05000528/LER-2004-005
| Docket Number05 28 2004 2004 - 005 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| Initial Reporting | |
| 5282004005R01 - NRC Website | |
1. REPORTING REQUIREMENT(S):
This LER 528/2004-005-01 is being submitted to report a condition which was prohibited by the plant's Technical Specifications. This report applies to Units 1, 2, and 3.
Specifically, the tests conducted by Technical Specification Surveillance Requirements 3.4.15.2 to verify the Shut Down Cooling (SDC) isolation valve interlocks were inadequate.
2. DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):
Shutdown Cooling System (EIIS: BP) suction line valve interlocks are designed to act as permissives. The Shutdown Cooling System Suction Line Valve Interlocks permit the isolation valves to be opened below a certain RCS pressure. The Shutdown Cooling System Suction Line Valve Interlocks receive power from the emergency busses should there be a loss of all AC power. This is to assure that the interlocks and valves will be able to operate under all operating conditions. The SCS is a low temperature, low pressure system used to remove decay heat from the RCS. Cooldown of the RCS is accomplished via the steam generator down to about 350°F and about 400 psia. Below these values the SCS is used to cool the RCS to refueling temperatures and to maintain these conditions for extended periods of time. To preclude over-pressurization, there are redundant, motor driven, interlocked, isolation valves on each suction line. The interlocks prevent the suction line isolation valves from being opened if RCS pressure has not decreased below 410 psia. These interlocks are redundant so that any single failure will not cause a suction line and heat exchanger to be subjected to pressures greater than design pressure. The interlock cannot be overridden so that operator action cannot inadvertently subject the SCS to RCS pressure. In addition, no single failure can prevent the operator from aligning the valves, on at least one suction line, for shutdown cooling after RCS pressure requirements are satisfied. Redundant relief valves are provided on the suction lines to prevent or mitigate over-pressurization from pressure transients. These transients can be caused by inadvertent starting of HPSI pumps, charging pumps, inadvertent energizing of pressurizer backup heaters, or a combination of these. The relief valves are set at 467 psig to ensure the system stays below its design limits. The SDC valve interlocks are safety-related and designed to protect the SDC system from over-pressurization.
3. INITIAL PLANT CONDITIONS:
On May 28, 2004, Palo Verde Units 1, 2 and 3 were in Mode 1 (POWER OPERATION), operating at approximately 100 percent power. There were no major structures, systems, or components that were inoperable at the start of the event that contributed to the event. There were no failures that rendered a train of a safety system inoperable and no failures of components with multiple functions were involved.
4. EVENT DESCRIPTION:
On May 28, 2004, during a review of Condition Report number 2687507 it was determined that Palo Verde was not testing SDC isolation valve interlocks as described in UFSAR section 7.6, nor were these safety-related interlocks being subjected to a complete channel calibration/functional test as intended by NRC GL96-01. The Technical Specification surveillance requirement is 3.4.15.2.
5. ASSESSMENT OF SAFETY CONSEQUENCES:
S.R. 3.4.15.2 verifies the SDC system open permissive interlock prevents the valves from being opened with a simulated or actual RCS pressure signal > 410 psia every 18 months.
The open permissive interlocks are installed on the three SDC Suction piping isolation valves on each train; Train A SIAUV651 (upstream), SICUV653 (middle), SIAUV655 (downstream), Train B SIBUV652 (upstream), SIDUV654 (middle), SIBUV656 (downstream). The functional intent of the open permissive interlock (410 psia setpoint) is to ensure the RCS pressure will not pressurize the SDC system beyond 125% of its design pressure of 485psig, and ensure the SDC relief valves will not lift.
Per Site Procedure "Cold Shutdown to FlOt Standby Mode 5 to Mode 3", RCS pressure is maintained less than 410 psia until the Low Temperature Over Pressurization (LTOP) relief valves are isolated and the power supply disconnects for SICUV653 and SIDUV654 are Open and Locked per 40AC-OZZO6 "Locked Valve, Breaker, and Component Control".
