05000483/LER-2008-002

LER-2008-002, Callaway Plant Unit 1 05000 483 1 OF 13

Docket Number Sequential Revmonth Day Year Year Month Day Yearnumber No.
Event date:	05-21-2008
Report date:	11-05-2009
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability
4832008002R01 - NRC Website

A. REPORTABLE EVENT CLASSIFICATION

Evaluation of the condition addressed by this LER determined that the condition is reportable per the following criteria:

10CFR50.73(a)(2)(i)(B) — Operation or Condition Prohibited by Technical Specifications 10CFR50.73(a)(2)(v)(B) — Event or Condition That Could Have Prevented Fulfillment of a Safety Function Needed to Remove Residual Heat 10CFR50.73(a)(2)(v)(D) — Event or Condition That Could Have Prevented Fulfillment of a Safety Function Needed to Mitigate the Consequences of an Accident 10CFR50.73(a)(2)(vii) — Common Cause Inoperability of Independent Trains or Channels

B. PLANT OPERATING CONDITIONS PRIOR TO THE EVENT

The plant was in MODE 1 at 100% power at the time the condition was discovered.

AT THE START OF THE EVENT AND THAT CONTRIBUTED TO THE EVENT

The event described in this report is the discovery of a void in a section of emergency core cooling system (ECCS) piping that is required to be full of water for maintaining the ECCS in a standby operable status during plant operation. The affected pipe section is part of the safety injection pump `A/B' common suction header from the "A" residual heat removal heat exchanger discharge. As discussed in the Narrative Summary of the Event section below, the void was introduced during maintenance on the safety injection (SI) [EIIS system: BQ] system during Refuel Outage 15 but was unknowingly not removed during the fill and vent procedure completed prior to restart from that outage. The SI system was not required to be operable at the time the void was created and left in place.

TIMES

NOTE: A listing of some of the terms used in this Licensee Event Report (LER) is provided in section V, ADDITIONAL INFORMATION, of this report.

BACKGROUND:

The Emergency Core Cooling System (ECCS) at Callaway consists of three separate subsystems: centrifugal charging (CC) (high head) [EIIS system: BQ], safety injection (SI) (intermediate head) [EIIS system: BQ], and residual heat removal (RHR) (low head) [EIIS system: BP]. Each subsystem consists of two redundant, 100% capacity trains. The ECCS flow paths consist of piping, valves, heat exchangers, and pumps such that water from the Refueling Water Storage Tank (RWST) [EIIS system: BP component: TK ] can be injected into the Reactor Coolant System (RCS) [EIIS system: AB ] following the accidents for which the ECCS is designed to mitigate. The major components of each subsystem are the centrifugal charging pumps (CCPs) [EIIS system: BQ component: P], RHR pumps [EIIS system: BP component: P], heat exchangers [EIIS system: BP component: HX], and safety injection pumps (SIPs) [EIIS system: BQ component: P]. The trains may be interconnected, thus providing the operators with the ability to utilize components from opposite trains to achieve the required 100% flow to the core.

There are three phases of ECCS operation in response to a loss of coolant accident (LOCA):

injection, cold leg recirculation, and hot leg recirculation. In the injection phase, water is taken from the RWST and injected into the RCS through the cold legs. When sufficient water is removed from the RWST to ensure that enough boron has been added to maintain the reactor subcritical and the containment sumps have enough water to supply the required net positive suction head to the ECCS pumps, suction is switched to the containment sumps for cold leg recirculation. The RHR pumps can then provide suction head for the other ECCS pumps (i.e., CCPs and/or SIPs). After a period of time, i.e., 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> after switchover to cold leg recirculation, recirculation to the RCS hot legs is required to preclude potential boron precipitation in the reactor core. The switchover to hot leg recirculation is a manual operator action. Hot leg recirculation can be effected by use of the RHR pumps and/or SIPs. One RHR pump in combination with one SIP can provide adequate hot leg recirculation if the RCS pressure is above the shutoff head of the RHR pumps (since the CCPs can only deliver to the RCS cold legs) as either RHR pump can be aligned to deliver flow to one SIP.

