IR 05000400/2004009

IR 05000400-04-009, on 10/25/2004 - 10/29/2004, Shearon Harris Nuclear Power Plant; Special Inspection IP 93812 for a Loss of Shutdown Cooling Event

ML043340263
Person / Time
Site:	Harris
Issue date:	11/26/2004
From:	Mccree V Division Reactor Projects II
To:	Scarola J Carolina Power & Light Co
References
IR-04-009
Download: ML043340263 (27)

Text

November 26, 2004

SUBJECT:

SHEARON HARRIS NUCLEAR POWER PLANT - NRC SPECIAL INSPECTION REPORT 05000400/2004009

Dear Mr. Scarola:

On October 29, 2004, the Nuclear Regulatory Commission (NRC) completed a Special Inspection at the Shearon Harris Nuclear Power Plant. The enclosed report documents the inspection findings which were discussed on October 29, 2004, with you and other members of your staff.

Based on the criteria specified in Management Directive 8.3, NRC Incident Investigation Procedures, the Special Inspection was initiated on October 22, 2004, in accordance with NRC Inspection Procedure 93812, Special Inspection. This Special Inspection was chartered to inspect and assess the circumstances associated with a loss of shutdown cooling event which occurred on October 18, 2004. The Special Inspection charter is included as an attachment to the enclosed inspection report. The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your license. The inspectors reviewed selected procedures and records, conducted field walkdowns, observed activities, and interviewed personnel.

Based on the results of this inspection, we have determined that your staff conducted a comprehensive review of the issue, and that the cause of the loss of shutdown cooling event was well understood. Identified problems were appropriately placed into your corrective active program. This report documents one finding concerning inadequately taped electrical leads which were lifted for relay testing, and which contributed to the loss of shutdown cooling event.

This finding has potential safety significance greater than Green (very low significance).

However, the finding does not present an immediate safety concern, because your staff subsequently completed the testing and restored the equipment to normal configuration.

In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publically Available Records (PARS) component of NRCs document system

CP&L

(ADAMS). ADAMS is accessible from the NRC Web-site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA by L. Wert for/

Victor M. McCree, Director Division of Reactor Projects Docket No.: 50-400 License No.: NPF-63

Enclosure:

Inspection Report No. 05000400/2004009 w/Attachments

REGION II==

Docket No:

50-400 License No:

NPF-63 Report No:

05000400/2004009 Licensee:

Carolina Power & Light (CP&L) Company Facility:

Shearon Harris Nuclear Power Plant, Unit 1 Location:

5413 Shearon Harris Road New Hill, NC 27562 Dates:

October 25 - 29, 2004 Inspectors:

G. McCoy, Senior Resident Inspector - Vogtle (Lead Inspector)

M. Cain, Resident Inspector - Summer P. OBryan, Resident Inspector - Shearon Harris Approved by:

P. Fredrickson, Chief Reactor Projects Branch 4 Division of Reactor Projects

Enclosure

SUMMARY OF FINDINGS

IR 05000400/2004-009; 10/25 - 29/2004; Shearon Harris Nuclear Power Plant; Special

Inspection IP 93812 for a loss of shutdown cooling event.

The inspection was conducted by a senior resident inspector and two resident inspectors. Two unresolved items were identifiedone with potential safety significance greater than

Green.

The significance of most findings is indicated by their color (Green, White, Yellow, Red) using IMC 0609, Significance Determination Process (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 3, dated July 2000.

Cornerstone: Mitigating Systems, Initiating Events

• Event Review The inspectors determined that the exact circumstances surrounding the initiating event could not be conclusively determined. The most probable cause was a failure to adequately insulate leads lifted from a degraded grid voltage time delay relay. A subsequent short circuit caused the loss of power to a 6.9 KV emergency bus and the operating residual heat removal (RHR) pump. The licensee adequately evaluated both the initiating event and the subsequent safety-related equipment responses.

The operators correctly diagnosed the event and restored core cooling in accordance with procedures. RHR flow to the core was secured for a total of four minutes, and the primary temperature rose approximately six degrees F.

The B RHR pump was operable and immediately available for service had the A pump failed to restart.

