05000483/LER-2010-009, Regarding High Energy Line Break (HELB) Program Deficiencies

Regarding High Energy Line Break (HELB) Program Deficiencies

ML110280328
Person / Time
Site:	Callaway
Issue date:	01/27/2011
From:	Reasoner C Ameren Missouri, Union Electric Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
ULNRC05764 LER 10-009-00
Download: ML110280328 (12)

LER-2010-009, Regarding High Energy Line Break (HELB) Program Deficiencies

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(v), Loss of Safety Function
4832010009R00 - NRC Website

text

~~

WAmeren MISSOURI Callaway Plant January 27, 2011 u.s. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-0001 Ladies and Gentlemen:

ULNRC05764 10 CFR 50.73(a)(2)(i)(B) 10 CFR 50.73(a)(2)(ii)(B) 10 CFR 50.73(aX2)(v) 10 CFR 50.73(aX2)(vii) 10 CFR 50.73(a)(2)(ix)(A)

DOCKET NUMBER 50-483 CALLAWAY PLANT UNIT 1 UNION ELECTRIC CO.

FACILITY OPERATING LICENSE NPF-30 LICENSEE EVENT REPORT 2010-009-00 HIGH ENERGY LINE BREAK (HELB) PROGRAM DEFICIENCIES The enclosed licensee event report is submitted in accordance with 10 CFR 50.73 to report the identification of programmatic deficiencies in the implementation of the Callaway Plant High Energy Line Break (HELB) Program. These deficiencies resulted in previous events in which operability of plant equipment can not be demonstrated.

This letter does not contain new commitments.

Sincerely, Cleve Reasoner Vice President Engineering ACS Enclosure: LER 2010-009-00 PO Box 620 Fulton, MO 65251 AmerenMissouri.com

ULNRC05764 January 27,2011 Page 2 cc:

Mr. Elmo E. Collins, Jr.

Regional Administrator U.S. Nuclear Regulatory Commission Region IV 612 E. Lamar Blvd., Suite 400 Arlington, TX 76011-4125 Senior Resident Inspector Callaway Resident Office U.S. Nuclear Regulatory Commission 8201 NRC Road Steedman, MO 65077 Mr. Mohan C. Thadani (2 copies)

Senior Project Manager, Callaway Plant Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Mail Stop 0-8G 14 Washington, DC 20555-2738 Mr. James Polickoski Project Manager, Callaway Plant Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Mail Stop 0-8BIA Washington, DC 20555-2738

ULNRC05764 January 27,2011 Page 3 Index and send hardcopy to QA File A160.0761 Hardcopy:

Certrec Corporation 4200 South Hulen, Suite 422 Fort Worth, TX 76109 (Certrec receives ALL attachments as long as they are non-safeguards and may be publicly disclosed. )

LEREvents@inpo.org (must send the WORD versioll ofihe LER to this address)

Electronic distribution for the following can be made via LER ULNRC Distribution:

A. C. Heflin F. M. Diya C. O. Reasoner III D. W. Neterer L. S. Sandbothe S. A. Maglio S. L. Gallagher T. L. Woodward (NSRB)

T. B. Elwood D. E. Dumbacher (NRC)

B. D. Brooks (WCNOC)

Ms. Diane M. Hooper (WCNOC)

Mr. Tim Hope (Luminant Power)

Mr. Ron Barnes (APS)

Mr. Tom Baldwin (PG&E)

Mr. Wayne Harrison (STPNOC)

Ms. Linda Conklin (SCE)

Mr. John O'Neill (Pillsbury Winthrop Shaw Pittman LLP)

Missouri Public Service Commission Records Center (INPO)

NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150*0104 EXPIRES: 10/31 /2013 (10*2010)

, the NRC may digits/characters for each block) not conduct or sponsor, and a person is not required to respond to, the information collection.

