ML20151Y487
| ML20151Y487 | |
| Person / Time | |
|---|---|
| Site: | Portsmouth Gaseous Diffusion Plant |
| Issue date: | 09/15/1998 |
| From: | Jonathan Brown UNITED STATES ENRICHMENT CORP. (USEC) |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| GDP-98-2042, IEB-91-001, IEB-91-1, NUDOCS 9809180252 | |
| Download: ML20151Y487 (14) | |
Text
.o USEC
. A Global Energy Company September 15,1998 GDP 98-2042 United States Nuclear Regulatory Commission Attention: Document Control Desk Washington, D.C. 20555-0001 Portsmouth Gaseous Diffusion Plant (PORTS)
Docket No. 70-7002 Event Report 97-21, Revision 2 Event Report 97-22, Revision 2 Event Report 98-05, Revision 2 The subject event report revisions are being submitted :' identify that more than one reporting criterion was met as a result of these events. These events were origmally reported as autoclave safety system failures in accordance with 10 CFR 76.120(c)(2). Since these autoclave safety systems are credited as criticality controls, their failure is also reportable in accordance with NRC Bulletin 91-01. This information was not provided when the original event notifications were made.
Changes from the previous reports are marked with a vertical line in the right margin. Enclosures 1,2, and 3 are the revised Event Reports. Enclosure 4 is the List of Commitments for Event Report 98-05, Revision 2.
Should you require additional information regarding this events, please contact Scott Scholl at (740) 897-2373.
Sincerely, pp/na J. Morn,s Brown General Manager Portsmouth Gaseous Diffusion Plant
Enclosures:
As Stated f
b
)
d cc:
' NRC Region III Office NRC Resident Inspectors - PORTS 9909100252 990915 PDR ADOCK 07007002 C
PDR r
,s P.O. Box 800, Portsmouth, OH 45661 Telephone 740-897-2255 Fax 740-897-2644 http://www.usec.com Offices in Livermore, CA Paducah,1G' Portsmouth, OH Washington, DC I
GDP 98-2042 Page1of3 Event Report 97-21 Revision 2 Description of Event On' October 22,1997, at 0635 hours0.00735 days <br />0.176 hours <br />0.00105 weeks <br />2.416175e-4 months <br />, X-343 Autoclave (AC) #7 was in Mode II, heating a 14-ton Uranium Hexafluoride (UF ) Tails cylinder when the audible alarm for steam shutdown was received. The cylinder had been heating for approximately one hour when the actuation occurred.
The Operator responding to the alarm noticed the Low Cylinder Pressure Shutoff (LCPS) safety system had actuated, causing the steam supply valves to AC #7 to close. The operator also noted that PI-705A indicated an internal UF cylinder pressure of-50 psia. The LCPS is designed to 6
actuate if the internal cylinder pressure has not reached 20 psia after one hour of heating. Since a reading of-50 psia indicated the instrument loop had malftmetioned, the operator opened the local instrument cabinet to investigate the failure. When the door to the cabinet was opened, the door movement caused the instrument reading to change to 61.7 psia, which was the expected cylinder pressure. The steam supply valves to the autoclave then opened and cylinder heating resumed automatically as designed. The operator immediately initiated steam shutdown utilizing the local steam isolation controls to place the autoclave in a shutdown condition until the cause of the actuation could be determined.
The initial engineering review of the actuation concluded that the LCPS actuation was caused by an invalid low pressure signal and was not reportable. Further investigation into the cause of the failure of PI-705A revealed that the pressure transducer providing the signal to PI-705A had failed.
Engineering determined that the failed pressure transducer also rendered the UF. Cylinder High Pressure Autoclave Steam Shutoff (CHPASS)' safety system inoperable, since the pressure transducer also provides the signal for this safety system. Following the discovery of this i
information, it was determined that the failure of the AC #7 CHPASS safety system was reportable i
in accordance with 10 CFR 76.120(c)(2).
