05000282/LER-2003-001
| Docket Number | |
| Event date: | |
|---|---|
| Report date: | |
| 2822003001R00 - NRC Website | |
EVENT DESCRIPTION
On March 3, 2003, during an inspection of the Unit 1 Residual Heat Removal (RHR) system', the positioner feedback linkage2 to the Train B air-operated control valve, RHR Heat Exchanger Reactor Coolant Outlet Flow Control Valve3, was noted to be disconnected and an adjustable wrench was observed lodged in the positioner linkage. It was later determined that the feedback linkage had deformed and failed during operation due to binding caused by the misplaced wrench lodged in the valve operator.
The positioner and controls for the Train B RHR heat exchanger outlet control valve were properly maintained in accordance with plant maintenance procedures on September 9, 2002.
The maintenance procedure directs and documents the Instrumentation and Control (I&C) Specialist to specifically check the feedback linkage and nothing abnormal was noted during performance of this maintenance procedure.
A surveillance test was performed on November 21, 2002. Successful performance of this activity demonstrated that the valve's ability to modulate flow was functional. This was the last time that the feedback linkage was verified intact prior to discovery of its failure.
During investigation of this event, controlled test simulations demonstrated that for the feedback linkage failure to occur, following introduction of the adjustable wrench into the area of the valve positioner, the control valve must have been stroked from the closed position to the open position. Operation of the Train B RHR heat exchanger outlet control valve that could have damaged the feedback linkage happened for the first time on November 26, 2002 at 1108 hrs, again on November 29, 2002 at 0930 hrs, and finally on December 4, 2002 at 0130 hrs.
Investigation and analysis of activities performed in the Train B RHR pit during and following the Unit 1 outage in November/December 2002 determined that the Train B RHR heat exchanger outlet control valve linkage deformation and failure event most likely occurred on December 4, 2002 at 0130 hours0.0015 days <br />0.0361 hours <br />2.149471e-4 weeks <br />4.9465e-5 months <br /> when the Control Room Operator repositioned the valve to the open position from the control board4 in accordance with the instructions of plant procedures for operating the RHR system. However, the investigation could not rule out the possibility that the event occurred on November 26, 2002 or November 29, 2002.
On March 3, 2003, following discovery of the failed feedback linkage on the Train B RHR heat exchanger outlet control valve, Technical Specification (TS) 3.5.2 Condition A was entered to 1 EIIS System Identifier: BP 2 EIIS System Identifier: BP Component Identifier: TC 3 EIIS System Identifier: BP Component Identifier: FCV 4 EIIS Component Identifier: MCBD allow repair of this valve. The Train B RHR heat exchanger outlet control valve was repaired and returned to service at 2128 hours0.0246 days <br />0.591 hours <br />0.00352 weeks <br />8.09704e-4 months <br /> that same day.
On March 24, 2003, the Nuclear Management Company (NMC) determined that if the wrench had become dislodged from the valve positioner feedback linkage, the valve would reposition to the closed position without Control Room Operator action. A system status light in the Control Room would provide indication of valve repositioning, however the Control Room Operator may not be able to reposition the valve to its open, safeguards position. If an event occurred in this configuration, which required the RHR valve to be open, isolation of the air supply5 to the actuator would open the valve and the valve would also fail open on a loss of air event.
CAUSE OF THE EVENT
A 10" adjustable wrench was inadvertently left in the vicinity of Train B RHR heat exchanger outlet control valve which likely entered into the area between the positioner and the mounting bracket when the valve was in its closed position. Workers failed to account for tools upon completion of their tasks near this valve.
ANALYSIS OF THE EVENT
entered Mode 3 operation on December 4, 2002 at 0435 hours0.00503 days <br />0.121 hours <br />7.19246e-4 weeks <br />1.655175e-4 months <br />. TS 1.1, Definitions, defines a device as OPERABLE "when it is capable of performing its specified safety function(s).
