IR 05000327/2013014
| ML13345A284 | |
| Person / Time | |
|---|---|
| Site: | Sequoyah  |
| Issue date: | 12/11/2013 |
| From: | Nease R NRC/RGN-II/DRS/EB1 |
| To: | James Shea Tennessee Valley Authority |
| References | |
| IR-13-014 | |
| Download: ML13345A284 (13) | |
Text
December 11, 2013
SUBJECT:
SEQUOYAH NUCLEAR PLANT - APPARENT VIOLATION CLOSURE INSPECTION REPORT 05000327/2013014 AND 05000328/2013014
Dear Mr. Shea:
This letter refers to the component design basis inspection completed on August 9, 2013, at your Sequoyah Nuclear Plant, Units 1 and 2. On September 16, the team leader conducted a supplementary exit with Mr. John Carlin and other members of your staff to present changes to the inspection as a result of the teams review of additional information. The results of the inspection were documented in Inspection Report 05000327/2013007 and 05000328/2013007 (Agencywide Documents Access and Management, ADAMS, System Accession Number ML13267A460) dated September 23, 2013.
Based on the results of this inspection, one finding was identified for which the NRC had not yet reached a final significance determination. The team identified that the licensee failed to consider instrument uncertainty and design basis requirements in determining the allotted time for operators to complete time-critical actions to swap emergency core cooling pump suction from the refueling water storage tank to the containment sump. Because this finding required additional risk analysis to determine the final significance, the finding was issued as an Apparent Violation in accordance with the NRC Enforcement Policy. The current Enforcement Policy is included on the NRCs Web site at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. The Region II Senior Reactor Analyst has completed the significance determination process and determined the finding was of very low safety significance (Green). The results of this determination are documented in the enclosed report.
The NRC is treating this violation of very low safety significance as a non-cited violation consistent with Section 2.3.2 of the NRC Enforcement Policy. If you contest this violation or the significance of the violation, you should provide a response within 30 days of the date of this inspection report, with the basis for your denial, to the Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-001; with copies to the Regional Administrator Region II; the Director, Office of Enforcement, United States Nuclear Regulatory Commission, Washington, DC 20555-0001; and the NRC Resident Inspector at Sequoyah.
In accordance with Title 10 of the Code of Federal Regulations 2.390 of the NRCs Rules of Practice, a copy of this letter, its enclosure, and your response, if any, will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of the NRCs Agencywide Documents Access and Management System (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely, RA
Rebecca L. Nease, Chief
Engineering Branch 1
Division of Reactor Safety
Docket Nos.: 50-327, 50-328 License Nos.: DPR-77, DPR-79
Enclosure:
Inspection Report 05000327/2013014, 05000328/2013014 w/Attachment: Supplementary Information
REGION II==
Docket Nos.:
50-327, 50-328
License Nos.:
Report Nos.:
05000327/2013014, 05000328/2013014
Licensee:
Tennessee Valley Authority (TVA)
Facility:
Sequoyah Nuclear Plant, Units 1 and 2
Location:
Sequoyah Access Road
Soddy-Daisy, TN 37379
Dates:
September 23 - November 22, 2013
Inspectors:
Shakur Walker, Senior Reactor Inspector
Nicole Coovert, Reactor Inspector
Theodore Fanelli, Accompanying Personnel
Approved by:
Rebecca L. Nease, Chief
Engineering Branch 1
Division of Reactor Safety
SUMMARY
IR 05000327/2013014, 05000328/2013014; 9/23/2013-11/22/2013; Sequoyah Nuclear Plant,
Units 1 and 2; Significance Determination Process.
This inspection was conducted by three Nuclear Regulatory Commission (NRC) inspectors from Region II. The significance of inspection findings are indicated by their color (i.e., greater than Green, or Green, White, Yellow, Red) and determined using Inspection Manual Chapter (IMC)0609, Significance Determination Process dated June 2, 2011. Cross-cutting aspects are determined using IMC 0310; Components Within the Cross Cutting Areas dated October 28, 2011. All violations of NRC requirements are dispositioned in accordance with the NRCs Enforcement Policy dated January 28, 2013, revised July 9, 2013. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 4.
