05000483/LER-2009-005
| Docket Numbersequential Revmonth Day Year Year Month Day Yearnumber No. | |
| Event date: | 12-8-2009 |
|---|---|
| Report date: | 9-29-2010 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident |
| 4832009005R01 - NRC Website | |
1. DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):
Atmospheric Steam Dump Valve Design and Operation:
Callaway Plant has four Atmospheric Steam Dump valves (ASDs) (EIIS: RV). There is one ASD in each main steam (EIIS: SB) line outside of containment and upstream of the main steam safety valves and main steam isolation valve. Thus, there is one ASD for each steam generator at Callaway. The ASDs, ABPV0001/2/3/4, are used to remove heat from the Reactor Coolant System (RCS) when the plant is being started up or shut down with the main condenser not available. The ASDs are air-to-open, spring-to-close, fail-shut valves with a nominal relief set point of 1125 psig steam line pressure. Surveillance acceptance criteria stipulate that the ASDs must be capable of opening fully within 20 seconds.
The relief set point for each ASD is controlled via a controller (ABPIC0001A/2A/3A/4A) (EIIS:
PIC) on the Main Control Board (MCB) (HIS: MCBD) in the control room. The valves can also be controlled from the Auxiliary Shutdown Panel (ASP). The valves are capable of manual control from the MCB or the ASP by selecting manual on the manual/auto (M/A) control station (EIIS: HC) and increasing or decreasing the air pressure from the current-to-pressure (I/P) transducer (EIIS:
CNV) to the valve positioner (Bailey ABB AP2) (EIIS: CPOS).
A pressurized nitrogen accumulator is provided for each valve as a backup to the air system. The accumulators allow valve operation on a loss of normal air supply.
2. INITIAL PLANT CONDITIONS:
On December 8, 2009 the plant was in Mode 1 at approximately 100 percent power. Apart from the inoperability of two ASDs as described below, there were no other structures, systems, or components known to be inoperable at the time of the event that contributed to the event.
3. EVENT DESCRIPTION:
At 0408 on December 8, 2009, atmospheric steam dump (ASD) valve ABPV0003 was taken out of service for maintenance. The maintenance task was to calibrate the instrumentation loop associated with pressure transmitter ABPT0003 and associated pressure-indicating controller (PIC) (ABPIC0003A) for the ASD.
Several problems were encountered during the calibration, including the following: the pressure transmitter and PIC were found to be out of calibration, the valve did not stroke fully open during a post-maintenance test, the M/A handstation would not control the valve in manual, the PIC case was found to be cracked, and the valve had dual indication when it was stroked. The M/A station and controller case were promptly replaced. Post-maintenance testing was completed satisfactorily and the ASD was declared operable at 0132 on December 11, 2009.
Stroke tests were performed on the other three ASDs to determine extent of condition. No problems were encountered with ABPV0001 and ABPV0004. However, ABPV0002 only stroked open to 81% of its full-open position. This did not meet the full-open acceptance criterion specified by plant procedures. The valve was thus declared inoperable at 0137 on December 11, 2009.
Troubleshooting performed on valve ABPV0002 revealed the current-to-pressure (UP) transducer output to be erratic and actuator leakage to be in excess of the allowable rate. The UP transducer and a diaphragm were replaced, and post maintenance tests were performed. The valve was declared operable at 0442 on December 13, 2009.
A corrective action document was initiated for each of these ASD failures, and in accordance with the corrective action program, a "Past Operability" determination was completed for each valve. In particular, the failure of ABPV0002 was determined to have been inoperable for an extended period of time due to vibration—induced degradation. It was thus concluded that ABPV0002 was inoperable when ABPV0003 was removed from service on December 8, 2009 (as determined after the fact) such that both ASDs were concurrently inoperable for the period of time that ABPV0003 was inoperable.
4.� ASSESSMENT OF SAFETY CONSEQUENCES:
The Atmospheric Steam Dump valves (ASDs) have a safety function to manually open and close from the MCB and are tested in accordance with Technical Specification (TS) 3.7.4, "Atmospheric Steam Dump Valves (ASDs)." The safety function of the ASD to open provides a method to cool down the unit to residual heat removal (RHR) conditions when the preferred heat sink via the Condenser Steam Dump Valves is not available. Additionally, a minimum number of ASDs must open to provide a method, during a Steam Generator Tube Rupture (SGTR), to perform a rapid RCS cooldown before RCS depressurization. The safety function of the ASDs to close was not affected by the event described in this LER.
Cooldown to RHR Conditions The cooldown to RHR entry conditions is credited in the accident analysis to ensure RHR entry conditions are achieved within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The steam mass flowrate required to reach RHR conditions within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> is an important variable in the accident analysis. Depending on the accident scenario, the 8-hour integrated steam release values range from 1,396,000 lbm to 1,790,000 lbm. From FSAR Table 10.3-2, the nominal flow capacity for each ASD is 594,642 lb/hr. One fully qualified ASD would have an 8-hour capacity of 4,757,136 lbm, which bounds the values credited in the accident analysis.
Conclusion Since ABPV0001 and ABPV0004 each stroked satisfactorily on 12/13/09, the safety function to cool the unit to RHR entry conditions was met during the time frame of the degraded condition.
