05000318/LER-2007-002

LER-2007-002, Dual Containment Spray Train Inoperability Due to Latent Valve Failure

Docket Numbersequential Revmonth Day Year Year Month Day Yearnumber No. 05000
Event date:	09-14-2007
Report date:	11-08-2007
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(v)(C), Loss of Safety Function - Release of Radioactive Material
3182007002R00 - NRC Website

I.� DESCRIPTION OF EVENT

A. PRE-EVENT PLANT CONDITIONS

Units 1 and 2 were operating at 100 percent of rated thermal power on September 14, 2007, prior to the discovery of the condition.

B. EVENT

On September 14, 2007, with Units 1 and 2 operating at 100 percent power, Operations personnel determined that 21 Shutdown Cooling Heat Exchanger (SDCHX) Component Cooling (CC) Outlet Valve, 2-CC-3828-CV, did not stroke open during surveillance testing. Local observation showed that the valve actuator stroked in response to handswitch manipulation in the Control Room, however the valve stem did not move.

The cause of this failure to stroke was a broken woodruff key between the valve actuator and the valve stem.

A review of prior plant data revealed that the woodruff key failure occurred on September 7, 2007, at the completion of a scheduled valve timed-stroke surveillance.

The woodruff key failure caused 2-CC-3828-CV to be inoperable from 0050 on September 7, 2007, until the valve was returned to service at 1605 on September 15, 2007. Technical Specification Limiting Condition for Operation (LCO) 3.6.6 requires that two containment spray (CS) trains and two containment cooling fans shall be operable.

The failed shut condition of 2-CC-3828-CV caused 21 CS Train to be inoperable for longer than is allowed by the Technical Specification Required Action Completion Time.

Further investigation determined that 22 CS Train was removed from service for planned maintenance from 0300 on September 11, 2007 until 2121 on September 12, 2007. This action resulted in the inoperability of both CS trains (21 and 22). This condition only applied to Unit 2. Identical valves on 22 SDCHX and Unit 1 SDCHXs were verified operable based on the previous satisfactory completion of surveillance testing and a review of related plant trending data.

TO THE EVENT:

The 21 SDCHX CC Outlet Valve (2-CC-3828-CV) was determined to be inoperable and contributed to the event. The planned maintenance on 22 CS Train rendered the second train inoperable and also contributed to the significance of the event. No other inoperable systems, structures, or components contributed to or influenced the condition at the time of discovery.

NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (9-2007)

D. DATES AND APPROXIMATE TIMES OF MAJOR OCCURRENCES:

September 7 at 0050, Quarterly Component Cooling Valve Operability Testing was performed on 2-CC-3828-CV. The test was a quarterly timed test of valve/actuator without a Position Indication Test or system response acceptance criteria. The test was performed satisfactorily.

This is the earliest time that 2-CC-3828-CV would have failed and is considered the starting point for entry into Technical Specificatiori 3.6.6.A.

September 7 at 2350 until September 8 at 0100, the "A" Train Engineering Safety Features Logic Test was performed with acceptance criteria met for 21 CS Train. During the test, the Engineered Safety Feature Actuation Signal was provided for 2-CC-3828-CV to open.

September 10 at 0051, 21 CS Train exceeded the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> limit for Technical Specification LCO 3.6.6.A and required entry into LCO 3.6.6.B.

September 11 at 0300, 22 Emergency Core Cooling System air cooler and 22 Containment Spray Pump were removed from service for planned maintenance. Both Unit 2 CS trains were out-of-service (OOS) and Technical Specifications LCO 3.6.6.F and 3.0.3 applied to Unit 2 at this time due to the latent valve failure.

September 12 at 1326, 22 Containment Spray Pump passed Post-Maintenance Operability Testing.

September 12 at 2121, 22 Emergency Core Cooling System air cooler was returned to service.

22 CS Train was back in service at this time, with 21 CS Train remaining OOS. Technical Specifications 3.6.6.F and 3.0.3 were no longer applicable.

September 14 at 0945, the 21 CS Train was removed from service during a scheduled Component Cooling Pump Quarterly Surveillance Test.

September 14 at 0945, during the performance of the scheduled surveillance a low flow condition was identified involving 2-CC-3828-CV, 21 SDCHX outlet control valve. Operations staff commenced troubleshooting.

