05000530/LER-2009-001

LER-2009-001, Manual Reactor Trip Due to a Loss of Instrument Air to the Containment Building

Docket Number
Event date:
Report date:
Initial Reporting
ENS 45537	10 CFR 50.72(b)(2)(iv)(B), RPS System Actuation
5302009001R00 - NRC Website

All times are Mountain Standard Time and approximate unless otherwise indicated.

1. REPORTING REQUIREMENT(S):

This LER is being submitted pursuant to 10 CFR 50.73 (a)(2)(iv)(A) to report a manual actuation of the reactor protection system (RPS). This event was reported to the NRC on the Emergency Notification System (ENS) on December 3, 2009, at 07:14. (ENS 45537)

2. DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):

The reactor protection system (RPS) (EIIS: JC) consists of sensors, calculators, logic, and other equipment necessary to monitor selected nuclear steam supply system (NSSS) conditions and to effect reliable and rapid reactor shutdown (reactor trip). The system's functions are to protect the core specified acceptable fuel design limits and reactor coolant system (RCS) (EIIS: AB) pressure boundary for incidents of moderate frequency, and to provide assistance in limiting conditions for certain infrequent events and limiting faults. A manual reactor trip is also provided as part of the RPS to permit the operator to trip the reactor.

The instrument air system (IA) (EIIS: LD) provides a continuous supply of compressed, oil free, filtered, dry air for the operation of pneumatic instrumentation and pneumatic actuators.

IA is provided to the containment (EIIS: NH) building through a single two inch instrument air line. This line includes a containment isolation check valve, which is located inside containment, and a normally open solenoid operated containment isolation valve (3JIAAUV0002) outside of the containment. Power to the solenoid operated valve is from Class 1 E 125 VDC. The solenoid operated valve is normally energized and open. It fails closed on a loss of power and will automatically close on a containment spray actuation signal (CSAS). Manual operation and indication of the valve position is located in the control room.

Valve 3JIAAUV0002 is manufactured by the Target Rock Corporation. When de-energized, the spring force maintains the disc in the closed position. The valve uses differential pressure acting on the disc to exert a force in the same direction as a spring and therefore � sealing the disc against its seat. When the solenoid coil is energized, the magnetic force acting on the solenoid plunger lifts the plunger, stem, and disc against the combined spring and pressure force, opening the valve.

Major components affecting plant operation with the closure of 3JIAAUV0002 while at power are:

• RCP seal bleed-off isolation valve to the VCT closes, redirecting RCP seal bleed-off from the VCT to the RDT.

• RCP seal bleed-off isolation valve to the RDT fails open to allow RCP seal bleed-off to be directed to the RDT through the RCP seal bleed-off safety relief valve.

• RCP seal injection flow control valves fail open.

• RDT outlet containment isolation valve closes removing the operators' ability to pump the RDT.

• Letdown flow to the regenerative heat exchanger isolation valves close isolating letdown.

• Steam generator (SG) #1 blowdown containment isolation valve closes stopping SG blowdown.

• SG #2 blowdown containment isolation valve closes stopping SG blowdown.

• Pressurizer main spray control valves close using auxiliary spray to control reactor coolant system (RCS) pressure.

3. INITIAL PLANT CONDITIONS:

Palo Verde Unit 3 was in Operating Mode 1 (Power Operations) at approximately 100 percent thermal power at the initiation of this event. There were no other major structures, systems, or components that were inoperable at the start of the event that contributed to the event.

4. EVENT DESCRIPTION:

On December 3, 2009, at 03:19, Unit 3 operators received an alarm on PKA-M41, Class 1 E 125 VDC bus. The alarm cleared at 03:29 after an area operator reset the ground device. At 03:40, control room operators received multiple RCP seal bleed-off alarms and noted the RCP seal bleed-off isolation valve to VCT was in an intermediate position and then went fully closed. Operators recognized that the reactor drain tank level and pressure were rising due to RCP seal bleed-off flow being directed to the RDT through a safety relief valve and entered the abnormal operating procedures for the plant condition. At 03:54, the crew attempted to align the RDT containment isolation valve to pump the RDT down but the valve would not open. At 04:05, control room operators noted the instrument air containment isolation valve position indication was no longer lit and the steam generator containment blowdown isolation valves were closed, leading operators to enter 40A0-9ZZ06, Loss of Instrument Air which directs operators to isolate the letdown system and enter 40A0-9ZZ05, Loss of Letdown.

