05000440/LER-2008-002

LER-2008-002, Inoperable Emergency Closed Cooling System Results In Condition Prohibited By Technical Specifications

Docket Number
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
4402008002R00 - NRC Website

Energy Industry Identification System Codes are identified in the text as [XX].

INTRODUCTION

On February 10, 2008, at approximately 0830 hours0.00961 days <br />0.231 hours <br />0.00137 weeks <br />3.15815e-4 months <br />, with the plant in Mode 1 (i.e., Power Operation) and the reactor operating at approximately 100 percent of rated thermal power, Operators determined that the Emergency Closed Cooling Water subsystem B [CC] (ECC B) was inoperable. ECC B had been inoperable due to insufficient minimum flow and entry was immediately made into the appropriate Technical Specification Limiting Condition For Operation (TS LCO), 3.7.10, Condition A, Required Action A.1. ECC B had been inoperable for approximately 52 hours6.018519e-4 days <br />0.0144 hours <br />8.597884e-5 weeks <br />1.9786e-5 months <br /> before the TS LCO Required Action was taken to declare the associated systems or components inoperable. At approximately 0839 hours0.00971 days <br />0.233 hours <br />0.00139 weeks <br />3.192395e-4 months <br /> on February 10, 2008, with the TS Required Action met, the plant exited TS LCO 3.7.10. This event is being reported in accordance with 10 CFR 50.73(a)(2)(i)(B) as any operation or condition prohibited by the plant's technical specification.

EVENT DESCRIPTION

On February 8, 2008, at approximately 0430 hours0.00498 days <br />0.119 hours <br />7.109788e-4 weeks <br />1.63615e-4 months <br />, flow was isolated through Control Complex Chilled Water (CCCW) [KM] chiller B [CHU] without the ECC bypass valve [TV] being opened. Clearance tags were applied to allow chiller maintenance work to be performed. At that time, Operations personnel did not recognize that the clearance tagging and isolation of the CCCW chiller B reduced ECC B flow to less-than minimum requirements. The ECC B and its associated supported systems became inoperable due to lack of adequate minimum flow. When ECC B was made inoperable, the plant should have entered TS LCO 3.7.10, Condition A, "One or two ECC subsystems inoperable." Required Action A.1 states, "Declare associated system(s) or components(s) inoperable, immediately.

When ECC B became inoperable, the following also became inoperable: Residual Heat Removal (RHR) [BO] subsystems B and C, Combustible Gas Mixing Compressor [BB] B, and Post Accident Hydrogen Analyzer [IK] B. Because entry into Condition A was not recognized by Operations, the associated Required Action A.1 was not taken, resulting in the requirement to enter into TS LCO 3.7.10, Condition B. Required Action B.1 calls for the plant to "Be in Mode 3" (Hot Shutdown), within "12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />," AND. Required Action B.2 calls for the plant to "Be in Mode 4," (Cold Shutdown), within "36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />." With the TS LCO Conditions not recognized, neither of these Required Actions were taken.

When ECC B became inoperable, ECC A was still operable.

On February 10, 2008, at 0830 hours0.00961 days <br />0.231 hours <br />0.00137 weeks <br />3.15815e-4 months <br />, approximately 52 hours6.018519e-4 days <br />0.0144 hours <br />8.597884e-5 weeks <br />1.9786e-5 months <br />' after ECC B was made inoperable, while performing restoration review of a clearance tag, the Shift Engineer questioned the Shift manager on how to restore the bypass valve. The Shift Manager raised the concern that the valve was closed when it was required to be open to ensure minimum flow for ECC B. At this point, Operations recognized that ECC B was inoperable due to insufficient minimum flow and entry was made into the TS LCO 3.7.10, Condition A, and Required Action A.1 was immediately taken to "Declare associated systems or components inoperable." On February 10, 2008, at approximately 0839 hours0.00971 days <br />0.233 hours <br />0.00139 weeks <br />3.192395e-4 months <br />, with minimum flow established and TS LCO 3.7.10 met, the plant exited TS LCO 3.7.10, Condition A.

CAUSE OF EVENT

The cause attributed to the lack of minimum flow for the ECC B subsystem was a closed bypass valve.

The bypass valve was left closed due to a System Operating Instruction (S01) that did not include steps to realign through the bypass valve when the ECC flow path was isolated. The missing steps resulted from an inadequate review of procedure changes associated with previously implemented design modifications.

In 2003, implementation of two Engineering Change Package (ECP) design modifications resulted in physical separation of the ECC A and B loops from the Nuclear Closed Cooling [CC] system and changed ten motor operated valves into manual operated valves. This physical separation of the systems resulted in some of the ten valves changing their position from normally closed to normally open. In addition, because of the ECP design modifications, changes were made to two SOls:

"Emergency Closed Cooling System," and "Control Complex Chilled Water System." The changes included removal of steps from the ECC instruction that aligned ECC flow through the bypass valve as well as changes to the CCCW instruction that removed steps that had ensured ECC minimum flow was established through two bypass valves required to be open to maintain minimum flow. The changes made to the SOls impacted system operations as these changes introduced the latent problems. In 2003, a less than full understanding of the scope of the ECP design modifications led to assigning a lower classification of "simple change" to the associated procedure changes. This lower classification of simple change, instead of significant change, allowed for only an abbreviated review. As a result, the SOI changes did not receive an internal review by Operations, or cross discipline review by the system engineer, that are required for significant changes, but not required for simple changes. This resulted in a lack of adequate procedural guidance, through the removal of significant procedural steps,' important to proper plant operation.

