05000382/LER-1917-001, Regarding Both Trains of Emergency Core Cooling System Inoperable Due to Inadvertently Performing Maintenance on Train B Resulting in Event or Condition That Could Have Prevented Fulfillment of a Safety Function
| ML17128A085 | |
| Person / Time | |
|---|---|
| Site: | Waterford  |
| Issue date: | 05/04/2017 |
| From: | Jarrell J Entergy Operations |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| W3F1-2017-0041 LER 17-001-00 | |
| Download: ML17128A085 (8) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(i) |
| 3821917001R00 - NRC Website | |
text
10 CFR 50.73 W3F1-2017-0041 May 4, 2017 U.S. Nuclear Regulatory Commission Attn: Document Control Desk 11555 Rockville Pike Rockville, MD 20852
Subject:
Licensee Event Report (LER) 2017-001-00, Both Trains of Emergency Core Cooling System Inoperable due to Inadvertently Performing Maintenance on Train B Resulting in Event or Condition that Could Have Prevented Fulfillment of a Safety Function Waterford Steam Electric Station, Unit 3 (Waterford 3)
Docket No. 50-382 License No. NPF-38
Dear Sir or Madam:
On March 8, 2017, both trains of the Emergency Core Cooling System at Waterford Steam Electric Station, Unit 3 (Waterford 3) were inoperable, causing entry into Technical Specification (TS) 3.5.2 action c.
This event is reportable pursuant to 10 CFR 50.73(a)(2)(v)(D), "Event or Condition that Could Have Prevented Fulfillment of a Safety Function of Structures or Systems that are Needed to (D) Mitigate the Consequences of an Accident."
This report contains no new commitments. Please contact John P. Jarrell, Regulatory Assurance Manager, at (504) 739-6685 if you have questions regarding this information.
Sincerely, JPJ/MMZ
Attachment:
LER 2017-001-00 Entergy Operations, Inc.
17265 River Road Killona, LA 70057-3093 Tel 504 739 6685 Fax 504 739 6698 jjarrel@entergy.com John P. Jarrell III Manager, Regulatory Assurance Waterford 3
W3F1-2017-0041 Page 2 cc:
Mr. Kriss Kennedy, Regional Administrator U.S. NRC, Region IV RidsRgn4MailCenter@nrc.gov U.S. NRC Project Manager for Waterford 3 April.Pulvirenti@nrc.gov U.S. NRC Senior Resident Inspector for Waterford 3 Frances.Ramirez@nrc.gov Chris.Speer@nrc.gov
Attachment to W3F1-2017-0041 Licensee Event Report 2017-001-00 (5 pages)
NRC FORM 366 (04-2017)
NRC FORM 366 (04-2017)
U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 03/31/2020 the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
LICENSEE EVENT REPORT (LER)
(See Page 2 for required number of digits/characters for each block)
(See NUREG-1022, R.3 for instruction and guidance for completing this form http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr1022/r3/)
- 1. FACILITY NAME Waterford 3 Steam Electric Station
- 2. DOCKET NUMBER 05000-382
- 3. PAGE 1 of 5
- 4. TITLE Both Trains of Emergency Core Cooling System Inoperable due to Inadvertently Performing Maintenance on Train B Resulting in Event or Condition that Could Have Prevented Fulfillment of a Safety Function
- 5. EVENT DATE
- 6. LER NUMBER
- 7. REPORT DATE
- 8. OTHER FACILITIES INVOLVED MONTH DAY YEAR YEAR SEQUENTIAL NUMBER REV NO.
