ML18016A313

LER 98-001-00:on 980109,potential Condition Outside Design Basis Related to Instrument Air Sys Leak Causing SG pre- Heater Bypass Isolation Valves to Be Inoperable Was Noted. Caused by Inadequate Design Control.Generated Jco 98-01

ML18016A313
Person / Time
Site:	Harris
Issue date:	02/09/1998
From:	Verrilli M CAROLINA POWER & LIGHT CO.
To:
Shared Package
ML18016A311	List: ML18016A310 ML18016A313
References
LER-98-001, LER-98-1, NUDOCS 9802170061
Download: ML18016A313 (4)

Text

NRC FORM 366 (4.95)U.s.NUCLEAR REGULATORY COMMISSION

'LXCENSEE EVENT REPORT (LER)(Sae reverse for required number of digits/characters for each block)APPROVED BY OMB No.3150-0104 EXPIRES 04/30/96 ESTIMATED BURDEN PER RESPONSE TO COMPLY WITH THIS MANDATORY INFORMATION COLLECTION REDUEST.509 HRS.REPORTED LESSONS LEARNED ARE INCORPORATED INTO THE LICENSING PROCESS AND FEO BACK TO UIOUSTRY.FORWARD COMMENTS REGAROIHG BURDEN ESTIMATE TO THE INFORMATION AND RECORDS MANAGEMENT BRANCH Irk F33L US.NUCLEAR REGULATORY COMMLSSION, WASHINGTON, OC 20555000l, ANO TO THE PAPERV/ORK REDUCTION PRDIECT ISI50.OIOIL OFFICE OF MANAGEMENT ANO BUDGET, WASHUIGTON, OC 205IL FACIUTY NAME lll Harris Nuclear Plant Unit-1 DOCKET NUMBER I2)50-400 PAGE I3I 1 OF4 TITLE (4I Potential Condition Outside Design Basis related to Instrument Air System Leak causing the S/G Pre-heater Bypass Isolation Valves to be inoperable.

EVENT DATE (5)LER NUMBER{6)MONTH DAY 1 9 SEOUENTIAL REVISION NUMBER NUMBER 98 98-001-00 REPORT DATE{7)MONTH DAY YEAR 2 9 98 FACIUTY NAME FACIUTY NAME OTHER FACILITIES INVOLVED (6)DOCKET NUMBER DOCKET NUMBER 05000 OPERATING MODE (9)POWER LEVEL (10)NAME 100%20.2201{b)20.2203(a)

(1)20.2203(a)

(2)(i)20.2203(a)

(2)(ii)20.2203(a)

(2)(iii)20.2203(a)

(2)(iv)50.73(a){2)(i)50.73(a)(2){ii)20.2203(a)(2)(v) 20.2203(a)

{3){i)50.73(a)(2)(iii) 50.73(a)(2)(iv)20.2203(a)

(3)(ii)20.2203(a)

(4)50.36(c){1)50.73(a)(2)(v)50.73(a)(2)(vii)50.36(c)(2)LICENSEE CONTACT FOR THIS LER (12)TELEPHONE NUMBER Ilnalvde Ates Cade)50.73(a)(2)(viii) 50.73(a){2)(x)73.71 OTHER Specify in Abstract below or in NRC Form 36BA THIS REPORT IS SUBMITTED PURSUANT To THE REQUIREMENTS OF 10 CFR 5:{Chock one or more)(11)Michael Verrilli Sr.Analyst-Licensing (919)362-2303 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT (13)CAUSE SYSTEM COMPONENT MANUFACTURER REPORTABLE TO NPRDS CAUSE SYSTEM COMPONENT MANUFACTURER REPORTABLE TO NPRDS SUPPLEMENTAL REPORT EXPECTED (14)YES{If yas, complete EXPECTED SUBMISSION DATE).X No EXPECTED SUBMISSION DATE{15)MONTH DAY YEAR ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 singla-spaced typawrittan lines)(16)On January 9, 1998, a condition was identified during operation that results in the plant being potentially outside it'design basis.Specifically, a potential failure mechanism exists where a leak in the non-safety Instrument Air System could result in the inoperabihty of the Steam Generator Pre-heater Bypass Isolation Valves.These valves are safety-related containment isolation valves that are required by plant procedures to automatically shut in 10 seconds or less upon receipt of a Main Feedwater Isolation Signal.These valves are positioned by a pneumatic piston-operated actuator which is supplied by the non-safety related Instrument Air System.They are designed to automatically close if control air supply is lost.However, a"smart" air leak has been postulated in the Instrument Air system that could possibly reduce the air inlet pressure to just low enough to affect proper operation of the actuator's 3-way and 4-way pilot valves and not be detected by Operations personnel.

