05000483/LER-2020-005, Inoperable Isolation Valve Between Safety-Related Essential Service Water and Nonsafety-Related Service Water
| ML20322A166 | |
| Person / Time | |
|---|---|
| Site: | Callaway  |
| Issue date: | 11/17/2020 |
| From: | Ameren Missouri, Union Electric Co |
| To: | Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML20322A164 | List: |
| References | |
| ULNRC-06619 LER 2020-005-00 | |
| Download: ML20322A166 (4) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 4832020005R00 - NRC Website | |
text
Abstract
During troubleshooting of momentary alarms and flickering handswitch indications that were received during closure stroking of the upstream isolation valve (EFHV0024) between safety-related Essential Service Water (ESW) system train B and the nonsafety-related Service Water (SW) system, it was discovered that a fuse holder in the supply breaker was not holding a control power fuse for EFHV0024 securely, thereby causing intermittent interruptions in the power supplied to the valve.
Due to the degraded condition of the fuse holder, its seismic qualification was not assured. This rendered EFHV0024 inoperable during the period when the degraded condition existed. While redundant valve EFHV0026 remained OPERABLE during this period, the capability to automatically isolate the SW system from ESW system train B was not
~ingle-failure proof, and actions to provide passive isolation by closing and removing power from EFHV0024 or EFHV0026 were not performed. This rendered ESW train B inoperable and resulted in a condition or operation prohibited by Technical Specifications, as ESW train B was not restored to OPERABLE status to exit the applicable Required Actions within the specified Completion Times.
~s Control Room indications of a failure of either isolation valve to actuate to its closed position would have alerted Operators to manually isolate the affected valve(s), if needed, the degraded condition was of minor safety significance.
ESW train B was restored to OPERABLE status by correcting the degraded condition upon its discovery.
- 1.
DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):
YEAR 2020 SEQUENTIAL NUMBER
- - 005 REV NO.
- - 00 The event reported in this LER involves the Essential Service Water (ESW) system [EIIS: Bl]. The ESW system provides a safety-related flow of cooling water to transfer residual heat and heat from components to the Ultimate Heat Sink (UHS) [EIIS: BS]. The ESW system also provides a non-preferred safety-related source of makeup for the Spent Fuel Storage Pool [EIIS: DA] and a non-preferred safety-related supply of Auxiliary Feedwater [EIIS: BA] to the steam generators.
The ESW system consists of two independent and redundant trains. During normal operation, the loads in either or both ESW system trains may be supplied from the nonsafety-related Service Water (SW) system [EIIS: KG], which is cross-connected to the ESW system trains. In order to prevent loss of UHS inventory and ensure pressure and flow in the ESW system trains are sufficient to meet their required safety functions, upon receipt of a Safety Injection Signal (SIS) [EIIS: JE], loss of offsite power (LOOP), or Auxiliary Feedwater Actuation Signal (AFAS) [EIIS: JE] with low suction pressure [EIIS: PT] indication, both ESW system trains are actuated and safety-related isolation valves [EIIS: ISV] isolate nonsafety-related loads and the SW system from ESW system trains.
Each ESW system train is provided with two motor-operated valves in series for isolation from the SW system. Successful closure of either valve will accomplish the isolation function. ESW system train B is provided with an upstream isolation valve EFHV0024 and a downstream isolation valve EFHV0026. Class 1 E 480-V electrical power [EIIS: EC] for the EFHV0024 motor actuator is provided from onsite [EIIS: EK] and offsite safety-related AC electrical sources train A, while the Class 1 E 480-V electrical power for the EFHV0026 motor actuator is provided from onsite and offsite safety-related AC electrical sources train B.
Technical Specification (TS) 3.7.8, "Essential Service Water System (ESW)," provides the Limiting Condition for Operation (LCO),
Required Actions, and Surveillance Requirements (SRs) for the ESW system.
- 2.
INITIAL PLANT CONDITIONS
At the time of the event, Callaway was operating in Mode 1 at 100% power.
- 3.
