05000528/LER-2008-001, Regarding Inadequate Surveillance Test Procedure Resulting in Failure to Meet TS Requirements
| ML080990647 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 04/01/2008 |
| From: | Mims D Arizona Public Service Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| 102-05839-DCM/JHH/RAS LER 08-001-00 | |
| Download: ML080990647 (7) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 5282008001R00 - NRC Website | |
text
10 CFR 50.73 zýA A subsidiary of Pinnacle West Capital Corporation Dwight C. Mims Mail Station 7605 Palo Verde Nuclear Vice President Tel. 623-393-5403 P.O. Box 52034 Generating Station Regulatory Affairs and Plant Improvement Fax 623-393-6077 Phoenix, Arizona 85072-2034 102-05839-DCM/JHH/RAS April 01, 2008 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001
Dear Sirs:
Subject:
Palo Verde Nuclear Generating Station (PVNGS)
Units 1, 2, and 3 Docket Nos. STN 50-528, 50-529 and 50-530 License No. NPF 41, NPF 51 and NPF 74 Licensee Event Report 2008-001-00 Attached, please find Licensee Event Report (LER) 50-52812008-001-00 which reports operation in a condition prohibited by Technical Specifications due to an inadequate surveillance test procedure.
In accordance with 10 CFR 50.4, copies of this LER are being forwarded to the NRC Regional Office, NRC Region IV and the Senior Resident Inspector. If you have questions regarding this submittal, please contact Russell A. Stroud, Section Leader, Regulatory Affairs, at (623) 393-5111.
Arizona Public Service Company makes no commitments in this letter.
Sincerely, DCM/RAS/gat Attachment cc:
E. E. Collins Jr.
NRC Region IV Regional Administrator M. T. Markley NRC NRR Project Manager - (send electronic and paper)
R. I. Treadway NRC Senior Resident Inspector for PVNGS A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway 9
Comanche Peak
- Diablo Canyon S
Palo Verde
- South Texas Project 0 Wolf Creek rA
NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 08/31/2010 (9-2007)
, the NRC may sfor each block) not conduct or sponsor, and a person is not required to respond to, the digits/characters finformation collection.
- 3. PAGE Palo Verde Nuclear Generating Station (PVNGS) Unit 1 05000528 1 OF 6
- 4. TITLE Inadequate Surveillance Test Procedure Resulting in Failure to Meet TS Requirements
- 5. EVENT DATE
- 6. LER NUMBER
- 7. REPORT DATE
- 8. OTHER FACILITIES INVOLVED MONTH DAY YEAR YEAR SEQUENTIAL REV MONTH DAY YEAR PVNGS Unit 2 05000529 NUMBER NO.
V G
Unt20 059 FACILITY NAME DOCKET NUMBER 02 01 2008 2008 - 001 00 04 01 2008 PVNGS Unit 3 05000530
- 9. OPERATING MODE
- 11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR§: (Check all that apply)
El 20.2201(b)
El 20.2203(a)(3)(i)
Cl 50.73(a)(2)(i)(C)
El 50.73(a)(2)(vii) 1 / 1 / 1 El 20.2201(d)
El 20.2203(a)(3)(ii)
El 50.73(a)(2)(ii)(A)
El 50.73(a)(2)(viii)(A)
El 20.2203(a)(1)
El 20.2203(a)(4)
El 50.73(a)(2)(ii)(B)
El 50.73(a)(2)(viii)(B)
El 20.2203(a)(2)(i)
El 50.36(c)(1)(i)(A)
E] 50.73(a)(2)(iii)
[I 50.73(a)(2)(ix)(A)
- 10. POWER LEVEL El 20.2203(a)(2)(ii)
[] 50.36(c)(1)(ii)(A)
E] 50.73(a)(2)(iv)(A)
El 50.73(a)(2)(x)
E] 20.2203(a)(2)(iii)
El 50.36(c)(2)
El 50.73(a)(2)(v)(A)
El 73.71(a)(4)
E] 20.2203(a)(2)(iv)
El 50.46(a)(3)(ii)
El 50.73(a)(2)(v)(B)
El 73.71(a)(5) 100 / 100 / 100 El 20.2203(a)(2)(v)
El 50.73(a)(2)(i)(A)
El 50.73(a)(2)(v)(C)
El OTHER El 20.2203(a)(2)(vi) 0 50.73(a)(2)(i)(B)
El 50.73(a)(2)(v)(D)
Specify in Abstract below or in Note: All times listed in this event report are approximate and Mountain Standard Time (MST) unless otherwise indicated.
- 1.
REPORTING REQUIREMENT(S)
This LER (50-528/2008-001-00) is being submitted pursuant to 10 CFR 50.73(a)(2)(i)(B) to report operation in a condition prohibited by Technical Specifications (TS). Specifically, TS Surveillance Requirement (SR) 3.3.11.2 requires verification every 18 months that each required Remote Shutdown System control circuit and transfer switch is capable of performing the intended function. Contrary to this requirement, the existing surveillance test procedure (STP) did not adequately verify that capability.