If this occurred, the pilot valves would shuttle, causing the accumulator pressure to bleed off, which would prevent the valves from closing as required.This potential scenario constitutes operation outside the design basis of the plant and was reported to the NRC via the emergency notification system on January 9, 1998 at 1450 hours0.0168 days <br />0.403 hours <br />0.0024 weeks <br />5.51725e-4 months <br />.The cause of this condition was inadequate design control during development of a plant modification implemented in August 1984 in response to NRC Information Notice 82-25.The investigation for this event also revealed several other missed opportunities to identify this condition during subsequent plant modifications and/or related evaluations.

Immediate corrective actions included development of a Justification for Continued Operation (JCO), with the required evaluation and compensatory measures to ensure continued operability.

The JCO evaluation determined that the isolation valves were operable dependent upon once per 12-hour monitoring of the discharge pressure on the inlet regulator for each valve actuator.Additional corrective actions will include a plant modification to resolve the design deficiency, a FSAR revision and training for appropriate Engineering personnel.

9802170061 980209 PDR ADCICK 05000400 S PDR NRC FORM 366A M-SS)LICENSEE EVENT REPORT (LER)TEXT CONTINUATlON US.NUCLEAR REGULATORY COMMISSION FACIUTY NAME (I)Shearon Harris NUclear Plant-Unit¹1 TEXT Pr more spscers nod.vso oddMmsl copies of ABC Povv 3IFQI (11)DOCKET 50400 LER NUMBER (6)YEAR SEOUENTIAL REVISION NUMBER NUMBER 98-001-00 PAGE (3)2 OF 4 EVENT DESCRIPTION:

On January 9, 1998, with the plant operating in mode 1 at 100%power, a condition was identified that results in the plant being potentially outside the design basis.Specifically, a potential failure mechanism exists where a leak in the non-safety Instrument Air System (EIIS Code: LD)could result in the inoperability of the Steam Generator (S/G)Pre-heater Bypass Isolation Valves (1AF-64, 1AF-102, and 1AF-81, EIIS Code: SJ-V).These valves are safety-related containment isolation valves that are required by plant procedure PLP-106 (Technical Specification Equipment List and Core Operating Limit Report)to automatically shut in 10 seconds or less upon receipt of a Main Feedwater Isolation Signal (MFIS).These valves are positioned by a pneumatic piston-operated actuator and are opened and closed by high pressure air (-150 psig)from the actuator's accumulator.

