05000483/LER-2009-003
| Callaway Plant | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 4832009003R00 - NRC Website | |
All times are approximate and Central Standard Time unless otherwise stated.
I.� DESCRIPTION OF THE REPORTABLE EVENT
A. REPORTABLE EVENT CLASSIFICATION
10CFR50.73(a)(2)(i)(B) requires reporting of any operation or condition prohibited by Technical Specifications. This Licensee Event Report (LER) is submitted accordingly. See Section I.D below for more information.
B. PLANT OPERATING CONDITIONS PRIOR TO THE EVENT
The plant was entering MODE 3 (Hot Standby) from MODE 4 (Hot Shutdown) following Refuel 16 at the time the event occurred. The Reactor Coolant System temperature and pressure at this time were 350 degrees Fahrenheit and 944 psig, respectively.
C. STATUS OF STRUCTURES, SYSTEMS OR COMPONENTS THAT WERE INOPERABLE AT THE
START OF THE EVENT AND THAT CONTRIBUTED TO THE EVENT
No other structures, systems or components were inoperable at the start of the event which contributed to the event.
D. NARRATIVE SUMMARY OF THE EVENT, INCLUDING DATES AND APPROXIMATE TIMES
During Refuel 16, the remote servo [EllS system: BA, component: FCO] for the Turbine-Driven Auxiliary Feedwater Pump (TDAFP) [EIIS system: BA, component: P] governor flow valve [EllS system:
BA, component: FCV] was replaced. The post-maintenance testing for the servo replacement included gathering stroke data for the TDAFP governor flow valve and inputting this data into the TDAFP Speed Controller [EllS system: BA, component: SC] database. While in MODE 5 (Cold Shutdown), this testing recorded a driver position current reading of 3.11 mADC. Additional testing of the turbine [EllS system:
BA, component: TRB] uncoupled from the pump was performed and the plant continued into MODE 4.
During this testing, an unexpected overspeed trip of the turbine occurred while being supplied with steam from the Auxiliary Steam system [EIIS system: SA]. Due to the fact that the turbine had been successfully started three times prior to the trip, and because the trip appeared to occur instantaneously with neither speed ramp-up indication nor any abnormalities, the likely cause of the trip was determined to be condensate from the Auxiliary Steam system. Since the turbine would be started three additional times for the testing, the test was continued as allowed by procedure and was completed satisfactorily. At 1818 on November 4, 2008, the Callaway Plant ascended into MODE 3.
After entering into MODE 3, on November 5, 2008, in preparation for surveillance testing of the TDAFP, a task was performed that required installation of a strip chart recorder [EIIS system: BA, component:
XR] connected to the governor valve position indication circuit [EIIS system: BA, component: ZI]. It was observed that prior to starting the turbine, this indication was low and erratic. After verifying the strip chart connections were satisfactory, investigations concluded that the replacement servo was faulty. At 1650 on the same day, the TDAFP was declared inoperable and Condition C (i.e., Required Action C.1) of Technical Specification (TS) Limiting Condition for Operation (LCO) 3.7.5, "Auxiliary Feedwater (AFW) System," was entered.
As no other remote servo spares were available, the remote servo that was removed during Refuel 16 was reinstalled. Following successful completion of surveillance testing, the TDAFP was declared operable at 1215 on November 6, 2008. Thus, Required Action C.1 of TS LCO 3.7.5 was exited.
During reviews recently performed on July 1, 2009, Plant Engineering noted that the remote servo position indication of 3.11 mADC recorded during post-maintenance testing in the refuel outage was below the minimum value expected. The reading from this 4-20 mADC circuit representing the position of the remote servo for the TDAFP should not have been below 4.0 mADC. Neither this, nor its significance, was recognized at the time of the post-maintenance testing as no acceptance criteria were listed or referenced in the procedure for this parameter. Based on this, along with the unexpected overspeed trip that occurred, it was concluded that the replacement remote servo that had been installed was defective. Thus, the ascension into MODE 3 on November 4, 2008 occurred with the TDAFP inoperable.
TS LCO 3.7.5 requires three trains of Auxiliary Feedwater to be OPERABLE in MODES 1, 2, and 3.
There are no TS requirements for Auxiliary Feedwater in MODE 4. LCO 3.0.4 states that when an LCO is not met, entry into a MODE or other specified condition in the Applicability shall only be made after performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering the MODE or other specified condition in the Applicability, and establishment of risk management actions, as appropriate. As Callaway was not aware of the inoperable TDAFP at the time of the MODE change, these actions were not taken. Therefore, TS LCO 3.0.4 was violated.
E. METHOD OF DISCOVERY OF EACH COMPONENT, SYSTEM FAILURE, OR PROCEDURAL ERROR
On June 22, 2009, NRC began a Special Inspection in response to the failure of the TDAFP to start on May 25, 2009, which was unrelated to the condition that existed on November 4 and 5, 2008.
