05000528/LER-2012-006, For Palo Verde, Unit 1 Regarding Safety Injection System Check Valve Testing Could Have Resulted in Less than Required Injection Flow

For Palo Verde, Unit 1 Regarding Safety Injection System Check Valve Testing Could Have Resulted in Less than Required Injection Flow

ML13056A003
Person / Time
Site:	Palo Verde
Issue date:	02/19/2013
From:	Mims D Arizona Public Service Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
102-06658-DCM/DCE LER 12-006-00
Download: ML13056A003 (10)

LER-2012-006, For Palo Verde, Unit 1 Regarding Safety Injection System Check Valve Testing Could Have Resulted in Less than Required Injection Flow

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
5282012006R00 - NRC Website

text

10 CFR 50.73 DWIGHT C. MIMS Senior Vice President, Nuclear Regulatory & Oversight Palo Verde Nuclear Generating Station P.O. Box 52034 Phoenix, AZ 85072 Mail Station 7605 Tel 623 393 5403 102-06658-DCM/DCE February 19, 2013 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

Dear Sirs:

Subject:

Palo Verde Nuclear Generating Station (PVNGS)

Units 1, 2, and 3 Docket No. STN 50-528, STN 50-529, and STN 50-530 License No. NPF 41, NPF 51, and NPF 74 Licensee Event Report 2012-006-00 Enclosed please find Licensee Event Report (LER) 50-528/2012-006-00 that has been prepared and submitted pursuant to 10 CFR 50.73. This LER reports a condition related to safety injection (SI) system alignments used to conduct SI check valve testing that could have prevented the fulfillment of a safety function.

In accordance with 10 CFR 50.4, copies of this LER are being forwarded to the Nuclear Regulatory Commission (NRC) Regional Office, NRC Region IV, and the Senior Resident Inspector. If you have questions regarding this submittal, please contact Mark McGhee, Operations Support Manager, Regulatory Affairs, at (623) 393-4972.

Arizona Public Service Company makes no commitments in this letter.

Sincerely, DCM/DCE/hsc Enclosure cc:

E. E. Collins Jr.

NRC Region IV Regional Administrator L. K. Gibson NRC NRR Project Manager for PVNGS M. A. Brown NRC Senior Resident Inspector for PVNGS A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway.Comanche Peak.Diablo Canyon-Palo Verde.San Onofre.South Texas-Wolf Creek

NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 10/31/2013 (10-2010)

, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

3. PAGE Palo Verde Nuclear Generating Station (PVNGS) Unit 1 05000528 1 OF 9

4. TITLE Safety Injection System Check Valve Testing Could Have Resulted in Less than Required Injection Flow

5. EVENT DATE

6. LER NUMBER

7. REPORT DATE 1

8. OTHER FACILITIES INVOLVED MNH DY YA YERSEQUENTIAL REV MONTH DAY YEAR FACILITY NAME DOCKET NUMBER E

YEAR ENUMBER NO.

PVNGS Unit 2 05000529 FACILITY NAME DOCKET NUMBER 12 21 2012 2012 - 006 -

00 02 19 2013 PVNGSUnit3 05000530

9. OPERATING MODE

11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR§: (Check all that apply)

El 20.2201(b)

[I 20.2203(a)(3)(i)

[I 50.73(a)(2)(i)(C)

E] 50.73(a)(2)(vii) 1-E 20.2201(d)

El 20.2203(a)(3)(ii)

El 50.73(a)(2)(ii)(A)

E] 50.73(a)(2)(viii)(A)

[] 20.2203(a)(1)

El 20.2203(a)(4) 0 50.73(a)(2)(ii)(B)

E] 50.73(a)(2)(viii)(B)

El 20.2203(a)(2)(i)

E: 50.36(c)(1)(i)(A)

[I 50.73(a)(2)(iii)

[1 50.73(a)(2)(ix)(A)

10. POWER LEVEL E] 20.2203(a)(2)(ii)

[: 50.36(c)(1)(ii)(A)

El 50.73(a)(2)(iv)(A)

[I 50.73(a)(2)(x)

E] 20.2203(a)(2)(iii)

E] 50.36(c)(2)

[I 50.73(a)(2)(v)(A)

E] 73.71 (a)(4)

[] 20.2203(a)(2)(iv)

El 50.46(a)(3)(ii) 0 50.73(a)(2)(v)(B)

E] 73.71(a)(5) 100 E] 20.2203(a)(2)(v)

[I 50.73(a)(2)(i)(A)

