05000529/LER-2007-004
| Docket Number | |
| Event date: | 10-26-2007 |
|---|---|
| Report date: | 12-26-2007 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 5292007004R00 - NRC Website | |
Note: All times listed in this event report are approximate and Mountain Standard Time (MST) unless otherwise indicated.
1. REPORTING REQUIREMENT(S):
This LER (50-529/2007-004-00) is being submitted pursuant to 10 CFR 50.73(a)(2)(i)(B) to report operation in a condition prohibited by Technical Specifications (TS).
Specifically, TS 3.7.2 requires that four Main Steam Isolation Valves (MSIV) and their associated actuator trains ("A" and "B") be operable in Modes 1 through 4. TS 3.7.2 Limiting Condition for Operation (LCO) Condition A requires that with one MSIV with a single actuator train inoperable, the MSIV actuator train shall be restored to an operable status within 7 days. On October 26, 2007, during in-service surveillance testing, it was determined that the actuator train "A" for Unit 2 MSIV 181 (number two steam generator, steam line number two) was inoperable. Further investigation of the cause of the inoperability concluded that the period of inoperability had been from July 31, 2007, (date of last maintenance) to October 27, 2007, (date of restored operability). Contrary to TS 3.7.2 Condition A, the actuator train "A" for MSIV 181 was inoperable for greater than the 7 day required action time.
2. DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S): ' The Main Steam system (EIIS Code: SB) consists of one MSIV in each main steam line (two.
for each of the two steam generators) outside, but close to, containment. The MSIVs are downstream from the Main Steam Safety Valves (MSSVs), atmospheric dump valves, and auxiliary feedwater pump turbine steam supply valves to prevent those valves from being isolated from the steam generators by MSIV closure. Closing the MSIVs isolates each steam generator from the other, and isolates the turbine, Steam Bypass Control System, and other auxiliary steam supplies from the steam generators.
The MSIV is a 28-inch double-disc, wedge type gate valve manufactured by the Anchor/Darling Valve Company, with redundant pneumatic hydraulic actuator trains. The actuation system is composed of redundant trains "A" and "B". The MSIVs fast close within 4.6 seconds upon receipt of a Main Steam Isolation Signal (MSIS) (EIIS Code: JE). The instrumentation and controls of the valve actuator train "A" are physically and electrically separate and independent of the instrumentation and controls of the valve actuator train "B".
Either actuator train can independently perform the safety function to fast close the MSIV on demand.
For each actuator train for each MSIV, nitrogen pressurized hydraulic fluid stored in an accumulator provides the energy required for fast closure of the MSIV upon receipt of an MSIS. The actuation of the MSIV is controlled by the position of two four-way directional control valves that operate together to direct hydraulic fluid as needed to change valve position. One four-way valve controls the flow of hydraulic fluid to and from the pressurized hydraulic fluid accumulator while the other four-way valve controls the flow of hydraulic fluid to either side of the MSIV actuator hydraulic piston (bottom for opening, top for closing).
Instrument air provides pilot air to the four way directional control valves to position them as needed for opening and closing the MSIV.
The MSIVs close on an MSIS generated by high containment pressure, low steam generator pressure, or high steam generator level. The MSIVs fail closed on loss of power, and may also be actuated manually.
During performance of in-service testing, the MSIV actuator train is placed in a condition that simulates a loss of instrument air to the system. This is accomplished by isolating the instrument air supply to the valve and opening a vent valve upstream of the instrument air check valve. The purpose of the instrument air check valve is to retain sufficient volume of air in the air reservoir and associated tubing and fittings for one actuation of the MSIV.
3. INITIAL PLANT CONDITIONS:
On October 26, 2007, Palo Verde Unit 2 was in Operating Mode 1 (Power Operations), at approximately 100 percent power. No equipment was inoperable that contributed to this event.
4. EVENT DESCRIPTION:
On October 26, 2007, at approximately 10:35 hours, during the performance of quarterly surveillance test procedure 73ST-9SG01, "MSIVs — Inservice Test", step 8.1.3 was completed to isolate instrument air to MSIV 181 in order to leak test the air reservoir check valves. Subsequently, Control Room Safety Equipment Inoperable Status (SEIS) alarm "10F SG2 LN2 MSIV UV-181 air reservoir pressure low, Train A" annunciated.
Approximately two minutes later the "A" accumulator hydraulic pressure indicated 2,800 pounds per square inch (psi), which is lower than the typical pressure of 5,200 psi.