September 14, at 1500, Operations identified that the control valve was broken. At that time, Operations, Maintenance, Integrated Work Management, and Engineering were working on Priority 1 maintenance to fix the sheared woodruff key. 21 CS Train was declared inoperable at this time and documented via Condition Report IRE-025-472. Later that day, diagnostic testing confirmed that the valve had excessive drag. This determination spurred the formation of an Issue Response Team to evaluate and correct the issue.

NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (9-2007)

CONTINUATION SHEET

September 15 at 1130, a temporary alteration was installed, placing 2-CC-3828-CV in the valve's analyzed post-accident "open" position.

September 15 at 1130, Operations accepted an Operability Determination providing justification for continued operation with 2-CC-3828-CV in its post-accident position.

September 15 at 1605, 21 CS Train was returned to service. Technical Specifications 3.6.6.A and 3.6.6.B were no longer applicable.

September 17 at 1412, Operations staff determined, during the initial investigation into 21 CS Train inoperability, that 22 CS Train was OOS from 0050 on September 7, 2007 until 1605 on September 15, 2007 including the timeframe that 21 CS Train was inoperable. This was recognized as a separate missed LCO and Condition Report IRE-025-517 was initiated to capture the condition.

E. OTHER SYSTEMS OR SECONDARY FUNCTIONS AFFECTED:

The loss of CS train(s) affected the containment heat removal and containment atmosphere fission product removal safety functions.

F. METHOD OF DISCOVERY:

The inoperable 21 CS Train condition was discovered on September 14, 2007 during the investigation of the failed shut SDC Heat Exchanger CC Outlet Valve, 2-CC-3828-CV.

Condition Report IRE-025-517 was initiated to capture the unidentified inoperable conditions affecting the CS trains. Condition Report IRE-025-472 was initiated to capture the latent failure of 2-CC-3828-CV. The failed CC Outlet Valve and subsequent inoperable CS trains are licensee-identified issues due to their discovery during or as a result of the performance of scheduled surveillance testing. Further investigation determined that both 21 and 22 CS Trains were OOS when 22 CS Train was taken out for maintenance.

G. MAJOR OPERATOR ACTION:

No major operator actions were taken as a result of this condition.

H. SAFETY SYSTEM RESPONSES:

No safety system responses occurred as a result of the subject condition.

II.� CAUSE OF EVENT NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (9-2007)

CONTINUATION SHEET

The event is NUREG-1022 Cause Code [D].

The apparent cause for the inoperability of the CS trains was incorrect valve travel setup on 2-CV-3828-CV, which damaged the valve liner. The valve liner created an internal obstruction restricting valve disc travel. The NUREG-1022 Cause Code for this event is "D", Defective Procedure, for failures caused by inadequate or incomplete written procedures or instructions. A review of Calvert Cliffs Procedure Valve-43, "Masoneilan Pacesetter Butterfly Valve Overhaul," determined that no requirement existed for verification of a critical dimension on the actuator linkage. An additional procedural error resulted due to a lack of clarity related to measurement of the valve seat liner compression.

Contributing causes of the dual CS Train inoperability included missing an opportunity to identify the degraded condition during a surveillance test procedure (STP) and a misunderstanding of the limitations of this particular valve's remote position indication system.

An additional STP provided opportunities which were missed to include available, redundant verifications of physical system parameters during restoration steps. A scripted pre-job brief missed opportunities to include differences in the design of the SDC Heat Exchanger Outlet Valves. The Operations Training Program missed opportunities to effectively train on Remote Position Indication System operation for the subject valves as part of Licensed Requalification Training and Auxiliary Building Operator Continuing Training.

III.A ANALYSIS OF EVENT Technical Specification LCO 3.6.6.A, "One containment spray train inoperable," requires the restoration of the CS train to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Should this condition not be met, Technical Specification LCO 3.6.6.B requires the plant to be placed in Mode 3 within six hours, with pressurizer pressure less than 1750 psia within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The inoperability of 21 CS Train from 0050 on September 7, 2007 until 1605 on September 15, 2007 resulted in a duration of 207 hours0.0024 days <br />0.0575 hours <br />3.422619e-4 weeks <br />7.87635e-5 months <br /> and 15 minutes which exceeded the allowed completion time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. At 0051 on September 10, 2007, Unit 2 met the requirements for entry into Technical Specification LCO 3.6.6.B. At 0651, Unit 2 met the requirements for entry into LCO 3.0.3. However, the Operations staff was not aware of the condition and Unit 2 remained at 100 percent power.

