05000483/LER-2003-006
| Callaway Plant Unit 1 | |
| Event date: | 7-3-2003 |
|---|---|
| Report date: | 3-18-2004 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(V)(C) 10 CFR 50.73(a)(2)(V)(D) 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(v)(C), Loss of Safety Function - Release of Radioactive Material |
| 4832003006R01 - NRC Website | |
I. � DESCRIPTION OF THE REPORTABLE EVENT
A. REPORTABLE EVENT CLASSIFICATION
The initial procedural issue involving the arming of the Pressurizer Power Operated Relief Valves has been reclassified as a voluntary LER. Initially, the event was classified as reportable per 10CFR50.73(a)(2)(v)(C) and 10CFR50.73(a)(2)(v)(D), an event or condition that could have prevented the fulfillment of a safety function to control the release of radioactive material and mitigate the consequences of an accident, respectively. Subsequent evaluations have determined that dose to the public resulting from the procedure problem would have been below limits established by the Standard Review Plan (SRP) and well below regulatory limits. The ability to maintain offsite dose to levels below SRP and regulatory limits demonstrate that this event did not represent a safety system functional failure.
B. PLANT OPERATING CONDITIONS PRIOR TO THE EVENT
Callaway Plant was in Mode 1 at 100 percent power.
C. STATUS OF STRUCTURES, SYSTEMS OR COMPONENTS THAT WERE INOPERABLE AT THE
START OF THE EVENT AND THAT CONTRIBUTED TO THE EVENT
Not Applicable to this event.
D. NARRATIVE SUMMARY OF THE EVENT, INCLUDING DATES AND APPROXIMATE TIMES
In March, 2003, Callaway discovered an error in the Final Safety Analysis Report (FSAR) involving the Steam Generator Tube Rupture (SGTR) accident analysis and resulted in LER 2003-003-00. As part of an extent of condition review, a decision was made to perform a review of all accidents which stipulated operator response time requirements. As part of this review, the problem involving arming the Pressurizer Power Operated Relief Valves (PZR PORV) during an SGTR accident was discovered and described in the following text as Revision 0 of this LER. All new text can be identified by a vertical bar located to the left of the text.
On 7/3/03, during development of Licensed Operator Continuing Training (LOCT), it was discovered that an error existed in emergency procedure E-3, STEAM GENERATOR TUBE RUPTURE. The postulated accident involved a reactor trip due to a loss of off-site power compounded by a steam generator tube rupture (SGTR) on "D" loop of the reactor coolant system, and a stuck open auxiliary feedwater flow control were being armed in order to provide cold overpressure protection during the cool down phase. By arming the PORVs early, this made it difficult to secure Safety Injection later in the SGTR recovery. Cool down of the reactor coolant system (RCS) was accomplished using the intact S/G Atmospheric Steam Dump (ASD) valves. The cool down was initiated in order to equalize RCS pressure with that of the ruptured S/G, thereby securing flow from the RCS to the faulted S/G. As the cool down progressed, cold Safety Injection water migrated into the Tcold portion of the faulted RCS loop as flow to the ruptured S/G was decreasing. The PZR PORVs actuate based upon the auctioneered lowest Tcold temperature and as the Tcold temperature decreased in the faulted loop, the PORV setpoint would decrease until a PORV actuation would occur. This PORV actuation would then rapidly lower RCS pressure and jeopardize maintaining the required RCS subcooling margin. With actuation of the PORV, an inflow of water into the Pressurizer would also occur in the "D" loop surge line. This influx of water from the loop via the surge line allowed additional cold Safety Injection water to flow into the faulted loop and further reduced the PORV actuation setpoint, increasing the possibility of additional PORV actuations.
If the subcooling margin could not be maintained, then the Licensed Operators (LO) could not proceed with the accident recovery procedure until conditions were re-established to allow reducing RCS temperature and pressure in a controlled manner per the E-3 procedure. This cool down would be repeatedly interrupted by actuation of the PORV's and delay reaching conditions where Safety Injection could be terminated. This in turn, prolonged the event and resulted in additional primary water being released to the atmosphere via the ruptured SIG which increased radiation dose to the public.