The Limiting Condition for Operation for Technical Specification 3.5.2, "ECCS — Operating," states that two ECCS trains shall be OPERABLE. The APPLICABILITY is MODES 1, 2, and 3. With one or more ECCS trains inoperable (such that at least 100% of the ECCS flow equivalent to a single operable ECCS train is still available), Condition A of TS 3.5.2 applies.

Required Action A.1 requires restoring the inoperable train(s) to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Otherwise, plant shutdown is required.

DISCUSSION OF THE EVENT:

The ECCS SI subsystem was drained several times during Refuel 15 (conducted during the April-to-May 2007 timeframe) to perform maintenance. Safety/hold-off tagging was placed on the system and changed several times as various work activities for the system were performed.

This required the system (or portions of the system) to be drained and refilled several times as needed.� Subsequent review of the work documents used at that time showed that the specified scope of filling and venting varied with the work activities to be done, especially with regard to use of vent valve EMV0179. Although an established fill-and-vent procedure (plant procedure OTN-EM-00001) was used and identified in the work documents, it appears that an inadequate final filling and venting of the system was performed for system restoration prior to restart from the outage.

For restart from Refuel 15, the plant entered MODE 3 from MODE 4 on May 5, 2007 at 1805.

Subsequently, the plant entered MODE 2 on May 8, 2007 at 0412, and then MODE 1 on May 8, 2007 at 1010. The plant remained in MODE 1 until shutdown for Refuel 16 which commenced October 10, 2008 at 2300. As noted above, both trains of ECCS are required when the plant is in MODES 1, 2, or 3.

During Operating Cycle 16, in response to NRC Generic Letter 2008-01 and Wolf Creek Operating Experience, Callaway developed and implemented a plan to verify that the Emergency Core Cooling System (ECCS) was full of water. On May 21, 2008, while implementing this plan, line EM-023-HCB-6", SIP `A/B' Common Suction Header from RHR `A' During ECCS Recirculation (also known as the "piggyback" line from the 'A' RHR heat exchanger to the SIPs), was found to contain a void approximately 6.6 cubic feet in volume.

This exceeded the allowable void volume of 2.105 cubic feet as specified in plant engineering documents for this section of piping. At 1430, PEMO1A, Safety Injection Pump 'A', was declared INOPERABLE pursuant to Technical Specification 3.5.2.A. This condition was entered into the Equipment Out of Service Log (EOSL) as EOSL 15731. The line was vented at valve EMV0179, SI Pump 'A' from RHR 'A' HX Suction Vent, and declared OPERABLE at 2050 on May 21, 2008.

Based on a review of work history performed on the affected system, the discovered void was determined to be caused by inadequate filling and venting of the system following the last time work was done on that part of the system, which was during Refuel 15.

NUREG 1022 requires clarification of the event date if it is different from the discovery date.

In this case, the event occurred on May 5, 2007, when the SI system was restored from work on relief valve EM8858A. The void was introduced into the piping when the filling and venting of the system was performed at that time. The void was subsequently discovered on May 21, 2008.

After discovery of the void, AmerenUE initially determined that the event/condition was not reportable. However, a notice of violation was subsequently issued to Callaway for failure to report the event in accordance with 10CFR50.73(a)(1). AmerenUE therefore submitted Revision 0 of this LER for the condition discovered on May 21, 2008 on the basis that the condition constituted a condition prohibited by the Technical Specifications and was reportable per 10CFR50.73(a)(2)(i)(B) as well as 10CFR50.73(a)(2)(vii). Following submittal of Revision 0 of this LER, it was then identified that the event/condition addressed by this LER should have also been reported as one that could have prevented fulfillment of a safety function. The NRC thus proposed a severity level 4 non-cited violation of 10CFR50.73(a)(2)(v) for not reporting the condition as a Safety System Functional Failure. Revision 1 of this LER is therefore submitted to additionally report the subject event/condition as one that could have prevented fulfillment of a safety function needed to remove residual heat and mitigate the consequences of an accident, pursuant to 10CFR50.73(a)(2)(v)(B) and 10CFR50.73(a)(2)(v)(D), respectively.