Steam Generator Tube Rupture (SGTR) Rapid Cooldown SGTR consequences are driven by primary-to-secondary break flow via the ruptured tube that is postulated to exist within one steam generator. The ASDs are credited to perform a rapid cooldown of the RCS. SGTR mitigation strategy requires that the primary-to-secondary breakflow be terminated by equalizing the pressure of the primary and secondary sides of the ruptured steam generator.P Prior to pressure equalization, the primary side must be cooled so that subcooling is maintained in the primary side.
Two cases for the SGTR are described and analyzed in the Callaway FSAR. One involves the postulated failure of an ASD in the open position leading to continued release of steam generator fluid and contained radioactivity. The other involves a postulated failure of the ruptured steam generator Auxiliary Feedwater (AFW) flow control valve resulting in water relief through an ASD and/or main steam safety valve.
In either case, the current analysis of effects and consequences as described in the FSAR involves the assumption that all three ASDs associated with the intact (non-ruptured) steam generators are available for controlled cooldown of the RCS. (The ASD associated with the ruptured steam generator is assumed to be unavailable for the RCS cooldown function.) With respect to what is described in the FSAR, the availability of three ASDs is either implied via the steam generator flow rates identified in the figures and tables presenting the assumptions and analysis results for the SGTR scenario involving a stuck open ASD, or is explicitly stated in the analysis description given in FSAR section 15.6.3.2.2 for the SGTR scenario involving an AFW flow control valve failure.
In light of the concurrent inoperability of ABPV0002 and ABPV0003 for the period of time from 0408 on December 8, 2009 to 0132 on December 11, 2009, sufficient ASD availability did not exist to support the ASD function/availability described in the FSAR for SGTR mitigation. This is the basis for reporting the event/condition as one that could have prevented fulfillment of a safety function.
This event/condition would not, however, preclude satisfactory mitigation of an SG IR event. As described previously, ASD ABPV0002 was found to stroke open to 81% of its fully open position.
During the time when the degraded condition of ABPV0002 overlapped the time that ABPV0003 was removed from service, one ASD (ABPV0003) was completely unavailable, one ASD (ABPV0002) was inoperable but available to perform its function at 81% of its capacity, and two ASDs (ABPV0001 and ABPV0004) were fully operable such that each was capable of functioning at 100% of its capacity. With this limited but available ASD capacity, a sensitivity study was performed to determine whether sufficient ASD capacity remained for satisfactory mitigation of an SGTR event, assuming the occurrence of an SGTR during the noted conditions.
For the sensitivity study, one of the fully functional ASDs was assumed to be the ASD associated with the faulted steam generator and thus considered to be unavailable. This left one fully functional ASD and the degraded ASD (ABPV0002) available for performing the ASD cooldown function assumed in the SGTR analysis, for a combined equivalent capacity of 1.81 ASDs. (The ASDs each exhibit a linear flow-to-position relationship.) With one fully qualified ASD available and one ASD at 81% capacity, the sensitivity study confirmed that while the rapid cooldown required for SGTR mitigation would be extended due to the reduced ASD capacity, the calculated dose consequences would still be within the SGTR dose values reported in the FSAR, due to margins contained within the safety analyses.
It should be noted that the calculated dose values presented in the FSAR for an SGTR were determined using the highest equilibrium value of dose-equivalent Iodine-131 (DEI) allowed by the Technical Specifications, i.e., 1 microCurie/gram, in the reactor coolant. Since SGTR thyroid dose consequences are directly proportional to the assumed initial DEI level, and the highest steady-state DEI value encountered at Callaway during Fuel Cycle 17 was 0.045 microCuries/gram, the SGTR thyroid dose consequences calculated per the sensitivity study could be reduced by more than a factor of 20 to achieve a much lower value representative of actual plant conditions during the period of reduced ASD capacity.
Conclusion Although the ASD inoperability described in this LER constituted a condition that must be reported as one that could have prevented fulfillment of a safety function based on the required ASD capacity/availability described in the FSAR for SGTR mitigation, the condition was not safety significant. This conclusion is based on consideration of actual plant conditions (i.e., actual RCS DEI levels) and the results of the sensitivity study which showed that the impact on SGTR dose consequences would be minimal.
This event was also evaluated with the Callaway PRA model. The evaluation determined that the conditional core damage probability (CCDP) of the event was less than 1E-6; therefore, this event was of very low risk significance. Use of the PRA model to evaluate the event provides for a comprehensive, quantitative assessment of the potential safety consequences and implications of the event, including the consideration of alternative conditions beyond those analyzed in the FSAR.
5.� REPORTING REQUIREMENTS:
This LER is submitted to report a condition prohibited by the Technical Specifications, pursuant to 10 CFR 50.73(a)(2)(i)(B), as well as a condition that could have prevented the fulfillment of the safety function of a system needed to remove residual heat and mitigate the consequences of an accident, pursuant to 10 CFR 50.73(a)(2)(v)(B) and 10 CFR 50.73(a)(2)(v)(D) respectively.
