05000286/LER-2013-002
| Event date: | 03-04-2013 |
|---|---|
| Report date: | 4-29-2013 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 2862013002R00 - NRC Website | |
Note: The Energy Industry Identification System Codes are identified within the brackets ().
DESCRIPTION OF EVENT
On March 4, 2013, at approximately 4:15 hours, while in Mode 4 (Hot Shutdown) during plant shutdown for the Cycle 17 Refueling Outage (3R17), Radiation Protection (RP) personnel entered the 46 foot elevation (elev) of the reactor containment building {NH} to install plastic RP fencing around the Reactor Coolant Drain Tank (RCDT) {CA}. The RP work crew received clearance after the plant reached Mode 4, to enter the reactor containment Inner Crane Wall (ICW) to install RCDT fencing and post it as a Locked High Radiation Area (LHRA). The RP work crew assumed they could enter the ICW area through any gate of the Emergency Core Cooling System (ECCS) {BP & BO sump flow channel barrier. The RP work crew chose to use a specific single gate access point (Gate No.
C) due to its proximity to the RCDT. Subsequently, a RP Technician that was not part of the work crew identified that personnel had not entered the area using the required access point double barrier gate. Further assessment determined the plant was in Mode 4 during the work activity. The opening of the single flow channel sump debris barrier gate violated the ECCS operability basis which requires the sump barrier system to be operable in Mode 1-4. The condition was recorded in the Indian Point Energy Center (IPEC) Corrective Action Program (CAP) as Condition Report CR-IP3-2013-00975.
For postulated breaks in the Reactor Coolant System (RCS) {AB} there are two post Design Basis Accident (DBA) recirculation related sumps within the containment, 1) the Internal Recirculation (IR) Sump (elev. 35'-6") and, 2) the Containment Sump (elev.
38'-3"). Both sumps collect liquids discharged into the containment during a DBA.
When enough water is available to supply the required net positive suction head to the IR pumps and Residual Heat Removal (RHR) pumps, suction is switched to the IR Sump for cold leg recirculation via the IR pumps. The RHR pumps take suction from the Containment Sump which is only credited for use after 24 hours of Recirculation if needed. As part of resolution to Generic Safety Issue (GSI)-191 (Assessment of Debris Accumulation on PWR Sump Performance) and Generic Letter 2004-02 (Potential Impact of Debris Blockage on Emergency Recirculation During Design Basis Accidents at Pressurized Water Reactors) flow barriers were installed in the containment to channel the break flow into the reactor cavity sump (elev. 19'). This fluid would than travel up and out of the Incore Instrumentation Tunnel, through the Crane Wall and Containment Sump labyrinth wall via specially designed openings, and into the annulus area outside the Crane Wall. The flow will migrate towards the IR Sump or the Containment Sump depending on which pump(s) are operating. The flow channeling barriers are installed around the Incore Instrumentation Tunnel, on the Recirculation Sump trenches, and at the Containment Sump. This flow path is credited so that a large quantity of the Loss of Coolant Accident (LOCA) generated debris will settle in the Reactor Sump or elsewhere in the containment before reaching the IR or Containment sump. Flow channeling barrier doors are installed in the northeast (Gate No. C) and northwest (Gate No D and E) quadrant openings of the Crane Wall. In addition, flow channeling barrier doors are installed in the north and south entrances to the IR Sump area (Gate No. B and A). A dual access gate (Gates No. D and E) allow access without violating the flow barrier integrity.
Prior to the plant shutdown, a RP work crew was briefed for the initial containment entry that was to occur immediately after shutdown in accordance with procedure OAP-007 (Containment Entry and Egress), procedure 0-RP-RWP-405 (Containment Entry at Power or Initially After Shutdown), and Radiation Work Permit RWP-2013-3028. The briefing included personnel with different work assignments that were all briefed at the same time. The briefing was performed by an RP Supervisor who was not part of the RP work crew assigned to install the RCDT fencing. The brief by the RP Supervisor did not state to all personnel briefed that they could only enter the 46 foot elevation Containment ICW through the dual gate access point when the plant was in Mode 1, 2, 3 or 4. The requirement is contained in Section 2.30.2 of procedure OAP-007.
The work crew was also not briefed on the proper fencing material (steel) to use at the RCDT which was identified in the Vapor Containment Posting Plan. Members of the work crew made their first entry into containment shortly after shutdown (March 4, 2013 at 00:04 hours) when the plant was in Mode 3 (Hot Standby). Work crew members who needed to enter the 46 foot elevation Containment ICW properly entered via the dual flow barrier access point. All single flow barrier access points were in the required bolted closed condition. Upon completion of the initial work task the work crew exited containment and were on standby for the RCDT fencing job. The Outage Control Center (OCC) informed the RP work crew that the RCDT fencing could not be performed until the plant reached Mode 4. Mode 4 was achieved at approximately 03:47 hours, at which time a supplemental RP Supervisor on the RP work crew received clearance from the OCC to enter the 46 foot elevation containment ICW to install the RP fencing around the RCDT. After receiving clearance, the RP work crew made the second containment entry at approximately 04:15 hours, and entered the 46 foot elevation ICW to install fencing around the RCDT and post it as a LHRA. A second pre-job brief specifically for the fence installation task was not performed which conformed to normal past practice. The RP work crew chose to use a specific single flow barrier access gate (Gate No. C) due to its proximity to the RCDT and because it had fewer obstructions to carrying in the RP fencing material.
