05000483/LER-2006-004

LER-2006-004, Callaway Plant Unit 1

Callaway Plant Unit 1
Event date:	05-12-2006
Report date:	08-10-2006
Reporting criterion:	10 CFR 50.73(a)(2)(iv)(A), System Actuation
4832006004R01 - NRC Website

A. REPORTABLE EVENT CLASSIFICATION

50.73(a)(2)(iv)(A) — Manual or Automatic Actuation of Systems Listed in 50.73(a)(2)(iv)(B):

(1) Reactor protection system (RPS) including: reactor scram or reactor trip; and (6) PWR auxiliary or emergency feedwater system.

B. PLANT OPERATING CONDITIONS PRIOR TO THE EVENT

Mode 1, 47 Percent Reactor Power

START OF THE EVENT AND THAT CONTRIBUTED TO THE EVENT

No structures, systems or components were Inoperable at the start of the event which contributed to the event.

D. NARRATIVE SUMMARY OF THE EVENT, INCLUDING DATES AND APPROXIMATE TIMES

At 1754 on 5/8/2006, Reactor Coolant System (RCS) Loop 2 Channel 3 Flow Transmitter, BBFT0426, was declared Inoperable, and the plant entered a 72-hour action statement under Tech Spec 3.3.1.M.

The recovery plan included a downpower to 45% to replace the transmitter. The downpower was scheduled to begin at 1900 on 5/11/2006 and continue through the transmitter replacement at 0100 on 5/12/2006 with a return to full power beginning at approximately 0700 on 5/12/2006.

The load reduction commenced as scheduled and proceeded as planned down to approximately 49% power. Just after clearing the P-9 bistables (50% power permissive setpoint) the high-load and low-load valves for the Moisture Separator Reheaters (MSRs) were not responding as expected. At approximately 0035 on 5/12/2006 an investigation was initiated on the operation of the MSR valves during the downpower. Subsequent evaluations determined the closing circuit for these MSR valves was not functioning in automatic control.

Concurrent with the MSR valve response investigation and while stabilizing power below P-9, a turbine vibration alert was received and investigated in accordance with alarm response procedure OTA-RK­ 0026, "Annunciator Response Procedure MCB Panel RK026". Plant computer points showed rising vibration levels above 8 mils, and numerous vibration alarms were received on bearings 5, 6, 7 and 8.

Off-Normal procedure OTO-AC-00002, "Turbine Vibration", was entered. At Step 2, the Reactor Operator (RO) reported turbine vibration at 11.46 mils. At Step 4, the RO reported that turbine vibration was rising. It was determined that a turbine trip was required. Plant conditions were evaluated to be less than the P-9 setpoint and direction was given for a manual turbine trip, which occurred at 0047. OTO­ AC-00002 was exited and a transition made to OTO-AC-00001, "Turbine Trip below P-9".

The turbine stop valves immediately closed on initiation of the turbine trip. The resultant spike in pressure in the 'A' Steam Generator (S/G) caused the level in the generator to shrink by approximately 16 percent. A reduction in steam flow occurred in conjunction with the sudden loss of turbine load. The control rods stepped in automatically, and the condenser steam dumps opened in the trip mode. At approximately 00:47:50 (approximately 40 seconds after the turbine trip), condenser steam dump Group 2 appears to have closed based on a review of plant computer data. This caused a decrease in steam flow, an increase in steam pressure, and a resulting shrink of the narrow range level. Subsequently, the steam dumps began modulating to maintain RCS average temperature at 557 degrees F, as designed.

A follow up evaluation determined that Group 2 steam dumps (as monitored by a representative condenser steam dump valve, ABUV0039) did not open as expected during this transient. Although an extensive circuit analysis was not performed to evaluate this aspect of the transient, the control logic should have opened Group 2 approximately 3 to 4 seconds after Group 1 initially opened and approximately 3 to 4 seconds prior to Group 3 initially opening. However, Group 2 opened after Group 3, apparently Group 2 did not open, as anticipated, on the load reject controller during this transient. The group may have opened on a S/G HI-1 pressure signal instead. It was determined that this apparent malfunction was likely the cause of the 'B' Atmospheric Steam Dump (ASD) opening for approximately 7 seconds during the transient. However, beyond the momentary operation of the 'B' ASD, this apparent malfunction is not considered to have had any significant impact on the plant response following the peak pressure spike since the Group 2 valves subsequently opened and the ASD compensated for the delay in operation of the affected condenser steam dumps.

