05000269/LER-2009-002

LER-2009-002, Automatic Initiation of Emergency Feedwater Upon Loss of Main Feedwater

Docket Numbersequential Revmonth Day Year Year Month Day Yearnumber No. Unit 2 05000 270
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability
2692009002R00 - NRC Website

BACKGROUND

At Oconee Nuclear Station (ONS), the Emergency Feedwater (EFW)[BA] System, the Auxiliary Service Water (ASW[BA] System, or the Standby Shutdown Facility Auxiliary Service Water (SSF ASW[BA] System can provide decay heat removal via the steam generators following a Loss of Main Feedwater [SJ] (LOMF).

In response to post7TMI requirements, ONS installed a series of improvements to the EFW systems. After implementation of these improvements, EFW initiated on a LOMF event as detected by either low hydraulic oil pressure on both Main Feedwater Pump Turbines (MFDWPT) [TRB] or low feedwater discharge pressure on both MFDWPs.

On April 15, 1996, the NRC issued Amendments 216, 216, and 213 (TAC NOS. M94288, M94289, and M94290) deleting the requirement of having the main feedwater pump discharge header pressure switch provide an input to actuate the Emergency Feedwater [BA] System. As a part of this change, the station custom Technical Specification (TS) 3.4.2 was changed from crediting the discharge pressure instrumentation OR the hydraulic.oil pressure instrumentation to only crediting the hydraulic oil pressure instrumentation. The corresponding MFDWP discharge pressure switches and associated hardware for EFW actuation were removed via station design changes.

ONS TS 3.3.14 requires two LOMF pump instrumentation channels for each automatic initiation circuit., TS 3.3.14 also requires a manual initiation circuit, which was not affected by the event.

Per TS 3.3.14, Condition B, if one or more required EFW pump initiation circuit(s) is inoperable, the affected EFW pump is declared inoperable immediately. Per TS 3.7.5 Condition E, when three EFW pumps are inoperable, the licensee is to immediately initiate action to restore one EFW pump and one EFW flow path to operable status immediately.

Selected Licensee Commitment (SLC) 16.7.2 requires a similar EFW automatic start circuit be functional as part of the Anticipated Transient Without Scram (ATWS) [JC] Mitigation Systems Actuation Circuitry (AMSAC).

NRC: FORM 3bbA (9-21)(H) This report identifies that, during previous unit start-ups, required automatic start circuits were inoperable for periods of time longer than allowed by the TSS. It is noted that there were no occasions associated with these event where ONS failed to make a Mode change required by TS. However, that fact is due to the wording of TS 3.7.5, Condition E, which does not require a mode change while in this condition. The failure to recognize the condition and take the required action is clearly contrary to the intent of the specification. Consequently, these events are being reported pursuant to 10 CFR 50.73(a)(2)(i)(B), operation in a condition prohibited by the plant's Technical Specifications. The condition is also being reported under 10 CFR 50.73(a)(2)(vii), a single condition caused two independent trains to become inoperable in a system designed to remove residual heat, since the reset of a single FDW pump disabled the LOMF instrumentation for all three EFW pumps.

At the time of the discovery of these past events, Unit 1 was in a refueling outage with no fuel in the core. Units 2 and 3 were operating at 100% power. No plant evolutions or other inoperable equipment contributed to these events.

EVENT DESCRIPTION

During the review of an instrumentation procedure change, it was identified that the procedure allowed for the MFDWPT to be

• reset (i.e., hydraulic oil pressure present) but not aligned to be a source of Main Feedwater (FDW). In this condition, the LOMF signals, which are based on reset-control-oil pressure status (i.e., hydraulic oil), would be in an incorrect state relative to the pump's ability to provide main feedwater. On October 21, 2009, it was determined that this issue was reportable. Within the three-year. reporting period of 10 CFR 50.73(a)(1), there had been sixteen (16) prior instances where, while in the mode of applicability, a main feedwater pump had been reset but was not aligned and providing main feedwater. These events were distributed among all three Oconee units (4 for Unit 1, 7 for Unit 2, and 5 for Unit 3). Had the other MFDWP tripped, the EFWPs would not have initiated on LOMF. This condition was not recognized; therefore, operability was not restored immediately as required by TS 3.7.5.