This condition was prohibited by Technical Specifications and reportable under 10 CFR 50.73(a)(2)(i)(B), 'Any event or condition prohibited by the plant's Technical Specifications.' Technical Specification LCO 3.6.6.F, "Two containment spray trains inoperable," requires immediate entry into TS LCO 3.0.3, which would require entry into Mode 3 within 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> and subsequent cooldown to Mode 5 within 37 hours4.282407e-4 days <br />0.0103 hours <br />6.117725e-5 weeks <br />1.40785e-5 months <br />. The inoperability of 21 and 22 CS Trains from 0300 on September 11, 2007 until 2121 on September 12, 2007 resulted in a duration of 42 hours4.861111e-4 days <br />0.0117 hours <br />6.944444e-5 weeks <br />1.5981e-5 months <br /> and 21 minutes. Operations staff was unaware of this condition and Unit 2 remained at 100 percent power throughout this period. This condition was also prohibited by Technical Specifications and reportable under 10 CFR 50.73(a)(2)(i)(B), 'Any event or condition prohibited by the plant's Technical Specifications.' The CS and Cooling Systems cool the containment atmosphere to limit post-accident containment pressures and temperatures to less than design values. The CS and containment ' cooling systems each provide 100 percent of the system design requirements for containment heat removal, but the CS system is also credited within the Accident Analyses for radio-iodine removal during the Maximum Hypothetical Accident (Updated Final Safety Analysis Report, Section 14.24). In addition, the Iodine Removal System also functions to reduce the concentration of fission products released to the containment atmosphere following a postulated accident. The Iodine Removal System works with the CS System to reduce the potential release of radionuclides from containment after a design basis accident.

The dual CS train inoperability could have prevented' the fulfillment of the containment iodine removal safety function to control the release of radioactive material and mitigate the consequences of a design basis accident_ initiating from 100 percent rated thermal power. For this reason, the condition is reportable under 10 CFR 50.73(a)(2)(v)(C) and (a)(2)(v)(D), 'Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to:

(A) Shutdown the reactor and maintain it in a safe shutdown condition; (B) Remove residual heat; (C) Control the release of radioactive material; or (D) Mitigate the consequences of an accident.' NUREG-1022, Revision 2, states in the discussion related to the 10 CFR 50.73(a)(2)(ii)(B) reporting criteria that the level of significance generally corresponds to the inability to perform a required safety function. The inability to remove iodine from the containment atmosphere during a design basis accident meets this standard. The dual CS train inoperability resulted in a condition that could have resulted in a radioactive material release from containment beyond the limits analyzed in the maximum hypothetical accident in Updated Final Safety Analysis Report, Chapter 14. For this reason, this condition is reportable under 10 CFR 50.73(a)(2)(ii)(B), 'Any event or condition that resulted in (B) the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety.' There were no actual safety consequences as a result of this condition because a design basis accident did not occur during the time the conditions existed. The potential safety consequences of the conditions are low because the containment heat removal safety function was retained and the containment atmosphere fission product removal safety function was not completely lost due to the availability of the Containment Iodine Removal Units. Containment spray would have still been effective in removing fission products from the containment atmosphere during the injection phase of a design basis accident (i.e., only the recirculation phase was affected).

The single CS train inoperable condition existed for a total duration of 208 hours0.00241 days <br />0.0578 hours <br />3.439153e-4 weeks <br />7.9144e-5 months <br /> and 15 minutes, which met the requirements for entry into TS LCO 3.0.3. The dual CS train inoperable condition existed for a total duration of 42 hours4.861111e-4 days <br />0.0117 hours <br />6.944444e-5 weeks <br />1.5981e-5 months <br /> and 21 minutes, which also met the requirements for entry into TS LCO 3.0.3. The calculated plant risk increase for both trains of CS 00S was 6.0 E-08 in Incremental Conditional Core Damage Probability (ICCDP). The entire window's increase, including the time frame with 21 CS Header inoperable alone, is 6.6 E-08 in ICCDP.

The Nuclear Regulatory Commission Safety System Functional Failure Performance Indicator will be impacted by this condition. The impact to the Performance Indicator will not result in exceeding the threshold for a White Performance Indicator.

IV. CORRECTIVE ACTIONS

A. ACTION TAKEN TO RETURN AFFECTED SYSTEMS TO THE PRE-EVENT

NORMAL STATUS:

1. A temporary alteration was installed which placed the affected valve, 2-CC-3828-CV, in the valve's post-accident (open) position.