Communications deficiencies were noted between plant work control organizations and within the electrical work groups. Neither the work control center nor the control room were fully cognizant of some important work activities occurring in the plant. Also, deficiencies were noted in the work scheduling process and work activities reduced the defense in depth for protection against a loss of core cooling during a period of relatively high level of decay heat production. The electrical power supply for the A RHR pump was undergoing testing, control of the B RHR pump was shifted between the control room and the remote shutdown panel, and the plant had been depressurized which complicated the availability of natural circulation cooling using the steam generators.

• TBD A self-revealing finding was identified for failure to properly implement a test procedure, contrary to Technical Specification 6.8.1. An electrician inadequately taped the electrical leads which had been lifted from a time delay relay in a safety-related switchboard. The leads subsequently shorted, resulting in a loss of offsite power to one safety bus, with a loss of reactor shutdown cooling for four minutes. Subsequently, the leads were taped correctly and the procedure completed satisfactorily. This finding was related to the cross-cutting area of human performance because the performance deficiency was identified as the failure of maintenance personnel to adequately tape the lifted leads.

The finding is more than minor because it affected one train of decay heat removal while shutdown. The finding has potential safety significance greater than Green because a loss of shutdown cooling flow occurred during a period of relatively high decay heat production. This finding is unresolved pending completion of the significance determination process. (Section 03.04.b)

Licensee Identified Violations

None.

REPORT DETAILS

EVENT DESCRIPTION AND CHRONOLOGY 01.01 Initial Plant Conditions On October 18, 2004, Harris Nuclear Plant (HNP) was shutdown for RFO-12 and had been shutdown for approximately two days. The plant was in mode 5 with the reactor coolant system (RCS) depressurized and the pressurizer power operated relief valves (PORV) open. The A residual heat removal (RHR) system was in service in the shutdown cooling mode. RCS temperature, as measured at the discharge of the A RHR pump, was being maintained in a band from 115 to 120 degrees Fahrenheit (F). The A RHR pump discharge temperature at the time of the event was 116.7 degrees F with a calculated time to boil of 28 minutes. The A and B component cooling water (CCW) systems were supplying cooling water to the A and B RHR heat exchangers respectively and the A normal service water (NSW) pump was supplying cooling water to the A and B CCW heat exchangers. The B charging and safety injection (CSIP) pump was running. Steam generators were not readily available for decay heat removal.

01.02 Event Description At 7:41 a.m. on October 18, 2004, power was lost to 6.9 KV emergency bus 1A-SA. Loss of power to this bus resulted in a loss of power to the A RHR pump and interrupted shutdown cooling. Operators entered Abnormal Operating Procedure (AOP) 25, Loss of One Emergency AC Bus (6.9KV) or One Emergency DC Bus (125V). At 7:45, after verifying that the A emergency diesel generator (EDG) successfully started and was supplying power to bus 1A-SA, the operators restarted the A RHR pump. The A CCW pump started automatically and with the A emergency service water (ESW) header being supplied by the A NSW header, shutdown cooling was restored. RCS bulk temperature, as measured at the discharge of the A RHR pump rose from 116.7 degrees F to 122.4 degrees F during the four minute interruption of shutdown cooling.

Other issues were identified during the sequencing of loads after the EDG started. The A ESW pump did not automatically start and feeder breaker 1A3-A, 6.9 KV emergency bus 1A-SA to transformer 1A3-SA, immediately reopened after shutting during the automatic A EDG load sequence.

At the time of the loss of power to emergency bus 1A-SA, an electrical maintenance activity was in progress in the relay cabinet which houses the degraded bus and undervoltage relays for the emergency bus. The maintenance activity required several leads to be lifted and taped, and test device leads to be clipped to the terminals on degraded voltage time delay relay 2-1/1711. This configuration resulted in conductors being in close proximity which were capable of actuating the emergency bus 1A-SA degraded voltage trip relay if inadvertent electrical contact were made. A detailed sequence of events is included as Attachment 3.

SPECIAL INSPECTION CHARTER AND SCOPE Based on the criteria specified in Management Directive 8.3, NRC Incident Investigation Procedures, a Special Inspection was initiated in accordance with NRC Inspection Procedure 93812, Special Inspection. The objectives in the attached charter (Attachment 2)are addressed by the specific headings in the inspection activities section of the report.