PROCEDURAL ERROR

The void was discovered while performing ultrasonic testing to check for voids in line EM-023- HCB-6".

The cause analysis of the event determined that a procedure error, i.e., not using valve EMV0179 to vent the associated line, was the root cause of the void.

II.� EVENT DRIVEN INFORMATION

A. SAFETY SYSTEMS THAT RESPONDED

Not applicable for this issue.

B. DURATION OF SAFETY SYSTEM INOPERABILITY

Although engineering judgment supports a determination that the Emergency Core Cooling System (ECCS) remained capable of meeting the ECCS acceptance criteria of 10CFR50.46, it has been conservatively determined that the presence of the void caused the system to be inoperable with respect to the requirements of the Technical Specifications and that the condition could have prevented fulfillment of a safety function. This condition existed from when the plant entered MODE 3 (i.e., at 1805 on May 5, 2007) at the end of Refuel 15 until the time when the void was removed by venting at 2050 on May 21, 2008.

C. SAFETY CONSEQUENCES AND IMPLICATIONS OF THE EVENT.

A detailed risk assessment of the EM-023-HCB-6" void issue is documented in the plant's corrective action system. The risk assessment determined that the increase in core damage frequency (i.e. delta CDF) due to this issue was 7E-8 per year, which is well below the risk­ significance threshold of 1E-6 per year. Therefore, this issue was determined to be of very low risk significance.

With respect to a deterministic evaluation, it may be concluded that the ECCS remained capable of meeting the ECCS acceptance criteria of 10CFR50.46, despite the voiding identified in line EM-023-HCB-6". At the same time, a conservative evaluation of the condition leads to the conclusion that both trains of one ECCS subsystem were potentially affected to the extent that the subsystem was inoperable. On this basis, it has been determined that the associated TS requirements were not met and that the condition could have prevented fulfillment of a safety function. A complete evaluation, in which all three phases of post-LOCA ECCS operation are considered, is provided as follows.

Overall ECCS Operation As described previously, the SIPs and the CCPs perform the intermediate-head injection and high-head injection function of the ECCS, respectively. These pumps and their respective system components must operate to provide borated water to the reactor coolant system (RCS) from the refueling water storage tank (RWST) during the ECCS injection mode. These pumps are also required to deliver flow from the containment recirculation sumps via the RHR pumps to the RCS cold legs during the cold leg recirculation mode of ECCS, commonly known as the piggyback alignment. In addition, the SIPs deliver flow from the containment recirculation sump via the RHR pumps to the RCS hot legs during the hot leg recirculation mode of ECCS. The SIPs and CCPs are normally in standby operation and are required to start automatically upon receipt of a safety injection (SI) signal.

Injection Phase For the injection phase of an accident, it has been determined that the void identified in line EM- 023-HCB-6" would not be transported to any of the ECCS pump suctions. The piggyback lines are isolated by the EMHV8807A and B valves (residual heat exchanger 'A' to SI pump suction downstream isolation valves) which would prevent any significant flow through this piping.

Therefore, with no motive force to transport the void down to the CCPs or SIPs during the injection phase, the presence of the void had no impact on the capability of the ECCS to perform satisfactorily for the injection phase in response to an accident (LOCA).

Cold-Leg Recirculation Phase During the recirculation phase, the void identified in line EM-023-HCB-6" could be transported to either the CCPs or the SIPs. Transport to the CCPs or the SIPs would likely occur as a result of sequential alignment of the RHR pumps (in accordance with the plant emergency operating procedures (EOPs)) or in the unlikely event of a failure of one of the RHR pumps. (While both RHR trains are in service, there would be insufficient differential pressure (flow) to move the void from its location in the EM-023-HCB-6" line.) If the 'IV RHR pump was aligned first for providing suction to the CCPs, or if a failure of the 'A' RHR train occurred, a flow path for transportation of the void would be established from the containment recirculation sump, through the RHR pump/heat exchanger, through EJHV8804B (residual heat removal train 13' supply to the SIPs), to the SIP suction lines, through the piggyback lines (EM-022-HCB-6" and EM-023- HCB-6"), and then to the CCPs. This flowpath could potentially render both CCPs incapable of performing their design safety function because the void could be transported into both CCPs.