13. PAGE Callaway Plant Unit 1 05000483 1 OF 9

4. TITLE High Energy Line Break (HELB) Program Deficiencies

5. EVENT DATE

6. LER NUMBER

7. REPORT DATE

8. OTHER FACILITIES INVOLVED YEAR I SEQUENTIAL I REV FACILITY NAME DOCKET NUMBER MONTH DAY YEAR NUMBER NO.

MONTH DAY YEAR FACILITY NAME DOCKET NUMBER 12 1

2010 2010 - 009 -

00 1

27 2011

9. OPERATING MODE

11. THIS REPORT IS SUBMITIED PURSUANT TO THE REQUIREMENTS OF 10 CFR§: (Check all that apply) o 20.2201 (b) o 20.2203(a)(3)(i) o 50.73(a)(2)(i)(C)

[gl 50.73(a)(2)(vii)

MODE 1 o 20.2201 (d) o 20.2203(a)(3)(ii) o 50.73(a)(2)(ii)(A) o 50.73(a)(2)(viii)(A) o 20.2203(a)(1) o 20.2203(a)(4)

[gl 50.73(a)(2)(ii)(B) o 50.73(a)(2)(viii)(B) o 20.2203(a)(2)(i) o 50.36(c)(1 )(i)(A) o 50.73(a)(2)(iii)

[gl 50.73(a)(2)(ix)(A)

10. POWER LEVEL o 20.2203(a)(2)(ii) o 50.36(c)(1 )(ii)(A) o 50.73(a)(2)(iv)(A) o 50.73(a)(2)(x) o 20.2203(a)(2)(iii) o 50.36(c)(2)

[gl 50.73(a)(2)(v)(A) o 73.71 (a)(4) o 20.2203(a)(2)(iv) o 50.46( a)(3)(ii)

[gl 50.73(a)(2)(v)(B) o 73.71 (a)(5) 100%

o 20.2203(a)(2)(v) o 50.73(a)(2)(i)(A)

[gl 50.73(a)(2)(v)(C) o OTHER o 20.2203(a)(2)(vi)

[gl 50.73(a)(2)(i)(B)

[gl 50.73(a)(2)(v)(D)

Specify in Abstract below or in N"Rr. Fnrm ~fifiA

12. LICENSEE CONTACT FOR THIS LER FACILITY NAME rELEPHONE NUMBER (Include Area Code)

T.B. Elwood, Supervising Engineer, Regulatory Affairs and Licensing 314-225-1905 CAUSE SYSTEM COMPONENT MANU*

REPORTABLE

CAUSE

SYSTEM COMPONENT MANU*

REPORTABLE FACTURER TO EPIX FACTURER TO EPIX

14. SUPPLEMENTAL REPORT EXPECTED

15. EXPECTED MONTH DAY YEAR 121 YES (If yes, complete 15. EXPECTED SUBMISSION DATE)

ONO SUBMISSION DATE 04 01 2011 ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single-spaced typewritten lines)

On 12101/2010, evaluation of a Nuclear Oversight audit of Engineering Programs identified cases in which Callaway Plant did not properly implement High Energy Line Break (HELB) defenses. These cases of improper HELB barrier and boundary control challenged equipment Operability. Pending further analysis, systems required to mitigate HELB events may not have been able to perform as needed. These systems include auxiliary feedwater, component cooling water, residual heat removal, and the ultimate heat sink.

The failure to properly implement HELB defenses was determined to be a programmatic deficiency of the HELB Program at Callaway Plant. Technical guidance in the Hazard Barrier Program procedure and management oversight of the HELB program were both determined to be insufficient to prevent challenges to equipment Operability. Corrective actions include the development of appropriate compensatory measures, calculation of HELB hazard information and barrier capabilities, and verification that HELB analysis of record reflects current plant configuration.

NRC FORM 366 (10-2010)

6. LER NUMBER I

SEQUENTIAL I NUMBER 009 REV NO.

00 2

1.

