ML20245B631
| ML20245B631 | |
| Person / Time | |
|---|---|
| Issue date: | 03/31/1987 |
| From: | Cintula T NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | |
| Shared Package | |
| ML20245B616 | List: |
| References | |
| TASK-AE, TASK-E706 AEOD-E706, NUDOCS 8904260194 | |
| Download: ML20245B631 (25) | |
Text
- _ - _ _ _ _ _ _ _ _ _ - _ - _ _ -
( g,.
. yi..
j ENGINEERING EVALUATION REPORT
- I
[7, AEOD/E706
-l INADEQUATE MECHANICAL BLOCKING OF VALVES-j March 31, 1987-l rl.
e i
l
- i.,
i Prepared by: Theodore C. Cintula l
0 l
1 1
Office for Analysis and Evaluation of Operational Data i
U.S. Nuclear Regulatory Commission 1
1
- This document supports ongoing AE0D and NRC activities and does not represent the' position or requirements of the responsible NRC program office.
8904260194 870330 PDR ORG NEXDPDC i
i
]
o O ^, *-
i p
TABLE OF CONTENTS.
l
' Pace i
EXECUTIVE
SUMMARY
l' 1..
INTRODUCTION 1
2..
DISCUSSION 2
2.1 Definitions 2
2.2 Mechanical Blocking Methods 2
2.2.1' Motor-operated Valves..,.............
2 2.2.2 Air-operated Valves................
3 2.2.3 Spring-Actuated Safety / Relief Valves 3
2.3 Possible Failure Modes..................
4
'2.4.0perational Data.....................
4 3.
ANALYSIS OF THE DATA 4
-3.1 Initial' Data Review 4
3.2 Failure Modes 6
3.3 Event Causes and Corrective Actions 13 3.4 Consequences of Events..................
17
'4.
FINDINGS AND CONCLUSIONS 19 5.
SUGGESTIONS..........................
20
'6.
REFERENCES 22
' a
..:n,
~
~
p TABLEOFCONTENTS'(continued)
Page
- LIST OF TABLES Table 1.
Valve Biccking Events 7
L able 2.
Event Cause and Corrective Action T
14 Table.3. Consequences of-Each Event.................
18 LIST OF FIGURES Figure 1.
Potential' Undesirable Outcomes from an Inadequacy in the Blocking of an. Automatic Valve 5
1
._.-..-.-_.----n.--__-___.
_-.____.A_
_ _ _ ~ _ _ _ _ _
D
1
\\.
l l
1 AE00 ENGINEERING EVALUATION REPORT UNITS:
Various LWRs EE REPORT NO.: AE00/E706 DOCKET NOS.:
Various DATE: March 31, 1987 LICENSEES:
Various EVALUATOR / CONTACT: T. C. Cintula NSSS/AEs:
Various
SUBJECT:
INADEQUATE HECHANICAL BLOCKING 0F VALVES EVENT DATES: Various
SUMMARY
Nineteen events involving the mechanical blocking (open or closed) of a valve were investigated. Ten of the events involved a misapplication of the blocking device. There were several events of potential and actual safety significance.
The root cause of failure to properly block the valve was traced to one or more human factor deficiencies related to either personnel errors or inadequate procedures.
The report suggests that IE issue an information notice on this subject with focus on two of the events in which a single isolation valve was not adequately blocked and subsequently cycled to an " unsafe" position.
It is suggested that the information notice highlight the need for careful review of temporary blocking procedures during equipment modifications or repairs when a single isolation valve is relied upon for system integrity.
- Finally, because the most significant events were attributable to human factor inadequacies during maintenance activities, it is suggested that NRR review this report for inclusion into existing studies as appropriate.
1.
INTRODUCTION An investigation of domestic LWR operating experience involving inadequate or
. inadvertent blocking of valves by mechanical methods was initiated by an event that occurred at a foreign reactor. The foreign event occurred at a Westinghouse two-loop PWR and resulted in a sustained, uncontrolled blowdown of high energy steam from an unanticipated opening of an upstream isolation valve that was not properly blocked in the " closed" position. The root cause of the foreign reactor event was identified to be inadequate procedural controls for assuring that the valve was incapable of subsequent automatic movement.
The purpose of this study is to examine the applicability and extent of
. inadequate or inappropriate practices regarding mechanical blocking of valves that have occurred at domestic reactors. The study reviews the nature and cause of the mechanical blocking problems, the safety significance of the events, and the corrective actions taken, and suggestions for correcting the identified deficiencies are also developed.
P
I 2-i 2.
DISCUSSION 2.1 Definitions
'For the purposes of clarifying some terms and concepts discussed in this l
report on the various aspects of mechanically blocking a valve so it is incapable of changing position, the following definitions are provided:
(1) An inadequately blocked valve occurs when valve position is intended to be fixed but the valve is:
(a) not properly blocked mechanically to prevent its subsequent movement, or is (b) properly blocked mechanically by a physical device, but the device fails such that it is incapable of preventing subsequent valve i
motion.
(2) An inadvertently blocked valve occurs when valve position is not intended to be fixed, but the valve is rendered incapable of automatic action because the valve is mechanically blocked in an immovable position.
In the above definitions valve motion or valve action refers to a change in the valve disc position (open or close).
The term " mechanical blocking," as used in this report, refers to the engagement of a physical device which prevents actuation of the valve (e.g., engagement of the valve operator's auxiliary handwheel, the addition of a stem collar).
Electrical disabling of valves that are rendered incapable of movement because power was removed from the valve motor operator (i.e., racking-out of the circuit breaker) were not considered in.this study. Similarly, events involving the locking of a valve handwheel with a lock or chain to prevent local manual operation of the valve were not included in this sttidy.
This study addresses only events involving the application or engagement of a physical device to prevent automatic or remote valve movement.
i 2.2 Mechanical Blocking Methods The three most common valve assemblies capable of remote manual or l
automatic (when a setpoint is achieved) operation installed in the nuclear i
l power plants are motor-operated, air-operated and spring-loaded safety or j
relief valves. The motor-operated and air-operated valves may or may not have a manual handwheel. A brief discussion on the typical methods that may be used to mechanically block each type of valve to prevent automatic action of the valve follows:
2.2.1 Motor-0perated Valves i
L Generally, motor-operated valves are not blocked by mechanical methods to prevent automatic motion because:
(1) the valve stem is not generally accessible for the attachment of a stem collar, and (2) mechanical blocking of a motor-operated valve may lead to motor burnout if the motor 1
l l
l
- )
is inadvertently energized. Therefore, motor-operated valves are typically prevented from automatic or remote manual movement by removing electrical power from the valve operator (racking-out of the valve electrical breaker) and " tagging" the valve's control switches.
