05000250/LER-1998-003-02, :on 980619,discovered That Auxiliary Feedwater Sys Was Inoperable Due to Inadequate Inservice Testing of Valves.Caused by Misunderstanding of Testing Criteria.Util Revised Procedures & Verified Operability of Valves
| ML17354B034 | |
| Person / Time | |
|---|---|
| Site: | Turkey Point  |
| Issue date: | 07/15/1998 |
| From: | Mowrey C FLORIDA POWER & LIGHT CO. |
| To: | |
| Shared Package | |
| ML17354B033 | List:
|
| References | |
| LER-98-003-02, LER-98-3-2, NUDOCS 9807210013 | |
| Download: ML17354B034 (10) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(ii) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(iv), System Actuation 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(viii) 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 2501998003R02 - NRC Website | |
text
NRC FORM 366 (6-1998)
U.S.
LICENSEE EVENT REPORT (LER)
(See reverse for required number of digits/characters for each block)
EAR REGULATORYCOMMISSION APPROVE OMB NO. 31504104 EXPIRES 06/30/2001
, the NRC may not conduct or sponsor, and a person is not required to respond to, tho information collection, FACILITYNAME(1)
TURKEYPOINT UNIT3 DOCKETNUMBER(2) 05000250 PAGE (3) 1 QF 6
TITLE(4)Auxiliary Feedwater System Inoperable due to Inadequate Inservice Testing of Check Valves EVENT DATE 5 MONTH 19 1998 DAY YEAR LERNUMBER 6)
SEQUENTIAL REVISION NUMBER NUMBER 1998 003
00 REPORT DATE 2 07 15 1998 OTHER FACILITIESINVOLVED 6 DOCKEI'UMBER 05000251 DOCKETNUMBER 05000 FACIUIYNAME TURKEYPOINT UNIT4 FACILIIYNAME OPERATING MODE (6)
POWER LEVEL(10) 100 20.2201(b) 20.2203(a)(1) 20.2203(a)(2)(i) 20.2203(a)(2)(ii) 20.2203(a)(2)(iii) 20.2203(a)(2)(iv)
THIS REPORT IS SU BMITTEDPURSUANT TO THE REOU 20.2203(a)(2)(v) 20.2203(a)(3)(i) 20.2203(a)(3)(ii) 20.2203(a)(4) 50.36(c)(1) 50.36(c)(2)
IREMENTS OF 10 CFR:
Check one cr mcr 50.73(a)(2)(i) 50.73(a)(2)(ii) 50.73(a)(2)(iii) 50.73(a)(2)(iv) 50.73(a)(2)(v) 50.73(a)(2)(vii) 50.73(a)(2)(viii) 50.73(a)(2)(x) 73.71 OTHER Specify in Abstract below or In NRC Form 366A NAME CRAIG MOWREY-COMPLIANCE SPECIALIST LICENSEE CONTACT FOR THIS LER 12 TELEPHONE NUMBER gndude Ares Code) 305-246-6204
CAUSE
SYSTEM COMPONENT MANUFACTURER REPORTABLE To EPIX
CAUSE
SYSTEM COMPONENT MANUFACTURER REPORTABLE TO EPIX U
P YES (Ifyes, complete EXPECTED SUBMISSION DATE).
X No EXPECTED SUBMISSION DATE (15)
MONTH DAY YEAR ABSTRACT (Limitto 1400 spaces, i.e., approximately 15 single-spaced typewrIEen tines) (16)
During a design review of the Auxiliary Feedwater (AFW) System, Florida Power and Liqht (FPL) determined that surveillance procedures did not require several check vaIves in the AFW system to 'pass the maximum required accident flow rate.
The Turkey Point Design Basis Document stipulates a maximum required accident flow rate of 466.8
- gpm, based on the required flow for a Loss of Offsite Power to both units.
Since one AFW pump may be required to supply water to both units, each pump discharge check valve and each pump suct3.on check valve from the Condensate Storage Tank must pass 466.8 gpm.
