05000364/LER-2015-001

LER-2015-001, Turbine Driven Auxiliary Feedwater Pump in a Condition Prohibited by Technical Specifications due ,to a Design Issue

Joseph M. Farley Nuclear Plant
Event date:	01-09-2015
Report date:	01-14-2016
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat
3642015001R01 - NRC Website

LER 15-001-01 for Farley, Unit 2, Regarding Turbine Driven Auxiliary Feedwater Pump in a Condition Prohibited by Technical Specifications Due to a Design Issue

ML16014A215
Person / Time
Site:	Farley
Issue date:	01/13/2016
From:	Gayheart C A Southern Co, Southern Nuclear Operating Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NL-16-0039 LER 15-001-01
Download: ML16014A215 (7)

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (1--5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. It a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

2015 - 001 - Joseph M. Farley Nuclear Plant, Unit 2 05000-364 01

PLANT AND SYSTEM IDENTIFICATION

Westinghouse - Pressurized Water Reactor Energy Industry Identification Codes are identified in the text as [XX].

DESCRIPTION OF EVENT

On 1/9/2015 at 1255 CST with Unit 2 operating at 100 percent thermal power the Turbine Driven Auxiliary Feedwater (TDAFW) pump was declared inoperable based on a causal investigation for a November 2014 surveillance test failure. The causal analysis identified that a design vulnerability existed which was the cause of both the November failure and a similar April 2014 failure. It was determined that a reasonable assurance of operability could not be supported, and Technical Specification (TS) 3.7.5 Required Action B.1 was entered.

In April of 2010 during Refueling Outage 2R20, the Woodward 505 Digital Turbine Control System (DTCS) [65] was installed on the TDAFW pump, replacing the existing governor system. In November of 2011 during Refueling Outage 2R21, a vulnerability identified in 2011 led to a site-developed design change that added a second (parallel) start signal to the governor controller. The original start signal input to the Woodward 505 DTCS is from a steam admission valve limit switch, and could be delayed up to ten seconds after the demanded start as the valve stroked. The design change added a second start signal for redundancy which decreased the timing of start signals to the controller. This second start signal was directly tied to the handswitch and the automatic start signal. This modification removed the delay between the demand signal initiation and the Woodward 505 DTCS receiving the start signal input.

In 2014, the TDAFW pump failed to start on two separate occasions in April and November.

Investigations failed to identify the configuration setting design as the cause. On both occasions following troubleshooting and maintenance, the system successfully passed the surveillance tests.

Outside of these two failures, there were 58 successful starts during the period from the 2011 design change to January 2015.

In January 2015 during causal analysis for the November 2014 failure, a design vulnerability was identified with the governor control system which created a configuration within the controller software that had the potential for a normal and expected trip signal to be unexpectedly recognized as a shutdown signal during the start sequence. The result of this design deficiency was an intermittent failure mode linked to a timing relay such that if the turbine was in a specific configuration when the timer actuated at 10 seconds a shutdown signal would be generated. This failure mode is the most likely cause of the failure to start events during the April and November 2014 surveillances.

On 1/10/2015 a temporary modification was completed to increase the timer setpoint to eliminate the vulnerability. Post-modification testing and surveillance testing was completed satisfactorily and the TS 3.7.5 was exited on 1/10/2015 at 1806.

-NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION 11-2(115) zr 41 '

• F LICENSEE EVENT REPORT (LER)

CONTINUATION SHEET

APPROVED BY ON1B: NO. 3150.0104 EXPIRES: 10/31/2018 Reported lessons learned are incorporated into the licensing process and fed back to industry Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555.0001, or by internet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

2015 - 001 - 05000-364 01

CAUSE OF EVENT

The cause of the design vulnerability in the system was the absence of any documented basis for a Magnetic Pick Up (MPU) override timer setting in the original design documentation. This basis would have provided the necessary information to develop the design change correctly in 2011.

REPORTABILITY ANALYSIS AND SAFETY ASSESSMENT

From November 18, 2011 through January 10, 2015 the TDAFW pump could not be relied on to start for some plant conditions in the accident analysis for a Main Steam Line Break (MSLB). Other accident analysis conditions were found to be unaffected. The TDAFW start is assumed to be affected when in mode 3 at lower steam generator pressures. Therefore, the Auxiliary Feed Water (AFW) system was not capable of performing its specified safety functions for MSLB and was inoperable for a period of time longer than allowed by Technical Specification (TS) 3.7.5. This is reportable as an operation or condition prohibited by TS per 10 CFR 50.73(a)(2)(i)(B).

During periods of time when a Motor Driven Auxiliary Feed Water (MDAFW) pump was taken out of service, with the TDAFW pump considered inoperable, the plant was inadvertently left with only a single AFW train in operation. The TS Bases and the MSLB accident analysis require availability of at least two of three AFW pumps for the AFW system to perform its safety function. Therefore this condition is also reportable per 10 CFR 50.73(a)(2)(v)(B) as condition that could have prevented the fulfillment of a safety function of a system needed to remove residual heat.

A past operability review is being finalized and the LEA will be supplemented if information in this LEA is affected.

CORRECTIVE ACTION

A temporary modification was completed to adjust the timer to eliminate the vulnerability. This modification will be made permanent through the design change process. Design documents will be revised to add missing information regarding the basis for a timer setting which led to the design issue.

ADDITIONAL INFORMATION

Other system affected: No systems other than those mentioned in this report were affected by this event.

Commitment Information: This report does not create any licensing commitments Previous Similar Events: None Reported lessons teamed are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by internet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503.11a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

2015 - 001 - 05000-364 01

SUPPLEMENT

Based upon further analysis and completion of a past operability review, SNC has concluded that the design flaw in the governor control system would not have resulted in either a condition prohibited by TS or a loss of safety function. The analysis concluded that the TDAFW system would have performed its design basis functions in the case of an actual start demand. The design flaw introduced a vulnerability of the pump potentially failing to restart in short proximity to a first demand start for no more than one hour after the pump was secured. This conclusion is based on troubleshooting test data (recorder), surveillance testing data and start demands (i.e., 59 due to testing and 1 due to a lightning strike) since implementation of the governor controls design change, maintenance history on the steam admission valve, and response time testing.

There have been no occurrences in which the TDAFW pump failed to start on the first attempt including an actual loss of power event on Unit 2 in which an actual auto start was generated for the TDAFW pump. The pump successfully started during this event from a blackout signal and successfully ran until secured by operations The health and safety of the public was not adversely affected during the limited time that the vulnerability existed after a first demand start of the TDAFW pump because both trains of the Motor-Driven Auxiliary Feedwater System were always available during and after starting the TDAFW pump for surveillance or post-maintenance testing.