ML18005A378

LER 88-001-01:on 880115,procedural Deficiency Which Could Have Resulted in Failure of ECCS During Recirculation Phase of Accident Identified.Caused by Failure to Note New Requirement in Procedure.Procedures revised.W/880329 Ltr

ML18005A378
Person / Time
Site:	Harris
Issue date:	03/29/1988
From:	Howe A, Watson R CAROLINA POWER & LIGHT CO.
To:	NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM)
References
HO-880080-(O), LER-88-001, LER-88-1, NUDOCS 8804060126
Download: ML18005A378 (11)

Text

j.v.

'. ACCELERATED DISJ IBUTION DEMONSTR10N SYSTEM REGULATORY INFORMATION DISTRIBUTION SYSTEM (RIDS)

ACCESSION NBR:8804060126 DOC.DATE: 88/03/29 NOTARIZED: NO DOCKET FACIL:50-400 Shearon Harris Nuclear Power Plant, Unit 1, Carolina 05000400 AUTH. NAME AUTHOR AFFILIATION HOWE,A. Carolina Power & Light Co.

WATSON,R.A. Carolina Power & Light Co.

RECIP.NAME RECIPIENT AFFILIATION

SUBJECT:

LER 88-001-01:on 880115,emergency operating procedure deficiency for switchover to recirculation discovered.

W/8 DISTRIBUTION CODE: IE22D COPIES RECEIVED:LTR NCL SIZE:

TITLE: 50.73 Licensee Event Report (LER), Incident Rpt, etc.

NOTES:Application for permit renewal filed. 05000400 RECIPIENT COPIES RECIPIENT COPIES ID CODE/NAME LTTR ENCL ID CODE/NAME LTTR ENCL A PD2-.1 LA 1 1 PD2-1 PD 1 1 BUCKLEY,B 1 1 INTERNAL: ACRS MICHELSON 1 1 ACRS MOELLER 2 2 AEOD/DOA 1 1 AEOD/DSP/NAS 1 1 AEOD/DSP/ROAB 2 2. AEOD/DSP/TPAB 1 1 ARM/DCTS/DAB 1 1' DEDRO 1 1 NRR/DEST/ADS 7E 0 NRR/DEST/CEB 8H 1 1 NRR/DEST/ESB 8D 1 1 NRR/DEST/ICSB7A 1 1 NRR/DEST/MEB 9H 1 1 NRR/DEST/MTB 9H 1 1 NRR/DEST/PSB 8D 1 1 NRR/DEST/RSB 8E 1 1 NRR/DEST/SGB 8D 1 1 NRR/DLPQ/HFB10D 1 1 NRR/DLPQ/QAB10A 1 1 NRR/DOEA/EAB11E 1 1 NRR/DREP/RAB10A 1 1 NRR/DREP/RPB10A 2 2

-D - SIB9A1 1 1 NRR/PMAS/ILRB12 1 1 G 02 1 1 RES TELFORD,J 1 1 RES/DE/EIB 1 1 RES/DRPS DIR 1 1 RGN2 FILE 01 1 1 EXTERNAL EG&G GROHi M 4 FORD BLDG HOY,A 1 1 H ST LOBBY WARD 1 1 LPDR 1 1 NRC PDR 1 1 NSIC HARRIS,J 1 1 NSIC MAYS,G 1 1 8

A D

TOTAL NUMBER OF COPIES REQUIRED: LTTR 45 ENCL 44

NRC Forml388 U.S. NUCLEAR REQULATOAY COMMISSION

'94)3) APPAOVED OMB NO. 31604104 EXPIRES: 8/31/88 LICENSEE EVENT REPORT (LER)

FACILITY NAME (1) DOCKET NUMBER (2) PA E 3 SHEARON HARRIS NUCLEAR POWER PLANT UNIT ONE o 5 o o o4O ioFo6 EMERGENCY OPERATING PROCEDURE DEFICIENCY FOR SWITCHOVER TO RECIRCULATION AFTER A EVENT DATE (5) LER NUMBER (8) REPOAT DATE (7) OTHER FACILITIES INVOLVED (8)

