05000483/LER-2006-006
| Docket Number Sequential Revmonth Day Year Year Month Day Yearnumber No. | |
| Event date: | 08-05-2006 |
|---|---|
| Report date: | 09-22-2006 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 4832006006R00 - NRC Website | |
I. DESCRIPTION OF THE REPORTABLE EVENT
A. REPORTABLE EVENT CLASSIFICATION
50.73(a)(2)(i)B — Operation or Condition Prohibited by Technical Specifications.
50.73(a)(2)(v)C — Event or Condition that Could Have Prevented Fulfillment of a Safety Function:
Control the Release of Radioactive Material.
50.73(a)(2)(v)D — Event or Condition that Could Have Prevented Fulfillment of a Safety Function:
Mitigate the Consequences of an Accident.
B. PLANT OPERATING CONDITIONS PRIOR TO THE EVENT
Mode 1, 100% Reactor Power
C. STATUS OF STRUCTURES, SYSTEMS OR COMPONENTS THAT WERE INOPERABLE AT THE
START OF THE EVENT AND THAT CONTRIBUTED TO THE EVENT
No system, structures, or components were Inoperable at the start of this event which contributed to the event.
D. NARRATIVE SUMMARY OF THE EVENT, INCLUDING DATES AND APPROXIMATE TIMES
On 08/05/2006 the Callaway Operations shift crew was performing an Auxiliary Building Train B Negative Pressure Test on the Train B Emergency Exhaust System, as required by Technical Specification surveillance requirements 3.7.13.4 and 3.7.13.5, when Auxiliary Building Supply Damper, GLD0047, failed to close as expected. At 10:20 on 08/05/2006, the Train B Emergency Exhaust System was declared inoperable due to damper GLD0047 failing to close during testing.
Additionally, the Auxiliary Building Exhaust Plenum/Unit Vent Particulate /Iodine Detector was also declared inoperable due to the inoperability of the Train B Emergency Exhaust System being inoperable. The Control Room Supervisor directed the Operations shift crew to close the Train A Auxiliary Building Supply Damper, GLD0046, and remove the power fuses to GLD0046 to isolate the Auxiliary Building air supply. These actions were completed at 10:39. A corrective action request was initiated to document the GLD0047 damper failure.
A job was initiated for a Maintenance crew to inspect the damper and damper motor and perform necessary repairs. Upon inspection of the damper and damper motor, it was determined the damper motor was not receiving power and a failure of the pushbutton hand indicating switch on the Main Control Board was suspected. Another job was initiated to replace the suspect handswitch. As the Electrical Maintenance crew prepared to remove the handswitch, the Supervisor noticed, from the back side of the control panel, the contact block plunger was protruding from the end of the contact block of the handswitch assembly. This indicated the relay contacts within the handswitch assembly were not aligned in their normal configuration. When the Electrical Maintenance crew replaced the handswitch, they exercised the old handswitch several times and found the handswitch plunger did not operate as smoothly as it should.
(Continued) After the handswitch was replaced, the Operations crew satisfactorily performed a stroke time test on the damper to ensure functionality of the newly installed handswitch and operability of the Train B Emergency Exhaust System. Technical Specification action 3.7.13.A was exited and the Train B Emergency Exhaust System was declared operable at 22:30 on 08-05-2006.
The System Engineer reviewed the handswitch contact design and confirmed the handswitch, in the configuration observed by the Electrical Supervisor, would have prevented the actuation of damper GLD0047, if a Safety Injection Signal would have occurred. With the contact block plunger stuck in the position found, the normally closed contacts of the handswitch were stuck in the open position, which would not allow current to pass from the handswitch to the damper actuator if a Safety Injection Signal would have occurred.
E. METHOD OF DISCOVERY OF EACH COMPONENT, SYSTEM FAILURE, OR PROCEDURAL ERROR
The Callaway Operations crew was performing an Auxiliary Building Train B Negative Pressure test on the Train B Emergency Exhaust System, as required by Technical Specifications, when Auxiliary Building Supply Damper, GLD0047, failed to close as expected. Upon inspection of the damper and damper motor, it was determined the damper motor was not receiving power and a failure of the pushbutton hand indicating switch on the Main Control Board was suspected. A job was initiated to replace the handswitch. As the Electrical Maintenance crew prepared to remove the handswitch, the Supervisor noticed, from the back side of the control panel, the contact block plunger was protruding from the end of the contact block of the handswitch assembly. This indicated the relay contacts within the handswitch assembly were not aligned in their normal configuration.
