05000483/LER-2008-001

LER-2008-001, Containment Cooler Inoperability

Docket Number
Event date:	03-26-2008
Report date:	09-29-2009
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability
4832008001R01 - NRC Website

I.� DESCRIPTION OF THE REPORTABLE EVENT

A. REPORTABLE EVENT CLASSIFICATION

10CFR50.73(a)(2)(i)(B) — Operation or Condition Prohibited by Technical Specifications 10CFR50.73(a)(2)(v)(D) — Event or Condition That Could Have Prevented Fulfillment of a Safety Function Needed to Mitigate the Consequences of an Accident 10CFR50.73(a)(2)(vii) — Common Cause Inoperability of Independent Trains or Channels

B. PLANT OPERATING CONDITIONS PRIOR TO THE EVENT

Plant was in MODE 1 at 100% power at the time the condition was discovered.

START OF THE EVENT AND THAT CONTRIBUTED TO THE EVENT

One containment purge exhaust monitor was inoperable at the onset of the event. This inoperability precluded use of the containment purge system, which was a contributing condition for the event, as further discussed in Section IV of this LER.

D. NARRATIVE SUMMARY OF THE EVENT, INCLUDING DATES AND APPROXIMATE TIMES

Per Callaway Technical Specification (T/S) 3.6.6, "Containment Spray and Cooling Systems," two containment cooling trains and two containment spray trains are required to be operable in Modes 1, 2, 3, and 4. One of the primary functions of these systems is to remove sufficient heat energy and subsequent decay heat from the containment atmosphere following a loss-of-coolant accident (LOCA) or main steam line break (MSLB) to maintain the containment pressure below design values. The trains are completely redundant, and for each cooling train two coolers are provided and required. One train consists of the "A" and "C" coolers; the other cooling train consists of the "B" and "D" coolers. A cooler consists primarily of a cooling coil, damper, and fan. The fans can be run in fast speed or slow speed during plant operation to maintain containment pressure and temperature within required operating limits.� However, upon receipt of an actuation signal (in the event of an accident) the fans are designed to automatically start or restart in slow speed for their accident mitigation function.

Another relevant feature of the containment coolers is that the fan motors are equipped with thermal overload protection to prevent motor damage from a mechanical overload. Separate overload devices are provided for slow- and fast-speed operation. Subsequent to a thermal overload protective trip, operator action is required to reset the trip before the cooler can be restarted.

At 0709 on March 26, 2008, containment pressure was elevated but within the allowable range as containment purge was not available to reduce containment pressure. Control Room operators shifted all four containment cooler fans to fast speed in order to reduce containment pressure. A high vibration alarm, computer point GNY0007, was subsequently received on the "A" containment cooler (SGNO1A), and it was decided to shift the fan to slow speed. At 0736, the fan was stopped per procedure OTN- GN-00001, "Containment Cooling and CRDM Cooling," in preparation for re-starting it in slow speed.

When the fan was stopped, an Engineered Safety Function Actuation Signal (ESFAS) status panel alarm was received for loss of control power to SGNO1A. Loss of indication also occured on the fan handswitch.

The loss of control power to SGNO1A occurred due to the fast-speed thermal overload contact opening.

The contact opened due to relatively high motor loading coincident with a fan speed change. The increased motor loading was due to the increased density of the air being moved through the fan. At the time of the cooler trip, containment pressure was relatively high coincident with relatively low cooling water temperature. High containment pressure and/or low cooling water temperature act to cool or compress the air entering the fan, thereby increasing the air density and therefore the mass flow rate through the fan. This condition increased the load on the fan which resulted in increased current through the fan motor and its fast-speed thermal overloads. At the time of the event on March 26, 2008, the current was high enough that it caused the fast-speed thermal overloads to operate near their minimum trip curves. When the "A" containment cooler fan was switched from fast-speed to stop, the vibration of the fast-speed starter coil denergizing produced sufficient vibration to cause the fast-speed thermal overload contact to open. For the design that was in effect at the time of the event, the fast-speed thermal overload contact was in series with the slow-speed thermal overload contact. Thus, with the fast-speed overload contact open, a slow-speed restart would be precluded.

T/S Surveillance Requirement (SR) 3.6.6.7 requires verifying that each containment cooling train starts automatically and [that the] minimum cooling water flow rate is established on an actual or simulated actuation signal." Further, the Bases for SR 3.6.6.7 state, "This SR requires verification that each containment cooling train actuates upon receipt of an actual or simulated safety injection signal. Upon actuation the fans start in slow speed or, if operating, shift to slow speed and the cooling flow rate increases to a value that enables each train of Containment Coolers to remove the heat load credited in the current Licensing Bases Containment Analysis.

