IR 05000317/1987009
| ML20206N208 | |
| Person / Time | |
|---|---|
| Site: | Calvert Cliffs  |
| Issue date: | 04/10/1987 |
| From: | Lester Tripp NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML20206N201 | List: |
| References | |
| 50-317-87-09, 50-317-87-9, NUDOCS 8704200424 | |
| Download: ML20206N208 (10) | |
Text
--
y r
,
'
,
)
U. S. NUCLEAR REGULATORY COMMISSION
'
REGION I
Docket / Report: 50-317/87-09 License: DPR-53 t
s Licensee:
Baltimore Gas and Electric Company Facility:
Calvert Cliffs Nuclear Power Plant, Unit 1 Inspection At: Lusby, Maryland
,
Dates:
March 26-30, 1987
,
Inspector:
'T.
F e
r esident Inspector Approved:
/
'
p. E. Tripp, Chi y tor Projects Section 3A date Summary: March 26-30, 1987:
Special Inspection Report 50-317/87-09 This is a special inspection to ascertain the circumstances involving the isolation of all recirculation actuation system level switches, as reported in Licensee Event Report (LER) 317/87-05 dated March 2, 1987.
Inspection hours totalled 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
Results: Two apparent violations were identified: (1) failure to comply with the General Precautions of a surveillance test procedure which resulted in the plant being in a condition in which both trains of the Emergency Core Cooling and Con-tainment Spray Systems, systems designed to mitigate a serious safety event, were unable to perform their intended function under certain conditions; and (2) failure to report an event or condition that alone could have prevented the fulfillment of the safety function of systems that are needed to mitigate the consequences of an accident.
t 870420 g Q h 17
'PDR A
PDR G
,
,
..
).
f
.,,
, _.,,. _., _ _ _ _ _
,_
__ _
,,n
-
-
,
.
DETAILS
.
Within this report period, interviews and discussions were conducted with various licensee personnel, including reactor operators, maintenance and surveillance technicians and the 'icensee's management staff.
1.
Event Summary
,
'<
1'
On February 17, 1987, all four sensor channels of the recirculation actuation i
system (RAS) were inoperable for approximately 15 minutes when an operator isolated the four level switches which sense refueling water tank (RWT) level.
,
The isolation of the level switches caused inoperability of the RAS which is an automatic feature required by Technical Specifications in order for each
-
,
of the emergency core cooling systems (ECCS) and containment spray systems (CSS) to be considered operable. Hence, both trains of ECCS and CSS were inoperable in apparent violation of several Technical Specifications.
2.
Background On February 20, 1987, licensee representatives notified the Senior Resident Inspector that on February 17, in preparation for the performance of a sur-veillance test on RWT level switches, four RWT level switches for Unit 1 RWT were inadvertently isolated for about 10-15 minutes by shutting the isolation valves, and then subsequently reopened. The licensee further stated that the applicable Technical Specification (TS) 3.3.2 " Engineered Safety Feature Ac-tuation System Instrumentation", Table 3.3-3(5.b) " Containment Sump Recircu-i lation, Recirculation Actuation Signal (RAS)" requi.res that a minimum of 3 channels of refueling water tank level remain operable, and that the applic-able " Action Statement", Action 7 did not address more than 1 channel being inoperable at a time. The licensee, therefore, considered themselves in Limiting Condition for Operation LC0 3.0.3 which states:
"When a Limiting Condition for Operation is not met, except as provided in the associated ACTION requirements, within one hour ACTION shall be initiated to place the unit in a MODE in which the specification does not apply...."
..
However, the isolation valves were reopened and consequently the RAS channels were restored to an operable status within about 15 minutes. The licensee stood that further investigation was in progress and that a Licensee Event Report (LER) might be forthcoming pending review of this occurrence by the
.
Plant Safety Committee.
The inspector agreed that an LER was appropriate.
t 3.
System Description During a Loss of Coolant Accident (LOCA) if off-site power is available, the following cubponents are actuated by a safety injection actuation signal (SIAS):
two high pressure safety injection (HPSI) pumps start, both low pressure safety injection (LPSI) pumps start, eight HPSI line isolation valves open,
,
,
(!j
{ f
- -,.