II. EVENT DRIVEN INFORMATION
A. SAFETY SYSTEMS THAT RESPONDED
No automatic actuations occurred in response to the failure of the handswitch in this event and no safety systems responded.
B. DURATION OF SAFETY SYSTEM INOPERABILITY
The date of discovery for this event is 08/05/2006, when the Operations shift crew found the Auxiliary Building Supply Damper, GLD0047, failed to close during surveillance testing of the Train B Emergency Exhaust System. However, after reviewing the configuration of the handswitch and associated circuitry, there was no conclusive evidence that the damper failed at the time of discovery.
Therefore, the System Engineer reviewed documentation, including past Technical Specification surveillances, to determine the last known successful operation of the handswitch circuitry for a simulated safety injection signal to damper GLD0047. It was determined the damper was last operated successfully on 07-09-2006 during the performance of a surveillance procedure, which tested the slave relay and circuitry associated with the handswitch and damper. During the performance of this test procedure, a simulated safety injection signal through the handswitch automatically closed damper GLD0047.
(Continued) While performing the restoration section of the test procedure, the handswitch was used to open damper GLD0047 when restoring the 'B' train Emergency Exhaust System. The handswitch failure could have occurred at this time. To conservatively establish the period of time the Train B Emergency Exhaust System was inoperable, the start time for the performance of the slave relay surveillance procedure of 09:55 on 07-09-2006 is used. The end of the period of inoperability was when the damper was declared operable on 08-05-2006 at 22:30, after the handswitch was replaced and the damper was tested successfully for operability. Therefore, the inoperability of the Train B Emergency Exhaust System was from 09:55 on 07-09-2006 to 22:30 on 08-05-2006. The duration of the inoperability was 27 days, 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, and 35 minutes. Because it was not recognized that the Train B Emergency Exhaust System was inoperable during this period of time, entry into applicable Technical Specification actions for the following conditions was not performed until 10:20 on 08-05-2006:
3.7.13.A One Emergency Exhaust System train inoperable in MODES 1, 2, 3, or 4.
Restore Emergency Exhaust System train to OPERABLE status within 7 days.
3.7.13.0 Required Action and associated Completion Time of Condition A or B not met in MODE 1, 2, 3, or 4.
Be in MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Be in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
A review of Control Room Logs was performed to determine the operability of the Train A Emergency Exhaust System from 07-09-2006 09:55 through 08-05-2006 22:30. The Train A Emergency Exhaust System was found to be inoperable during the following time periods:
07/14/06 15:10 — 07/14/06 15:16 Train A Essential Service Water inoperable due to work on EFHVO043 07/20/06 09:11 — 07/20/06 09:24 Train A Load Shed Emergency Load Sequencing inoperable due to surveillance testing.
07/24/06 10:25 — 07/25/06 01:44 Train A Emergency Exhaust inoperable due to repair of hot connection.
07/25/06 09:14 — 07/25/06 09:35 Train A Emergency Exhaust inoperable due to surveillance testing.
07/27/06 01:47 — 07/27/06 02:10 Train A Essential Service Water inoperable due to surveillance testing.
Because both trains of the Emergency Exhaust System were inoperable during these time periods, entry into applicable Technical Specification action for the following condition was also missed:
3.7.13.B Two Emergency Exhaust System trains inoperable in MODES 1, 2, 3, or 4.
Restore Auxiliary Building boundary to OPERABLE status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
(Continued) C. SAFETY CONSEQUENCES AND IMPLICATIONS OF THE EVENT.
This event did not have a significant impact on nuclear safety. The Emergency Exhaust System and the Auxiliary Building pressure boundary have safety functions for mitigating the release of radioactivity during the recirculation of sump fluids following a large break LOCA with core damage, but have no function to prevent core damage. Therefore, this event has no impact on core damage frequency.
The integrity of the Auxiliary Building pressure boundary is taken into consideration as a part of the LOCA consequences analyses. During the recirculation phase of the LOCA sequence, it is assumed that ECCS components in the Auxiliary Building will leak. Ten percent of this leaked sump fluid flashes to steam. This provides a release mechanism for the iodines contained within the sump fluids. The Emergency Exhaust System is credited to mitigate this release pathway. The safety grade filters in the Emergency Exhaust System are credited for removal of iodines.