NRC identified and Self-Revealing Findings
Cornerstone: Mitigating Systems
- Green: The team identified a non-cited violation of 10 CFR 50, Appendix B, Criterion III, Design Control, for the licensees failure to correctly translate design basis requirements into emergency sub-procedure, ES-1.3, Transfer to Residual Heat Removal Containment Sump, Revision 19. Specifically, the time allotted for operators to perform time critical actions to swap emergency core cooling system (ECCS) pump suction from the refueling water storage tank (RWST) to the containment sump during a small break loss of coolant accident (SBLOCA) did not properly account for full range of instrument uncertainties (instrument, instrument calibration, instrument loop uncertainties, etc) and the accident analysis design basis requirement in Updated Final Safety Analysis Report 15.3.1, to ensure the recovery of the core was demonstrated and to ensure continuous operation of the ECCS. This was a performance deficiency. As immediate corrective action, the licensee performed an operability review and documented the results in the corrective action program as problem evaluation reports 760336 and 758761. The licensee concluded that there were no current operability concerns, and created Standing Order SO-13-025 to reinforce operator time performance requirements.
The performance deficiency was determined to be more than minor because it affected the Design Control attribute of the Mitigating Systems cornerstone, and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of containment spray pumps, safety injection pumps, and charging pumps during a SBLOCA. Specifically, the licensee failed to demonstrate that operators would be able to successfully complete the time critical actions (TCAs)prior to reaching 8 percent RWST tank level which required operators to secure all pumps taking suction from the RWST. From the licensees calculations evaluating and documenting the basis for the TCAs, the licensee had not considered the worst case allowable acceptance criteria for RWST level instrument uncertainties from calibrations or instrument loops in conjunction with the design pump flow rates. This action would result in the momentary loss of all ECCS high pressure injection during a SBLOCA and did not ensure the availability, reliability, and capability of the ECCS to respond to initiating events.
The team used Inspection Manual Chapter 0609, Significance Determination Process, Attachment 4, Initial Characterization of Findings, and Appendix A, The Significance Determination Process for Findings At-Power. The Senior Reactor Analyst completed a Phase 3 detailed risk evaluation and determined the finding to be of very low safety significance. This finding was not assigned a cross-cutting aspect because the underlying cause was not indicative of present licensee performance.
REPORT DETAILS
REACTOR SAFETY
Cornerstones: Initiating Events, Mitigating Systems, Barrier Integrity
1R21 Component Design Bases Inspection
.1 (Closed) Apparent Violation (AV): Failure to Adequately Translate Design Basis Into
Procedure Acceptance Criteria Time to Perform Operator Action (RWST Swapover)
a. Inspection Scope
This finding was identified as an AV in the Sequoyah Nuclear Plant 2013 component design basis inspection (CDBI) report 05000327/2013007 and 05000328/2013007 (ADAMS Accession Number ML13267A460) dated September 23, 2013, pending the NRCs completion of the Significance Determination Process (SDP) to assess the significance of the finding. The team reviewed the licensees revised Prompt Determination of Operability (PDO) regarding the licensees ability to perform the time critical actions (TCAs) with respect to realistic design flows, actual instrument calibration records, instrument loop uncertainties, and past operator performance times. The Senior Reactor Analyst performed a SDP Phase 3 to determine the final risk significance of the finding.
b. Findings
Introduction:
An NRC-identified Green non-cited violation (NCV) of 10 CFR 50, Appendix B, Criterion III, Design Control, was identified for the licensees failure to correctly translate design basis requirements into emergency procedure, ES-1.3, Transfer to Residual Heat Removal Containment Sump, Revision (Rev.) 19.
Specifically, the time allotted for operators to perform TCAs to swap emergency core cooling system (ECCS) pump suction from the refueling water storage tank (RWST) to the containment sump during a small break loss of coolant accident (SBLOCA) did not properly account for full range of instrument uncertainties (instrument, instrument calibration, instrument loop uncertainties, etc) and the accident analysis design basis requirements described in Updated Final Safety Analysis Report (UFSAR), Section 15.3.1, to ensure the recovery of the core was demonstrated and to ensure continued operation of the ECCS.
Description:
The licensees USFAR described function, system operation, and requirements for ECCS in Section 3.1.2, Conformance with NRC General Design Criteria - Overall Requirements, which stated, in part, that the primary function of the ECCS was to deliver borated cooling water to the reactor core in the event of a LOCA.
This limited the fuel-clad temperature and thereby ensured that the core would remain intact and in place and fuel damage would not exceed that stipulated as a basis in the safety analysis (Chapter 15). In addition, UFSAR Section 6.1, Engineered Safety Features - General, stated, in part, that the ECCS protected the fuel cladding following a LOCA by providing a timely, continuous and adequate supply of borated water to the reactor coolant system (RCS) and, ultimately, the reactor core. The ECCS provides high head injection through safety injection pumps (SIPs) and centrifugal charging pumps (CCPs), and low head injection through residual heat removal pumps (RHRPs) and accumulator injection immediately following an accident. Low head/high head recirculation is used in the long-term recovery period.