El 50.73(a)(2)(v)(C)

[E OTHER El 20.2203(a)(2)(vi)

El 50.73(a)(2)(i)(B) 0 50.73(a)(2)(v)(D)

Specify in Abstract below or in SI system, which consists of high pressure safety injection (HPSI), low pressure safety injection (LPSI) (EIIS: BP) and the safety injection tanks (SITs) (EIIS: BP) 0 Containment spray system (CS) (EIIS: BE) 9 Shutdown cooling system (SDC) (EIIS: BP)

The SI system injects borated water into the reactor coolant system (RCS) (EIIS: AB) to provide core cooling and negative reactivity to ensure that the reactor core is protected after a loss of coolant accident (LOCA), a control element assembly (CEA) ejection accident, a loss of secondary coolant accident or a steam generator tube rupture (SGTR). The SI system functions also include core heat removal for extended periods of time following a LOCA. The addition of negative reactivity function is designed primarily for the loss of secondary coolant accident where RCS cooldown could add enough positive reactivity to achieve criticality and return to significant power. The four SITs provide the passive injection function to supply water to the reactor vessel during the blowdown phase of a LOCA, to provide inventory to help accomplish the refill phase that follows thereafter, and to provide RCS makeup for a small break LOCA. SI piping and components are located in the auxiliary building (EIIS: NF) and containment building (EIIS: NH).

The SI systems are actuated upon receipt of a safety injection actuation signal (SIAS) on low RCS pressure and high containment pressure. During an event requiring ECCS actuation, a flow path is provided to ensure an abundant supply of water to the RCS, via the HPSI pumps, LPSI pumps and SITs and their respective injection headers, to each of the four RCS cold leg injection nozzles.

The RCS circulates water in a closed cycle, removing heat from the reactor core and internals and transferring it to the steam generators (SGs) (EIIS: AB). The SGs provide the interface between the RCS and the main steam system (EIIS: SB). The major components of the RCS are the reactor vessel (EIIS: AB) and two parallel heat transfer loops, each containing one SG and two reactor coolant pumps (EIIS: AB). Each reactor coolant loop contains penetrations for SI system injection nozzles: one injection nozzle in each of the four reactor vessel inlet pipes (RCS cold legs 1A, 2A, 1B and 2B); and one outlet nozzle to the shutdown cooling system in each of the reactor vessel outlet pipes (RCS hot legs, loops 1 and 2). RCS piping and components are located in the containment building.

Each of the four cold leg SI injection lines receives SI flow from both the A and B HPSI pumps and one of the two LPSI pumps and one of the four SITs. The RCS inset on

Figure A (pg. 9) shows the SI injection nozzle arrangement on RCS cold leg 1A as an example. Check valves in the SI injection lines inside the containment building close to prevent reverse flow and over pressurization of the low pressure portions of the SI piping.

The SI injection line check valve ST procedures provide a high pressure test method that uses the HPSI B pump as the pressure source for testing of SI check valves on both trains.

The HPSI B pump recirculation piping design includes a connection to the SIT fill and drain header which is used for the high pressure test method. A similar connection is not provided from the HPSI A pump recirculation piping. Low pressure methods of testing are also prescribed using the SITs as the pressure source.

TS LCO 3.5.3, ECCS-Operating, requires two ECCS trains to be operable and is applicable in Mode 1 (Power Operation), Mode 2 (Startup) and Mode 3 (Hot Standby) with pressurizer pressure >= 1837 pounds per square inch absolute (psia) or with RCS cold leg temperature

>= 485 degrees Fahrenheit. Condition B of TS LCO 3.5.3 permits one or more trains of ECCS to be inoperable for reasons other than an inoperable LPSI subsystem if at least 100 percent of the ECCS flow equivalent to a single operable ECCS train is available. The Required Action of Condition B specifies the inoperable train(s) must be restored to an operable status within a Completion Time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

TS LCO 3.5.4, ECCS-Shutdown, requires one HPSI train to be operable. Due to the stable conditions associated with operation in Mode 3 with pressurizer pressure <1837 psia and with RCS Tc < 485 degrees Fahrenheit and in Mode 4, and the reduced probability of a Design Basis Accident, the ECCS operational requirements for the SI system are reduced.

TS LCO 3.5.3 does not address a condition in which less than 100 percent of the ECCS flow equivalent to a single operable ECCS train is available while one or more ECCS trains are inoperable. Such a condition requires entry into TS LCO 3.0.3 with initiation of actions within one hour to place the unit in a mode or specified condition in which the LCO is not applicable.