OVERVIEW OF HIGH ENERGY LINE BREAK DEFENSES AND RIS 2001-09

3. PAGE OF A high energy line break (HELB) is a postulated accident that can introduce harsh environmental conditions (e.g., temperature, pressure, humidity, and flooding) to plant equipment and challenge the operability of equipment needed to mitigate the HELB. Defenses against HELB events include: 1) ensuring equipment located in rooms susceptible to a postulated HELB are qualified to operate in harsh conditions, 2) implementing barriers to shield unqualified equipment from the HELB hazard, and 3) removal of the hazard by isolation of the high-energy line (or reduction of the energy in the line).

Implementation of a HELB boundary by means of high energy line isolation can prevent areas downstream of the isolation point from being subject to the high-energy hazard upstream of the isolation point. In areas where isolation of high-energy lines can not occur, hazard barriers are credited with protecting plant equipment from the harsh conditions of a postulated HELB event. At Callaway Plant, the implementation of hazard barriers is performed under Hazard Barrier Program procedure APA-ZZ-00750.

Hazard barriers for HELB events are typically doors or hatches that can be opened, removed, or otherwise impaired. When hazard barriers are impaired in such a way that they would not be reasonably expected to protect against hazards as required, Regulatory Issue Summary (RIS) 2001-09 provides the following guidance (edited slightly, as shown, for the context of this LER):

[Limitations may exist for] continued reactor operation with a hazard barrier removed. For example, an auxiliary feedwater (AFW) pump that is credited with mitigating a HELB event would be rendered inoperable if a barrier that is credited with protecting the AFW pump from the effects of the postulated HELB event is removed to allow maintenance to be performed in the AFW pump room. The pump would not be able to mitigate the HELB event with the barrier removed, and consistent with the guidance provided in [RIS 2005-20], the [Technical Specification (TS)] limiting condition for operation of the AFW pump would apply. It may be possible to take compensatory measures to maintain pump Operability and avoid entering the TS action statement for shutting down the reactor (e.g., installing a temporary barrier that provides equivalent protection). Also, if the hazard does not exist at the time (e.g., if the high energy line is isolated and depressurized), the pump would remain operable.

2.

INITIAL PLANT CONDITIONS

The overall programmatic deficiencies described in this report were discovered when the plant was in Mode 1 at 100% power. Plant conditions specific to each resulting case are described in Section 3 of this LEA.

3.

EVENT DESCRIPTION

A Nuclear Oversight (NOS) audit of Engineering Programs identified deficiencies in the Callaway Plant HELB Barrier Program in late 2010. Upon NOS identification of these deficiencies, a standing order was issued that required an engineering evaluation to be performed prior to impairing any HELB barriers (in place of APA-ZZ-00750 guidance). No HELB barriers were impaired at the time the order was issued.

Beginning on December 1,2010, subsequent evaluation of these issues began to reveal instances within the last three years in which the improper implementation of HELB defenses may have challenged equipment Operability. These instances appeared to involve inadequate control of HELB barrier impairments and/or inadequate analysis of the H ELB hazards in Engineering evaluations.

An analysis of each of these cases was performed with a computer model using assumptions based on the analysis of record. Preliminary results of this analysis are summarized below for each case. A supplement to this LER will be provided once analysis of the events can be completed.

6. LER NUMBER I

SEQUENTIAL I NUMBER 009 REV NO.

00

3. PAGE 3

OF In the cases below involving HELB barrier impairments performed under Fire Protection Impairment Permits (FPIPs), the necessary compensatory measures (e.g., hourly or continuous fire watches) to maintain fire and pressure boundary functions were met. However, due to programmatic deficiencies in the HELB program, compensatory measures were not sufficient to maintain HELB barrier function. (The causes and events that led to the overall programmatic deficiencies are discussed in Section 6 of this LER.)

Case 1: Main Steam Line Break in the Main Steam Tunnel Affecting the Auxiliary Building Door DSK11273 provides a barrier between the main steam tunnel and the Auxiliary Building stairwell A-2.

This door was blocked open under twelve FPIPs in the previous three years. With DSK11273 open, its HELB barrier function is defeated, exposing the stairwell to the effects of a postulated Main Steam Line Break (MSLB) in the main steam tunnel. In conjunction with these impairments of DSK11273, other doors and hatches were impaired under FPIPs listed below:

FPIP No.

