ML17311B003

From kanterella
Jump to navigation Jump to search
LER 94-009-01:on 941118,determined That Letdown Isolation Valve Could Not Satisfy 10CFR50,App R Related Requirement. Caused by Personnel Error.Procedure Changes Implemented Which Eliminate Reliance on Isolation Valve During Shutdown
ML17311B003
Person / Time
Site: Palo Verde Arizona Public Service icon.png
Issue date: 06/28/1995
From: Grabo B
ARIZONA PUBLIC SERVICE CO. (FORMERLY ARIZONA NUCLEAR
To:
Shared Package
ML17311A999 List:
References
LER-94-009, LER-94-9, NUDOCS 9507100223
Download: ML17311B003 (16)
v • d • e


Text

LICENSEE EVENT REPORT (LER)

DOCKET NUMBER (2) PAGE (3)

ACIUTYNAME (1)

Palo Verde Unit 1 0 5 0 0 0 5 2 8 1oFO LE(a)

Letdown Isolation Valve Lea ka e Im actOnA end ix R Re uirements EVENT DATE 6 LER NUMBER 6 REPORT DATE OTHER FACIUTIES INVOLVED 6 SEQUENTIAL REVI6ION MONTH FACIUTYNAMES NVMSERS MONTH NUMBER NUMBER NIA 0 5 0 0 0 1 8 9 4 9 4 0 0 9 0 1 0 6 2 8 9 5 N/A 0 5 0 0 0 IS REPORT IS SUBMITTED PURSUANT TO THE REOVIREMENTS OF 10 CFR C (Check one or moro ot Ihe foilovving) (11) 20.402(b) 2(L605(c) 50.73(a)(2)(iv) 73 71(b)

(~

20.605(a)(I)0i 50.30(c)(I) 50.73(a)(2)(0 73.71(c) 50.35(c)(2) 50.73(a)(2)(vii) OTHER bI AbMraH 20.405(a)(I)(a)

LEYEL(10) 0 9 8 20.4)5(a)(I)(~) 50.73(a)(2)(i) 50.73(a)(2)(viii)(A) below and ln TerrL NRC Form D .vbi 20.605(a)(I)(rv) M.73(a)(7)(r0 50.73(a)(2)(n1rj(B) 20 605(a)O)(v) 50.73(a)(2)(ri0 5073(a)(2)IX) Volunta LER UCENSEE CONTACT FOR TI6S LER (I 2)

E NUMBER E

Burton A. Grabo, Section Leader, Nuclear Regulatory Affairs 6 0 2 3 9 3 - 6 4 9 2 COMPLETE ONE UNE FOR EACH COMPONENT FAILURE DESCRIBED W TIBS REPOR T(13)

COMPONENT MANVFAC REPORTABLE;;~i; ',:ii.'-.",'.1, 3'AUSE SYSTEM COMPONENT MANUFAG.

TURER REPORTABLE TO NPROS j>> Yr~v"(>~~Qp$ "

B C B SUPPLEMENTAL REPORT EXPECTED(la) EXPECTED

~ ~~

SUBMISSON DATE (15)

YES 01 Yea, oom plate EXPECTED SUBMISSON DATE) gyes vr NCO pecos, I ~, I ~ ~) ( I'i)

On November 18, 1994, at approximately 1245 MST, Control Room personnel determined that letdown isolation valve 1JCHBUV0515 could not satisfy its 10CFR50 Appendix R related requirement to isolate letdown flow from the remote shutdown panel 40 in the event of a Control Room fire, with an existing leakage of gallons per minute (gpm). The valve leakage was firstthe identified on Appendix December 8, 1992, but plant personnel overlooked 10CFR50 R related requirement of the valve until noted by the NRC resident inspectors.

During the evaluation of this event also overlooked applicable it was determined that plant Technical Specification personnel an Interpretation (TSI) for the Remote Shutdown System.shutdown This TSI requires the components associated with the remote control circuits to be OPERABLE to meet the bases of Technical Specification 3.3.3.5.

Procedure changes were implemented which eliminated the reliance on 1JCHBUV0515 during remote shutdowns.

There have been no previous similar events reported pursuant to 10CFR50.73 in the last three years.

9507100223 'II50b28 PDR ADOCK 05000528

LlCENSEE EVENT REPORT (LER) TEXT CONTINUATlON DOCKET NUMBER LER NUMBER PAGE YEAR Palo Verde Unit 1 0 5 0 0 0 5 2 8 9 4 -'0 0 9 0 1 0 2oF 0 8 1~ EVENT CLASSIFICATION:

This LER is being submitted as an information type LER (i.e., Voluntary LER) because of the potential adverse effects of letdown isolation valve leakage on 10CRF50 Appendix R requirements. Although there have been no 10CFR50.73 reporting requirements identified, APS believes the information provided in this voluntary LER merits disclosure to the nuclear industry.

