ML20153G457

Forwards Voluntary Event Rept ER-98-23 Describing Exceedance of Normetrex Pump Discharge Pressure Safety Limit Specified by Technical Safety Requirement (Tsr) 2.3.2.1.Ltr Contains No New Licensee Commitments

ML20153G457
Person / Time
Site:	Paducah Gaseous Diffusion Plant
Issue date:	09/25/1998
From:	Pulley H UNITED STATES ENRICHMENT CORP. (USEC)
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
GDP-98-1068, NUDOCS 9809300079
Download: ML20153G457 (10)

Text

._

...-4 d

r USEC

- A Global Energy Company i

I September 25,1998 GDP 98-1068 United States Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555-0001 Paducah Gaseous Diffusion Plant (PGDP)

Docket No. 70-7001 Event Report ER-98-23 Enclosed is a voluntary 30-day written report describing the exceedance of the Normetex pump j

discharge pressure Safety Limit specified by Technical Safety Requirement (TSR) 2.3.2.1.

A i

voluntary notification was submitted on August 27,1998 (NRC No. 34683).

There are no new commitments in this submittal. Any questions regarding this matter should be directed to Larry Jackson at (50'2) 441-6796.

Sincerely, h

Howard Pulley j

General Manager

}

Paducah Gaseous Diffusion Plant

Enclosure:

As Stated cc: NRC Region III Office NRC Resident Inspector - PGDP p

/

9809300079 990925 PDR ADOCK 07007001 C

PDR j

P.O. Box 1410, Paducah, KY 42001 Telephone 502-441-5803 Fax 502-441:5801 http://www.usec.com Offices in Livermore, CA Paducah, KY Iortsmouth, OH Washington, DC

l 1

l 1

Docket No. 70-7001 GDP 98-1068 Page1of9 EVENT REPORT ER-98-23(Voluntary Report)

DESCRIPTION OF EVENT At 0205 hours0.00237 days <br />0.0569 hours <br />3.38955e-4 weeks <br />7.80025e-5 months <br /> on August 26,1998, a failure occurred that caused the unplanned closure of the discharge block valve on the on-stream No. 2 Normetex pump in the C-315 Tails Withdrawal Facility. This resulted in an automatic shutdown of the pump motors and a rapid, but brief, discharge pressure increase on the pump before the pump rotation came to a complete stop.

Operators myiewing system data on the system's monitoring computer noted that discharge pressure peaked at approximately 46 pounds per square inch absolute (psia), which is in excess of the Normetex pump's 45 psia Safety Limit (SL) per Technical Safety Requirement (TSR) 2.3.2.1. Post-event reconstruction of the available data concluded that the observed pressure was credible and, further, that the design of the Normetex Pump High Discharge Pressure System, with a Limiting Control Setting (LCS) of42 psia, was not adequate to prevent exceeding the SL under all conditions.

At 0230 hours0.00266 days <br />0.0639 hours <br />3.80291e-4 weeks <br />8.7515e-5 months <br /> on August 26,1998, the Plant Shift Superintendent (PSS) declared the No. 2 Normetex pump inopemble. At 0137 hours0.00159 days <br />0.0381 hours <br />2.265212e-4 weeks <br />5.21285e-5 months <br /> on August 27,1998, a voluntary notification was made to the Nuclear Regulatory Commission (NRC), informing them of this SL exceedance, and NRC No.

34683 was assigned to the notification.

Prior to the event, the C-315 Tails Withdrawal facility was operating normally with Normetex pumps No. 2 and No. 3 in Withdrawal (Mode 2) discharging to the A-Condensing Loop. Loads on

{

the pumps were moderate to low. At 0125 hours0.00145 days <br />0.0347 hours <br />2.066799e-4 weeks <br />4.75625e-5 months <br /> on August 26,1998, withdrawal was stopped on the UF tails cylinder in withdrawal position No.1, due to it being full to the prescribed level, j

6 thereby shifting the flow of UF to the on-stream accumulator. At 0145 hours0.00168 days <br />0.0403 hours <br />2.397487e-4 weeks <br />5.51725e-5 months <br />, the two C-315 6

operators resumed filling activity to withdrawal position No. 2. The operators were performing duties out of the Area Control Room (ACR) associated with weighing cylinders at the time of the event. There was no maintenance activity in the vicinity of the Normetex pumps.