INSPECTION ACTIVITIES 03.01 Timeline for the Event (Objective 1)

The inspectors reviewed available plant event data, control room logs, computer data, and interviewed operations personnel to develop a timeline for the event which is included as Attachment 3. Additional comments were developed in comparing the events to procedural guidance and are included with the timeline.

03.02 Licensee Cause Determinations (Objectives 2 through 5)

a. Inspection Scope

The inspectors were formally briefed by licensee management and key event investigation team members as to their findings and conclusions concerning the loss of the 1A-SA emergency bus and subsequent plant equipment response.

The inspectors reviewed the licensees corrective action documents related to this event, personnel event summary statements, timelines, failure mode analyses, and various logs and procedures to evaluate the effectiveness of the licensees cause determinations. The specific documents reviewed are listed in Attachment 1.

The inspectors carefully reviewed all pertinent control wiring diagrams (CWD)associated with the loss of off-site power sequencer to include the individual sequenced loads and relay protection schematics to determine if safety related equipment responded to the event as designed.

b. Observations and Findings

Inspectors concluded that while the exact circumstances surrounding the initiating event could not be conclusively identified, data available from plant computers demonstrated that the degraded grid voltage relay was inadvertently energized causing the loss of emergency bus 1A-SA. Inspectors concluded that the licensee adequately evaluated and performed reasonable cause determinations for both the initiating event and the subsequent safety related equipment responses. More specifically, the failure of feeder breaker 1A3-A to reclose after power was restored to emergency bus 1A-SA or to be operated from the main control board and the failure of ESW pump A to automatically sequence start were satisfactorily reviewed.

Inspectors concluded that the most probable cause for the degraded grid voltage signal was during preparation to perform Section 7.5 of Procedure MST-E0045, 6.9 KV Emergency Bus 1A-SA and 1B-SB Undervoltage Relay Channel Calibration. An electrician inadvertently shorted two sets of disconnected leads from time delay relay 2-1/1711. Shorting the leads disconnected from terminal point 2' to leads disconnected from terminal point L1' of time delay relay 2-1/1711 produced a current path causing time delay relay 2-2/1711 to energize and begin a timing sequence. After 54 seconds, relay 2-2/1711 timed out, and an undervoltage signal was generated opening breaker 105', 6.9 KV emergency bus 1A-SA to auxiliary bus 1D tie breaker, thus causing the 6.9 KV emergency bus 1A-SA to de-energize, resulting in the automatic start of the 1A-SA EDG.

As the A EDG started and came to rated speed, 1A-SA EDG output breaker 106' closed, energizing the 1A-SA 6.9 KV bus. The loss of off-site power sequencer then began sequentially loading the nine sequencer load-banks. When the 106' breaker closed, auxiliary contacts in its control circuitry closed to send a close signal to 480V bus feeder breaker 1A3-A. However, due to the shorted leads still being in contact, the 1A3-A breaker was still receiving an open signal. The 1A3-A breaker attempted to close one second after the EDG output breaker closed, but immediately re-opened due to the sustained degraded grid voltage signal caused by the shorted leads. The 1A3-A breaker was then physically prevented from re-closing due to the anti-pump circuitry associated with the breaker control device. Subsequent attempts to reclose the breaker from the Main Control Board were unsuccessful due to the breaker being locked-out on anti-pump. Approximately 15 seconds after the EDG output breaker closed, the sequencer attempted to start load-bank #3, the A ESW Pump. The pump failed to start due to open contacts in the pump start circuitry caused by the shorted leads maintaining contact and keeping the degraded grid voltage relay energized.

The inspectors concluded, based on computer point logs, that approximately 80 seconds after the inadvertent shorting of the disconnected leads, the shorted leads became separated, de-energizing the degraded grid voltage relay. This allowed the A ESW pump to be started from the main control board (MCB). Subsequent operation of the A ESW pump from the MCB was successful. After plant stabilization, the control room ordered an inspection of feeder breaker 1A3-A by electricians, who racked the breaker to the test position. The anti-pump lockout was reset while racking the breaker to the test position. Subsequent local operation of the breaker was successful.