NRC� 9-2(JU / ) Specifically, the condition existed for the identified unit and main feedwater pump on the dates identified below. Additional information included is the unit status when the hydraulic oil pressure was reset (entered instance), the unit status when the MFDWP was pumping (exited instance), and the duration of the false signal condition.

1. 1B; 12/17/06; from Mode 1 at 35% to 50%; 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 2. 2B; 2/19/07; from Mode 1 at 30% to 50%; 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 3. 1B; 2/24/07; from Mode 1 at 35% to 45%; 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 4. 1A; 2/24/07; from Mode 1 at 40% to 50%; 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 5. 2A; 5/29/07; from Mode 2 to Mode 1 at 15%; 21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br /> 6. 2B; 6/1/07; Mode 1 at 60% (no power level change); 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 7. 1B; 10/13/07; from Mode 1 at 20% to 55%; 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 8. 3A; 12/19/07; Mode 1 at 55% (no power level change); 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 9. 2B; 4/3/08; Mode 1 at 60% (no power level change); 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 10.2B; 9/27/08; from Mode 1 at 25% to 50%; 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> 11.3B; 11/9/08; from Mode 2 to Mode 1 at 55%; 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> 12.2A; 12/11/08; Mode 2 (no mode change); 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> 13.2A; 12/14/08; from Mode 1 at 20% to 60%; 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> 14.3B; 5/21/09; Mode 1 at 20% (no power level change); 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 15.3B; 5/22/09; from Mode 2 to Mode 1 at 20%; 21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br /> 16.3A; 5/23/09; from Mode 1 at 20% to 50%; 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> Although the ability of EFW to automatically initiate on LOMF during the times identified was affected, residual heat removal capability was not lost. The EFW system is designed to start automatically in the event of a low water level in either steam generator for 30 seconds and via AMSAC based on low MFDWP discharge pressure.

CAUSAL FACTORS:

The cause of this event is that existing Facility Configuration Information (i.e., Design Deliverable Documents, Operational Configuration Information, 10 CFR 50.59 Evaluation, etc.) was not sufficient to address functional limitations of the hydraulic oil pressure LOMF input. Since installation (1980), the hydraulic oil pressure signal has always had the limitation that, at some points in operational alignment, it does not accurately represent MFDW availability. Failure to control entry into the TS was likely due NRC,� ()H1`4 3(obik ( — 2()U / ) to a lack of complete information of the system operation in normal start-up activities and the subsequent impact on Technical Specification requirements.

The lack of detail in the facility configuration information from the original design contributed to again missing this impact during the 1996 design and licensing change to remove the FDWPT discharge pressure switches. A diverse group of Duke personnel was involved in the review of the modification and the associated TS change.

• During this investigation, it was determined that the following issues contributed to the duration of this event:

1.Although the Licensing Amendment Request Process has historically provided for cross-disciplinary reviews, formal comment resolution did not exist

• at the time of installation of the LOMF function nor during the removal of the discharge pressure switches. The resolution of comments, if seen by all reviewers, could have led to identification of procedure changes. The information provided to the affected organizations was apparently not sufficient to communicate the details of the licensing change such that they were incorporated into procedures.

2.The lack of an impact review step in the temporary change process utilized in 1996 did not provide an opportunity to identify impacts to operating practices resulting from the removal of the discharge pressure switches.

3.The understanding of the interface between MFDWPT hydraulic oil and Plant Protection Systems (EFW, Reactor Protective System (RPS), ATWS) is not well known. Operator Training for MFDWPT and EFW does not readily identify the tie between these systems and the routine impact to EFW and ATWS for reset actions of MFDWPT in Mode 1 and 2.