MONTH DAY YEAR YEAR Pgg: SEQUENTIAL ;S.'A'EYISKIN MONTH OAY YEAR FACILITYNAMES DOCKET,NUMBERISI xBr>>l NUMBER '<. 4 NUMBER 0 5 0 0 0 0 3 29 88 0 5 0 0 0 THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 cFR (II ICheck onr or mott of thr follorflnpl (11(

OPERATINO MODE (8) 20.402(B) 20A06(c) 60.73(e) (2)Dv) 73.7)(B)

POWE R 20.406(e) l1) ll) 50M(c) (I ) 50.73(e) (2) (v) 73.71(c)

LEVEL (rill)(BI (10) 20A05(e) II)Dl) 50.38(c) (2) 60.73(e) (2)(v8) OTHER (Specify In Abstrect be/ore end In Text, HRC Form 20.406(e)(1) Dil) 50.73(e)(2) li) 60.73(e) (2) (rill)(AI 388AI 20A06(e)(1) I lv) 50.73(el (2) (8) 50,73 (e) (2)

>>rrrnr,'>> '4'N3>>>>>>v+>> 20.405(e)(1)(r) 50.73(e)(2) (IIII 50.73( ~ ) (2) (x)

LICENSEE CONTACT FOR THIS LER (12)

NAME TELEPHONE NUMBER AREA CODE ANDREW HOWE SR. ENGINEER REGULATORY COMPLIANCE 919 362 2 719 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBEO IN THIS REPORT (13) 9' CAUSE SYSTEM COMPONENT MANUFAC.

TUAER REPORTABLE,':.

TO NPROS CAUSE SYSTEM COMPONENT MANUFAC.

TUAER EPORTA8 LE TO NPRDS INWIT PA%33('<

SUPPLEMENTAL REPORT EXPECTED (14) MONTH DAY YEAR EXPECTED SU 8 MISSION DATE (16)

YES (II yes, complrtr EXPECTED SUBhtlSSIDN DATEI No ABSTRACT It.imlt ro t400 sprees, I e., rppsoxlmetrly fiftrrn sinpleepece typervrittrn lines) (18)

On January 15, 1988, it was discovered that a procedure deficiency had previously existed in the Emergency Operating Procedures (EOPs) which could have resulted in the failure of the Emergency Core Cooling System (ECCS) during the recirculation phase of an accident, under a scenario of a single failure of one Residual Heat Removal Pump (RHRP). The deficiency involved an improper valve lineup which could cause a RHRP to exceed its design flow limit during ECCS recirculation, if one of the two RHRPs had failed during a loss of coolant accident (LOCA) leaving only one operating RHRP, and if the LOCA was sufficiently large to completely depressurize the Reactor Coolant System.

This procedure deficiency resulted from the failure to completely incorporate into plant procedures a change made to the Final Safety Analysis Report.

The deficiency existed beginning in December of 1986, when the EOP containing the error was approved, and initial operation of the plant began. When the safety significance of the discrepancy was discovered, the EOPs were revised to correct the error. This occurred on December 16, 1987.

Other FSAR changes made in this time period involving a change to procedures were reviewed to ensure they were properly implemented. Members of the Plant Nuclear Safety Committee have been advised of this situation and reminded of their responsibility regarding the reportability of such situations.

g(pZ2.