Because plant personnel did not realize that the anti-pump protection had been activated and subsequently reset during event recovery, operators did not understand the reason for the apparent erratic behavior of feeder breaker 1A3-A. The control room operators had the electricians rack the breaker back in and close it locally to re-energize the 1A3-SA 480V safety related bus. Only after this evolution was completed did the operators realize that feeder breaker 1A3-A operated properly during the event.

03.03 Reactor Operator Performance (Objective 6)

a. Inspection Scope

The inspectors reviewed available plant data, control room logs, and interviewed operations and maintenance personnel to evaluate the reactor operators performance during the event. The inspectors reviewed plant procedures and discussed event diagnosis and system recovery with the on-shift operations personnel to assess human performance for the event and the adequacy of procedural guidance to respond to the loss of core cooling during shutdown. The records which were reviewed are listed in

1.

b. Observations and Findings

The inspectors concluded that the operators correctly diagnosed the event from the available alarms and indications. The inspectors noted that the initial indications were that the 1A-SA bus was de-energized, the EDG started and the 1A-SA bus was reenergized. The inspectors verified that the operators correctly entered AOP-025, Loss of One Emergency AC Bus (6.9 KV) or One Emergency DC Bus (125 V) and methodically followed the proper steps in the procedure. The inspectors determined that the operators took immediate actions to verify that the support systems were properly operating and then initiated the proper actions to restore core cooling. The RHR cooling flow to the core was secured for a total of four minutes, and the primary plant temperature rose approximately six degrees F. The inspectors noted that during this period, the B RHR pump was operable and immediately available for service had the A pump failed to restart.

The inspectors also noted that operations personnel had recently trained on loss of shutdown cooling events during pre-outage training. This training included a simulator scenario involving a loss of RHR cooling.

With respect to the loss of feeder breaker 1A3-A, and the difficulty in recovering the 1A3-SA 480 V emergency bus, the inspectors determined that emergency bus 1A3-SA remained without power for over three hours due to the operators incomplete understanding of the anti-pump feature of feeder breaker 1A3-A. This anti-pump feature prevented the breaker from being operated remotely after it opened during automatic sequencing process. Although the operators stated that they did not observe the shutting and subsequent opening of the breaker during EDG load sequencing, they did not pursue the possibility that the anti-pump feature was the cause of the inability to shut the breaker from the main control room. This lack of understanding about the features of this breaker delayed the recovery of emergency bus 1A3-SA, and extended the discharge of the vital batteries. The licensee included this issue as part of Action Request (AR) 140449.

03.04 Personnel Performance and Other Contributions to the Event (Objective 7)

a. Inspection Scope

In order to assess other contributors to this event, the inspectors reviewed the written statements provided by licensee personnel and interviewed key plant personnel including maintenance, outage scheduling, and work control personnel. Inspectors also reviewed licensee work management and risk assessment practices. The documents reviewed are listed in Attachment 1.

b. Findings

Introduction:

An Unresolved Item (URI) was identified involving a failure to adequately tape the leads which had been lifted from a time delay relay in the 1A-SA switchboard.

This finding has a potential safety significance greater than Green.

Description:

On the morning of October 17, 2004, the work control center approved starting Procedure MST-E0045 and the electricians started the job. The work on this task was not completed within one shift as planned. The open work order was turned over to the second shift during the evening of October 17. The second shift continued the procedure, lifted and taped the leads from the time delay relay, and installed the temporary leads for the test equipment. After the leads were lifted, interference from other work prevented completion of this task. The electricians left the job site to support other tasks, and other electrical maintenance removed power to the test equipment for the emergency bus 1A-SA work. The work was resumed by the first shift on the morning of October 18 when the event occurred. The licensees root cause investigation could not positively identify the cause of the short which led to the loss of the 1A-SA bus. Licensee maintenance personnel indicated that upon entering the panel after the event, electrical tape on the leads lifted from time delay relay 2-1/1711 was partially detached and bare metal was exposed. No pictures were taken, but personnel indicated that the leads had not been wrapped with electrical tape. Due to the short amount of time the leads were expected to be disconnected, the leads were tabbed by placing a piece of electrical tape up one side of the lead, over the top, and down the other side. This method of taping was inadequate to prevent the inadvertent shorting of the leads. Step 7.5.2 of Procedure MST-E0045 requires the technician to label (if necessary), lift and tape the leads from the relay under test. The technicians failed to adequately tape the leads in order to prevent the leads from shorting out and causing the loss of the vital bus, as discussed in Section 03.02.

