05000454/LER-2009-001
| Byron Station, Unit 1 | |
| Event date: | 10-28-2009 |
|---|---|
| Report date: | 06-09-2010 |
| 4542009001R01 - NRC Website | |
A. Background
The Emergency Core Cooling System (ECCS) [BQ/BP] has two 100% redundant trains. Each train has three phases of operations: injection, cold leg recirculation, and hot leg recirculation. In the injection phase, borated water from the Refueling Water Storage Tank (RWST) is injected into the Reactor Coolant (RC) [AB] System through the cold legs. When sufficient borated water has been removed from the RWST to maintain the reactor subcritical and the sumps can supply the required net positive suction head to the ECCS pumps, suction is switched to the sumps for cold leg recirculation. This is accomplished, in part, by an RWST low level signal automatically opening the sump isolation valve (i.e., SI8811) for each ECCS train. Though normally the SI8811 remains open during a design basis LOCA, the valve is also considered an isolation valve in the event of a faulted line outside of Containment during the accident should the line need to be isolated.
Technical Specification (TS) 3.5.2, "ECCS- Operating," is applicable in Modes 1 through 4 and allows for one train of ECCS to be inoperable for seven days. To facilitate maintenance activities on the low head subsystem of the ECCS (i.e., Residual Heat Removal (RH) [BP]), Byron Operating Procedure (BOP) RH-4, "Draining the RH System" drains the appropriate section/s of piping, when needed. The BOP RH-4 does not restrict its use to any particular Operating Mode. However, historically, maintenance on the RH system which required draining was performed in a refueling outage. The BOP RH-4 requires the SI8811 valve in the train being drained to be closed but it does not require it to be disabled from automatic opening. Similarly, BOP RH-3, "Filling the RH System," does not require the SI8811 valve to be disabled from automatically opening while refilling the suction line.
In the 2005 timeframe, an on-line dose reduction initiative, to drain and replace the water in the RH suction line after the completion of an outage, was adopted. Also, since the American Society of Mechanical Engineers (ASME) In-Service Testing (1ST) stroke testing of the SI8811 valves requires the RH suction line to be drained, Exelon Generating Company, LLC, via an approved 1ST relief request, moved the 1ST tests from Refueling Mode conditions to coincide with the drain of the RH piping for the on-line dose reduction initiative.
B. Description of Event
Event Date/Time: October 28, 2009 / 0027 Unit 1 was in Mode 1 — Power Operations RC System: Normal operating temperature and pressure No additional structures. systems, or components were inoperable at the start of this event that contributed to the event.
On October 27, 2009, a planned work window began for the Unit 1 Train B RH suction line to replace the existing water for dose reduction purposes, perform 1ST stroke tests on the Unit 1 Train B S18811 (i.e., 1S18811B) valve and to perform maintenance on the Train B RH pump's motor. Appropriate TS Action Conditions were entered and BOP RH-4 was initiated to drain the Unit 1 Train B RH suction line.
On October 28. 2009, at approximately 0027, the vent and drain valves for the Unit 1 Train B RH suction line were positioned open and draining commenced. At approximately, 0130, an on-shift licensed Reactor Operator (RO) questioned the adequacy of the BOP RH-4 controls. Specifically, the RO noticed the procedure positioned the 1S18811B closed but it remained energized. In this configuration, the valve would be capable of automatically opening if a Loss of Coolant Accident (LOCA) were to occur. In the event of a LOCA during the draining evolution, and a subsequent switchover to cold leg recirculation occurred, a leak path would exist from the Unit 1 B sump through the open drain and vent valves into the Auxiliary Building.
I Further discussions ensued with other Operators concerning the issue raised which culminated in the Shift Manager, at approximately 0400, directing the 1S18811B valve to be de-energized closed. However, by this time the draining was completed and the vent and drain valves re-closed. The RO initiated an Issue Report (IR) to place his concern into the Corrective Action Program (CAP) to address future RH suction line drain evolutions. At 1524 the same day, the 1S18811B 1ST stroke tests and other work activities on the RH pump motor were also completed.