As noted above, following the trip of SGNO1A, its associated fast-speed thermal overload contact remained open. Had a safety injection signal (SIS) been received, the fan would not have been capable of a slow speed restart. Thus, SGNO1A could not have performed its specified safety function as required per T/S 3.6.6 and verified per SR 3.6.6.7. The Control Room immediately entered Condition C of T/S 3.6.6 for loss of one containment cooler train. (Required Action C.1 for this Condition requires restoring an inoperable cooling train within seven days; otherwise, a plant shutdown is required.) A plant work document was written to investigate the fan trip and recover the fan. In addition, a Prompt Operability Determination (POD) was performed and a compensatory action was put in place to allow only running the containment cooler fans in slow speed until a design change could be effected. A plant modification was subsequently designed, planned, and implemented to restore slow-speed fan operation capability following a fast-speed fan trip, thus restoring the ability of the containment coolers to respond to an actuation signal and be re-started in slow speed.

With regard to the trip of the "A" cooler, it was clear at the time of the event that the cooler was inoperable with the thermal overload trip condition in effect, as described above. After further investigation and analysis, it became clear that with a containment cooler in fast-speed operation, i.e.

even with no overload trip initially in effect, there is the potential for the cooler to immediately trip upon receipt of an SIS at the onset of the accident because the resultant downshift in speed could trigger the thermal overload protection for the fan. Furthermore, if the accident resulted in a slow pressurization of containment, the fan would run in a high-load condition and could trip prior to receipt of an SIS. This would make the fan incapable of performing the function required per T/S 3.6.6 and incapable of meeting SR 3.6.6.7.

As further described in Section II.B of this LER, "Duration of Safety System Inoperability," a review of plant operating data over the last three years was performed to determine when the containment coolers were susceptible to tripping to the extent that they had to be considered inoperable. This review identified that there were multiple times when the "A" and "D" coolers were inoperable based on loading conditions for high-speed operation. This condition, if known at the time, would have required entry into the applicable Condition(s) and Required Action(s) under T/S 3.6.6, which permit only limited periods of time for restoring an inoperable cooler(s) before otherwise requiring the plant to be brought to a shutdown condition. (Required Action E.1 for two inoperable containment cooling trains requires being in Mode 3 within six hours. Required Action E.2 requires being in Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.) Since the condition causing inoperability was unknown but present at the identified times, the requirements of the Technical Specifications were not met (i.e., the allowed outage times were exceeded). The condition therefore resulted in a condition or operation prohibited by the Technical Specifications and is reported pursuant to 10 CFR 50.73(a)(2)(i)(B).

Although sensitivity analysis was able to show that peak accident containment pressure would not be exceeded for applicable accident scenarios assuming only a single containment cooler available, the safety analysis of record assumes either containment cooling train to be capable of removing 141.4 x 101'6 Btu/hour. This cooling capability requires both coolers to be available in an operable train, as one train may be assumed to be unavailable due to single failure considerations. Due to the identified impact of the condition on both containment cooling trains, the condition is considered to be one that could have prevented fulfillment of a safety function needed to mitigate the consequences of an accident, and is therefore reported pursuant to 10 CFR 50.73(a)(2)(v)(D).

In addition, it is also concluded that the subject condition was a common-cause condition that rendered independent trains inoperable. That is, since the condition caused the "A" and "D" coolers to be concurrently inoperable at times during the three-year period of review, and because the containment cooling trains are needed to control the release of radioactive material, remove residual heat, and/or mitigate the consequences of an accident, the condition is also reported pursuant to 10 CFR 50.73(a)(2)(vii).

E. METHOD OF DISCOVERY OF EACH COMPONENT, SYSTEM FAILURE, OR PROCEDURAL ERROR

As previously described, the trip of the "A" containment cooler on March 26, 2008 was a spurious occurrence revealed to the control room operators via an alarm and indication in the control room. The downshift in speed that immediately preceded the trip indication led to identification of the fact the thermal overload trip was likely caused by the vibration or shock from deenergization of the starter coil with the fan already operating near its thermal overload setpoint(s), i.e., in a high-load condition due to existing containment and cooling water conditions. Recognition of that condition then led to the question of whether any of the fans would trip in response to an SIS (or even prior to receipt of an SIS) if received while the fan is operating at fast speed under high-load conditions at the onset of an accident. The sensitivity study performed to address this concern is described in Section II.0 wherein the low-safety significance of this concern is discussed.

II.0 EVENT DRIVEN INFORMATION

A. SAFETY SYSTEMS THAT RESPONDED

Not Applicable for this report.

B. DURATION OF SAFETY SYSTEM INOPERABILITY

Subsequent to the thermal overload trip of "A" Cooler on March 26, 2008, a review of plant data was performed to identify those periods of time — over a three-year period — when any one (or more) of the coolers was in high-speed operation (during Modes 1, 2, 3, or 4) concurrent with containment and cooling water conditions conducive to high-loading and thus tripping of the fans. Based on plant experience, the most likely times for meeting such conditions were the spring and fall when cooling water temperatures are typically low and containment pressures may be relatively high.

