05000387/LER-2007-002
| Ususquehanna Steam Electric Station - Unit 1 | |
| Event date: | 06-20-2007 |
|---|---|
| Report date: | 08-15-2007 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 3872007002R00 - NRC Website | |
EVENT DESCRIPTION
On June 20, 2007, with Susquehanna Unit 1 in Mode 1 at 100% power, it was determined that an unrecognized condition had existed at the Engineered Safeguard Service Water (ESSW) pump house that rendered a single loop of Residual Heat Removal (RHR; EllS Code: BO) inoperable for the suppression pool cooling mode of operation. This condition was created in August 2002 when, for security related purposes, an access door to the pump house was removed with the opening then being sealed by concrete block. As will be described in the following discussion, this modification placed the station outside of its design basis relative to single failure requirements for the ESSW pump house ventilation system.
The ESSW pump house contains the Emergency Service Water (ESW; EIIS Code: BI) and Residual Heat Removal Service Water (RHRSW; EIIS Code: CC) pumps for the station. The pumps in both systems are divisionalized. The original plant design recognized that a loss of ventilation fans in one division of the ESSW pump house could result in a loss of all ESW and RHRSW pumps in that division. However, the remaining division of ESW and RHRSW would maintain capabilities for safely shutting down the plant.
In 1985, a plant change was made to eliminate the potential loss of ESW cooling to two RHR pumps and associated room coolers in one division as was postulated upon failure of an ESW bypass valve. Through this modification, the 'A' ESW loop that had previously supplied cooling to the 'A' loop RHR equipment, was now re-routed to cool pumps and pump auxiliaries in both the 'A' and 'B' RHR loops. A similar change was made to the 'B' ESW loop flow path. Although it was not recognized at the time, this cross-divisional modification created a situation where a Loss of Offsite Power (LOOP) event combined with a power failure to one division of ESSW pump house ventilation would leave only one loop of RHR suppression pool cooling to share between Susquehanna Units 1 and 2.
In 1991 following engineering evaluation of the unintended consequence created by the 1985 change, an Emergency Operating procedure was modified to direct opening of ESSW pump house doors in the event of a divisional HVAC failure. As is supported by analysis, manually opening the doors would permit sufficient air flow to cool the pumps in a LOOP event concurrent with failure of one division of ESSW ventilation. When the procedure was revised, the manual action should have been incorporated into the plant design basis because it was relied upon to maintain compliance with single-failure design requirements. Although the engineering evaluation recognized that an FSAR change should accompany the procedural change that was enacted, no such activity was ever generated within the corrective action process. As such, the FSAR was not updated to describe the action.
In 1998, it was recognized that a description of the operator action required to mitigate the effects of a divisional HVAC failure in the ESSW pump house was not included in the FSAR. An in-house memo indicated that the necessary update would occur in response to a related item already existing in Susquehanna's corrective action program. This corrective measure was not incorporated into the action item resolution as identified.
In 2002, a security related modification sealed the access door being relied upon to support ESSW pump house ventilation operability during a LOOP/divisional ventilation power loss event. Documentation provided with the modification recognized that the door was credited in emergency procedures but incorrectly concluded that it was not required for operability of ESSW ventilation. The operator action was removed from the procedure at the time the modification was implemented.
In 2005, a revised calculation concluded that pump house temperatures could become unacceptably high during summer conditions without the door flow path capability. Corrective actions were generated to establish an equivalent flow path.
As of June 7, 2007, no action had yet been taken in response to the corrective actions.
On June 8, 2007 in response to concerns raised during on-site inspection activities, measures were taken to maintain two ESSW pump house ventilation dampers in an open position. This action provided the means to establish circulation cooling to a division of the ESSW pump house in the event of a divisional Heating Ventilation and Cooling (HVAC) failure.
