05000395/LER-2003-003
| Virgil C. Summer Nuclear Station | |
| Event date: | 09-08-2003 |
|---|---|
| Report date: | 02-27-2004 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| Initial Reporting | |
| ENS 40142 | 10 CFR 50.72(b)(3)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident |
| 3952003003R01 - NRC Website | |
PLANT IDENTIFICATION
Westinghouse - Pressurized Water Reactor
EQUIPMENT IDENTIFICATION
Control Room Ventilation system emergency filter plenum XAA 0029A-AH
IDENTIFICATION OF EVENT
The oncoming shift supervisor (9/09/03, 0730 hours0.00845 days <br />0.203 hours <br />0.00121 weeks <br />2.77765e-4 months <br />) questioned why the intermittent control building alarm was acceptable and if the system would perform its design function following an accident.
EVENT DATE
09/08/03
REPORT DATE
02/27/04
CONDITIONS PRIOR TO EVENT
Model, 100% Power
DESCRIPTION OF EVENT
On September 8, 2003, maintenance personnel opened the "A" train Control Room charcoal filter plenum (XAA-0029A-AH) to replace a charcoal filter that failed surveillance testing. The tag-out process for the work included de-energizing the plenum fan (XFN0030A—AH), which failed the isolation dampers open due to a loss of control power. At 1530 hours0.0177 days <br />0.425 hours <br />0.00253 weeks <br />5.82165e-4 months <br />, maintenance began to disassemble the DESCRIPTION OF EVENT (Cont'd) plenum to allow for access to replace the charcoal filter. Intermittent alarms for the control room pressure were received but considered an expected alarm by the operating shift due to the maintenance on the system. The annunciator response procedures were reviewed in response to the alarm but did not provide adequate information to assist in evaluating the cause of the alarm.
On September 9, at 0730 hours0.00845 days <br />0.203 hours <br />0.00121 weeks <br />2.77765e-4 months <br />, the shift supervisor asked if the system could perform its design function during an accident in the current configuration. The plant staff was unclear as to whether the 0.125 inch TS surveillance requirement was applicable in the normal ventilation mode. At approximately the same time (0805 hours0.00932 days <br />0.224 hours <br />0.00133 weeks <br />3.063025e-4 months <br />), maintenance was directed to close up the system (reinstall the plenum covers and gag the isolation dampers closed).
Engineering review determined that the tag-out of the "A" train ventilation system inadvertently repositioned the isolation dampers for the emergency charcoal filter plenum and its associated fan XFN 0030A open. The configuration would not allow maintaining the required positive 0.125-inch water column as specified in TS (3.7.6) and as verified by the intermittent control room low pressure alarms. This maintenance activity effectively breached the control room boundary and rendered the two emergency trains inoperable. This activity unknowingly placed the plant into Technical Specification Limiting Condition for Operability (LCO) 3.0.3, which requires 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to prepare for plant shutdown and 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to Hot Standby.
CAUSE OF EVENT
Multiple barriers should have prevented this event. Procedures did not contain the warning that the activity would breach the system, a lack of knowledge that this activity would violate TS, the planning process did not detect the potential for the breach, and a lack of understanding by the operators that considered the intermittent alarm an expected response were all instrumental in allowing this event to occur.
The root cause evaluation has identified eleven causal factors associated with human performance difficulties that provide for the root cause of the event.
ANALYSIS OF EVENT
The Control Room ventilation envelope is designed to provide the Control Room and specific vital areas in the Control Building with a minimum flow of air to assure habitability for personnel and operability of equipment during normal operations and to provide filtered air during accidents, fires, or radiation/chemical releases onsite. During normal operations, a maximum of 1000 scfm of outside air is brought in to maintain a minimum positive pressure of 0.125 inches water column. This positive pressure is required for accident conditions to prevent intrusion of airborne contaminants.
Engineering investigation determined that by having the isolation dampers for the "A" train emergency filter plenum open, a path existed for some percentage of the "B" train air flow to back feed into the "A" train. The opening of the plenum provided an opening, which allowed the reduction in positive pressure. Additionally, the potential increase in the outside air flow rate may have exceeded design analysis assumption limits. This potential negates the design function during an accident, which is to protect the operators from unacceptable levels of airborne contaminants.
During the time period that the "A" train was tagged out, no releases of airborne contaminants occurred and there were no undesired exposures to personnel. Equipment temperatures remained within acceptable bands.
The change out of a charcoal filter is not a common activity but has been performed previously on the Control Room emergency ventilation system as well as other ventilation systems through out the plant.
The last time this activity was performed was in 2000 on the opposite train. The procedure does contain some compensatory measures, such as using sheet plastic to provide a temporary boundary, but the plastic sheeting was not used on the Control Room emergency ventilation system on September 8, 2003 due to not understanding the need to protect the boundary. The lack of understanding of what constitutes a breach of the Control Room Boundary was across all disciplines involved in the activity.
CORRECTIVE ACTIONS
The Station took the following immediate corrective actions:
- The filter plenum was closed to prevent unfiltered air from being drawn into the ductwork.
- The isolation dampers for the emergency charcoal filter plenum and fan were gagged closed to prevent any back flow through fan XFN0030A.
Corrective actions were established during the root cause evaluation performed for this event, which will be tracked under the corrective action program (CER 03-2819).
1. Review and modify existing plant work control and tagging procedures to enhance the ability to control work evolutions involving the Control Room Pressure Boundary.
2. Revise the OPS Scheduling Tagout Checklist to include a check-off for "CR Pressure Boundary affected-Evaluation per GMP100.017 required.
3. Revise the electrical feeder list to include information that de-energizing the CR Emergency Filter Fan (XFN0030A & B) will result in not only the inlet and outlet dampers failing open but also that subsequent opening of the filter plenum will result in breach of the Control Room Envelope.
4. Place placards on the HVAC access doors for the ductwork in the Control Room Boundary per GMP 113.001 and the Maintenance Aid Program. These placards will caution the plant staff not to breach the CR Boundary without the proper evaluation.
5. Require training for the applicable groups on the configuration of the Control Room Ventilation.
Update annual Employee Training to make the plant staff aware of the boundaries of the CR Envelope.
6. ECR 70436, 70437, and 70438 have been generated to change the setpoint, DP switch, and time delay associated with the HI/LO CR Pressure Switches.
7. Revise the annunciator response procedure (XCP-6210-LCB5 3-4) to instruct the Control Room Staff to notify the HVAC group of any alarm condition and verify the HVAC panel alarm is valid by observing the local CR differential pressure indicators.
8. Place a "TS" sticker on the HVAC alarm panel located adjacent to these annunciators to denote that this alarm is associated with a Tech Spec required value.
9 . Revise MMP 460.020 (Activated Carbon Replacement In HVAC Systems) to require the use GMP 100.017 (Controlling the Breach of System Integrity, Attachment I) for breach of HVAC systems, provide directions for proper isolation for the tasks involved, and proper verification of CR Pressure during plenum disassembly.
10. Revise GMP 100.017 to add a step that documents the results of an engineering evaluation, if one is requested, as well as a step to document any actions requested have been implemented and breach of the system is approved.
PRIOR OCCURRENCES
None