text

LER-2015-004, Regarding Auxiliary Feedwater Control Valve Inoperable Due to Faulty Electronic Positioner Card
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications; 10 CFR 50.73(a)(2)(v), Loss of Safety Function; 10 CFR 50.73(a)(2)(i); 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability; 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded; 10 CFR 50.73(a)(2)(viii)(A); 10 CFR 50.73(a)(2); 10 CFR 50.73(a)(2)(viii)(B); 10 CFR 50.73(a)(2)(ix)(A); 10 CFR 50.73(a)(2)(iv)(A), System Actuation; 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor; 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat; 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown
	4832015004R00 - NRC Website
	v • d • e

Regarding Auxiliary Feedwater Control Valve Inoperable Due to Faulty Electronic Positioner Card
	ML15285A019
Person / Time
Site:	Callaway
Issue date:	10/12/2015
From:	Cox B; Ameren Missouri, Union Electric Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	ULNRC-06258 LER 15-004-00
	Download: ML15285A019 (14)
	v • d • e

Cal laway Plant MISSOURI October 12, 2015 ULNRC-0625$

U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-000 1 10 CFR 50.73(a)(2)(i)(B) 10 CFR 50.73(a)(2)(v)(D)

Ladies and Gentlemen:

DOCKET NUMBER 50-483 CALLAWAY PLANT UNIT 1 UNION ELECTRIC CO.

RENEWED FACILITY OPERATING LICENSE NPF-30 LICENSEE EVENT REPORT 2015-004-00 AUXILIARY FEEDWATER FLOW CONTROL VALVE INOPERABLE DUE TO FAULTY ELECTRONIC POSITIONER CARD The enclosed licensee event report is submitted pursuant to 10 CFR 50.73(a)(2)(i)(B) to report a condition prohibited by the Technical Specifications and pursuant to 10 CFR 50.73(a)(2)(v)(D) to report a condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident. The condition was due to a faulty auxiliary feedwater (AFW) flow control valve positioner card installed on one train of AFW (motor driven B train) with coinciding outages affecting the redundant AFW trains from November 18, 2014 through December 3, 2014.

This letter does not contain new commitments.

Sincerely, Barry L. Cox Senior Director Nuclear Operations Enclosure P0 Box 620 Fulton, Fy10 65251 AmerenFllissouri.corn STARS Alliance

ULNRC-0625$

October 12, 2015 Page 2 cc:

Mr. Marc L. Dapas Regional Administrator U. S. Nuclear Regulatory Commission Region IV 1600 East Lamar Boulevard Arlington, TX 76011-4511 Senior Resident Inspector Callaway Resident Office U.S. Nuclear Regulatory Commission

$201 NRC Road Steedman, MO 65077 Mr. L. John Klos Project Manager, Callaway Plant Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Mail Stop O8H4 Washington, DC 20555-000 1

ULNRC-0625 8 October 12, 2015 Page 3 Index and send hardcopy to QA File A160.0761 Hardcopy:

Certrec Corporation 6100 Western Place, Suite 1050 Fort Worth, TX 76107 (Certrec receives ALL attachments as long as they are non-safeguards and may be publicly disclosed.)

Electronic distribution for the following can be made via LER ULNRC Distribution:

F. M. Diya D. W. Neterer L. H. Graessle B. L. Cox I. E. Herrmann S. A. Maglio T. B. Elwood G. G. Yates Corporate Oversight Corporate Communications NSRB Secretary Performance Improvement Coordinator Resident Inspectors (NRC)

STARS Regulatory Affairs Mr. John ONeill (Pillsbury Winthrop Shaw Pittman LLP)

Missouri Public Service Commission

fIRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY 0MB: NO. 3150-0104 EXPIRES: 01/31/201 7 01-2014)

Estimated burden per response to comply with this mandatory collection request:

80 hours9.259259e-4 days 0.0222 hours 1.322751e-4 weeks 3.044e-5 months .

Reported lessons learned are incorporated into the licensing process and fed back to industry. Send comments regarding burden estimate to the FdA, Privacy and Information Collections Branch CT-S F53),

U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by LCEKSEE EET REPORT LER internet e-mail to infocollects.Resourcenrc.gov, and to the Desk Officer, I

I Office of Information and Regulatory Affairs, NEOB-1 0202, (3150-01 04), Office (See e e e f

- I k

c of Management and Budget, Washington, DC 20503. Ii a means used to

- I impose an information collection does not display a currently valid 0MB digits/characters for each block) control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