Some motor-operated valves are provided with a manual handwheel. The hand-wheel is designed for local manual operation of the valve only and will not mechanically block the valve in position to prevent automatic movement.
Even when the handwheel is engaged, as soon as the valve's electric motor operator is energized the handwheel clutch automatically disengages and the valve stem will travel to the position directed by the motor-operator.
2.2.2 Air-0perated Valves Air-operated valves are generally prevented from moving by either of two types of mechenical blocking devices:
(1) engagement of the valve's manual i
handwheel (if the valve is equipped with a handwheel), and (2) the applica-tion of a stem collar " gag" to the exposed surface of the valve stem.
Air-operated valves with a handwheel can be mechanically blocked in any position by engagement of the manual handwheel. Engagement of the valve handwheel has no effect on the pneumatic operator, as the pneumatic forces generated by the valve operator are comparatively weak and cannot overcome the frictional forces in the geartrain of the manual handwheel valve operator. After the valve handwheel is engaged, the valve may be
" jacked" open or closed with the handwheel, but a valve actuation signal will not result in valve movement from the pneumatic valve operator nor will it damage the pneumatic operator.
Stem collars are external. devices which are physically clamped to the exposed area of the movable valve stem at the valve yoke shoulder either at the valve body or the valve operator end in order to prevent movement of the valve stem. As described in the section on manual handwheels, the attachment of a stem collar does not affect valve forces as airected by the pneumatic operator, but as long as the friction force of the stem col'.ar gag clemping action is greater than the force generated by the pneumatic operator, the valve will not cycle.
2.2.3 Spring-Actuated Safety / Relief Valves Spring-actuated safety or relief valves may be prevented from lifting or may be forced to stay fully closed after failing to reseat tightly after lifting (a term known as " weeping") by installation of a valve gag. Weeping may occur after a relir valve has performed it design function by reducing system pressure to the relief valve setpoint, but has failed to reseat to a leaktight condition.
The gag may be a screw-thread device built into an optional cap of the valve. The gag physically forces the valve stem and plug into the seat of the valve.
i l
I
{
_ _ __ _ j
[
2.3 Possible Failure Modes Figure 1 is.a simplified representation of the various modes that a valve could fail to perform its intended design or safety function due to an inadequacy in blocking. applications. The two possible failure modes are:
(a) The failure to mechanically block the valve or the failure of the mechanical block to function correctly when subsequent movement of the valve was not desired.
(b) Failure to remove or disengage the mechanical blocking device to subsequently allow free automatic movement of the valve.
The potential undesirable outcome associated with 2.3(a) above is that the valve may inadvertently travel to an undesired valve position.
Such events may result.in system blowdown, flooding events or the premature loss of a safety or control system.
1
' The undesirable outcome associated with 2.3(b) is that a valve may not be able to close or open when demanded. Some events that could be postulated to occur with this inadvertent blocking are:
the loss of a safety-related or control system; the loss of redundant protection; or a leak from or between systems that may be unisolable.
2.4 Operational Data A total of 18 events at the licensed U.S. reactors were found in addition to the foreign reactor event. The data search covered a period of over five years, from October 1981 to February 1986. One additional event, that occurred earlier was also included in the data base. These events were found by searching the SCSS (Sequence Coding and Search System) data base and reviewing selected NRC regional inspection reports.
. 3.
ANALYSIS OF THE DATA 3.1 Initial 0ata Review The 19 events that formed the initial data base for this study were composed of the following:
Valve Types Number of Events Motor-operated isolation valve with I
handwheel Air-operated valves; seven of the 9
air-operated valves were equipped with the a manual handwheel, the other two valves did not have the built-in handwheel feature
e s
l n
b a
o r
t r
T o
P n
e nd l
l ae a
b cs i
a I
o t
l el n
o g
vc e
s n
l t
i ei ae o
n e
vk Vb P
U oc h
mo t
el n
rb 1
i ol ta y
I c
c a
ei.
u rne q
uac e
lhi n
d icv s
o a
aee m
tn i
n Fmd e
no t
I l
l ai c
b yo dt e
n o
t r nc t
a t
r et ue ro r
o P
fn dt er e
m n
ao eo vp m
o nd l
Sc rr o
m r
ae a
/
p e
a f
og cn i
fds f
fr h
I tn e
t oem oy ou s
m i
ep n
te t
s r
ee rek vo e
sat se ss e
mv ouc l
t sl s sf se t
ol fdo ae o
oey oa or a
ca r
l Vb P
Lrs Ls Lp W tV enb u
po Oc in tti.
1 2
3 4
i et oc nE l a nnyo bm nuci aa afat et c
ua ru yqc iA etei s
vedl en lfap s
da aanp m
f n
Vsia e
o Uf l
/s o
b sdm l
y o
see ag sl r
ott i n et P
las ti sn l y nk oe l
ees ec lt a
rr to cr i
ul I
ol e
t tyo PB fk ev n
atr goc vd e
met l n o
l a t
efn 1
li el an o
rao ak rb VI P
Psc e
tcu r
soll u
nli a g
ibac 1
i fi F
ol n
I tara coh ei c
rnae uacm s
lhi n
s icve s
w t
aeeh m
o n
Fmdt e
d e
l w
v b
o E
y o
l l
r B
g st P
n nn m
i ee l
e d
pt a
t o
Or i
s o
I e
t y
l ev n
S F
vd e
l a t
an o
VI P
1 2
. Valve Types Number of Events Spring-loaded safety val ~ves, and 4
Spring-loaded relief valves 5
An initial review of the data showed that in the nine events involving the mechanical blocking of a safety or a relief valve each event resulted in a desirable outcome. That is, the application of a mechanical gag either:
(a) Forced the valve closed after the valve had lifted and failed to seat tightly (a condition known as " weeping") or (b) Prevented a valve (which had been declared disabled) from opening at less than acceptable pressure and thus prevented a pctential blowdown.