Analysis:

This issue was greater than minor because it affects the initiating event cornerstone and increases the likelihood of an initiating event. The finding has potential safety significance greater than Green because a loss of shutdown cooling flow occurred during a period of relatively high decay heat production. The finding also increased the likelihood of a loss of offsite power for the safety bus. However, the finding does not present an immediate (current) safety concern, because the licensee subsequently completed the testing and restored the equipment to normal configuration.

The final safety significance of the issue has yet to be determined. This finding was related to the cross-cutting area of human performance because the performance deficiency was identified as the failure of maintenance personnel to adequately tape the lifted leads.

Enforcement:

TS 6.8.1 requires in part that written procedures be implemented, including procedures for maintenance that can affect the performance of safety-related equipment. Contrary to the above, on October 17, 2004, Procedure MST-E0045 was not implemented, in that the leads which were lifted from time delay relay 2-1/1711 were not adequately taped. The finding does not present an immediate (current) safety concern, because the licensee subsequently completed the testing and restored the equipment to normal configuration. This issue was entered in the licensees corrective action program as AR 140449140449 Pending determination of the safety significance, this finding is identified as URI 05000400/2004009-01, Failure to Follow the Procedure for Taping Leads Lifted From Time Delay Relay 2-1/1711.

c.

Observations While reviewing the circumstances leading to the event, the inspectors noted communication deficiencies between plant work control organizations and within the electrical shop. These communication problems were specifically related to the status of the on-going electrical maintenance on October 17 and 18, 2004. Even though the electricians continued work on this task after the expected completion time, no notification was made to the work control center. As a result, on the morning of October 18, the work control center did not realize that work was continuing on Procedure MST-E0045. The operations personnel in the control room knew that the procedure had been delayed and was still open, however, at the time of the event they did not know that there was an electrician actively working in the panel. Lack of clear coordination and communications within the electrical maintenance organization significantly delayed the completion of Procedure MST-E0045. Electricians initiated work which redirected electricians to other activities, and deenergized wall sockets being used for power to the test equipment used during Procedure MST-E0045. These delays allowed additional time for the disconnected leads from time delay relay 2-1/1711 to become exposed from the inadequate taping.

During interviews with work control personnel, inspectors noted deficiencies in the work scheduling process. The licensee relies on software links in the outage plan to manage risk during the outage. If two tasks occurring at the same time would present an unacceptable amount of risk, a software link would be created to prevent their simultaneous performance. If a task is prevented by a software link but can be supported by the current plant conditions a special evaluation is required prior to the approval of the task. Inspectors noted that there was not a software link in the outage plan to prevent the performance of Procedure MST-E0045 while the A train of RHR was providing core cooling, yet there is a warning in the Operator Prerequisite Summary Sheet of Procedure MST-E0045 that notes that incorrectly performing the agastat timing test and adjustment may cause a loss of the bus. At the same time, inspectors also noted that a link existed to prevent procedure OST-1857, Remote Shutdown System Operability: Accumulator Isolation Valve and Letdown Isolation Valve Testing, from being initiated prior to the completion of Procedure MST-E0045. The performance of OST-1857 required the shift of control of the B train pumps, including the B train RHR pump to the Auxiliary Control Panel. There was no record of any evaluation performed prior to the breaking of this software link. The inspectors determined that these deficiencies contributed to the event in that a link could have been created to prevent performance of relay testing on the A bus while it was powering the sole operating RHR pump, or an evaluation for the performance of OST-1857 could have detected the increased risk of the concurrent plant conditions. (Section 03.06 of this report contains additional discussion of this issue.)