A review of superceded revisions of E-3 determined that in 1988, the statement arming the PZR PORVs was added to the E-3 procedure, with the "reason for change" stated as to comply with Westinghouse Emergency Response Guides (ERGs). It should be noted that research indicates no specific directions concerning the operation of cold overpressure protection systems has been contained in ERGs. In Westinghouse Direct Work DW-87-047, it stated that the ERGs address a Cold Overpressure Protection System (COPS) to ensure that utilities consider this system operation in the process of developing the EOPs. Not until DW-98-001 were instructions given to add the cold overpressure protection system in- service temperature limit as criteria for depressurizing the RCS in FR-P.2.
The reason the PORV's were armed for the cold overpressure mitigation system (COMS) in the pressure channel coincidence closed the PZR block valves. The associated ERG required the PZR PORV block valves to be OPEN. Therefore in order to have the PZR PORV's available for use, COMS was armed and allowed the block valves to remain OPEN. Westinghouse Direct Work 98-044 recognized that the initiation of COMS was a plant specific item and thus no change was made to the generic EOP's. During Callaway Plant Refuel 11 the 2185 PSIG interlock was deleted in order to make the PZR PORV control circuits' safety grade and made the arming of the PZR PORVs unnecessary. Until 1999, the Callaway plant simulator did not exhibit these conditions due to computer modeling limitations.
The condition described in this LER potentially would have delayed recovering from a SGTR but it did not prevent recovery. Several crews of Licensed Operators used the flawed procedure in simulator exercises to determine potential responses, with the results ranging from minor delays accompanied by few PORV operations, to crews being delayed long enough that they were procedurally directed to alternate recovery procedures which would then eventually accomplish the necessary final recovery solution. Those crews that were sufficiently delayed so that they were required to use alternate procedures had two alternate resolution flow paths. One flow path required transitioning to a procedure for SGTR with loss of reactor coolant and subcooled recovery required. The other flow path involved a one hour soak period to restore compliance with RCS cool down rates. However, recovery was always possible, just delayed by varying amounts of time dependent upon operator response times to conditions experienced during the simulations.
In order to determine a postulated dose to the public, staff personnel concluded that a 3-hour accident duration is a limiting assumption for the time to terminate SGTR releases. This determination is based on the following rationale:
Procedure E-0 is entered upon the SGTR and Reactor Trip at time 0. Step 14 of E-0 requires a transition to E-3 and the E-3 transition will occur in approximately 20 minutes. At this point RCS temperature is less than 540 degrees F. Procedure E-3 is entered and its actions are performed. Following the arming of the Cold Overpressure Mitigation System (COMS), the initial cool down, and the first depressurization, the issue with the contrasting auctioneering of COMS and the subcooling monitor will be encountered. Loss of subcooling will be indicated due to the high reactor coolant hot leg temperature in the stagnant loop with the ruptured steam generator. Step 16 of E-3 requires a transition to procedure ECA-3.1, SGTR WITH LOSS OF REACTOR COOLANT - SUBCOOLED RECOVERY DESIRED. The cumulative time is 60 minutes or less.
RCS temperature is less than 440 degrees F. ECA 3.1 is entered and its actions performed. A 100 degree F/hr cool down rate is established per step 11. Step 27 has the Emergency Core Cooling Systems (ECCS) pumps operated as necessary. At 350 degree F, the Residual Heat Removal (RHR) system is placed in service per step 37. At this time in the event, the Control Room and the OnSite Emergency Response Organization will have recognized a release is in progress, and also that subcooling exists in the core, and that the hot leg temperature indication is from a stagnant loop. Discussions between the Control Room and the OnSite Emergency Response Organization result in actions that restore subcooling and allow securing of ECCS pumps. The cumulative time is conservatively estimated at 180 minutes or less.
To establish a dose estimate, a bounding steady-state DEI-131 value of 0.07 microcuries/gm was selected for the time period of interest. The DEI-131 value chosen reflects the highest steady state value actually observed at Callaway since the year 2000. This was conservatively treated as being composed entirely of I- 131. This is conservative because the longer half-life of 1-131 will cause it to last longer in the primary and secondary side inventories, and will extend its availability to produce offsite consequences.