There were no instances of a mechanical gag inadvertently being applied to a safety or relief valve that was capable of functioning correctly or of a mechanical gag failing to operate. Because each event of the intentional gagging of a safety or relief valve led to a desirable operational outcome, and no safety implications could be identified with the licensee actions taken with this type of valve, a further analysis of safety / relief valves was not conducted and will not be discussed further in the analysis section of this report.
Table 1 lists the ten other events which involved the misapplication of a blocked valve. The table includes the type of valve and, if equipped with a handwheel, the methods used to block the valve, the subsequent valve automatic action and a brief description of the event.
Plant names, event dates and the source of the information are listed in the Reference section of the report.
3.2 Failure Modes The list of events in Table 1 show that one motor-operated and nine I
air-operated valves failed to perform their design function in the following manner:
(a) Two air-operated valves inadvertently opened because they were not mechanically blocked.
(b) One motor-operated valve inadvertently opened due to the failure of a i
mechanical blocking device (i.e., a stem collar).
(c) Four air-operated valves failed to open or were incapable of opening on demand because they were inadvertently blocked in the closed posi-tion.
(d) Three air-operated valves were incapable of closing because they were j
inadvertently mechanically blocked in an open position.
l l
Only one of the ten events involved the misapplication of a mechanical l
blocking device to a motor-operated valve (Ref. 1). As stated in Section 2.2.1, motor-operated valves are generally not Slocked in position by a mechanical device (valve handwheel or stem collar).
Thus, it was not j
t.
oeie nuu setsdes sl sd saoa co t
ih c epseaaae sarchl uo n
weel oeh wvws twe asr e
ndrhi rt o
i peer v
anit amp ceel eoh vtdl E
ad f o nsh vc f v tl ueo fh - f rmoitl fl o aet r f
o gf gf e d
ad oat mvnat t
nve v
o rn s n o a ' e s )i o
o g
ee g
s t reeeo r 'e r c vysvpeg a e pf h h pc n
i o
avwsel s pl oh a wh m Tt o i
pl ih a a
Tg t ey-e t
eaedTvr0vo l
tl neh p
rvh e4 t
y edt e.i vt i
t e et1 e
.l enatd l
r ee h
.h a1ht yt h a oedam c
hh nt et w t nl n w
nml evo s
tti v
d.
eee d nAeic r
e gl t exfit u no raaef D
g
,d naneooceq ai fl h neeivef r il e ht. e pt y i vnt v
pef ps invm l
rl rf e e d pd f mb esel osdl uauih rnaiuou h opaoanu Dvtl t pa( sscs Tpovrwaf n
n n
o o
i o
i s
i t
t t
et a
a l
n vc l
e l n o
o v
au s
s I
E VF I
gn i
kco l
B 6
e e
c n
v n'
o l
e i
a u
t V
q 1
2 c
e e
s S
n 1
o n
C i
e l
d b
e a
t T
s i
l g*
n*
e id s
k o o
ch C
h ot HS H
t l e B.M sa emas rl l
d oe e
re e
l e
t e h
e k
ah oh t w t
e c
rw r
ed ad h
o f o pn rn e
w l
ot oa ea r
d B
a h
ph a
nagy eu r
o pt oh
- h s
H al rt rd Gl yc tt eof a
ii TA oi bh orc Mw Aw mt aievp uetl ncd a nMnl anac eoh enn egmC cuII cne eq nigmMeee e
ek ae s
c rcgtt nll n*
eons ooaa e.
fl E NCVV ro eN 1
2 eB R
f C
e
- HSN* 12 R
7,l
,l!
,l
t e eneie f og en Meyrat o t
's l imsh ovt e ovnshi h aer l
n rasuati nib.
i et et mddsc e
euol w tI s d emer d
h a
a-v d npo ri ot erab uee tenem e
E ra vt os pol ar d rk
,t oh anv omd If o.
nl wceeic ai eel f
ee pne oasvcuo pl t mt pa o
desg l
ehd r l o ql uoaasov eh or.enpt ateeare tsse n
ttl aseeo h ndh vpre aint nte o
o ch eh e t
oat b n e
esioh i
nk cvwb eascm nd o o
h od ant t
cesl d vhl rintoi t nem p
r o h i a n yl t eysoaa tt t
oh dd i
ol tdval a el af r d
i ndCt el l r
t hl vdhl w d eess ae huo c
conmn a
nwa l
l tl o l s ntoh s
eti aieueud readb nep po.i w
e p
rahth onueinaee l s e
o D
sd scrt ctfad st armhd gcrdsst nel sd a
h enn eewe n
eeue i ue t
dn ceet pl d s i
edmavd s e ed a dl oeoct nopno rrarcl e nshhnh aoih rioenmal ueeoeas Aiwt athhtt pl pviih c D whfbvu
)
deu n
n n
n o
o i
o i
i t
i t
t n
et a
a o
vc l
l c
l n o
o
(
au s
s VF I
I s
tnev E
g n
i e
6 k
c c
n n
C e
o l
u i
B q
2 2
t e
c e
s e
v n
S l
o a
C n
V i
d e
1 ts e
i l
g*
i b
n*
~
a id e
T k o C
?
ch HS e
ot H
h l e t
BM sa s
e g
m a
a l
l g s
e e.
re ren e
l oh ohi h
e t w t w-t e
r ad adt h
f o rn rnl e
w ot ea eai r
d a
ph ph u a
n eu o
o b
agy pt
- h h
s Hal yc rt rtd rd Gl TA ii iin eof Aw Awa bh orc mt ai uetl ncd nMnl ana eoh egmC cuI I cne e
ni g m M e c
ek ae n*
r c gt t nl e.
eons oo fl E ro eN 3
4 eB f
R e
C R
- *HSN* 1 l
sat eeO p
et ng eh ae aose yo e
l w
t s
oadvg v
drl pof
.h e nv an n
b nigal ud o neoul var thl oe.
