05000529/LER-2009-002
| Docket Number Sequential Revmonth Day Year Year Month Day Yearnumber No. | |
| Event date: | 08-21-2009 |
|---|---|
| Report date: | 12-23-2009 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability |
| 5292009002R00 - NRC Website | |
All times are Mountain Standard Time and approximate unless otherwise indicated.
1. REPORTING REQUIREMENT(S):
This LER is being submitted pursuant to both 10 CFR 50.73(a)(2)(i)(B), as a condition prohibited by Technical Specifications (TS), and 10 CFR 50.73(a)(2)(vii), as a single cause that resulted in at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system.
TS Limiting Condition for Operation (LCO) 3.6.3 requires containment isolation valves (CIVs) ISV) to be OPERABLE in Modes 1 (Power Operation) through 4 (Hot Shutdown). If a CIV becomes inoperable, Condition A requires isolation of the affected penetration flow path within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. If that completion time is not met, Condition E requires the unit to be in Mode 3 in six hours and in Mode 5 in 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
2. DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):
The Main Steam system (EIIS: SB) provides steam generator (SG) blowdown (BD) system sample flow paths to monitor SG secondary water chemistry. These flow paths are used to sample the water from either the SG hot leg or two downcomer regions.
The SG BD sample flow paths each contain an inboard (inside containment) and outboard (outside containment) solenoid-operated CIV that is remotely operated from the control room. The CIVs automatically close upon the receipt of a Safety Injection Actuation, Auxiliary Feedwater Actuation, or Main Steam Isolation signals (ENS: JE) to isolate each of the respective containment penetration flow paths. The inboard and outboard CIV pair for the SG BD sample containment penetration flow paths are listed below:
Hot Leg (HL) or Containment SG# Downcomer (DC) Penetration Inboard CIV Outboard CIV 1 HL 37B 2SGAUV204 2SGAUV219 1 DC 37A 2SGAUV211 2SGAUV228 1 DC 49 2SGAUV220 2SGAUV221 2 HL 63A 2SGBUV224 2SGBUV225 2 DC 48 2SGBUV226 2SGBUV227 2 DC 63B 2SGBUV222 2SGBUV223 � Each of the SG blowdown sample system CIVs is a Valcor model V52660-5683-46 half-inch solenoid operated globe valve. The solenoid for each is powered from a 130 VDC Cutler- Hammer Model ARD66OUR, Style 765A689G07 Control Relay (El IS: RLY). When the valve is open, the control relay coil is continuously energized. A closure demand from the control room hand-switch or automatic actuation signal de-energizes the control relay coil which causes the relay's 6-pole relay contact block to return to its de-energized position which in turn de energizes the valve solenoid, causing the valve to close.
3. INITIAL PLANT CONDITIONS:
On August 21, 2009, Palo Verde Unit 2 was operating in Mode 1 at approximately 100percent power at normal operating temperature and pressure. No systems, structures, or components were out of service that contributed to this reported condition.
4. EVENT DESCRIPTION:
On August 21, 2009, at 04:01, SG downcomer blowdown sample CIV 2SGAUV211 failed to close during surveillance testing. Station personnel isolated the affected containment penetration to comply with TS LCO 3.6.3 for an inoperable CIV. After the control relay was replaced and the valve function was successfully re-tested on August 29, 2009, the CIV was declared OPERABLE. The control relay had been replaced and tested on July 22, 2009, as a 5-year preventive maintenance task. The surveillance test on August 21 was the first quarterly surveillance test since the July 22 replacement.
On August 29, 2009, at 08:52, SG hot leg blowdown sample CIV 2SGAUV219 failed to close during surveillance testing. Station personnel isolated the affected containment penetration to comply with TS LCO 3.6.3 for an inoperable CIV. After the control relay was replaced and the valve function was successfully re-tested on September 3, 2009, the CIV was declared OPERABLE. The control relay had been replaced and tested on July 15, 2009, as a 5-year preventive maintenance task. The surveillance test on August 29 was the first quarterly surveillance test since the July 15 replacement.
