05000305/LER-2005-002

LER-2005-002,

Docket Number
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition
3052005002R01 - NRC Website

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6 PAGE (3)

Event Description:

On 2/11/2005, while the Kewaunee Power Station (KPS) was operating at full power, plant engineering personnel discovered that the auxiliary feedwater (AFW) system [BA] discharge pressure switches [PS][63] may not operate in time to protect the AFW pumps [P] from damage in the event of a loss of condensate [SD] storage tank (CST)[TK] water caused by a tornado. During a tornado that causes substantial plant equipment damage and a loss of offsite power, the AFW pumps are required equipment to conduct a safe plant shutdown. Compensatory measures were put in place to protect the pumps in case a tornado watch was declared for the area. These measures allowed continued plant operation. On 2/19/2005, while the plant was operating at full power, during investigative efforts for AFW system operability related to pump protection from a loss of CST water, the potential for a loss of the AFW pumps from a high energy line break (HELB) was discovered. The AFW pumps could be damaged during a feedwater system [SJ] HELB due to damaged common suction piping. The damaged common piping is postulated to create the same effect on the AFW pumps as the loss of CST inventory. Consequently, the AFW pumps could not be assured to be operable under all postulated design basis HELB scenarios.

AFW System Background The AFW system is an engineered safety features (ESF) system. The system is required for both post­ accident mitigation and normal safe shutdown of the plant. The suction piping system design for the AFW pumps has two sources of water to ensure secondary system cooling.

The preferred water source is two condensate storage tanks CSTs containing makeup quality water from the plant water treatment system [KH]. The two CSTs are piped through a common six-inch pipe to three equal capacity AFW pumps; two motor [MO] driven (MD) and one steam turbine [TRB] driven (TD). The CST, a majority of interconnecting piping, and the water treatment systems are non-ESF, non-protected equipment. The non-protected system components are not designed to withstand a design basis seismic event or the forces created by a design basis tornado.

The common piping enters the safeguards alley room where the AFW pumps are located, and divides into the suction piping for each pump. The suction piping in the safeguards alley is qualified for both seismic and tornadic events.

The safety related AFW water source is raw water piped to the AFW system from the plant redundant (two trains) ESF service water (SW) system [BI]. The SW system draws water from Lake Michigan through a seismically designed in-ground/below grade underwater gravity feed "forebay" water collection system [KI].

The "A" train SW header provides water to the "A" train MDAFW pump, the "B" train provides water to the "B" train MDAFW pump, and both SW trains provide water to the TDAFW pump. The SW system components and piping are ESF class protected systems and components. The SW piping connects to the protected portion of the individual pump suction piping segments.

Alignment of the protected SW water source from the non-protected water source to the AFW pumps is by manual operator actions from the control room [NA]. Upon receipt of a low water level annunciator [ALM] and corresponding control room indication of low level in the CSTs, the control room operator opens the motor operated valves [20] between the respective pump(s) and associated SW header.

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6 PAGE (3) Kewaunee Power Station 05000305 YEAR The AFW pumps at KPS are Pacific, horizontal, 11 stage, centrifugal pumps, with oil-lubricated bearings at each end. The pump discharge supplies cooling water to the lubricating oil cooler via the recirculation line.

The long, relatively thin shaft and rotating element are stabilized during operation by the internal wearing rings on each stage that act as hydrodynamic steady bearings. Interruption of these hydrodynamic bearings by air entrainment or heavy cavitation can cause the rotating element to contact the cover. The heat generated by this contact has been shown by industry experience to quickly cause pump seizure.

Therefore, the pump must be tripped and allowed to coast down prior to the onset of cavitation or ingestion of large quantities of air.

In 1993, design change request (DCR) 2668 was installed in response to post-TMI (Three Mile Island) Nuclear Regulatory Commission (NRC) guidance letter dated September 21, 1979. The letter provided, in part, requirements related to the AFW pumps' protection as, "NRC Requirements for Auxiliary Feedwater Systems At Kewaunee Plant, Long Term Recommendation GL-4." GL-4 required, "Licensees having plants with unprotected normal AFW system water supplies should evaluate the design of their AFW systems to determine if automatic protection of the pumps is necessary following a seismic event or tornado.