The size of the void that could be swept into each of the pump suctions would be in excess of a 5% void fraction, assuming the void was divided evenly enough for transport of a large fraction to each pump. The 5% void fraction is the current acceptance criterion provided by the pump vendor (Flowserve) with respect to what the pump(s) can handle without causing the pump(s) to degrade.

Alternatively, and in accordance with the plant EOPs, the RHR 'A' pump may be aligned first for providing suction head for the SIPs. (This is in accordance with the sequential alignment of the RHR pumps as specified per plant procedure ES-1.3.) In this case, or in the event of a failure of the `B' RHR train to start or operate during the recirculation phase, a flow path for transportation of the void could be established from the containment recirculation sump, through the RHR pump/heat exchanger, through EJHV8804A, to the CCP suction lines, through the piggyback lines, and then to the SIPs. This flowpath could potentially render both SIPs incapable of performing their design safety function since the void could be transported into both SIPs. The size of the void that could be swept into the pump suctions could be in excess of a 5% void fraction going into each SIP (assuming, again, that the void was divided evenly enough for transport of a large fraction to both pumps).

Based on the above, it may be noted that the void that was found in the "piggy back" piping could not have adversely affected both CCPs and both SIPs. The void would either be pushed to the CCPs by the discharge pressure of the `B' RHR pump or pushed to the SIPs by the discharge pressure of the 'A' RHR pump. (The void would not be transported to any of the ECCS pumps if both trains of RHR were aligned for the recirculation phase at the same time, but per the EOPs, the pumps are aligned sequentially and thus not at the same time for providing a suction flow path to the CCPs and SIPs.) Despite the loss of an individual subsystem (i.e., the CCPs or the SIPs), the ECCS would still have been capable of meeting its acceptance criteria, but not performing its intended design safety function. The ECCS has a safety function of ensuring the following 10CFR50.46 acceptance criteria are met following a postulated Loss of Coolant Accident (LOCA): 1) maximum fuel element cladding temperature is 0.17 times the total cladding thickness before oxidation, 3) maximum hydrogen generation from a zirconium water reaction is the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react, 4) core is maintained in a coolable geometry, and 5) adequate long term cooling capability is maintained.

The potential impact of the void on the recirculation phase, i.e., for the ECCS decay heat removal function, was further evaluated, as supported by Callaway calculation BN-16. The evaluation, as summarized below, took into consideration the large break LOCA and small break LOCA scenarios. For each case, the shortest time possible for entry into the recirculation phase (piggy back alignment) was considered since this would represent the maximum decay heat load required to be met by the ECCS at the onset of the recirculation phase.

For a design basis large break LOCA (LBLOCA), the RCS would be at such a low pressure that all three sets of pumps (RHR pumps, SIPs, and/or CCPs) would be capable of supplying water to the RCS. Assuming full flow from all six ECCS pumps as well as the two Containment Spray pumps, (since the RHR pumps, SIPs, CCPs, and Containment Spray pumps could all be operating during the injection phase of a LBLOCA), the approximate drain-down time of the RWST would be 12.5 minutes, or 750 seconds per Case 1 of calculation BN-16, Rev. 1. After that, time would be required for operators to manually align the ECCS into piggyback alignment. Based on the timing of scenarios practiced on the plant simulator, it would take at least 240 seconds to fully align the CCPs and SIPs into piggyback alignment. At this point in time, i.e., approximately 990 seconds after the break, the ECCS flow demand for providing adequate core decay heat removal would be no more than approximately 725 gpm. Due to the rapid depressurization of the RCS following a LBLOCA, this flowrate is capable of being delivered by one RHR pump, two CCPs, or two SIPs. Therefore, the required flow rate to meet decay heat plus 20% (per the plant's design basis) would have been provided such that the ECCS remained capable of satisfying the ECCS acceptance criteria of 10CFR50.46 for the cold-leg recirculation phase following a LBLOCA.