Subsequent troubleshooting determined that there was an air leak in one of the four way valves due to a missing air port 0-ring that resulted in air pressure declining to the point that the four-way valve began to shift. This caused a loss of accumulator hydraulic fluid to the reservoir and the resultant pressure decrease. This condition most likely existed since July 31, 2007, when the four-way valve was replaced. This as-found condition rendered the MSIV 181 actuator train "A" inoperable from July 31, 2007, (date of last maintenance) to October 27, 2007, (date of restored operability).
The failed directional four-way control valve was a Teledyne Republic Manufacturing valve model number 23304-7001-2853.
5. ASSESSMENT OF SAFETY CONSEQUENCES:
The safety function of the MSIVs is to fast close when a MSIS Engineered Safety Features Actuation System (ESFAS) actuation occurs. The fast close action prevents containment over pressurization and excessive reactor cool down following a main steam line break, main feedwater line break, or loss of coolant accident. The MSIS rapidly terminates steam flow and feedwater flow by isolating each steam generator.
There are four MSIVs, one on each main steam line. Each valve can be actuated from train "A" or train "B" instrumentation, power and air. Each actuator train performs completely redundant functions. This configuration ensures that a single failure in the power source or a mechanical failure of one MSIV actuator train cannot result in the loss of the isolation function. During this event, the redundant MSIV actuator train was operable. Therefore, the main steam line was still capable of being isolated in the event that a MSIS occurred.
This condition did not adversely affect plant safety or the health and safety of the public. The event did not result in any challenges to the fission product barriers or result in any releases of radioactive materials. Therefore, there were no adverse safety consequences or implications as a result of this event.
The actuator train "A" closure system for MSIV 181 was inoperable from July 31, 2007, to October 27, 2007. Although this time period exceeds that period allowed by TS 3.7.2 LCO Condition A (7 days), the redundant actuator train "B" would have been able to perform its safety related function of fast closure. During a design basis event, instrument air is assumed to be lost; however, with the normally supplied instrument air available, the actuator train "A" was capable of fast closure of the MSIV.
The event did not result in a transient more severe than those analyzed in the updated Final Safety Evaluation Report Chapters 6 and 15. The event did not have any nuclear safety consequences or personnel safety impact.
The condition would not have prevented the fulfillment of any safety function of structures or systems as defined by 10 CFR 50.73(a)(2)(v).
6. CAUSE OF THE EVENT:
The direct cause for the inoperability of the actuation train "A" for MSIV 181 was inadequate human performance by maintenance that resulted in the air port 0-ring not being installed following replacement of the four-way valve on July 31, 2007.
The root cause of this event was inadequate post maintenance test instructions which did not specify a component test to check for air leakage.
Contributing causes included poor maintenance related documents that contributed to inconsistent work performance. The documents reflected an over-reliance on skill-of-the-craft in that they lacked specificity with regard to current good work practices.
7. CORRECTIVE ACTIONS:
An Engineering Troubleshooting, Repair, and Test Plan was developed and implemented for the actuator train "A" for MSIV 181 to support locating and correcting possible air leakage.
Following troubleshooting and identification of the leak between the four-way valve and the manifold, the four-way valve was removed, new interface 0-rings were installed, the four-way valve was reinstalled, leak testing of the air-line and four-way valve were satisfactorily completed, and post maintenance testing was completed on October 27, 2007. The actuator train "A" for MSIV 181 was then declared operable.
The investigation team verified that section 8.1 of surveillance test 73ST-9SG01, "MSIVs — Inservice Test," had been performed for all other MSIVs since any prior replacement of four way valves, which verified no excessive leakage exists on any other actuator trains.
Maintenance updated and revised the post maintenance retest instructions associated with the MSIVs and Main Feedwater Isolation Valves (FWIV) to include specific testing for both hydraulic and pneumatic leaks when either of the four way valves are replaced, and to add full stroke closed testing of air reservoir check valves when the four-way valve used to control flow of hydraulic fluid to and from the accumulator is replaced. Note that the FWIVs use the same type of actuator to open and close the valves.
Maintenance revised the work instructions for replacing MSIVs and FWIVs four-way valves to include more specific and detailed guidance to accomplish the maintenance work.
8. PREVIOUS SIMILAR EVENTS:
four-way valve in the actuation system for a FWIV. The cause of that event was failure to recognize a specific failure mode of the associated four-way valve thereby allowing an inoperable condition to remain undetected beyond the permitted TS LCO action time. As the cause of that event was different from the cause of this event, the corrective actions from that event would not have prevented the event being reported in this LER.