i The failure of the CHPASS system is also reportable in accordance with NRC Bulletin 91-01. The i
CHPASS system provides one of two criticality controls relied on to maintain double contingency i
where the potential to introduce excess moderation into the autoclave from an incoming cylinder i
exists. In the unlikely event that the first control on UF. impurity content is not maintained during i
cylinder filling, excess Hydrogen Fluoride (HF), a moderator, could be present in the cylinder. The i
CHPASS system provides a second control because the additional cylinder pressure caused by the i
presence of excess HF will cause the CHPASS to interrupt the heating cycle before a cylinder i
rupture occurs. In this event, the first criticality control was maintained. The cylinder cold pressure i
check, which was done prior to cylinder heating, provided assurance that there were no excess i
impurities in the cylinder which could cause cylinder over pressurization during heating.
i
_~ _
t 4
GDP 98-2042 Page 2 of 3 Event Report 97-21 Revision 2 Cause of Event The direct cause of the event was a failed pressure transducer. The 24-VDC pressure transducer, i
model number PIT /3-15PSIG/4-20MA/12-42DC, manufactured by Moore Industries converts a i
pneumatic signal of 3-15 psia to a current signal of 4-20 mA. Since the loop is wired in series, i
when the 4-20 mA current from the pressure transducer is lost, it renders the loop inoperable.
i The root cause of event was a random failure of the pressure transducer module. The module consists of a printed circuit board encased in a plastic hwsing. The unit has two electrical screw terminals anchored to the housing and soldered to the printd circuit board. Engineering analysis determined that the solder on the positive side of the transduce circuit board had separated. There was no evidence that the unit had been mishandled or that the failure was caused by too much stress on the connection.
The manufacturer of the device was contacted to determine if the failed solderjoint could have been caused by a fabrication problem that resulted in an improper solder connection. The manufacturer indicated that this device has experienced a low failure rate of 0.13 percent. As a result, engineering believes this failure to be an isolated occurrence. This module-and approximately 45 others have been in service for 15 years with no known failures of this type.
Based on this information, engineering has determined that these modules are acceptable for continued use.
Corrective Actions 1.
On October 28,1997, the pressure transducer was replaced and the loop calibrated.
Extent of Exposure ofIndividuals to Radiation or Radioactive Materials There were no exposures to individuals from this incident to radiation or radioactive meterials.
Lessons Learned When this event occurred, it was not immediately recognized that a -50 psia pressure indicator reading could be an indication that the pressure transducer or pressure transmitter had failed. An engineering evaluation determined that the -50 psia reading is the default condition when a pressure indicator loses its input signal. The loss of the input signal could be caused by any failure of the cylinder pressure loop, including a malfunctioning pressure transmitter or transducer. As a result of the pressure loop design, any failure of the pressure loop will not generate an alarm until the
I-l GDP 98-2042 Page 3 of 3-l Event Report 97-21 Revision 2 LCPS actuates after one hour of heating. Operators were not aware of this design feature and did. t not immediately recognize that the CHPASS safety system was inoperable.
i i
I' l
r.
n a
GDP 98-2042 Page1of4 Event Report 97-22 Revision 2 Description of Event On October 25,1997, at 1800 hours0.0208 days <br />0.5 hours <br />0.00298 weeks <br />6.849e-4 months <br />. X-344 Autoclave (AC) #3 was in Mode II, heating a Uranium i
Hexafluoride (UF ) cylinder. The cylinder had been heating for approximately 25 minutes when 6
the operator noted that pressure indicator PI-165 indicated an internal UF cylinder pressure of-50 6
- psia. Since a reading of -50 psia indicated the instrument had malfunctioned, the operator immediately initiated steam shutdown manually, utilizing the local steam isolation controls to place.
the autoclave in a shutdown condition until the cause of the -50 psia instrument indication could be determined.
After the faulty PI-165 reading was first observed on October 25,1997, Maintenance personnel initially observed that PI-165 was reading the expected pressure when they arrived to investigate.
Maintenance personnel checked the instrument loop and determined that the "as-found" instrument readings for the loop were within tolerance. W9'e Maintenance personnel were performing closeout activities they noticed that the PI-165 cylinder pressure. PI-169 sample loop pressure and PI-186 manifold pressure were all reading -50 psia. Further investigation indicated that the power
. cord to the transducer cabinet, which supplies power to all three systems, was loose. The plug was tightened and all PI readings returned to nonnal. Maintenance personnel believed that the loose power cord was the cause for the faulty PI readings. Operations then performed the Cylinder High Pressure Test and Cylinder Low Pressure Test successfully and returned the autoclave to service.