3. PAGE Callaway Plant Unit 1 05000483 1

OF 1 1

4. TITLE Auxiliary Feedwater Control Valve Inoperable Due To Faulty Electronic Positioner Card

5. EVENT DATE

6. LER NUMBER

7. REPORT DATE

8. OTHER FACILITIES INVOLVED FACILITY NAME DOCKET NUMBER MONTH DAY YEAR YEAR SEQUENTIAL REV MONTH DAY YEAR FACILITY NAME DOCKET NUMBER 08 11 2015 2015 004 00 10 12 2015

9. OPERATING MODE

11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR: (Check all that apply)

LI 202201(b)

LI 20.2203(a)(3)(i)

LI 50.73(a)(2)(i)(c)

LI 50.73(a)(2)(vii) 3 LI 20.2201(d)

LI 20.2203(a)(3)Øi)

LI 50.73(a)(2)(ii)(A)

LI 50.73(a)(2)(viii)(A)

LI 20.2203(a)(1)

LI 20.2203(a)(4)

LI 50.73(a)(2)(U)(B)

LI 50.73(a)(2)(viii)(B)

LI 20.2203(a)(2)(i)

LI 50.36(c)(1)0)(A)

LI 50.73(a)(2)Oii)

LI 50.73(a)(2)(ix)(A) 10 POWER LEVEL 20.2203(a)(2)(ii)

LI 50.36(c)(1)(ii)(A)

LI 50.73(a)(2)(iv)(A)

LI 5D.73(a)(2)(x)

LI 20.2203(a)(2)(iii)

LI 50.36(c)(2)

LI 50.73(a)(2)(v)(A)

LI 73.71(a)(4)

LI 20.2203(a)(2)Cv)

LI 50.46(a)(3)ti)

LI 50.73(a)(2)(v)(B)

LI 73.71(a)(5) 0 LI 20.2203(a)(2)(v)

LI 50.73(a)(2)(i)(A)

LI 50.73(a)(2)(v)(C)

LI OTHER LI 20.2203(a)(2)(vi) 50.73(a)(2)(i)(B) 50.73(a)(2)(v)(D)

Specify in Abstract below or in path actuates to its correct position on an actual or simulated actuation signal. This SR includes the requirement to verify that each MDAFP motor-operated discharge flow control valve (ALHV0005 and ALHV0007 for PALO1B, and ALHV0009 and ALHVOO1 1 for PALO IA) limits the flow from the associated MDAFP to its respective steam generator to less than or equal to 300 gpm. Each MDAFP flow control discharge valve is required to be operable per TS 3.7.5 for MODES 1,2, and 3.

ENERGY INDUSTRY IDENTIFICATION SYSTEM COMPONENT AND SYSTEM INFORMATION The Energy Industry Identification System (EIIS) component and system identifiers for the components described herein are as follows:

System: BA, Auxiliary feedwater System Components: P, Pump; FCV, Flow Control Valve System: SJ, Main feedwater System 2.

INITIAL PLANT CONDITIONS

Prior to ALHV0007 failing to open from the main control board (MCB), Callaway Plant was stable in MODE 1, with 1248 MWe output. At 01:39 on August 11, 2015, an unexpected turbine trip and reactor trip occurred in response to an offsite transmission line fault. As a result of these trips, an automatic actuation of the auxiliary feedwater system occurred. When control room operators attempted to take manual control of the B train motor-driven auxiliary feedwater pump (MDAFP) discharge control valves (subsequent to acceptable operation of the valve, initially, in response to the automatic AFW actuation), they were unable to reopen valve ALHV0007 using the main control board control station. The extent of condition and the full ramifications for ALHV0005 were discovered while the plant was in MODE 3 (Hot Standby) at normal operating temperature and pressure.

3.

EVENT DESCRIPTION

Prior to the event, Callaway Plant was stable in MODE 1 with 1248 MWe output. At 01:39 on 8/11/2015, an unexpected turbine trip and reactor trip occurred due to an offsite transmission line fault on the Montgomery-Callaway 8 switchyard line.

An automatic Auxiliary Feedwater Actuation Signal (AFAS) was generated. The turbine-driven auxiliary feedwater pump (TDAFP) and both motor-driven auxiliary feedwater pumps (MDAFPs) started, with the TDAFP primarily satisfying the water level requirements of the steam generators. All four flow control valves for the two MDAFPs, including ALHV0005 and ALHV0007, closed as a result of the flow supplied by the TDAFP. In accordance with the normal operation procedure, manual operator action was later initiated to transfer flow to the MDAfPs in order to secure the TDAFP. Steam generator (SG) levels were restored to within the control band.