_._
.
-
- _.
-
.. - - -
,.... -.-
.
(
-
_
_
-
-
.
four LPSI line isolation valves open, the auxiliary HPSI isolation valve opens (if it was shut), the leak-off return line to reactor coolant (RC) drain tank isolation valve shuts, and four safety injection tank (SIT) outlet motor-operated valves (MOVs) open (if they were shut).
The HPSI and LPSI pumps take a suction on the RWT and discharge borated water into the RCS through the HPSI and LPSI flow paths. When RCS pressure drops below the HPSI pump shutoff head, the HPSI pumps start delivering flow into the RCS. When the RCS pressure drops below the LPSI pump shutoff head, the four SITS discharge their content into the four RCS loops along with flow delivered by the LPSI pumps. When the RWT level drops below approximately 30 inches, the engineering safety feature actuation system (ESFAS) gener-ates an RAS, which initiates the following actions: containment sump isolation valves open, both LPSI pumps stop, and minimum flow recir-culation line isolation valves shut (unless locked out, normal position is open and locked out), and service water and component cooling water heat exchanger throttle valves return to the automatic throttled position.
'
The safety injection system then begins the recirculation mode of operation, where water spilling from the RCS break is recirculated by the HPSI pumps from the containment sump back onto the RCS. This mode of operation continues
until terminated or modified by operator action.
During the Design Bases Accident, recirculation actuation is initiated approximately 36 minutes after a LOCA.
The safety injection flow required to match core decay heat boil-off is approximately 410 gpm. One HPSI pump with 25 percent spillage injects 450 gpm into the RCS when the RCS pressure is at the maximum containment pressure.
Thus, flow from one HPSI pump is sufficient to prevent core damage at this time.
During normal operation one HPSI pump is locked out of automatic initiation for operator initiation if required.
Each unit is equipped with one RWT containing a minimum of 400,000 gallons of borated water at a boron concentration of between 2300 and 2700 ppm.
Each tank is equipped with four level switches (LS-4142A-D) with two level switch isolation valves per switch.
Each switch provides one signal to each train of logic A-D for the RAS component of the ESFAS.
4.
Applicable Technical Specifications (TS) and Other Requirements The following TS Limiting Conditions for Operations (LCOs) apply to this event.
--
TS 3.3.2.1, Engineered Safety Feature Actuation System Instrumentation Requires: A minimum of three operable RWT level switches. Two channels are required to trip /cause a RAS signal to be generated.
.
Permits: One channel to be inoperable for one hour before it must Se bypassed or tripped.
i
..
,
_
._
.
r
-
.
--
TS 4.3.2.1.1, Surveillance Requirement Requires: A Channel Functional Test of the RWT low level switch function on a monthly frequency.
--
TS 3.5.2, Emergency Core Cooling Systems Requires: Two independent ECCS subsystems shall be operable with each subsystem comprised of one operable high pressure safety injection pump, one operable low pressure safety injection pump, and an operable flow path capable of taking suction from the refueling water tank on a Safety Injection Actuation Signal and automatically transferring suction to the containment sump on a Recirculation Actuation Signal.
Permits: One subsystem to be inoperable for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
--
TS 3.6.2.1, Containment Spray System Requires: Two independent containment spray systems shall be operable with each spray system capable of taking suction from the RWT on a Con-tainment Spray Actuation Signal and Safety Injection Actuation Signal and automatically transferring suction to the containment sump on a Re-circulation Actuation Signal.
Each spray system flow path from the con-tainment sump shall be via an operable shutdown cooling heat exchanger.
Permits: One containment soray system to be inoperable for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> be-fore additional action is required.
--
TS 3/4.0, Applicability 3.0.1: Technical compliance with the Limiting Conditions for Operation contained in the specifications is required during the operational modes or other conditions specified therein; except that upon failure to meet the Limiting Conditions for Operation, the associated action requirements shall be met.