On October 27,1997, Operations Management recognized that the condition that caused the erroneous reading on PI-165 may have also caused the UF, Cylinder High Pressure Autoclave -
Steam Shutoff (CHPASS) safety system to be inoperable. A similar pressure indicator failure at X-343 AC #7 had occurred on October 22,1997, and caused the CHPASS to be inoperable (reference Event Report 97-21 Rev 2). Since investigation activities were unable to determine if the CHPASS would still function with the identified deficiencies, it was determined that the system may not have been able to perform its design function as a result of this event. The failure of the CHPASS safety system is reportable in accordance with 10 CFR 76.120(c)(2).
The failure of the CHPASS system is also reportable in accordance with NRC Bulletin 91-01. The CHPASS system provides one of two criticality controls relied on to maintain double contingency i
where the potential to introduce excess moderation into the autoclave from an incoming cylinder i
exists.! In the unlikely event that the first control on UF. impurity content is not maintained during i
cylinder filling, excess Hydrogen Fluoride (HF), a moderator, could be present in the cylinder. The i
CHPASS system provides a second control because the additional cylinder pressure caused by the i
presence of excess HF will cause the CHPASS to interrupt the heating cycle before a cylinder i
rupture occurs. In this event, the first criticality control was maintained. The cylinder cold i
GDP 98-2042 Page 2 of 4 Event lleport 97-22 Revision 2 pressure check, which was done prior to cylinder heating, provided assurance that there were no i
excess impurities in the cylinder which could cause cylinder over pressurization during heating, i
The CHPASS system is a single channel system. The heating of a UF cylinder containing an 6
excessive amount of ' light' gases at normal heating temperatures could result in the intemal cylinder pressure exceeding the hydrostatic test pressure and possibly create a UF release in the 6
autoclave. The safety system function of the CHPASS ensures the pressure in the cylinder does not exceed the maximum allowable working pressure of the lowest rated cylinder that could be heated in the autoclave. The UF cylinder pressure instrument loop is required to alarm if the 6
cylinder pressure at any time reaches 115 psia.
Cause of Event The direct cause of the event was inadequate electrical connections between the pressure transducer and the CHPASS safety system circuitry.
During investigation activities conducted by Maintenance and Engineering, it was observed that movement of the wiring and tem 1inal strip that connects the pressure transducer to PI-165 caused the PI to read -50 psia. This terminal strip also provides the connections between the pressure transducer and the CHPASS circuitry. Although it is not known for certain that the loose electrical connections affected the CHPASS circuitry, the investigation was not able to prove that the CHPASS was operable when this condition was discovered. As a result, it was conservatively determined that the loose wiring could have prevented the CHPASS from performing its design function.
PI-165 is the pressure indicator for cylinder pressure on X-344 AC #3. The cylinder pressure loop contains a pressure transmitter, a pressure transducer, a pressure indicator, and high and low pressure switches. The pressure transmitter is located on the UF drain linejust outside the head 6
of the autoclave. The pressure transmitter converts UF pressure to a mV signal. The pressure 6
transducer converts the mV signal to a mA signal and consist of two cards. One card converts the mV signal to 0-5 Volts DC. The other card converts 0-5 Volts DC to 4-20 mA and contains the high and low pressure switches. The pressure indicator converts the mA signal to a pressure reading in psia.
Engineering determined that a -50 psia reading on PI-165 was a result of a signal loss to the Pl.
The PI design is such that it interprets a 0 mA reading as -50 psia. The signal loss can result from inadequate electrical connections from the transducer to the PI, signal loss within the transducer, a loss of signal within the pressure transmitter or a power loss to the pressure transducer.
The loss of power to the transducer was climinated as a possible cause because the CIIPASS did
_.____.. _...~..
\\
l
{
l GDP 98-2042 Page 3 of 4 f
Event Report 97-22 Revision 2 not alarm when the faulty PI-165 reading was first observed. The design of the system will cause an alarm if power is lost. The pressure transmitter was also eliminated as a cause because the l
transmitter performed as. designed through all pressure ranges during testing. The transmitter is a mechanical device and any failure of the transmitter would be repeatable.