CAUSE OF EVENT
Two apparent causes have been associated with the removal and blocking of the ESSW pump house door in 2002:
1. Inadequate implementation of the corrective action process due to poor human performance — Inadequate use of the corrective action process resulted in failure to update the FSAR to indicate that opening of ESSW pump house doors is required to achieve safe shutdown of the plant in a LOOP with a concurrent power failure to one division of pump house ventilation. There were two distinct opportunities to update the FSAR. In 1991, no corrective action was generated to change the FSAR as was determined necessary through engineering analysis. In 1998 when it was again recognized that the FSAR failed to address the operator action, a memo was generated to document the deficiency. Although the memo anticipated that the required FSAR changes would be accomplished as part of an existing Condition Report, the Condition Report's action plan was never revised to execute the change.
2. Process weaknesses associated with the handling of complex modifications — The safety evaluation performed in support of the 1985 ESW cross-divisional modification failed to identify that the proposed change would create a single failure vulnerability in the suppression pool cooling mode of RHR. This shortcoming was attributable to process weaknesses associated with the handling of complex modifications.
ANALYSIS / SAFETY SIGNIFICANCE
This event became reportable in accordance with 10CFR50.73(a)(2)(i)(B) when it was determined that a single loop of RHR suppression pool cooling was administratively rendered inoperable following installation of a 2002 modification at the ESSW pump house. The RHR suppression pool cooling system was impacted from the time the modification was installed in August of 2002 until June 8, 2007 when measures were taken to establish an adequate ventilation flow path.
This situation did not comply with both Unit 1 and Unit 2 Technical Specifications governing the RHR suppression pool cooling system (TS 3.6.2.3).
Actual Consequences:
There were no actual safety consequences resulting from this event. As discussed above, the blocked door would only become significant under a discreet set of circumstances (LOOP event combined with a power failure to one division of ESSW pump house ventilation). Such an event did not occur during the period in question. Until a more permanent resolution can be enacted, two dampers in the pump house have been "gagged" in the open position to ensure circulation cooling in the event of a divisional HVAC failure.
Potential Consequences:
From a probabilistic risk standpoint, there was essentially no risk associated with the removal and blocking of the ESSW door.
Existing calculations indicate that the ESW and RHRSW pumps can fulfill their PRA mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in the absence of pump house ventilation as long as 1 door can be opened. (NOTE: Other doors were not blocked and could be opened.) The design basis mission time for ESW and RHRSW is defined in the FSAR as 30 days. For this extended mission time, temperatures in the Division (I/11) pump room would get high enough to cause that Division's ESW and RHRSW pumps to fail under the postulated circumstances even if one door were opened to compensate. This would result in only one loop of suppression pool cooling being available, in the long-term, to share between Units 1 and 2. This outcome is not in conformance with the design basis of the containment heat removal system. Although blocking of the ESSW pump house door placed the station outside of its design basis relative to single failure requirements specified in the FSAR, it has been demonstrated through previously existing analysis that one loop of suppression pool cooling is sufficient to bring both Units to a safe shutdown condition.
CORRECTIVE ACTIONS
Completed Actions:
- Two ESSW pump house dampers have been "gagged" in the open position to ensure circulation cooling in the event of a divisional HVAC failure.
- Susquehanna's modification program now requires performance of a failure modes and effects analysis that will help identify potentially adverse consequences created through the implementation of complex modifications.
- An impact evaluation process was incorporated into Susquehanna's modification program that strengthens the station's ability to recognize the impacts of engineering changes.
- Susquehanna's corrective action program is significantly more robust than it was in the 1990's. Implementation weaknesses existing at that time have been corrected.
Planned Actions:
- A permanent corrective measure will be implemented to ensure that at least one loop of RHR suppression pool cooling remains operable on each Unit during a LOOP event concurrent with an additional random single failure.
- The FSAR will be revised to address and recognize any design features or operator actions associated with the permanent resolution.
ADDITIONAL INFORMATION
Failed Components Information:
None
Past Similar Events:
None