The analysis of the AFW system design, according to GL-4, determined automatic protection of the AFW pumps was necessary to protect the pumps from damage that could result if a postulated seismic event or tornado caused a loss of pump suction. It was recognized that these events could progress faster than the operator's ability to recognize and respond to align the protected SW source. DCR 2668 installed a pump discharge pressure switch on each pump's outlet to initiate a pump trip upon loss of pump discharge pressure.

2/11/2005 Event Description During the recent NRC High Risk Low Margin (HRLM) Pilot Inspection, the NRC questioned if the AFW discharge pressure trip switch design would protect the pumps from damage, and whether air binding was considered for the discharge pressure trip. Because of the very low net positive suction head requirements for the pumps, no cavitation of the pumps would have occurred on a suction pipe failure until the suction piping was essentially empty. Given the delay until discharge pressure decreased to the setpoint, the time delays designed into the pressure trip control circuitry, and the presumed pump coast-down time, it was postulated that substantial damage to the pumps could occur. Consequently, the presumed damage, up to potential pump seizure, could prevent the pumps from being capable of performing their intended function to support a safe plant shutdown.

Shortly after the NRC question was first introduced, the KPS engineering staff determined the AFW pump discharge pressure switches would not provide adequate protection if the non-protected suction piping failed catastrophically. A postulated severance of the common piping was assumed to result in a substantial amount of air being introduced to the pump suction. Based on the air volume introduced, internal pump lubrication would be lost. Since the pump design depends upon the support provided by the water lubricated wearing rings, the pump vendor warns that pump failure would occur in a very short period of time.

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6 PAGE (3) Kewaunee Power Station 05000305 YEAR NUMBER � Kewaunee Technical Specifications (TS), Section 3.4.b, requires the AFW discharge pressure trips be operable when the plant is greater than 350 degrees. TS further states that an auxiliary feedwater pump discharge pressure trip may be inoperable for a period not to exceed 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

Subsequent to identifying the AFW discharge pressure trips inoperable, compensatory procedural and administrative actions were initiated to ensure continued AFW system operability in the event of a tornado.

These compensatory measures would align the safety related SW supply to the AFW pumps when there was a National Weather Service announcement of a tornado watch in the area of the plant. After procedure changes were processed, the AFW discharge pressure trips were restored to an operable but non­ conforming condition at 0056 hours6.481481e-4 days <br />0.0156 hours <br />9.259259e-5 weeks <br />2.1308e-5 months <br /> on 2/12/2005.

2/19/2005 Event Description Subsequent to completion of the aforementioned NRC HRLM Pilot Inspection, engineering efforts continued to further support AFW suction piping system operability. While inspecting the suction piping in the vicinity of the plant main feedwater (MFW) pumps and associated MFW system piping, it was noted that the common AFW suction pipe passes close to the MFW pipe. When considering the close proximity of the MFW pipe and its orientation to the suction pipe, and the fact that the MFW pipe is a high energy line, a HELB was postulated to occur with the potential to cause damage to the AFW common suction pipe. This postulated pipe failure could result in the same consequence as the failure defined by the 2/11/2005 event.

The design basis, in part, requires assumption of HELBs according to a letter dated December 15, 1972.

This letter, sent to Wisconsin Public Service Corporation (WPSC), the owner of the Kewaunee Nuclear Power Plant, from the Atomic Energy Commission (AEC), described the AEC review of postulated pipe failures outside of the containment structure for the site compared to Criterion 4 of the Commission General Design Criteria, listed in Appendix A of 10 CFR Part 50. This letter, in addition to other correspondence, formulates the basis of the HELB program at KPS. The KPS Updated Safety Analysis Report (USAR) describes large break locations for the MFW piping. USAR, Figure 10A.4.1, "Feedwater Isometric," shows terminal end and intermediate break locations in areas adjacent to the AFW suction piping.

As it relates to the MFW piping system, the KPS HELB design requires the assumption of a piping system failure. As a result of the assumed failure, the consequences of a pipe whip and jet impingement effects caused by the energy released from the piping are required to be analyzed.

