ML040140447
| ML040140447 | |
| Person / Time | |
|---|---|
| Site: | Columbia  |
| Issue date: | 01/13/2004 |
| From: | Coleman D, Perino C, Sly C Energy Northwest |
| To: | Office of Nuclear Reactor Regulation |
| References | |
| Download: ML040140447 (14) | |
Text
Shutdown Cooling Isolation Reportability Craig Sly Principal Engineer-Licensing Christina Perino Manager-Licensing Doug Coleman Manager-Regulatory Programs Energy Northwest Columbia Generating Station
Background
- Two shutdown cooling isolation events occurred during the Columbia Spring 2003 Refueling Outage
- May 21, 2003, de-energized wrong relay during work activity (human error). toD 0 Auto Zoo
- June 16, 2003, during containment isolation logic functional test (procedural deficiency). n.Do F '4
- Both isolations were recognized and understood by operators within minutes and SDC returned to normal status in 31 and 12 minutes, respectively 1
May 21, 2003 Event
- Mode 5, reactor head removed, cavity flooded to above 22 ft above top of RV flange, fuel pool gates removed, SDC loop A in operation.
- About 10 minutes from completing actions to place plant in natural circulation cooling.
- Maintenance repairing lug connector on MS-RLY-K72A mistakenly worked MS-RLY-K72.
- K72 relay is daisy-chained to MS-RLY-K29.
- MS-RLY-K29 caused RHR-V-9 to close.
May 21, 2003 Event (continued)
- Operators quickly recognized what had happened (relay work was in the control room panels).
- Declared system inoperable and entered TS required actions.
- Ten minutes to reconnect wire, verified no other spurious actuations, declared operable after 31 minutes total.
2
June 16, 2003 Event
- Mode 4, reactor coolant temperature 112 F, condensate system available as an alternate means of decay heat removal by injection into RPV and rejection to main condenser, SDC loop A in operation, SDC loop B available.
- Procedure step requires manual depression of logic B pushbutton.
- Depressing this button causes isolation signal to 16 NSSSS isolation valves, including RHR-V-8.
- Isolation cause RHR pump A to trip off.
June 16, 2003 Event (continued)
- Operators entered appropriate TS Action Requirement.
- Isolation signals were reset and SDC restored in about 12 minutes.
- Cause was inadequate procedure, did not contain description of valve isolations when B pushbutton is pressed.
3
Reportability Evaluation Evaluation concluded events described are not reportable because:
- Did not result in a condition prohibited by the plant's Technical Specifications. IOCFR 50.73 (a)(2)(i)(B)
- Did not result in a general isolation signal (only one valve was affected) and did not result in an ECCS system actuation. 10 CFR 50.73(a)(2)(iv)
- Not a condition that alone could have prevented the fulfillment of the safety function of systems or structures that are needed to remove residual heat.
- It was not a condition that caused two independent trains or channels to become inoperable in a single system designed to remove residual heat.
50.73 (a)(2)(vii)(C) 10CFR 50.73 (a)(2)(i)(B)
Condition Prohibited by TS
- LCO for TS 3.9.8 was conservatively assumed by operators to not be met.
However, during each event, all of the applicable TS 3.9.8 Completion Times were met 4
Automatic Actuation
- The event did not result in a General Containment Isolation Signal affecting containment isolation valves in more than one system or multiple main steam isolation valves
- Not valid signals initiated in response to actual plant parameter.
- The shutdown cooling isolation function is not considered an ECCS function.
Prevention of Safety Function 10 CFR 50.73 (a)(2)(v)(C)
- The RIHR shutdown cooling mode is manually controlled.
- There is a large volume of water above the RV flange that provides a heat sink for decay heat removal.
- Even if the cause of the isolation signal had not been discoveqec quickly, procedural controls exist that would have ilKed operators to manually restore RHR shutdown cooling prior to the system being unable to perform its intended safety function.
Reasonable to conclude that the RHR shutdown cooling system was capable of fulfilling its intended safety function (that is, it was operable).
Supporting this conclusion is TS NOTE that allows required SDC subsystem to be removed from operation for up to two hours per 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> period.
5
50.73 (a)(2)(vii)(C)
Single Cause or Condition
- TS Basis state each RHR shutdown cooling is OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat.