8804060126 Ii 05000400 880325'DR ADOCK 8 DCD

NRC Form ESSA V.S. NUCLEAR REOULATORY COMMISSION

($ 421 LICENSEE EVENT REPORT (LER) TEXT CONTINUATION APPROVED OMS NO. 3(50&(04 EXPIRES: SI31/SS fACILITYNAME (11 DOCKET NUMSER (2l LER NVMSER LSI ~ AOE IS)

SHEARON HARRIS NUCLEAR POWER PLANT YE<<95 55QVENTIAL NVM ER R(vr5ION NVM 5R UNIT ONE OF 0 5 0 0 0 TEXT Ilfmoro N>>c>> II fffr(orE I>>f afrrR(N>>>>l IIRC Amr ~'fl (17(

DESCRIPTION:

Note'The following drawings supplement the narrative of this report:

Attachment A - ECCS Recirculation Flowpath Existing Prior to September 1986 Attachment B - ECCS Recirculation Flowpath Required in FSAR After September 1986 Attachment C ECCS Recirculation Flowpath Implemented in Procedures, December 1986 The switchover procedure for transferring the Emergency Core Cooling System (ECCS) from injection to recirculation is outlined in FSAR Table 6.3.2-6. The initial practice required closing isolation valves to separate the ECCS headers into two separate trains, thus providing protection for passive failures of the piping. The resulting valve lineup for recirculation is shown in Attachment A. On September 27, 1985, and on August 21, 1986, Westinghouse Electric Corporation, the Nuclear Steam Supply System designer for the Shearon Harris Nuclear Power Plant (SHNPP), issued letters (serial CQL-9018 and CQL-9445) to Ebasco Services, Inc., the architect/engineer for SHNPP. The letters documented recommendations for changes to the procedure described in FSAR Table 6.3.2-6 for the switchover. Westinghouse recommended deletion of the procedure steps which separated the two ECCS trains, since these steps did not provide complete passive failure protection, and since their elimination would allow a single RHRP to supply both CSIPs. In addition, the second correspondence identified the need for new check valves to be installed in the piping connecting the discharge of an RHRP to the CSIP suction, to prevent potential backflow through an idle RHRP during recirculation.

These proposed changes were approved for implementation at SHNPP, since they improved operational flexibility following an accident. In addition, a separate issue regarding requirements for local leak rate testing (LLRT) on ECCS containment penetrations was also resolved by implementing this proposed change.

NRCfORM 5454 *U S OPO:I SSS.DS24 SSSI455 NSSI

NRC form 30SA U.S. NUCLEAR REGULATORY COMMISSION (043)

LICENSEE EVENT REPORT (LER) TEXT CONTINUATION APPROVEO OMS NO. 3150-0104 EXPIRES: 0/31/SS PACILITY NAME (1) OOCKET NUMBER LT) LER NUMSER (0) ~ AOE (31 SHEARON HARRIS NUCLEAR POWER PLANT YEAR SEQUENTIAL (

NVM E4 REVISION Q NVM E4 UNIT ONE o s o o o 400 88 001 0 1 0 3 oF0 6 TEXT /1/'moro <<oc>> /P nqvkrd, ver A//o)mo///RC Form 30143/ (17)

DESCRIPTION: (continued)

An FSAR change (serial HPOS"845) was initiated to incorporate these changes.

As part of the review of these changes, Technical Support determined that a single RHRP could not supply two CSIPs and both low pressure ECCS injection headers, as the proposed recirculation lineup required. However, by isolating one of the two low pressure safety injection (LPSI) header containment isolation valves, an acceptable configuration was created. This revised lineup demonstrated that the RHRP would not run out (Preoperational Test 2085-P-05, completed October 5, 1986). Therefore, the FSAR change included the new requirement to close one of the two LPSI containment isolation valves to ensure that runout of the RHRP would not occur during recirculation if the other RHRP failed.

This change was incorporated into the FSAR change which was approved on September 24, 1986. A letter was also submitted to the NRC describing this change.