For a design basis small break LOCA (SBLOCA), the RCS would remain at an elevated pressure such that only the SIPs and/or the CCPs would be capable of injecting into the RCS during the initial stages of the cold leg recirculation phase of an accident. (The Containment Spray pumps would not be running since the pressure in the containment building would not reach the Containment Spray Actuation Signal pressure setpoint of 27 psig following a SBLOCA.) Assuming that the SIPs and the CCPs would draw down the RWST water volume during the injection phase, the minimum injection-phase time before switchover and piggyback alignment would be at least 130 minutes, or 7800 seconds.

Per calculation BN-16, the RWST has a volume of 235,597 gallons available for injection phase. The flowrates, noted in BN-16, with both CCPs and SIPs running would be 962 gpm for the CCPs and 828 gpm for the SIPs. With an available injection volume of 235,597 gallons and a draindown flowrate of 1790 gpm (CCPs' flowrate plus SIPs' flowrate), automatic swapover and piggyback alignment would not start until at least 130 minutes into the accident. Additional time (minimum 240 seconds) would be required before piggyback alignment would be completed. Conservatively assuming piggyback alignment at 130 minutes (or 7800 seconds) after onset of the accident, the required injection flow needed into the RCS to remove decay heat plus 20% would be less than 414 gpm. (7000 seconds subcritical decay time requires 414.8 gpm.) This amount of flow is capable of being provided by either one CCP or one SIP. Thus, even if it is assumed that the gas void would bind both SIPs or both CCPs upon alignment in the piggyback configuration, adequate flow would be provided from the unaffected pumps to remove the decay heat plus 20%. The ECCS would therefore still be capable of satisfying the ECCS acceptance criteria of 10CFR50.46 for the cold-leg recirculation phase following a SBLOCA.

Hot Leg Recirculation Phase Per the Callaway EOPs for both small and large LOCAs, thirteen hours after the switchover to cold leg recirculation, operators are required to perform the actions necessary to switch to hot leg recirculation. Although hot leg recirculation can be established with one SIP (with one or both RHR pumps providing suction to the SIP), it can be reasonably assumed that at 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> after the switchover to cold leg recirculation, the RCS is depressurized to below the RHR pump shutoff head so that the RHR pumps may be used for (or to support) hot leg recirculation. This is supported by Callaway's emergency operating procedures which provide guidance for depressurizing the RCS. The EOPs direct operators to cool down and depressurize the RCS as rapidly as possible following a LOCA. By the time hot leg recirculation is initiated, the EOPs support use of the RHR pumps to provide flow directly to the RCS hot legs. It may therefore be concluded that the presence of the void in the ECCS piggy back piping would not have prevented hot leg recirculation capability following a LOCA.

Conclusion In conclusion, despite the void identified in line EM-023-HCB-6", the ECCS was still capable of meeting the ECCS acceptance criteria of 10CFR50.46. Nevertheless, and based on the intent of the Technical Specifications for having all three of the noted subsystems available to accommodate the various phases of ECCS operation for mitigation of a design-basis LOCA, it has been conservatively determined that the presence of the void constituted a condition that could have prevented fulfillment of a safety function. Risk assessment determined that the increase in core damage frequency (i.e. delta CDF), due to the identified void condition was 7E-8 per year, thus confirming the very low risk significance of this event.