- Based on description of what constitutes an operable RHR shutdown cooling subsystem, it is concluded that the RHR shutdown cooling OPERABLE for the duration of these events
- RHR-A shutdown cooling subsystem was capable of being manually aligned by remote operation (opening) of RHR-V-8 or 9 in accordance with Abnormal Procedure ABN-RHR-SDC-LOSS.
Conclusions
- The SDC events were evaluated and it was concluded that they were not reportable based on:
- No TS AOT were exceeded.
- Not an ECCS actuation or automatic actuation.
- Not a loss of safety function of a system needed to remove residual heat.
- Industry benchmarking supports these conclusions.
- Independent industry expert reviewed our evaluations and concurred with our conclusions.
6
- .6 299 Cabrill Drive Charleston, SC 29414 November 24, 2003 Ms. Christina Perino Licensing Manager Columbia Generating Station Energy Northwest, PO Box 968 Richland, WA 99353
Dear Ms. Perino,
I am pleased to submit this report of work performed under Contract No. 315706.
I was tasked to perform an independent assessment of several reportability evaluations conducted by the licensing staff at Columbia Generating Station.
I reviewed six events, and agreed with your staffs evaluation in each case.
Isolation of the Residual Heat Removal (RHR) System Two of the events involved interruption of flow in the RHR system. Prior to each event, the plant was shut down with one RHR pump running to remove decay heat. An error caused inadvertent closing of an isolation valve in the common RHR suction line. The events were not considered reportable at first. Later, after discussion with the NRC Resident Inspector and his Branch Chief, the events were reported under 10 CFR 50.73(a)(2)(v). Regardless, I agree with the initial conclusion that the events were not reportable.
The main points are as follows:
o The NRC's event reporting guidelines in NUREG-1022, Rev. 2, state that the standard for reporting under 50.72(a)(2)(v) is a reasonable expectation of preventing fulfillment of the safety function (or reasonable doubt that the system would have performed its safety function if called upon). The standard is based on several discussions in the "Statements of Considerations" that we publis nthe Federal Register with the reporting rules (10 CFR 50.72 and 50.73).
o Operation of the RHR system in the shutdown cooling mode is manually initiated. It does not need to be initiated (or re-initiated) on an urgent or short-time basis. Initiation within about an hour is sufficient. (In the plant conditions of these two events, many more hours were available as well.)
o In both events the plant staff diagnosed and corrected the cause of the isolation within about 10 minutes. (In the first case, an erroneously
disconnected relay was reconnected; in the second case, a test lineup was returned to normal.) Even if the cause of the isolation had not been corrected, the plant's procedures would have led directly to opening the valve manually. This could have been done within about an hour.
o Accordingly, there was not any reasonable expectation of preventing the RHR system from fulfilling its the safety function.
The following points also apply:
o NUREG-1022, Rev. 2, states "For example, if a single RHR suction line valve should fail in such a way that RHR cooling cannot be initiated, the event would be reportable." For both of these events shutdown cooling could be initiated by opening the isolation valve.
o One of the events occurred when the plant was in the refueling mode with more than 22 feet of water above the reactor vessel flange. The bases for the technical specifications state that under these conditions an RHR train is considered operable if it can be manually aligned (remote or local) in the shutdown cooling mode. Throughout the event an RHR train could be manually aligned by opening the closed valve.
o Commonly, events such as this are not considered reportable. I have reviewed several similar events at different plants during the past few years where the NRC staff agreed the events were not reportable. In addition, your staff has inquired of other plants and found that several of them do not consider events such as these to be reportable.
This conclusion may meet with some skepticism, perhaps on the grounds that, regardless of other factors, RHR flow was infact stopped for a while. However, the RHR system in the shutdown cooling mode does not need to start rapidly in order to fulfill its safety function. Thus, a condition that causes a modest delay would not prevent the system from fulfilling its safety function.
Isolation of the Reactor Core Isolation Cooling (RCIC) System Two of the events involved isolation of the RCIC system. They were reported under 50.73(a)(2)(v). One was an inadvertent isolation, caused by a procedure error. The other resulted from actions required by the technical specifications.
(A 250 VDC battery was inoperable, so a containment isolation valve was declared inoperable; the inoperable containment isolation valve was closed, which forced the operators to isolate the steam supply to the RCIC turbine.)