The Tra3.n 2 AFW steam supply check valves must pass enough steam for the pumps to produce 466.8 gpm.
The cause of this condition was a misunderstanding in the AFW testing criteria of one unit demand (Technical Specification surveillance criteria) versus two unit demand (Inservice Test fIST] criteria for check valves).
This misunderstanding led to inadequate IST surveillances beginning in October 1989.
FPL verified that all affected check valves are capable of passing 467 gpm.
Procedurea will be revised to increase the IST flow rate for the affected check valves to 467 gpm.
FPL is reviewing check valves in the IST program for shared systems needed during postulated two unit events, to verify that the specified surveillance criteria bounds the maximum accident flow rate requirement.
98072i00i3 9807i5 PDR ADQCK 05000250 8
PDR NRC FORM 366 (6-1 996)
~
~
LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION FACILITY NAME TURKEY POINT UNIT 3 DOCKET NUMBER 05000250,,
LER NUMBER 98-003-00 PAGE NO.
2 OF 6
I. DESCRIPTION OF THE EVENT Duzing a design review of the Auxiliary Feedwater (AFW) System [BA], Florida Power and Light (FPL) determined that the delivered flow requirement for one AFW pump [BA:p] is 466.8 gallons per minute (gpm), in accordance with the Turkey Point Design Basis Documents (DBDs).
Contrary to this requirement,
- however, the surveillance proceduzes for the AFW pumps'ischarge check valves (20-143, 20'-243 and 23-343)
[BA:v] require only 390 gpm to satisfy the ASME Section XI (OM-10) full-stroke
'requirement.
If passing flow is the method used to verify full-stroke, the check valve must pass the maximum required accident flow rate, in accordance with the guidance in NRC Generic Letter 89-04 and in NUREG-1482, "Guidelines for Inservice Testing at Nuclear Power Plants."
System Description
Three steam turbine driven AFW pumps are provided for Turkey Point Units 3 and 4
The three pumps are installed such that each supplies auxiliary feedwater to either Unit 3 or 4, with any single pump supplying the total feedwater requirement of either unit.
The A pump is aligned to AFW Train 1, the B pump is aligned to Train 2, and the C pump can be aligned to either train.
The AFW pumps are supplied with steam from the unit which has lost its normal feedwater supply.
The steam supply valves.
[BA:isv] will automatically open on any of several signals, e.g.,
Safety Injection, Low-Low Level in any of the three steam generators [SB:sg], loss of both feedwater pumps [SJ:p] under normal operating conditions, and bus stripping [EC:bu].
The AFW system is currently configured to respond to any automatic actuation signal as follows:
1.
The steam supply valves to all available pumps begin to open on the signal 2.
All available pumps start and all Flow Control Valves fully open, within 95 seconds of the signal 3.
The Flow Control Valves [BA:fcv],throttle back to 130 gpm pez steam
~
generator within one to two minutes of the pump start Reportable Condition Present surveillance procedures ensure that system response is as described above.
Steam generator flow is verified to be 130
+ 5 gpm after the AFW system stabilizes.
FPL determined that surveillance procedures did not require the AFW pumps'ischarge check valves to pass the maximum required accident flow rate.
The Turkey point Design Basis Document stipulates a maximum required accident flow rate of 466.8
- gpm, based on the required flow, for a Loss of Offsite Power to both units.
Since one AFW pump may be required to supply water to both units, each pump's discharge check valve must be shown to pass at least 466.8 gpm to satisfy the ASME Section XI (OM-10) full-stzoke requirement for Inservice Testing (IST). The maximum flow rate, which occurs prior to stabilization, has typically not been documented.
Therefore, adequate documentation cannot be found to prove that IST acceptance criteria has been met.
As a zesult, based on this inadequate IST surveillance, the AFW system was technically inoperable, dating from July 1990, when FPL committed to test these check valves using full flow testing, in response to Generic Letter 89-04.
This condition is prohibited by Technical Specifications, and is therefore reportable under 10 CFR 50.73(a) (2) (i) (B).
pump flow rate is used as the positive means to verify that the steam supply check valves are passing design steam flow.