From a field inspection of the MFW and AFW common suction piping, the MFW pipe is approximately one foot away from the AFW pipe. The MFW pipe is in a horizontal planar relationship parallel to and above the AFW pipe. Also, the linear pipe orientation has the MFW pipe perpendicular to the AFW pipe. Given the orientation of the two pipes, it is reasonable to assume that a pipe whip could directly impact the AFW condensate suction pipe. Also, considering the closeness of the pipes, a pipe crack in the MFW pipe could have a damaging effect on the AFW pipe from jet impingement.

Given the piping orientation, engineering determined that in either failure assumption, pipe whip or jet impingement, failure of the common AFW suction piping can be assumed to occur. The failure of the piping would result in air entrainment such that air would be introduced to the AFW pumps. As described by the 2/11/2005 event above, air introduction to the pump suction due to HELB has the same result. The pumps are assumed to be damaged to the point they may not be relied upon to support the HELB event.

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6 PAGE (3) In summary, the two events described above result in a loss of protection function required to be provided by the AFW system. In both events, the AFW pumps are required equipment. They are needed to place the plant in a safe shutdown condition and provide secondary side cooling. The AFW pumps were declared inoperable and a plant shutdown was completed at 0509 on 2/20/2005.

Event Analysis:

These events are being reported in accordance with the following requirements:

• 10 CFR 50.73(a)(2)(i)(A), completion of a plant shutdown required by TS. Due to declaring the AFW discharge pressure trips inoperable under steam line break conditions as described by the 2/19/2005 event, and the inability to correct the condition within the time limitations of the TS, an orderly plant shutdown was initiated and completed on 2/20/2005 at 0509 hours0.00589 days <br />0.141 hours <br />8.416005e-4 weeks <br />1.936745e-4 months <br />.

• 10 CFR 50.73(a)(2)(ii)(B), the plant being in an unanalyzed condition that significantly degraded plant safety. In order to shutdown the plant and mitigate the consequences of the design based HELB of the main feed pipe described by the 2/19/2005 event, AFW would be required. Given the postulated event and potential failure consequences of all three AFW pumps being damaged, this analysis requirement could not be assured. Therefore, the plant was in an unanalyzed condition.

• 10 CFR 50.73(a)(2)(v)(A), any event or condition that could have prevented fulfillment of a safety function of structures or systems needed to shutdown the reactor and maintain it shutdown. For the 2/11/2005 event, concurrent with the loss of CSTs caused by a tornado, a loss of off-site power is also assumed to occur. In order to complete a plant shutdown under the circumstances, at least one AFW pump is required to be available. Under the postulated conditions described by the 2/11/2005 event, the requirements to assure a safe plant shutdown could not be assumed.

The two events are being reported in a single Licensee Event Report (LER) because 1) their common system functional loss, both events resulted in determining the AFW pumps discharge pressure protection function would not protect the AFW pumps from damage, 2) the similarity in cause, both events are the result of an inadequate pump protection design, and 3) the second event was discovered while in the process of continuing engineering efforts to resolve issues from the first event.

Safety Significance:

As a consequence of the 2/19/2005 discovery, a plant shutdown was completed on 2/20/2005. In both events the scenario that causes the pump failures is also a scenario that requires the AFW pumps to support a required plant shutdown. Also, in both cases, it can be assumed that all available AFW pumps could be affected by the failure.

All three AFW pumps are expected to start on a plant trip as a consequence of low steam generator [SG] level signals that are created. A reactor [RCT] trip is an expected consequence of the scenarios that are identified as the contributors to the events described. Considering the scenarios, main feed HELB and a FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6 PAGE (3) tornado induced loss of off site power, the need for the AFW pumps is inherently more important. In effect, the consequential loss of AFW under the scenarios described introduces a loss of secondary cooling event.

The significance of a tornado event is reduced by the low probability of occurrence of an initiating tornado of the magnitude assumed. Also, there is a probability that the tornado that could be expected to strike the KPS site and plant proper will be of substantially lower magnitude such that total CST damage would not occur.

The probability of a HELB occurring that would cause damage to all three AFW pumps is also a low probability event. Although HELBs are required to be assumed to occur, in this instance the HELB would have to occur in the worst case orientation to incur the worst case damage to the common suction piping.