In preparation for securing the TDAFP, a control room operator was unable to reopen ALHV0007, MDAFP B to SG A, using the main control board (MCB) control station at 04:56 on 8/1 1/20 15. An Operating Technician (OT) was dispatched locally to the valve and found it fully closed on its seat. The OT partially opened the valve using the handwheel; however, the control room operator was still unable to regain remote electrical control of the valve and the valve was declared inoperable. The valve was then locally closed with the handwheel and left closed. Local manual control of ALHV0007 was maintained. After valve ALHV0007 was declared inoperable, Job 15003479 was initiated to troubleshoot. Upon preliminary investigation, electricians observed that the electronic positioner card was charred. The electronic positioner card was then replaced with a hybrid electronic positioner card (explained later in this Event Description) and valve control was restored. Further investigation of the failed electronic positioner card determined that the BR2 bridge rectifier had burned completely off of the positioners circuit card.

In 2014, the Limitorque Modutronic Model IOA electronic positioners for the four MDAFP discharge control valves, as

4.

ASSESSMENT OF SAFETY CONSEQUENCES

Impact During Plant MODE I above 10% RTP During normal operation above 10% RIP, the MDAFP flow control valves are required by TS 3.7.5, Auxiliary Feedwater System, to be in the fully open position in order for the corresponding train of AFW to be operable. Upon actuation of the AFW system, the MDAFP flow control valves are credited to either throttle or isolate flow from the A and B MDAFPs to their respective SGs, depending on the accident scenario and the level of TDAFP flow available. No accident analysis sequence requires that the MDAFP flow control valves reopen, after closing from their initial fully open position above 10%

RTP, in order for the AFW system to fulfill any of its specified safety functions.

In the case of the ALHV0005 failure on 12/3/20 14, the valve was unable to throttle or isolate flow through automatic flow-limiting operation or remote manual operation. As a result, from the time ALHV0005 was left energized on li/I 8/2014 until the failed NLI-lOA-LM-P Rev. 0 positioner card was replaced on 12/3/2014, the B MDAFW train would not have been able to fulfill all of its specified safety functions above 10% RIP for the FLB analysis where automatic flow-limiting operation to the faulted SG is required.

After the ALHV0005 failure on 12/3/20 14, the NLI-IOA-LM-P Rev. 0 positioner card was replaced with an identical NLI IOA-LM-P Rev. 0 positioner card with the same degraded condition associated with the undersized bridge rectifier.

However, ALHV0005 then operated normally with the degraded condition present until 8/12/2015 when the NLI-IOA-LM-P Rev. 0 positioner cards on both ALHV0005 and ALHV0007 were replaced with the NLI-lOA-LM-P hybrid positioner cards. After the ALHV0005 NLI-IOA-LM-P Rev. 0 positioner card was replaced on 8/12/2015, the removed card was tested by energizing it in a controlled environment simulating the most limiting DBA conditions to determine how much additional, energized operation time the NLI-1OA-LM-P Rev. 0 positioner card could have sustained before failure. The previously installed NLI-IOA-LM-P Rev. 0 positioner card, before being replaced on 8/12/20 15, could have continued operating for a time period greater than the required AFW system mission time. In addition, both ALHV0005 and ALHV0007 performed as expected during a controlled plant shutdown in response to Technical Specification 3.4.13 on excessive RCS leakage (reported in LER 2015-001-00 and Event Notification 51253) and the manual AFAS that subsequently occurred on 7/23/20 15 (reported in LER 20 15-002-00). This gives confidence that ALHV0005 would have been able to throttle or isolate at all times such that the ability of the ALHV0005 to perform its specified safety functions in MODE I above 10%

RIP would not have been challenged by the degraded condition present from 12/3/20 14 to 8/12/20 15.

In the case of the ALHV0007 failure on 8/11/2015, the valve successfully demonstrated the ability to throttle or isolate flow.

Therefore, the ability of ALHV0007 to perform its specified safety functions in MODE 1 above 10% RIP would not have been challenged by the degraded condition that existed for ALHV0007 since Refuel 20.

Impact During Plant MODE 1 below 10% RIP, and MODES 2 and 3 When placing the AFW system in service as part of a controlled plant cooldown or heat up, the MDAFP flow control valves are remotely manually closed prior to starting the A and B MDAFPs, as allowed by TS Surveillance Requirement 3.7.5.1.

During this evolution, core decay heat decreases to the point that short-term, automatic AFW flow to the SGs is not required to maintain adequate SG level. As discussed in the 5/23/1997 NRC letter attached to Technical Specification Task force Traveler TSTF-245-A Revision 1, it is recognized that the AFW system may be used during startup ofthe plant, normal shutdown, and hot standby conditions and that it is controlled [sic] band operated during these conditions in the manual mode ofoperation. In such situations, the AFW system is considered OPERABLE with regards to the limiting conditionfor operation and the 7S definitions ofOPERABLE/OPERABILITY. This provision is consistent with the Note associated with SR 3.5.7.1, as amplified by the associated TS Bases.