Specifically, Technical Specification (TS) Surveillance Requirement (SR) 4.3.3.'5 states, "The Remote Shutdown System

[(IU)] shall be demonstrated operable: by operation of each remote shutdown system disconnect switch and power and control circuit including the actuated components at least once per 18 months." Letdown isolation valve 1JCHBUV0515 (CB)(ISV) satisfied this TS SR through successful completion of stroke time and position indication testing. However, since TS Limiting Condition for Operation (LCO) 3.3.3.5 does not require the component (i.e., V515) to be able to perform its safe shutdown function, TS LCO 3.3.3.5 was not violated.

In addition, TS LCO 3.3.3.5 ACTION c. states that the provisions of TS 3.0.4 are not applicable, which would have permitted startup within the bounds of the Limiting Condition for Operation.

2 ~ EVENT DESCRIPTION On November 18, 1994, at approximately 1245 MST, Palo Verde Unit 1 was in Mode 1 (POWER OPERATION), operating at approximately 98 percent power, when Control Room personnel determined that 1JCHBUV0515 (V515) could not satisfy its 10CFR50 Appendix R related requirement to isolate letdown flow from the remote shutdown panel (IU) in the event of a Control Room fire, with an existing leakage of 40 gallons per minute (gpm). The valve leakage was first identified on December 8, 1992, but plant personnel overlooked the 10CFR50 Appendix R related requirement of the valve until noted by the NRC resident inspectors.

During the evaluation of this event also overlooked it was determined that applicable Technical plant personnel an Specification Interpretation (TSI) for the Remote Shutdown System. This TSI requires the components associated with the remote shutdown control circuits to be OPERABLE to meet the bases of TS 3.3.3.5.

ll LICENSEE EVENT REPORT (LER) TEXT CONTINUATION DOCKET NUMBER LER NUMBER PAGE YEAR R NUMBER Palo Verde Unit 1 0 5 0 0 0 5 2 8 9 4 0 0 9 0 0 3 OF 0 '8 Prior to the event on December 8, 1992, Unit 1 was in Mode 3

{HOT STANDBY) following a reactor {AB) trip (LER 529/92-016) when a reactor operator (utility, licensed) observed that letdown flow was indicated by control board instrumentation (IU)(FI), while valve controls 'indicated the valve was in the closed position. The through-seat leakage was quantified at approximately 20 gpm. Corrective maintenance was scheduled to be completed during the fourth refueling outage (1R4). Unit 1 returned to Mode 1 at approximately 0616 MST on December 10, 1992 and was synchronized to the grid at 1524 MST on December 10, 1992.

On September 25, 1993, Unit 1 was defueled during refueling outage 1R4, when local leak rate testing (LLRT) was performed on the Containment Letdown Penetration (NH)(PEN).

V515 was used during this test to isolate reactor coolant (AB) and maintain test pressure while containment isolation valve 1JCHAUV0516 (V516)(BD)(ISV) was tested. Due to the satisfactory completion of the LLRT, it was indeterminate as to whether V515 was in fact leaking, since it had been successfully used to maintain test pressure and no difficulty had been experienced in either draining or pressurizing the common line.

On October 22, 1993, Unit 1 was in Mode 6 (REFUELING) when APS personnel (Operations, Maintenance, Outage Planning, and Engineering) met to address V515's leakage. A review of the Updated Final Safety Analysis Report (UFSAR), the Combustion Engineering System Safety Analysis Report (CESSAR), and design documentation was performed and it was concluded that, the functional requirements of V515 were to remain open during normal operation, to close upon receipt of a Safety Injection Actuation Signal (SIAS)(BP/BQ)(JE), and to isolate flow in the event of a letdown line break. APS personnel determined that adequate isolation would be provided by V516 in the event of a SIAS and a letdown line break, and they agreed to test V515 at normal operating pressure (NOP) to determine it if the leak still existed. As part of the plan, was decided that if test'ing at NOP confirmed the valve leaked, corrective maintenance would be performed during the next refueling outage, 1R5.

41 LICENSEE EVENT REPORT (LER) TEXT CONTINUATION ACN/lYNAME DOCKET NUMBER LER NUMBER PAGE YEAR Palo Verde Unit 1 5 0 0 0 5 2 8 9 4 0 0 9 0 1 0 4oF0'8 On November, 20, 1993, Unit 1 was in Mode 3, when V515 was tested at NOP in accordance with approved surveillance procedures. The test indicated that V515 had a leak rate of approximately 40 gpm. Following the test, an additional review of the design bases and TS was performed by APS personnel and no issues were identified which discredited the decision to resume plant start up. Unit 1 achieved Mode 1 on November 25, 1993, and was synchronized to the grid on November 26, 1993.