Section 6.3.2.2, Equipment and Component Design, of the UFSAR described the system operation of ECCS. The operation of the ECCS following a LOCA, was divided into two distinct modes:
- (1) the injection mode in which any reactivity increase following the postulated accidents was terminated, initial cooling of the core was accomplished, and coolant lost from the primary system in the case of a LOCA was replenished; and
- (2) the recirculation mode in which long term core cooling was provided during the accident recovery period.
In the event of a SBLOCA, as stated in USFAR, Section 15.3.1, an intermediate small break would be large enough to cause a significant RCS mass loss. The depressurization rate would be slow enough for those breaks to minimize pumped injection and ultimately, the small break transient would be mitigated by the pumped ECCS injection and/or the passive (accumulator) injection. As a result, during a SBLOCA, the licensee would rely on the injection of high pressure ECCS pumps to inject above the pressure of the reactor, which would be depressurizing at a slow rate. Low pressure injection from the RHRPs and the accumulator would not occur until later in the event response timeline due to reactor pressure still being higher than RHRPs shutoff head pressure. Therefore, during a SBLOCA, there would be times when the SIPs and CCPs would be the only ECCS injection source. In contrast, during a large break (LB)
LOCA, a significant RCS mass loss and a fast depressurization rate would occur, establishing continuous flow using low pressure injection through RHRPs and accumulators.
During normal operation system line-up, ECCS components would be in stand-by mode of operation aligned to the RWST. In the event of a LOCA, a safety injection signal would be initiated and all ECCS pumps would receive an auto-start signal. Based upon containment pressure, two containment spray pumps (CSPs) would be running, and CCPs and SIPs pumps would be injecting into the reactor based upon reactor vessel pressure. The RHRPs would be running; however, they would not be injecting, until after the reactor has significantly depressurized to lower pressures. When the RWST reaches 27% (percent) level, the operators receive a control room annunciator which would direct them to procedure ES-1.3, Transfer to Residual Heat Removal Containment Sump, in order to align suction for the ECCS pumps and CSPs from the RWST to the containment sump. The procedural and automatic actions transition ECCS from the injection phase to the recirculation phase; however initially, recirculation would be through the same paths as the injection phase.
The team reviewed the licensees calculations, SQN-SQS2-0110, Emergency and Abnormal Operating Procedure Setpoints, Rev. 21, and NDQ0063980038, RWST and Containment RHR Sump Safety and Operational Limits, Setpoint Required Accuracy, and LBLOCA and SBLOCA Sump Minimum Levels, Rev. 14, to determine the basis of the RWST water levels, pump flow rates, and operator times for critical actions. The calculations stated, in part, that TCAs were a manual action or series of actions that must be completed within a specified time to meet the plant licensing basis.
There are two significant RWST level setpoints related to TCAs: low level at 27% and low-low level at 8% tank level. As discussed above, during normal system line-up, the water supply to the CSPs, SIPs, and the CCPs are aligned to the RWST. During a SBLOCA, once the tank lowers to 27% level, several actions occur: a main control room alarm is annunciated for RWST Lo-Level; an automatic swapover of a suction valve from the RWST to the containment sump; and two TCAs start concurrently. The first TCA is for the operators to stop one CSP within two minutes in order to slow down the rate of RWST inventory usage. The second TCA is performed in parallel and requires the operators to manually complete, within 8 minutes, the recirculation valve swapover alignment for the CCPs and SIPs, when RCS pressure is above the shutoff head of the RHRPs. The total operator action time of 8 minutes was based upon the calculated time for the RWST level to decrease from low level (27%) to low-low level (8%). In addition, at 8% RWST level or lower, a second main control room alarm is annunciated for RWST Lo-Lo Level and the operators are procedurally required to secure all pumps taking suction from RWST, which are the CSP, SIPs, and CCPs.
The calculation justifications stated that the RWST setpoints selected would ensure that ECCS flow would not be interrupted during a LOCA. In addition, during a SBLOCA, the pressure in the RCS is high enough to prevent flow into the RCS from the RHR pumps, therefore, the setpoint selection was to also ensure that there was enough water in the RWST between the low level setpoint and the low-low level setpoint to allow time for the manual realignment of the SIPs and CCPs to the discharges of the RHR pumps for high-head recirculation. These setpoints and time requirements were translated into procedure ES-1.3, which directed the control room operators to perform TCAs during a SBLOCA.