As stated above, S/G levels initially lowered as expected and then began to rise. During performance of OTO-AC-00001, the 'B' main feedwater pump was tripped. The Main Feedwater Regulating Valves (MFRVs) were modulating as expected to restore S/G water levels.

Approximately 1 minute 40 seconds after the turbine trip, 'A' S/G reached the minimum level experienced during the transient. At this point the inventory that had been injected into the S/G had heated enough that thermal expansion caused the narrow range S/G level indication to rise rapidly. Since level was still below the level control setpoint for about the next 43 seconds, the feedwater flow controller had not yet started to close the MFRV. This continued to allow more feedwater to be injected into the S/G.

At approximately 0049 (1 minute 50 seconds after the turbine trip), condenser steam dump control was shifted to the steam pressure mode by the operators. By this time, RCS average temperature was approaching 557 degrees F; consequently this action does not appear to have had any significant affect.

About 2 minutes 30 seconds after the turbine trip, the MFRVs began to modulate to the closed position.

MFRVs continued to close for about the next two and a half minutes until fully closed. At 0051 (about 3 minutes 50 seconds after the turbine trip), feedwater flow had been reduced below steam flow as reflected in plant computer data. However, by Control Room trend recorders, feedwater flow had been reduced to less than steam flow even earlier in the transient. This reduction in feedwater flow did not stop the S/G level increase since thermal expansion of the existing inventory was still occurring.

During this timeframe, a transfer from the MFRVs to the MFRV Bypass Valves was initiated. This action, however, did not cause the P-14 (Steam Generator High-High Level) signal which was received later in the event. When the step was reached in OTO-AC-00001 to transfer S/G level control from the MFRVs to the MFRV Bypass Valves, reactor power level was approximately 10 to 12 percent and S/G levels were near 60 percent. Direction was given to perform the transfer per Attachment 'A' of OTO-AC-00001. About this same time, S/G levels had turned (reduced) for a short duration and then started to rise. The trend recorders for S/G level control indicated that feedwater flow was lower than steam flow. This indicated to the RO that S/G levels should be turning and trending back to normal levels; however, the levels continued to rise. The operating crew believed there was a need to transfer to the MFRV Bypass Valves for control of S/G levels. Therefore, the RO continued with performance of Attachment 'A' with the anticipation of achieving required S/G levels based on indications in the control room.

At 00:53:07, during the transition to bypass feedwater control, the P-14 setpoint was exceeded in the 'A' steam generator. The P-14 signal caused a Feedwater Isolation Signal (FWIS), which tripped the 'A' Main Feedwater Pump (MFP) and initiated a Motor Driven Auxiliary Feedwater Pump Actuation Signal (MDAFAS). The Control Room Supervisor (CRS) informed the Shift Manager (SM) there was an auxiliary feedwater actuation. Reactor power was less than 12% and the CRS recommended a manual reactor trip. The SM concurred and the operating crew manually tripped the reactor at 00:53:33, and then transitioned to Emergency Operating Procedure E-0, "Reactor Trip or Safety Injection".

E-0 was entered, and all immediate actions were completed. All equipment functioned as designed. At 0058, the crew transitioned from E-0 to ES-0.1, "Reactor Trip Response". During the performance of ES-0.1, all equipment functioned as designed. Pressurizer level and pressure control were verified to be functioning normally. The crew exited ES-0.1 and transitioned to OTG-ZZ-00008, "Normal Unit Recovery Guideline Following Reactor Trip". The plant was stabilized in Mode 3, reactor trip breakers were reset at 03:26, the auxiliary feedwater system was reset for automatic operation at 03:37, and feedwater supply was transitioned from auxiliary feedwater to the startup feedwater pump at 03:45.