e uit h aoem at s cy) otairp o
v s
af vh se
,aie cSb utpunnt E
d g o) t ur w
sonA tna t ooa Aei se pd not eFdaal ori r
f rtsrh sss i ewl gE ehMot atee o
rseat naa reocl r( rt s
t asn
. u e pl oww tfd ae e
i psl oe n
d c v yl pi wonml vh.
e ol g o
ecnt oet gg ryot geaocentt sc i
voI ceaaa ocl i
ncuswsni m
t o
t k rgg t nbdsegssoo a
ya p
mr nd e
ce e
hii l dll nl e i
ee. e n o pf f agol at sdd cwapwl t r
rmeratOoo erwi e
or oas c
mne ret a gf nl gyl und c s
taif nd ee m
,f n o o e gl bd owin e
ohl fie
. pp ae i
inal e
oti D
n i - yd yy l svtt nguecrl aa rmdtoett rtaeil ao fh oebmt eea l l s ennveuuse t rm on rt eoipoee t e gl cst rrt pmeti eat wuml nn f uiaeeceeof ah ua wwstb ecoo Aqsvrrapwnoaht am
)
deu n
n n
o i
o i
t i
t n
et a
o vc l
c l n o
(
au s
VF I
- s tnev E
g n
e 6
i c
k n
n c
e o
o u
i l
q 2
t B
e c
s e
e n
S v
o l
C n
a i
V de t
1 s
i e
g*
l l
n*
b id e
a k o s
T ch o
ot H
h l e t
BM sa ena l
s e
re e
l oh h
e tw t
e r
ad h
f o rn e
w ot ea r
d a
ph a
n eu o
agy pt h
s H al yc rt rd Gl TA ii eof Aw bh orc mt a
uetl ncd n M nl a eoh egmCcuI I cne e
ni g m M c
ek ae n*
r c gt t nl e.
eonSooa ro fl E eN 5
eB f
R e
C R
- eSN* 1
,l11l{l1l!
iliI
)
li iil
!l
- jj a
.g, ytl l ne-d dt os neeet we o t d h n gd e s
nu e
h uh v
,ioiwenei tv tmcdvinf t y os l
e l
sea gaennenoi nl f
a nhv nl riareit ot e
y ta v
ot io h p pt n n m n hsl n
n e
tal efoe c
n tsns
,oiee t
eo sieil sdeou wadmoih n
oci e
ph a t y o i b wq n
ien tt e
nnt trotuul p te inttita v
ia e
nhl see s
irnapu,
E ssl l t yf a s u i b v t b eaaetity a
o aal ow f m asu vrpvnecl nwl y
thos lt eocat f
wts o
nid odueel meo m
a l rce n
ee e
iefsvl o h n yl s vyep rye
. n rvnn te ul art aaa ae e
au o
eewg aft aaif dm w
drhennrq i
h oi r
ocvt rl r
epwvoope t
Teds eyn reoueol t sda ss p
h we pc teavf ovfe a
nhf r b
o n d n h pl cl e
rt a oetu
.tod
. i l
eel et an aeh enhd dnS rc yobs rgur dvol vl w pe l nae s
rt a
proat n se bd omeuoem.
- nhoihn e
o d
ewpaueaeean D
t erd gm ph oh ehhrae ritwt il ncae neeatft rwtehv i a ayaa enos i
v d
p o
athsrat n vebo rel essgentoem ntierng nunl uhahaanh a u nh e noihppoi i qi c DtvTwwiThbiTr AcwToscs
)
l l
d o
o e
r r
u t
t n
n n
n i
o o
o t
i C
C n
et o
vc w
w c
l n o
o l
(
au l
VF F
F s
tnev E
g n
6 i
e k
c n
c n
o o
e i
l u
B q
2 2
tc e
e e
s S
v n
l o
n a
C i
V de t
1 s
i e
l l
g*
b n*
e a
id s
T k o ch H
H o
n h
o ot t
i l e t
BM s
a a
re e
p m
O a
l s
se le e
d nt re re e
l e
eo oh oh h
e k
pm t w t w t
e c
O e r
ad ad h
o R
f o rn rn e
w l
y ot ea ea r
d B
l f a
ph ph a
n t o eu o
o agy n
pt h
h s
Hal ee yc rt rt rd Gl tl eof a
rb ii TA iiAw Aw bh orc ea mt aiev p uetl ncd a nMnl anac eohenn egmCcuI I cne eq ni g m M e e e e
ek ae svv c
rcgttnl l n*
eonSooaa e.
fl E NCVV ro eN 6
7 eB R
f C
e
- HSN*
1 2 R
j tl
- l1
,l
tt e f
g o
oem erudfta e v i o e o e n e. i h nv nhl rsrhi e
re eeave t
nel n
i va wt ant o t
itTr wdsil h
eol ont e
ev o
voill s(i v
dr df incod a s
y retl eso evacriir E
epe t ont rewno
.l k
h u
.ocl ttl op)t wl r t e f
cot htiul onaei nn oaesgeat o
ot sst senoevt nee pvpanhlf l
f ea w
cvl iepu owit oa n
no rtl d yd easeoq tf -
k s
o eo o
orrl ervob e
aereafid i
ril t asad uh p
es iivef e
ot ne dvb tl all oen
,i o t
et o c
b ew ohd al u i e a
h e p
wir a
i st eet nh mit ehas nrevedt p r
son rcnitrot g
v u
h h e
,o c
l po ne o r a r gl s
gT n t l s
e c
eameosfgoaeea en o
bry e
el hnnhts if geh w hi i e ol
. tt rtn D
h al t eit edt ht tk wra t a ernsl yw l
anaaiae dt u hnttvpaeel dde h eell ard nun ti nal mmvel nl e tl k oo ed i
assspu aea iaoh aoenh uaoh h nm Mmct vcdI wfhh w WatiiA os
)
de n
n u
c o
o n
r i
i o
i t
i t
t n
et a
a l
o vc l
c l n o
o
(
au s
s I
VF I
- s tnev E
g 6
n e
i c
n k
n o
'c e
i o
u l
q 2
1 tc B
e e
s S
e n
v o
n l
C i
a V
de t
s 1
i l
e g*
l n*
e b
i d s
a k o o
T ch ot H
N h
t l e BM sa emas le re rl e
l oh oe h
e t w t e t
e r
ad ab h
f o rn rw e
w ot ea ed r
d a
ph pn a
n eu o
oa agy pt
- h
- h s
H al yc rt r
rd Gl io eof lA iiA w An bh nrc mt ai uetl ncd nMnl ana eoh egmC cuI I cne nigmMeee e
ek ae c
rcgtt nl l n*
eons oo e.