Removal of power from these valves also removes control power and has the effect of precluding inadvertently opening the valves from either spurious failure or inadvertent hand-switch operation. Down powering the valve is functionally equivalent to the open permissive interlock. If a downstream isolation valve's interlock failed to ensure the valve would not open, and the valve was inadvertently opened from the control room or remote shutdown panel, the SDC system would remain isolated from RCS pressure by the remaining isolation valves.
If an upstream isolation valve's interlock failed to ensure the valve would not open, and the valve was inadvertently opened from the control room or remote shutdown panel, the SDC suction line would be pressurized up to the middle isolation valve. This section of piping is rated for RCS pressure, and the thermal relief valve's setpoint is 2485 + 75 psig. Thus no LOCA initiation or loss of SI system function would occur. No impacts were identified, assuming a failure of the open permissive interlock, that would result in an over-pressurization of the SDC system beyond design limits.
Based on the analysis, the use of the Surveillance test that was not in full compliance with the testing procedure described in the UFSAR would not have prevented the fulfillment of the safety function and would not result in a safety system functional failure as defined by 10CFR50.73(a)(2)(v).
This event did not pose any significant implication for public health and safety or common defense and security.
6.� CAUSE OF THE EVENT:
The cause of the original event (missed surveillance test) was human error. In the process of revising the Surveillance Test, the author used faulty logic in responding to questions in the 10 CFR 50.59 Screening process. The author and the reviewer both failed to recognize that SR 3.4.15.2 and its Basis state that the SDC open permissive interlock must be verified to prevent the valves from being opened with a simulated or actual RCS pressure signal of >410 PSIA every 18 months. UFSAR section 7.6.2.1.1 includes a specific test procedure that is intended to be used to comply with these requirements. Surveillance Procedures SDC Interlocks Loop & Alarm Calibration (36ST 9S104 and 36ST-9SI05) were changed in 1995 to delete valve interlock logic verification and only checked alarm contact status.
The cause for the second event involving this LER supplement was human error involving miscommunication. The UFSAR described testing was incorrectly translated into surveillance test procedural steps which did not replicate the intended test description. Based upon what we now know was a miscommunication the corrective actions to change the surveillance procedures in accordance with the UFSAR section 7.6.2 were closed.
No unusual characteristics of the work location (e.g., noise, heat, poor lighting) directly contributed to this event. No procedural errors contributed to this event.
7.� CORRECTIVE ACTIONS:
Surveillance tests 36ST-9S104 and 36ST-9S105 were revised and tested in all three units to meet Technical Specification surveillance requirement 3.4.15.2. On 6/15/04 meetings were held to determine what revisions were needed to 36ST-9S134 and 36ST-9S105 to satisfy the Technical Specification surveillance requirements. Appendix C was added to the procedures which extensively tested the SDC Interlock circuitry.
However, this test did not meet the UFSAR section 7.6.2 test methodology, nor the GL 96-01 testing methodology.
On 6/30/04 SDC Interlock testing IAW Appendix C was completed in all three units.
On 9/25/04 procedures 36ST-9S104 and 36ST-9S105 were again revised to include Appendix D which matched the test procedure described in UFSAR section 7.6.2. The tests have been successfully completed in all three Units as follows:
- On 10/15/04 and 10/22/04 completed Unit 3 Appendix D SDC Interlock testing
- On 4/12/05 and 4/18/05 completed Unit 2 Appendix D SDC Interlock testing
- On 8/13/05 and 8/14/05 completed Unit 1 Appendix D SDC Interlock testing A review of other non-Plant Protection System safety-related interlocks, inhibits, permissives or bypass circuits that may not have been included in surveillance tests has been completed.
8. PREVIOUS SIMILAR EVENTS:
In the past three years, previous similar events were reported in LERs 3-2003-003, 2-2003-003 and 1-2001-005.