(Reference: LER 2009-002). The NRC inspection team reviewed two Refuel 16 events related to the TDAFP turbine, including the TDAFP trip that occurred on November 4, 2008. These events were documented in Callaway's Corrective Action Program via the Callaway Action Request System (CARS).
Based on this review, the NRC questioned if the plant had entered MODE 3 (during restart from Refuel 16) with an inoperable TDAFP. After further review of data recorded by Plant Engineering, it was determined that MODE 3 was, in fact, entered with an inoperable TDAFP.
II.� EVENT DRIVEN INFORMATION
A. SAFETY SYSTEMS THAT RESPONDED
Not applicable for this event.
B. DURATION OF SAFETY SYSTEM INOPERABILITY
The TDAFP was inoperable at the time the Callaway plant entered MODE 3 at 1818 on November 4, 2008 and was declared OPERABLE at 1215 on November 6, 2008. The TDAFP was determined to be OPERABLE prior to the Callaway Plant's ascension into MODE 2 (Startup). The duration of inoperability was approximately 42 hours4.861111e-4 days <br />0.0117 hours <br />6.944444e-5 weeks <br />1.5981e-5 months <br />, which is within the 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> permitted by Required Action C.1 of TS LCO 3.7.5.
C. SAFETY CONSEQUENCES AND IMPLICATIONS OF THE EVENT.
The degraded condition of the TDAFP in conjunction with an assumed single failure or unavailability of a Motor-Driven Auxiliary Feedwater Pump (MDAFP) [El IS system: BA, component: P] would have the potential to adversely impact the mitigation capability or assumed plant response to any of several postulated events described in Section 15.2 of the Callaway Final Safety Analysis Report (FSAR).0 In particular, the Loss of Normal Feedwater (LONF), Loss of Non-Emergency AC Power (LOAC) and Feedline Break (FLB) events credit the automatic delivery of AFW within 135 seconds of event initiation, via two AFW pumps. However, it should be noted that actual plant conditions during the time of this event were significantly less limiting than the initial conditions assumed as a part of the Licensing Bases heatup analyses addressed in FSAR Section 15.2. This event occurred under "cold core" conditions.
Fuel Cycle 17 initial criticality had not yet occurred. Approximately half of the Fuel Cycle 16 fuel assemblies from the reactor core were in the spent fuel pool and had been replaced with assemblies that were not contributing decay heat to the primary coolant. Therefore, as described further below, this event was of very low safety significance.
The impact of an inoperable TDAFP on the capability to mitigate each of the applicable licensing-bases events/accidents, with consideration of actual plant conditions that existed at the time of the event, is summarized as follows.
LOSS OF NORMAL FEEDWATER AND LOSS OF NON-EMERGENCY AC POWER Should a postulated LONF/LOAC event occur with the TDAFP inoperable, a single failure could leave the plant reliant upon a single MDAFP to provide secondary side inventory and heat sink. The Analysis of Record (AOR) for LONF and LOAC demonstrates that the accidents have a duration of less than 1.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />. For core conditions that existed at the time of TDAFP inoperability, only approximately 7 percent of the End of Life (EOL) decay heat load existed. This would result in a loss of approximately 10 percent of the water inventory per steam generator if the water in the steam generator was already at saturation temperature. The AOR assumes that the plant is at power operation at the initiation of the event.
Therefore, it can be concluded that the degraded condition of the TDAFP did not represent an unanalyzed condition that significantly degraded plant safety for the LONF/LOAC sequences.
FEEDLINE BREAK
With regard to a postulated FLB, the AOR demonstrates that the accident has a duration of 1.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />.
For core conditions that existed at the time of TDAFP inoperability, only approximately 7 percent of the End of Life (EOL) decay heat load existed. This would result in a loss of approximately 10 percent of the water inventory per steam generator if the water in the steam generator was already at saturation temperature. Therefore, it can be concluded that the degraded condition of the TDAFP did not represent an unanalyzed condition that significantly degraded plant safety for the FLB sequences.
SMALL BREAK LOSS OF COOLANT ACCIDENT
The TDAFP is credited to provide secondary side heat sink inventory during small break loss-of-coolant accident (SBLOCA) sequences. The AOR assumes that the plant is at power for the start of the postulated SBLOCA. The AOR bounds the conditions of the plant at the time of this event because the core was subcritical for more than 24 days. Therefore, the degraded condition of the TDAFP did not represent an unanalyzed condition that significantly degraded plant safety for the SBLOCA sequences.
STATION BLACKOUT
The degraded condition of the TDAFP would impact the response to a station blackout (SBO) event.