INfl~... rUr¶IV~ 3COM 10301W/

WG FOW -A (10-2010, 1 O

- G, U-T*E PAERC

3. INITIAL PLANT CONDITIONS

On December 21, 2012, each of the PVNGS units was operating in Mode 1 at approximately 100 percent power. No systems, structures or components were inoperable that contributed to this condition.

4. EVENT DESCRIPTION

On December 21, 2012, PVNGS Compliance department personnel completed a reportability review of the results of prior evaluations related to the application of TS LCO 3.5.3, Condition B, and TS LCO 3.5.4 during surveillance testing of SI injection line check valves. The prior evaluations considered possible alternatives to methods used prior to October 2012 for testing of SI injection line check valves in lower modes (TS LCO 3.5.4 applicability) to allow greater flexibility with test scheduling during refueling outages. During the prior evaluations, it was recognized that system alignments during testing could result in the potential for diversion of ECCS flow. The evaluations focused on allowable alignments but did not evaluate the adequacy of the existing test methods with regard to compliance with the plant licensing basis. Following completion of the prior evaluations, continued questioning related to the potential impacts of past testing methods led to a detailed reportability review of the previously used ST procedures, including actual test performances and the postulated ECCS diversion flow.

The reportability review concluded that the previous versions of the ST procedures used to conduct SI injection line check valve testing placed the SI system in alignments that could result in less than the minimum required ECCS flow being delivered to the RCS during a LOCA. The reduced ECCS flow could result when the HPSI B pump manual discharge isolation valve is closed and a manual drain valve is opened on the injection line being tested such that a portion of the SI flow from HPSI A pump could be diverted from the RCS in the event of a LOCA.

Figure A (pg. 9) provides a drawing of a typical alignment of the SI system and the postulated diversion flow path used in the deficient ST procedures to test the SI check valves. The displayed alignment is typical of the multiple similar alignments used for testing of the various SI check valves covered in the ST procedures.

In the example, the tested SI check valve is V-542 on the SI injection line to RCS cold leg 1A. The deficient ST procedures isolated the HPSI B pump discharge from the SI injection flow path by closing the HPSI B pump manual discharge isolation valve V-478. The HPSI B pump minimum flow recirculation orifice bypass valve V-219 is throttled open to establish the required test pressure with the system aligned to direct test pressure from the HPSI B pump via UV-638 to the downstream side of the tested SI check valve, V-542. The motor operated HPSI injection valves UV-637 from train A HPSI and UV-636 from train B HPSI would be closed during the test, but are shown in their open, SIAS actuated state in Figure A, as are the HPSI B injection valves to the other RCS cold legs.

To verify check valve seat tightness with test pressure applied, a test connection and collection bottle is installed on manual drain valve V-059 (upstream of SI check valve V-542) and the drain valve is opened to collect and monitor back flow through the check valve. The manual drain valve was typically opened for a short duration (approximately one minute) to collect and measure any back flow through the SI check valve.

The two ST procedures used to conduct the check valve testing permitted the testing in modes and conditions during which TS LCO 3.5.3 applied. During the three years prior to discovery of the reportable condition, the ST procedures were used during refueling outages on seven occasions to test SI check valves in Mode 3 while TS 3.5.3 was applicable.

During the conduct of the ST procedures, the unit operators did enter TS LCO 3.5.3 Condition B. However, each time a manual drain valve was opened while TS LCO 3.5.3 was applicable, the affected unit entered conditions where TS LCO 3.0.3 applied. In each case, the conditions requiring entry into TS LCO 3.0.3 existed for substantially less than one hour and TS LCO 3.5.3 Condition B, was exited in less than the allowed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In the prior three years, the ST procedures were not used while in Mode 1 or Mode 2.

On October 26, 2012, the ST procedures were revised to prescribe system alignments during SI injection line check valve testing that ensure that at least 100 percent of flow equivalent to one operable ECCS train is available when TS 3.5.3 is applicable. The revised test methods are compliant with the minimum required ECCS flow described in the safety analysis and licensing basis.

5. ASSESSMENT OF SAFETY CONSEQUENCES

This event did not adversely affect the health and safety of the public and there were no actual safety consequences as a result of this event. The event did not result in a challenge to the fission product barriers or result in the release of radioactive materials.