The hypothetical initiation of an FLB, coupled with a limiting single failure of the TDAFP while ALHV0007 was in a manually closed position below 10% RIP and in the described degraded condition, would have required ALHV0007 to be opened manually to meet the AFW system specified safety function of providhig the required flow to the SGs during the accident scenario. This would have been accomplished through local manual operator action to open the valve using the actuator handwheel. The automatic flow-limiting circuit demand signal would not have opened ALHV0007 due to the

failure of the NLI-IOA-LM-P Rev. 0 positioner card.

The most limiting scenario for MODES 1-3 under 10% RTP, while manual control of the MDAFP valves is allowed, is a design basis accident occurring immediately after plant shutdown when core decay heat is at its peak. In that situation, if the MDAFP flow control valves had already been remotely manually closed, operators would have over 45 minutes to open ALHV0007 before reaching 10% level in the A SG. A water level often (10) % is the minimum SG level that will prevent thermal shock to the SO internals after re-establishing flow. The value of 45 minutes was conservatively calculated by assuming feedwater to all four SOs is simultaneously unavailable. The amount of time available before reaching 10% SO level increases rapidly as the postulated time of the event after reactor shutdown increases. The normal operation guidance in procedure OTN-AL-0000 1 for manually starting the AFW pumps directs the operator to OPEN discharge control valves as needed.

Similarly, for accident conditions, the Emergency Operating Procedure (FOP) guidance in E-0, Reactor Trip or Safety Injection, for ensuring proper AFW valve alignment directs the operator to align AFW valves as necessary. EOP ES-0. 1, Reactor Trip Response, can also be entered from E-0. Step 6 of ES-0.1 checks SO feed flow status. If total feedwater flow is <285,000 lbm/hr, the Response Not Obtained column of ES-0.l directs the operator to Establish feed flow as necessary using AFW. Similarly, EOP FR-HI, Response to Loss of Secondary Heat Sink, directs the operator to CHECK AFW valve alignment if AFW flow has not been established, Field training for operation of the MDAFW flow control valves is covered under qualification standard, EOS-SAE-l8, to manually isolate feedwater to a faulted steam generator in accordance with EOP E-2, on the Secondary Watchstation qualification card.

Continued manual local operator use of ALHV0007 to gradually throttle flow using the valve actuator handwheel would also be needed during the following plant cooldown to RHR entry conditions. Local manual operator action to control ALHV0007 in this scenario is a reliable and credible operator action that can be completed within 45 minutes. However, based on the FLB analysis sensitivity cases described below, one MDAFW pump feeding two intact SOs is sufficient to meet the acceptance criteria of an FLB event. In view of this best estimate analysis from Westinghouse, it would not have been necessary for ALHV0007 to throttle or isolate flow at any time in order for the AFW system to successfully mitigate a DBA.

Based on the above, the ability of the B MDAFW train to perform its specified safety functions in MODES 1, 2, and 3 below 10% RTP would not have been challenged by the degraded condition of ALHV0007. In addition, due to the data obtained from testing performed on the ALHV0005 NLI-IOA-LM-P Rev. 0 positioner card that was replaced on 8/12/20 15, the ability of the AFW system to perform its specified safety functions would not have been challenged by the degraded condition present of ALHV0005 from 12/3/2014 to 8/12/2015. It has already been established that the AFW system would not have been able to perform all of its specified safety functions from 11/18/14 to 12/3/14 due to the degraded condition for ALHV0005 prior to the replacement of the NLI-IOA-LM-P Rev. 0 positioner card on 12/3/20 14.

Crediting of Local Manual Operator Action FSAR Section 10.4.9.1.1 notes that the AFW system has the capacity to be operated locally as an alternate, redundant means of feedwater control, in the unlikely event that the control room must be evacuated.

The guidance of NRC Information Notice 97-78, Crediting of Operator Actions in Place of Automatic Actions and Modifications of Operator Actions, Including Response Times, was used to evaluate the acceptability of the use of local manual actions below 10% RIP during a DBA. Information Notice 97-78 provides a list of nine items to be addressed for manual operator actions. In addition to the procedural guidance and training discussed above, the other seven items were addressed in the past operability evaluation for this event. In the manual AFAS event that occurred on 7/23/20 15 (reported in LER 2015-002-00), local manual operator action was successfully used to actuate ALHVOOJI following procedural guidance when it failed to remote manually open. During that event, local manual action to open ALHVOOI I was completed within 8.5 minutes.