MONTH DAY YEAR FACILITY NAME DOCKET NUMBER 05000 03 08 2017 2017
- - 001
- - 00 05 04 2017 FACILITY NAME DOCKET NUMBER 05000
- 9. OPERATING MODE 1
- 11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR §: (Check all that apply) 20.2201(b) 20.2203(a)(3)(i) 50.73(a)(2)(ii)(A) 50.73(a)(2)(viii)(A) 20.2201(d) 20.2203(a)(3)(ii) 50.73(a)(2)(ii)(B) 50.73(a)(2)(viii)(B) 20.2203(a)(1) 20.2203(a)(4) 50.73(a)(2)(iii) 50.73(a)(2)(ix)(A) 20.2203(a)(2)(i) 50.36(c)(1)(i)(A) 50.73(a)(2)(iv)(A) 50.73(a)(2)(x)
- 10. POWER LEVEL 100%
20.2203(a)(2)(ii) 50.36(c)(1)(ii)(A) 50.73(a)(2)(v)(A) 73.71(a)(4) 20.2203(a)(2)(iii) 50.36(c)(2) 50.73(a)(2)(v)(B) 73.71(a)(5) 20.2203(a)(2)(iv) 50.46(a)(3)(ii) 50.73(a)(2)(v)(C) 73.77(a)(1) 20.2203(a)(2)(v) 50.73(a)(2)(i)(A) 50.73(a)(2)(v)(D) 73.77(a)(2)(i) 20.2203(a)(2)(vi) 50.73(a)(2)(i)(B) 50.73(a)(2)(vii) 73.77(a)(2)(ii) 50.73(a)(2)(i)(C)
OTHER Specify in Abstract below or in NRC Form 366A
- 12. LICENSEE CONTACT FOR THIS LER LICENSEE CONTACT TELEPHONE NUMBER (Include Area Code)
John Jarrell (504) 739-6685 CAUSE SYSTEM COMPONENT MANU-FACTURER REPORTABLE TO EPIX
CAUSE
SYSTEM COMPONENT MANU-FACTURER REPORTABLE TO EPIX
- 14. SUPPLEMENTAL REPORT EXPECTED
- 15. EXPECTED SUBMISSION DATE MONTH DAY YEAR YES (If yes, complete 15. EXPECTED SUBMISSION DATE)
NO ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single-spaced typewritten lines)
On March 8, 2017, at 1627 CST, it was identified that Low Pressure Safety Injection (LPSI) train B was inoperable due to SI-135B, Reactor Coolant Loop 1 Shutdown Cooling Warmup Valve, being found open, which is not the required position. At the time of discovery, LPSI train A was inoperable for maintenance and the station was in compliance with Technical Specification (TS) 3.5.2 action a which requires that an inoperable LPSI train be restored within 7 days. The shift operating crew entered TS 3.5.2 action c due to both trains of the Emergency Core Cooling System being inoperable. Action c requires that with both LPSI trains inoperable, at least one train must be restored within one hour.
SI-135B was subsequently closed and tested to verify operability. TS 3.5.2 action c was exited at 1705. The station remained in compliance with TS 3.5.2 action a.
It was determined that the SI-135B valve was opened inadvertently. It was planned to perform work on SI-135A, Reactor Coolant Loop 2 Shutdown Cooling Warmup Valve. The workers incorrectly began work on SI-135B and manually opened the valve. This was caused by personnel not performing proper component verification to validate that they were on the correct component, contrary to station procedures. Corrective actions are being performed to improve station work practices related to component verification.
INITIAL CONDITIONS Waterford 3 was in Mode 1 at approximately 100% power. Low Pressure Safety Injection (LPSI) train A had previously been declared inoperable for scheduled maintenance and the station was in compliance with Technical Specification (TS) 3.5.2 action a. There were no other structures, components, or systems inoperable at the start of this event that contributed to this event.
SYSTEM DESCRIPTION The Emergency Core Cooling System (ECCS) or Safety Injection System (SIS) is designed to provide core cooling in the unlikely event of a Loss of Coolant Accident (LOCA). The cooling must suffice to prevent significant alteration of core geometry, preclude fuel melting, limit the cladding metal-water reaction, and remove the energy generated in the core for an extended period of time following a LOCA. The SIS fluid must contain sufficient neutron absorbers to maintain the core subcritical for the duration of a LOCA. In addition, the ECCS functions to inject borated water into the Reactor Coolant System (RCS) to add negative reactivity to the core in the unlikely event of a steam line rupture.
Safety injection is also initiated in the event of a steam generator [SG] tube rupture or a control element assembly [ROD] ejection incident.
To assure system availability, redundant components are provided. The major components of this system are three High Pressure Safety Injection (HPSI) pumps [P], two LPSI pumps [P], four safety injection tanks [TK], high pressure injection valves [INV], and low-pressure injection valves [INV]. The functions of the LPSI pumps are to inject large quantities of borated water into the RCS in the event of a large pipe rupture and to provide shutdown cooling flow through the reactor core and shutdown cooling heat exchanger [HX] for normal plant shutdown cooling operation or as required for long-term core cooling.
SI-135A is the Reactor Coolant Loop 2 Shutdown Cooling Warmup Valve [V] for LPSI train A and SI-135B is the Reactor Coolant Loop 1 Shutdown Cooling Warmup Valve [V] for LPSI train B. Both are normally closed valves and are opened when placing the Shutdown Cooling System in service. SI-135A and SI-135B are located in an area that contains SIS piping and components for trains A and B. Remote indication of SI-135A and SI-135B valve position is provided in the control room.