At approximately 04:30 the Shift Manager (SM) and Control Room Supervisor (CRS) evaluated tripping the reactor to prevent overfill of the RDT and/or a breach of the RDT through its rupture disc. The CRS briefed the crew on tripping the reactor, tripping all RCPs, isolating seal bleed-off and completing standard post trip actions (SPTAs). Operators tripped the reactor at 04:31, secured all RCPs and isolated seal bleed-off at 04:32. This was necessary as seal bleed-off can only be isolated with the RCPs secured. At approximately 04:41 the crew completed the SPTAs and entered 40EP-9E007, Loss of Offsite Power/Loss of forced Circulation.

Forced circulation was restored at 10:58 when a temporary modification was installed which aligned nitrogen to the IA system and RCP 1A was started.

5. ASSESSMENT OF SAFETY CONSEQUENCES:

The instrument air system is not required to achieve a safe reactor shutdown or to mitigate the consequences of an accident. Pneumatically operated valves that have a safety function and may be required to operate to ensure safe shutdown of the plant following an accident or to mitigate the consequences of an accident, use a safety related check valve to isolate their safety related pneumatic backup supply from the non-safety related instrument air system.

Other pneumatically operated valves that have a safety function are designed to fail to a safe position upon loss of instrument air and do not require a continuous air supply under emergency or abnormal conditions. This event resulted in a loss of forced circulation and natural circulation was used to control heat removal following the trip. Operators verified all SEQUENTAL REVISIONYEAR �NUMBER NUMBERPalo Verde Nuclear Generating Station 05000530 5 'OF 6Unit 3 2009 -- 001� --� 00 safety function status checks were satisfactory after the trip per 4OEP-9E07, Loss.of Offsite Power/Loss of Forced Circulation, which includes heat removal.

The RCP seals were challenged prior to the trip by redirecting RCP seal bleed-off to the RDT, and post trip when RCP seal bleed-off was isolated after the RCPs were secured.

Engineering evaluated the RCP seals and concluded that no RCP seal operating parameter nor vendor criteria were exceeded. The shaft seals for all four RCPs were determined to have been within their design envelope during the transient. The evaluation also concluded that no further action or corrective maintenance was required prior to returning the seals to operation.

The event did not result in a transient more severe than those previously analyzed in the PVNGS UFSAR, Chapter 15. The reactor trip was not automaticallyinitiated as a result of any of the categories defined in UFSAR Section 15.0.1.2. The Specified Acceptable Fuel Design Limits and reactor coolant system pressUre limit were not exceeded. Equipment and systems assumed in UFSAR Chapter 15 were functional and performed as required. No automatic engineered safety feature (ESF) actuations occurred during the event; and, all safety related buses remained energized from normal offsite power during and following the reactor trip.

There were no actual safety consequences as a result of this condition. The condition would not have prevented the fulfillment of the safety function; and, the condition did not.result in a safety system functional failure as defined by 10 CFR 50.73 (a)(2)(v).

6. CAUSE OF THE EVENT:

The cause of this event was a failure of a coil in solenoid valve 3JIAAUV0002 which isolated instrument air to the containment building. The loss of instrument air to the containment building caused the RCP seal bleed off isolation valve to the VCT to close and led plant operators to the decision to manually trip the reactor, secure all RCPs and secure RCP seal bleed-off.

In addition to the coil failure, a weakness was identified with procedures 40AL-9RK3A, Panel BO3A Alarm Response and 40A0-9ZZ06, Loss of Instrument Air, which did not provide adequate guidance to control room operators to allow for an earlier diagnosis of a loss of instrument air to the containment building.

7. CORRECTIVE ACTIONS:

Immediately following the event, the coil in the failed solenoid valve was replaced. An extent of condition review was performed of solenoid valves that were from the same lot number as the failed solenoid valve. Three valves were found installed in the power plant with the same lot number; but, those valves are normally de-energized and closed and are, therefore, not subjected to conditions similar to the failed coil. The damaged coil was sent to an offsite laboratory for further evaluation.

The following additional corrective actions were or will be implemented for all three units:

• Procedure 40A0-9ZZ06, Loss of Instrument Air, was revised providing instructions to plant operators on required actions when instrument air is lost to the containment building.

• Procedure 40AL-9RK3A will be revised to provide the operator additional information to aid in diagnosis of a loss of instrument air to the containment building in a timely manner.

• Licensed Operator Training and Simulator Training will revise lesson plans to provide additional training on a loss of instrument air to the containment building event.

8. PREVIOUS SIMILAR EVENTS:

Palo Verde Nuclear Generating Station reported a manual reactor trip of unit 2 in LER 529­ 2003-001-00 when a pressurizer spray valve positioner failed causing the maximum amount of air through the positioner. This resulted in a pressure drop in the instrument air system which affected components similar to this event. However, the cause of the previous event was not similar to this event. As such, the corrective actions for that event would not have prevented this event.