At 0205 hours0.00237 days <br />0.0569 hours <br />3.38955e-4 weeks <br />7.80025e-5 months <br />, the No. 2 Normetex pump shutdown alarm sounded. An operator immediately entered the ACR to mspond to the alarm and noted that the control panel annunciators indicated the i

No. 2 Nonnetex pump was shut down and its air-operated suction and discharge valves had closed.

The operator then opened the discharge vent valve to evacuate the remaining UF in the pump. The 6

second operator went to the pump to check for local control panel alarms, which might indicate the cause of the pump shutdown. The pump main drive motors had tripped, but no local control panel alarms were actuated. After notifying management and the PSS, the various system alarms and data l

screens generated by the system control / logging computer were reviewed. In addition to the pump

- shutdown alarm, a high pressure warning at 37 psia was received immediately after the shutdown i

alarm. Review of the on-screen data plot of pressure versus time showed one plot for discharge i

pressure peaking at approximately 46 psia during the event.

I

~

Docket No. 70-7001 GDP 98-1068 Page 2 0f 9 There was no observable damage to the pump or expansion joint bellows or out-leakage of UF.

6 Operations in the vicinity of the pump were restricted to preserve evidence, with the exception that manual suction and discharge block valves were closed to permit long term isolation. When isolated, the pumps do not contain significant quantities of UF (less than five pounds). At 1245 hours0.0144 days <br />0.346 hours <br />0.00206 weeks <br />4.737225e-4 months <br /> on August 27,1998, the PSS declared all Normetex Pump High Discharge Pressure Systems inoperable, based on an initial investigation of the trip that determined the Normetex Pump High j

Discharge Pressure System would not always perform its intended safety function. The Product and j

Withdrawal Facilities entered recirculation mode with the Normetex pumps placed in Standby (Mode 3).

He Normetex pumps am served by several systems which will prevent excessive pressure increases on the discharge of the pump. Two such systems, both classified as non-safety, are the Normetex Pump Discharge Block Valve Interlock Trip and the Normetex Pump Operational High Pressure Trip. The interlock shuts down the Normetex pump if the discharge block valve goes closed on a running pump. The interlock actuates when the valve is fully closed, unless it is overridden, as would be the case during a normal pump start-up with the discharge block valve closed or when the pump is taken off-stream. The interlock override automatically clears when the discharge block valve is opened. The Operational High Pressure Trip actuates when the pressure reaches 39 psia and is designed to prevent operating at excessive pressures that, under long term, non-transient conditions could damage the Normetex pump. A third system is the High Discharge Pressure System, a TSR safety system, which consists of dual discharge pressure transmitters and pressure switches that act to trip the pump motors at or below the LCS of 42 psia. The intent of the LCS is to prevent exceeding the 45 psia SL.

A detailed Engineering Evaluation (EN-C-821-98-061, Rev. 0) of the anticipated performance of the system to a closed discharge block valve scenario was completed. The evaluation concluded that the rapidity of the discharge pressure increase, due to a positive displacement pump pumping UF 6 gas into a small, isolated discharge volume, could exceed the 45 psia SL even if the Discharge Block Valve Interlock Trip, the Operational High Pressure Trip, or the High Discharge Pressure System safety system shut down the pump. For this particular event, considering the pre-event pressures and flows and the ultimate pressures achieved, the actual initiator of the trip was concluded to be the non-safety Discharge Block Valve Interlock Trip which actuated when the discharge block valve closed. While the Operational and High Discharge Pressure Systems were operable, they were not required, because the Discharge Block Valve Interlock trip had already tripped the pump.

