ML18016A313

LER 98-001-00:on 980109,potential Condition Outside Design Basis Related to Instrument Air Sys Leak Causing SG pre- Heater Bypass Isolation Valves to Be Inoperable Was Noted. Caused by Inadequate Design Control.Generated Jco 98-01

ML18016A313
Person / Time
Site:	Harris
Issue date:	02/09/1998
From:	Verrilli M CAROLINA POWER & LIGHT CO.
To:
Shared Package
ML18016A311	List: ML18016A310 ML18016A313
References
LER-98-001, LER-98-1, NUDOCS 9802170061
Download: ML18016A313 (4)

Text

NRC FORM 366 U.s. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB No. 3150-0104 (4.95)

EXPIRES 04/30/96

' ESTIMATED BURDEN PER RESPONSE TO COMPLY WITH THIS MANDATORY INFORMATION COLLECTION REDUEST. 509 HRS. REPORTED LESSONS LEARNED ARE LXCENSEE EVENT REPORT (LER) INCORPORATED INTO THE LICENSING PROCESS AND FEO BACK TO UIOUSTRY.

FORWARD COMMENTS REGAROIHG BURDEN ESTIMATE TO THE INFORMATION AND (Sae reverse for required number of RECORDS MANAGEMENT BRANCH Irk F33L US. NUCLEAR REGULATORY COMMLSSION, WASHINGTON, OC 20555000l, ANO TO THE PAPERV/ORK REDUCTION PRDIECT ISI50.

digits/characters for each block) OIOIL OFFICE OF MANAGEMENT ANO BUDGET, WASHUIGTON, OC 205IL FACIUTY NAME lll DOCKET NUMBER I2) PAGE I3I Harris Nuclear Plant Unit-1 50-400 1 OF4 TITLE (4I Potential Condition Outside Design Basis related to Instrument Air System Leak causing the S/G Pre-heater Bypass Isolation Valves to be inoperable.

EVENT DATE (5) LER NUMBER {6) REPORT DATE {7) OTHER FACILITIES INVOLVED (6)

FACIUTY NAME DOCKET NUMBER MONTH DAY SEOUENTIAL REVISION MONTH DAY YEAR NUMBER NUMBER FACIUTY NAME 1 9 98 98 001 00 2 9 98 DOCKET NUMBER 05000 OPERATING THIS REPORT IS SUBMITTED PURSUANT To THE REQUIREMENTS OF 10 CFR 5: {Chock one or more) (11)

MODE (9) 20.2201 {b) 20.2203(a)(2)(v) 50.73(a) {2)(i) 50.73(a)(2)(viii)

POWER 20.2203(a) (1) 20.2203(a) {3){i) 50.73(a) (2) {ii) 50.73(a) {2)(x)

LEVEL (10) 100%

20.2203(a) (2) (i) 20.2203(a) (3) (ii) 50.73(a)(2)(iii) 73.71 20.2203(a) (2)(ii) 20.2203(a) (4) 50.73(a) (2)(iv) OTHER 20.2203(a) (2) (iii) 50.36(c) {1) 50.73(a)(2) (v) Specify in Abstract below or in NRC Form 36BA 20.2203(a) (2)(iv) 50.36(c) (2) 50.73(a) (2) (vii)

LICENSEE CONTACT FOR THIS LER (12)

NAME TELEPHONE NUMBER Ilnalvde Ates Cade)

Michael Verrilli Sr. Analyst - Licensing (919) 362-2303 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT (13)

CAUSE SYSTEM COMPONENT REPORTABLE REPORTABLE MANUFACTURER CAUSE SYSTEM COMPONENT MANUFACTURER TO NPRDS TO NPRDS SUPPLEMENTAL REPORT EXPECTED (14) MONTH DAY YEAR EXPECTED YES SUBMISSION

{Ifyas, complete EXPECTED SUBMISSION DATE). X No DATE {15)

ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 singla-spaced typawrittan lines) (16)

On January 9, 1998, a condition was identified during operation that results in the plant being potentially outside it' design basis. Specifically, a potential failure mechanism exists where a leak in the non-safety Instrument Air System could result in the inoperabihty of the Steam Generator Pre-heater Bypass Isolation Valves. These valves are safety-related containment isolation valves that are required by plant procedures to automatically shut in 10 seconds or less upon receipt of a Main Feedwater Isolation Signal. These valves are positioned by a pneumatic piston-operated actuator which is supplied by the non-safety related Instrument Air System. They are designed to automatically close if control air supply is lost. However, a "smart" air leak has been postulated in the Instrument Air system that could possibly reduce the air inlet pressure to just low enough to affect proper operation of the actuator's 3-way and 4-way pilot valves and not be detected by Operations personnel. If this occurred, the pilot valves would shuttle, causing the accumulator pressure to bleed off, which would prevent the valves from closing as required. This potential scenario constitutes operation outside the design basis of the plant and was reported to the NRC via the emergency notification system on January 9, 1998 at 1450 hours0.0168 days <br />0.403 hours <br />0.0024 weeks <br />5.51725e-4 months <br />.

