05000400/LER-2014-003
| Shearon Harris Nuclear Power Plant, Unit 1 | |
| Event date: | 10-08-2014 |
|---|---|
| Report date: | 12-08-2014 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 4002014003R00 - NRC Website | |
Reported lessons learned are incorporated into the licensing process and fed back to industry.
Send comments regarding burden estimate to the FOIA, Privacy and Information Cdlections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB contrd number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
Energy Industry Identification System (El IS) and component codes are identified in the text as poq .
Background
On October 8, 2014, while operating at 100 percent power in Mode 1, Harris Nuclear Plant (HNP) personnel determined that the calculation for Diesel Fuel Oil Storage Building (DFOSB) [DE] Internal Flooding was invalid during an extent of condition evaluation from an apparent cause evaluation report. The analysis credited the required single active component failure as the loss of a single sump pump [WK P], rather than the loss of the common power supply to both sump pumps, which is depicted in current plant design. The elevation of the safety related Diesel Fuel Oil (DFO) Transfer Pump [DE P] is not sufficient to protect the pump from the postulated effects of an internal flood caused by a break in the fire suppression system piping [IC PSP]. The DFO Transfer Pumps are used to refill the Emergency Diesel Generator (EDG) Day Tanks [EK, DG TK] when the EDGs are running for an extended period of time in response to a loss of offsite power. The system has been in this condition since plant construction.
This event is reportable in accordance with 10 CFR 50.73(a)(2)(v), "Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to:"..."(D) Mitigate the consequences of an accident.
Event Description
On October 8, 2014, while operating at 100 percent power in Mode 1, HNP personnel determined that the calculation for DFOSB Internal Flooding was invalid during an extent of condition evaluation from an apparent cause evaluation report. The calculation identified a single active failure to occur by the failure of a single sump pump and neglected the fact that the power source to both sump pumps was the common Motor Control Center (MCC-1-4B13) [MCC].
During re-evaluation of the internal flooding condition in the DFOSB due to the postulated moderate energy line break (MELB), incorporating the worst case single active failure, it was identified that the internal flood event would challenge Operations' capability to respond to the event and isolate the pipe break prior to the flood water affecting the safety related DFO Transfer Pumps.
As a result of this inability to maintain the functional capability of safety systems and components utilized for the HNP Final Safety Analysis Report (FSAR), Chapter 15, design basis accidents during the Chapter 3, design basis MELB internal flooding event, the DFOSB fire suppression system supply to the building was isolated promptly. This action prevents water from entering the building during the postulated pipe rupture. Additionally, a compensatory fire watch was placed at the DFOSB. Backup fire suppression is provided by staged fire extinguishers. This combination of actions is sufficient to maintain the safety-related function of the DFO Transfer Pumps.
The calculation was revised to appropriately evaluate the internal flooding event in the DFOSB. A design modification is being pursued to remove the vulnerability to internal floods currently associated with the DFO Transfer Pump and to update the calculation accordingly. The inability to mitigate the postulated leak with the single active failure has existed since initial plant construction.
The EDG design function is to provide emergency power to remove residual heat and to mitigate the impact of postulated accidents in the event offsite power is not available. There is no impact other than a reduction of defense in depth if offsite power is available.
This design is a historical issue that was part of the original plant design and no discrepancies have been found that would indicate this should have been identified earlier than now. An extent of condition was completed for HNP internal flooding design basis calculations to determine their conformance with the Standard Review Plan and the identified design criteria.
During the extent of condition evaluation for this historical issue, it was identified that the internal flooding calculations do not specify the components that are credited to fail, and therefore do not appropriately address the required design criteria. An action was created to update the internal flooding calculations to appropriately address the required design criteria in accordance with the applicable Standard Review Plan and to ensure each calculation is in compliance with the licensing basis.
Causal Factors Historical - Deficiency associated with the original design of the plant and inadequate technical rigor used to revise the calculation for DFOSB Internal Flooding in 2003.
Corrective Actions
Completed Corrective Actions
1) Fire suppression to the DFOSB was isolated to eliminate potential flooding. Backup fire suppression is provided by staged fire extinguishers. A fire watch was posted in the DFOSB.
2) The calculation for DFOSB Internal Flooding was revised to appropriately evaluate the internal flooding event in the DFOSB.
Planned Corrective Actions
1) Modify the design of the DFO Transfer Pump, the DFOSB Fire Suppression System, or the DFOSB Flood Mitigation System per Engineering Change 98527 to restore compliance with the site licensing basis and to remove the vulnerability to internal floods currently associated with the DFO Transfer Pump. Ensure that the calculation for DFOSB Internal Flooding is revised accordingly.
2) Revise internal flooding calculations to appropriately address the required design criteria in accordance with the applicable Standard Review Plan. Ensure the calculation is in compliance with the licensing basis.
Safety Analysis
There were no safety consequences associated with this event, as the equipment did not fail. A potential design-basis MELB leak from the fire-suppression header in the DFOSB, concurrent with the unavailability of both DFOSB sump pumps due to loss of the common power supply, could impact the ability of the EDGs to perform their design function for their complete mission time.
Sump pumps are provided to ensure that ingress of fluids from either internal or external sources do not adversely impact the safety-related DFO Transfer Pumps. The DFO Transfer Pumps are used to refill the EDG Day Tanks when the EDGs are running for an extended period of time in response to a loss of offsite power. Each EDG Day Tank has a capacity that will provide for approximately seven hours of EDG run time. Inoperability of the Transfer Pumps beyond seven hours could preclude the two trains of EDGs from meeting their FSAR Chapter 15 mission time. Two DFOSB sump pumps are provided, such that unavailability of one does not result in loss of the capability to mitigate the ingress of water. However, a single active failure affecting the power to both sump pumps would result in the loss of capability to mitigate the impact of the leak.
The MELB from the fire water header in the DFOSB was compared to the guidance contained in NUREG-0800, "Standard Review Plan (SRP)," Section 3.6.1 and 3.6.2 and their attached NRC Branch Technical Positions (BTP) MEB 3-1, "Postulated Break and Leakage Locations in Fluid System Piping Outside Containment," and ASB 3-1(formerly APCSB 3-1), "Protection Against Postulated Piping Failures in Fluid Systems Outside Containment." Using the methodology presented by these SRP sections and their attached BTPs, because the MELB in the DFOSB does not cause a turbine trip or Reactor Protection System [JC] actuation, the two trains of offsite power, and supplied safety equipment, are assumed to be available for safe shutdown of the reactor for this leak.
Neither the postulated design-basis MELB leak nor the loss of offsite power have occurred during the operation of HNP, so there are no actual safety consequences and no actual impact to public health and safety or the environment as a result of this condition. If a leak had occurred that affected the capabilities of the two DFO Transfer Pumps without a loss of offsite power, the plant would have been shut down using offsite power with no impact to other equipment. If offsite power was lost without a leak from the fire suppression system, the plant would have been shut down using power from the EDGs with no impact to other equipment. It is only the concurrent FSAR Chapter 3 postulated MELB design basis leak and Chapter 15 design basis event with loss of offsite power that would have any safety impact.
Previous Similar Events
No Operating Experience was found that would indicate the design deficiency should have been identified earlier. HNP became aware of the issue on October 8, 2014.
Commitments This report contains no regulatory commitments.