On September 4, 2009, at 03:39, SG downcomer blowdown sample CIV 2SGBUV227 failed to close during surveillance testing. Station personnel isolated the affected containment penetration to comply with TS LCO 3.6.3 for an inoperable CIV. After the control relay was replaced and the valves function was successfully re-tested on September 6, 2009, the CIV was declared OPERABLE. The control relay had been replaced and tested on July 22, 2009, as a 5-year preventive maintenance task. The surveillance test on September 4 was the first quarterly surveillance test since the July 22 replacement.
After the replacement the control relay for CIV 2SGBUV227 on September 6, the valve again failed to close on October 5, 2009. Since Unit 2 was in Mode 5 (Cold Shutdown), LCO 3.6.3 was not applicable. The control relay was replaced again on October 11, 2009.
On October 4, 2009, at 03:39, SG downcomer blowdown sample CIV 2SGBUV228 failed to close during surveillance testing. The CIV remained open and then closed 5 minutes after receipt of the actuation signal. The control relay was replaced during the refueling outage and the valve's function was successfully re-tested on October 21, 2009. The control relay had been replaced and tested on September 11, 2009, as a 5-year preventive maintenance task.
The surveillance test on October 4 was the first test since the September 11 replacement.
CIVs 2SGAUV211 and 2SGAUV228 are the inboard and outboard CIVs for the SG #1 downcomer sample line penetration #37A. The periods between the 5-year replacements and the subsequent failures of the valve did not overlap.
For each of the five CIV failures that occurred, the Cutler-Hammer Model ARD66OUR, Style 765A689G07 Control Relays had been replaced in the prior several weeks. Each had been successfully retested after scheduled replacement.
On November 3, 2009, sufficient evidence was available to conclude that each of CIV failures resulted from the failure of the CIV's control relay and that there was a common mode of failure even though the specific cause of the failures have not yet been determined. This common mode of failure led to the the determination that the events were reportable.
November 3, 2009, was established as the discovery date.
�
5. ASSESSMENT OF SAFETY CONSEQUENCES:
The common mode failures of each the 5 CIVs led to a conclusion that in each of the cases, the CIVs had been inoperable for an indeterminate period of time between the retest after replacement and the first subsequent closure demand. Therefore the action requirements of TS LCO 3.6.3 Conditions A and E had not been met to either isolate the affected penetration flow path or shut down and cool down the plant to Mode 5.
In each of the above cases, the containment isolation function for each of the penetrations was preserved because the other CIV for each penetration was OPERABLE. As a result, there was no impact to the health and safety of the public that occurred during those periods. The condition did not result in any challenges to the fission product barriers or result in the release of radioactive materials. The 10 CFR 100 offsite dose criteria were never challenged or exceeded.
The condition did not prevent the fulfillment of any safety function and did not result in a safety system functional failure as defined by 10CFR50.73(a)(2)(v).
6. CAUSE OF THE EVENT:
The Unit 2 SG blowdown sample line CIVs experienced a common-mode failure to close when the respective control relays' contact blocks failed to return to their de-energized position following a closure demand. Each of the relays was in the similar serial number sequence 73222 - # #.
The root cause investigation is on-going. Laboratory inspection and testing of three of the five control relays have not identified the failure mechanism that prevented the control relays from changing state when de-energized. The failures could not be replicated in the laboratory. The other two failed relays have been returned to the vendor for further testing.
An LER supplement will be provided after completion of the root cause evaluation if a cause is identified that would substantially change the reader's understanding of the event.
�
7. CORRECTIVE ACTIONS:
The spare Cutler-Hammer Model ARD66OUR Control Relays relays in the station's warehouse were examined and none were from the 73222 - # # serial number sequence.
The station tested each of the other valves or dampers in safety-related applications in which the same model control relay same serial number sequence is installed. Each of those devices functioned satisfactorily.
Actions to prevent recurrence will be assigned following completion of the root cause investigation if the cause of the relay failures is identified that would substantially change the reader's understanding of the event.
An LER supplement will be provided after completion if the root cause is identified.
8. PREVIOUS SIMILAR EVENTS:
In 1997, 8 failures of Westinghouse ARD66OUR control relays caused failure of the respective solenoid operated valves. The cause of those failures was related manufacturing defects in the epoxy used to fill the relay coil dead spaces. Since the current Cutler Hammer ARD66OLIR relays do not exhibit the same failure mechanism, the corrective actions for those failures would have not prevented the failures reported herein.
0