Given the parallel nature of the suction line and the main feed line, damage to the AFW condensate suction line is not expected to occur. This, added to the fact that the energy of the affected feed piping is lower than that of a main steam line or a portion of the feed line downstream of the main feed heaters, reduces what would normally be assumed for damage to an incidental component of the HELB.

Considering the low probability of either of the events occurring that would cause a loss of either the CSTs or the suction piping of the AFW pumps, the safety significance of this LER is considered to have low to moderate safety significance.

Cause:

A root cause evaluation (RCE) was completed and includes the full scope of corrective actions. The direct cause of the two events is an inadequate AFW automatic protection system design. The RCE identified that engineering had a lack of knowledge and understanding of what constitutes proper rigor of analysis, review or documentation when resolving issues related to design basis for the AFW pumps. The resulting corrective actions that have been completed and are to be completed are listed below.

Corrective Actions Completed:

1. Physical changes to the design of the AFW suction piping have been completed under DCR 3576.

Newly added protected piping and increased protected piping reserve water capacity have been installed. A change to the AFW pump protection design has also been installed.

The piping system changes consist of a large section of the suction piping being rerouted and changed to protected piping. The new piping has a larger diameter and has combined parallel pipe lengths to add a reserve water capacity. A reserve water capacity was built into the suction piping to ensure available water to the AFW pumps to account for time delays and pump coast-down to address the postulated event conditions and the new automatic protection system reaction time.

Capacity assumptions include a pump failure to trip and accounting for the maximum flows that can be anticipated for varying combinations of pumps operating. The new section of suction piping is mounted seismically. It is routed through a seismically designed, Class 1 structure, the auxiliary equipment building [NF]. The auxiliary building area where the pipe is run is designed to withstand both the design basis seismic events and tornado.

The automatic protection system for the pumps is redesigned to a suction pressure protection concept. Three new suction pressure instruments are installed, one per pump. Each of the new FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) pressure sensors will initiate its respective pump trip when low suction piping system pressure is sensed. Since the pressure sensors are installed at the far upstream end of the new protected piping section, they will be sensitive to a pipe failure that introduces air into the system before the minimal reserve capacity built into the new piping section would be affected.

The discharge pressure trip setpoint has been re-established based on a more conservative approach for protection from pump runout. The discharge pressure trips are credited with protecting the pumps from damage should runout conditions be present.

The physical changes to the AFW suction piping system were completed prior to the Kewaunee plant restart in June 2005.

2. An Independent Review Group (IRG) was chartered as of March 7, 2005 as an interim measure.

The IRG is currently performing duties in accordance with NAD-04.08 and GNP-04.08.01. The IRG is performing an independent technical review of KPS engineering products such as operability evaluations, 50.59 screenings and evaluations, calculations important to safety, and modifications important to safety.

3. Using identified weaknesses and industry guidance, a document was developed and implemented that is being used to guide engineering personnel on the human performance tools needed to develop a quality and rigorous product.

4. Training was conducted to reinforce expectations regarding engineering product quality per NRC commitment contained in letter NRC-05-035 (ADAMS Accession Number ML050820213). This training will be included as part of recurring continuing training in engineering to aid in institutionalizing the process and will include coverage on engineering standards of quality.

Corrective Actions to be Completed:

1. The processes that were determined to define engineering areas where quality and rigor need to be inherent in the product include 50.59, modifications, calculations, and operability reviews. The following actions will be taken to ensure that the existing process documents contain steps to ensure quality is built into the process:

• Process procedures will be reviewed to ensure existing steps require quality and rigor are inputs to the product. The steps will be identified as steps critical to ensure quality and rigor are in the products.

• If any process is determined to not contain adequate guidance for either building in quality to the product or performing a rigorous independent review, then the process will be revised to provide the necessary guidance.

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6 PAGE (3) Kewaunee Power Station 05000305 YEAR

• To make a clear tie to the human performance tools that are to be used to develop a quality product, a clear reference to engineering human performance requirements will be added to the appropriate implementing document in each process.

Previous Similar Events:

None

Additional Information:

The pump manufacturer is Pacific Pumps, Inc. (Now Flowserve Pump Div.).

The pump model number is 1.5 UNI-11.

The critical features of the pump that contribute to the condition found are; the multiple stages on a horizontal shaft, resulting in possibility of rapid failure on loss of suction events.