2. Maintenance Order 2200704582 was initiated to repair/replace 2-CC-3828-CV at the next available opportunity.

B. ACTION TAKEN OR PLANNED TO PREVENT RECURRENCE

Initial action taken:

1. Metallurgical analysis was performed on the broken woodruff key to determine the most likely failure mode.

2. Suspended mechanical maintenance procedure for overhaul of the affected valve.

NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (9-2007)

CONTINUATION SHEET

Planned actions:

1. Troubleshooting will be performed on 2-CC-3828-CV valve setup by adjusting the valve travel. Normal friction will be verified post­ troubleshooting by performing diagnostic testing.

2. Valve-43, Masoneilan Pacesetter Butterfly Valve Overhaul Procedure, will be revised to measure and adjust the "B" dimension to 1-3/4 inches.

3. 2-CC-3828-CV valve internals will be inspected during overhaul to compare failure analysis , results to apparent cause evaluation findings.

4. STP-O-007 NB (1 & 2) will be modified to clarify for the four SDCHX CC outlet CVs when restoring the system to utilize all available redundant physical system parameters. Specific instructions/steps will be strategically r placed to ensure operators monitor system response during restoration of the applicable valves.

5. The scripted pre-job briefs for STP-0-007A/B will be modified to include differences in the design of the affected valves (1/2-CC-3828-CV and 1/2-CC-3830-CV) and Operating Experience related to system restoration from this event.

6. Other Engineered Safety Feature Actuation Signal related STPs will be reviewed to identify any which have one of the affected 16 Masoneilan Pacesetter valves similar to 2-CC-3828-CV.

7�Other STPs that are affected by one of the 16 Masoneilan valves similar to 2-CC-3828-CV will be modified to make changes to these newly identified procedures that are analogous to the changes to STP-O-007 NB for the respective systems.

8.�Training will be conducted on design and specific Position Indication Test constraints for these Masoneilan valves as part of part of Licensed Operator Requalification Training and Auxiliary Operator Continuing Training.

V.�ADDITIONAL INFORMATION

A. FAILED COMPONENTS

The subject valve is a 16" Masoneilan Pacesetter Power Actuated Butterfly valve with a spring diaphragm and an elastomer lining in the valve body manufactured by Masoneilan International, Inc. (EPIX Identification Number M120), Model Number 37-34211.

B. PREVIOUS LERs ON SIMILAR EVENTS

systems inoperable, Event Date 6/30/93. The root cause was due to a failure of the pivot locking plate on the No. 11 SDC Heat Exchanger CC Outlet Valve (1-CC­ 3828-CV) while 12 CS Train was 00S for maintenance. The corrective actions for this earlier condition did not prevent the current condition because the failure mode of 1-CC-3828-CV was different than the current failure of 2-CC-3828-CV.

When High Energy Line Break Barriers Removed." This event resulted in periods where all three trains of auxiliary feedwater pumps were inoperable due to high energy line break barrier removal. Corrective actions for this event focused on clearly identifying high energy line break barriers and considering the impact on affected systems during periods when they are open or removed. Latent equipment failures did not contribute to this event and were not considered.

Issue Report IRO-045-116; 11 SDC Heat Exchanger Outlet 1-CC-3828-CV does not operate, Event Date 7/06/95. The Priority 3 root cause analysis performed identified bunching of the elastomer as the probable cause of internal obstruction that led to failure of the woodruff key between the valve stem and the valve actuator. The corrective action for this earlier condition was replacement of the valve. Stresses imparted on the valve during the removal of the 11 SDC Heat Exchanger shell to install helical spacers four years prior to the event was identified as the most likely cause of the failure. No additional corrective actions were identified to prevent recurrence due/ to the unique nature of the work involved.

C. THE ENERGY INDUSTRY IDENTIFICATION SYSTEM (EIIS) COMPONENT

SYSTEM REFERRED TO IN THIS LER:

NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (9-2007)

CONTINUATION SHEET

� NUMBER IEEE 803� IEEE 805 Component� EllS Function� System� ID 2-CC-3828-CV SDC Heat Exchanger Outlet� TCV� CC Containment Air Cooler� CLR� BK � � Iodine Removal Unit FLT VA SDC HX� HX� BP ECCS Air Cooler� CLR� VF D.� SPECIAL COMMENTS None