Modes Start Time End Time Duration (hh:mm) 15833 1

2010.04.14 08:34 2010.04.14 17:24 8:50 18551 1

2010.03.22 16:00 2010.03.22 18:49 2:49 18522 1

2010.03.17 20:06 2010.03.20 05:46 57:40 16523 1

2008.10.09 08:02 2008.10.09 12:32 4:30 Common to all four FPIPs are impairments to door DSK11275 in stairwell A-2 and equipment hatches connecting the top three floors of the Auxiliary Building. FPIPs 15833 and 16523 each contained additional impairments to Auxiliary Building doors and hatches, including the door into the Component Cooling Water (CCW) surge tank rooms.

The piping in the main steam tunnel is especially robust and designed not to exceed stress limits that would cause a pipe failure. However, a failure of this piping was assumed for the purposes of this analysis.

The analysis of a postulated MSLB in the main steam tunnel shows that the CCW surge tank level transmitters, CCW heat exchanger bypass valve solenoid valves, Limitorque motor operated valves (MOVs),

and various control panels that are needed for CCW Operability may not have been able to perform their necessary functions in this event. Pending further investigation, CCW system Operability cannot be demonstrated under these four barrier impairment configurations for a postulated MSLB.

Case 2: Main Steam Line Break in the Turbine Building Doors DSK13291, DSK14032, and DSK33044 are HELB boundary doors that separate the Turbine Building from the Auxiliary Building. At least one of these three doors was blocked open under a number FPIPs since December 1, 2007. Impairing one of these doors allows a postulated MSLB in the Turbine Building to affect areas in the Auxiliary Building containing equipment not qualified to withstand a MSLB environment.

In particular, impairment of DSK13291 would allow a postulated MSLB accident environment into the AFW pump vestibule and associated pipe chase rooms. Condensate storage tank (CST) to AFW pump suction header pressure transmitters are located in this area and may not have been able to perform in this environment. These AFW pressure transmitters swap suction of the AFW pumps from the CST to Essential Service Water (ESW). The postulated loss of function of these transmitters could render all trains of AFW inoperable.

This door was impaired under 21 FPIPs in Modes 1-3 since December 1, 2007. Pending further investigation, Operability of AFW cannot be demonstrated with DSK13291 impaired.

Impairment of DSK33044 would allow a postulated MSLB accident environment into the Auxiliary Building 2000' elevation level corridors. Equipment in this area that may not have been able to perform in these conditions includes: CCW to/from Radwaste flow transmitters, CCW isolation valve solenoid valves, and residual heat removal (RHR) system flow switches.

The CCW transmitters and isolation valves are associated with the isolation of CCW to/from the Radwaste Building. The postulated loss of function of either set of these components could render both trains of CCW inoperable due to the loss of the isolation function. The affected RHR flow switches control the RHR pump discharge recirculation line. The postulated loss of function of these flow switches could render both trains of RHR inoperable.

DSK33044 was impaired five times in Mode 1 since December 1, 2007. Pending further investigation, Operability of CCW and RHR cannot be demonstrated with DSK33044 impaired.

Case 3: Auxiliary Steam HELB Affecting the Essential Service Water Pipe Room Door DSK11 011 is credited as a barrier for the ESW pipe chase room for a HELB originating in the Auxiliary Building 1974' elevation hallway. Since December 1, 2007, this door was impaired three times in Mode 1 for a total of 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br />, 19 minutes.

Of the components in this room, the Limitorque MOVs and the ESW temperature elements that control the cooling tower fan and ESW cooling tower bypass valve operation may not have been able to perform their required functions under HELB conditions. Pending further evaluation, Operability of ESW and the Ultimate Heat Sink (UHS) cannot be demonstrated with door DSK11011 impaired.

Case 4a: Auxiliary Steam HELB Affecting Component Cooling Water Boric acid batching tank auxiliary steam isolation valve FBV0147 serves as a HELB boundary for the associated auxiliary steam line. When FBV0147 is open, the auxiliary steam line downstream of the valve must be considered a high energy line. In this case, a harsh environment following an auxiliary steam line HELB affecting the Auxiliary Building 2026' level corridor must be postulated.