On January 17, 1994, Unit 1 was in Mode 1, when an increase in the letdown heat exchanger (CB)(HX) outlet temperature caused an automatic closure of V515. Control Room personnel again noted that letdown flow existed with V515 closed and consulted with Engineering personnel who concluded that the functional requirements of V515 were still being met, and still considered the valve operable.

On October 13, 1994, Unit 1 was in Mode 1, when an NRC resident inspector inquired as to what justification allowed a plant start up to- occur with V515 leaking by its seat at approximately 40 gpm. An operability determination was performed in accordance with approved APS procedures which documented the review of the design basis. The previous justification remained in tact.

On November 18, 1994, Unit 1 was in Mode 1, when NRC resident inspectors contacted the Unit 1 Shift Technical Advisor (STA) and asked if V515 could be credited to isolate letdown flow from the remote shutdown panel (RSP), given the 40 gpm leak rate. The inspectors had noted that V515 was credited in an approved procedure to remotely isolate letdown flow in the event of a control room fire, and questioned the applicability of TS 3.3.3.5, REMOTE'HUTDOWN SYSTEM.

Following discussions with the NRC inspectors, APS personnel agreed that V515 was not capable of satisfying its remote safe shutdown requirement. A conservative entry into TS 3.3.3.5 Action b was made. To satisfy the TS requirement, a procedure change was promptly made to provide guidance to isolate the control room circuitry from V516 in the event of a control room fire and ACTION b of TS 3.3.3.5 was satisfied.

0 0 1

LICENSEE EVENT REPORT (LER) TEXT CONTINUATION DOCKET NUMBER LER NUMBER PAGE YEAR R NUMBER NUMBER Palo Verde Unit 1 0 5 0 0 0 5 2'8 9 4 0 0 9 0 1 0 5 OF 0 8 The previous evaluations did not consider the impact of the V515 leakage on the Remote Shutdown System since the leakage did not affect the disconnect switches, power or controls, or monitoring instrumentation as specified in TS 3.3.3.5.

An existing TSI 3.3.3.5-13-01-00, "Remote Shutdown System Operability Control Circuits" was overlooked during the design documentation reviews. The TSI states that "the component associated with the remote shutdown control circuit,...is required to be reviewed, OPERABLE to meet the bases of 3.3.3.5." Had this TSI been and had there been an understanding of the fire protection function of the valve, APS personnel would have recognized that through-seat leakage for V515 would have impacted the current Appendix R evaluation for PVNGS.

There were no safety system responses and none were necessary.

3. ASSESSMENT OF THE SAFETY CONSEQUENCES AND IMPLICATIONS OF THIS EVENT:

There were no significant safety concerns related to this event for a fire outside of the control room since there is no fire zone where a fire could have disabled both V516 and Containment Letdown Isolation Valve 1JCHBUV0523 (V523) (CB)

(ISV), either of which had the capability to isolate letdown flow.

There was no significant safety concerns related to this event in that during a control room fire, letdown would have isolated automatically when operations personnel, following approved procedures, would have stopped nuclear cooling water pumps (CC)(P), causing an automatic isolation of letdown by valve V523.

Prior to July, 1993 procedures did not include instructions to isolate nuclear cooling water pumps, which would change the scenario in the following manner. If Operations personnel did not recognize the through-seat leakage of V515, there would have been adequate time (8.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />) and technical support to identify an alternate method of isolating letdown flow and providing additional make-up capability to the Reactor Coolant System (RCS).

il II 4l

LICENSEE EVENT REPORT (LER) TEXT CONTINUATION ACVlYNAME DOCKET NUMBER LER NUMBER PAGE yEAR SEQUENTIAL EVISIO NUMBER NUMBER Palo Verde Unit 1 0 5 0 0 0 5 2 8 9 4 - 0 0 9 - 0 1 0 6o"0 8 The event did not result in any challenges to the fission product barriers or result in any releases of radioactive materials. Therefore, there were no adverse safety consequences or implications as a result of this event.

This event did not adversely affect the safe operation of the plant or the health and safety of the public.

4 ~ CAUSE OF THE EVENT:

An investigation performed in accordance with the APS Incident Investigation Program determined that the cause of the event was due to Operations and Engineering personnel overlooking the 10CFR50 Appendix R requirement associated with V515 (SALP Cause Code A: Personnel Error).