The supplemental RP Supervisor unbolted the gate and the RP work crew entered the ICW to install the RP fencing. None of the flow barrier gates have signage to warn personnel that access is prohibited until Mode 5 (Cold Shutdown). No members of the RP work crew were sufficiently knowledgeable of the sump flow barrier basis to understand their action was a violation of OAP-7 and its impact on ECCS operability.
The flow barrier gates do not have an automatic closure or latch mechanism so it must be bolted/locked to ensure it stays shut. The gate swings into the crane wall so that DBA flow and forces would tend to close the gate when pressure is applied (e.g., DBA debris loads). After entry through the single flow barrier gate, the gate was closed but unbolted for approximately 30 minutes until a RP Technician who was not associated with the work recognized the condition and notified the work crew. The single flow barrier gate was immediately bolted closed and the dual gate was used by the RP work crew to egress the area after completing their work. Additionally, it was discovered the fencing material being used was hard plastic which is prohibited for use inside containment during Modes 1-4 without prior approval from Engineering and should have been steel in accordance with Engineering Change Request (ECR)-11684. The fencing material was replaced with lead shielding when the plant was in Mode 5 (Cold Shutdown) Mode 5 was achieved at 08:52 hours on March 4, 2013. In Mode 5 and 6, the ECCS and sumps are not required to be operable per the TS.
Cause of Event
The apparent causes were an inadequate pre-job brief and an inadequate procedure for Containment Entry and Egress (OAP-007, 0-RP-RWP-405) due to poor change management.
The pre-job brief failed to cover the requirement to use the dual sump barrier gate access point when in Modes 1-4, nor did it address the type of fencing allowed.
Section 2.30.2 of Procedure OAP-007 specifically states that the dual gate on the 46 foot elevation shall be used for ICW entries in Modes 1, 2, 3 and 4. However, Attachment 6 within OAP-007 is used by RP personnel and it does not have the information. The VC Posting Plan was not properly used at the per-job brief, whereby it did list the RCDT fencing job but did not list the approved fencing material to use.
Document quality was inadequate due to poor change management following implementation of the actions in response to GL-2004-02 and GSI-191 and approval of ECR-11684.
Procedure OAP-007, Attachment 6 is a checklist applicable to RP personnel for containment entry in Modes 1-4 but it does not address use of only the dual access flow barrier gate for access at the 46 foot elevation Containment ICW. Procedure 0-RP-RWP- 405 Section 2.0 (Precautions and Limitations) and Attachment 9.2 (Pre-job Brief Criteria) do not address use of only the dual gate access point for the 46 foot elevation Containment ICW during Modes 1-4.
RCDT fencing material that is fastened with steel cable may be used on the 46 foot elev. Containment ICW during Modes 3 and 4 per ECR-11684. The RP initial survey and posting plan that is used immediately after plant shutdown does not specifically address use of only the dual gate access point for the 46 foot elevation Containment ICW during Modes 1-4 and also does not specify that only steel RCDT fencing material that is fastened with steel cable may be used during Mode 4 at that elevation.
Corrective Actions
The following corrective actions have been or will be performed under Entergy's Corrective Action Program to address the cause:
- The single gate used during the event was bolted close.
- The plastic fencing around the RCDT was removed and replaced with temporary lead shielding after reaching Cold Shutdown.
- RP personnel were briefed on the event, lessons learned and management expectations and the department clock was reset. Personnel were notified that only the dual gate access point may be used during Modes 1-4 and that plastic fencing material can not be used on the RCDT ICW prior to Mode 5 (cold shutdown).
Also communicated was the expectation that any plans to make multiple entries after shutdown for different tasks must be covered during the brief including Containment down posting from a LHRA.
- Procedure OAP-007 will be revised to clearly state that within the procedure's attachments that only the sump barrier dual access gate for 46 foot Containment ICW entries shall be used in Modes 1-4. The current procedure Step 2.30.2 provides this requirement but the attachments which are used in the field do not.
- RP procedure 0-RP-RWP-405 will be revised to address Mode applicability and use of the sump barrier dual gate access point during Modes 1-4, and the allowed RCDT fencing material that can be used prior to Cold Shutdown.
- A TEAR will be initiated to evaluate inclusion of the GSI-191/GL 2004-02 Modification and ECN-11684 into RP initial training.