3.0.2: Noncompliance with a specification shall exist when the require-ments of the Limiting Condition for Operation and associated action re-quirements are not met within the specified time intervals.
If the Limiting Condition for Operation is restored prior to expiration of the specified time intervals, completion of the action requirement is not required.
3.0.3: When a Limiting Condition for Operation is not met, except as provided in the associated action requirements, within one hour action shall be initiated to place the unit in a mode in which the specification does not apply....
, _.
.
-
.
.
--
.- -
-
.
i
Where corrective measures are completed that permit operation under the action requirements, the action may be taken in accordance with the specified time limits as measured from the time of failure to meet the Limiting Condition for Operation.
Exceptions to these requirements are stated in the individual specifications.
10 CFR 50.73, Licensee event report system.
--
"(a) Reportable Events. The holder of an operating licensee for a-nuclear power plant (licensee) shall submit a Licensee Event Report (LER) for any event of the type described in this paragraph within.
30 days after the discovery of the event...
"(2) The licensee shall report... (B) any operation or condition prohibited by the plant's Technical Specifications..."
-
--
10 CFR 50.72, Immediate notification requirements.for operating nuclear power reactors.
/ (a) General Requirements: (1) Each nuclear power reactor licensee lic-
"
ensed under Section 50.21(B) for Section 50.22 of this part shall notify the NRC Operations Center via the Emergency Notification
_
System.... (b) Non-emergency events - (2) Four-hour reports.
If not reported under paragraphs (a) or (b)(1) of this section, the licensee shall notify the NRC as soon as practical and in all cases, within four hours of the occurrence of any of the following:...
"(iii)
Any event or condition that alone could have prevented the fulfillment of the safety function of structures or systems that are needed to:
"(A) Shut down the reactor and maintain it in a safe shutdown condition,
"(B) Remove residual heat,
"(C) Control the release of radioactive material, or-
"(D) Mitigate the consequences of an accident."
Applicable Procedures The following licensee procedures are relevant to this event.
--
E0P-5 " Loss of Coolant Accident", Rev. O Requires:
L.
Verify automatic RAS initiation between 0.5 and 1.0 feet on RWT level indication LIA-4143.
I
-
I.
_
_
.. _,,,., _ _. _ _. _.
_.. _ _ _
-. _..,
,
,.. _... _ _ _, _ _.._
_ _ _ _.,,, _ _., _.. _. _ _____ _
r
-
.
l
!
l 1.
Place SI pump recirc lockout switches in "0N".
2.
Commence RAS verification per Attachment (6).
3.
Shut RWT outlet valves:
SI-4142-MOV and SI-4143-MOV.
4.
Throttle HPSI flow to approximately 568 gpm.
5.
Maintain 30 gpm per operating HPSI pump by sequentially secur-ing charging pumps then HPSI pumps.
6.
I_f HPSI pump cavitation occurs in recirculation mode.
Then align containment spray pumps to HPSI pump suction.
a.
Open SDC recirculation valve (s) to 11(13) HPSI pumps, SI-662-MOV (SI-663-MOV).
b.
Start 11(12) containment spray pump.
--
E0P-5 " Attachment (6) - RAS Check-Off List" Requires: a check of the following:
Panel No. IC08-1C09-IC10 a.
2 LPSI Pumps.................
0ff b.
2 Pump Vent and Recirculation Isolation Valves (SI-659-MOV, SI-660-MOV).................. Shut c.
2 Containment Sump Isolation Valves (SI-4144-MOV, SI-4145-MOV)........................ 0 pen Panel No. 2C24A a.
2 No. 11(21) CCW HX Salt Water Inlet and Outlet Valves...... 0 pen b.
1 No. 12(22) CCW HX Salt Water Inlet Valve..................
0 pen c.
2 No. 12(22) CCW HX Salt Water Outlet Valve.................
0 pen d.
No. 11(21) SRW HX Salt Water Outlet Throttle Valve........ 0 pen e.