However, since this event occurred following a subcritical core of more than 24 days and with nearly half of the core containing new fuel assemblies, the decay heat load was low. There was a more than 17 hour supply of water (until dry-out in the steam generators would occur in the event of an SBO) at the time of the degraded condition, which exceeds the 4-hour coping period required by FSAR Section 8.3A.
Thus, there was an adequate supply of water to the steam generators to maintain the integrity of the reactor coolant system and shutdown of the reactor.
RISK SIGNIFICANCE
With regard to risk significance, the degraded condition of the TDAFP, in conjunction with an assumed failure or unavailability of a MDAFP, would have had the potential to adversely impact the mitigation capability or assumed plant response to any of several postulated events. However, actual plant conditions during the time of this event were significantly less limiting than the initial conditions assumed as a part of the Licensing Bases. Therefore, as described above, this event was of very low safety significance.
III. CAUSE(S) OF THE EVENT AND CORRECTIVE ACTION(S)
This event was evaluated using a root cause analysis (RCA) process. A RCA team was assembled to review this event, determine the cause of the event, and develop corrective action to prevent recurrence. The RCA team identified three Causal Factors (CF) with one Root Cause (RC). One Corrective Action to Prevent Recurrence (CATPR) was identified, along with one Contributing Cause (CC). This issue has been entered into Callaway's corrective action program.
The first CF was that applicable procedural guidance does not contain adequate acceptance criteria for the recorded position feedback current data. In the procedure, the electrical position feedback current indication is recorded for information only, and therefore the procedure does not address any acceptance criteria for this parameter. Had this procedure contained acceptance criteria for this parameter, the low reading of 3.11 mADC that was recorded would have been identified as a deficient condition requiring evaluation and resolution. The RC for this CF is that the procedure did not meet the requirement of the Callaway Procedure Writing Manual for acceptance criteria. The CATPR will be to revise this procedure to add acceptance criteria for the readings recorded for the driver position currents. All other engineering testing and technical procedures will be reviewed for compliance with Callaway's Procedure Writing Manual to include acceptance criteria, pursuant to establishing the extent of cause.
The second CF identified was the replacement servo for the TDAFP was either defective or damaged. A Callaway procedure did successfully detect this failure prior to the entry into MODE 3, but the failure was not recognized at the time of performance due to a lack of acceptance criteria for the governor valve position feedback current indication. As noted previously, the procedure is being revised to include appropriate acceptance criteria.
The final CF was the unsubstantiated conclusion that the overspeed trip was due to condensate in the Auxiliary Steam supply. This conclusion was based on the fact that the turbine had been performing as expected during three starts prior to the noted trip. The turbine was being run uncoupled from the pump (requiring low energy to spin the turbine) and was being supplied with lower quality Auxiliary Steam.
Condensate in the steam has caused overspeed trips in the past. The conclusion to continue the test seemed logical based on this operating experience. As the turbine was going to be started three additional times to complete the testing, it was felt that successfully continuing the test would confirm the conclusion that the overspeed trip was due to condensate in the steam. The faulty servo was the most likely cause of the overspeed trip, and the trip constituted a missed opportunity to identify the faulty servo before it was returned to service. The CC was the overspeed trip was not thoroughly evaluated. A requirement will be added to the operating procedure to evaluate overspeed trips using a formal troubleshooting plan.
IV. PREVIOUS SIMILAR EVENTS
A search of the CARS identified the following related events:
November 2004: The position feedback signal recorded on a strip recorder was out of range (high).
Troubleshooting determined that the remote servo for the TDAFP governor flow valve had failed. The servo was replaced. The failure report determined that a feedback resistor in the voltage regulator circuit had failed. Also, during factory acceptance testing, a failure of the valve position sensor occurred. No corrective actions were deemed necessary due to the random nature of the failure.
May 2005: During a slow manual start of the TDAFP following a TDAFP LCO, the TDAFP speed could not be lowered sufficiently. Subsequent troubleshooting determined that the governor valve was not being fully closed by the control system due to the value of the minimum setting in a database. The governor valve was stroked and the data was used to input new minimum and maximum limits in the database. As a result, stroke data must be collected and input into the database anytime that maintenance is performed on the remote servo or governor valve.
V. ADDITIONAL INFORMATION
The remote servo that failed is manufactured by Woodward Governor Company, supplied by Engine Systems Inc. as model number 9903-539.
The system and component codes listed below are from the IEEE Standard 805-1984 and IEEE Standard 803A-1984 respectively.
System:� BA, Auxiliary / Emergency Feedwater System (PWR) Components: FCO, Control Operator, Flow FCV, Valve, Control, Flow P, Pump SC, Control, Speed TRB, Turbine XR, Recorder, Special ZI, Indicator, Zone (Position) System:� SA, Auxiliary Steam System