An additional cause of the event was the clearance contained boundary points not specifically required for the scope of the work. This additional cause reflects a lack of effective use and implementation of human performance tools. Also, the operations impact reviews did not identify the problem with the clearance.

A contributing cause of the event included a less than adequate, review of documentation. Clearance reviews were performed only'for the CCCW system chiller work. The instruction did not contain sufficient information in the precautions and limitations section and in the instruction body to identify ECC minimum flow requirements. An additional contributing cause included a lack of training for Licensed Operators and Non-Licensed Operators on the two ECP design changes, implemented in 2003, prior to the system being placed in service. At the time, there was no procedure requirement for the Training Organization to perform a design interface evaluation.

EVENT ANALYSIS

The design basis of the ECC system is to support the Emergency Core Cooling System and supply cooling water to RHR, Low Pressure Core Spray [BM], and the Reactor Core Isolation Cooling [BN] room coolers, RHR pump seals, and cooling water to the hydrogen analyzers following an accident.

The ECC system also supplies the emergency source of cooling water to the control complex chillers.

The control complex chillers provide for most of the required flow for the system so that if the pathway is isolated, minimum pump flow requirements cannot be met without the bypass valve being open. The pump does not normally run unless required and did not run while the bypass valve was closed. The ECC system is designed to perform its function with a single failure of an active component, assuming a loss of offsite power. A bounding evaluation of the event was performed that included the ECC B � being unavailable for 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br />. The Incremental Conditional Core Damage Probability (ICCDP) was determined to be 9.4E-08. The Incremental Conditional Large Early Release Probability (ICLERP), by definition, cannot be greater than the ICCDP. Configurations with a core damage probability of less than 1.0E-06 and a large early release probability of less than 1.0E-07 are not considered risk significant events. Therefore, this event is considered to be of very low risk significance.

CORRECTIVE ACTIONS

Operations personnel opened the bypass valve to make the system operable. The Shift Operational Management System (SOMS) tracking database was changed to include notes that state closing any of the eight (8) ECC valves, which are able to isolate flow to a chiller, need to be evaluated for ECC operability.

An extent of condition review was completed. As a result, the SOMS database will be updated to include additional notes stating that the closing of twenty (20) additional valves on other plant systems may result in loss of adequate minimum flow protection for the system. Warning placards will be placed on the eight (8) ECC valves, as well as the additional twenty (20) valves on other plant systems, stating, "Closure of this valve may result in loss of adequate minimum flow protection for this system.

Contact the control room prior to closing and verify proper flow path has been established.

In order to ensure the minimum flow requirements for the ECC A and B are met, changes will be made to the precautions and limitations section of the ECC SOI to include specifics regarding flow paths, the bypass line and valves isolating flow to the CCCW chiller A and B. The ECC SOI will have sections added to align ECC A and B flow through the bypass valve to maintain ECC operable when flow through the chiller is isolated, and to secure ECC A and B flow through the bypass valve when flow through the chiller is restored. A precaution and limitation will be added to the CCCW SOI to state that unless the bypass valve is first opened, isolation of ECC flow through CCCW Chiller A and B will render ECC inoperable due to inadequate minimum flow.

Corrective actions will include clarification of expectations, monitoring of performance and providing feedback to improve the performance of plant procedure preparers and approvers, the planning organization, licensed reactor operators, and the operations clearance group. Training on ECC and the lessons learned from this event will be incorporated into the Operator Continuing Training Program.

PREVIOUS SIMILAR EVENTS

A review of Licensee Event Reports and the Corrective Action Program database for the past three years was completed for conditions written for operations prohibited by TS due to configuration control and Human Performance errors. LER 2005-005, "Inadequate Review of On-Line Work Results in Technical Specification Entry," describes a condition where a Shift Manager determined that all in progress TS required work had not been previously identified. As a result, TS LCO Required Actions were not completed. The cause was determined to be less than adequate impact review for two orders and their associated clearances prior to the work being released. Corrective actions included revising clearance notes to include affected relays and inadequate equipment impact reviews. The previous LER causes and associated corrective actions would not have been expected to prevent this event.

A review of corrective action program documents over the last three years found that a condition report (08-32972) was written for a cross-cutting theme for the human performance aspect, "Work Control.

Although the condition report is still under management review, the condition report's causes of less than adequate implementation of human performance tools and elimination of error traps are similar to the causes for this LER. The condition report is recent and its corrective actions have not all been implemented.

The cause of this LER (2008-002) occurred in 2003 and is latent in nature. The reviewed corrective actions taken over the previous three years would not have prevented this event.

COMMITMENTS

There are no regulatory commitments contained in this report. Actions described in this document represent intended or planned actions, are described for the NRC's information, and are not regulatory commitments.

Note: Although this LER has been reviewed and approved by site management, the associated condition report's root cause evaluation is expected to receive an internal "collegial" review by the site's corrective action review board after the LER has been submitted to the NRC.