An Engineering Evaluation (EN-C-821-98-059, Rev. 0) was completed to provide Operations with Normetex pump limitations to ensure that a similar transient would not result in discharge pressures in excess of the SL of 45 psia. The evaluation defined maximum values for the suction and discharge pressure parameters to which Operations should control the process. Operations procedures CP4-CO-CN2021a," Operation of the C-310 Normetex Pump," and CP4-CO-CN2021b,

" Operation of the C-315 Normetex Pump," were revised to maintain suction and discharge pressures

Docket No. 70-7001 GDP 98-1068 Page 3 of 9 l

l as defined by the Engineering Evaluation. The revised procedures also require a dedicated operator or fmnt line manager to be stationed in the ACR for C-310 and C-315 prior to placing the Normetex pumps in Withdrawal (Mode 2) to constantly monitor and control the specific pressures.

Additionally, since this Engineering Evaluation took credit for the Discharge Block Valve Interlock l

tripping the Normetex pump, resulting in lower pressure transients, the Discharge Block Valve Interlock was reclassified as a "Q" safety-related system. To support this change in classification, an Engineering Evaluation (EN-C-821-98-060, Rev. 0) was prepared to ensure the system satisfied the requirements of Design Engineering Standing Order 98-003, Rev. 2, " Configuration l

Management Controls Flowdown Implementation Requirements." This evaluation concluded that a field functional test, consisting of closing the Discharge Block Valve on an evacuated, isolated Nonnetex pump, n sulting in the tripping of the Nomietex pump, was required prior to declaring the pumps operable. Implementation of these changes to the procedures and to the interlock quality classification were not put in place until a Notice of Enforcement Discretion (NOED) was received from NRC.

l On August 28, 1998, the United States Enrichment Corporation (USEC) submitted to NRC a Request for Enforcement Discretion. USEC requested that NRC exercise discretion not to enforce l

compliance with the actions required in TSR 2.3.3.1, Normetex Pump High Discharge Pressure System. This request provided justification based on the use of an alternate means to fulfill the l

safety function of the Normetex Pump High Discharge Pressure System and the low safety significance should the system fail. The request indicated that, if allowed to return the Normetex pumps from Standby (Mode 3) to Withdrawal (Mode 2), the following compensatory measures would be implemented: (a) Operations procedure changes described above would be implemented; (b) a dedicated operator or front line manager would be stationed in the ACR as described above; and (c) the quality classification of the interlock would be changed to "Q." These compensatory measures ensure that the SL will not be exceeded as a result of an accidental closure of the discharge block valve. Additionally, USEC committed to submitting a Certificate Amendment Request (CAR) j addressing the actions necessary for the ultimate resolution of the issue.

l l

On August 28,1998, at 1630 hours0.0189 days <br />0.453 hours <br />0.0027 weeks <br />6.20215e-4 months <br />, NRC orally issued USEC a NOED on the Normetex Pump High Discharge Pressure TSR 2.3.2.1 issue, based on the commitments made in the Request for j

Enforcement Discretion. At 1815 hours0.021 days <br />0.504 hours <br />0.003 weeks <br />6.906075e-4 months <br />, the PSS declared the Normetex Pump High Discharge l

Pressure Systems operable, in accordance with the NOED. No. 2 Normetex pump remained l

inoperable. All required compensatory measures were in place. On September 11,1998, USEC l

submitted a CAR providing the justification to delete TSR 2.3.2.1, "Nomietex Pump Discharge Pressure," and TSR 2.3.3.1,"Normetex Pump High Discharge Pressure System." The CAR also included revisions to related sections of the Safety Analysis Report.

1 Docket No. 70-7001 GDP 98-1068 Page 4 cf 9 CAUSES OF EVENT A.

Direct Cause The SL exceedance was caused by the transient pressure created when the discharge block valve closed on the on-stream No. 2 Normetex pump. When the discharge valve closed, an interlock on the valve automatically tripped the pump and closed the suction control valve, as designed. The Normetex pump, a positive displacement pump, did not stop immediately, but coasted down, as designed. This resulted in a pressure spike, as the pump coasted down f

4 against the closed valve. Due to the small volume of piping between the pump and the discharge block valve, a rapid pressure rise occurred. As the pump came to a complete stop, 1

the pressure in the discharge side bled back through the pump to the suction side, reducing 4

pressure, as designed. The pressure decayed quickly to less than 45 psia.