HELB analysis assumes FBV0147 is maintained closed. However, FBV0147 was maintained open for the majority of the previous three years. This configuration discrepancy had been previously identified at Callaway Plant, but the analysis performed at the time erroneously determined that the integrity of the barrier into the 2026' level corridor would be maintained in a HELB event.

Components for both trains of CCW are located in this corridor. In a harsh environment following a postulated auxiliary steam HELB, the unsealed solenoid valves and Limitorque MOVs in the 2026' level corridor may not have been able to perform properly. In addition, this area contains control panels that are required for unit shutdown. These control panels also may not have been able to perform properly in a harsh environment.

Pending further evaluation, neither train of CCW can be demonstrated Operable with FBV0147 open.

Case 4b: Auxiliary Steam HELB Affecting the Electrical Penetration Rooms The doors into both electrical penetration rooms (rooms 1409 and 1410) were opened to the Auxiliary Building 2026' elevation main hallway concurrent with the door to the boric acid batching tank room (room 1407) being open. With this door configuration and valve FBV0147 open, the electrical penetration rooms may have been exposed to a high energy environment in a postulated HELB event from room 1407. This occurred in Mode 1,

100% power, under an impairment permit that was in effect from 3/12/080749 to 3/17/08 0713 to allow for room painting and drying. The exact duration(s) of this door configuration is not known. However, based on the impairment description and the Job notes, it can be assumed that the FPIP allowed this configuration for no more than 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> at a time.

Equipment in the electrical penetration rooms is generally not qualified for a high energy environment. In particular, the safety-related 480 VAC Motor Control Centers (MCCs) in this room may not have been capable of performing their safety functions due to the postulated conditions. These MCCs serve portions of many plant systems, including AFW, the Reactor Coolant System (RCS), the Chemical and Volume Control System (CVCS), ESW, CCW, RHR, supportive HVAC systems, and Safety Injection (SI).

In this configuration, any number of these systems assumed to mitigate the consequences of a HELB could have been affected by a postulated Auxiliary Steam HELB in room 1407. Pending further evaluation, these components cannot be demonstrated Operable for this period of time.

Case 5a: Auxiliary Building Equipment Hatches Equipment hatches between elevations of the Auxiliary Building are credited as HELB barriers in the analysis of record. Without adequate compensatory measures, the impairment of one or more of these hatches may have allowed the harsh environment from a postulated HELB to spread to other levels in the Auxiliary Building containing equipment not qualified for the pressure, temperature and steam conditions associated with a HELB.

Multiple configurations of Auxiliary Building equipment hatch impairments have existed since December 2007.

Case 5b: Auxiliary Building Stairwells Similar to Case 5a, stairwell doors in the Auxiliary Building are credited as HELB barriers in the analysis of record. Without adequate compensatory measures, the impairment of one or more of these stairwell doors may have allowed the harsh environment from a postulated HELB to spread to other levels in the Auxiliary Building containing equipment not qualified for the pressure, temperature and steam conditions associated with a HELB.

Multiple configurations of Auxiliary Building stairwell door impairments have existed since December 2007.

4.

ASSESSMENT OF SAFETY CONSEQUENCES

Overall, HELBs are low-frequency occurrences. These events would have to cause systems required to mitigate a postulated HELB to be rendered non-functional in order to result in substantive safety consequences.

In Cases 1 and 4a, portions of both trains of the CCW system could be impacted. CCW is ultimately required to mitigate the consequences of these postulated HELBs because it is used to bring the plant to a cold shutdown condition. However, immediately following either of these events, the plant could have been held at hot standby. While in hot standby, it is assumed that personnel can assess plant status and make repairs prior to going to cold shutdown. If the CCW system was not functional due to a postulated HELB, it could be restored to service prior to it being required to mitigate a MSLB or Auxiliary Steam HELB.