During the investigation Engineering and Maintenance observed that jiggling the wiring and l
terminal strips that connect the transducer to PI-165 would cause the readings to change from -50 psia to the expected reading. The associated wiring was re-terminated and the two transducer
_ boards were replaced as a precautionary measure. After calibration was performed on the 1
equipment, PI-165 was again observed to read -50 psia. Since replacement of the transducer cards did not correct the problem, it was suspected that the problem was caused by faulty electrical connections.
l 1
The root cause for the event was determined to be inadequate design of the transducer housing mounting which resulted in faulty electrical connections. During the investigation it was noted that the transducer housing was placed on a small pedestal without any method of attachment. To access the tenninal strips on the transducer, the housing is turned or rotated on the pedestal. It was observed that when the transducer was rotated, erroneous readings were obtained on PI 165.
The lack of permanent mounting also allowed stress to be placed on the terminal strips. The wires exit from the bottom of the housing such that the weight of the housing is allowed to exert force on the wires. This creates stress on the wires that can degrade the electrical connection. The transducer cards also plug into the terminal strip and could be affected by movement of the wires.
With this type of arrangement, any movement of the transducer housing can afTect the integrity of the electrical connections. Since the transducer connections are part of the CHPASS safety system,it was concluded that the CIIPASS may have been affected by this deficiency.
j An engineering walkdown was conducted to detennine if this mounting deficiency exists at other H
autoclave installations. No additional mounting problems were noted.
- Corrective Actions 1.
The autoclave cylinder pressure transducer cards and terminal strip connecting the transducer to PI-165 were replaced. Pressure indicator PI-165 and its associated wiring L
were replaced. These actions were completed by October 30,1997.
l
_ 2.
_ On October 30,1997, the pressure transducer housing was temporarily mounted to the pedest:1 table to prevent inadvertent movement and to prevent the housing from exerting l
- =-C uu
-r
. 4.
q y
r gww.--.
9--.-
e p_r
.rwr-9 e^M,-
y w-
GDP 98-2042 l
Page 4 of 4 i
i force on the wires and terminal connections.
3.
On February 4,1998, a design modification was completed to provide a permanent mounting of the UF6 cylinder pressure transducer housing.
4.
By March 26,1998, a design modification will be installed to provide pemianent mounting i
of the UF cylinder pressure transducer housing. This action was completed on February 6
i 4,1998.
i Extent of Exposure ofIndividuals to Radiation or Radioactive Materials There were no exposures to individuals from this incident to radiation or radioactive materials.
1 Lessons Learned Safety systems must be properly mounted and secured to ensure they will remain capable of performing their design f,metion.
1 I
1 l
l 1
l l
l
l..
GDP 98-2042 Page 1 of 5 Event Report 98-05 I
Revision 2 Description of Event On April 9,1998, at 1300 hours0.015 days <br />0.361 hours <br />0.00215 weeks <br />4.9465e-4 months <br />, while in Mode VII Shutdown, Operations personnel were performing a functional check on Autoclaves #1 and #2 in the X-342 facility. In response to a NRC inquiry concerning the adequacy of containment valve surveillance testing, the operator
. performed a containment isolation valve closure functional check with the normal plant air supply isolated. The purpose of this functional check was to verify that containment isolation valves were capable of closing with the safety related backup air supply.
The checks demonstrated that several valves on Autoclave #1 and #2 failed to close as designed when the normal plant air supply was valved off. At the time of this discovery, it was not known if the redundant containment isolation valves in the affected penetrations were operable during the time period that the backup air supply was degraded. As a result, the failure of the containment isolation valves to close on demand under a simulated loss of the non-safety related plant air supply was reported in accordance with 10 CFR 76.120(c)(2).
i This event is also reportable per NRC Bulletin 91-01. The autoclave containment isolation i
system provides one of two criticality controls relied on to maintain double contingency where
-the potential for uranium to escape from the autoclaves and accuroulate in an unsafe i
configuration exists. The second criticality control consists of the engineering controls relied i
on to prevent a major release of UF inside the autoclave. Each control is adequate to i
6 independently prevent uranium from accumulating-in an unsafe configuration outside the i
autoclave. 'In this event, the second criticality control was maintained. A major release of UF6 i
inside the autoclave did not occur.
i The containment valves that failed to close use air-to-open, air-to-close actuators. These actuators are connected to air reservoirs that supply closing air pressure if the normal plant air supply is lost. Air leaks within the containment valve air reservoir systems allowed the backup air pressure to fall below the pressure required to close the valves. Both of these autoclaves were inoperable at the time of discovery. All autoclaves on plantsite were declared inoperable until Operations could determine whether this condition existed on other autoclaves in the X-343 and X-344 Buildings.
l The X-342, X-343, and X-344A autoclave facilities are equipped wita a total of 13 autoclaves.