03.05 Occurrence of a Similar Event While at Power (Objective 8)

a. Inspection Scope

Inspectors reviewed Procedure MST-E0045 to determine the prerequisites and required plant conditions which must be met prior to performance of the procedure. Inspectors also interviewed outage and scheduling personnel to determine the scheduling requirements for this procedure.

b. Observations and Findings

The inspectors noted that Procedure MST-E0045 performs a calibration check and calibration of both the undervoltage relays and the degraded voltage circuitry. In this event, the loss of power to emergency bus 1A-SA occurred while the leads were lifted for testing of the agastat timers for the degraded voltage circuit. The testing of the agastat timer is the only point in the procedure where leads are lifted. Although procedure MST-E0045 may be initiated during any operating mode, Section 7.5 of the procedure, Agastat Timing Test and Adjustment, may only be performed when the plant is in mode 5. There is a specific note in Section 7.5 which states that the plant must be in operating mode 5 or below before performing this section. This was confirmed through interviews with scheduling personnel. The inspectors concluded that this specific event could not have occurred at power.

03.06 Adequacy of the Application of the Protected Train Concept (Objective 9)

a. Inspection Scope

Inspectors reviewed Procedure OMP-003, Outage Shutdown Risk Management in order to evaluate the licensees requirements for the protected train as well as to evaluate the licensees overall shutdown risk management program. The inspectors also interviewed operations, maintenance, scheduling and management personnel to determine how the licensee implements the procedures for the protected train.

b. Findings

Introduction:

A URI was identified involving the assessment and management of the maintenance activities conducted during the outage. This issue is unresolved pending completion of both enforcement and significance determination.

Description:

The protected train concept is a subset of the plants overall outage shutdown risk management plan. In addition to the protected train, the plant also uses work controls to ensure that multiple tasks are not performed at the same time which would increase plant risk to an unacceptable level. All of the work planned for the outage is entered into a computer-based scheduling program, and software links are developed to ensure the proper plant conditions exist for the performance of each task.

In addition, links are used to prevent coincident tasks which would raise plant risk to an unacceptable level. Prior to the outage, the outage plan is reviewed to ensure the adequacy of the defense-in-depth provided. This review is documented in the Pre-Outage Risk Assessment Report. If necessary, additional software links are added to provide the required defense-in-depth. As long as there is no work affecting the protected train, and the work occurs within the specific time window specified in the outage plan, the licensee determined that the risk was bounded by the review in the Pre-Outage Risk Assessment Report. The 70 hour8.101852e-4 days <br />0.0194 hours <br />1.157407e-4 weeks <br />2.6635e-5 months <br /> period of time in which procedure MST-E0045 was to be performed was when the B train was the protected train. Therefore, the licensee could conduct the procedure anywhere within this window, independent of plant conditions.

The inspectors questioned the accuracy of this risk evaluation considering the significantly different plant conditions which existed at the time procedure MST-E0045 was initially scheduled compared to the time it was actually performed. The inspectors also questioned the location in the outage of the 70 hour8.101852e-4 days <br />0.0194 hours <br />1.157407e-4 weeks <br />2.6635e-5 months <br /> period in which the procedure could be performed with respect to the time for the RCS to boil after a loss of shutdown cooling.

When procedure MST-E0045 was originally scheduled, both RHR pumps were operating, and the RCS was pressurized, allowing the possibility of natural circulation core cooling using the steam generators. However, when the procedure was actually conducted, the RCS had been depressurized, which complicated the use of the steam generators and natural circulation for core cooling had the RHR system failed. Also, the A RHR pump was in service while testing the A train degraded grid voltage relays during procedure MST-E0045, increasing the chance of a loss of power to the A train shutdown cooling RHR pump, if the work was improperly performed. This lineup was satisfactory to the licensee because only one RHR pump was required to be operating, and, according to the licensees protected train program, either the A or B RHR pump could be the operating pump. In addition, the protected B train of RHR was involved in a procedure which shifted control of the B train RHR pump from the control room to the auxiliary control panel. The B RHR pump was never inoperable and the licensee considers this a low risk evolution which meets the requirements of the protected train program. Inspectors noted that problems could occur during the transfer, further complicating a recovery from a near-term loss of shutdown cooling event. The inspectors noted that these conditions were not all scheduled at the same time in the original outage plan. They occurred simultaneously because of slippages and delays in the scheduled work, all within the allowed scheduling windows. The inspectors noted that plant personnel did recognize that the shifting of all these events from the originally scheduled times increased the shutdown risk for the plant, but because the B train was protected and no work was challenging the operability of the protected train, the increase in risk was considered acceptable.