- 2.
DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):
The Remote Shutdown System provides the control room (CR) operator with sufficient instrumentation and controls to place and maintain the unit in a safe shutdown condition from a location other than the control room. Disconnect switches are provided in the control circuits for specified "B" train components, in order to prevent the inadvertent operation of components during a CR fire. The ability to achieve and maintain a safe shutdown condition requires that the Auxiliary Feedwater (AFW) system (EIIS Code: BA) and the steam generator safety valves (EIIS Code: SB) or the steam generator atmospheric dump valves (EIIS Code: SB) be used to remove core decay heat and meet all safety requirements. The long term supply of water for the AFW System and the ability to borate the Reactor Coolant System (RCS, EIIS Code: AB) from outside the CR allow extended operation in Mode 3.
The disconnect switches have two positions; LOCAL/REMOTE and LOCAL. With a disconnect switch in LOCAL/REMOTE position, operation of the component is enabled both from the CR and from the local controls. With the disconnect switch in the LOCAL position, operation of the component is possible only at the local controls. The method of testing each disconnect switch involved placing the disconnect switch in LOCAL, then functionally testing the component from the local control and also verifying that the function was disabled from the CR. This functional testing of the transfer switch did not verify proper electrical isolation of each transfer circuit between the CR and the local control.
- 3.
INITIAL PLANT CONDITIONS
On February 1, 2008, Palo Verde Units 1, 2 and 3 were in Mode 1 (Power Operations), at approximately 100 percent power at the time of discovery of the condition. No additional equipment or components were inoperable at the time of the condition that contributed to this condition.
- 4.
CONDITION DESCRIPTION:
On February 1,2008 at 1400, engineering personnel concluded during performance of the Component Design Bases Review (CDBR), that STP 40ST-9ZZ20, "Remote Shutdown Disconnect Switch and Control Circuit Operability," did not adequately test two valves: SIB-UV-615 and SIB-UV-625, Low Pressure Safety Injection (LPSI, EIlS Code:
BP) header injection valves to the RCS loops 2A and 2B. The STP provided a method to test the transfer of functional control from the CR to the local controls only, but did not provide a testing method to ensure a circuit fault would not impact the local control capability for SIB-UV-615/625. Engineering personnel reported the condition to CR personnel, and all three units entered TS SR 3.0.3, which permits a delay of up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or the limit of the specified frequency of the surveillance, to complete performance of the STP.
On February 6, 2008, at 1845, further evaluation by engineering personnel revealed that six additional valves were affected by the inadequate STP:
- 1. LPSI shutdown heat exchanger "B" bypass valve, SIB-HV-307,
- 2. LPSI Containment Spray to shutdown cooling heat exchanger "B" crosstie valve, SIB-HV-694,
- 3. Auxiliary Feedwater Pump "B" to steam generator (SG) 1 block valve, AFB-UV-34,
- 4. Auxiliary Feedwater Pump "B" to SG 2 block valve, AFB-UV-35,
- 5. Auxiliary Feedwater Pump "B" to SG 1 control valve, AFB-HV-30, and
- 6. Auxiliary Feedwater Pump "B" to SG 2 control valve, AFB-HV-31.
Engineering personnel informed control room personnel and TS SR 3.0.3 was entered for each of the affected valves.
On February 7, 2008, an extent of condition review was completed and the results indicated that 70 components were required to meet Appendix R safe shutdown criteria on each of the three units. Risk assessments had been performed for 4 of the 8 components that had already been entered into TS SR 3.0.3 (as identified above). Control room personnel declared the remaining affected components inoperable and TS Limiting Condition for Operation (LCO) 3.3.11 Condition B was entered. TS LCO 3.3.11 Condition B requires restoration of the inoperable switches or control circuits to an operable status within 30 days, or issuance of procedure changes that identify alternate disconnect methods or control circuits.
On February 14, 2008, a new STP, 40ST-9ZZ25, "Online Remote Shutdown Disconnect Switch Operability," was implemented to allow testing of remote shutdown system disconnect switches online.
On February 15, 2008, after extensive review of an engineering evaluation of the affected
components by Operations, Operations Standards, Engineering, Probabilistic Risk Assessment, and licensing personnel, it was determined that the required disconnect switches and control circuits could appropriately be included under the provisions of TS SR 3.0.3, and, therefore, TS LCO 3.3.11, Condition B, was exited for the affected components. In accordance with the requirements of TS SR 3.0.3, a risk evaluation was performed by engineering personnel to manage the risk impact. This evaluation separated the 70 affected components into three categories:
- 1. components which already had an adequate degree of testing completed,
- 2. components which would require testing in the near-term based on the risk evaluation, and
- 3. components for which testing could be extended for up to one surveillance period (the maximum allowed by TS SR 3.0.3) based on the risk evaluation.
While performing testing of the components in Category 2 above, in accordance with STP 40ST-9ZZ25, three conditions were identified:
- 1. On February 21, 2008, station personnel observed an unacceptable resistance reading across the Unit 1 Auxiliary Feedwater Pump "B" to SG 2 block valve (AFB-UV-34). Upon investigation, a jumper was found installed in circuit breaker 1 EPHBM3814.