The X-342 is equipped with two feed and sample (84-inch) autoclaves. The X-343 is equipped L
with four feed (72-inch) autoclaves and three feed and sample (84-inch) autoclaves. The X-344A l
is equipped with four sample and transfer (96-inch) autoclaves. Each of these autoclaves is equipped with an Autoclave High Pressure Containment Shutdown System (AHPCSS), as I
[
GDP 98-2042 l
Page 2 of 5 l
l Event Report 98-05 l
Revision 2 described in TSR Section 2.1.3.5. The autoclave facilities are equipped with a total of 233 l
AHPCSS containment isolation valves. Actuation systems for these containment valves can be j
divided into two different types: spring-to-close and air-to-close. Spring-to-close actuation systems are employed on 160 of the 233 AHPCSS containment isolation valves. The remaining 73 AHPCSS containment isolation valves are air-to-close (ATC) and rely on " backup" air systems to close the valve on loss of plant air or on loss of plant air and receipt of a containment signal. The actuation systems for the ATC valves can further be divided into three types based on design and service, including: pilot operated, shell vent, and parent cylinder safety valve (PCSV).
A test procedure was initiated to determine if any other air-to-close autoclave containment valves would fail to close without normal plant air pressure available. As of September 14, 1998, 70 i
of the 73 containment isolation valves have been tested on 13 different autoclaves. Three as-i found tests were performed on the pilot operated actuation systems. These systems were i
- functionally tested under normal plant air conditions, closure with loss of air, and containment with low air pressure (55 psig). Valve closure and closure times were noted or recorded for each test. Any leaking components were replaced and as-left data was taken. For acceptance, valves were required to close in less than 15 seconds for containment at normal air pressure, close in less than 15 seconds for containment with low air pressure, and close with loss of air.
Components of the actuation air system were tested for zero leakage, including the removal and leak testing of the check valve. As-found testing for the shell vent and PCSV actuation systems involved testing for containment at low air pressure (55 and 45 psig, respectively). The components of these actuati. n systems were checked for leakage, including the removal and leak testing of check valves. Acceptance criteria for these systems were based on their ability to
- close within 15 seconds repeatedly. Any leaking components were replaced and as-left data was i
taken. Of the 70 valves tested to date,42 of these valves have passed and 28 valves failed either i
. the loss of air, the low air pressure test, or both tests.
i The backup air systems have been repaired and the failed valves have been tested satisfactorily
, for all autoclaves that have been returned to service. The backup a systems will be tested and repaired prior to returning the remaining autoclaves to service, Engineering performed a review to determine if there were any other plant systems which utilize i
(
'the air-to-close valve design in "Q" safety system applications ine review identified that similar air-to-close valves were installed in the ERP, LAW ano Tails Withdrawal stations.
l~
Testing was conducted on these valves and all passed satisfactorily. There were two additional i
valves identified in the X-705 calciner system. Following an extended outage, the calciner
,;(..
GDP 98-2042 Page 3 of 5 Event Report 98-05 Revision 2 l-valves were tested on June 8,1998, prior to startup and passed satisfactorily. Engineering has also initiated a review to verify that other TSR safety systems and their supporting systems are i
adequately tested to verify performance of their intended safety function.
An engineering evaluation of the event was performed. The evaluation found there was no impact to safety since with a loss of plant air, the autoclave automatically shuts down and l
containment is not required. With normal plant air available, the containment system would l
have closed the valves. There was no credit taken in the TSR bases statements for closure of valves on loss of normal air. -No design basis accident assumes loss of air concurrent with a cylinder rupture in an autoclave.