During the November/December 2002 Unit 1 refueling outage, a 10" adjustable wrench was left in an inappropriate location in the vicinity of the Train B RHR Heat Exchanger Reactor Coolant Outlet Flow Control Valve. The adjustable wrench was apparently left from one of three work activities that were performed on a manually operated valves, located directly above the diaphragm case for the Train B RHR heat exchanger outlet control valve. The most likely area in which the wrench was left was on top of the positioner attached to the Train B RHR heat exchanger outlet control valve. The adjustable wrench apparently entered the area between the positioner and the mounting bracket when the valve was in its closed position.
Operating the valve to the open position likely resulted in linkage binding resulting in deformation of the positioner feedback linkage, deformation of the standoff bolt between the 5 EIIS System Identifier: LD 6 EIIS System Identifier: BP Component Identifier: LOV stem connector assembly and linkage, and separation of the bolt from the stem connector assembly.
In the "as-found" configuration, the wrench was resting on the positioner drive arm and the valve was in its safeguards position for power operation, full open. If the wrench had become dislodged from the Train B RHR heat exchanger outlet control valve, the capability to re-open the Train B RHR heat exchanger outlet control valve with the control room hand controller is dependent on the under range capability ( Room Operator would have to position the hand controller beyond the full open position. The Control Room hand controller for the Train B RHR heat exchanger outlet control valve under range capability may not be sufficient to allow re-opening the valve.
Since operability of the Train B RHR heat exchanger outlet control valve could not be assured without the wrench lodged in the operator mechanism, the valve would not support operability of RHR Train B as required by TS LCO 3.5.2, which requires two trains of the Emergency Core Cooling System (ECCS) (RHR and safety injection8 (SI) systems) to be operable. Thus, this event has been determined to be reportable per 10CFR 50.73 (a)(2)(i)(B).
Impact on Safety System Functional Failure Performance Indicator This condition could not have (by itself) prevented a safety function, because the Train B RHR heat exchanger outlet control valve inoperability only affects one train of RHR and the valve with the wrench cradled in the operating mechanism was in the safeguards position, full open.
Also, the redundant RHR Train A, except for a few minutes during the period of possible inoperability of RHR Train B, could have continued to perform the required safety function.
Thus, this event is not reportable per 10CFR 50.73 (a)(2)(v), and, therefore, does not impact the Safety System Functional Failure Performance Indicator.
Evaluation of Safety Significance System Functions The RHR system is a dual use system that provides a safeguards function as part of the ECCS and removes residual heat during normal evolutions such as plant cooldown from Mode 4 to Mode 5 and residual heat removal from the core during plant shutdown in Modes 5 and 6.
The Train B RHR heat exchanger outlet control valve is an air-operated valve on RHR Train B designed to fail open upon loss of instrument air pressure. The Train B RHR heat exchanger EIIS System Identifier: BP Component Identifier: HC 8 EIIS System Identifier: BQ outlet control valve is used to control the cooldown rate of the reactor coolant system9 (RCS) by controlling the flow rate through Train B RHR heat exchanger10. During normal operation, the valve is in the open position to allow full flow through Train B RHR heat exchanger for low head injection. The line from Train B RHR heat exchanger to Train B SI pump" for high head recirculation taps off upstream of the Train B RHR heat exchanger outlet control valve so the valve is not required for high head recirculation. When this valve is not full open, a light12 illuminates on the "SI Not Ready" panel13 in the control room, which indicates that the system is not in its safeguards configuration for plant operation in Modes 1, 2, and 3.
Initiating Events Requiring the Train B RHR Heat Exchanger Outlet Control Valve Function Since the RHR supply to the SI pump suction is upstream of the Train B RHR heat exchanger outlet control valve, this valve is only required to perform its safeguards function during transients and accidents that require RHR low head injection. The Train B RHR heat exchanger outlet control valve does not provide any function for high head recirculation so these initiating events are not affected by this valve's failure.
Because of the functions provided by the Train B RHR heat exchanger outlet control valve, it is required for the RHR system to mitigate the consequences of: (1) loss of coolant accidents (LOCAs) (including large break and small break LOCAs); and (2) steam generator14 tube rupture (SGTR) accidents.