Many people believe that reporting an event such as this should not be required because the technical specifications required the operators to take the actions that made the system inoperable. However, reporting is indeed required
- 1,I because there is no exception or special provision for cases where the technical specifications require taking a system out of service.
With regard to RCIC there may be a change coming. Your staff plans to pursue a change in the final Safety Analysis Report (FSAR) that will make it clear that Columbia Generating Station does not 'take credit" for RCIC in the sense that utaking credit" is discussed in the NRC's reporting guidance in Regulatory Information Summary (RIS) 2001-14. If this is done, RCIC failures at Columbia Generating Station will generally not be reportable under 50.73(a)(2)(v).
Some further discussion of individual events is provided in the enclosure.
Please let me know if I can be of any additional assistance.
Yours truly, Dennis Allison
ENCLOSURE Shutdown Cooling Isolation - I
Reference:
LER 2003-003-00, Event Date 5/21/2003 Plant status: Refueling mode, reactor pressure vessel head removed, about 22 feet of water above the flange, refueling doors open, one residual heat removal (RHR) pump running.
Summary of event: During repairs in a control room cabinet, maintenance technicians disconnected the wrong relay, causing the inboard isolation valve in the common RHR suction line to close. The running RHR pump tripped on low suction pressure. The problem was diagnosed and corrected within about 10 minutes. After all required checks were completed, the RHR train was declared to be operable 36 minutes after the isolation.
Evaluation of reportability: A reportability evaluation concluded the event was not reportable. Later, after discussion with the NRC Resident Inspector and his Branch Chief, the event was reported under 10 CFR 50.73(a)(2)(v). Regardless, I agree with the initial conclusion that the events were not reportable.
The main points are as follows:
o The NRC's event reporting guidelines in NUREG-1022, Rev. 2, state that the standard for reporting under 50.72(a)(2)(v) is a reasonable expectation of preventing fulfillment of the safety function (see Page 53) or reasonable doubt that the system would have performed its safety function if called upon (see Page 57). The standard is based on several discussions in the "Statements of Considerations" that were published in the Federal Register with the reporting rules (10 CFR 50.72 and 50.73).
o Operation of the RHR system in the shutdown cooling mode is manually initiated. It does not need to be initiated (or re-initiated) on an urgent or short-time basis. Initiation within about an hour is sufficient. (In the plant conditions of these two events, many more hours were available as well.)
o In both events the plant staff diagnosed and corrected the cause of the isolation within about 10 minutes. (In the first case, an erroneously disconnected relay was reconnected; in the second case, a test lineup was returned to normal.) Even if the cause of the isolation had not been corrected, the plant's procedures would have led directly to opening the valve manually. This could have been done within about an hour.
o Accordingly, there was not any reasonable expectation of preventing the RHR system from fulfilling its the safety function.
The following points also apply:
o NUREG-1 022, Rev. 2, states 'For example, if a single RHR suction line valve should fail in such a way that RHR cooling cannot be initiated, the event would be reportable." For both of these events shutdown cooling could be initiated by opening the isolation valve.
o One of the events occurred when the plant was in the refueling mode with more than 22 feet of water above the reactor vessel flange. The bases for the technical specifications state that under these conditions an RHR train is considered operable if it can be manually aligned (remote or local) in the shutdown cooling mode. Throughout the event an RHR train could be manually aligned by opening the closed valve.
o Commonly, events such as this are not considered reportable. I have reviewed several similar events at different plants during the past few years where the NRC staff agreed the events were not reportable. In addition, your staff has inquired of other plants and found that several of them do not consider events such as these to be reportable.
This conclusion may meet with some skepticism, perhaps on the grounds that, regardless of other factors, RHR flow was in fact stopped for a while. However, the RHR system in the shutdown cooling mode does not need to start rapidly in order to fulfill its safety function. Thus, a condition that causes a modest delay would not prevent the system from fulfilling its safety function.
Shutdown Cooling Isolation - II
Reference:
LER 2003-005-00, Event Date 6/16/2003 Plant status: Cold shutdown mode, reactor coolant temperature about 112F, one RHR pump running.
Summary of event: While testing the isolation logic for the Traveling In-core Probe (TIP) System, a general outboard containment isolation signal was received, causing the outboard isolation valve in the common RHR suction line to close. The running RHR pump tripped on low suction pressure. The problem was diagnosed and corrected and the RHR train was declared to be operable 12 minutes after the isolation. Reactor coolant temperature increased about 1 degree, to 113F.