Offsite thyroid doses are the limiting concern for this accident. The SRP limit for SGTR with an accident- initiated iodine spike is 30 Rem to the thyroid. This value was estimated for the Exclusion Area Boundary (EAB) and the Low Population Zone (LPZ). The EAB dose is a 0-to-2-hour value. The LPZ dose covers a longer duration, but is calculated with a lower atmospheric dispersion factor (X/Q).
The following values were calculated for a 3-hour duration SGTR-Overfill with a 0.07 DEI-131and are bounded by the Standard Review Plan (SRP) limits and FSAR stated values:
- EAB Thyroid Dose 6.51 Rem
- LPZ Thyroid Dose 1.71 Rem Using this information, it has been concluded that this event does not represent a safety system functional failure, therefore reporting criteria 10CFR50.73(a)(2)(v)(C) and 10CFR50.73(a)(2)(v)(D) were removed from this LER. This event is now being reported as a voluntary LER.
E. METHOD OF DISCOVERY OF EACH COMPONENT, SYSTEM FAILURE, OR PROCEDURAL ERROR
The E-3 procedure error was discovered during development of Licensed Operator Continuing Training.
II. EVENT DRIVEN INFORMATION
A. SAFETY SYSTEMS THAT RESPONDED
Not applicable to this this event because this LER details a hypothetical SGTR accident and corresponding actions to recover.
B. DURATION OF SAFETY SYSTEM INOPERABILITY
No safety systems were rendered inoperable as a result of the event described in this LER.
C. SAFETY CONSEQUENCES AND IMPLICATIONS OF THE EVENT.
An initial Probabilistic Risk Assessment (PRA) determined that the reported event was of very low risk significance. A revised PRA concluded a problem with EOP E-3 could delay the securing of SI during a SGTR coincident with a Loss of Offsite Power (LOOP). This could potentially prolong recovery from the SGTR. This, in turn, would result in additional steam generator liquid release to the atmosphere via the ruptured steam generator's atmospheric steam dump (ASD) valve and increased dose to the public. The PRA calculation determined the increased Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) to be of very low safety significance. � .
III. CAUSE OF THE EVENT
The procedure error was due to incorrect evaluation of Westinghouse correspondence, which led to the insertion of the extra step in procedure E-3 to arm the PZR PORVs and enabling operation of COMS.
IV. CORRECTIVE ACTIONS
Once the E-3 procedure error was identified, a new revision was issued which corrected the problem.
A Self Assessment was conducted from August 25 through 29, 2003 to review Callaway's process for controlling Emergency Operating Procedures. No other Emergency Operating Procedure deficiencies were identified that would have prevented the fulfillment of a safety function or the mitigation of the consequences of an accident. As a result of this Self Assessment, the following actions are being taken:
- Westinghouse EOP correspondence will be evaluated for applicability to Callaway.
- Emergency Operating Procedures are being revised as necessary, based upon the results of the previously mentioned correspondence evaluation.
- Callaway's administrative procedure governing the revision of Emergency Operating Procedures will be revised to incorporate a formal review and documentation process of Westinghouse correspondence applicable to Callaway.
- An Emergency Operating Procedures Upgrade Program is being implemented to enhance the review and revision of all EOP procedures.
V. PREVIOUS SIMILAR EVENTS
On 7/3/03, Callaway Action Request (CAR) 200304922 was written to document the present issue. In reviewing the Callaway Action Request System (CARS) historical records for the past 3 years, no additional CARs were identified that were associated with the problem identified in this LER.
A review of LERs for the last three years did not reveal any LERs submitted for an issue similar to the one documented in this LER.
VI. ADDITIONAL INFORMATION
The system and component codes listed below are from the IEEE Standard 805-1984 and IEEE Standard 803A-1984 respectively.
System: � Not Applicable. There was no equipment failure as described in this LER.
Component: � Not Applicable. There was no equipment failure as described in this LER.