No. 12(22) SRW HX Salt Water Outlet Throttle Valve........ 0 pen
--
Calvert Cliffs Instruction CCI-309A " Locked Valves" This instruction is intended to describe the criteria used for determin-ing which valves at Calvert Cliffs are to be locked, the different types of locking devices to be used, the requirements for unlocking valves during various plant modes and the surveillance required to verify that these valves are locke _
-
.
.
Section III requires:
III. Criteria for Locking Valves A.
Valves are locked to prevent inadvertent operation which could:
1.
Render systems or equipment necessary for the safe operation of the plant inoperable.
B.
Locked valves are divided into five categories by the following criteria:
3.
Instrument root stops and test valves which if mis-positioned could prevent operation of the Reactor Protective System, ESFAS, or AFAS.
Section VI requires:
Locked Valve Deviation Sheets: Whenever any locked valve is taken
~out of its locked position, such deviation shall be logged in the
" Locked Valve Deviation Log".
This includes the repositioning of these valves for testing. When a locked valve is repositioned for an STP, and that STP requires the valve to be locked in its normal position and second checked by a licensed operator, a locked valve deviation is not required....
The Control Room Supervisor will approve a locked valve deviation by initialling the locked valve deviation sheet. When the deviation is initiated, it shall be logged and initialed by the operator placing the valve in the "out of normal position"... 0nce the valve is returned to its normal position and locked, it shall be cleared from the log by an entry in the " return to normal position" column.
Independent verification by two operators (the second checker must be a licensed operator) must be indicated by their initials when the valve is returned to normal. The CRS will then initial the locked valve deviation sheet to verify he was notified the valve was returned to normal.
--
STP-M-220-1 " Engineering Safety Feature Actuation System Functional Test",
Rev. 7 Requires:
I.
General Precautions
<
A.
Proceed through each section of this test in sequential steps.
B.
Not more than one channel shall be in a test mode at any one time, with the exception of pressurizer pressure blocking and steam generator blocking sensor channel,
o
.
,
V.
Refueling Water Tank Low Level Switch Calibration Check This step performs the calibration of level switches 1-LS-4142 A through D.
'
5.
Event Details Through discussions with the relevant personnel and reviews of the appropriate documents, the inspector commenced an investigation of this event on March 26, 1987.
On February 17, 1987, Unit 1 Control Room Operators were requested by the Instrument Maintenance Shop to have RWT level switch isolation valves unlocked in preparation for the performance of Section V of STP-M-220-1 Engineering Safety Features Actuation System Functional Test, RWT Low Level switch cali-bration. At approximately 0800 hours0.00926 days <br />0.222 hours <br />0.00132 weeks <br />3.044e-4 months <br /> the Control Room Operator (CRO) summoned the Auxiliary Operator (AO) (A0 outside watch) to the Control Room. The CR0 i
briefed the A0 on the calibration procedure the Instrument Maintenance per-sonnel were about to perform, then directed the A0 to go and remove the lock-ing devices from each isolation valve.
The CR0 then proceeded to fill out the locked valve deviation sheet as required by CCI-309 stating that the locking devices were removed. This was done in preparation for both the A0's and Control Room Supervisor's signatures upon completion of the evolution and for the CRO's interim tracking of the ongoing event.
The A0 left the Control Room shortly after 0800 hours0.00926 days <br />0.222 hours <br />0.00132 weeks <br />3.044e-4 months <br /> and proceeded to the radiologically controlled area 69-foot check-in point. He logged in/ checked with RadCon operations and obtained the required protective clothing (boots, gloves and lab coat). He then went to the.45-foot elevation (ground level),
outside to the RWT room where he donned the protective clothing, entered the contaminated area and proceeded to remove the locking devices. Upon comple-tion of removing the locking devices, the A0 shut the eight isolation valves (two per switch) in order to facilitate expected needs of the instrument
'
maintenance personnel about to perform the calibration.
The A0 removed his protective clothing at the step-off pad in the RWT room and returned to the Control Room to fill out and sign the locked valve devi-ation sheet. Upon signing his name, he told the CR0 that he had also shut the valves and that the locked valve deviation sheet did not reflect what he had done. The CR0 then directed the A0 to reopen the valves since the valves are only to be shut one at a time. The A0 went directly to the RWT room, redonned his protective clothing and opened the valves. He then returned to the Control Room and reported the valves open and locking devices removed and signed the deviation sheet. This occurred at about 0840 a.m.