The cause of the failure to identify the 10CFR50 Appendix R related requirement of the valve was due to an inadequate review by Engineering and Operations personnel of the Appendix R fire protection requirements for V515. In addition, the failure to apply the TSI requirement and the misunderstanding of the fire protection requirement function of the valve contributed to a missed opportunity to recognize that seat leakage for V515 had an impact on the current Appendix R evaluation for PVNGS.

No unusual characteristics of the work location (e.g.,

noise, heat, poor lighting) directly contributed to this event. There were no procedural errors identified.

5. STRUCTURES g SYSTEMS I OR COMPONENT INFORMATION Letdown Isolation valve 1JCHBUV0515 is a pneumatically actuated 2 inch globe valve manufactured by Fisher Controls Company Incorporated, model number 667-DBQ.

Unit 1 Letdown Isolation Valve 1JCHBUV0515 was first identified by Control Room personnel to be leaking by at a rate of approximately 20 gpm on December 8, 1992.

Subsequent test results indicated the leak rate to be as high as 40 gpm.

~, :C LICENSEE EVENT REPORT (LER) TEXT CONTINUATION DOCKET NUMBER LER NUMBER PAGE YEAR Palo Verde Unit 1 0 5 0 0 0 5 2 8 9 4 0 0.9 0 1 0 7 OF 0 8 NRC resident inspectors identified the 10CRF50 Appendix R related requirement of V515 during routine inspections, on or about November 18, 1994, and notified APS Operations and Engineering personnel.

The cause of the valve leakage has not been conclusively determined. Diagnostic testing of the valve will be completed during 1R5 scheduled to be completed by June 10, 1995. Recent testing has indicated that the valve will isolate flow at approximately 500 pounds per square inch absolute (psia), but leaks at approximately 2250 psia.

Engineering personnel have determined that the bench setup of the valve operator spring force is the most likely cause of the through-seat leakage.

The failure mode of V515 is through-seat leakage at NOP.

The mechanism of the failed component is,not fully understood at this time, however, the bench setup of the valve operator spring force is the most likely cause of the through-seat leakage. The effect of through-seat leakage is that the valve cannot be relied upon to remotely isolate letdown flow in the event of a control room fire.

Zn addition to the 10CFR50 Appendix R related requirement to isolate letdown flow from the remote shutdown panel, V515 is designed to remain open to provide letdown flow during normal operations, to close upon receipt of a SZAS, and to isolate a letdown line break.

The requirement to remotely isolate letdown flow in the event of a Control Room fire could have been satisfied by crediting V516 with closure. V516 also receives a SIAS.

flow in Both V516 and V523 were available to isolate letdown the event of a letdown line break.

No Failures that rendered a train of a safety system inoperable were involved.

II 0

4'

LICENSEE EVENT'REPORT (LER) TEXT CONTINUATION ACIUIYNAME DOCKET NUMBER LER NUMBER PAGE YEAR SEQUENTIAL EVIBIO NUMBER NUMBER Palo Verde Unit 1 0 5 0 0 0 5 2 8 9 4 - 0 0 9 - 0 1 0 8oFO 8

6. CORRECTIVE ACTIONS TO PREVENT RECURRENCE:

A procedure change was implemented which provided direction to isolate the control room circuitry from valves V516 and V523 in the event of a control room fire, thereby removing the reliance on V515 for this function. A list of Appendix R equipment, calculations, and analyses was made available in the Control Rooms.

A review of active operability determinations was performed to identify if others existed which did not evaluate the impact on fire protection commitments, including Appendix R related requirements. None were identified.

Additional actions to prevent recurrence are being tracked under the Commitment Action Tracking System. These actions included:

~ Operations personnel will receive training on the requirements of Appendix R.

~ A root cause of failure analysis and corrective maintenance will be performed for V515.

7. PREVIOUS SIMILAR EVENTS:

No other previous events have been reported pursuant to 10CFR50.73 which involved the same cause and events.

ADDITIONAL INFORMATION:

APS Probability/Risk Assessment (PRA) personnel reviewed the impact of the 40 gpm letdown isolation valve leak on the calculated Interfacing Systems Loss Of Coolant Accident (ISLOCA) outside containment (V-sequence)- frequency. The review revealed that a 40 gpm leak would not be a V-sequence concern, as it is within the capacity of one charging pump to provide makeup and the inventory in the Refueling Water Tank would provide adequate time to shutdown and depressurize should a break outside containment occur.

This review considered the effects of a 40 gpm leak and not a catastrophic failure of V515.

0

Retrieved from "https://kanterella.com/w/index.php?title=ML17311B003&oldid=2427855"