For the postulated MSLB in the Turbine building described in Case 2, the AFW system or CCW and RHR systems could be impacted. Following a MSLB, the AFW system is required to maintain the plant in hot standby. CCW and RHR systems are required to bring the plant from hot standby to cold shutdown.

I SEQUENTIAL I NUMBER 009 REV NO.

00 6

OF Case 3 postulates a break in the auxiliary steam system concurrent with the door to the ESW pipe chase being impaired. With the hazard barrier defeated, both trains of the ESW system may be impacted. It is assumed that following an auxiliary steam HELB, the plant will be taken to hot standby. While in hot standby, personnel can assess plant status and make repairs prior to going to cold shutdown. Since the ESW system serves as the safety-related makeup to the AFW system, the ability to maintain hot standby may be impacted following a postulated HELB event.

In Case 4b, the doors to both electrical penetration rooms were impaired simultaneously. These rooms contain components that serve multiple safety-related systems and are not qualified for a harsh steam environment. Impacted systems include: AFW, RCS, CVCS, ESW, CCW, RHR, supportive HVAC systems, and SI. With these systems potentially impacted, the ability to maintain the plant at hot standby could be affected. However, during the review of door impairments during the past three years, this condition was found to have existed only once and for a period of less than 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />.

The impacts of Cases 5a, Auxiliary Building Equipment Hatches, and 5b, Auxiliary Building Stairwells are considered to be enveloped by Cases 1 through 4.

5.

REPORTING REQUIREMENTS

This LER is submitted pursuant to the 10 CFR 50.73 criteria described below:

10 CFR 50.73(a)(2)(i)(B): Operation or Condition Prohibited by Technical Specifications For cases in which two trains of CCW cannot be considered Operable, the appropriate Technical Specification is LCO 3.0.3. LCO 3.0.3 directs Mode 3 entry within 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />. This Completion Time was not met.

For cases in which three trains of AFW cannot be considered Operable, TS 3.7.5 Condition E directs immediate action to restore Operability of one AFW train prior to any other required mode changes. This Technical Specification was not met.

In Case 2, two trains of RHR cannot be considered Operable. The appropriate Technical Specification for two ECCS trains inoperable is LCO 3.0.3. LCO 3.0.3 directs Mode 3 entry within 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />. This Completion Time was not met.

In Case 3, ESW and the Ultimate Heat Sink cannot be considered Operable. The limiting Technical Specification is TS 3.7.9 for the inoperable UHS. TS 3.7.9 Condition B directs Mode 3 entry within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

This Completion Time was not met.

The most time-restrictive Technical Specification for Case 4b is TS 3.7.5, Condition D, for two AFW trains inoperable. This Condition directs Mode 3 entry within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. This Completion Time was not met.

As described above, the deficiencies described in this LER represent operation prohibited by Technical Specifications.

10 CFR 50.73(a)(2)(ii)(B): Degraded or Unanalyzed Condition Plant equipment that would have needed to respond to a postulated HELB event might not have been able to respond to the event as assumed. The deficiencies described in this LER could have resulted in an unanalyzed condition that significantly degraded plant safety.

10 CFR 50.73(a)(2)(v): Event or Condition That Could Have Prevented Fulfillment of a Safety Function This LER describes cases in which one or more systems would have been unable to perform their HELB mitigation functions. This impacts Function (D) of this criterion, "mitigate the consequences of an accident."

The systems described in these cases are also associated with functions (A), (B) and (C) of this criterion.

10 CFR 50.73(a)(2)(vii): Common-cause Inoperability of Independent Trains or Channels As described above, Technical Specification Operability criteria were not met for two or more trains of the AFW, CCW, RHR and ESW systems. This loss of Operability resulted from a single cause and affected parallel trains of systems designed to perform safety functions described in the rule.