Following a small break LOCA initiating event with successful SI system15 injection, the Control Room Operator can cooldown and depressurize the RCS to temperatures and pressures where the RHR system can be used to remove decay heat, thereby precluding the need for high head recirculation. The Train B RHR heat exchanger outlet control valve provides a function in this case as it can be used to control the RCS cooldown rate through Train B RHR heat exchanger. If SI system injection should fail, the RCS can be depressurized such that low head injection together with low head recirculation can prevent core damage. In this case, the Train B RHR heat exchanger outlet control valve allows full low head RHR flow to the reactor vesse116.
9 EIIS System Identifier: AB lo EIIS System Identifier: BP Component Identifier: }DC 11 EIIS System Identifier: BQ Component Identifier:
12 EIIS System Identifier: IB Component Identifier: IL 13 EIIS System Identifier: IB 14 EIIS System Identifier: SB Component Identifier: SD 15 EIIS System Identifier: BQ 16 EIIS System Identifier: AB Component Identifier: RPV For large break LOCAs, the functions provided by the Train B RHR heat exchanger outlet control valve are the only means to prevent core damage as low head injection together with low head recirculation are required to mitigate the accident.
Following a SGTR, SI system injection is needed to prevent core uncovery. SI pumps will be sequentially stopped and RHR shutdown cooling would be needed to provide decay heat removal while the RCS is depressurized to atmospheric pressure. In this case, the functions provided by the Train B RHR heat exchanger outlet control valve are required to mitigate core damage.
Deterministic Assessment In the "as-found" condition, the Train B RHR heat exchanger outlet control valve had an adjustable wrench lodged in the valve air-operated control mechanism and the feedback linkage was broken. The valve was open and could have performed its design basis safety function. The light on the "SI Not Ready" panel associated with this valve was not illuminated.
Tests on a valve mockup determined that the valve could be fully closed and fully opened in this configuration but could not be modulated.
On the basis of tests performed on a valve mockup, if the wrench became dislodged from the valve operator, the valve would go to the fully closed position without any Operator action. The operators may not be able to re-open the valve when the wrench becomes dislodged and the valve would not be able to perform its safety function.
The wrench appears to have been lodged in the Train B RHR heat exchanger outlet control valve operator for nearly three months. The magnitude of force required to dislodge the wrench from this Train B RHR heat exchanger outlet control valve is not known. Pictures of the wrench in the "as-found" position and mockup tests demonstrated that that the combination of interferences and geometry of the valve positioner mounting bracket served to cradle the wrench.
If the wrench became dislodged during normal plant operations, without provocation, the valve would go to the fully closed position due to dislodgement of the wrench and the Control Room Operators would be alerted to the valve closure by the "SI Not Ready" panel light illumination.
TS 3.5.2, Condition A would have been entered and the valve would be repaired on a timely basis.
For the purposes of discussion, it is postulated that likely causes for dislodging the wrench could include valve operations or an event which would shake the plant such as an earthquake. This valve is in an obscure location; so unobserved bumping by plant personnel resulting in wrench dislodgement is unlikely.
An activity that dislodged the wrench and caused the valve to close during plant operation would have also caused the "SI Not Ready" light to illuminate. An operation associated with plant operation that possibly could cause dislodging the wrench would be moving the valve to attempt throttling RHR flow for a plant cooldown. When the valve went to the fully closed position due to dislodgement of the wrench, the Control Room Operators would have indications that the valve was not correctly positioned, such as lack of RHR flow and the "SI Not Ready" light illuminated. During normal plant operational evolutions, the valve going to fully closed and not capable of re-opening from the Control room would not involve safety significance. The plant operating evolution, such as plant cooldown, could be delayed until the valve was repaired. Once the broken feedback linkage was identified for the Train B RHR heat exchanger outlet control valve, repair was effected in approximately two hours. If the valve needed to be opened urgently, the Operators could isolate the instrument air supply to the valve from a location outside the RHR pit causing it to fail fully open.
An activity that involves significant plant shaking and could require response of the safety related plant systems is an earthquake. If the Train B RHR heat exchanger outlet control valve went to the fully closed position due to dislodgement of the wrench during an earthquake, the Control Room Operators would have indications that the valve was not correctly positioned such as lack of RHR flow and the "SI Not Ready" light illuminated. Since the instrument air system is not designed to withstand a design basis earthquake, it could also be postulated that the instrument air system would fail and the Train B RHR heat exchanger outlet control valve would return to the fully open position. In the very unlikely event of an earthquake that would require ECCS but not disable the instrument air system, the Control Room Operators would have indications that the valve was not correctly positioned such as lack of RHR flow and the "SI Not Ready" light illuminated. To establish Train B ECCS flow to the reactor core, the Operators could isolate the instrument air supply to the valve from a location outside the RHR pit causing it to fail fully open. An earthquake requiring ECCS is a very unlikely event.