On December 9, 2009, ASD ABPV0003 was determined to be inoperable, as previously described.
Corrective maintenance was performed to restore the ASD to operable status. Since it could not be determined specifically when the inoperability occurred, and there was no firm evidence that the failure was caused by maintenance performed on the valve, per NUREG 1022, the time of failure is taken as the time of discovery.
On December 11, 2009, ASD ABPV0002 did not stroke full open as required by plant procedures.
This constituted an as-found condition of inoperability for the valve. A cause team determined that the UP transducer for the valve was subject to vibration and that vibration was the cause of the UP transducer failure. Although it could not be determined specifically when this failure occurred, it is presumed that the condition existed for a period longer than allowed by TS 3.7.4 (i.e., longer than the Required Action Completion Time specified in the TS for restoring an inoperable ASD to operable status).
Per TS 3.7.4, the Completion Time for restoring ASD operability is 7 days for one inoperable ASD, and 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for two inoperable ASDs. The period of inoperability for valve ABPV0002 overlapped that of valve ABPV0003. Although the combined period of ASD inoperability did not exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, it was concluded that the inoperability of ASD ABPV0002 alone exceeded the timeframe permitted by the TS for restoring an ASD to operable status, thus constituting a violation of the Technical Specifications.
Although, as noted above, the period of time when ABPV0002 and ABPV0003 were both inoperable did not exceed the TS Completion Time for two ASDs inoperable, this combined inoperability (i.e., with one ASD removed from service for maintenance and another ASD inoperable but unknown to be so) constituted a condition that could have prevented fulfillment of the safety function of a system needed to remove residual heat and mitigate the consequences of an accident. This is based on the FSAR-described requirement/assumption for having three ASDs available for SGTR mitigation and the fact that the ASD function of effecting rapid cooldown of the RCS during an SGTR is a function involving the removal of residual heat and which serves to limit the consequences of an SGTR.
6.� CAUSE OF THE EVENT:
ABPV0003 The required post-maintenance testing resulting from calibration of pressure transmitter ABPT0003 and controller ABPIC0003 was to stroke valve ABPV0003. During the post-maintenance valve stroke testing on December 9, 2009, the manual/auto (M/A) station on the Main Control Board (MCB) operated ABPV0003 in automatic; however, it did not operate the valve in manual. The identification of the loss of manual actuation rendered the valve inoperable. Technicians were not able to determine the exact cause of the M/A station failure; however, post-event testing indicated that the manual circuit was failed.
The MCB M/A station for ABPIC0003A was replaced on 12/9/2009. While replacing the M/A station, a crack was observed in the ABPIC0003A controller case. The controller was also replaced.
Subsequently ABPV0003 was stroked in both auto and manual from the MCB. However, dual indication was seen for the valve position when the valve was stroked open. It was determined that this was not related to the M/A station and controller replacement.
On 12/10/09, technicians verified and set limits on ABPV0003 to address the dual indication condition. This action did not correct the dual indication condition. Additional troubleshooting was performed. Stroke testing indicated sufficient full stroke actuation pressure was not being developed. Additional troubleshooting included blowing out the positioner diaphragm pressure gauge port. After completion of blowing out the positioner diaphragm pressure gauge port, ABPV0003 stroked (while isolated) consistently (5 — 6 times) and within the procedurally allotted time. The stroke test of valve ABPV0003 at system pressure and temperature was performed satisfactorily on 12/11/09 and the valve was declared Operable.
ABPV0002 Troubleshooting performed on valve ABPV0002 found the UP transducer output erratic and actuator leakage in excess of the allowable rate. The amount of leakage found would not affect successful operation of ABPV0002. The erratic UP transducer output was the direct cause for ABPV0002 failing to stroke per the requirements of plant procedures.
A cause team determined that original installation configuration rendered the UP transducer susceptible to vibration problems. Vibration at the valve has occurred for several years. Since the vibration experienced at the valve was the cause of the UP transducer failure, it is likely that valve ABPV0002 was not able to fully stroke open before it was stroke tested on December 11, 2009.
While it could not be determined when failure occurred, it is likely that the condition existed for a period longer than permitted by the TS.
The cause team also determined that the chosen preventive maintenance strategy was not effective in ensuring equipment reliability in the environment that the equipment exists.
7.� CORRECTIVE ACTIONS:
ABPV0003 The M/A station and the controller case were replaced.
A time-based replacement strategy has been developed and implemented for critical Foxboro M/A stations. Additionally, Bailey ABB AP2 positioners are to be replaced with ABB AV1 positioners during Cycle 18.
ABPV0002 The FP transducer and a diaphragm were replaced. A plant modification will be implemented to move the PP transducer to an area of lower vibration. A new set of preventative maintenance tasks has been created to perform mid-cycle diagnostic testing on the ASDs.
8.� PREVIOUS SIMILAR EVENTS:
Callaway has submitted eight LERs within the past three years which were reported as a condition prohibited by the TS. None of them were related to the ASD valves.
Callaway has had several plant work documents and some corrective action documents for replacing I/P transducers and valve positioners for the ASDs.
Additional Component Failure Information:
Cause: 0�System: SB�Component: CPOS Manufacturer: 8040