10 CFR 50.73(a)(2)(ix)(A): Single Cause that Could Have Prevented Fulfillment of the Safety Functions of Trains or Channels in Different Systems Any single HELB boundary event that rendered multiple trains inoperable would not meet this criterion because the equipment inoperability resulted from a shared dependency among trains that is a natural consequence of the plant design (Le., a common space). However, when considering the overall programmatic deficiency as a single underlying cause, the deficiencies of the Callaway Plant HELB program caused trains in different systems to be rendered inoperable. Thus, in addition to 50.73(a)(2)(v) and 50.73(a)(2)(vii), this reportability criterion is also met.

6.

CAUSE OF THE EVENT

Section 3 of this LER documents a series of cases in which Operability criteria for plant equipment required to mitigate a HELB were not met. These cases are symptomatic of a greater programmatic deficiency in which HELB calculations and guidance were not sufficient to prevent challenges to equipment operability.

Two root causes were determined for this deficiency. The first root cause is that the technical guidance in Hazard Barrier Program procedure APA-ZZ-00750 was insufficient to successfully implement the guidance of RIS 2001 -09. Without sufficient guidance, HELB evaluations permitted barrier impairments that did not consistently maintain equipment operability. The second root cause is that management oversight of Engineering programs - specifically, the HELB Program - was not sufficient to prevent challenges to protected equipment. This root cause enabled insufficient technical guidance to persist and also allowed for the inappropriate evaluation of HELB boundaries and barriers. Taken together, these root causes allowed deficiencies to exist within the Callaway Plant HELB defenses.

7.

CORRECTIVE ACTIONS

A number of corrective actions have been determined to address the root causes (listed above) and contributing causes of these programmatic deficiencies. These corrective actions include, but are not limited to, the following:

• The pressure capacities of the Auxiliary Building HELB doors and the pressure produced by each type of high energy hazard will be calculated and documented. This will identify the door capabilities and available margin so that proper impairment evaluations can be made in the future.

• Appropriate compensatory actions for HELB barriers will be developed. This will allow equipment Operability requirements to be met when HELB barriers are impaired.

6. LER NUMBER I

SEQUENTIAL I NUMBER 009 REV NO.

00

3. PAGE 8

OF

• A list of hazard barriers that are not permitted to be opened in conjunction with other barriers will be developed. This will identify which HELB barriers would be required to provide hazard protection when another HELB barrier is impaired.

I

• The HELB Program will be designated as an official Engineering Program. This designation will require additional program ownership and oversight.

• A review and verification of the assumptions made in the calculation of record will be performed. This will ensure that the analysis reflects current plant configuration.

As stated in Section 3 of this LER, a standing order was established to obtain an engineering evaluation prior to impairing HELB barriers. This order will be lifted once the appropriate corrective actions are implemented.

8.

PREVIOUS SIMILAR EVENTS

In December 2009, Callaway Plant personnel identified that auxiliary steam isolation valve FBV0146 was maintained open, contrary to HELB analysis calculations. This event was initially reported to the NRC under Event Notification 45571 as an unanalyzed condition that significantly degrades plant safety. This notification was subsequently retracted when subsequent analysis concluded that the condition did not render safety-related components inoperable.

9.

OTHER INFORMATION The Energy Industry Identification System (EllS) identifiers for the components and systems mentioned in this report are as follows:

System: SB, Main Steam System System: CC, Component Cooling Water System Components:

LT, Level Transmitter; SOL, Solenoid; HCV, Hand Control Valve; PL, Panel; FT, Flow Transmitter; System: BA, Auxiliary Feedwater System Component:

PT, Pressure Transmitter System : BP, Residual Heat Removal System Component:

FS, Flow Switch System: BI, Essential Service Water System Components:

HCV, Hand Control Valve; TE, Temperature Element System: BS, Ultimate Heat Sink System: SA, Auxiliary Steam System Component:

ISV, Isolation Valve System: ED, Low Voltage Power System, Class 1 E Component:

MCC, Motor Control Center System : AB, Reactor Coolant System System: CB, Chemical Volume and Control System System: BQ, Safety Injection System YEAR 2010

6. LER NUMBER

3. PAGE I

SEQUENTIAL I REV NUMBER NO.

9 OF 9

009 00