fl E ro eN 8
9 eB R
f C
e
- HSN*
R i
l i
!l l
ll l'
,)-i j
)!
il
,i
._N '
i e
d e
l r
e vda b
e ns st l eh z-i s t
r oo as
- att eeswhw t
e t c s
hnne4 ~ svn.
dsaea o
ilAt ed a
~
i ed hso t
o hma
.e t aeh1 dnve tapt f
metal e.te pt e
oes ema) o h
eohm hreoufheiro mlih2 gt f r s t o t t ov o o t h t pl e oe t( e n
oti on flds tc cv t'
rrs c
in s.nrao ae hm un l
n f
a ed r k i m p)i ltevl etohsega a
oun l o v
ihprg env e
gwnnu eeo e
oorl natefudbi v
dn iaor v r e p"d r c e a o f d
oe kd E
eitl so l
vei t
l hoet wvi d
wrtece 5
ob emra a a pt gnfo teeaohavot c
m
,haer vm,l gooptavd l tral a emgt et e f
u iac oll oof ehbr n
ran tan onpgat sdl oaot l p e
o ei) swe o
nf eseisvl yoodyp i
ntd1 dg s i S i(d h o v pi fmto ll o _
t esl(fe rtCd etl o n
oi p r ul -
n" mrdodov ooar oem icCldr p
e i
eieinrantcci i
bhu:
fa a u Ei e" r
tbee E
ps ut itratta roo ia c
di t cyt e
tbas n
aa p gi m t n s
aWearcs rds raneedrldm s
nam e
h hl un earewoucieoeuysdeha gt eop i q n o p s n pb e e v c e D
.tooee e
s s gh naht oet e e n oi g rl eer veoi-rt irt c-visue-i S t pb mt l nt ee reuarl s b ql resCepme s
ainoh t o u p o ei a o u e oih e C e u e h y p vli tt et DosravpsssatdEfssTbu
)
deu n
n n
o i
o i
t i
t n
et a
o vc l
c l n o
(
au s
VF I
- s tnev E
g n
e 6
i c
k n
no c
e i
o u
l q
1 tc B
e e
s e
n S
v o
n l
C i
a V
de t
s 1
i l
e g*
l n*
b id es a
ko o
n T
ch ot N
h o
t i
l e t
BM s
a a
re e
p m
O as se d
nt rl e
l e
eo oe h
e k
pm t e t
e c
O e r
ah h
o R
y fo rw e
w l
ot ed r
d B
l f a
pn a
n t o eu oa agy n
pt
- h s
Hal ee yc r
rd Gl tl TA io eof a
rb An bh orc ea mt ai e v p uetl ncd a nMnl anac eohenn egmCcuII cne eq ni g m M e e e e
ekae svv c
r c gt t nl l n*
eonSooaa e.
flE NCVV ro eN 0
eB f
1 R
C e
- HSN* 12 R
i ll
!lllllliI
unexpected that motor-operated valve events represented a small proportion of the events found. Most of the inadequacies in mechanical blocking
{
applications involved air-operated valves.
For the one mechanical blocking 1
failure of a motor-operated valve, electrical power had been removed from I
the valve operator because the valve operator motor windings had burned out 1
and maintenance personnel were in the process of removing the motor operator.
In seven of the nine air-operated valve events, the valves were equipped with a manual handwheel.
In each event, the manual handwheel was engaged, and prevented the desired automatic actuation of the valve.
In one event at McGuire Unit 2, the air-operated valve was equipped with both a stem collar gag and a manual handwheel to block valve movement (Ref. 5).
In this event, when the handwheel was disengaged, the valve still was incapable of remote operation due to the stem collar gag.
In each of these seven events involving a mechanically blocked valve, the blocking device was left in place on the valve when it should have been removed.
There were no reported instances of the auxiliary handwheel failing to block the valve in position successfully.
There were two events involving an air-operated valve without the optional handwheel operator (Refs. 9 and 10).
In each event, the air-operated valves without handwheel operators were not restricted frce movement by stem collar gags or other gagging devices.
In each case, an undesirable valve actuation occurred when the unblocked air-operated valve was the only isolation valve available to isolate an open piping system.
Finally, one motor-operated valve in this study was blocked in the closed position with a stem collar gag (Ref. 1). After the handwheel of the motor-operated gag was disengaged and turned in the wrong direction, the stem collar gag failed to maintain the valve in the closed position. This is the only instance of a mechanical gagging device failing to prevent valve motion.
3.3 Event Causes and Corrective Actions Table 2 lists the root cause attributed to each event with a brief statement of the cause description and the associated corrective actions to prevent recurrence. An examination of this table indicates that four events were attributable to personnel errors and five events were caused by inadequate procedures.
In one event, the licensee could not or at least failed to indicate a cause for the mispositioned handwheel and the cause was listed " unknown."
Personnel errors involved both acts of omission and commission. That is, procedures or their intent were not carried out correctly., For instance, at McGuire (Ref. 1) the technician simply made an error in turning the handwheel in the wrong direction (an act of comission), while at Limerick (Ref. 2) the technician left a handwheel engaged (an act of omission).