The RHR system comprises two redundant trains of which only one is required to mitigate the consequences of an accident which requires ECCS. During the period from December 4, 2002 through March 3, 2003, Train A RHR was operable and would have provided the required ECCS flow during an accident except for nine minutes on January 29, 2003 during which Train A RHR was out of service for performance of a surveillance test. Thus, Train A was operable in excess of 99.99 percent of the time that Train B could be considered inoperable.
Deterministic Assessment Conclusions The RHR Train B control valve with broken feedback linkage and an adjustable wrench lodged in the valve air operator mechanism is considered an event of low safety significance. This conclusion is based on considerations presented above which include:
1. The redundant RHR train, Train A, was operable over 99.99 percent of the time that RHR Train B could be considered inoperable.
2. If the valve closed due to dislodgement of the wrench, the Control Room Operators would have indication from the "SI Not Ready" panel.
3. If wrench dislodgement was associated with an event during which the operators anticipate RHR flow to the reactor vessel, the Control Room Operators could also observe that there is no RHR Train B flow.
4. Postulated events such as an earthquake that could cause significant plant shaking to dislodge the wrench and require RHR flow are very unlikely. An earthquake that could dislodge the wrench could also disable the instrument air system (not designed to withstand seismic events) which would re-open the valve.
Risk Significance Assessment Assumptions 1. It was conservatively assumed for this risk analysis, that the Train B RHR heat exchanger outlet control valve was failed in the closed position.
2. It was assumed that the valve could not be opened from the Control Room.
3. Credit for local Operator action to fail air to the valve to open it was not credited.
4. It was assumed that the Train B RHR heat exchanger outlet control valve was failed in the closed position for 90 days from December 4, 2002 until discovery on March 3, 2003.
5. Large early release frequency (LERF) was not considered due to the insignificant impact of the RHR system on LERF results.
Risk Significance Initiating Events Impact Because of the functions provided by the Train B RHR heat exchanger outlet control valve, it is required for the RHR system to mitigate the consequences of: (1) loss of coolant accidents (LOCAs) (including large break, medium break, small break and reactor coolant pump (RCP) seal LOCAs); and (2) steam generator tube rupture (SGTR) accidents.
Risk Significance Determination The results of the analysis assuming that the Train B RHR heat exchanger outlet control valve is failed in the closed position for 90 days are a conditional core damage frequency (CCDF) of 1.65E-06/yr for Unit 1 and a conditional core damage probability (CCDP) of 4.07E-07.
Dominant sequences involve a small break LOCA or SGTR followed by failure of the component cooling system17 supply to Train A RHR heat exchanger or failure of the Train A RHR heat exchanger outlet control valve. Other sequences involving large break LOCA initiating events are of much less significance than those sequences involving a small break LOCA or SGTR initiating event.
Risk Significance Conclusions The risk analysis performed using the current Prairie Island risk assessment model and assuming that the Train B RHR heat exchanger outlet control valve has failed in the closed position shows that the resulting CCDF is 1.65E-06/yr. Using the value of 90 days during which the Train B RHR heat exchanger outlet control valve is assumed to be failed in the closed position, the CCDP is 4.07E-07. By virtue of the CCDP being less than 1E-06, the event can be classified as non-risk significant.
CORRECTIVE ACTIONS
Immediate:
The Train B RHR heat exchanger outlet control valve feedback linkage was reconnected and acceptance testing was performed.
Actions to Prevent Recurrence:
1. Develop a tool accountability program.
2. Perform training on tool management at the work site and tool accountability at the completion of the task or workday.
FAILED COMPONENT IDENTIFICATION
Train B RHR heat exchanger outlet control valve CV-31236.
PREVIOUS SIMILAR EVENTS
No previous LERs with similar events.