The accumulator is maintained at a higher air pressure by an air intensifier pump.The intensifier is a double piston compressor that is driven by control air.The air intensifier is needed to boost inlet control air pressure to approximately 150 psig, since normal control air pressure (approx.75 psig)will not close the valve alone.With the use of pneumatic pilot valves located on the actuator, the intensified air in the accumulator is used to position the actuator piston, which is connected to the valve disc by a common shaft.The pneumatic pilot valves guide the intensified air from the accumulator to either face of the piston to position the operator.Directing the high pressure air below the piston will open the S/G pre-heater bypass valves;and directing the high pressure air to the top of the piston will cause the valves to close.The S/G pre-heater bypass valves are designed to automatically close if control air supply is lost.This is accomplished by two in-series solenoid valves that are energized open to supply the control air from the Instrument Air System.If a Main Feedwater Isolation signal is generated the solenoid valves will de-energize, securing the control air supply, which causes the S/G pre-heater bypass isolation valves to close.The solenoid valves will also de-energize if Instrument Air System pressure drops to 66 psig.However, a"smart" air leak has been postulated in the Instrument Air System piping that could possibly reduce the air inlet pressure to just low enough to affect proper operation of the actuator's 3-way and 4-way pilot valves and not be detected by the pressure switches in the main header of the Instrument Air System that would de-energize the solenoid valves at 66 psig.If this occurred, the pilot valves would shuttle, causing the accumulator pressure to bleed off, which would prevent the valves from closing as required.Operations personnel would have no indication of accumulator low pressure other than local observations made by an auxiliary operator and possibly dual valve indication in the main control room due to the valves cycling slightly.This potential scenario constitutes potential operation outside the design basis of the plant and was immediately reported to the NRC via the emergency notification system on January 9, 1998 at 1450 hours0.0168 days <br />0.403 hours <br />0.0024 weeks <br />5.51725e-4 months <br />.CAUSE: The cause of this condition was inadequate design control during development of a plant modification implemented in August 1984, which was prior to issuance of the Harris Plant Operating License.Specifically, NRC Information Notice 82-25,"Failure of Hiller Actuators Upon Gradual Loss of Air Pressure" stated that on a gradual loss of control air, the pneumatic control valves may assume some intermediate position and cause the stored air in the accumulator to vent to atmosphere and prevent the actuator from performing it's safety function of closing.To resolve this concern Field Change Request (FCR-I-992)was developed to install two pressure switches in the Instrument Air System header that would de-energize the solenoid valves (described above)at 66 psig.However, ANSI Standard N18.2.a"Nuclear Safety Criteria for Design of Stationary PWR Plants" requires that a barrier be installed between safety class interfaces, such as the air control circuit and the instrument air supply.This design requirement was not properly applied during the development of FCR-I-992; therefore, the safety related system did not meet the single failure design criteria.The investigation for this event also revealed additional missed opportunities to identify this design deficiency in the Instrument Air System.These included: (1)HNP's response development for NRC Generic Letter 88-14 in 1989, which specifically included an evaluation (Plant Change Request, PCR-4151)of the Instrument Air System and the Pre-heater Bypass Valve actuator design, (2)Adverse Condition Report¹91-314 initiated in June 1991, which identified a leak in the supply air regulator for 1AF-81 that significantly lowered accumulator pressure, and (3)development of PCR-6158 and it's associated evaluation (PCR-6066) in 1992, which implemented a modification to the actuator air circuitry to enhance the air intensifier pump and upgrade portions of the control air piping to safety-related.

In each of these cases, the"smart" leak scenario described in this LER was not identified nor considered credible due to the incorrect assumption that the system design met the single failure criteria.N M (4.)

NRC FORM 366A F)a6)LlCENSEE EVENT REPORT (LER)TEXT CONTINUATION US.NUCLEAR REGULATORY COMMISSION FACILITY NAME (I)Shearen Harris Nuclear Plant~Unit//1 TEXT P secre s~seir cere'rerf.

ese errrFse)re copes el h'RC&m NQl)17)DOCKET 50400 LER NUMBER IS)SEQUENTIAL REVISION NUMBER NUMBER 98-Ool.-00 PAGE)3)3 OF 4 SAFETY SIGNIFICANCE:

There were no actual consequences associated with this potential failure scenario.JCO 98-01 established the basis for continued operability of the pre-heater bypass valves.These valves are listed as containment isolation valves in PLP-106 (TS Equipment List and Core Operating Limits Report)and are required to automatically shut following receipt of a Main Feedwater Isolation Signal (MFIS).A MFIS is generated from the safety injection actuation logic as well as on high-high S/G level in any steam generator.