Feedwater Line Break (FLB) Analysis Sensitivity Cases Using best estimate analysis assumptions in a post-event analysis performed by Westinghouse for the conditions present during plant operation between 11/18/2014 and 12/3/20 14, one MDAFW train would have been able to mitigate any event requiring decay heat removal until RHR operation. The limiting DBA (FLB) for AFW operation would have been mitigated by a single train of MDAFW feeding two intact steam generators. If certain key analysis inputs are set to their nominal values, the conservatisms built into the current analysis of record (AOR) for the FLB accident in FSAR Section 15.2.8 (with three SGs receiving MDAFW flow) render the AOR more limiting with respect to the analysis acceptance criteria than the situation under consideration where, due to the failed open position of flow control valve ALHV0005 and the postulated failure of the TDAFP, only 2 SGs receive MDAFW flow.

This reanalysis includes the use of a low-low SG water level reactor trip setpoint of 5% of narrow range span (NRS). The nominal SG low-low setpoint (field bistable settings) for an adverse containment environment is 21% of NRS. The nominal setpoint (21% of NRS) accounts for the worst case Channel Statistical Allowance (CSA) of 19.8% of NRS and also contains setpoint margin of 1.2% of NRS. The AOR uses a safety analysis limit (SAL) of 0% of NRS to account for these worst case channel errors. The CSA is calculated using multiple factors, including sensor and rack drift terms and environmental allowance (EA) biases. The amount of drift that had occurred after calibration during Refuel 20 until 12/3/20 14 was essentially zero. The worst case EA biases were also found to be very conservative. By using more realistic numbers from accident models, the EA biases were reduced significantly. These adjustments brought the CSA from 19.8% ofNRS to 10.8% of NRS.

Acceptable FLB analysis results were obtained from Westinghouse (i.e., no hot leg saturation) with two steam generators receiving MDAFW flow and with the steam generators at 5% of NRS when the reactor trips, which is below the 10.2% of NRS analysis limit obtained with a reduction of drift terms and EA biases. Two new cases have been analyzed, with and without offsite power. The assumed reactor trip setpoint, combined with a better-estimate decay heat model, with a better-estimate main steam safety valve model (which allows earlier secondary-side pressure relief), and with a reduced feedwater line fill time (as this volume is assumed to be emptied due to the break and needs to be refilled with AFW prior to any additional inventory reaching the SGs), coupled with the assumption that only 2 SGs receive MDAFW (as opposed to 3 in the AOR), yield an FLB transient that demonstrates hot leg saturation is precluded. Furthermore, these modeling changes result in accident consequences that are bounded by those of the current AOR for the plant (i.e., more margin to hot leg saturation is seen for these two new cases).

The degraded condition, determined to be a vendor design deficiency, was such that the bridge rectifiers for the valve operator motor fields for B train valves ALHV0005 and ALHV0007 could have and did fail, preventing further electrical operation of the valves from the main control board. The failure of ALHV0007 resulted in an inability to remotely feed the A steam generator from the B MDAFP. However, the ALHV0007 valve could still be manually manipulated locally using the valve handwheel. During the 8/1 1/20 15 plant event, operators chose to continue feeding the A steam generator using the TDAFP via its discharge valve, ALHV0008, TDAFP to S/G A.

AFW performance requirements during an FLB bound the mitigation function requirements performed by the AFW system for a Main Steam Line Break, Loss of Non-Emergency AC Power, Loss ofNormal Feedwater, SG Tube Rupture, and small break LOCA.

Risk Impact This event was also evaluated with the Callaway PRA model. The evaluation determined the incremental conditional core damage probability (ICCDP) of this event was less than IE-06; therefore, this event was of very low risk significance. Use of the PRA model to evaluate the event provides a comprehensive, quantitative assessment of the potential safety consequences and implications of the event, including consideration of alternative conditions beyond those analyzed in the FSAR.

of the safety function of the AFW system.

Beyond the examples given in 1983, an example of an event reportable as an unanalyzed condition that significantly degraded plant safety would be the discovery that a system required to meet the single failure criterion does not do so.

In another example, if fire barriers are found to be missing, such that the required degree of separation for redundant safe shutdown trains is lacking, the event would be reportable as an unanalyzed condition that significantly degraded plant safety.

On the other hand, if a fire wrap, to which the licensee has committed, is missing from a safe shutdown train but another safe shutdown train is available in a different fire area, protected such that the required separation for safe shutdown trains is still provided, the event would not be reportable.