Reportability With respect to reportability, this event is being reported as a condition or operation prohibited by the Technical Specifications, pursuant to 10CFR50.73(a)(2)(i)(B). As noted previously, the Limiting Condition for Operation of TS 3.5.2 requires both ECCS trains to be Operable in Modes 1, 2, and 3. With one train inoperable (and at least 100% of the ECCS flow equivalent to a single Operable ECCS train available), Condition A is required to be entered. Its associated Required Action A.1 requires restoring the inoperable train to Operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. With the Required Action and its associated Completion Time not met, Condition B applies, and per its Required Actions (B.1 and B.2) the plant must be placed in a shutdown condition, i.e., in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. No Condition or Required Action is specified for having two ECCS trains inoperable, so in the event of such a condition, LCO 3.0.3 must be entered. Per LCO 3.0.3, action must be taken within one hour to place the plant in Mode 3 within 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />, in Mode 4 within 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />, and in Mode 5 within 37 hours4.282407e-4 days <br />0.0103 hours <br />6.117725e-5 weeks <br />1.40785e-5 months <br />.

As described earlier, LCO 3.5.2 requires two trains of each of the three ECCS subsystems corresponding to the high-head, intermediate-head, and low-head functions to be Operable.

Based on how this LCO is structured, inoperability of any one entire subsystem is considered a inoperability of both trains of ECCS. Since it has been conservatively determined that the void discovered in the EM-023-HCB-6" line rendered either both SIPs or both CCPs inoperable, even if only for the recirculation phase of an accident, a conservative interpretation of LCO 3.5.2 leads to the determination that the presence of the void would have required entry into LCO 3.0.3.

Because the void was not known to exist for the time from when it was introduced and not removed prior to restart from Refuel 15 until it was discovered on May 21, 2008, the requirements of LCO 3.5.2 and LCO 3.0.3 were not met. The condition therefore constituted a condition prohibited by the plant Technical Specifications.

Consistent with the above, the event is also required to be reported pursuant to 10CFR50.73(a)(2)(vii), i.e., as an event where a single cause or condition caused at least two independent trains to become inoperable in a single system designed to shut down the reactor and maintain it in a safe condition, remove residual heat, control the release of radioactive material, or mitigate consequences of an accident. This is based on the conservative determination that the void rendered both SIPs or both CCPs inoperable, thus causing both trains of one subsystem to be inoperable.

Consistent with the conservative determinations above and the position expressed by the NRC in the aforementioned non-cited violation issued for Callaway in connection with this LER, it has also been determined that the noted void condition could have prevented fulfillment of a safety function of systems (i.e., ECCS subsystems) needed to remove residual heat and mitigate the consequences of an accident. This is based on the position that, consistent with the design of the ECCS for providing adequate flow throughout the various phases of ECCS operation for mitigation of a design-basis LOCA and under design-basis conditions, each subsystem (high head, intermediate head, and low head) must be capable of fulfilling its FSAR-described design­ basis function for the phase of operation to which the subsystem is dedicated, without reliance on another subsystem.

Thus, although the ECCS remained capable of fulfilling the ECCS acceptance criteria of 10CFR50.46 as described in Section C of this LER, it is conservatively concluded that this event is also reportable under 10CFR50.73(a)(2)(v)(B) and 10CFR50.73(a)(2)(v)(D), i.e., as an event or condition that could have prevented fulfillment of a safety function needed to remove residual heat and mitigate the consequences of an accident, respectively.

III. CAUSE(S) OF THE EVENT AND CORRECTIVE ACTION(S)

The investigation into why the void was present determined that the fill and vent section of procedure OTN-EM-00001, Safety Injection System, did not utilize valve EMV0179 as a vent point. This valve is needed to vent the section of piping between the 'A' SI Pump suction and valve EMHV8807B, RHR HX 'A' to SI PUMPS Suction Downstream Isolation Valve VLV'B' (Line EM-023-HCB-6").

Revision 22 of procedure OTN-EM-00001 did not include EMV0179 as a vent location for pipeline EM-023-HCB-6". Consequently, all subsequent revisions through Revision 27 did not include EMV0179 as a vent location. The procedure writer and reviewers did not identify that valve EMV0179 needed to be included in OTN-EM-00001 as a vent point due to inadequate self-checking during the procedure revision process.