Technical Specification (TS) Bases 3/4.5, ECCS System, stated, in part, that the CCPs and SIPs were credited in a SBLOCA event and that this event established the flow and discharge head at the design point for the CCPs. Using design flow for the CSPs, CCPs, and SIPs, combined with the allowed times to perform the two TCAs for RWST swapover at 27% level, the team determined that the 8% tank level would be reached prior to completing the TCAs (if operators took the entire 8 minutes) which would require operators to secure these pumps. At this point in the SBLOCA event, ECCS injection would be stopped. In addition, calculation SQN-SQS2-0110, stated, If the alignment of the CCPs and SIPs is not completed within the above times, then these pumps would be shutdown at RWST low-low level and restarted after the valve manipulations for the recirculation are completed. As previously discussed, with RCS pressure above the shutoff head of the RHRPs, there could be some time period when no ECCS injection occurs. During this time period, decay heat removal would be from boiling of the water in the reactor vessel. No fuel damage would occur until the core becomes uncovered, which would add several minutes to time available to align the CCPs and SIPs for recirculation. However, because UFSAR Section 15.3.1 required continued operation of the ECCS, the team determined that this calculation justification did not meet design basis requirements.
The team also identified that the licensees calculations did not consider the impacts of RWST instrument inaccuracies and worst case allowable calibration specifications, in conjunction with the pump flow rates from the RWST. As a result, the calculations did not accurately validate that that time allotted for the operators to perform the actions (8 minutes) would ensure success in meeting the design basis requirements.
The team reviewed the licensees calibration surveillances for the RWST level instruments associated with the 27% and 8% tank levels. The team identified that the TS allowable tolerances for the 27% level instruments were between 26.69% to 28.09%
level. For the 8% level instruments, the allowable calibration was 7.80% +/- 2.09%.
The worst case allowable as-left calibration was 26.69% for RWST low level and 9.89%
for RWST low-low level. The team also reviewed the instrument loop uncertainty calculations for RWST level instruments, as documented in SQN-EEB-MS-TI28-0015, Instrument Accuracy Calc 1-LT-63-50,-51,-52,-53 RWST Switchover, Rev. 11, and SQN-QN-EEB-MS-TI28-0025, Instrument Accuracy Calc 1-LT-63-50,-51,-52,-53 RWST PAM Indication, Rev. 13. The team identified that when the low level indicator was at 27%, which equated to 130 inches of RWST level, the actual level, based upon instrument loop uncertainties, could be as high as 143.388 inches or as low as 115.873 inches. When the low-low level indicator was at 8%, which equated to 54.2 inches of RWST level, the team identified that actual level could be as high as 67.872 inches or as low as 40.296 inches.
The team identified that with the worst case allowable instrument calibration setpoints, combined with the design pump flow rates, the time allotted by the procedure (8 minutes) for operators to perform the TCAs for RWST swapover during a SBLOCA did not ensure successful performance of the actions prior to reaching the RWST low-low level. Operators are required to secure all ECCS pumps taking suction from the RWST when the low-low level alarm comes in. Based on the teams calculations using worst case allowable instrument calibration and design pump run-out flows, the team determined there was approximately 6.5 minutes available to complete the swapover before having to secure ECCS. In addition, when the team considered the effects of worst case instrument loop uncertainties, the team determined that the licensee would not be successful at performing the TCAs even using the worst case actual simulator operator times (6 minutes and 8 seconds was longest recorded). As a result, the two primary functions for ECCS, injection and recirculation, would be lost until realignment to the sump was made to restore core cooling.
In response to these concerns, the licensee performed an immediate operability determination that indicated operators, as demonstrated by previous simulator test runs which included a sample of seven timings for each TCA, were consistently performing the TCAs in less time (6 minutes and 8 seconds was longest recorded) than the 6.5 minutes calculated by the team. In addition, Standing Order SO-13-025 was created to recognize the non-conservative acceptance criteria and reinforce operator time performance requirements. The licensee performed two PDOs to provide a reasonable expectation of operability. One PDO, problem evaluation report (PER) 760336, evaluated the past two years of instrument calibration as-found results and the full range of instrument uncertainties in conjunction with the actual pump flow rates based upon piping design and pump curves with respect to reactor pressure. The second PDO, PER 758761, evaluated the impacts of emergency diesel generator over/under frequency on ECCS pumps, due to the allowable TS tolerances. From the results of the analyses in the immediate operability determination and PDOs, the team determined that the licensee, using the combination of all of the following factors: actual operator times from the simulator, instrument uncertainties, as-found instrument calibration results, reasonable instrument loop uncertainty, and realistic pump flow rates, would be able to complete the TCAs for RWST swapover successfully prior to having to secure all ECCS injection.
