability would have been impacted by the inability to automatically trip/reset and the difficulty in restarting the system through other means.

With the BFN, Unit 1, HPCI turbine stop valve bound in the open position, electrical and mechanical HPCI trip functions were effectively disabled. In this condition, when the HPCI turbine reaches an overspeed condition and does not trip, a failure of the HPCI turbine could result. In addition, due to the failure of the HPCI turbine stop valve to close, HPCI would not trip on high water level. If manual operator action were not taken in this event, HPCI would fill the steam lines with water. This would subsequently send water to the Main Turbine [TA], the Reactor Core Isolation Cooling (RCIC) [BN] System steam supply, the Main Feedwater [SJ] System steam supply, and to the HPCI System steam supply lines, thereby compromising the ability of these systems to mitigate postulated accidents and transients.

Despite this reduction in defense-in-depth, redundant systems such as the Automatic Depressurization System (ADS) [SB], the CS System, and the Residual Heat Removal (RHR) System remained Operable, as allowed by Technical Specifications (TS), to respond to postulated accidents and maintain safe shutdown capability. The Emergency Core Cooling System (ECCS) subsystems (including ADS) are designed to ensure, in the event of a design basis accident and a worst case single failure, that adequate core cooling is maintained. The redundant capacity of the ECCS is consistent with the assumptions used in the safety analyses.

During the time period that the incorrect gap setting existed with the HPCI turbine stop valve, the RHR System was concurrently inoperable during the following periods of time.

• Loop I LPCI (RHR Pump 1C - LER 50-259/2010-004-01) o Approximately 2 years beginning prior to the start of HPCI inoperability on November 19, 2008, and ending on November 16, 2010.

• Loop II LPCI (Flow control valve 1-FCV-074-0066 - LER 50-259/2010-003-02) o Approximately 2 years beginning prior to the start of HPCI inoperability on November 19, 2008, and ending on November 16, 2010.

Due to the concurrent inoperability of Loop I LPCI, Loop II LPCI, and HPCI not being recognized, BFN, Unit 1, failed to enter Limiting Condition of Operation (LCO) 3.0.3 as required by TS 3.5.1 Required Action H.1. The LCO 3.0.3 requires action to be initiated within one hour to place the unit in Mode 2 within 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />, Mode 3 within 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />, and Mode 4 within 37 hours4.282407e-4 days <br />0.0103 hours <br />6.117725e-5 weeks <br />1.40785e-5 months <br />. During the period of Loop I LPCI, Loop II LPCI, and HPCI concurrent inoperability, CS was occasionally inoperable for performance of planned maintenance. Each time a loop of CS was inoperable, entry into LCO 3.0.3 was required.

Additionally, for approximately 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> on March 30, 2011, an inadvertent actuation of the Common Accident Signal (CAS) Logic of BFN, Unit 2, occurred. This actuation of the CAS Logic caused the inoperability of the BFN, Unit 1, Loop II LPCI and CS subsystems. As a result of the inoperability of the Loop II LPCI and CS subsystems, BFN, Unit 1, immediately entered LCO 3.0.3 as required by TS.

With one low pressure ECCS subsystem inoperable and assuming the HPCI System is inoperable, adequate core cooling is ensured by the operability of the ADS and the remaining low pressure ECCS subsystems. The BFN, Unit 1, TS provide an action completion time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> with the HPCI System inoperable and one low pressure ECCS injection/spray (either LPCI or CS) subsystem inoperable. During the time period that the incorrect gap setting existed in the HPCI turbine stop valve, a low pressure ECCS subsystem was not concurrently inoperable for more than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after November 16, 2010.

In addition, during the time period that the incorrect gap setting existed with the HPCI turbine stop valve, the RCIC System was not concurrently inoperable for longer than the 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> shutdown action completion time provided by the BFN, Unit 1, TS, except for the following periods when the RCIC system was inoperable for maintenance.

• Approximately 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> from February 5, 2010, to February 7, 2010

• Approximately 35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br /> from August 30, 2010, to August 31, 2010

• Approximately 8 days from March 14, 2011, to March 22, 2011 Based on an evaluation of the number of strokes of the HPCI turbine stop valve required for the HPCI System to successfully perform its function for the required mission time, the HPCI turbine stop valve is required to automatically open and close 18 times for the bounding design basis event of a small break LOCA with no operator action. Based on the actual number of valve strokes for the HPCI turbine stop valve prior to the failure on April 19, 2012, the inability for the HPCI System to meet its required mission time first occurred on February 27, 2012. Therefore, the HPCI System is considered to have been inoperable and unable to perform its required function from February 27, 2012, to April 24, 2012.

Risk significant systems (or portions of risk significant systems) unavailable for extended periods of time reduces the margin of safety in the plant. A probabilistic risk assessment (PRA) was performed which calculated the Incremental Core Damage Probability Deficit (ICDPD) and Incremental Large Early Release Probability Deficit (ILERPD). The ICDPD was determined to be 9.19E-6 and the ILERPD was determined to be 9.01E-7.

Based on the PRA, this event posed minimal reduction to public health and safety.

VI. CORRECTIVE ACTIONS - The corrective actions are being managed by TVA's corrective action program.

A. Immediate Corrective Actions

1. Repaired BFN, Unit 1, HPCI turbine stop valve.

2. Verified that the correct gap is set on BFN, Unit 2, HPCI turbine stop valve and BFN, Unit 3, HPCI turbine stop valve.

B. Corrective Actions to Prevent Recurrence

1. Revised MCI-0-073-VLV001 to remove unit specific guidance and set a gap of 1/32" to 1/16" for all three BFN units in accordance with EPRI guidelines and GE SIL 306.

2. Review all unit common Electrical, Instrument and Control, and Mechanical Maintenance procedures to verify that unit specific guidance is not provided unless it includes guidance for all three BFN units. Based on the review, document any unit specific guidance that is provided procedurally but fails to include specific guidance for all three units in the corrective action program. The corrective action document should evaluate the equipment that may be affected by this condition.

A. Failed Components

The failed component was 1-FCV-073-0018. This component was manufactured by Schutte and Koerting Co. with a manufacturer model number of J53MTR.

B. Previous Similar Events

A search of LERs for BFN, Units 1, 2, and 3, for approximately the past five years, did not identify any similar events.

Similar Problem Evaluation Reports (PERs) associated with this condition are documented in PERs 377771 and 377833.

C. Additional Information

The corrective action document for this report is PER 539040.

D. Safety System Functional Failure Consideration

In accordance with NEI 99-02, this event is considered a safety system functional failure. This event is considered a safety system functional failure because it could have prevented fulfillment of the HPCI System safety functions to remove residual heat and to mitigate the consequences of an accident.

E. Scram With Complications Consideration

This event did not include a reactor scram.

VIII. COMMITMENTS

There are no commitments.