Evaluation of reportability: Same as for the previous event, described above.
Reactor Core Isolation Cooling (RCIC system) Isolation - I
Reference:
LER 2003-008-00, Event Date 7/8/2003 Plant status: Operating at 73 % power.
Summary of event: During testing, technicians inadvertently pressurized a differential pressure sensor, causing an isolation valve to close in the steam supply line to the RCIC. Equipment was returned to normal mode and RCIC was declared operable about 52 minutes after the isolation.
Evaluation of reportability: RCIC is a single train system that is required to start automatically in response to low reactor vessel water level. Closure of the containment isolation valve in its steam supply line rendered the RCIC system inoperable because RCIC would not start automatically.
Initially the event was not considered reportable because plants that did not "take credit" for RCIC in their FSARs are not required to report RCIC failures according to the NRC's guidance in regulatory information summary (RIS) 2001-14.
However, after further review this conclusion appeared uncertain. Therefore, the event was reported under 50.73(a)(2)(v).
In the future, the licensing staff intends to pursue an FSAR change that will make it clear that Columbia Generating Station does not "take credit" for RCIC in the sense that "taking credit" is discussed in RIS 2001-14. If so, RCIC failures at Columbia Generating Station will no longer be reportable under 50.73(a)(2)(v).
RCIC Isolation - Il
Reference:
LER 2003-009-00, Event Date 8/22/2003 Plant status: Operating at 100% power.
Summary of event: A degraded pilot cell was discovered in the 250 VDC battery for Division 1. Operators were required by the technical specifications to declare a containment isolation valve in the RCIC minimum flow bypass line inoperable and close it. Thus, it was necessary to isolate the steam supply to the RCIC turbine. The battery cell was replaced and RCIC was declared operable about 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> later.
Evaluation of reportability: RCIC is a single train system that is required to start automatically in response to low reactor vessel water level. Taking RCIC out of service in this manner rendered the RCIC system inoperable because it would not start automatically.
The requirement to report an event such as this one strikes many people as strange because the technical specifications directed the operators to take the actions that made the system inoperable. However, there is no exception or escape provision in the rules for cases where the technical specifications required taking a system out of service.
With regard to RCIC there may be a change on the way. In the future, the licensing staff intends to pursue an FSAR change that will make it clear that Columbia Generating Station does not "take credit" for RCIC in the sense that "taking credit" is discussed in RIS 2001-14. If so, RCIC failures at Columbia Generating Station will no longer be reportable under 50.73(a)(2)(v).
High Pressure Core Spray (HPCS system) Inoperability
Reference:
EN #40229, Event Date 10/7/2003 Plant status: Operating at 100% power.
Summary of event: While preparing for maintenance to replace a part in the HPCS Waterleg (keep fill system), HPCS pressure decayed and a low pressure alarm was received. HPCS was declared inoperable and control power fuses were removed to prevent HPCS from starting. HPCS was filled and vented and returned to service about 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> later.
Evaluation of renortability: The event was (correctly) considered reportable and an ENS notification was made under 10 CFR 50.72(b)(3)(v) which is the equivalent of 50.73(a)(2)(v). The licensing staff plans to prepare an LER (#2003-10).
Control Room Emergency Filtration (CREF) Inoperability
Reference:
EN #40287, Event Date 11/1/2003.
Plant status: Operating at 100 % power.
Summary of event: During a test the CREF system was aligned with two of three intake dampers closed (i.e., the local air intake and one of the two remote intake dampers were closed). Starting both trains caused a low flow signal that prevented the intake air heaters from operating. The heaters are needed (on a humid day) to lower the relative humidity of the incoming air to 70% so that the filters will perform as analyzed (95% removal efficiency) and maintain control room dose within the limit of GDC 19. Thus, both trains were declared inoperable.
- Evaluation of reportability: The event was (correctly) considered reportable and an ENS notification was made under 10 CFR 50.72(b)(3)(v) which is the Part 72 equivalent of 50.73(a)(2)(v).
However, the licensing staff plans to pursue retraction of the report on the basis of refined calculations. Without intake heaters the humidity might be higher than 70%, resulting in a filter efficiency less than 95%. However, the reduced efficiency filters would still maintain control room dose within the limits of GDC 19.