A review of the event determined OTO-AC-00001 was revised in 1991 to place rod control in automatic.

Leaving rod control in automatic during this event resulted in a significant power reduction from 47% power to less than 10% power in approximately four minutes. The controls for the MFRVs are tuned to operate at higher power levels. Therefore, having rod control in automatic resulted in the MFRVs operating outside their normal range leading to high S/G levels, which contributed to safety system actuations and a manual reactor trip.

E. METHOD OF DISCOVERY OF EACH COMPONENT, SYSTEM FAILURE, OR PROCEDURAL ERROR

Given the initial conditions of this event, a reactor trip following a turbine trip below 50 percent power was self-revealing through the occurrence of the event. Procedural deficiencies were discovered through the use of a seven-step root cause analysis. Interviews with the operating crew were conducted to gather information and to validate facts. The root cause team developed an Events and Causal Factors Chart and identified one Causal Factor. The TapRoot(R) method was used to determine the Root Cause of the Causal Factor. The TapRoot(R) Root Cause Tree identified one Root Cause. By asking one additional 'Why", the team clarified the Root Cause by associating it with the station procedure change review process in effect in 1991.

II.EVENT DRIVEN INFORMATION

A. SAFETY SYSTEMS THAT RESPONDED

Safety systems that responded to this event included the FWIS, the MDAFAS, and the reactor protection system manual trip function. The responses of these and other non-safety systems that responded to this event are described in the Narrative Summary.

B. DURATION OF SAFETY SYSTEM INOPERABILITY

No structures, systems or components were Inoperable during the event which contributed to the event.

C. SAFETY CONSEQUENCES AND IMPLICATIONS OF THE EVENT.

This event was evaluated with the Callaway Probabilistic Risk Assessment (PRA) model. The evaluation determined that the Conditional Core Damage Probability (CCDP) of the event was less than 1E-6; therefore, this event was of very low risk significance. Use of the PRA model to evaluate the event provides for a comprehensive, quantitative assessment of the potential safety consequences and implications of the event, including the consideration of alternative conditions beyond those analyzed in the FSAR.

III. CAUSE(S) OF THE EVENT AND CORRECTIVE ACTION(S)

A seven-step root cause analysis process was used to evaluate this event. Interviews with the operating crew were conducted to gather information and to validate facts. The Root Cause Team developed an Events and Causal Factors Chart and identified one Causal Factor. The TapRoot(R) method was used to determine the Root Cause of the Causal Factor, and led the team to identify a Root Cause associated with the station procedure change review process in effect in 1991.

CAUSAL FACTOR CF-1: OTO-AC-00001 does not require rod control to be in Manual below 15% power.

This is inconsistent with Callaway Plant design basis.

The actions of OTO-AC-00001 directed rod control to be placed in the automatic mode of operation without terminating the power decrease as to allow for controlled plant shutdown. This created a situation in which the rod control system decreased reactor power to a level below which the MFRVs could adequately control S/G level. This power reduction occurred so quickly that S/G level control could not be manually transferred to the MFRV Bypass Valves. The mitigation strategy outlined in OTO-AC-00001 for responding to a turbine trip below P-9 was not appropriate.

ROOT CAUSE RC-1: When OTO-AC-00001 was revised in 1991 to place rod control in automatic, an inadequate review of the FSAR and other design documents was performed. This review did not identify that the normal power range for automatic rod control is between 15 and 100% full power.

CORRECTIVE ACTION TO PREVENT RECURRENCE CATPR-1A: Since 1991 procedure APA-ZZ-00101, "Preparation, Review, and Approval of Written Instructions", has been revised to require that reviewers be designated by the department head as qualified reviewers and that a validation or verification be performed prior to issuance of a major procedure revision. Currently, APA-ZZ-00101 specifically requires that the procedure writer review Controlled Documents, Licensing Basis Documents, References, Commitments and Associated Work Documents. APA-ZZ-00101 was also revised to require a qualification process for procedure writers.