When the deficient ST procedures were used in plant conditions where TS LCO 3.5.3 applied, the postulated diversion flow through an open manual drain valve placed the plant in a condition outside of its licensed safety analysis for brief periods. The ST procedures allowed use of deficient SI system testing alignments in Mode 1 and Mode 2, but had only been used in Mode 3 in the three years prior to discovery of this condition.

To assess safety significance, PVNGS conducted an engineering evaluation of a postulated small break LOCA (SBLOCA) occurring during the SI injection line check valve testing while the postulated diversion path through the open manual drain valve existed and assuming the test was conducted 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after shutdown. The actual elapsed time between the units' reactor shutdowns and performances of SI injection line check valve testing, during the past three years, ranged from 11 days to greater than 30 days.

The engineering evaluation compared the ECCS flows for the Mode 1 SBLOCA safety analysis of record (AOR) to the postulated remaining ECCS flows while the diversion path existed. The evaluation concluded that potential diversion flow during the actual performances of the ST procedures in Mode 3 while TS LCO 3.5.3 was applicable would not have caused the fuel thermal limits to have been exceeded and, therefore, would not have resulted in damage to the fuel cladding. Based on the lower decay heat for the event initiated 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after shutdown, the fuel peak centerline temperature would remain below the predicted temperatures in the SBLOCA AOR. A large break LOCA (LBLOCA) was also evaluated and conditions during the SI check valve tests were bounded by the LBLOCA AOR because of the lower decay heat for the event initiated 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after shutdown in this evaluation and the injection of SIT inventory which occurs during a LBLOCA. Therefore, the amount of ECCS flow available would have been sufficient to preclude fuel damage during the actual performance of the STs in the prior 3 years and the ECCS performance criteria of 10 CFR 50.46 would not have been exceeded.

The nuclear safety risk significance of this condition was negligible from the perspective of the PVNGS Probabilistic Risk Assessment (PRA) model. Realistic thermal-hydraulic

analysis using the Modular Accident Analysis Program (MAAP) predicts no core damage for any size LOCA with either one or two HPSI trains operating during use of the ST procedures with the postulated ECCS flow diversion path. Therefore, use of the ST procedures in Mode 1 or Mode 2 would have presented a negligible increased risk of either core damage or large early radioactive release.

6. CAUSE OF THE EVENT

The direct cause of this condition was latent procedure deficiencies which allowed a cold leg SI injection header manual drain valve common to both EGGS trains to be open without an evaluation that ECCS minimum flow requirements would be met. The procedure deficiencies existed since 1983.

The root cause of this condition was the station's procedure review process failed to identify the latent procedure deficiencies affecting both EGGS trains.

7. CORRECTIVE ACTIONS

The ST procedures were revised to prescribe system alignments that ensure the minimum required ECCS flow is available during SI check valve testing. These revisions were completed prior to the Unit 2 refueling outage in November, 2012. The new test method ensures the availability of at least 100 percent of ECCS flow equivalent to one operable EGGS train when TS LCO 3.5.3 is applicable.

To prevent recurrence, the procedure process will be revised to require the conduct of reviews for common train impacts on design and licensing bases involving safety systems during procedure development and revision processes.

8. PREVIOUS SIMILAR EVENTS

Similar events that involved unanalyzed SI check valve testing system alignments have not occurred previously at PVNGS.

INr~A.~

F-UsIv, 3OW~ ]U.LUIU()

NRC. FUR*M 3.6 k0*]-20107)

M.-

1-GYUEDrAr-

Z z

",oz Post SlS P I netinfo

frm, 0

030 SI lnj. to CL1A, tj V-637 SI C

typical forCL1iB, From HPSI-A C*

2A n

BCL 1A HPSI injection nozzles are n

RCS INSET I N-RCS HL & CL wfSl Injection (to CL 1A)

V-42 T C 1 V-059L(see inset) m H PtyiB C L

2-A Z

C L(

A

,na2c n

injection nozzle typca forca RCS CL B, 2A UV-63 2Bm-FrmTo CL B

L2A m

CL--,

RWTNSE 34 0 I0 Z

UV-667~~~V05 To65 Reir to RWT CLMRSCl e (eco ne)

HPSI-B V-219 V-459 HL-RCS Hot Leg (Reactor Outlet)

CI o*

Imzz

[~~~~r

<-mna av

4 73T-SI3SIIneciInjaerCectio Paleths------542 1SB A CLSS mZ Z

• o 0

0 0

To (SLA CLOSES)=

2A Fiue UV611 HPSI-B C: 0-V-1 Po59Hst-SIAS e (ectrOult)0 K

(0 aMo