The review confirmed that there were multiple times during the spring and/or fall of each year (2005 through 2008) in which the "A" and "D" coolers would likely have tripped upon receipt of an actuation signal. (Review of operating data for the cooler fans showed that the "A" and "D" coolers are consistently subject to slightly higher loading than the "B" and "C" coolers during routine plant operation, and correspondingly have slightly higher running currents than the "B" and "C" coolers. The higher margin to the thermal overload setpoint for the "B" and "C" coolers makes them less susceptible to inadvertent thermal overload trips such that there was little potential for them to trip during the conditions that existed throughout the three-year period.) C. SAFETY CONSEQUENCES AND IMPLICATIONS OF THE EVENT.

Upon further investigation and evaluation following the trip of the "A" containment cooler, Engineering identified that with the containment cooling fans initially in fast-speed operation, together with certain initial plant conditions, thermal overload tripping of the coolers could occur after the onset of an accident and prior to the receipt of the SIS. This could render the affected coolers unavailable during a significant phase of the accident, since slow-speed restart would be precluded. It was recognized that this would be a particular concern for containment pressurization events such as a small-break LOCA or split-break MSLB when the containment is pressurized at a relatively slow or moderate rate thus allowing the containment cooling fans to be subject to higher loading for a long enough time that the thermal overloads would trip prior to coolers being shed and reloaded onto the safety bus by the LOCA sequencer in response to a SIS.

Based upon the above, the condition associated with the containment coolers had the potential to adversely impact the results of the containment pressure-temperature analyses. Containment analysis code, GOTHIC 7.2a, was therefore used to quantify the impact of the degraded coolers on calculated post-accident containment environments. The sensitivity runs addressed Main Steam Line Break (split breaks and double ended ruptures), Small Break LOCA, and Large Break LOCA.

It has been concluded that although the degraded condition of the containment cooler motors would have resulted in reduced cooler availability and therefore in a lower level of heat removal than what is credited in the analysis of record, the calculated post-accident pressure and temperature peak values did not exceed the peak accident values presented in the Final Safety Analysis Report (FSAR). Therefore, this did not result in an unanalyzed condition that significantly affected nuclear safety.

III. CAUSE(S) OF THE EVENT AND CORRECTIVE ACTION(S)

The root cause for thermal overloading the containment cooler motors while in fast speed was determined to be an inadequate design specification. During original plant design development, the architect-engineer did not account for the worst-case containment atmospheric conditions that the containment coolers are required to operate in under normal and accident conditions (i.e., either at the onset or during an accident), prior to automatically switching to slow-speed. This resulted in the procurement specification being incorrect and the containment cooler motors being undersized for fast-speed operation.

A contributing cause for the containment coolers not being able to restart automatically in slow-speed following a fast-speed thermal overload trip, was that the original control circuit design had both the fast­ speed and slow-speed thermal overload trip contacts in series. Since the original design did not consider that the fast-speed thermal overloads had the possibility of tripping prior to the containment cooling fans being restarted in slow speed at the onset of an accident, placing both the fast-speed and slow-speed thermal overloads in series was not recognized as a design deficiency at the time.

Modification MP 08-0013, "Containment Coolers DSGNO1A/B/C/D Control Circuit Change," was completed on April 22, 2008. This design change modified the control circuits for the containment coolers to separate the fast-speed and slow-speed thermal overload circuits, thus allowing the containment cooling fans to automatically restart in slow-speed even if the fast-speed thermal overloads have tripped. This modification resolved the operability concern of the containment coolers since it allows them to perform their safety design function of starting (or re-starting) and running in slow speed to mitigate the consequences of an accident.

IV. PREVIOUS SIMILAR EVENTS

Previous occurrences of the containment coolers tripping during fast-speed operation were documented during the Startup Test Program at Callaway in 1983. Actions taken to address the tripping included replacement of the thermal overloads with higher ratings and changes to the control circuitry for the coolers.

A trip of one of the coolers occurred in 1986, and as corrective action for that event, new overloads with trip times in the longer portion of their allowable range were installed. Shortly after that, in 1987, a precaution was added to the operating procedure regarding fast-speed operation of the coolers during conditions of high containment pressure and low cooling water temperature, noting that operation under such conditions may cause the coolers to operate near the thermal overload setpoint(s). No further occurrences were documented until the trip of the "A" cooler on March 26, 2008.

For the trip that occurred on March 26, 2008 it should be noted that, at the time of the event, containment pressure was higher than normal (but still within the limit specified in the Technical Specifications) because containment purge was unable to be operated due to the extended inoperability of a purge exhaust process radiation monitor. (Per Callaway TS 3.3.6, "Containment Purge Isolation Instrumentation," the containment purge supply and exhaust valves must be closed when an inoperable containment purge exhaust radiation is not restored within the allowed outage time specified in the Required Action.) In addition, due to time of the year for this event (i.e., early spring), cooling water temperature was low. These factors combined to increase the load on the containment cooler fans (as previously explained) to higher than typical levels.

V. ADDITIONAL INFORMATION

The system and component codes listed below are from the IEEE Standard 805-1984 and IEEE Standard 803A-1984 respectively.

System:� BK — Containment Fan Cooling System Component: 49� — Relay, Machine or Transformer Thermal Component: FAN — Fan