05000315/LER-1998-052, :on 981128,no Analysis for NSR Sc Manual Loader for Tdafwp Could Be Found in Original Design.Cause Due to All Failure Modes Not Considered When Compressed Air Sys Originally Designed.Performed Review of Components

:on 981128,no Analysis for NSR Sc Manual Loader for Tdafwp Could Be Found in Original Design.Cause Due to All Failure Modes Not Considered When Compressed Air Sys Originally Designed.Performed Review of Components

ML17335A492
Person / Time
Site:	Cook
Issue date:	01/19/1999
From:	Gebbie J INDIANA MICHIGAN POWER CO.
To:
Shared Package
ML17335A491	List: 05000315/LER-1998-052, :on 981128,no Analysis for NSR Sc Manual Loader for Tdafwp Could Be Found in Original Design.Cause Due to All Failure Modes Not Considered When Compressed Air Sys Originally Designed.Performed Review of Components 05000315/LER-1998-052-01, Forwards LER 98-052-01,re Potential Failure Mode for Air Operated Components Not Considered in Original Design. Interim LER Has Been Updated to Include Two Addl Instances of Same Failure Mode
References
LER-98-052, LER-98-52, NUDOCS 9901260365
Download: ML17335A492 (6)

LER-1998-052, on 981128,no Analysis for NSR Sc Manual Loader for Tdafwp Could Be Found in Original Design.Cause Due to All Failure Modes Not Considered When Compressed Air Sys Originally Designed.Performed Review of Components

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(ii) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(viii) 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(iv), System Actuation 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition
3151998052R00 - NRC Website

text

NRC Form 366 U.S. NUCLEAR REGULATORY COMMISSION (6-1998)

LICENSEE EVENT REPORT (LER)

(See reverse for required number of digits/characters for each block)

APPROVED BY OMB No. 3150-0104 EXP)RES 06/30/2001 ESTSAATEO BURDEN PER RESONSE TO COMPLY WITH TISS MAIE5ATORY INFORMATIONCOLLECTINREOVEST: 50 0 NRS. REPORTED lESSONS LEARNGIARE INCORPCRATEO WTO THE UCENSING PROCESS AND FED BACK TO OIDVSTRY.

FORWARD COMMENTS REGARDING BVRDEN ESTIMATE TO TNE INFORMATIONAND RECORDS MANAGEMENT BRANCH (T4 FSSI.

U.S.

NUCLEAR REGIAATORY COMIBSSERL WASHINGTON. DC 2o5554co1. AIEITO THE PAPERWOIK EDUCIION PROJECT (55504IOI), OFACE OF MANAGEMENT AND BVDGET, WASISNGTON, OC 205O5 FACIUTYNAME(5)

TITLE(5)

Cook Nuclear Plant Unit 1 DOCKET NUMBER(2) 05000-315 PAGE (2) 1 of4 Potential Failure Mode for AirOperated Components Not Considered in Original Design MONTH DAY YEAR YEAR EVENT DATE (5)

LER NUMBER (6)

SEQUENTIAL NUMBER REVISION NUMBER REPORT DATE (7)

MONTH DAY YEAR A IU NAM DC Cook Unit 2 TNU 05000-316 OTHER FACILITIESINVOLVED(8) 11 28 1998 1998 052 01 01 19 1999 A ILI NAM 0

NV OPERATING MODE (9)

POWER LEVEL(10) 000 20.2201 (b) 20.2203(a)(1) 20.2203(a)(2)(i) 20.2203(a)(2)(v) 20.2203(a)(3)(i) 20.2203(a)(3)(ii) 50.73(a)(2)(i) 50.73(a)(2)(ii) 50.73(a)(2)(iii) 50.73(a)(2)(viii) 50.73(a)(2)(x) 73.71 THIS REPORT IS SUBMITTEDPURSUANT TO THE REQUIREMENTS OF 10 CFR (): (Check one or more) (11) 20.2203(a)(2)(ii) 20.2203(a)(2)(iii) 20.2203(a)(2)(iv) 20.2203(a)(4) 50.36(c)(1) 50.36(c)(2)

LICENSEE CONTACT FOR THIS LER (12) 50.73(a)(2)(iv) 50.73(a)(2)(v) 50.73(a)(2)(vii)

OTHER Speci/r FI Abstract below or o NRC Forot 366A NAME TELEPHONE NUMBER(Iodude Area Code)

Mr. Joel Gebbie, Safety Related Mechanical Engineering Supervisor 616/465-5901 x1543 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT (13)

V

CAUSE

SYSTEM COMPONENT MANUFACTURER REPORTABLE TO EPIX

CAUSE

SYSTEM COMPONENT MANUFACTURER REPORTABLE TO EPIX SUPPLEMENTAL REPORT EXPECTED 14 X

YES (IfYes, complete EXPECTED SUBMISSION DATE)

NO EXPECTED SUBMISSION DATE (15)

MONTH 06 DAY 01 1999 Abstract (Limitto 1400 spaces, i.e., approximately 15 single-spaced typewritten lines) (1 6)

During a Safety System Functional Inspection (SSFI) self-assessment of the Auxiliary Feedwater (AFW) System, no analysis for a failure of the non-safety related remote speed controller manual loader for the Turbine Driven Auxiliary Feedwater Pumps (TDAFP) could be found. Engineering analysis of the condition resulted in the conclusion that a failure of the non-safety related manual loader output could result in the TDAFP operating at a minimum speed of 1900 rpm with only one Motor Driven Auxiliary Feedwater Pump (MDAFP) in operation when Auxiliary Feedwater (AFW) is required to mitigate the consequences of an accident.