The cause of this condition was inadequate design control during development of a plant modification implemented in August 1984 in response to NRC Information Notice 82-25. The investigation for this event also revealed several other missed opportunities to identify this condition during subsequent plant modifications and/or related evaluations.

Immediate corrective actions included development of a Justification for Continued Operation (JCO), with the required evaluation and compensatory measures to ensure continued operability. The JCO evaluation determined that the isolation valves were operable dependent upon once per 12-hour monitoring of the discharge pressure on the inlet regulator for each valve actuator. Additional corrective actions will include a plant modification to resolve the design deficiency, a FSAR revision and training for appropriate Engineering personnel.

9802170061 980209 PDR ADCICK 05000400 S PDR

NRC FORM 366A US. NUCLEAR REGULATORY COMMISSION M-SS)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATlON FACIUTY NAME (I) DOCKET LER NUMBER (6) PAGE (3)

SEOUENTIAL REVISION YEAR NUMBER NUMBER Shearon Harris NUclear Plant - Unit ¹1 50400 2 OF 4 98 - 001 - 00 TEXT Pr more spscers nod. vso oddMmsl copies of ABC Povv 3IFQI (11)

EVENT DESCRIPTION:

On January 9, 1998, with the plant operating in mode 1 at 100% power, a condition was identified that results in the plant being potentially outside the design basis. Specifically, a potential failure mechanism exists where a leak in the non-safety Instrument Air System (EIIS Code: LD) could result in the inoperability of the Steam Generator (S/G) Pre-heater Bypass Isolation Valves (1AF-64, 1AF-102, and 1AF-81, EIIS Code: SJ-V). These valves are safety-related containment isolation valves that are required by plant procedure PLP-106 (Technical Specification Equipment List and Core Operating Limit Report) to automatically shut in 10 seconds or less upon receipt of a Main Feedwater Isolation Signal (MFIS). These valves are positioned by a pneumatic piston-operated actuator and are opened and closed by high pressure air (-150 psig) from the actuator's accumulator. The accumulator is maintained at a higher air pressure by an air intensifier pump. The intensifier is a double piston compressor that is driven by control air. The air intensifier is needed to boost inlet control air pressure to approximately 150 psig, since normal control air pressure (approx. 75 psig) will not close the valve alone. With the use of pneumatic pilot valves located on the actuator, the intensified air in the accumulator is used to position the actuator piston, which is connected to the valve disc by a common shaft. The pneumatic pilot valves guide the intensified air from the accumulator to either face of the piston to position the operator. Directing the high pressure air below the piston will open the S/G pre-heater bypass valves; and directing the high pressure air to the top of the piston will cause the valves to close.

The S/G pre-heater bypass valves are designed to automatically close if control air supply is lost. This is accomplished by two in-series solenoid valves that are energized open to supply the control air from the Instrument Air System. Ifa Main Feedwater Isolation signal is generated the solenoid valves will de-energize, securing the control air supply, which causes the S/G pre-heater bypass isolation valves to close. The solenoid valves will also de-energize if Instrument Air System pressure drops to 66 psig.

However, a "smart" air leak has been postulated in the Instrument Air System piping that could possibly reduce the air inlet pressure to just low enough to affect proper operation of the actuator's 3-way and 4-way pilot valves and not be detected by the pressure switches in the main header of the Instrument Air System that would de-energize solenoid valves at 66 psig.

If this occurred, the pilot valves would shuttle, causing the accumulator pressure to bleed off,thewhich would prevent the valves from closing as required. Operations personnel would have no indication of accumulator low pressure other than local observations made by an auxiliary operator and possibly dual valve indication in the main control room due to the valves cycling slightly.

This potential scenario constitutes potential operation outside the design basis of the plant and was immediately reported to the NRC via the emergency notification system on January 9, 1998 at 1450 hours0.0168 days <br />0.403 hours <br />0.0024 weeks <br />5.51725e-4 months <br />.

CAUSE:

The cause of this condition was inadequate design control during development of a plant modification implemented in August 1984, which was prior to issuance of the Harris Plant Operating License. Specifically, NRC Information Notice 82-25, "Failure of Hiller Actuators Upon Gradual Loss of Air Pressure" stated that on a gradual loss of control air, the pneumatic control valves may assume some intermediate position and cause the stored air in the accumulator to vent to atmosphere and prevent the actuator from performing it's safety function of closing. To resolve this concern Field Change Request (FCR-I-992) was developed to install two pressure switches in the Instrument Air System header that would de-energize the solenoid valves (described above) at 66 psig. However, ANSI Standard N18.2.a "Nuclear Safety Criteria for Design of Stationary PWR Plants" requires that a barrier be installed between safety class interfaces, such as the air control circuit and the instrument air supply. This design requirement was not properly applied during the development of FCR-I-992; therefore, the safety related system did not meet the single failure design criteria.