CORRECTIVE ACTION TO PREVENT RECURRENCE CATPR-1B: Revise the mitigation strategy implemented in OTO-AC-00001, 'Turbine Trip below P-9". Different strategies will be evaluated for implementation including, but not limited to: tripping the reactor upon a Turbine Trip; and including instructions to place rod control in manual below 40% power but prior to reaching 25% power, and stabilizing power at that level. After the plant is stabilized, the operating crew will place the plant in the desired condition.

CORRECTIVE ACTION CA-1: Provide training to operators prior to issuance of revised OTO-AC-00001.

CORRECTIVE ACTION CA-2: Evaluate if a revision to OTO-AD-00001, "Loss of Condenser Vacuum", is required to address rod control operation at reduced power levels ( from the extent of condition review discussed below.

Procedure OTO-AC-00001 underwent a Major Revision and Validation in 2004 with the revision being issued in 2005 as part of an Emergency Operating Procedure upgrade project. The revised procedure was validated in the simulator. However, the simulator model of the old S/Gs was used with new numbers for the replacement S/Gs. The initial reactor power for these scenarios was not documented and could not be validated by the root cause team. As part of the root cause evaluation, numerous simulator runs were performed with the model for the replacement S/Gs. In each case S/G level rose close to, but never reached, the P-14 setpoint. Initial reactor power level was 45 percent for these simulator runs, while in the event of 5/12/2006 initial reactor power was 47 percent. This difference in initial reactor power could account for the minor difference in S/G level reaching the P-14 setpoint during the event. As a result of this observation, an action was generated to evaluate the need to re-validate operating procedures affected by the S/G replacement in light of the validation discrepancy identified for OTO-AC-00001.

Extent of condition and extent of cause reviews were conducted as part of the root cause analysis. The Off-Normal (OTO) procedures were reviewed to determine any having direction to place rod control in automatic and which could potentially be in use at low power levels (less than 25%). Three procedures met these criteria: OTO-AC-00002; OTO-AD-00001; and OTO-MA-00001, 'Turbine Load Rejection". All three procedures have transitions to OTO-AC-00001 when a turbine trip is necessary below 50% power.

OTO-MA-00008, "Rapid Load Reduction", also met the criteria but has guidance to begin transferring S/G level control from the MFRVs to the Bypass Valves at a sufficiently high power to complete the transfer prior to reaching 20% power. The procedure also contains appropriate guidance to ensure rod control is placed in manual at 15% power. OTO-AD-00001 reduces turbine load in response to lowering condenser vacuum and could potentially be in use at low power with no guidance on operation of control rods.

OTO-AD-00001 does direct performance of OTO-MA-00008 if a rapid load decrease is required.

OTO-MA-00001 responds to a load reject, specifically a setback or runback, and is not likely to be in use at low levels but does direct transition to OTO-AC-00001 if turbine trip is required.

The extent of cause portion of the review evaluated the generic potential for inadequate procedural guidance. In the case of OTO-AC-00001, the procedure was revised using the process existing in 1991.

The procedure writing process under APA-ZZ-00101 has been strengthened since the time the OTO-AC-00001 automatic rod control revision was generated. In addition, APA-ZZ-00101 requires a qualification process for procedure writers and provides a methodology for review and approval to minimize the potential for procedural deficiencies. This includes additional verification or validation techniques to ensure that each procedure is adequate.

The procedure review and approval process has been significantly strengthened since 1991. The process now requires a validation or verification, which it did not in 1991. CATPR-1A minimizes the potential for similar procedural issues from occurring as it provides a process for the review and approval of a procedure prior to the issuance of a major revision.

CATPR-1B will prevent recurrence as the procedure will provide definitive instructions for rod control operation for turbine trip transients occurring below P-9.

Several other issues, including those listed below, were evaluated for impact on this event. These items were determined not to be causal factors or contributors to this event. The resolution of each item is described in detail in the root cause analysis report.