EVENT DESCRIPTION
On September 18, 2020, troubleshooting was being performed to determine the cause of momentary Engineered Safety Features Actuation System (ESFAS) [EIIS: JE] alarms and flickering indications on the valve handswitch [EIIS: HIS] that had been previously observed during closure strokes of EFHV0024 that were performed on July 22, 2020, August 17, 2020, and September 12, 2020.
During troubleshooting, the secondary control power fuse [EIIS: FU] in the supply breaker [EIIS: BKR] cubicle for EFHV0024 was found to be loose in its fuse holder [EIIS: FUB]. The loose connection between the fuse and its holder had been causing intermittent interruptions in the power supplied to the EFHV0024 motor operator, which in tum had caused the alarms and flickering handswitch indications. The as-found condition of the fuse holder was determined to be degraded, as the prongs that hold the fuse in place were found to be loose. The degraded condition was determined to have existed from July 22, 2020 to September 18, 2020, when it was corrected.
I
- 4.
ASSESSMENT OF SAFETY CONSEQUENCES
The degraded condition of the fuse holder reported in this LER did not significantly degrade plant safety.
ESW is credited to perform safety-related functions required for achieving and maintaining safe shutdown, removing residual heat, and mitigating the consequences of accidents.
During the period when the degraded condition existed, both EFHV0024 and the redundant isolation valve EFHV0026 successfully actuated to the safety-related closed oosition each time that they were stroked closed. No work activities were oerforrned on NRG FORM 3668 (08-2020)
Page i of! U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY 0MB: NO. 3150-0104 EXPIRES: 08/31/2023 (08-2020)
- 3. LERNUMBER YEAR Callaway Plant, Unit No. 1 05000-483 2020 SEQUENTIAL NUMBER
- - 005 REV NO.
- - 00 EFHV0026 that would have rendered it inoperable at any time during this period, and both the onsite and offsite sources for safety-related AC electrical sources train B were capable of providing control power for EFHV0026 during this period. In consideration of the above, the degraded condition did not cause a loss of safety function regarding the capability to isolate the SW system from ESWtrain B.
However, as stated in General Design Criterion 44, "Cooling water," of 10 CFR 50 Appendix A, "General Design Criteria for Nuclear Power Plants," "Suitable redundancy in components and features, and suitable interconnections, leak detection, and isolation capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure." In addition, as described in Callaway Plant Final Safety Analysis Report (FSAR) section 3.1.2, "Additional Single-Failure Assumptions," in designing for and analyzing for design basis accidents (i.e., large break loss-of-coolant accident (LBLOCA), main steam line break, main feedwater line break, rod ejection, locked [Reactor Coolant Pump] RCP rotor or RCP shaft break, fuel handling accident, or steam generator tube rupture), one of the analysis assumptions is that "for a LBLOCA, for additional safety no credit is taken for the functioning of non-seismic Category I components."
It is not evident that in its as-found degraded condition, the fuse holder for EFHV0024 remained seismically qualified (i.e., capable of withstanding a seismic event and remaining capable of performing its required safety function). If a seismic event were to produce vibration sufficient to dislodge the fuse from the holder, the resulting sustained loss of secondary control power would have prevented EFHV0024 from being capable of actuating to its safety-related closed position. Based on the above, during the period when the degraded condition existed, in regards to accident mitigation, only EFHV0026 was able to be credited to actuate to its closed position for isolation of the SW system from ESW system train B.
TS SR 3.7.8.2 requires periodic verification that each ESW automatic valve in the flow path that is not locked, sealed, or otherwise secured in position, actuates to the correct position on an actual or simulated actuation signal. The Bases for TS SR 3. 7.8.2 state in part 'When either of the series isolation valves in the supply or return lines to/from the normal service water system is closed with power removed, this Surveillance no longer applies to the affected isolation valves since the valves would no longer be in the flow path." In accordance with these provisions, the safety-related function to isolate the SW system from ESW train B may be accomplished by closing either EFHV0024 or EFHV0026 and removing power to the operator of the closed valve.
Although EFHV0024 and/or EFHV0026 were closed on several occasions during the period when the degraded condition existed, power was not removed from the valve operators on any of these occasions. Therefore, during the entire 58-day period when the degraded condition existed, the capability to isolate the SW system from ESW system train B was not single-failure proof, and ESW train B was therefore inoperable Based on the following, the condition was of minor safety significance.