Therefore, the Tzain 2 steam supply check valves (AFSS-003B and AFSS-003C) for the B and C AFW pump turbines also require a
pump flow rate of 467 gpm to verify full-stroke opening.
Train 2 steam to the A AFW
LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION FACILITY NAME TURKEY POINT UNIT 3 DOCKET NUMBER 05000250 LER NUMBER 98-003-00 PAGE NO.
3 OF 6
pump is not an allowed configuration pez the Technical Specifications, so AFSS-003A is not required to be tested.
The Train 1 steam supply has two check valves in
- parallel, one from each unit.
There are no Train 1 steam supply check valves that are common to both units.
Therefore no Train 1 check valves need to be tested to the 467 gpm criterion.
During recent testing (5/4/98 to 6/16/98), plant personnel verified that each pump produced in excess of 480 gpm during testing, thus satisfying the maximum accident flow rate IST requirement for the pump discharge check valves and for the AFW steam supply check valves.
No documentation could be located to indicate that the AFW pump suction valves from the Condensate Storage Tank [KA:tk](3-20-401 and 4-20-401) weze tested to 467 gpm.
Therefore on July 6,
- 1998, both trains of the AFW system were declared inoperable.
Testing of these two valves was completed satisfactorily within the 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed for a missed surveillance by Technical Specification 4.0.3, and the AFW trains were declared operable.
The existing condition was prohibited by Technical Specifications, and is therefore reportable under 10 CFR 50.73(a)(2)(i)(B).
II. CAUSE OF THE EVENT
The root cause for this procedural difference in the surveillance versus required flow rates was cognitive personnel error by utility non-licensed personnel in 1990, specifically a misunderstanding in the AFW testing criteria of one unit demand (Technical Specification required flow rate) versus two unit demand (IST criteria for check valves).
That is, AFW testing is performed by delivering flow to only one unit, however, for certain check valves in the AFW system this does not represent the maximum required accident flow rate, which corresponds to a two unit event.
The flow control valve setting(s) must be adjusted from its preset flow demand for single unit response (125 gpm minimum per steam generator) to produce and document flow testing for a two unit flow requirement.
The auxiliary feedwater system flow requirements have been reevaluated several times at Turkey Point.
In the early 1980s, AFW requirements were reevaluated.
as part of the Steam Generator Replacement project.
These analyses established the limiting AFW flow for a single unit event to be 373 gpm for the Loss'f Normal Feedwater transient (LONF).
AFW flow for this single unit event was based on a three minute time delay for AFN'low initiation and on no loss of offsite power.
This 373 gpm flow requirement was incorporated into the Technical Specification Surveillance in Technical Specification Amendment 90/84 in December 1982.
Additional analyses were subsequently performed for the non-LOCA accidents and submitted in 1987 to permit changing the AFW Technical Specifications to allow a,30 day allowed outage time on the third AFW pump.
These analyses demonstrated that the for a 'single unit event the minimum required flow for a loss of main feedwater event (no loss of offsite power) is 315 gpm in three minutes.
For a two unit event, it was assumed 125 gpm would be provided to the farthest unit hydraulically for ten minutes followed by balancing flow to the two units at 230 gpm per unit (460 gpm total flow for two units).
While this change to the Technical Specifications was accepted by the
- NRC, no change to the surveillance requirement of 373 gpm for 15 minutes was made.
The AFW Technical Specifications were further revised in 1990 as part of the Technical Specification upgrade program to change from custom Technical Specifications to Standard Technical Specifications modeled after the Westinghouse Standard Technical Specifications (NUREG-0452, Revision 5 Draft).
The 373 gpm flow
t t
LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION FACILITY NAME TURKEY POINT UNIT 3 DOCKET NUMBER 05000250 LER NUMBER 98-003-00 PAGE NO.
4 OF 6
requirement was retained in the revised Technical Specifications, and is considered a
general performance test requizement for the AFW system.
