05000316/LER-2003-001
| Docket Number | |
| Event date: | 1-26-2003 |
|---|---|
| Report date: | 02-02-2005 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown |
| 3162003001R01 - NRC Website | |
Conditions Prior to Event Unit 1— Mode 5, 0 percent power Unit 2 — Mode 1, 100 percent power
Description of Event
On January 23, 2003 at 0400 hours0.00463 days <br />0.111 hours <br />6.613757e-4 weeks <br />1.522e-4 months <br />, the CD EDG was removed from service for a planned maintenance outage of approximately 31 hours3.587963e-4 days <br />0.00861 hours <br />5.125661e-5 weeks <br />1.17955e-5 months <br />. The planned maintenance consisted of troubleshooting and repairing the slow start circuit, relocating the front bank fuel return header, replacing the spider assembly for the engine driven fuel oil pump, and cleaning and inspecting the auto voltage regulator droop circuit potentiometer. None of the activities performed at this time affected the governor system or fuel rack linkage.
At 2332 hours0.027 days <br />0.648 hours <br />0.00386 weeks <br />8.87326e-4 months <br /> on January 24, 2003 the CD EDG was started for its operability run following the completed maintenance activities. Load oscillations of approximately 150 KW in the downward direction occurred. The decision was made to replace the Electronic Governor Module (EGM). Following replacement of the EGM, the CD EDG was started for tuning of the newly installed module. It was determined that the tuning attempt was unsuccessful (unable to control load swings). The EDG was secured to install a different EGM.
At 1906 hours0.0221 days <br />0.529 hours <br />0.00315 weeks <br />7.25233e-4 months <br /> on January 25, 2003, the diesel was started to tune the second governor control module. Additional delays were encountered during the tuning process when it was determined that the control room synchroscope was not functioning. After troubleshooting and correcting this problem, the EDG load was increased to 2750 KW. After approximately one minute, load fluctuations of approximately 100 KW were observed, and shortly thereafter the load underwent a step increase of approximately 1000 KW for a short period of time, and then returned to about 2750 KW.
Load was maintained at that level for several minutes to monitor for additional perturbations, which did not occur. The diesel load was reduced to 1150 KW and stabilized to allow gathering of data.
At 0017 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> on January 26, 2003, a shutdown of the Unit 2 reactor commenced in accordance with the Limiting Condition for Operation (LCO) for Technical Specification 3.8.1.1, A.C. Sources, Action "b", due to the inability to return the CD EDG [EK] to an OPERABLE status within the allowed outage time. All remaining safety related equipment performed as required and no anomalies were noted. On January 26, 2003, at 0426 hours0.00493 days <br />0.118 hours <br />7.043651e-4 weeks <br />1.62093e-4 months <br />, Donald C. Cook Nuclear Plant (CNP) Unit 2 entered Mode 3.
Following the step load increase of 1000 KW, a visual inspection of the governor and fuel rack linkage was conducted.
This inspection determined that a washer was installed on the wrong side of the connecting pin between the output shaft lever and the Heim end of the attached linkage arm. This led to mechanical binding. With troubleshooting complete, reassembly of the linkage occurred and several tuning and post maintenance testing runs were conducted. No additional problems were identified. The CD EDG was declared OPERABLE at 0830 hours0.00961 days <br />0.231 hours <br />0.00137 weeks <br />3.15815e-4 months <br /> on January 27, 2003. This event is being reported in accordance with 10 CFR 50.73(a)(2)(i)(A) and NUREG-1022, Revision 2, Section 3.2.1, which requires each licensee to submit an LER for the completion of any nuclear plant shutdown required by the plant's technical specifications.
Cause of Event
The root cause for this event is:
An inadequate configuration control process that did not assure correct installation of the 2CD Emergency Diesel Generator governor linkage which led to mechanical binding. This condition was further complicated by the lack of expertise in maintaining and diagnosing the aging obsolete governor system.
Analysis of Event
There were three conditions that had potential safety significance. One was the initial load swings caused by a malfunction of the diesel speed control system. The second was the load spike that was caused by the binding in the fuel racks. The third was the forced shutdown of Unit 2 as a result of not being able to restore CD EDG within its allowed outage time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
The initial load swings were not safety significant since the EDG would have been able to perform its safety function.
This conclusion was supported by an evaluation that determined that the EDG would have remained within the Technical Specification and Administrative Technical Requirement frequency limits when operated in isochronous mode.
The load spike was associated with the binding of the fuel racks while increasing load. It was determined that for a rack binding force initially in excess of EGB (hydraulic governor) output, the CD EDG would exceed its minimum and maximum Technical Specification allowable frequency limits, the engine would not trip on overspeed, but the engine could reach stall conditions if the fuel racks remained bound for the time that was approximated during the event, coincident with all increase in load. Based on event data and field inspections, there is reasonable assurance that the rack binding was intermittent and while the more restrictive Administrative Technical Requirement limits would have been momentarily exceeded, the EDG would have continued to perform its safety function.
While the CD EDG was declared inoperable Unit 2 was placed in a condition of inherently higher risk for the duration of the allowed outage time, due to the loss of one train of emergency AC power. Additionally, as a result of not restoring the CD EDG within the allowed outage time, Unit 2 was required to perform a shutdown to comply with Technical Specification requirements.
The normal process for shutting down a unit, by reducing power to below 20% and then performing a manual reactor trip presents a more substantial risk to the plant than either performing a slow controlled shutdown, or maintaining the plant at power. This type of shutdown places a heavy reliance on safety systems to function correctly during and following the shutdown. During the shutdown, all remaining safety related equipment performed as required and no anomalies were noted. Thus, there was no actual safety significance associated with the shutdown of Unit 2.
In summary, there were no safety consequences as a result of the event. There was not a valid demand for the CD EDG to perform its safety function for the duration of the event. There was no safety consequence as a result of the shutdown of Unit 2 since all safety systems functioned as required.
Corrective Actions
Immediate actions:
The CD EDG was restored to operable condition following replacement of the EGM and restoration of fuel rack linkage configuration.
Corrective Actions to Prevent Recurrence:
1. Performed a review of EDG control system configuration documents to ensure that CNP specific configuration documents are established and available. (CRA 03025002-07,-48,-49,-51,-52, 03061006-01, -02 action complete) 2. Evaluated the level of expertise needed by station personnel for repair, replacement, adjustment, and tuning.
Provided additional training to personnel. (CRA 02277047-027, 03025002-05,-06 action complete) 3. Reviewed the EDG control system procedures to identify components that require procedures for repair, replacement, or adjustment and tuning. Created new procedures to support EDG subsystem maintenance or enhanced existing procedures where needed. (CRA 02277047-027, 03025002-04, 02347041-02 action complete)
Previous Similar Events
corrective actions associated with the similar LER and determined that the corrective actions implemented would not have prevented the occurrence of this event.