05000316/LER-2006-006
| Donald C. Cook Nuclear Plant | |
| Event date: | 04-19-2006 |
|---|---|
| Report date: | 07-18-2007 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability |
| 3162006006R00 - NRC Website | |
Conditions'Prior to Event Unit 2 - 100% power
Description of Event
On April 10, 2006, Donald C. Cook Nuclear Plant (CNP) tested the Unit 2 "B" Residual Heat Removal (RHR) system heat exchanger outlet safety valve and on April 19, 2006, CNP tested the Unit 2 "A" RHR system heat exchanger. outlet safety valve. The safety valves for both trains of,RHR had an unsatisfactory as-found lift pressure test (high).
Technical Specification (TS) 3.5, Emergency Core Cooling Systems (ECCS); 3.5.2, ECCS - Operating, requires two trains of ECCS to be OPERABLE when in MODES 1, 2, and 3. When one or more trains are inoperable, Condition A requires that the inoperable train(s) be restored to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Since a similar cause was determined for the unsatisfactory as-found lift pressures, this condition may have arisen over a period of time, and there is a likelihood that the affected safety valves on both trains of RHR may not have been OPERABLE during plant operation for a time longer than allowed by TS. Therefore, this occurrence is considered reportable in accordance with 10 CFR 50.73(a) (2)(i)(B) as a condition prohibited by CNP's TS and 10 CFR 50.73(a)(2)(vii) as a common cause of inoperability.
10 CFR 50.73(a) requires licensees to subMit licensee event reports (LER) within. 60 days of discovery of the event. This LER is being submitted greater than 60 ..days after the event due -to CNP's failure .to recognize that the multiple test failures constituted a reportable condition..
Cause of Event
The apparent cause of the occurrence is nozzle disc bonding.
Analysis of Event
As described above, both Unit 2 RHR system heat exchanger outlet safety valves failed to initially lift. at 1.25 times their design.setpoint (design setpoint is 600 psig).
The failure of these safety valves to lift at the setpoint.pressure has no direct influence on the behavior of
- other components, equipment, or conditions. Thus,:
these failures do not increase'the-probability .of any initiating event in'the CNP Probabilistic Risk Assessment (PRA) model and have no impact'on plant risk from that standpoint. Failure of these safety. valves. could impact mitigation.
.
capabilities of the RHR and safety injection (SI) [BJ] systems under specific circumstances when these systems would be required to operate under high pressure r � .� .
conditions. Events which could lead to these conditions include a small break loss-of-coolant accident (SBLOCA) and an extended loss of heat sink accident.
Following one of these accidents, the potential exists.in the SI-to-RHR injection piping configuration for the SI system to over pressurize the RHR system if the Reactor Coolant System (RCS) remains above 600 psig. With either an SBLOCA or extended loss of heat sink, an additional failure would have to occur for the failure of one of these safety valves to affect its associated RHR train.
Specifically, the RHR cheCk valve upstream of the SI-to-RHR tie-in would also have to fail to prevent backflow/leakage. Thus, forthe SI system to overpressurize the RHR system causing rupture or significant leakage of the RHR piping, the following would be required:
- an SBLOCA or loss of heat sink,
- failure of the associated RHR train-related check valve.
Control Room alarms would alert operators to abnormal pressure conditions in the RHR pump discharge lines. The annunicator response procedures provide direction for operator action. In the' worst case, a single SI and RHR train could be disabled due to a large rupture. If the piping ruptured and spilled water to either the SI or RHR pump rooms, control room alarms would indicate significant leakage in'the.associated room. Room Sump Level Alarms indicate leakage in the room. The annunciator
- response procedure directs operators. to deterMine the source . of the leakage and isolate it. Given the training that Operations personnel receive on RHR and SI system operation, they would be expected to recognize that RHR/SI system operation was causing this alarm
- and take, action to stop .or minimize the impact.
Both RHR safety valves did lift on a second' attempt within 596:of the design setpoint and appeared to reseat satisfactorily.based on subsequent 'lift tests.
Given this behavior, there-is a reasonable probability that the valves would have functiOned to protect. the RHR system.
- Valve opening would avoid significant RHR train damage and associated leakage.
Neither of the RHR safety valves is explicitly included in the PRA model. In order for an RHR .safety valve to actuate, failure of an RHR check valve upstream of the
- SI-to-RHR tie-in must be assumed to cause failure of the associated.SI train.
Implicitly, the PRA model does credit the outflow from these valves during
- Interfacing System LOCA events. However, in such events, full RCS pressure would, n be applied to the valve and would likely open it fully. On this basis, there is o quantitative PRA impact of the RHR heat exchanger outlet safety valves lifting .
above their design setpoint. Nonetheless, barriers exist to.limit the.impact of this condition. Specifically:
0. particular-events are required (extended loss of auxiliary feedwater or SBLOCA),
- . an additional failure (failure of the East RHR To Reactor Coolant Loops #1 and #4 Check Valve; or West RHR�Reactor Coolant'Loops #2 & #3 Check Valve) is required, and
- redundant alarms exist to alert personnel to isolate/mitigate the leak.
_
- The likelihood of these conditions occurring simultaneously is extremely small based upon probabilistic insights.
Corrective Actions
Both Unit 2 RHR system heat exchanger outlet safety valves were replaced with new, pre-tested valves and were declared operable.
The Unit 1 and Unit
- 2 RHR safety valves are necessary for RHR heat exchanger overpressure protection. .Expansion of the test population was performed in accordance with I&M's ISI testing program to identify the extent of condition and included one of the two Unit 1 valves. This valve passed and did not exhibit indications of nozzle disc bonding.
I&M will continue to work with its vendors and industry. peers to ensure it fully
- understands and addresses this condition, with expanded testing .and
- adjustments to be performed as. appropriate.
Previous Similar Events
05000316/2006-002-00, MSSV Trevi Testing Failures.
The causal evaluation and corrective actions for this previouS similar event have been reviewed. Based on the differing system operating parameters for.the main .
steam safety valves and the RHR heat exchanger outlet safety_valves, I&M. has determined that the.extent of condition
- review and corrective actions taken. for LER 05000316/2006-002-00 could not have reasonably been 'expected to prevent the event being reported in this LER.