III.
SAFETY CONSEQUENCES
OF THE EVENT
DESCRIPTION
OF TRANSIENTS REQUIRING AFW Loss of Normal Feedwater (LONF)
Loss of main feedwater transients are only postulated to occur in a single unit whether in single or dual unit operation.
They are characterized by a rapid reduction in steam generator water levels which results in a reactor trip, a turbine trip, and auxiliary feedwater actuation by the protection system logic [JC).
Following reactor trip from high power, the power quickly falls to decay heat levels.
The water levels continue to deciease, progressively uncovering the steam generator.
tubes as decay heat is transferred and discharged in the form of steam either through the steam dump valves to the condenser, or through the steam generator safeties or atmospheric steam dump valves.
The reactor coolant [AB) temperature increases as the residual heat in excess of that dissipated through the steam generators is absorbed.
With increased temperature the volume of reactor coolant expands, filling the pressurizer and increasing reactor coolant system pressure.
- Hence, the timely introduction of sufficient auxiliary feedwater is necessary to arrest the decrease in the steam generator water levels, to reverse the rise in reactor coolant temperature, to prevent the pressurizer [AB:pzr] from filling to a water solid condition, and eventually to establish stable hot standby conditions.
Subsequently, a decision may be made to proceed with plant cooldown.
This transient differs from a simple LONF in that both units will trip causing a dual unit demand for AFW.
Emergency power sources [EK) must be relied upon to operate vital equipment;
,The loss of power to the electric driven condenser circulating water pumps [SG:p) results in loss of condenser vacuum and condenser steam dump capability.
- Hence, steam is relieved through the steam generator safety'alves [SB:rv] or the atmospheric dump valves [SB:pcv].
The calculated transients for each unit are similar for both LONF and LOOP except that reactor coolant pump [AB:p) heat input to the Reactor Coolant System (RCS) is not a consideration for LOOP following loss of power to the reactor coolant pump bus.
The limiting criterion for both is preventing the pressurizer from filling with water.
Small Break Loss of Coolant Accident (LOCA)
Small LOCAs are characterized by relatively slow rates of decrease in reactor coolant system pressure and liquid volume.
The principal contribution from the AFW System following small LOCAs is to remove the decay heat and RCS sensible energy which is not removed by the break flow.
This also augments the depressurization of the RCS and eventually allows cooldown to achieve hot shutdown.
GENERIC IMPLICATIONS AFW check valves in the IST Program were reviewed for applicability.
Only the seven valves discussed were determined to be impacted:
the pumps'ischarge check valves (20-143,
,243, and
.343),
the AFW suction valves from the Condensate Storage Tank (3-0-401 and 4-20-401),
and the Train 2 AFW pump steam supply valves (AFSS-003B and AFSS-003C).
Per NUREG-1482, flow measurements of full-stroke check valve testing are not subject to instrument range and accuracy requirements.
LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION FACILITY NAME TURF'EY POINT UNIT 3 DOCKET NUMBER 05000250 LER NUMBER 98-003-00 PAGE NO.
5 OF 6
Based on the zoot cause of the discrepancy (Maximum accident flow requirement is based on a two unit event, and testing is performed based on a one unit event.),
there do not appear to be any other safety related fluid systems which are shared between the units and are required simultaneously by both units at Turkey Point.
~
- However, FPL will perform a general review of the IST program check valves for shared systems needed during postulated two unit events, to verify that the specified surveillance criteria bounds the maximum accident flow rate requirement.
SUMMARY Updated Final Safety Analysis Report Section 14.1.12 Loss of Non-Emergency A-C Power to the Plant Auxiliaries, represents the limiting event for AFW.
The worst single failure in the AFW system could result in the availability of only AFW pump supplying 233.4 gpm to one of the units (466.8 gpm total to both units) 95 seconds following a start signal on low-low steam generator level.
This AFW flow is less (per unit) than that assumed for a loss of normal feedwater, because Turkey Point Units 3 and 4 have a shazed AFW system and a
LOOP may occur simultaneously on both units.