The investigation for this event also revealed additional missed opportunities to identify this design deficiency in the Instrument Air System. These included: (1) HNP's response development for NRC Generic Letter 88-14 in 1989, which specifically included an evaluation (Plant Change Request, PCR-4151) of the Instrument Air System and the Pre-heater Bypass Valve actuator design, (2) Adverse Condition Report ¹91-314 initiated in June 1991, which identified a leak in the supply air regulator for 1AF-81 that significantly lowered accumulator pressure, and (3) development of PCR-6158 and it's associated evaluation (PCR-6066) in 1992, which implemented a modification to the actuator air circuitry to enhance the air intensifier pump and upgrade portions of the control air piping to safety-related. In each of these cases, the "smart" leak scenario described in this LER was not identified nor considered credible due to the incorrect assumption that the system design met the single failure criteria.

N M (4. )

NRC FORM 366A US. NUCLEAR REGULATORY COMMISSION F)a6)

LlCENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (I) DOCKET LER NUMBER IS) PAGE )3)

SEQUENTIAL REVISION NUMBER NUMBER Shearen Harris Nuclear Plant ~

Unit //1 50400 3 OF 4 98 - Ool .- 00 TEXT P secre s~seir cere'rerf. ese errrFse)re copes el h'RC &m NQl )17)

SAFETY SIGNIFICANCE:

There were no actual consequences associated with this potential failure scenario. JCO 98-01 established the basis for continued operability of the pre-heater bypass valves. These valves are listed as containment isolation valves in PLP-106 (TS Equipment List and Core Operating Limits Report) and are required to automatically shut following receipt of a Main Feedwater Isolation Signal (MFIS). A MFIS is generated from the safety injection actuation logic as well as on high-high S/G level in any steam generator. As such, any accident analyzed in the FSAR that results in a safety injection or high-high S/G level may be impacted by degradation of the non-safety related air supply to these valves.

The list of applicable accidents includes: Main Steamline Break (15.1.5), Feedwater Line Break (15.2.8), Steam Generator Tube Rupture (15.6.3), and Loss of Coolant (15.6.5). Two different failure scenarios must be considered.

The first is the failure of the air supply to the valve actuators coincident with initiation of the accident. This is necessary because a non-safety related component cannot be credited in the mitigation of an accident, nor can the loss of a non-safety related component result in failure of a safety related component. The second condition to be considered is the undetected loss of air to the actuators during normal plant operation such that a pre-existing, degraded con'dition could be created.

Loss of Air Su I Coincident with Accident Initiation Of the events listed above, only the analysis of the Main Steamline Break (MSLB) actually takes credit for isolation of main feedwater flow in mitigating the accident. However, due to the rapid event sequence of this accident scenario, the pre-heater bypass valves would remain capable of performing their safety function as analyzed in the limiting MSLB events.

Loss of Air Su I as a Pre-existin Condition Over the course of the plant life, degradation of the air supply line to the pre-heater bypass valves that could result in a worst case leak (i.e., a smart leak) must be considered as a possibility. This presents a concern in that if the valves were to become disabled due to a small drop in the Instrument Air System header pressure, the inoperable condition of the pre-heater bypass valves may not be detected in the main control room. A MSLB or LOCA that occurred with this pre-existing condition would not progress within the constraints of the current analysis as described above.

Therefore, the compensatory actions identified in the corrective actions section below are necessary to ensure that the air supply to the pre-heater bypass valves remains intact. This action is not intended to be a manual response credited in the mitigation of an accident in place of a normal automatic function. Rather, the increased level of surveillance improves the confidence in the integrity of the Instrument Air System header and ensures high reliability of the pre-heater bypass valves.

PREVIOUS SIMILAREVENTS:

There have been no previous events reported related to a newly identified failure scenario that would potentially render the S/G Pre-heater Bypass Valves inoperable.

NRC FORM 36BA US. NUCLEAR RECULATORY COMMISSION

)4.9S)

LlCENSEE EVENT REPORT (LEB)

TEXT CONTINUATION FACILITY NAME II) OOCXET LER NUMBER IB) PACE I31 SEOUENTIAL REVISION YEAR NUMBER NUMBER Shearon Harris Nuclear Plant ~ Unit //I 50400 4 OF 4 98 - 00'I - 00 TEXT Rl psdsd spssd ss ssqvi ssE ssss ddt')psl copes ol NRC ppfps 3BQI (17)

CORRECTIVE ACTIONS COMPLETED:

1. Justification for Continued Operation (JCO ¹98-01) was generated along with the associated engineering evaluation (ESR ¹9800014)..This JCO/evaluation determined that the pre-heater bypass valves remained operable based upon a once per shift (12-hour) monitoring of the discharge pressure on the inlet regulator for each valve actuator to ensure the integrity of the non-safety related instrument air piping.

2. The Daily Operations Surveillance Test procedures (OST-1021 and OST-1022) were revised to direct 12-hour monitoring of the discharge pressure on the inlet regulator for each valve actuator.

CORRECTIVE ACTIONS PLANNED:

1. A plant modification will be developed and implemented to resolve the smart leak in the non-safety related Instrument Air System header. This will be completed prior to entering Mode< following completion of refueling outage ¹8, which is currently scheduled to begin in October 1998.

2. The FSAR will be revised to include a description of the modified S/G Pre-heater Bypass Isolation Valves.

This will be completed by December 31, 1998.

3. Training will be provided to appropriate Engineering personnel, which addresses the design control aspects of this event. This will be completed by July 15, 1998.