The change required significant revisions be made to the EOPs; however, due to other commitments, revisions were already in progress. The additional changes required due to the FSAR change were not therefore formally identified and tracked. On December 22, 1986, Revision 2 to procedure EOP-EPP-010, Transfer to Cold Leg Recirculation, was issued. However, the revision did not fully implement the requirements of the FSAR in that the requirement to close one LPSI containment isolation valve, identified in FSAR change HPOS-845, was not included. The procedure change package references this FSAR change in its safety analysis, but the engineers developing the procedure revision were not fully cognizant of all the new requirements. h The SHNPP On-site Nuclear Safety (ONS) unit was responsible for the review of INPO Significant Event Reports (SER), and during review of SER 2-87, they identified the discrepancy between the FSAR and the EOPs. On July 10, 1987, an action item was established for the plant engineering department to evaluate the discrepancy to determine whether the procedure or the FSAR was inaccurate. On December 3, 1987, the engineering department confirmed the deficiency was in the EOPs.

NRC PORM 3OOA 4 U.S.OPO;1050 0 024 538/455 (043)

NRC FAIR 348A V.S. NVC( EAR REOVLATORY COMMISSION (04)3)

LICENSEE EVENT REPORT (LER) TEXT CONTINUATION APPROVED OMS NO, 3150&I 04 EXPIRES: 8/31/88 fACILITYNAME ll) DOCKET NUMSER (2) LER NUMSER (4) ~ AOE (3)

SEOVENTIAL REYIEION SHEARON HARRIS NUCLEAR POWER PLANT YEAR NVM ER NVM ER UNIT ONE 0 5 0 0 0 OF TEXT //m4m 4P444/I /44NPNL v44 A/4/444///RC Fo/m 38340) l)T)

DESCRIPTION: (continued)

Separately, Operations personnel noted that the Monitor Light Box (MLB) for ECCS recirculation was engraved to require one LPSI containment isolation valve to be close while the other was open. Believing this to be a simple engraving error, a Plant Change Request (PCR) (serial PCR-2384) was initiated on September 25, 1987, to change the engraving to require the valve to be open during recirculation, in agreement with the plant EOPs. The PCR was rejected by Technical Support personnel, since they were aware of the previous FSAR change requiring the valve to be closed to prevent RHR pump runout. The Operations engineer who initiated the PCR then wrote a feedback report (serial 305) in accordance with plant procedure OMM-001, Operations Conduct of Operations, on October 26, 1987. A procedure change was determined to be required, and was to be addressed in the next revision which was to be issued in the fall of 1988.

In both cases, personnel were not cognizant of the safety significance of the procedure deficiency.

However, when ONS received the response for INPO SER 2-87 from engineering on December 3, 1987, the ONS unit contacted Operations and made them aware of the serious nature of the deficiency. A change to procedure EOP-EPP-010 was issued on December 16, 1987, correcting the error and making the procedure consistent with the FSAR. In addition, procedure EOP-EPP-003, Loss of All AC Power Recovery with Safety Injection Required, which also addresses the recirculation lineup, was issued on January 6, 1988.

On January 15, 1988, this matter was discovered by Regulatory Compliance personnel. The situation existing for nearly one year in which the emergency operating procedures were in disagreement with the FSAR was investigated and determined to be reportable.

SAFETY SIGNIFICANCE:

The ECCS, and hence all procedures governing operation of this system, were required to be in place when the plant first entered Mode 4 in December of 1986, as per Technical Specification 3.5.3. In the event of a large break loss of coolant accident simultaneous with the single failure of an RHRP, when the recirculation phase of ECCS operation was initiated in accordance with plant procedures, the plant would have been in an unanalyzed condition'.

This conclusion was reached after a review of the significance of this event.

Technical Support and Engineering personnel reviewed the test data and evaluation that was done in 1986 which determined that one LPSI header must be isolated during recirculation. The result of this review confirmed that the earlier test did not demonstrate sufficient margin to allow flow to both LPSI headers during recirculation.