As discussed above under the section on Feedwater Line Break (fLB) Analysis Sensitivity Cases, using best estimate analysis assumptions in a post-event analysis performed by Westinghouse for the conditions present between 11/18/2014 and 12/3/20 14, one AFW train would have been able to mitigate any event requiring decay heat removal until RHR operation. The limiting DBA (i.e., an FLB) for AFW operation would have been mitigated by a single train of AFW feeding two steam generators. Therefore, the event reported herein did not involve an unanalyzed condition that significantly degraded plant safety.

6.

CAUSE OF THE EVENT

following the AFAS on 12/3/20 14, all AFW pumps started and three of the four MDAFP flow control valves closed, as expected, due to the flow from the TDAFP. ALHV0005 failed to close due to the damaged bridge rectifier on the NLI-lOA LM-P Rev. 0 positioner card. Prior to that failure, the B MDAFP had been most recently run on 11/18/20 14 during Refuel 20 and both ALHV0005 and ALHV0007 operated satisfactorily. Following that surveillance, ALHV0007 was left fully open and de-energized. However, following Surveillance Job 13506361, ALHV0005 was left energized because the ZS/3 limit switch contacts did not open, as designed, with the valve in the fully open position,. The ZS/3 limit switch contacts should open and de-energize the valve when the valve is in the fully open position. Valve energization was evident by movement of ALHV0005 during subsequent TDAFP runs on 11/19/2014 and 11/20/2014. The extended energization of the bridge rectifier circuit led to accelerating aging and eventual bridge rectifier failure prior to being called upon on 12/3/20 14. All three of the other MDAFP flow control valves operated as expected throughout this event.

following the 12/3/2014 event, the NLI-1OA-LM-P Rev. 0 positioner card on ALHV0005 was replaced with an identical card with the same undersized bridge rectifier condition. The issue with ZS/3 limit switch contacts was also resolved during post-maintenance position indication retests on 12/3/20 14. After the NLI-1OA-LM-P Rev. 0 positioner card replacement on ALHV0005, no further failures of this valve occurred due to the degraded condition. ALHV0005 then operated normally with the degraded condition present until 8/12/2015 when the NLI-lOA-LM-P Rev. 0 positioner cards on both ALHV0005 and ALHV0007 were replaced with the NLI-IOA-LM-P hybrid positioner cards.

The direct cause of the ALHV0005 failure was a failure of a bridge rectifier on the valves electronic positioner circuit card.

Because the failure of the bridge rectifier is known to be from a design deficiency, ALHV0005 was not operable from 11/18/2014 to 12/3/2014.

In the case ofthe ALHV0007 failure, the valve successfully demonstrated the ability to throttle or isolate flow on 8/11/20 15.

As a result of the AFAS on 8/1 1/20 15, all AFW pumps started automatically. Both ALHV0005 and ALHV0007 stroked closed to control the high flow rate from all three AFW pumps running. The control room operators subsequently attempted to open ALHV0005 and ALHV0007 to secure the TDAFP. ALHV0005 opened, but ALHV0007 did not move due to the damaged positioner card bridge rectifier. ALHV0007 had been energized during the three-hour window following its initial closing such that sufficient degradation had accumulated for the bridge rectifier to fail. This failure to reopen does not call into question the ability of ALHV0007 to stroke closed from its normally open position at any time during or prior to the plant trip on 8/1 1/2 105. Therefore, the ability of the AFW system to perform its specified safety functions in MODE 1 above 2015 004 00

2015 004 00

NFL I-UFM 3A (1U-U1U)

Cal laway Plant MISSOURI October 12, 2015 ULNRC-0625$

U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-000 1 10 CFR 50.73(a)(2)(i)(B) 10 CFR 50.73(a)(2)(v)(D)

Ladies and Gentlemen:

DOCKET NUMBER 50-483 CALLAWAY PLANT UNIT 1 UNION ELECTRIC CO.

RENEWED FACILITY OPERATING LICENSE NPF-30 LICENSEE EVENT REPORT 2015-004-00 AUXILIARY FEEDWATER FLOW CONTROL VALVE INOPERABLE DUE TO FAULTY ELECTRONIC POSITIONER CARD The enclosed licensee event report is submitted pursuant to 10 CFR 50.73(a)(2)(i)(B) to report a condition prohibited by the Technical Specifications and pursuant to 10 CFR 50.73(a)(2)(v)(D) to report a condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident. The condition was due to a faulty auxiliary feedwater (AFW) flow control valve positioner card installed on one train of AFW (motor driven B train) with coinciding outages affecting the redundant AFW trains from November 18, 2014 through December 3, 2014.

This letter does not contain new commitments.