Technical Specifications 3.7,1.2 and 4.0.5 provide the operational and surveillance requirements for AFW.
Two independent AFW trains including three AFW pumps and associated flow paths aze required to be operable during Modes 1,
2, or 3.
The AFW pumps and associated valves are demonstrated operable at least once per 31 days by verifying each steam turbine driven pump operates for at least 15 minutes and develops at least 373 gpm to the steam generators.
The IST program tests the valves and pumps in the program in accordance with Technical Specification 4.0.5 and ASME Section XI requirements.
The AFW Design Basis Document (DBD) specifies an (original) design flow capability of 600 gpm for the pump discharge check valves '(20-143,
- - 243, -343).
- However, the DBD identifies that the -maximum accident flow rate to the steam generators zequired by one AFW pump as 466.8 gpm (LOOP on two units).
Recent, testing of the AFW pump discharge check valves confirms that greater than 390 gpm of flow passes through the check valve.
The intent of the ASME Code and the Technical Specifications is that an AFW pump discharge check valve should be capable of passing sufficient flow to support a dual unit transient (466.8 gpm per AFW DBD's Section 4.3.1,,for Loss of Offsite Power for Units 3 and 4).,
Documentation could not be found for all pumps that explicitly verified that greater than 467 gpm would be passed.
While explicit documentation could riot be found, testing data shows that the system behavior is such 'that when AFW is started for testing, a single pump will pzovide flow to the flow control valves associated with that train and unit (one flow control valve/steam generator/train).
The design of the system is such that each AFW flow control valve will go to its wide open position, and then will control flow to its set point of 130 gpm (390 gpm total).
Recent test results reviewed have shown that flow initially overshoots the 130 gpm set point on each FCV by a wide margin (flow peaks are typically greater than 200 gpm), with flow then being controlled to the set point in the next one to two minutes.
Based on the results
- reviewed, there is reasonable evidence to indicate that greater than 467 gpm has been achieved through each AFW pump and discharge check valve, and that the steam supply check valves have passed adequate steam to achieve 467 gpm pump flow rate, during past monthly system tests.
As described in Section I, although no historical documentation of adequate testing could be located for the AFW pump suction valves 3-20-401 and 4-20-401, the valves were satisfactorily tested on July 6, 1998, to greater than 467 gpm.
~
e LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION FACILITY NAME TURKEY POINT UNIT 3 DOCKET NUMBER 05000250 LER NUMBER 98-003-00 PAGE NO.
6 OF 6
All seven of the affected AFW check valves were capable of performing their intended design function.
Accordingly, the failure to properly specify the valves to their maximum anticipated accident required flow in the surveillance procedures is judged to have little safety significance, and has had negligible impact on the health and safety of the public.
IV. CORRECTIVE ACTIONS
1)
The pump discharge check valves and the CST outlet valves were verified capable of passing at least 467 gpm.
The steam supply check valves were verified capable of supplying the steam flow required for the pumps to supply 467 gpm.
2)
FPL reviewed all other AFW check valves in the IST program to ensure that the correct maximum required accident flow rate was specified.
3)
Procedures will be revised to increase the flow rate requirement to 467 gpm for the quarterly Inservice Test on check valves20-143, 20-243,20-343, AFSS-003B, and AFSS-003C, and 3-20-401 and 4-20-401.
4)
FPL is performing a general review of check valves in the IST program for shared systems needed during postulated two unit events, to verify that the specified surveillance criteria bounds the maximum accident flow rate requirement.
V.
ADDITIONAL INFORMATION
A.
Similar events
LER 250/96-04 reported other surveillances which were determined to be inadequate, found as a result of reviews conducted in accordance with Generic Letter 96-01, Testing of Safety-related Logic Circuits.
The condition reported herein involved a misunderstanding of acceptance criteria, rathez than testing of circuits.
B.
EIIS Codes are shown in the format [EIIS SYSTEM:
IEEE component function identifier, second component identifier (if appropriate)).