Event Analysis
The event is reportable under 10CFR50.73(a)(2)(v)(D) as a safety system functional failure as the condition could have prevented adequate post accident core cooling due to DBA debris blockage of the recirculation and/or the containment sump. An ECCS train is inoperable if it is not capable of delivering design flow to the RCS.
Individual components are inoperable if they are not capable of performing their design function or supporting systems are not available. Technical Specification (TS) 3.5.2 (ECCS-Operating) requires three ECCS trains to be operable in Modes 1, 2 and 3, and TS 3.5.3 (ECCS-Shutdown) requires one ECCS residual heat removal (RHR) subsystem and one ECCS recirculation subsystem to be operable in Mode 4. The licensing and design basis of the ECCS per UFSAR Section 6.2.2 (ECCS System Design and Operation) credits flow channeling barriers installed in containment in response to the resolution of GL-2004-02. The single flow barrier gate that was used for access had no latching mechanism to prevent it from being forced open during a DBA. The unbolted gate was not in accordance with design and not a sufficient robust barrier to prevent debris from entering the IR and Containment Sumps had a DBA occurred while in Mode 4.
Additionally, the plastic RP fencing used for the RCDT has not been evaluated and approved to withstand the DBA therefore, could degrade and impact sump operability.
The condition is also reportable under 10CFR50.73(a)(2)(vii) (common cause inoperability of independent trains or channels) as the condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to (D) mitigate the consequences of an accident.
The condition was not reportable as a TS prohibited condition. TS 3.5.3 Condition B (Required ECCS Recirculation subsystem inoperable) required action is to restore required ECCS recirculation subsystem to operable status in one hour or be in Mode 5 within 24 hours. The ECCS sump flow barrier single gate was unbolted at 04:15 hours on March 4, 2013, and plastic RP fencing carried into the area for installation around the RCDT. The improper condition was identified and immediate action taken to bolt the single gate after approximately 30 minutes while in Mode 4. The plastic RP fence was replaced when the plant reached Mode 5 at approximately 08:52 hours. The period of inoperability for the two conditions was approximately 4 hours thirty seven minutes which is within the TS allowed completion time of 24 hours to Mode 5.
Past Similar Events
A review was performed of the past three years of Licensee Event Reports (LERs) for events that involved SSFFs and/or common cause inoperability of an Engineered Safety Feature System. The review identified LER-2012-001 which reported a common cause inoperability of both trains of Auxiliary Feedwater Pumps on October 11, 2011, due to the inability to control AFW regulating valves after isolation of nitrogen backup to pneumatic actuators. The condition could result in pump trip due to high flow from fail open on loss of instrument air without local operator action. The apparent cause of not recognizing the need to station an operator locally to operate the AFW regulating valves prior to isolating the nitrogen supply was inadequate procedural guidance and licensing basis documents. This event has a similar aspect as part of the cause was inadequate document quality. Procedure OAP-007, Attachment 6 checklist for RP personnel for containment entry does not address use of only the dual gate access point. Procedure 0-RP-RWP-405 precautions and limitations, and the pre-job brief criteria does not address use of only the dual access gate nor does it specify that only steel fencing can be used for the RCDT fencing prior to Cold shutdown. However, corrective actions for LER-2012-001 would not have prevented this event as the issues associated with LER-2012-001 are unrelated to the issue identified in this LER.
Safety Significance
This event had no significant effect on the health and safety of the public. There were no actual safety consequences for the event because there were no accidents or transients during the time of the event. The analysis performed in response to GL-2004-02 included debris transport analysis conservatisms for transport of debris to both the IR sump and the Containment sump in excess of quantities that would be generated. Establishing normal RHR cooling to the RCS has RCS temperature below 350 degrees F and pressure less than 400 psig. In Mode 4 the reactor is not critical and reactivity is stable. In Mode 4 there is significantly less energy in the RCS to generate debris. At the time the actual RCS pressure was approximately 490 psig. An evaluation of a LOCA during Mode 3 and 4 operation was performed by Westinghouse (WCAP-12476) that showed a direct reduction in break probability for Mode 4 and a relative risk as the ratio of the frequency of core damage in either Mode 3 or 4 to Mode 1. This resulted in a mean relative risk probability of 1/6.5 for Mode 4 assuming the running RHR pump could not be restarted when compared to the risk for large break LOCAs in Mode 1. The evaluation concluded that Mode 4 LOCAs are not a significant contributor to shutdown risk. During this event the entire flow barrier was not disabled because only one debris barrier gate was unbolted and only for the time to allow personnel to enter the ICW. Therefore most debris would have been intercepted by the flow barrier system. Also, the barrier gate swings into the crane wall so that DBA flow and forces would tend to close the gate when pressure is applied (e.g., DBA debris loads) therefore limit flow barrier bypass and sump debris loading. The plastic fencing was not considered a significant contributor to inoperability of both ECCS sumps. It is reasonable to conclude the fencing would have been caught on structures or components either on the way to the reactor sump or in the sump and not travel to one or both ECCS sumps.