Sincerely, Barry L. Cox Senior Director Nuclear Operations Enclosure P0 Box 620 Fulton, Fy10 65251 AmerenFllissouri.corn STARS Alliance

ULNRC-0625$

October 12, 2015 Page 2 cc:

Mr. Marc L. Dapas Regional Administrator U. S. Nuclear Regulatory Commission Region IV 1600 East Lamar Boulevard Arlington, TX 76011-4511 Senior Resident Inspector Callaway Resident Office U.S. Nuclear Regulatory Commission

$201 NRC Road Steedman, MO 65077 Mr. L. John Klos Project Manager, Callaway Plant Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Mail Stop O8H4 Washington, DC 20555-000 1

ULNRC-0625 8 October 12, 2015 Page 3 Index and send hardcopy to QA File A160.0761 Hardcopy:

Certrec Corporation 6100 Western Place, Suite 1050 Fort Worth, TX 76107 (Certrec receives ALL attachments as long as they are non-safeguards and may be publicly disclosed.)

Electronic distribution for the following can be made via LER ULNRC Distribution:

F. M. Diya D. W. Neterer L. H. Graessle B. L. Cox I. E. Herrmann S. A. Maglio T. B. Elwood G. G. Yates Corporate Oversight Corporate Communications NSRB Secretary Performance Improvement Coordinator Resident Inspectors (NRC)

STARS Regulatory Affairs Mr. John ONeill (Pillsbury Winthrop Shaw Pittman LLP)

Missouri Public Service Commission

fIRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY 0MB: NO. 3150-0104 EXPIRES: 01/31/201 7 01-2014)

Estimated burden per response to comply with this mandatory collection request:

80 hours9.259259e-4 days 0.0222 hours 1.322751e-4 weeks 3.044e-5 months .

Reported lessons learned are incorporated into the licensing process and fed back to industry. Send comments regarding burden estimate to the FdA, Privacy and Information Collections Branch CT-S F53),

U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by LCEKSEE EET REPORT LER internet e-mail to infocollects.Resourcenrc.gov, and to the Desk Officer, I

I Office of Information and Regulatory Affairs, NEOB-1 0202, (3150-01 04), Office (See e e e f

- I k

c of Management and Budget, Washington, DC 20503. Ii a means used to

- I impose an information collection does not display a currently valid 0MB digits/characters for each block) control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

3. PAGE Callaway Plant Unit 1 05000483 1

OF 1 1

4. TITLE Auxiliary Feedwater Control Valve Inoperable Due To Faulty Electronic Positioner Card

5. EVENT DATE

6. LER NUMBER

7. REPORT DATE

8. OTHER FACILITIES INVOLVED FACILITY NAME DOCKET NUMBER MONTH DAY YEAR YEAR SEQUENTIAL REV MONTH DAY YEAR FACILITY NAME DOCKET NUMBER 08 11 2015 2015 004 00 10 12 2015

9. OPERATING MODE

11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR: (Check all that apply)

LI 202201(b)

LI 20.2203(a)(3)(i)

LI 50.73(a)(2)(i)(c)

LI 50.73(a)(2)(vii) 3 LI 20.2201(d)

LI 20.2203(a)(3)Øi)

LI 50.73(a)(2)(ii)(A)

LI 50.73(a)(2)(viii)(A)

LI 20.2203(a)(1)

LI 20.2203(a)(4)

LI 50.73(a)(2)(U)(B)

LI 50.73(a)(2)(viii)(B)

LI 20.2203(a)(2)(i)

LI 50.36(c)(1)0)(A)

LI 50.73(a)(2)Oii)

LI 50.73(a)(2)(ix)(A) 10 POWER LEVEL 20.2203(a)(2)(ii)

LI 50.36(c)(1)(ii)(A)

LI 50.73(a)(2)(iv)(A)

LI 5D.73(a)(2)(x)

LI 20.2203(a)(2)(iii)

LI 50.36(c)(2)

LI 50.73(a)(2)(v)(A)

LI 73.71(a)(4)

LI 20.2203(a)(2)Cv)

LI 50.46(a)(3)ti)

LI 50.73(a)(2)(v)(B)

LI 73.71(a)(5) 0 LI 20.2203(a)(2)(v)

LI 50.73(a)(2)(i)(A)

LI 50.73(a)(2)(v)(C)

LI OTHER LI 20.2203(a)(2)(vi) 50.73(a)(2)(i)(B) 50.73(a)(2)(v)(D)

Specify in Abstract below or in 1.

DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):

The auxiliary feedwater (AFW) system [EIIS system identifier BA] automatically supplies feedwater to the steam generators to remove decay heat from the reactor coolant system upon the loss of the main feedwater (MfW) [EIIS system identifier SJ] supply. The motor-driven AFW pumps (MDAfPs) [EIIS component identifier P] start automatically upon low-low steam generator water level in any steam generator, upon trip of both turbine-driven MfPs, upon actuation of Anticipated Transient Without Scram Mitigation System Actuation Circuitry (AMSAC), or upon actuation by the Loss of Coolant Accident (LOCA) sequencer or shutdown sequencer. The turbine-driven AFW pump (TDAFP) is automatically started by steam generator water level low-low in any two steam generators, undervoltage on either of the 4160V safety-related busses, or upon actuation of AMSAC. All three AFW trains can also be manually actuated.

The MDAfPs (PALO IA and PALO YB) supply flow to the steam generators through a normally open motor-operated flow control valve [EIIS component identifier FCVJ that automatically throttles flow. A downstream flow orifice prevents pump run-out conditions under all steam generator pressure conditions. One MDAFP at full flow is sufficient to remove decay heat and cool the unit to residual heat removal (RHR) entry conditions for a normal plant shutdown. The AFW system design is such that it can perform its function following a feedwater line break (FLB) between the MFW isolation valves and the reactor containment building, combined with a loss of offsite power following turbine trip, and a single active failure of the TDAFP. This results in the minimum assumed flow to the intact steam generators. One MDAFP is not, by itself, capable of delivering 100% of the AFW flow assumed in the FLB safety analysis of record in FSAR Section 15.2.8.

One MDAFP would deliver to the broken MFW header at a flow rate throttled by the motor-operated flow control discharge valve until the problem was detected, and flow terminated by the control room operators. Sufficient flow would be delivered to the intact steam generator by the throttled flow from the motor-driven AFW pump feeding the affected steam generator (SG) plus the equally split flow to two intact SGs from the other MDAFP.

In order for the MDAfPs to be operable during normal power operation while the AFW system is in automatic control or above 10% RTP, the applicable discharge flow control valves (ALHV0005 and ALHV0007 for PALOIB; ALHV0009 and ALHVOOI1 for PALO1A) must be operable and verified to be in the fully open position. Upon actuation of the AFW system, these flow control valves either throttle or isolate flow from the A and B MDAfPs to their respective SGs, depending on the accident scenario and the level of TDAFP flow available. During a postulated design basis accident (DBA) scenario where SG pressure is initially low, then increases, the AFW flow control valves would actuate to a more open position as SO pressure increases to maintain a constant rate of AFW flow. However, this additional actuation of the AFW flow control valves to a more open position, following their initial actuation to throttle or isolate, is not credited in any accident analysis. As documented in Calculation AL-29, Rev. 003B, Auxiliary Feedwater System Performance During a feedline Break, increases in SG pressure are assumed to result in decreased AFW flow. Additional actuation of the AFW flow control valves to a more open position to maintain a constant AFW flow rate is not credited.

Additional throttling of the AFW flow control valves is required following a DBA during the subsequent plant cooldown to RHR entry conditions. The AFW flow control valves are not credited to prevent pump run-out conditions for the MDAfPs. A flow orifice downstream of each AFW flow control valve is credited for AFW pump run-out protection.

failure of the TDAFP after the flow control valves have already throttled, or isolated, such that they would then be required to reopen is not a postulated scenario in the accident analysis. Per the Callaway licensing basis described in FSAR Sections 3.1.1.2 and 15.2.8, failure of the TDAFP is only postulated to occur as a single failure assumption upon initial demand, and as such, the MDAFP flow control valves will remain open to provide the required flow from the MDAFPs to the SOs.

The MDAfPs also have a normal operation function and remain operable with the applicable discharge flow control valves throttled by operator action from the control room to maintain steam generator levels during plant heatup, cooldown, or if started due to an Auxiliary feedwater Actuation Signal (AFAS) or manually started in anticipation of an AFAS. Therefore, correct valve positions in these plant states below 10% RIP vary depending upon plant conditions and are verified per Technical Specification (TS) Surveillance Requirement (SR) 3.7.5.1. SR 3.7.5.3 verifies that AFW can be delivered to the appropriate steam generator in the event of any accident or transient by demonstrating that each automatic valve in the flow

path actuates to its correct position on an actual or simulated actuation signal. This SR includes the requirement to verify that each MDAFP motor-operated discharge flow control valve (ALHV0005 and ALHV0007 for PALO1B, and ALHV0009 and ALHVOO1 1 for PALO IA) limits the flow from the associated MDAFP to its respective steam generator to less than or equal to 300 gpm. Each MDAFP flow control discharge valve is required to be operable per TS 3.7.5 for MODES 1,2, and 3.