Cause of Event The direct cause of the event was leaking autoclave backup air reservoir systems. When the plant air supply was valved off during testing, leaks in the air reservoir systems allowed the air pressure to drop on some of the systems to the point where the valves would no longer close.
l The root cause of the event was failure to identify and develop testing and surveillances that verify the intended safety functions of the air tanks. During the development of the SAR, i
personnel identified testing and surveillances for those safety systems identified in the SAR and
)
TSR. During this effort, the testing and surveillances for the autoclave backup air reservoir systems were not identified. A review of testing performed on air-to-close containment isolation l
~ valves indicated that quarterly surveillance testing only verified that at normal operating air pressure containment valves close upon receipt of a containment signal. The simulated loss of the non-safety related plant air system was not included in the quarterly surveillance testing.
A contributing cause of the failure to properly test and maintain the air-to-close containment valves was failure to develop and implement appropriate corrective actions for an event which occurred in 1996 during the transition from DOE to NRC regulation.
Event Report l
PTS-1996 0023 " Performance Degradation of Autoclave Safety Valves at X-344 Toll Enrichment Facility," describes an event where two PCSV failed to close during an inadvertent l
containment actuation on Autoclaves #2 and #3 in X-344 Building. As part of the corrective l:
action plan, Engineering was tasked to review the actuator / air supply system and develop a
(
corrective action plan to track implementation of any required changes. The engineering cvaluation provided recorranendations for only the autoclave actuator / air supply systems. It did not evaluate the actuator / air supplies across the plant. The corrective action plan did not i-specifically address the ability of the supporting air reservoir system to perform its intended
?
I L
t l
m l
- e.
l l'
GDP 98-2042 Page 4 of 5 l
Event Report 98-05 L
Revision 2 safety function to fail safe on loss of air and was focused narrowly on the failed.PCSV air-
. supplies.
A contributing cause was inadequate preventative maintenance (PM) for a back-up air supply supporting a safety system. The backup air supply was not identified as equipment requiring PM during the February 1997, review of the "Q" system boundarim. Therefore, no PM task or frequency was-defined for the backup air supply. The original boundary definition for j
high-pressure containment shutdown did not specifically include the air reservoir, because the air tanks were thought of as part of the containment valve assembly.. They were described in j
Boundary Definition #9 as, " Valve assemblies with air reserve tanks also include a pilot valve and check valve." The boundary manual was updated on April 29, 1998, and now states,
" Valves with air reservoir backups (necessary to close time valve on loss of air) also include any necessary pilot valves, check valves, air reservoir tanks, low air pressure switches and switch over solenoid valves...." The effect on the PM program of this change to the "Q" boundary was not evaluated. Currently, there is no process in place that ensures PM requirements are
. eval..ted when changes are made to safety significant documents.
Corrective Actions 1.
Issue formal testing criteria by June 17,1998, for surveillance testing of the backup air reservoir tanks. Testing will be conducted via work packages. Completed June 16,1998.
2.
An action plan will be developed by July 10,1998, that verifies SAR design bases systems i
credited for backup are being properly tested. This action was completed on July
'998.
i 3.
Testing of backup air reservoirs will be scheduled to be performed on a quarterly basis.
i This testing will be initiated on June 28,1998. This action was completed on June 26, i
. 1998.
i 4.
By August 5,1998, Engineering will perform a PM evaluation to determine if periodic i
maintenance is required to ensure safety related air-to-close valves with backup air i
reservoir tanks are capable of closing containment valves on loss of air at ERP, LAW, i
Tails, X-705, and X-340 complex. This action was completed on July 31,1998.
i L
5.
By September 16,1998, Engineering will perform an evaluation and develop an action plan
. that ensures any changes to the plant and safety related documents are flowed into the PM program.
l
l L
i i-GDP 98-2042 l
Page 5 of 5 Event Report 98-05 Revision 2 Extent of Exposure ofIndividuals to Radiation or Radioactive Materials There were no exposures to individuals from this incident to radiation or radioactive materials.
Lessons Learned l
There is a need to become more proactive in identifying systems requiring testing and maintenance.
Support _ systems that have inputs to safety related systems might impact system reliability if they do not perform as designed.
l
)
i I
I
~
GDP 98-2042 Page1ofl' Event Report 98-05 Revision 2 List of Commitments 1,
By September 16,1998, Engineering will perform an evaluation and develop an action plan that ensures any changes to the plant and safety related documents are flowed into the PM program.
1 l
i.
I l
i 4
I c
r~e
--r=
rr'--
-