05000317/LER-2001-002
| Calvert Cliffs, Unit 1 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 3172001002R00 - NRC Website | |
I. � DESCRIPTION OF EVENT On September 5, 2001, with both Units 1 and 2 operating in Mode 1 at 100 percent power, an error was identified in an Appendix R related calculation. The error was identified in response to an observation during Calvert Cliffs Nuclear Power Plant's triennial Fire Protection Inspection. Specifically, it was identified that steam generator blowdown (SGBD) flow was not accounted for in the calculation developed to determine the time to steam generator dry-out following an Appendix R event. As a result, the time to steam generator dry-out is less than what was previously assumed in the calculation.
The calculation is a bases document for Abnormal Operating Procedures (AOPs) utilized to safely shutdown the plant post-fire, as required per the regulatory requirements promulgated in 10 CFR Part 50, Appendix R, Section III.L "Alternative and Dedicated Shutdown Capability." Maintaining the design function of the steam generators (remove heat from the Reactor Coolant System) during Appendix R scenarios is necessary to preserve the Appendix R shutdown function performance goal of achieving and maintaining decay heat removal. In order to maintain the design function of the steam generators during an Appendix R event, certain operator actions must be performed within a critical time frame. Specifically, auxiliary feedwater (AFW) flow must be established prior to steam generator dry-out.
The subject calculation, which was performed in July 1989, determined that steam generator dry-out would occur approximately 47 minutes into an Appendix R event. Therefore, the associated AOPs were sequenced to ensure that the critical steps necessary to restore AFW (i.e., restore reactor coolant heat removal function) were complete in less than 47 minutes. In fact, the procedures specified a minimum completion time of 30 minutes for AFW restoration thereby providing a 17-minute margin. However, since the calculation did not account for loss of steam generator inventory via SGBD, the critical time determined in the calculation was non-conservative.
A preliminary analysis of the effect of SGBD flow on the time to steam generator dry-out indicated approximately 31 minutes at 100 gpm and approximately 26 minutes at 180 gpm (maximum SGBD flow allowed per Operating Instruction 0I-8A "Blowdown System"). Since the proceduralized targeted time for initiating AFW in an Appendix R event is 30 minutes, when SGBD flow exceeds 100 gpm, adequate time may not be available for operators to initiate AFW flow such that Appendix R criteria are met.
Calvert Cliffs Nuclear Power Plant's position on AOP time lines is that AOP-9A, "Control Room Evacuation and Safe Shutdown due to a Severe Control Room Fire," addresses the most bounding fire scenario in terms of manpower needs and required operator actions, and therefore has the longest time line.
Therefore, if the time requirements of AOP-9A can be accomplished within the current engineering evaluation restrictions, then the time requirements of all other AOP-9 series procedures will be less than or equal to the most conservative performance times of the current validated AOP-9A.
Recorded AFW restoration times for the current revisions of the AOP-9A procedures are 22 and 25 minutes for Units 1 and 2, respectively. These times are within the acceptable limits (26 minutes) of the preliminary analysis even if maximum blowdown flow (180 gpm) is assumed. However, the recorded AFW restoration time for a recent walkthrough of AOP-9B-1, "Safe Shutdown due to a Severe Cable Spreading Room Fire," was 48 minutes.
A post-walkthrough critique identified several issues that contributed to delaying AFW restoration. Delays were caused by procedure errors as well as operating plant conditions that would not exist during an actual Appendix R event (e.g., noise level at the auxiliary safe shutdown panel caused by the operating control rod drive motor-generator sets). During an actual event, one of the first steps in the procedure requires shutting down the motor-generator sets to ensure control rods were inserted. This action would eliminate the source of the elevated noise level. Adjusting the AOP-9B-1 times to eliminate delays due to the noise levels speculatively results in an AFW restoration time of approximately 36 minutes.
A review of total SGBD flow data for Unit 1 and Unit 2 over the last three years (September 1, 1998 through September 21, 2001), indicated a maximum SGBD flow of 180 gpm for Unit 1 and 180 gpm for Unit 2.
Average SGBD flows were approximately 68 gpm for Unit 1 and 75 gpm for Unit 2. The total SGBD flow rate at the time of the event (September 5, 2001) was 80 gpm for Unit 1 and 80 gpm for Unit 2.
II. CAUSE OF EVENT
This event was caused by errors in the steam generator dry-out calculation coupled with errors in the associated procedure, AOP-9B-1. A formal root cause investigation is underway to determine the causes of these errors. Preliminary results indicate that in both cases, errors were introduced due to human performance issues. Most likely, the errors in AOP-9B-1 were introduced in September 1999 when the procedure was not upgraded to make it consistent with the AOP-9A procedures. In revising Appendix R analyses, changes to the Interactive Cable Analysis necessitated the AOP procedural upgrade. Due to personnel changes within the procedure writing group during that time, the upgrade was never completed and the errors were not discovered. A walkthrough of AOP-9B-1 was not performed since it was assumed the time-line was bounded by the AOP-9A procedure which had already been successfully walked-through.
The errors in the Appendix R steam generator dry-out calculation were also most likely the result of human performance issues. Since the basis calculation (loss of feedwater — design basis analysis) did not account for blowdown, blowdown flow was also omitted from the Appendix R calculation. Blowdown flow was not included in the loss of feedwater-design basis analysis calculation because it was very small at the time the calculation was developed, and was therefore considered negligible. However, as blowdown flow increased over time, the associated calculations were not revisited.