EVENT DESCRIPTION
On March 8, 2017, at 1608, maintenance personnel commenced work to inspect the stem threads and obtain measurements on SI-135A. At 1627, a Shift Technical Advisor located in the control room identified that SI-135B was open, which was not the required position for this component per the system alignment performed to demonstrate operability [TS Surveillance Requirement (SR) 4.5.2.b.1]. At the time of discovery, LPSI train A was inoperable for maintenance and the station was in compliance with Technical Specification (TS) 3.5.2 action a which requires that an inoperable LPSI train be restored within 7 days. LPSI train B was declared inoperable and TS 3.5.2 action c was entered. Action c requires that with both LPSI trains inoperable, at least one train must be restored within one hour.
An operator sent to the field determined that the maintenance personnel had inadvertently opened SI-135B instead of SI-135A. SI-135B was closed and operability was verified by performing stroke time testing in accordance with the surveillance procedure. LPSI train B was declared operable at 1705 and TS 3.5.2 action c was exited. The station remained in compliance with TS 3.5.2 action a.
Page 3 of 5 (04-2017)
U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 3/31/2020
, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
LICENSEE EVENT REPORT (LER)
CONTINUATION SHEET (See NUREG-1022, R.3 for instruction and guidance for completing this form http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr1022/r3/)
- 3. LER NUMBER Waterford 3 Steam Electric Station 05000-382 YEAR SEQUENTIAL NUMBER REV NO.
2017
- - 001
- - 00 REPORTABLE OCCURRENCE TS 3.5.2 requires that two independent ECCS subsystems shall be OPERABLE in Modes 1, 2, and 3 (with pressurizer [PZR] pressure greater than or equal to 1750 psia and RCS average temperature greater than or equal to 500 degrees F) with each subsystem comprised of: a. One OPERABLE high-pressure safety injection train, b. One OPERABLE low-pressure safety injection train, and c. An independent OPERABLE flow path capable of taking suction from the refueling water storage pool on a safety injection actuation signal [JE] and automatically transferring suction to the safety injection system sump [SUMP] on a recirculation actuation signal. Action a. requires that with one ECCS subsystem inoperable due to one low pressure safety injection train inoperable, restore the inoperable train to OPERABLE status within 7 days or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reduce pressurizer pressure to less than 1750 psia and RCS average temperature to less than 500 degrees F within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
Action c. requires that with both LPSI trains inoperable due to less than 100% of ECCS flow equivalent to a single OPERABLE ECCS subsystem, restore at least one LPSI train to OPERABLE status within one hour or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reduce pressurizer pressure to less than 1750 psia and RCS average temperature to less than 500 degrees F within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
Each ECCS subsystem is required by SR 4.5.2 to be demonstrated OPERABLE. To ensure that the ECCS subsystem can deliver the design flow to the RCS, SR 4.5.2.b.1. requires that each valve (manual, power-operated, or automatic) in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct position. Operability is demonstrated by satisfactory performance of a system alignment in accordance with station procedure. Valve SI-135B is required to be in the closed position by the system alignment; therefore, when it was inadvertently opened, LPSI train B was rendered inoperable. This misalignment coincided with LPSI train A being inoperable due to the planned maintenance. The amount of time that both trains were inoperable was 38 minutes.
This condition is reportable pursuant to 10 CFR 50.73(a)(2)(v)(D), Event or Condition that Could Have Prevented Fulfillment of a Safety Function of Structures or Systems that are Needed to (D) Mitigate the Consequences of an Accident" due to both ECCS subsystems being inoperable.
PREVIOUS OCCURRENCES
Searches of the Entergy Condition Reporting System were performed for the past 5 years for conditions with a keyword of component misposition or trend code of component mispositioning. Those identified as similar to this event are provided below.
CR-GGN-2014-1345: On February 16, 2014, nuclear oversight personnel identified that technicians performing scheduled work for valve 1N23-F502A were incorrectly working on 1N35-F502A.
CR-PNP-2014-1431: On April 1, 2014, an operator inadvertently depressed the RCIC INITIATION SIGNAL reset push button on panel C904, instead of the RCIC SYS INJECTION MODE push button on panel C904 as directed by procedure. The incident resulted in unexpected test results and some steps of the surveillance being reperformed.
CR-IP2-2016-504: On January 29, 2016, during performance of calibration on RCS Wide Range Temperature Instruments, instrument technicians opened the terminal block protective cover for the incorrect instrument causing unexpected alarms and a plant perturbation.
Page 4 of 5 (04-2017)
U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 3/31/2020
, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
LICENSEE EVENT REPORT (LER)
CONTINUATION SHEET (See NUREG-1022, R.3 for instruction and guidance for completing this form http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr1022/r3/)
- 3. LER NUMBER Waterford 3 Steam Electric Station 05000-382 YEAR SEQUENTIAL NUMBER REV NO.