In the event of a single failure of EFHV0026 and/or a seismically-related failure of EFHV0024 to actuate to the safety-related closed position upon receipt of a SIS, LOOP, or AFAS with low suction pressure, an ESFAS alarm and lack of closure indication on the handswitch(es) for the affected valve(s) would have alerted Operators in the Control Room that the affected valve(s) did not close. If necessary, the affected valve(s) would then have been closed manually using the valve handwheel(s) to isolate the SW system from ESW system train B.
A nonsafety-related check valve in series with EFHV0024 and EFHV0026 provides defense-in-depth for prevention of backflow through the SW system to ESW train B isolation pathway. Page ~of~
U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY 0MB: NO. 3150-0104 EXPIRES: 08/31/2023
- 1. FACILITY NAME
- 2. DOCKETNUMBER
- 3. LERNU\\IIBER Callaway Plant, Unit No. 1 05000-483
- 5.
REPORTING REQUIREMENTS
YEAR 2020 SEQUENTIAL NUMBER
- - 005 This LER is submitted pursuant to 50. 73(a)(2)(i)(B) as an operation or condition prohibited by Technical Specifications.
REV NO.
- - 00 TS LCO 3. 7.8 requires two trains of ESW to be OPERABLE during Modes 1, 2, 3, and 4. As described in the Bases for TS 3.7.8, "The safety-related function associated with the mitigation of DBAs and transients analyzed in FSAR Chapters 6 and 15 is covered by this LCO. "
EFHV0024 was inoperable due to the degraded condition for a period of approximately 58 days while the plant was operating in Mode 1. The period of past inoperability of ESW train B exceeded the specified 72-hour Completion Time for restoration of the train to OPERABLE status in accordance with TS 3.7.8 Required Action A.1. In addition, with TS 3.7.8 Required Action A.1 not being met within its associated Completion Time, TS 3. 7.8 Required Actions 8.1 and 8.2 would have required that the unit be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />, respectively. As neither TS 3.7.8 Required Actions 8.1 nor 8.2 were completed within their respective Completion Times, the degraded condition resulted in a condition or operation that was prohibited by Technical Specification 3.7.8.
As noted above, the degraded condition was of minor safety significance and therefore did not cause the condition of the plant, including its principal safety barriers, to be seriously degraded, nor was it an unanalyzed condition that significantly degraded plant safety.
Based on the above, this event is being reported as an operation or condition prohibited by Technical Specifications in accordance with 10 CFR 50.73(a)(2)(i)(B).
- 6.
CAUSE OF THE EVENT
The event has been attributed to vibration that occurred during operation of the supply breaker, which caused the prongs that held the secondary control power fuse for EFHV0024 to gradually loosen in the fuse holder between July 22 and September 18, 2020. A photograph that was taken during periodic inspection and cleaning of the breaker enclosure on July 29, 2020 shows that the fuse was in full contact with the fuse holder prongs at that time, but the fuse was found to be only loosely held by the prongs when examined during troubleshooting on September 18, 2020. Although the exact time that the degraded condition of the fuse holder began cannot be determined, the multiple occasions between July 22, 2020 and September 18, 2020 when momentary ESFAS alarms and flickering handswitch indications occurred during closure of isolation valve EFHV0024 provide firm enough evidence that the fuse holder prongs did not hold the fuse securely enough to ensure the capability of the valve to withstand a seismic event and still be capable of performing its required safety function. There is no firm evidence that the degraded condition existed before the ESFAS alarm was received and flickering handswitch indication was first observed on July 22, 2020.
- 7.
CORRECTIVE ACTIONS
During the troubleshooting that was performed on September 18, 2020, loose screws in the fuse holder were tighened to restore the prongs to their design condition, so that the fuse would be securely held in place. Subsequent closure stroking of EFHV0024 was performed satisfactorily without receiving the intermittent alarms, which confirmed that the inoperable condition had been corrected.
- 8.
PREVIOUS SIMILAR EVENTS
A review of LERs from the past three years for Callaway found no other events involving loose fuses in supply breakers for equipment required to be OPERABLE by Technical Specifications. Page~of~