NRC FORM 344A 4 U.S.OPO:10884).824 838/488 IM3)

NRC PRIm 3SSA U.S. NUCLEAR REOULATORY COMMISSION

$ 43 l LICENSEE EVENT REPORT ILER) TEXT CONTINUATION APPROVEO OMB NO. 3150&I04 EXPIRES: 8/3l/88 PACILITY NAME ill OOCKET NUMBER l2l LER NUMBER ldl PACE l31 SHEARON HARRIS NUCLEAR POWER PLANT YEAR F<I. SEOVENTIAL :PII REV>>ION NVM ER NVM 44 UNIT ONE o so o o 40 088 001 0 1 OF TEXT // II>>m N>>4I /I IfEMPN/. vfr //I/444/I/RC P>>mI 3/4/A'4/ I17)

SAFETY SIGNIFICANCE: (continued)

The single operating RHRP could have exceeded its design flow limit under such a scenario, which would cause the RHRP to trip on overcurrent, subsequently causing the failure of the CSIPs, since these pumps rely on the RHRP as the source of water for recirculation operation. Operator action outside of plant procedures would have been required to recover the situation.

The following indications would have been available to the operator to alert him of the problem'.

Flow indication and alarms for the RHRP Motor amperage indication for 'the RHRP Alarms for the MLB due to the valve lineup error Alarm for the RHRP tripping Alarms for the CSIPs tripping It has been determined that restoration of a single RHRP without any operating CSIPs would be sufficient to ensure adequate post-LOCA cooling of the core, provided the flow is restored within approximately 3-4 minutes after interruption. The operator would have to reset the over current trip at the RHRP breaker, located one floor level below the control room, and restart the pump using the control switch.

The condition is reportable in accordance with 10CFR50.73(a)(2)(v) as a procedural error which could have prevented the fulfillment of the safety function of systems which mitigate the consequences of an accident.

CAUSE:

There is no single reason that this procedure deficiency came into existence, but the following contributed to the error.

1. Personnel responsible for the EOPs were aware of the Westinghouse proposals to revise the ECCS recirculation lineup, and when the FSAR was changed to implement this new lineup the additional requirement to close the LPSI isolation valve was not noted. The 'modification to close one of the two LPSI containment isolation valves affected only one page of a change package which was 32 pages in length, and the majority of this package discussed containment isolation valve design, not ECCS recirculation procedures.

NRC fORM $ 444 *U.S.OPO:1088&824 538'455 l843 I

1 U.S. NUCLEAR REOULATORY COMMISSION NRC Form 344A (94)3 I LICENSEE EVENT REPORT ILERI TEXT CONTINUATION APPROVED OMB NO, 3150&)(N EXPIRES: 8/31/88 FACILITYNAME (II DOCKET NUMBER l2) LER NUMBER (4) ~ AOE (3I YEAR SEQVENZIAL REVISION Pop SHEARON HARRIS NUCLEAR POWER PLANT NVMSER NVM ER UNIT ONE 0 8 8 0 10 106 OF 0 6 o s o o o 4 TExT ///more EPece /4 /e)/rkerL Ireo ~ //ooom/ /YRc Fonrr 3(ELi'e/ (17)

CAUSE: (continued)

2. Changes made to the FSAR, which would require changes to plant procedures, were not routinely identified and tracked prior to licensing of the plant due to the significant number of changes and due to the fact that procedures were being revised prior to initial use in preparation for the operation of the plant.

3. FSAR changes are not immediately made available in the copies of the FSAR, since updates are only required annually by regulations.

The discrepancy between the FSAR and EOPs was .identified by many groups during 1987. However, the technical issue as to which document was accurate was not obvious. Investigation of the discrepancy was not given appropriate urgency, given the potential consequences of the discrepancy. When the investigation was completed, the problem was corrected within a reasonable period of time, but the potential reportability of the situation was not identified.

No similar situations have previously occurred.

CORRECTIVE ACTIONS:

The EOPs were revised prior to the discovery of this situation.