(1) Decision to open MFRV Bypass Valves in an attempt to transfer feedwater control when steam generator levels were at approximately 80% may have contributed to the P-14 actuation signal. As discussed in the narrative summary, the trend recorders for S/G level control indicated that feedwater flow was significantly lower than steam flow. Although the RO believed this indicated that the levels would turn and trend to the procedurally required 45-55%; this assumption was not correct due to the swell in the S/Gs caused by the inventory already added in the early stages of the transient. In review of the event, the operating crew acknowledged that obtaining procedurally required conditions, not anticipating the conditions, is appropriate. Although the transfer to bypass feedwater flow did not alter the course of the event, the crew also acknowledged that stopping to more fully evaluate conditions was warranted.

Corrective action for this item included coaching the operating crew on procedure compliance and peer­ checking as human performance tools.

(2) Step sequencing within procedure OTO-AC-00001 may not have been adequate to ensure a timely transfer from the MFRVs to the MFRV Bypass Valves following a turbine trip from P-9.

(3) Manual control of the MFRVs was not established during this level transient which, had it occurred, may have prevented reaching the High-High S/G level setpoint.

(4) Post Refuel 14 startup test activities may not have been adequate for identifying the susceptibility of a P-14 actuation following a turbine trip below the P-9 permissive.

IV. PREVIOUS SIMILAR EVENTS

External and internal Operating Experience was reviewed for applicability to this event. No similar events were found in the Industry operating experience database. A review of LERs generated since 2001 was also conducted. There were three events where high S/G level resulted in a FWIS. A review of these events, which are described below, determined that they are not relevant operating experience with respect to this event.

(1) Indian Point Unit 2 LER 01-001-00, Turbine Trip During Startup Results In Auxiliary Feedwater System Actuation; (2) South Texas Unit 2 LER 02-003-01, Automatic Reactor Trip Due To Main Turbine Trip Caused By High Water Level In 2b Steam Generator; and (3) Catawba Unit 1 LER 03-001-00, High Steam Generator Level Turbine Trip Causes Reactor Trip And Automatic Start Of Motor Driven Auxiliary Feedwater System Pumps A search of the Callaway corrective action system (CARS) identified four relevant occurrences similar to the event of 5/12/2006:

(1) CAR 199002930: Turbine Trip/Reactor Trip — Plant shutdown of 20% per hour was in progress due to chemistry concerns. LER 90-016-00, Reactor Trip on Low Steam Generator Level Which Resulted From A Turbine Trip on A Spurious Moisture Separator Reheater High Level Signal; (2) CAR 199201323: Main Feedwater Isolation signal was received. LER 92-006-00, Main Feedwater Isolation Signal Due to the Spurious Opening of Main Steam Dump Valves; (3) CAR 199601921: Received a P-14 Hi-Hi Turbine Trip. LER 1996-006-00, Received A P-14 -HI Turbine Trip on 'B' S/G Shortly After Synching to the Grid; and (4) CAR 200401167: Reactor Trip due to low S/G water level. LER 2004-005-00, Inadequate Feedwater Heating During Plant Startup Causes Turbine Trip And Subsequent Reactor Trip.

A review of these events determined the first two are not relevant operating experience for the 5/12/2006 event. The third event documented a FWIS due to High-High S/G level during a swapover from the MFRV Bypass Valves to the MFRVs. At that time in plant operation, the swapover was performed at around 6 to 10 percent power because of the capability of the MFRV Bypass Valves. Corrective Actions for this event were to modify the trim on the MFRV Bypass Valves to allow operation the MFRV Bypass Valves up to 30% power. In addition, a modification was installed to increase the amount of pre-heating by routing main steam to the Feedwater heaters. These corrective actions have been proven to be very effective since their implementation.

While there are similarities between the fourth event and the event of 5/12/2006, it is not considered to be directly applicable because of several differences. The similarities include swinging steam generator levels, changing power levels, and transferring between the MFRVs and the Bypass Valves. However, there are significant differences such as: initiators of the events; operating crew response to the events; clarity of related procedural guidance; and S/G responses because of the S/G replacement between the events. In addition, the corrective actions for the fourth event were primarily focused on normal operations, such as power ascension and downpowers, and not intended to apply to transient conditions such as in the 5/12/2006 event.

V. ADDITIONAL INFORMATION

None