1 Troubleshooting actions for determination of the direct cause of the block valve closure

)

included: 1) local observation of valve operating circuit relays, solenoid valves, and other components for signs of obvious failure / overheating; 2) checks of computer logic for problems with input / output that could cause the valve to inadvertently close; and 3) operating the block valve in an attempt to duplicate the inadvertent closure. None of these efforts revealed a problem that, ofitself, could close the block valve on a running pump.

However, some degraded components were identified.

The non-safety discharge block valve air supply solenoid valve PY-212C2 was degraded.

This solenoid valve had a minor air supply-to-vent leak. This solenoid valve did not leak, however, when the solenoid was energized. Therefore, the solenoid valve is not likely to have closed the block valve, since it is in an energized state when the block valve is open.

Additionally, two computer digital input cards were degraded. Two computing systems operate in parallel to perform various control and interlock functions on the pumps. The No.

2 Normetex pump has a dedicated digital input card on each of these computers. On computer LPU-SSlX, a problem was discovered wherein the computer could not recognize a valve-open signal (latch) required to keep the valve open. This problem means that the discharge block valve solenoids PY-212A2 and PY-212B2 would only be energized via signals from LPU-SS2X,instead of from both computers. An interruption of solenoid power from the single remaining channel could thus close the block valve on a running pump. No evidence of such a power interruption or other problem that would produce this effect has been found. The alternate computer, LPU-SS2X, had a problem in that it did not recognize the block valve closing. This problem could prevent the discharge block valve interlock trip from functioning (on this channel only), but does not create a condition that could close the valve. Additional testing was performed to fully simulate pump on-stream operation by operating all pump controls with main motor fuses pulled. During a week of continuous operation in this simulated condition, the trip could not be duplicated.

I l

l Docket No. 70-7001 GDP 98-1068 Page 5 of 9 Formal troubleshooting activities have been concluded, since the cause appears to be an intermittent problem which cannot be duplicated at this time. However, computer data logging for digital inputs and outputs which might have been associated with the discharge block valve closure on the No. 2 Normetex pump has been established. This will assist in diagnosing any future problems that cause unplanned closures of the discharge block valve.

The extent to which this event could have the same direct cause as a similar trip of the No.

2 Nomietex pump, which occurred on July 7,1998, is uncertain. The earlier trip peaked at approximately 43 psia, which was below the SL. Investigation of this earlier trip showed a significantly degraded discharge block valve air supply solenoid valve PY-212B2. This valve was replaced prior to the event on August 26,1998. There is the potential that an intermittent problem caused both discharge block valve closure events which occurred on July 7 and August 26,1998, but in neither case could the failure be re-created.

An Engineering Evaluation (EN-C-821-98-064, Rev. 0) was prepared to ensure all actions required by TSR 1.6.1.2 were met prior to restart of the No. 2 Nomietex pump. TSR 1.6.1.2.a and b did not require action because of the nature of the event. TSR 1.6.1.2.c requires a technical evaluation be conducted to determine if any damage has occurred and to evaluate the ability of the system to be restarted. This Engineering Evaluation concluded that there was no damage to the C-315 No. 2 Normetex pump discharge expansionjoint as a result of the momentary SL exceedance. This was based on pressure calculations (Engineering Evaluation, EN-C-821-98-061, Rev. 0); data provided by the manufacturer on the expansion joint; the absence of observable leakage U the air buffer system sealing the space between the expansion joint's inner and outer plies; and leak rate testing results of the expansionjoint. Additionally, this Engineering Evaluation documented the need to replace the discharge block valve solenoid PY-212C2 and the digital input cards LPU-SSlX and LPU-SS2X. These components were replaced prior to declaring No. 2 Normetex pump operable.

B.