As such, any accident analyzed in the FSAR that results in a safety injection or high-high S/G level may be impacted by degradation of the non-safety related air supply to these valves.The list of applicable accidents includes: Main Steamline Break (15.1.5), Feedwater Line Break (15.2.8), Steam Generator Tube Rupture (15.6.3), and Loss of Coolant (15.6.5).Two different failure scenarios must be considered.

The first is the failure of the air supply to the valve actuators coincident with initiation of the accident.This is necessary because a non-safety related component cannot be credited in the mitigation of an accident, nor can the loss of a non-safety related component result in failure of a safety related component.

The second condition to be considered is the undetected loss of air to the actuators during normal plant operation such that a pre-existing, degraded con'dition could be created.Loss of Air Su I Coincident with Accident Initiation Of the events listed above, only the analysis of the Main Steamline Break (MSLB)actually takes credit for isolation of main feedwater flow in mitigating the accident.However, due to the rapid event sequence of this accident scenario, the pre-heater bypass valves would remain capable of performing their safety function as analyzed in the limiting MSLB events.Loss of Air Su I as a Pre-existin Condition Over the course of the plant life, degradation of the air supply line to the pre-heater bypass valves that could result in a worst case leak (i.e., a smart leak)must be considered as a possibility.

This presents a concern in that if the valves were to become disabled due to a small drop in the Instrument Air System header pressure, the inoperable condition of the pre-heater bypass valves may not be detected in the main control room.A MSLB or LOCA that occurred with this pre-existing condition would not progress within the constraints of the current analysis as described above.Therefore, the compensatory actions identified in the corrective actions section below are necessary to ensure that the air supply to the pre-heater bypass valves remains intact.This action is not intended to be a manual response credited in the mitigation of an accident in place of a normal automatic function.Rather, the increased level of surveillance improves the confidence in the integrity of the Instrument Air System header and ensures high reliability of the pre-heater bypass valves.PREVIOUS SIMILAR EVENTS: There have been no previous events reported related to a newly identified failure scenario that would potentially render the S/G Pre-heater Bypass Valves inoperable.

NRC FORM 36BA)4.9S)LlCENSEE EVENT REPORT (LEB)TEXT CONTINUATION US.NUCLEAR RECULATORY COMMISSION FACILITY NAME II)Shearon Harris Nuclear Plant~Unit//I TEXT Rl psdsd spssd ss ssqvi ssE ssss ddt')psl copes ol NRC ppfps 3BQI (17)OOCXET 50400 LER NUMBER IB)YEAR SEOUENTIAL REVISION NUMBER NUMBER 98-00'I-00 PACE I31 4 OF 4 CORRECTIVE ACTIONS COMPLETED:

1.Justification for Continued Operation (JCO¹98-01)was generated along with the associated engineering evaluation (ESR¹9800014)..This JCO/evaluation determined that the pre-heater bypass valves remained operable based upon a once per shift (12-hour)monitoring of the discharge pressure on the inlet regulator for each valve actuator to ensure the integrity of the non-safety related instrument air piping.2.The Daily Operations Surveillance Test procedures (OST-1021 and OST-1022)were revised to direct 12-hour monitoring of the discharge pressure on the inlet regulator for each valve actuator.CORRECTIVE ACTIONS PLANNED: 1.A plant modification will be developed and implemented to resolve the smart leak in the non-safety related Instrument Air System header.This will be completed prior to entering Mode<following completion of refueling outage¹8, which is currently scheduled to begin in October 1998.2.The FSAR will be revised to include a description of the modified S/G Pre-heater Bypass Isolation Valves.This will be completed by December 31, 1998.3.Training will be provided to appropriate Engineering personnel, which addresses the design control aspects of this event.This will be completed by July 15, 1998.