The jumper was not shown on the applicable design drawings and apparently had been present since plant startup. With the jumper installed, it could not be assured that the disconnect switch would have isolated the local control circuit from potential faults due to a control room fire. A postulated hot short could re-close valve AFB-UV-34, thereby terminating AFW flow to Steam Generator 1. The jumper was removed and the component was tested successfully.
- 2. On March 2, 2008, station personnel identified that contacts 42 and 43 did not appear to change state when the disconnect switch for the Unit 1 Class 1 E 125VDC Train B battery breaker (1EPKBM4102) was taken to LOCAL. A jumper was subsequently found installed across these contacts. These contacts are not Appendix R safe shutdown contacts and, therefore, any fire induced failures would not have resulted in the loss of the 125VDC Train B battery breaker during a control room fire event. As such, Mode 3 was still capable of being achieved and maintained with this identified condition. The jumper was removed and the component was tested successfully.
- 3. On February 17, 2008, station personnel identified a missing conductor in a Unit 3 valve position indication circuit for valve AFB-HV31. The missing conductor resulted in the valve position control room meter, 3J-AFB-ZI-31 A, not displaying properly when the hand switch was taken to the LOCAL position, but did not impact the isolation function of the associated disconnect switch. As such, the safety function was not impacted. The conductor was installed and tested successfully.
The remaining components which were tested online passed satisfactorily. The other affected components are not risk significant and are being managed in accordance with TS SR 3.0.3 until the next available time for performance of the modified STP.
- 5.
ASSESSMENT OF SAFETY CONSEQUENCES
This condition did not adversely affect plant safety or the health and safety of the public.
The condition did not result in any challenges to the fission product barriers or result in any releases of radioactive materials. Therefore, there were no actual adverse safety consequences or implications as a result of this condition.
The effect of the jumper installed on Unit 1 AFB-UV-34 valve circuitry was evaluated for asymmetric steam generator operation and cooldown due to the postulated inability to feed one steam generator. Through comparison to bounding 10 CFR 50 Appendix R Fire Protection Analyses, engineering personnel concluded the condition did not exceed acceptance criteria for control room fire events. As such, the condition reported in this LER would not have resulted in a transient more severe than those analyzed in the updated Final Safety Evaluation Report Chapters 6 and 15. The condition did not have any nuclear safety consequences or personnel safety impact.
The condition would not have prevented the fulfillment of a safety function and did not result in a safety system functional failure as defined by 10CFR 50.73(a)(2)(v).
- 6.
CAUSE OF THE CONDITION:
The direct cause of this condition was that the testing methods of the STP did not ensure that the intended function of isolation from the Control Room was met, in that each circuit was not individually verified to meet the requirements of TS SR 3.3.11.2.
The preliminary root cause for this condition is that persons experienced and knowledgeable of the requirements of 10CFR 50, Appendix R were not adequately involved in the development and revision of STP 40ST-9ZZ20, resulting in less than adequate technical reviews and incomplete implementation of the TS SR.
Contributing to this condition was that the original bases for the TS LCO and TS SR, as well as NRC Generic Letter 81-12, "Fire Protection Rule," were ineffectively translated into the original STP.
Further contributing to this condition was a failure to identify and effectively evaluate Operating Experience OE-22204, which should have prompted a review of the existing STP to ensure that the requirements for isolation were adequately verified. Review of this OE incorrectly concluded that the OE was not applicable to PVNGS. On a separate
occasion, review of this OE incorrectly concluded that if.the condition identified in the OE existed at PVNGS, it would be identified during performance of 40ST-9ZZ20.
If upon conclusion of the root cause analysis, substantial information is identified that would significantly change a reader's perception of the cause or consequences of the condition, or if there are substantial changes in the planned corrective actions, APS will include that information in a supplement to this LER.
- 7.
CORRECTIVE ACTIONS
STP 40ST-9ZZ25, "Online Remote Shutdown Disconnect Switch Operability," was implemented to perform the surveillance for the components with higher risk as defined by the risk analysis.
The three identified non-conforming conditions (jumpers and missing conductor) were corrected.
STP 40ST-9ZZ20 will be revised to ensure that each circuit is verified to meet the requirements of the TS SR. This revised STP will be implemented during upcoming refueling outages on each unit in accordance with TS SR 3.0.3.
- 8.
PREVIOUS SIMILAR CONDITIONS:
LER 50-528/2007-005 reported a condition where existing STPs did not verify that the TS SR was met for certain AFW valve actuation relays and, as a result, did not account for full valve stroke time.
Additionally, LER 50-528/2007-004-00 reported a condition where existing STPs did not ensure the Containment Spray system headers were full of water.
The corrective actions for these previous LERs could not have prevented the condition identified here, in that the previous events did not involve the same underlying concern or reason as this event, such as the same root cause, failure, or sequence of events.