III. ANALYSIS OF EVENT
As stated above, the steam generator dry-out calculation is a bases document for AOPs utilized to safely shutdown the plant in the event of an Appendix R fire. The specific Appendix R shutdown function performance goal affected involves the reactor heat removal function, achieving and maintaining decay heat removal. Maintaining the design function of the steam generators (remove heat from the Reactor Coolant System) during Appendix R scenarios is necessary to ensure this shutdown function is preserved. In order to maintain the design function of the steam generators during an Appendix R event, AFW flow must be restored within 26 minutes assuming maximum blowdown flow and 31 minutes assuming blowdown flow at 100 gpm.
The current timed walkthrough for all AOPs other than AOP-9B-1 is within the most limiting (26-minute) requirement. For AOP-9B-1, the timed walkthrough (August 31, 2001) recorded 48 minutes for AFW restoration which exceeds the dry-out requirement.
A post-walkthrough critique (August 31, 2001) determined that AFW restoration was delayed due to procedure errors as well as operating plant conditions. Operations personnel were immediately notified of the procedure errors. Although delays associated with actual procedure errors are valid, it is reasonable to reduce the 48- minute AOP-9B-1 walkthrough time by some amount due to the effects of the noise levels. Assuming a reasonable reduction of 25 percent (12 minutes) due to delays associated with plant conditions (e.g., repeating steps due to noise levels from the motor generator sets near the auxiliary shutdown panel), a more realistic yet speculative value of 36 minutes, may be assumed. However, this time still exceeds the allowed time of 26 minutes if maximum SGBD flow is assumed.
The AOP-9 series procedures have been reviewed by Operations. There were no significant errors identified in any of the procedures other than AOP-9B-1. Therefore, the times recorded in AOP-9A-1 and AOP-9A-2 remain valid, and bound all procedures other than AOP-9B-1. As a result, this event is only applicable to a severe Cable Spreading Room fire in Unit 1.
A review of total SGBD flow data for Unit 1 and Unit 2 over the last three years (September 1, 1998 through September 21, 2001) indicated that SGBD was occasionally operated at the maximum flow (180 gpm).
Average flows were approximately 68 gpm for Unit 1 and 75 gpm for Unit 2. The total SGBD flowrate at the time of the event (September 5, 2001) was 80 gpm for Unit 1 and 80 gpm for Unit 2.
At the time of the event (September 5, 2001), it is reasonable to assume that AFW restoration would occur within the minimum required time (approximately 31 minutes). The basis for this assumption is two fold. First, actual SGBD flow at the time of the event was 80 gpm for Unit 1 and Unit 2. Second, procedure errors in AOP-9B-1 had been identified and discussed by Operations personnel on August 31, 2001. However, since the calculation error existed since July 1989, and the AOP-9B-1 procedure errors were introduced in September 1999, the approximate times of occurrence are September 1999 through August 31, 2001.
Therefore, this event is considered reportable in accordance with 10 CFR 50.73(a)(2)(v). The guidance of NUREG-1022, Revision 2, specifies that the level of judgement for reporting an event or condition under this criterion is a reasonable expectation of preventing fulfillment of a safety function. In this case, it is reasonable steam generators to remove decay heat would not be fulfilled.
NUREG-1022, Revision 2 further states that the criterion covers events or conditions where structures, components, or trains of a safety system could have failed to perform their intended function because of: one or more personnel errors, including procedure violations; equipment failures; inadequate maintenance; or design analysis, fabrication, equipment qualification, construction, or procedural deficiencies. In this case, personnel errors including design analysis and procedural deficiencies in AOP-9B-1 would most likely prevent the steam generators from performing their intended safety function in the event of a severe Cable Spreading Room fire in Unit 1. The intent of criterion 10 CFR 50.73(a)(2)(v), is to capture those events where there would have been a failure of a safety system to properly complete a safety function, regardless of whether there was an actual demand.
A significance determination process assessment was performed for the subject event. This assessment determined a Core Damage Frequency change of less than 1.0E-6/year. The Large Early Release Frequency change associated with this issue is less than 1.0E-7/year.
IV. � CORRECTIVE ACTIONS A. Abnormal Operating Procedure, AOP-9B-1 has been revised, removing the significant errors identified during the walk-through. Additional changes are planned, including new time line validations, which are tracked by CCNPP's corrective action process.
B. A station operability determination has been performed. Compensatory measures were established limiting SGBD flow to a maximum of 100 gpm, or stationing a dedicated operator to quickly secure SGBD if plant conditions require flow above 100 gpm. Station procedure 0I-8A has been changed to accommodate the compensatory actions.
C. A formal root cause assessment is in progress to determine the causal factors, evaluate generic implications and establish additional corrective actions as required.
V. � ADDITIONAL INFORMATION A. Affected Component Identification:
IEEE 803 � IEEE 805 Component or System � EIIS Funct � System ID Auxiliary Feedwater System � HX � BA Steam Generator Blowdown � HX � WI Steam Generator � HX � BA
B. Previous similar events:
A review of Calvert Cliffs' licensee event reports over the past several years was performed. The review did not identify any similar reportable events where the design function of a structure, system, and component required to achieve safe shutdown post Appendix R event was challenged due to a calculation error.