The inadequate procedure is considered to be a flawed defense. The individuals that revised and reviewed OTN-EM-00001 have been coached on the need to self-check their work and to ensure the adequacy of procedure reviews. The subject vent was incorporated via Revision 28 of OTN-EM-00001. OSP-SA-00003, Emergency Core Cooling System Flow Path Verification and Venting, has been revised to include EMV0179 and other valves as vent locations to assist in removing voids.

Procedure APA-ZZ-00101, Processing Procedures, Manuals, And Desktop Instructions, was revised in November 2007 (Revision 045) to require an additional Technical Review. This change in the procedure review and approval process will help minimize the possibility of one Technical Review missing or overlooking an essential detail.

IV. PREVIOUS SIMILAR EVENTS

The issue of voiding in systems at Callaway was previously addressed in plant corrective action documents in the 2003 and 2005 timeframe. The voiding was in pump discharge lines. In 2005 a trend with respect to identified gas voids was identified and determined to be caused by inadequate fill and vent instructions. At that time, the normal operating procedures did not contain fill and vent instructions. The corrective action to prevent recurrence for this trend was to add fill and vent sections to the appropriate ECCS normal system operating procedures.

Also, Preventative Maintenance actions (PMs) were developed to verify that voiding- susceptible system piping is water solid, on a regular frequency. The sections of pipe discussed in this LER have been added to these PMs.

V.� ADDITIONAL INFORMATION

DESCRIPTION OF ITEMS MENTIONED ABOVE:

The system and component codes listed below in brackets [ ] are from the IEEE Standard 805­ 1984 and IEEE Standard 803A-1984 respectively.

OSP-SA-00003, Emergency Core Cooling System Flow Path Verification and Venting — the surveillance procedure for verifying and venting the emergency core cooling system flow path.

OTN-EM-00001, Safety Injection System — the procedure for normal lineup and operation of the safety injection system.

EJHV8804A, a motor-operated valve in the pipe between the 'A' residual heat removal system and the charging pump supply [system: BP, component: HCV].

EJHV8804B, a motor-operated valve in the pipe between the 'IV residual heat removal system and the safety injection pump supply [system: BP, component: HCV].

EMV0179, a valve for venting the section of piping between the 'A' residual heat removal heat exchanger and the "A" safety injection pump [system: BQ, component: V].

EMHV8807A, a motor-operated valve in the pipe between the 'A' residual heat removal system heat exchanger and the safety injection pump suction downstream isolation valve. This valve is in the mainstream piping [system: BQ, component: HCV].

EMHV8807B, a motor-operated valve in the pipe between the 'A' residual heat removal system heat exchanger and the safety injection pump suction downstream isolation valve. This valve is in the mainstream piping [system: BQ, component: HCV].

EM8858A, a relief valve in the 'A' safety injection pump suction piping (SI PMP A SUCT PRESS RLF TO RHT) [system: BQ, component: RV].

EM-023-HCB-6 inch — designation for the section of piping between the 'A' residual heat removal heat exchanger and the 'A' safety injection pump.

Workman's Protection Assurance (WPA) — Callaway plant's program for establishing conditions to prevent personnel injury during maintenance or repair of equipment. It also establishes measures to prevent unauthorized operation of out-of-service equipment or systems [system: BQ, component: P].

CCP, Centrifugal Charging Pump, high head pump, part of the Emergency Core Cooling System [system: BQ, component: P].

NRC FORM 366AU.S. NUCLEAR REGULATORY COMMISSION (1-2001) DOCKET (2) FACILITY NAME (1) NUMBER (2) LER NUMBER (6) PAGE (3) 13�OF 132008 -�002 - 01 RHR Heat Exchanger [system: BP, component: HX].

RWST, Refueling Water Storage Tank [system: BP, component: TK].

RHR pump, Residual Heat Removal [system: BP, component: P].

SI pump, Safety Injection Pump— intermediate head pump, part of the Emergency Core Cooling System [system: BQ, component: P]