05000280/LER-2009-001
| Document Numbersequential Revyear Month Day Year Surry Power Station, Unit 2 05000281Number No. | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident |
| 2802009001R00 - NRC Website | |
1.0 DESCRIPTION OF THE EVENT The emergency service water pump (ESWP) diesel engines [EllS—BI, ENG] are listed in UFSAR as being missile protected, however, the ESWP diesel exhausts protrude above the structure's roof and are not protected. The lack of missile protection for the exhausts was entered into the corrective action program and compensatory measures were implemented to ensure operability. ESWP C was modified to include missile protection and was returned to service on March 19, 2009. ESWP A was also modified with the same change and the pump was returned to service on May 8, 2009.
On May 30, 2009, with Units 1 and 2 at 100% power, the diesel engine for ESWP A failed to start during the performance of a periodic test. The pump was declared inoperable at 1330 hours0.0154 days <br />0.369 hours <br />0.0022 weeks <br />5.06065e-4 months <br />. On May 31, 2009, an additional attempt to start ESWP A was made and the pump successfully started and ran. However, after starting, water was observed leaking from the air box vent lines, the exhaust line roof penetration, and the exhaust manifold area. The Operator then stopped the pump and troubleshooting was initiated. ESWP A start failure was due to a piston to cylinder head hydraulic lock caused by rain water intrusion into the engine. As a result, a cylinder was damaged. The missile protection design used RTV sealant to seal the missile enclosure base plate to the roof. The presence of moisture prevented proper RTV curing and allowed water to leak into the engine.
After the first failure, the design was modified to use a two-component polyurethane elastomeric sealant Sikaflex-2c for the roof sealant because of its ability to provide curing in wet conditions. Following engine repairs and installation of the Sikaflex-2c sealant on the missile protection, the diesel engine was returned to service at 1644 hours0.019 days <br />0.457 hours <br />0.00272 weeks <br />6.25542e-4 months <br /> on June 3, 2009.
On June 6, 2009 an operator performing normal rounds reported that water was leaking around the exhaust pipe for ESWP A. The pump was again declared inoperable at 1410 hours0.0163 days <br />0.392 hours <br />0.00233 weeks <br />5.36505e-4 months <br /> on June 6, 2009. Based on the leakage location, the missile protection roof seal appeared again to not be intact. The new sealant material was chosen for its acceptable properties under submerged conditions, however, subsequent evaluation determined that the sealant was exposed to temperatures from the exhaust that were above its rating.
ESWP A was returned to the original configuration and returned to service on June 9, 2009 at 1942 hours0.0225 days <br />0.539 hours <br />0.00321 weeks <br />7.38931e-4 months <br />. The RTV on ESWP C was also verified to be acceptable for high temperature conditions, is properly cured, and therefore is not a common mode failure.
Technical Specification (TS) 3.14.A.4 requires three ESWPs to be operable above 350°F and 450 psig. The limiting condition for operation (LCO) allows one ESWP to be inoperable for 7 days. Although the majority of the Surry rainfall from May 8 to May 30, 2009 occurred after May 27, the ESWP A was assumed to be inoperable beginning May 8, � 2009 and remained inoperable until May 30, 2009, exceeding the allowed outage time of 7 days. Therefore, this report is being submitted pursuant to 10 CFR 50.73(a)(2)(i)(B), any operation or condition that was prohibited by the plant TSs. In addition, during the period when the ESWP A pump was assumed to be inoperable, ESWP B was taken out of service for less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> on May 12, 2009 to perform flow instrument maintenance.
Since the long-term service water requirement for a design basis accident on one unit and the service water requirement to bring the other unit to Hot Shutdown are greater than the design capacity of one ESWP, this report is also being submitted pursuant to 10 CFR 50.73(a)(2)(v)(D), any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.
2.0 SIGNIFICANT SAFETY CONSEQUENCES AND IMPLICATIONS Technical Specifications require three ESWPs to be operable to ensure sufficient cooling water is available in the event of an accident. One ESWP is permitted to be inoperable for up to a 7-day LCO. The ESWP A was assumed to be inoperable beginning May 8, 2009 and remained inoperable until May 30, 2009 when an LCO was entered. During this period, ESWP B was removed from service for less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> on May 12, 2009 to support flow instrument maintenance. Since the ESWP A was determined to be unavailable for less than a month and the ESWP B taken out of service for less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, the core damage frequency for this event was determined to be less than 5E-12 increase, and therefore is an issue of very low safety significance. As a result, the health and safety of the public were not affected.
3.0 CAUSE The direct cause of the inoperability of the ESWP A on May 30, 2009 and again on June 6, 2009 was water intrusion into the exhaust piping. A root cause evaluation determined that the cause of both events is that modifications to correct the lack of missile protection did not take into account all relevant design basis functions (adverse weather) prior to initiating the design. Environmental consideration of rainwater effects was not addressed in the design input or failure modes/effects of the design.
4.0 IMMEDIATE CORRECTIVE ACTION(S) On June 6, 2009, when water was again found to be leaking around the exhaust pipe for ESWP A, the pump was declared inoperable and diesel engine exhaust was returned to its pre-modification configuration. Compensatory measures were implemented to ensure operability and ESWP A was returned to service at 1942 hours0.0225 days <br />0.539 hours <br />0.00321 weeks <br />7.38931e-4 months <br /> on June 9, 2009.
5.0 ADDITIONAL CORRECTIVE ACTIONS A new design change will be developed to provide missile protection for the ESWPs exhaust lines.
6.0 ACTIONS TO PREVENT RECURRENCE The design process procedures will be revised related to design considerations of material suitability, environmental conditions, and potential failure modes. Related training will include particular attention on consideration of adverse weather conditions and the potential for introduction of new failure modes or increased potential for a particular failure mechanism.
7.0 SIMILAR EVENTS The root cause of the water intrusion into the ESWP A is considered a repeat of design issues identified on an inadequate engineering evaluation for a September 2008 event. The August 30, 2008 implementation of a design to provide missile protection for the ESWP B exhaust line resulted in the pump being declared inoperable on September 2, 2008.
Exhaust particulate buildup on a foreign material exclusion screen was considered to have caused back pressure in the exhaust piping. The exhaust piping screen was removed and ESWP B returned to service on September 2, 2008. The cause was a human performance error related to the change process selected to implement the modification of the diesel engine exhaust. Further modifications of the ESWPs were made using the design change process. The root cause evaluation corrective actions for the ESWP A event will further correct the ESWP B event cause.
8.0 ADDITIONAL INFORMATION Manufacturer- Detroit Diesel Model Number- 7084-7002 