On November 28, 1998, this was determined to be reportable.

Therefore, this LER is being submitted in accordance with 10 CFR 50.73 (a)(2)(ii)(B) as a condition outside the design basis of the plant.

To prevent recurrence of this issue in the future, a training course willbe provided to the Plant Engineering staff to ensure that the design requirements for non-safety related systems that interface with safety related systems are met. Potential modifications to the Auxiliary Feedwater System are being evaluated as an additional corrective action. When the course of action is decided, this LER willbe updated to reflect that information.

The safety significance of this condition was evaluated considering that the AFWsystem would be required to satisfy the accident analyses assumptions with the TDAFP operating at 1900 rpm in addition to a single active failure of a MDAFP.

Under these conditions, the AFWsystem would not be able to produce AFWflow rates assumed in the accident analyses.

However, the capability exists to cross-tie the AFWsystems between units and provide an alternate source ofAFWto the affected unit. Therefore, although this condition would result in the AFWsystem being outside the design bases, it would not pose a threat to the health and safety of the public.

In December 1998 and January 1999 additional components were identified that could experience the same failure. After the investigations for those components are completed, a supplemental report to this LER willbe submitted.

That submittal is expected to occur by June 1, 1999.

9901260365 99013.9 PDR ADQCK 050003i5 S

PDRU.S. NUCLEAR REGULATORY COMMISSION (6-1998)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITYNAME (1)

Cook Nuclear Plant Unit 1 OOCKET NUMBER(2) 05000-315 YEAR LER NUMBER (6)

SEQUENTIAL NUMBER REVISION NUMBER PAGE (3) 2of4 TEXT (ifmore space is required, use addh'Iional copies ofNRC Form (366A) (17)

Conditions Prior to Event

Unit 1 was in Mode 5, Cold Shutdown Unit 2 was in Mode 5, Cold Shutdown 1998 052 01 Descri tlon of Event On September 21, 1998, a Safety System Function Inspection (SSFI) self-assessment of the Auxiliary Feedwater (AFW) system began, using SSFI techniques in accordance with NRC Inspection Procedure 93801, "Safety System Functional Inspection". The inspection team utilized a vertical slice review in the functional areas of engineering design and configuration control, operations, maintenance, surveillance and testing, and quality assurance and corrective actions.

The self-assessment concluded on October 23, 1998.

During the SSFI, it was identified that no analysis for a failure of the non-safety related remote speed controller manual loader for the Turbine Driven AuxiliaryFeedwater Pumps (TDAFP) existed.

Engineering analysis of the condition resulted in the conclusion that a failure of the non-safety related manual loader output could result in the TDAFP operating at a minimum speed of 1900 rpm with only one Motor Driven AuxiliaryFeedwater Pump (MDAFP) in operation when Auxiliary Feedwater (AFW) is required.

On November 28, 1998, this was determined to be reportable in accordance with 10 CFR 50.73 (a)(2)(ii)(B) as a condition outside the design basis of the plant.

The steam supply to the Turbine Driven Auxiliary Feedwater Pump (TDAFP) is regulated by a Woodward governor valve.

Depending upon the position of the governor valve, the speed of the TDAFP can vary from 1900 rpm to 4350 rpm. The governor valve is a pneumatically controlled device. The position of the governor valve may be remotely adjusted from the Control Room by using the speed control manual loader. The pneumatic input to the speed control manual loader is supplied from the 20 psig compressed air header.

The loader output can vary from 3 psig to 15 psig. Loader output of 3 psig corresponds to maximum pump speed of 4350 rpm, while loader output of 15 psig corresponds to minimum pump speed of 1900 rpm.

Upon a loss of control air pressure to the loader, either due to loss of the compressed air system or a failure of the speed control manual loader, the TDAFP speed willautomatically go to its design speed of 4350 rpm. This condition has been previously evaluated.

However, ifthe speed control manual loader fails such that the TDAFP governor valve receives the compressed air header pressure of 20 psig, the TDAFP speed willautomatically go to its minimum speed setting of 1900 rpm. No evaluation of the failure mode where the TDAFP governor receives full compressed air system pressure of 20 psig had been performed.

The TDAFP speed control manual loader is a non-safety related component.

As such, failure of the loader cannot be considered as the single active/passive failure of the AFWsystem.

Therefore, the AFWsystem would have to satisfy the accident analyses assumptions with the TDAFP operating at 1900 rpm in addition to the single active failure of a MDAFP.

Under these conditions, the AFWsystem would not be able to produce AFWflow rates assumed in the accident analyses.