The inspectors noted that both the originally scheduled and the conducted time in the outage for the performance of Procedure MST-E0045, was only approximately 2 days after the plant had shutdown. At this short time after shutdown, a relative high amount of decay heat was still in the RCS, and thus the time to core boiling was relatively short, approximately 28 minutes. This short time, compared to later in the outage when the decay heat would be much less and thus the time-to-boil much longer, significantly increased the importance of maintaining shutdown cooling. The inspectors determined that these conditions appeared to result in a more significant increase in plant risk, than the risk determined in the Pre-Outage Risk Assessment Report.

Analysis:

The NRC has not completed an evaluation of the risk difference between the licenses Pre-Outage Risk Assessment Report and that identified by the inspectors.

Therefore, the final safety significance of the issue has yet to be determined.

Enforcement:

The enforcement action has not yet been determined. Pending determination of both enforcement and the safety significance, this issue is identified as URI 05000400/2004009-02, Assessment of Increased Plant Risk.

c.

Observations The inspectors reviewed the licensees application of the protected train concept, and noted that operations, maintenance, and work control personnel all had a clear understanding of the protected train concept as described in OMP-003. They all noted that, in general, no maintenance was to be performed on a component while it was designated as part of the protected train. Inspectors noted that at the time of the event, the B train was the protected train. The B RHR pump was operable and available throughout the event. Instead of over-reacting to the loss of shutdown cooling and immediately starting the B pump to restore cooling, the operators appropriately implemented the loss of emergency bus procedure, AOP-025, and restarted the A RHR pump. If the operators had been unable to restart the A train RHR pump, the B RHR pump was still available, and would have been started as part of AOP-020, Loss of RCS Inventory or Residual Heat Removal While Shutdown.

The inspectors noted that outage work had reduced the defense-in-depth regarding cooling of the reactor core. The electrical power supply for the A train of RHR was undergoing intrusive testing, the B train of RHR was having operational control shifted between the control room and the remote shutdown panel, and the plant had been depressurized which complicated the availability of natural circulation core cooling using the steam generators. This was occurring relatively soon after reactor shutdown which resulted in a relatively high level of decay heat production. These concurrent evolutions created a reduction in the defense-in-depth for the prevention of a loss of shutdown cooling event.

03.07 Generic Implications (Objective 10)

a. Inspection Scope

During the review of the other objectives, the inspectors assessed each observation for generic implications. The inspectors also evaluated all the conditions surrounding this event in order to evaluate the presence of other generic implications. The inspectors interviewed plant personnel and reviewed applicable plant procedures.

b. Observations and Findings

The inspectors reviewed the circumstances leading up to the event, equipment performance and operator response during the event, and reviewed the plant recovery and event investigation after the event. Except for the issues previously identified in this report, the inspectors did not identify any generic implications which could be viewed as precursors to future events which may occur at this plant. All the issues raised by the inspectors have been addressed by the licensee.

EXIT MEETING The inspectors presented the inspection results to Mr. J. Scarola and other members of licensee management at the conclusion of the inspection on October 29, 2004. The inspectors confirmed with the licensee that proprietary information was not provided or examined during the inspection.

s: 1.

Supplemental Information

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

D. Corlett, Supervisor - Licensing/Regulatory Programs

F. Diya, Manager - Engineering

R. Duncan, Director - Site Operations

E. McCartney, Training Manager

G. Miller, Maintenance Manager

T. Morton, Manager - Support Services

T. Natale, Manager - Outage and Scheduling

J. Scarola, Vice President Harris Plant

E. Wills, Operations Manager

B. Waldrep, General Manager Harris Plant

NRC personnel

L. Wert, Deputy Director, Division of Reactor Projects

P. Fredrickson, Chief, Reactor Projects Branch 4

C. Welch, Senior Resident Inspector - Harris

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened

05000400/2004009-01 URI Failure to Follow the Procedure for Taping Leads Lifted From Time Delay Relay 2-1/1711 (Section 03.04.b)

05000400/2004009-02 URI Assessment of Increased Plant Risk (Section 03.06.b)

Closed

None

Discussed

None