Root Causes The root cause for the exceedance of the SL was that the design of the Normetex Pump High Discharge Pressure System was inadequate to preclude transient pressures from exceeding the 45 psia SL. The first Normetex pump was installed in the C-310 Product Withdrawal facility in the 1982 time frame. This was followed by the installation of the Normetex pumps in the C-315 Tails Withdrawal facility in the 1987 time frame. The SL for the Normetex pump was first defined in the " Operations Safety Requirements for Product and Tails Withdrawal Facilities," KY/D-3974, issued on March 29,1985, and was established at 45 psia. Therefore, at the time of the original Nonnetex design (prior to 1982), there was not a SL requirement. At the time of the selection of the SL and LCS (Limiting Safety System Setting in DOE terminology) in 1985, the selection of the SL and LCS was not a rigorous quantitative process. At that time, there were no safety analysis engineers at PGDP and the i

L

Docket No. 70-7001 GDP 98-1068 Page 6 of 9 selections were based only on qualitative engineering judgment. The selection of the SL and LCS was based only on operational characteristics of the Normetex pump, rather than being analytically based on the actual accident analysis associated with a failure of the expansion joint bellows. No transient analysis was required to ensure the SL would not be exceeded.

Operations has completed a documented review of all TSR SLs to ensure that SLs are not likely to be challenged by normal operations, including events that are expected, such as an inadvertent valve actuation. This review found no other SLs likely to be challenged by normal operations.

Current Engineering design procedures and increased rigor significantly reduce the possibility of having a similar problem with the establishment of an SL for current and future projects. Additionally, the methodology proposed for the Safety Analysis Report Upgrade Project requires an analysis of the limiting transient to establish LCSs, SLs, and the associated technical basis for the controls to prevent Evaluation Basis Event scenarios that could exceed the off-site Evaluation Guidelines.

The need for the Normetex Pump High Discharge Pressure System as a TSR system has been questionedin the past. During preparation of the NRC Application for Certification in the early 1995 time frame, the decision was made not to include the High Discharge Pressure System as a TSR system, because it was identified that there was no accident analysis requirement for the system. The Application for Certification, USEC-01, submitted to NRC in April,1995, did not include the Normetex High Discharge Pressure System as a TSR system and there was no SL for the discharge expansion joint bellows. After NRC rejected Revision 0 and requested that the " existing safety basis" be used for certification, the Normetex High Discharge Pressure System was converted directly from an Operational Safety Requirement (OSR) to a TSR in USEC-01, Revision 1 with only format changes to provide the Limiting Conditions of Operation action steps not present in the OSRs.

Therefore, the presence of this system as a TSR system is essentially a holdover from the Department of Energy oversight due to the lack of a rigorous analysisjustifying its removal.

Following this latest event, the design, purpose, and necessity of having the Normetex Pump High Discharge Pressure System were evaluated. The system was compared to the 10 CFR 76.87 requirements for TSR SLs and LCSs. The subsequent evaluation determined that since the High Discharge Pressure System is not required to prevent an uncontrolled release of radioactivity, does not have a significant safety function, and does not serve to prevent an inadvertent criticality for a singly contingent operation, that inclusion of the system in the TSR was not required. Therefore, a Certificate Amendment Request (CAR) has been submitted to NRC with justification to delete the Normetex Pump High Discharge Pressure System as a TSR safety system. Therefore, no corrective actions related to design changes are warranted at this time.

Docket No. 70-7001 GDP 98-1068 Page 7 of 9 C.

Contributing Causes A contributire muse of the event is lack of rigorous review of the SL requirement. Because ofits histomal nature as an OSR, the basis and the risk of exceeding the SL were not challenged.

In considering the contributing causes, the plant staff has reviewed previous events which might have afforded an opportunity to identity the potential for SL exceedance. Four pressure excursions, which did not result in SL exceedances, occurred prior to the current event in which the SL was exceeded. Thee of these events occurred between 1992 and 1994 when the emphasis on SL was different than it is today. The fourth incident occurred in July 1998. In all four events, the SL was not exceeded and the events were not considered serious challenges to the SL. Failure to recognize and treat the events as serious challenges to the SL is considered ineffective corrective action. Under current practice, investigation reports and associated corrective actions for events reportable to the regulator are subjected to a more rigorous review / approval process through the Plant Operations Review Committee (PORC). In addition, Engineerir.g setpoint calculation (SPC-CSE19352-1, Rev. 0) for the trip setpoint of the Normetex Pump High Discharge Pressure System, dated August 18,1995, acknowledges the possibility of the SL being exceeded for a few seconds during an inadvertent closure of the discharge block valve. This information did not result in any actions to ensure the SL would not be exceeded.