This categorization of cause assumes the procedures and/or verbal
a 1II l
d t
n n
a s
- o a
y h
y e
di 1
t ae a
de r
nt dde t
m ev un e
ac eev yno nl od o h
ha n gi fim e,ga tei t
iat i
e v gi v ct ee aga cdr l as -
eoi n
hv~
hnr ee agsg vrs i
ti cet pk t v
an lPo t
s scc e
i a
p d
n hc' eei oe anys v
e o
t e rbn olf otu n n "n k
i ir e
i t
f t
i c
t wr wtm ea anlf ooe o
c o
od db haio i p l
A dc sna e
te thb dto e
l soov tie eics" e
om e
s ed n it nl d
sc b
v el a v
a eenn aoy i
l e hu eel v t roe l pf l
t ct wog rrl copu p i l
c e-dcn aie umsq l t in e
rg n
i.
e wh r
ee san wo r
n ayny rs t
thrs kre i
r so.
heie elt st rtd lt o
ald hak weaf nil y aui ei C
w e
stt eh o iwat me es os bd sht ti no.
eno
'e o o e ew n
ldnr t
t s wp ho v
p vs l
rdno eeeo ny e
d l
o l
tl unoi ngmi efdv nl a
r ad u o dait ngtr niel aa vl p veor ehta oarp.
atsa hr e
kht c
ir sga s
mniv t
ees ect n oese r
prg rev eu hha hoio rhop eeeoa ed ef he n
Tww Tl wc Ptpo PbDfg Piro Tn o
i tc d
A e
l t
ie e
a d nd yft v
r d
t one l oo i
a-e es mog t
n t
ld g
h sg cn l
c l n a
tt yra-eod e
e oa g
o reg.
riie e
r ch n
rn ap s
rtds h
r e
o r
ed oi r
w o
men fs otbo csse d
C eh o s
as pr h
noev n
tti l
nwe medt ipre a
d s
t e
o r
ell e ur h
n gc e
isu taum sld" a
ene h
tld o
gae d
hir w
iee atct nrce e
e e
tni d
sec o
n itor n
s s
rd ng oho rnee k ure o
u u
du an pwr o
vr rePw i
a a
etg hi dp fdl e an t
C C
s n
t dn i af m
s i
uyo ts eal sdvf d
.e s,
t f
abr f e rha e
i yel v od n
o c
w et i
r rned riel pe e
uoh a f e a ".
e n
l s 's v si v
t nce e
e dit o rihvg if E
n ash sk dee et w
otw n
mi e
i ot no vs catt pndei t
m co ar el oca mentt en e
il n it han rih y edaoc h e 2
t n
i cs Tvi Pftb Tihna td a
h o i
i e
t ctl nr r
l S
e e
he oe b
t ge ct s
s s
fb a
e ah ef e
e e
T s
A gw Ta r
r r
et u
u u
u so a
d d
d un C
e e
e a
r r
c c
c cd t
o o
o o
o l
o r
r r
r r
eu o
r r
P P
P ho R
E E
Tc e
e e
l l
t t
t e
e a
a a
n n
u u
u n
n n
q q
q w
o o
e e
e o
s s
d d
d n
r r
a a
a k
e e
n n
n n
P P
I I
I U
.o N
t n
1 2
3 4
5 6
ev E
p l
l l
wte h
r ins c
t f
k os noi cie et v n
n d
ot r e
r o
i e
l ap b we i
v bl os t
d o
oh eh c
e m
l sg v
o A
k e
aii ant c
r c
h h o e
o i e t
v l
e nnam sen i
r ao e
ece t
s e
h nt rnm c
a w
cyes uap e
w el ey ddi r
s mnws eiu r
l n l
ot cuq o
eo e
d ee oge C
ei e
eebr r
ht h
rr u
pen wi w
i ees dr d s d
uhl s diu
)
no n.
qwb e evt d
ap as e
ar l oe e
h h e rel p i rr u
n v
vi ap n
ee el el aw t
d i
h p h a h avo eon t
To Tv Tval Dt a noc
(
r n
t o l
d o
nr e
oe os i
ner sn tl t e d
t ove an i e see c
ie e
wo d av dnli A
s lh s
efl e o gl mr l"
a l pne oseet e
t uh n d
se i
v isir v
ct nte i p ae aes i
es oag n
f ve f r s
t sid sh a ay lh aa c
ud ert g hb sat sm w
e a
t e n
c ev eeo r
c t a pd e ed r
d rttt r
nc es mo uee us a.
o e e i yii o
dh m d yrh n C
e h udbfd gt et u esut o s
t qn i
ns c
s.
c c
i d
u eidte ir otsd ol cet n
a ds enb t e raae rl ova a
C eb ese ad Ph s
P a l l t ueud o rn td o dao e
f ussait eu y
nl yel vs s
o b
nc p
ryac rzu i
u iAe ss oy af aiod a
t r
cyea r i ",d rncer l
C n
t il rw ot e
og go
's a pnnl potaf l
t".l e
b u t
m a
adl er meei mcag n
e nebee ve edpa eeh nn e
t R wh oce l n Tiof Trt uo v
a E ot roh ae E
t L n prw vg S
kh pd ents n
et s
s e
h uiasa h o e
e 2
s T"
wwah Tn r
r u
u u
e a
d d
l C
e e
b r
r c
c a
t o
o o
o T
o r
r r
r o
r r
P P
R E
E e
e l
l t
t e
e a
a n
n u
u n
n q
q o
o e
e s
s d
d r
r a
a e
e n
n P
P I
I
.o N
t n
7 8
9 0
e 1
v E
- L 1
instructions were adequate in light of the technicians' experience and training. An event at LaSalle (Ref. 8) shows evidence of cognitive error, an instance where the act of commission was caused at least in part by l.
the technicians' lack of knowledge (i.e., training and experience). However, inadequate instruction could also have been been a contributor in this j
Case.
Procedural inadequacies usually involve incorrect instruction, lack of clarity, or insufficient / missing information. An example of incorrect procedures is given in Reference 9 where the procedures were written assuming a valve would fail closed on loss of air pressure to the actuator when in fact it failed open. A lack of clarity and/or insufficient information was the most likely cause of the event at Waterford (Ref. 5) where temporary procedures did not note valves were " reverse acting" and at Grand Gulf (Ref. 3) where the desired position of the handwheel was not specified in temporary procedures.
Of the ten events, four occurred as a result of " temporary" changes.
Of these, one involved a temporary valve marking (Ref. 6) one occurred during a temporary system modification (Ref. 9) and three events were attributed to inadequate temporary procedures (Refs. 4, 9, and 10).
The two most serious events (Refs. 9 and 10) were partly due to a failure to recognize the need to sustain an air pressure source to the valve operator to maintain a closed position.
In examining the corrective actions that were associated with the four events involving personnel error, the corrective actions taken to prevent recurrence (as stated by the licensees) were:
(a) Additional operator training; (b) Additional administrative control (locking the valve handwheel so it cannot be engaged); and (c) Removing the handwheels from the valves.