In December 1998 it was identified that the Residual Heat Removal (RHR) heat exchanger air operated outlet valves would experience a similar failure to that identified for the TDAFP governor valve.

In January 1999 it was identified that the Centrifugal Charging Pumps (CCP) discharge flow control valve was also susceptible to this failure mode.

Information on these additional components willbe provided after the investigations are completed.

Cause of Event

The root cause of this condition is that not all failure modes were considered when the compressed air system was originally designed.

The plant was designed in accordance with General Design Criterion 26, "Protection Systems Fail-U.S. NUCLEAR REGULATORY COMMISSION (6-1998)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITYNAME (1)

Cook Nuclear Plant Unit 1 DOCKET NUMBER(2) 05000-315 YEAR LER NUMBER (6)

SEQUENTIAL NUMBER REVISION NUMBER PAGE (3) 3of4 1998

052 01 TEXT (IImore space is required, use additional copies ofNRC Form (366A) (17)

Safe Design." The design criterion specifically refers to loss of air as a failure mode; however, it does not specify over-pressurization.

Review of components installed in the plant has revealed that a number of the components which utilize controllers are also designed with a dump solenoid.

The dump solenoid ensures that the component (e.g., valve) willfail to its safe position. Ifa component was credited with an active safety function, it was fitted with a dump solenoid.

However, ifthe component did not have an active safety function (such as the TDAFP speed controller manual loader), itwas not designed with a dump solenoid.

Anal sls of Event This LER is submitted in accordance with 10 CFR 50.73(a)(2)(ii)(B) as a condition outside the design bases of the plant.

The AFW'system provides water to the Steam Generators (SG) when main feedwater is unavailable because of a loss of main feedwater, unit trip, feedwater or steam line break, toss of off-site power, or small break Loss of Coolant Accident (SBLOCA). This water removes core residual heat to prevent the release of primary water through the pressurizer safety or powerwperated relief valves and allows the plant to cool down to the point at which Residual Heat Removal (RHR) can be placed in service.

Each unit is equipped with one turbine driven AFWpump and two motor driven AFW pumps.

For each unit, the TDAFP serves all four steam generators and each MDAFWpump serves two steam generators.

The steam to the AFW pump turbine is supplied from two of the steam generators.

The preferred source of water for the AFWsystem is the non-safety related CST..Each unit's CST is cross-tied by a normally closed air operated valve to provide condensate to the opposite unit's AFW. Ifboth CSTs are unavailable, water is supplied from Lake Michigan via the safety related ESW system, which is connected upstream of the AFWpump suction strainers.

A minimum of 175,000 gallons is required to maintain the unit at hot shutdown for nine hours.

The TDAFP speed control manual loader is a non-safety related component.

As such, failure of the loader cannot be considered as the single active/passive failure of the AFWsystem.

Therefore, the AFWsystem would be required to satisfy the accident analyses assumptions with the TDAFP operating at 1900 rpm in addition to the single active failure of a MDAFP. Under these conditions, the AFWsystem would not be able to produce AFWflow rates assumed in the accident

'nalyses.

However, thecapabilityexiststocross-tietheAFWsystemsbetweenunits.

Proceduresareinplaceand operators are trained to perform this evolution. Should this condition occur and since Cook is not designed for simultaneous design basis accidents in both units, supplemental AFWcould be provided from the opposite unit. Therefore, although this condition would result in the AFWsystem being outside the design bases, it would not pose a threat to the health and safety of the public.

Corrective Actions

To ensure that this condition does not affect other components in the plant, a review has been performed to identify those components that utilize a similar controller. Several components with similar controllers have been identified. Those components are the CCP discharge flow control valve, the RHR heat exchanger outlet valves, and the SG PORVs (MRV-213, 223, 233,243).

The CCP and RHR valves were evaluated for the impact of the failure mode, and it was determined that corrective actions should be implemented.

Additional information regarding corrective actions willbe provided once the investigations for these components are completed.

The PORVs were also evaluated and it was determined that the potential failure mode was adequately addressed by actions taken in the Emergency Operating Procedures.

This condition occurred because the effect of non-safety related components on the operation of safety related systems was not properly evaluated.

To prevent recurrence of this condition, a training course willbe provided to the Plant

s II vt

~U.S. NUCLEAR REGULATORY COMMISSION (6-1998)

~ LICEASEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITYNAME(1)

Cook Nuclear Plant Unit 1 DOCKET NUMBER(2) 05000-315 YEAR LER NUMBER (6)

SEQUENTIAL NUMBER REVISION NUMBER PAGE (3) 4of4 1998 052 01 TEXT (ifmore space is required, use additional copies ofNRC Form (366A) (17)

Engineering staff to ensure that the design requirements for non-safety related systems, structures or components (SSCs) that interface with safety related SSCs are met. This training willbe completed prior to restart.

The current design change process has been verified to address requirements to design against single failures. The current procedure provides a significant improvement in the design change process over the process that was in place at the time of the original design for DC Cook Potential modifications to the AuxiliaryFeedwater System are being evaluated as an additional corrective action. When the course of action is decided, this LER willbe updated to reflect that information.

Previous Similar Events

315/97-023-00 315/97-026-00 R