CORRECTIVE ACTIONS A.

Corrective Actions Taken 1.

On August 27,1998, the PSS declared all Normetex Pump High Discharge Pressure Systems inoperable and plant withdrawal operations were stopped. The C-310 Product Withdrawal Facility and the C-315 Tails Withdrawal Facility were placed in recirculation mode.

2. On August 28,1998, USEC submitted a Request for Enforcement Discretion to NRC related to TSR 2.3.3.1 and TSR 2.3.2.1.

a. Engineering Evaluation (EN-C-821-98-059, Rev. 0) completed to detemiine Normetex j

pump limitations which would ensure the SL of 45 psia would not be exceeded. The i

evaluation determined the suction and discharge pressure valites to which Operations i

should control the process.

I i

Docket No. 70-7001 GDP 98-1068 Page 8 of 9

b. Engineering Notice EN-C-811-98.s19, Rev. O completed to implement the safety system classification change of the interlock on the discharge block valve from "NS" to "Q."

3.

On August 28,1998, Openvions revised procedures CP4-CO-CN2021a," Operation of the C-310 Normetex Pump," and CP4-CO-CN2021b, " Operation of the C-315 Normetex Pump," to (a) maintain suction and discharge pressures at lower levels as defined by the Engineering Evaluation ( EN-C-821-98-059) and; (b) require a dedicated operator or front line manager to be stationed in the ACR for C-310 and C-315 prior to placing the Normetex pumps in Mode 2 to ensure the procedure actions are implemented.

4.

On August 28,1998, the PSS declared the C-310 and C-315 High Discharge Pressure Systems operable after NRC granted enforcement discretion based upon the compensatory actions proposed by USEC.

5.

On September 4,1998, Engineering completed an Engineering Evaluation (EN-C-821 061, Rev. 0) which calculated the anticipated pressures resulting from blockage of the Normetex pump discharge line.

6.

On September 11,1998, USEC submitted a CAR to NRC to justify the deletion of the TSR 2.3.2.1 SL, the TSR 2.3.3.1 LCS and the Normetex Pump High Discharge Pressure System as TSR requirements.

7.

On September 11, 1998, Engineering pepared an Engineering Evaluation (EN-C-821-98-064, Rev. 0) to satisfy the requirements of TSR 1.6.1.2. This evaluation was submitted to the PORC for concurrence which was received on September 15,1998.

8.

On September 17,1998, Maintenance replaced solenoid valve PY-212C2 on the No. 2 Normetex pump in C-3 M

(

9.

On September 21,1998, Maintenance replaced computer circuit cards LPU-SS1X and LPU-SS2X on No. 2 Normetex pump in C-315.

10. On September 24,1998, Engineering established computer logging for the digital inputs and outputs which might have been associated with the discharge block valve closure on the No. 2 Normetex pump.

I1. On September 24,1998, Operations completed a documented review of all TSR SLs u, ensure that SLs are not likely to be challenged by normal operations, including events that are expected such as an inadvertent valve actuation. This review found no other SLs likely to be challenged by normal operations.

1 l

Docket No. 70-7001 GDP 98-1068 Page 9 of 9 i

B.

Corrective Actions Planned l -

None EXTENT OF EXPOSURE OF INDIVIDUALS TO RADIATION OR TO RADIOACTIVE

]

MATERIALS There was no leakage of UF nor exposure ofindividuals to radiation or to radioactive rnaterials.

6 LESSONS LEARNED The design of safety systems must ensure that applicable SLs are not exceeded under all operating conditions.

l l

2.

,