Similarly, the corrective actions taken for the five events involving inadequate procedures consisted of procedural revisions including:
(a) Specifying that the valve handwheels be locked so it cannot be engaged without administrative control (similar to 3.3(b) for personnel error);
(b) Adding instructions that a valve may be gagged with more than one gagging device; (c) Providing guidance on how to gag and ungag valves; (d) Describing the " opening" direction of a valve; and
r
_ 17 (e) Adding a requirement to mechanically block a valve if it is the only isolation valve between a high pressure and low pressure system.
It should be noted that none of the ten events were repetitive at the same plant. Therefore, each of the corrective actions were effective.
3.4 Consequences of Events The consequence of each event is listed in Table 3.
Each event had some safety significance, but in some events the actual consequences of the inadequate or inadvertent blocking of an automatic valve were relatively minor. Events of this nature would be technical specification violations or a loss of redundancy in containment isolation.
Other misapplicatiens of mechanical blocking devices could have resulted in a loss of a safety-related system when it is required to be operational.
One valve at Oconee Unit 2 (Ref. 6), that was inadvertently blocked in the closed position could have resulted in reduced emergency feedwater flow to a steam generator in a two loop plant. Although this is an analyzed event and credit may be assumed for operator action in restoring emergency feed-water flow, it is also an event of unknown safety system unavailability which could complicate the effects of certain transients and is a contri-butor to postulated core damage scenarios involving loss of all feedwater.
One of the two containment spray systems was found inoperable during surveillance rounds at St. Lucie 1 (Ref. 7) because the valve handwheel was engaged with the valve in the partially closed position.
In this case, operator action cannot be assumed to restore the contair. ment spray loop to service. The safety analysis usually assumes some combinations of trains of the containment fans and containment sprays are inoperable for safe plant shutdown, but the effects of any major plant transient or loss of coolant accident would increase with loss of one train of the contain-ment spray system. A single active failure would further exacerbate the situation.
The two most serious events involving inadequate isolation valve blocking resulted in the loss of numerous safety-related equipment.
Each of these events was caused by an isolation valve that was not mechanically blocked in the " Closed" position, and subsequently cycled to the "Open" position.
Each event was attributed to inadequate temporary procedures.
In the first of these events, an incorrectly blocked air-operated isolation valve inadvertently opened with the reactor at power and released high energy steam to a safety-related equipment area for I hour and 52 minutes (Ref. 9). The steam blowdown could not be isolated and a significant reactor transient occurred. Several valves in the area were disabled due to the steam environment. The disabled valves included the affected steam generator's main steam isolation and relief valves.
- w 1
l1llj l
l jlI i
l I
iii
- '~
3
, E '.
S.
gr.
m a
a
.n p
h.
r e
sw m
- =
t '
s.
s u
td p h c
c r
eo u
e in i
l uw t
u~
d e
i r
no S'
C e's' t'
h a
o il en' m
t f
t mb Cha
.h a a
a~
Et
. td r.
a e
r 2ed
.d v
n c.
i n
e 5he ef e eu s.
v i
n tt hod sd l
e d
s t
e ue e.
t g
nei ee ar h.
n m
atx fnn c
t e
a ml ae oo ed m
e aa rg Ns' be a
n t
n uih g
a s
d i
i s
tg otc n
w
's i v
a si s
hii i.
ev t
n s
r mh ns) co t
n i
n o
1 w
i mr nr n
o a
in t
o aoe ep e
c m
ao a
rts rol u
m ti r
o n
dro
.qe n
e l
nt e
fdo o
ev i
d a
ia n
ei ttc sl a
i i
au e
adt nn na t
s t
mt g
eei eem ov n
t n
c red umo c
o u
e oa m
ann qpo n
c o
t t
a o
eir l o o
r e
dtc su ai e.
n P
ye t
en bqe it d
w ta i
o tt s
y tee ueh ia a
amh S
t nl s
d l w o
r l pt y
's eo t
w e
id w
p ei
. tdt e
ts u
o g be t
s rur enn t
c oi o
l a
ae n
qo tfae n
n p
b m
f e
t o
yef ea v
e e
m n
a e
h n
i t
espe v
u l a w
S d
hy t
e t
edd f
m E
q ae o
. R r
n f
n e
ati 4 e ph C
tc m
c fee r u'e e
nr d
h s
ot ~
o r
b ig a
o li ty w
e ne o
i t
saf 1h t
c n
is a
o tn l
o b
r e
t r
ael foaf E
C iw b
f u
ne n
n p
ra o
ro do n
om f.
dd S.
l s
ie
'o o
ou op l
c n
tyq htse o
a a
C a
t o
o t
t m
i a
R.
i d
cn t
f i
mey pd e i s
t o
t n
ua o
t afl eert e
n Nd r
n a
d r
a eal dco c
e
'- n o.
e er e
s l
tsa uce
'e re t
n o
s t
ad h
n t
L a' f
t e
o o
n t
a i
s dn oIt u
P ny l
P i
lf w
a i
nee or q
/
ob a
l aa d
r itm tt
,t e
l i d i.
e i
e t
t acn nsa s
a tn t
_m m
ty e
n meo mi p.
n u
aa n
su a
nr f
o e
fr o
md o
t lt e
el e
eo w
m ffi ogue C
c os t
co t
tt y
t n
oav r n pl A
i o.
nv s
on c
i n
i e
vtn P
e Pe n
e a
eme peru oo ue n
v e
h t
sa mbHf 3
_nhi qg i n
g t
n aet u
Re o
t er a
i r
o eto pr d
e inc e
sa m
e e
f c
l sn e2 -
l
. tie c
nh cr m
o e
St( y b
a
.t n
oc e
ne e
n rns Ca l
a cso e
cs h
et e
i ia Cwte T
iar u
i t
ua f
n eaw E
nt fwp q
yd qw o
o n
l m nee i
e t
n e
o b
h eiml c
s e
i s
s f
i af c h
pp e
n f
n s
o t
l oi tdim p
o a
r o
o c
l h
euo s
c s
e c
l s
u oew ftqc n
s d
rs al e m
l l
o e
tat u
s l
l l
r a
a a
a a
a l
r nen gsda c
u u
h u
i ol e neew i
t t
t t
l l
cei irt n
c c
r c
n a
a nrs d
ct h
a a
e a
e u
u u
n omen c
t t
t t
ea oofa e
o o
a o
o c
c nhr l ofl T
N N
W N
P A
A ATt Frap
.o N
t n
1 2
3 4
5 6
7 8
9 0
e 1
v E
il, l1
[jll t
l tj i
s 19 The other event at Hatch Unit 1 (Ref. 10), was initiated when an unblocked isolation valve in the residual heat removal pump suction line inadvertently opened, and flooded a basement corner room to a depth of 14 feet. The flooding submerged two RHR pumps, one core spray pump and the room cooler.