I The events which led to this procedure deficiency occurred prior to licensing of the plant. Upon issuance of the operating license, many changes went into effect regarding how plant design changes are controlled:

Changes to the plant components which require a PCR receive a complete safety analysis in accordance with 10CFR50.59.

PCRs are reviewed by the appropriate units to determine the ,

impact on plant procedures for which they are responsible.

FSAR changes now follow, rather than precede, the changes made to the plant and/or procedures.

The following additional measures have been taken'.

Changes to the FSAR approved in 1986 have been reviewed to verify that those changes which alter procedures described in the FSAR were properly implemented in the plant. No similar situations were discovered.

Members of the Plant Nuclear Safety Committee have been informed of this event and reminded of their responsibility to ensure potentially reportable items are brought to the attention of management.

NRC SORM 344* *U.S.OPO:1988 0.524 538/455 l943)

LER 88-001-01 BIT ATTACHMENT A ECCS RECIRCULATION FLOVPATIL EXISTING PRIOR TO SEPTEMBER 1986 ffSl-COLD LEG 1B-SB HPSI-HGT LEG 1C-SAB INSIDE CONTAINMENT CONTAINMENT 1A-SA fPSI-RECIRCULATICN COLD LEG SUMPS CHARGING/Sl PUMP5 LPSI-COLD LEG 1B-SB LPSI-RHR PUMPS HOT LEG HX LPSI-OGLD LEG 1A-SA INSIDE CONTAINMENT

LER 88-001-01 ATTAC)IHENT B ECCS RECIRCULATION FLOMPATH II'Sl-REQUIRED IN FSAR AFTER COLD LES SEPTFJIBER 1986 1B-SB HPSI-HDT LEG 1C-SAB INSIDE CONTAINMENT 1A-SA CONTAINMENT RECIRCULATION IfSl-COLD LEB SUMPS CHARGI NGl S I PUMPS F

LPSI-COLDLES ISI-M1 1B-SB LPSI-HOT LEO RHR PUMPS LPSI-HX COLD LEO ISI-340 CONTAINMENT IA-SA INSIDE

LER 88-001-01 BIT ATTACIIHENT C ECCS RECIRCULATION FLOWPATH IHPLEHFNTED IN PROCEDURE, COLD LEB DECEHBER 1986 1B-SB HPSI-IIBT LEO lc-SAB INSIDE CONTAINMENT COIITAINHENT I A-SA 8'6l-RECIRCULATION COLD LEB SUt1PS CHARGl NG/S l PUMPS LPSI-COLD LEO IB-SB LPSI-HBT LEO RHR PUMPS LPSI-HX COLD LEO IA-SA INSIDE CONTAIIII1ENT

CARL Carolina Power 5 Light Company HARRIS NUCLEAR PROJECT P.O. Box 165 New Hill, NC 27562 Ooo File Number'. SHF/10-13510C Letter Number'HO-880080 (0)

U.S. Nuclear Regulatory Commission ATTN: NRC Document Control Desk Washington, DC 20555 SHEARON HARRIS NUCLEAR POWER PLANT UNIT 1 DOCKET NO. 50-400 LICENSE NO. NPF-63 LICENSEE EVENT REPORT 88-001-01 Gentlemen'.

In accordance with Title 10 to the Code of Federal Regulations, the enclosed Licensee Event Report is submitted. The original report fulfills the requirement for a written report within thirty (30) days of a reportable occurrence and is in accordance with the format set forth in NUREG-1022, September, 1983.

Revision one provides additional information regarding the potential safety significance of the reported condition, based on further engineering evaluation.

Very truly yours, R. A. Watson Vice President Harris Nuclear Project MGW:ddl Enclosure cc'. Dr. J. Nelson Grace (NRC RII)

Mr. B. Buckley (NRR)

Mr. G. Maxwell (NRC SHNPP)

MEM/LER-88-001/1/OS1