Callaway surveillance procedures maintain a running total of ECCS component leakage. The acceptance criterion is that the sum of leakage from all components must not exceed one gallon per minute (gpm). Per the Standard Review Plan, the analysis assumes that leakage into the Auxiliary Building is twice the surveillance acceptance criteria (two gpm).
During the period of time the Auxiliary Building pressure boundary was degraded, the sum of ECCS leakage was less than 10 drops per minute. This is substantially below the one gpm value used as an acceptance criterion. Leakage of ECCS components into the Auxiliary Building was low enough to offset any of loss of credited filter removal capability due to the assumed degradation of the Auxiliary Building Pressure boundary.
With regard to probabilistic safety, this event has no impact on the Callaway core damage or large early release frequencies.
In summary, this issue is not safety-significant based on the following:
- system redundancy,
- the short duration of the time intervals during which both trains were inoperable,
- the Maintenance Rule Safety Significance categorization.
III. CAUSE(S) OF THE EVENT AND CORRECTIVE ACTION(S)
To evaluate the handswitch failure, the System Engineer inspected the defective handswitch assembly.
The handswitch was a model type E30 pushbutton position indication switch manufactured by Cutler- Hammer. As received from the Electrical Maintenance department, the handswitch could not be made to stick in a position other than its normal state, so the exact cause was not readily apparent. The System Engineer dismantled the handswitch assembly and found curled metal shavings and other debris inside the upper contact block. Metallurgical analysis determined the metal shavings were made of metal alloys different than the metal alloys used in the handswitch contacts.
(Continued) A root cause analysis team was formed to evaluate the data applicable to the handswitch failure and determine the root cause of the event and corrective actions to prevent recurrence. This team determined the root cause of the handswitch failure was the introduction of foreign material into the contact block of the handswitch assembly, which resulted from a modification to the main control board during initial plant construction in 1982. This modification included the drilling and tapping of three holes above the handswitch. The mechanical motion of the contact block plunger allowed transport of one or more of these particles of foreign material into a position where the plunger became wedged. A contributing cause to this event was the loose tolerances in the design and manufacture of the vintage contact blocks.
In evaluating the extent of condition of this event, the team identified ten other Cutler-Hammer E30 handswitches in the area of the modification, which may have been subjected to the same foreign material concerns. The corrective action to prevent recurrence includes the replacement of the ten handswitches identified. The team recognized the procedural controls regarding foreign material had changed significantly since the initial construction of Callaway Plant. The current Foreign Material Exclusion procedure was reviewed and was determined to be sufficient to prevent this type of event from recurring.
The Cause code of X on page 1 of this LER was selected due to the root cause of this event being identified as foreign material within the handswitch.
IV.� PREVIOUS SIMILAR EVENTS Operating experience and corrective action documents, pertaining to Callaway Plant, were reviewed and no previous similar events were found identifying foreign material as a cause or contributor to a handswitch failure.A search of external operating experience was made using the INPO Operating Experience database. Seventy-three documents were returned in the OE search, out of which sixteen similar events were identified. The following results are a brief description of the most relevant cases of operating experience citing foreign material.
INPO Operating Experience database entry dated July 15, 2004, Failure Number 260 described an event at McGuire Unit 1, in which a handswitch was stuck in the open position. The failed handswitch became evident to the operating crew during slave relay testing, when a phase B Containment Isolation signal was generated. Instead of all the phase B isolation valves closing as expected, the Operators observed one valve closing and then immediately reopening several times, until the phase B Containment Isolation signal was reset. Examination of the suspect handswitch revealed the contact block plunger was stuck open due to a piece of phenolic material lodged in the pathway of the handswitch plunger.
INPO Operating Experience database entry entitled, Control Switches Health Report, identifies failure modes associated with Cutler-Hammer switches, including pushbutton operator plungers and contact block plungers sticking due to lubricant thickening, affects of wear debris and atmospheric dust, and the possibility of contact blocks becoming displaced or damaged and interfering with the contact block plunger movement.
(Continued) While these examples cited component wear, debris, and dust within the contact block assembly, no examples were found which described evidence of metal shavings and metal debris as found in the handswitch assembly at Callaway described in this LER.
V. ADDITIONAL INFORMATION
The system and component codes listed below are from the IEEE Standard 805-1984 and IEEE Standard 803A-1984 respectively.
System:� VF Component: HIS The manufacturer of the original and replacement hand indicating switch is Cutler-Hammer, Inc., which is now a division of Eaton Corp. The model type of the handswitch was E30.
Manufacturer's Code:� C770