Analysis:
The team determined that the licensees failure to fully consider the range of instrument uncertainties and design basis requirements in determining the allotted time for operators to complete ECCS suction swapover from the RWST to the sump as required by 10 CFR 50, Appendix B, Criterion III, was a performance deficiency. This failure resulted in the potential for ECCS flow to be interrupted during a SBLOCA, which does not meet UFSAR design requirements. The performance deficiency was determined to be more than minor because it affected the Design Control attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective of ensuring the availability, reliability, and capability of CSP, SIPs, and CCPs during a SBLOCA. Specifically, the licensee failed to demonstrate that the operators would be able to successfully complete the TCAs prior to reaching 8% RWST tank level, at which time the operators would be required to secure all ECCS pumps taking suction from the RWST. This action would result in the momentary loss of all ECCS high pressure injection during a SBLOCA and did not ensure the availability, reliability, and capability of the ECCS to respond to initiating events.
The team used IMC 0609, Significance Determination Process, Attachment 4, Initial Characterization of Findings, for Mitigating Systems and Appendix A, The Significance Determination Process for Findings At-Power, both issued June 19, 2012, to evaluate the finding. Appendix A required a detailed risk evaluation because the finding represented a loss of function, i.e., inability to provide high head safety injection flow during a loss of coolant accident, under certain conditions. A senior reactor analyst subsequently performed a Phase 3 analysis of the risk impact while at-power. The analyst determined that the risk significance of the issue was very low (i.e., Green). The dominant accident sequence was a SBLOCA where: 1) the operators either do not act promptly to establish swapover, or 2) RWST level instruments are calibrated in a non-conservative (but still in an allowable range), or 3) both. The remaining mitigation of such an accident was comprised of recovery of the terminated injection flow. This finding was not assigned a cross-cutting aspect because the underlying cause was not indicative of present licensee performance.
Enforcement:
Appendix B of 10 CFR Part 50, Criterion III, Design Control, requires, in part, that measures shall be established to assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures, and instructions. Contrary to the above, since plant startup, the licensee failed to correctly translate design basis requirements into procedure, ES-1.3, to ensure that the time allotted for operator actions to swap ECCS pump suction from the RWST to the containment sump during a SBLOCA would ensure continuous operation of the ECCS. The licensee performed immediate operability and PDO evaluations to provide a reasonable expectation of operability based on operator time performances of the TCAs in the simulator, revised actual design flows, instrument loop uncertainties, and actual calibration data for the RWST level instruments. The violation was entered into the licensees corrective action program as PER 760336 to evaluate the finding and determine the appropriate final corrective actions. This violation is being treated as an NCV, consistent with Section 2.3.2 of the NRC Enforcement Policy. (NCV 05000327,328 /2013014-01, Failure to Adequately Translate Design Basis Into Procedure Acceptance Criteria Time to Perform Operator Action).
4OA6 Meetings, Including Exit
On December 04, 2013, the team leader presented the final results of the significance determination process to Mr. Mike McBrearty. The inspectors verified that no proprietary information was retained by the inspectors or documented in this report.
ATTACHMENT:
SUPPLEMENTARY INFORMATION
KEY POINTS OF CONTACT
Licensee personnel
John Campbell, Senior Design Electrical Engineer
Dennis Dimopoulos, Design Engineering Manager
Greg Mailen, Design I&C Engineer
Mike McBrearty, Site Licensing Manager
NRC personnel
- R. Nease, Chief, Engineering Branch Chief 1, Division of Reactor Safety, Region II
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened and Closed
- 05000327, 328 /2013014-01 NCV Failure to Adequately Translate Design Basis Into Procedure Acceptance Criteria Time to Perform Operator Action (Section 1R21.1)
Closed
- 05000327, 328/2013007-06 AV Failure to Adequately Translate Design Basis Into Procedure Acceptance Criteria Time to Perform Operator Action (Section 1R21.1)
ATTACHMENT