Since the initiation of this event, Nuclear System Directive (NSD) 227, "Communicating With The U.S. Nuclear Regulatory Commission" has been issued. It requires more formality in the Licensing Amendment Request review process. Additionally, NSD 301, "Engineering Change Program" currently requires impact reviews for all design changes, temporary or permanent. Therefore, these weaknesses have already been addressed.

CORRECTIVE ACTIONS

Immediate:

1.Reviewed event for applicability to RPS and ATWS, as they both receive the same erroneous signal. RPS is adequately addressed in technical procedures. For ATWS, each channel actuates based on input signals from low FDWPT control oil pressure or low FDWP discharge pressure, so the SLC entry condition was not met as a channel was not lost.

2.Affected maintenance and operating procedures were placed on Technical Hold, preventing their use.

Subsequent:

1.A design change was implemented to provide design documentation allowing the isolation of the pressure switches which are associated with the hydraulic oil reset pressure. These changes provide the ability to isolate the LOMF circuit to provide a channel trip as prescribed per TS 3.3.14 Condition A.

2.Necessary procedure changes were completed to align Maintenance Procedures with Operating Procedures to ensure requirements of TS 3.3.1 , Reactor Protective System (RPS) Instrumentation; TS 3.3.14, Emergency Feedwater (EFW) Pump Initiation Circuitry; and SLC 16.7.2, Anticipated Transients Without Scram are met.

Planned:

1. Review content for EFW, ATWS, RPS, MFDWPT, and Tech Spec Operating Training modules to ensure that licensee training adequately addresses the relationship of MFDWPT trip/reset status with licensing requirements.

There are no NRC Commitment items contained in this LER.

NRC YORM .ibbA (-200/)

SAFETY ANALYSIS

This group of events does' not constitute a loss of safety function or Safety System Functional Failure.

� The applicable function is decay heat removal via the EFW system. The TS required automatic initiation circuit was not operable during the indicated time periods.� TS 3.3.14 Condition B requires the affected EFW pumps to be declared inoperable as a result. However,

• the EFW pumps remained available. Automatic actuation of the Motor Driven EFW pumps was still possible via steam generator dry-out protection circuits (which, at ONS, are not credited within the safety analyses and therefore are not required by TS) or via AMSAC (which starts Turbine Driven and Motor Driven EFW pumps). EFW initiation was also available via manual actuation by control room operators as required by TS 3.3.14.

In addition, the station ASW and SSF ASW systems remained available for manual alignment and actuation if needed to assist in mitigating a postulated LOMF event during one of the time periods addressed in this report.

Duke Energy used a risk-informed approach to determine the risk significance associated with the Technical Specification violation for the LOMF channel operability event.

The Conditional Core Damage Probability (CCDP) and the Conditional Large Early Release Probability (CLERP) of this event was evaluated by considering the following:

• This scenario was modeled as a common mode failure of the MFW pump low hydraulic oil pressure auto-start signal for the EFW pumps. Due to TS 3.3.14, this condition declared all three EFW pumps inoperable.

• A conservative approach via the use of the average maintenance PRA model to represent plant configuration, equipment unavailability, and maintenance activities during these violations.

The CCDP associated with this event was determined to be less than 1.0E-06. The CLERP associated with this event is non-limiting with respect to the CCDP and was determined to be less than 1.0E-7.

NR(., ORM�( 9-2UU / ) This event is considered to be of no'significance to the health and safety of the public.

ADDITIONAL INFORMATION

A search of Oconee's corrective action database found no similar occurrences of this type of event with the same cause.

There were no releases of radioactive materials, radiation exposures or personnel injuries associated with this event.

This event is not considered reportable under the Equipment Performance and Information Exchange (EPIX) program.

NRC ()RM� (9-2UU / )