Based on initial response to the IR written, Operations Management de-energized the 1S18811B during the re-fill evolution. At 2241 the Unit 1 B RH system suction piping fill was completed and the Unit 1 Train B RH returned to operable status. Review of the Operations IR concluded that having the RH vent and drain valves open while the SI8811 valve is capable of automatic opening is an unanalyzed condition.
Use of procedures BOP RH-4 and BOP RH-3 was suspended pending a root cause evaluation and appropriate corrective actions. The investigation revealed there were five other occurrences in which the RH suction vent and drain valves were open while the SI8811 valve was capable of automatically operating during Operating Modes 1 through 4. These occurrences were:
Unit 1 RH Train B Unit 1 RH Train A Unit 2 RH Train B Unit 2 RH Train A Unit 2 RH Train B April 6, 2005 April 19, 2005 October 15, 2005 October 16, 2005 May 8, 2007 The exact duration of these previous conditions could not be determined, but is estimated to be similar to the current event. Other RH work windows occurred that required draining of the RH suction line, however due to the nature of the maintenance activities, the SI8811 valve was de-energized closed as part of the work control process.
This condition is being reported in accordance with 10 CFR 50.73 (a)(2)(ii)(B) for being in an unanalyzed condition that significantly degraded plant safety.
C. Cause of the Event
The cause of this condition was an inadequate procedure in that when executed in Operating Modes 1 through 4. the BOP RH-4 did not provide necessary requirements to ensure a flow path from Containment into the Auxiliary Building environment did not exist if an automatic SI8811 opening signal coincident with a LOCA occurred during the draining evolution. The lack of procedural controls in this procedure existed since original startup of the units. The cause of the inadequacy could not be determined.
Several contributing causes were also identified: these include:
The Work Control Process does not have an effective means to ensure rigorous technical human performance techniques are applied to the implementation of improvement initiatives.
The Improved Technical Specifications and Bases implementation in February 1999 did not contain sufficient detail on this unique penetration configuration and its closed system outside of Containment as a barrier.
Licensed Operators received less than adequate training on the importance of maintaining a closed system intact as an isolation barrier.
D. Safety Significance
There were no actual safety consequences to this condition. At no time, in Modes 1 through 4, was a SI8811 valve in an open condition with the RH suction line breached. If a LOCA were to have occurred requiring the initiation of the ECCS during the short timeframe the RH vent and drain valves were open. then the SI8811 valve would have opened upon a RWST low level signal and radioactive sump water would have had a flow path outside of Containment into the Auxiliary Building, Engineering evaluations of the potential safety consequences of this condition concluded the following:
1. There is reasonable assurance the postulated post LOCA radiological dose consequences from this potential containment bypass path would not have exceeded licensing basis offsite and main control room dose limits; 2. There is reasonable assurance no consequential post LOCA safety significant issues would result from this condition, such as removing ECCS inventory sufficient to impact the operability of the other ECCS train, impacting the functioning of the open SI8811 valve to close upon demand or other equipment due to the creation of an adverse environment; and 3. The risk impact of this condition is considered to be of very low safety significance.
This condition did not result in any safety system functional failures.
E. Corrective Actions
Procedures BOP RH-4 and BOP RH-3 have been revised to ensure the S18811 valve is de-energized closed in Modes 1 through 4 while the RH vent and drain valves are open.
An extent of condition assessment was conducted for other containment penetrations with an isolation valve that receive an automatic open signal to mitigate a DBA. No further issues were identified. In addition, an extent of cause review was conducted to assess the adequacy of other activities moved from a refueling outage condition to on-line condition.
Appropriate Work Control processes have been assessed to determine the adequacy of technical rigor being applied to improvement initiatives of this nature.
Training will be provided to Licensed Operators and Engineers concerning lessons learned from this event. In addition, the Licensed Operator Training program has been assessed to determine adequacy of training in terms of this penetration configuration and the application of TS requirements for procedure revisions that change the mode of performance of an activity.
The TS Bases has been revised regarding the configuration of the Containment Penetration containing the S18811 valves.
F. Previous Occurrences
Other than the previous occurrences mentioned in Section B, there have been no similar events identified at Byron Station in previous three years.
4.2007;