Discussions with the operators indicate that the valves were shut for about 15 minutes and that the CR0 was unaware of the mispositioned valves for about 5 to 10 minutes.
l
,
!
!
- - - -
-
-
- - -. -
-- -.
. ~ - - -. -. -.
--,
-- -
_
.
__
-
.
-
On March 2,1987, the licensee submitted to the NRC Licensee Event Report 87-05 which had been reviewed by the Plant Operations Safety Review Committee-on February 27, 1987 (Meeting No. 87-13). The LER focused on the fact that all four sensor channels of the Recirculation Actuation System were inoperable for approximately 40 minutes.
Licensee corrective actions stated in this LER were:
1.
The General Supervisor of Operations will review the operations admini-strative policy on Formality in Communications with all Operations per-sonnel.
2.
This event will be reviewed by all Operations personnel.
3.
The importance of Engineeted Safety Features instrumentation will be stressed with all Plant Roundsmen through formal training.
The licensee further stated that if a loss of coolant accident had occurred, plant procedures require the operator to initiate a recirculation actuation signal manually if one does not occur automatically. The licensee reported this event pursuant to 10 CFR 50.73(a)(2)(1) " Operation prohibited by Tech-nical Specifications".
6.
Findings a.
The licensee reported having isolated the level switches which sense refueling water tank levels thereby rendering all four channels of the recirculation actuation system inoperable for approximately 40 minutes until the level switches were unisolated. While this report was appar-ently submitted in compliance with 10 CFR 50.73, it failed to identify that the action precipitating the situation also resulted in rendering inoperable all emergency core cooling and containment spray as operabil-ity is defined by the plant's technical specifications. This situation, which alone could have prevented the fulfillment of the safety function of systems needed to mitigate the consequences of an accident, was not reported until March 2, 1987, 13 days following the event. This is an apparent violation of 10 CFR 50.72, article (b)(2)(iii)(D).
b.
General Precaution B of Surveillance Test Procedure No. M-220-1, Revision 6, Engineered Safety Features Actuation System Function Test, states,
"Not more than one channel shall be put in a test mode at any one time, with the exception of pressurizer pressure blocking and stream (sic)
generation blocking sensor channels." Part V, Refueling Water Tank Low Level Switch Calibration Check, Step B.2 directs action to connect the test rig to the bottom of the level switch having isolated the applicable instrument root valves. This action commences the test procedure, essen-tially putting the instrument in the test mode. The isolation of all four refueling water level switches is an apparent violation of Surveil-lance Test Procedure STP M-220-1, which placed the plant in Technical Specification LC0 3.5.2 and 3.6.2.1 in that it caused both trains of emergency core cooling and core spray to be inoperable with the plant in power operation.
l
. -.
,.
.-
_
, _.
.
.
.
- - -. -
r
-
.
'
This apparent violation resulted in two systems designed to prevent or mitigate serious safety events not being able to perform their intended safety function for approximately 15 minutes.
!
The root cause of this event appears to have been problems in communications between the two key operations personr.el involved in the evolution (Auxiliary Operator and Control Room Operator).
.
It is noted that the licensee's administrative controls were effective in the early detection of this apparently inadvertent, unauthorized operation of valves and that LER 87-05 conservatively reported the time out of service as 40 minutes as opposed to the more probable 15 minutes; however, it is also noted that the LER did not address the more significant impact of this event, the placing of all emergency core cooling and containment spray systems into an inoperable status, i
and attendant failure to satisfy Limiting Conditions for Operation
3.5.2. and 3.6.2.1.
7.
Exit Interview A meeting was held with senior facility management to discuss the inspection scope and findings. A summary of findings was presented to the licensee at the end of the inspection.
.
.
I
'
.
l
- --
.,_
_ - -.. _ _
_, _ _ _ _
,
--.
-, - -
..
- - - -,. _ _
. ~. ~ -. _,