The plant was defueled at the time and the equipment that was flooded was not required to be operable.
At Waterford Unit 3 (Ref. 5), a mechanically blocked blowdown isolation l
valve failed to close on an emergency feedwater actuation signal (EFAS).
Those valves should close on an EFAS to maintain steam generator water inventory. The redundant blowdown isolation valve, which had not been blocked, functioned as desigr,ed and steam generator inventory water was maintained.
In another event, at Oconee Unit 2 (Ref. 6), mechanical gags prevented the main steam drain valves from cpening to drain condensed steam from the piping. About 20 minutes later, a water hammer occurred. The water hammer was minor and only one main steem snubber in the system was damaged. However, water hamer event:: can potentially damage the system and affect on plant safety.
4.
FINDINGS AND CONCLUSIONS Three methods were found to be in use for physically blocking the actuation of valves. They are:
(1) engaging of the valve operator handwheel for air operated valves; (2) installing stem collars for air-operated valves and motor-operated vcives; and (3) gagging safety or relief valves.
The primary r>ethod used to block an air-operated valve was engagement of the handwheel.
1"here were no instances of an engaged handwheel failing to hold an air-operated valve in position. There was only one event of a stem collar gag failing to ?,old the valve in position. An investigation into the misapplication of mechanical blocking devices found thet they were misapplied only to isolation or flow control valves. The safety and relief valves were gagged when the situation reouired gagging, and after they were, the gag worked as intended and the gag was successfully removed to restore an operable valve to service. Motor-operated valves are only mechanically blocked in unusual circumstances, so mechanical blocking device inadequacies occur almost exclusively with air-operated valves.
The reported misapplication of a mechanical bkning device has not been frequent. Only ten events including one foreign event were identified in a five-year search period.
There was r,o evider-e of repetitious failures by any ifcensee in the misapplication of mchanical gags. Therefore, the corrective actions taken by thes3 licensees were effective in preventing subsequent missoplicatiao l
1 The root cause of the inappropriate mechanical blocking of a valve was i
almost evenly divided between personnel error involving both acts of omission and commission and inadequate procedures. It was noted during i
the study that inadequacies in temporary valve markings or temporary pro-cedures indirectly contributed to four of the ten events (Refs. 4, 5, 9 and10).
The actual consequence of the ten events involving misapplication of the mechanical blocking of an isolation valve ranged from a reduction in redundant protection without any actual consequence to significant damage to safety-related equipment. Specifically, it has been reported that a valve that was inadequately blocked and subsequently cycled to an unsafe condition has the potential to cause all of the following:
(1) a reactor transient; (2) an unisolable steam and water release; (3) a harsh environment with steam and flooding damage to major safety-related equipment, components and other control systems; and (4) the potential for personnd inju'ry.
Similarly, the study identified instances where the failure to remove a mechanical blocking device when it was no longer needed led to safety system unavailability for one of the two trains of the emergency feedwater system and the containment spray system.
In another instance failure to remove a mechanical blocking device resulted in a water hammer event.
In summary, although the misapplication of mechanical blocking of isolation valvis are infrecuent and unrepetitive occurrences, they can lead to potentially serious incider'.s and cause safety-related valves, equipment and systems to be incapable of performing their safety-related function.
5.
SUGGL5TIONS It is suggested that the Office of Inspection and Enforcement consider issuing an information notice detailing these events, their underlying causes and possible corrective measures. The information notice should suggest that licensees:
(1) Verify the adequacy of the temporary procedures regarding mod 1fications to piping systems so adequate protection is assured that a single isolation valve will remain in the " safe" position when needed; (2)
Identify potential causes of unintended valve actuation (e.g.,
temporary loss of power, surveillance tests) that could occur during maintenance which would result in an unblocked isolation valve cycling to an unsafe position, especially when this would result in an "open" system; and
- (3) Assure that procedures for restoring blocked valves to service are clear and have adequate verification.
In additfon, because a high proportion of the significant events in this study were directly attributable to human factor deficiencies during the performance of maintenance activities, NRR Division of Human Factors Technology, Maintenance Training Branch, should review the information in this report to determine if.the maintenance and surveillance plan adequately addresses the human performance problems identified in this report.
________m__
^ 6.
REFERENCES 1.
LER 369/81-173-03, "The Inadvertent Opening of Steam Generator IB Main Feedwater to Auxiliary Feedwater Nozzle Isolation Valve," dated December 7, 1981 for McGuire Unit 1.
2.
Inspection Reports 50-352/85-36 and 50-353/85-09, dated September 23, 1985, for Limerick Units 1 and 2.
3.
Inspection Report 50-416/85-22, dated August 9, 1985 for Grand Gulf.
4.
LER 370/85-009-00, " Steam Line 2C Water Hammer," dated June 20, 1985 for McGuire Unit 2.
5.
LER 382/86-002-00, " Reactor Trip Due to Dropped CEA Number 88 and Failure.
of Blowdown Isolation Valves to Close," report dated February 21, 1986 for Waterford Unit 3.
6.
LER 270/82-009-03, "2B Emergency Feedwater Flowpath Inoperable," for Oconee Unit 2, dated July 29, 1982.
7.
LER 335/77-034-00, Not Titled, dated September 15, 1977 for St. Lucie Unit 1.
8.
LER 373/83-137-01, Not Titled, dated November 23, 1983 for LaSalle Unit 1.
9.
Restricted Transcript from Steering Committee for Nuclear Energy, Comittee on the Safety of Nuclear Installations.
}
- 10. Inspection Report 50-321/85-37, dated January 15, 1986 for Hatch Unit 1.
-