2017
- - 001
- - 00 CR-ANO-C-2016-4258: On October 7, 2016, an operator incorrectly closed the makeup isolation damper for the running control room ventilation fan. This caused the running fan to be inoperable and placed Unit 2 into a 7-day LCO time clock.
CR-ANO-C-2016-3841: On October 16, 2016, two FIN mechanics inadvertently uncoupled 2P-39A boric acid makeup pump resulting in no boric acid makeup pumps being available, risk of injury from working on an unisolated pump that was positioned in Auto, and a site clock reset.
CR-WF3-2017-0977: On February 16, 2017, while hanging tagout CW-115, operations department hung a danger tag on a component not within the scope of their tagout. This resulted in a level 3 misposition and potential for equipment damage and personnel injury.
CAUSAL FACTORS (1) Maintenance personnel did not adequately perform component verification to validate that they were on the correct component and opened SI-135B instead of SI-135A.
(2) The protected equipment posting process did not provide an adequate barrier to protect the opposite train components that are located in the same area. Workers were allowed to approach protected train component SI-135B because it had no protected equipment posting.
(3) The work order to perform the maintenance on SI-135A was not planned in accordance with the station procedure that establishes standards and expectations for the use of specific human performance tools. This procedure states that concurrent verification should be used for actions that have a high potential to lead to irreversible consequences (loss of safety function). This allowed the condition by not requiring concurrent verification for component identification steps to be included in the work package.
(4) Supervisory engagement during the pre-job brief was inadequate. This allowed mitigating factors (proper component verification) to not be established when the potential to work on the wrong component had been identified as the worst thing that could happen.
CORRECTIVE ACTIONS
(1) A maintenance department stand down was performed to discuss the event and reinforce expectations for component verification (complete).
(2) SI-135B was added to the protected equipment postings database and the valve was posted as protected train equipment to support the maintenance on SI-135A (complete).
(3) Concurrent verification will be added to the component identification steps for future planned work on SI-135A (planned).
(4) Implement a process where if the determined risk mitigation actions for medium and high integrated risk activities call for protect redundant/mitigating equipment, then ensure that the opposite train redundant components located in mixed system train areas are positively protected (planned).
Page 5 of 5 (04-2017)
U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 3/31/2020
, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
LICENSEE EVENT REPORT (LER)
CONTINUATION SHEET (See NUREG-1022, R.3 for instruction and guidance for completing this form http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr1022/r3/)
- 3. LER NUMBER Waterford 3 Steam Electric Station 05000-382 YEAR SEQUENTIAL NUMBER REV NO.
2017
- - 001
- - 00 (5) Each maintenance shop superintendent will perform a series of targeted observations that focus on component verification practices during the job site review process with the intent to improve component verification practices (planned).
SAFETY SIGNIFICANCE
A safety system functional failure analysis was performed for this event. The assumptions used in the analysis were as follows:
LPSI train A was not available; LPSI train B was available but in the unplanned configuration with valve SI-135B open; HPSI trains A and B were both available; All containment cooling systems were available.
The unplanned configuration of LPSI train B combined with LPSI train A not available resulted in reducing the credited flow to the RCS to 2330 gpm. Analysis of this configuration concluded that no loss of the safety function occurred. This is based on the following results:
Peak clad temperature, peak local oxidation, and core-wide oxidation results documented in the ECCS performance analysis of record (AOR) remain bounding at this lower LPSI system flow.
The mass and energy releases during the blowdown, reflood, and long-term cooling phase of a LOCA at this lower LPSI system flow are bounded by the mass and energy releases documented in the AOR from the perspective of maximizing the containment pressure calculations.
The mass and energy releases from a main steam line break at this lower LPSI system flow do not affect the AOR for this event.
The non-LOCA safety analyses in Chapter 15 of the Updated Final Safety Analysis Report are not impacted at this lower LPSI system flow.
The actual consequence was that with LPSI train A inoperable, and with SI-135B open, LPSI train B would be able to deliver the reduced flow of 2330 gpm to the RCS during a design basis event. SI-135B was opened and LPSI train B operability was restored in 38 min. There were no other actual consequences to the general safety of the public, nuclear safety, industrial safety, and radiological safety for this event. As described above, although LPSI train A was inoperable and SI-135B was open, LPSI train B would be able to perform the required safety function of the ECCS during all required accident conditions. Therefore, it has been determined that the ECCS was capable of performing its safety function. The safety significance of this event is considered low.
The potential consequence to the general safety of the public, nuclear safety, industrial safety, and radiological safety of this event if response actions were delayed is that ECCS performance acceptance criteria would have been exceeded.
ADDITIONAL INFORMATION
Energy industry identification system (EIIS) codes and component function identifiers are identified in the text with brackets [ ].