ML18065B245

LER 98-007-00:on 980413,HPIS Sys Was Noted Inoperable During TS Surveillance Test.Caused by Performance of Flawed Procedure.Operators & Engineers Will Be Trained to Improve Operational Decision Making Through Resources & Knowledge

ML18065B245
Person / Time
Site:	Palisades
Issue date:	05/13/1998
From:	Engle D CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
To:
Shared Package
ML18065B244	List: ML18065B243 ML18065B245
References
LER-98-007, LER-98-7, NUDOCS 9805200353
Download: ML18065B245 (8)

Text

NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB NO. 3150-0104 (4/95) EXPIRES 4/30/98 ESTIMATED BURDEN PER RESPONSE TO COMPLY WITH THIS MANDATORY INFORMATION cou.ECTION REQUEST: 50.0 HRS. REPORTED LESSONS LEARNED ARE INCORPORATED INTO THE LICENSING PROCESS AND FED BACK TO INDUSTRY.

LICENSEE EVENT REPORT (LERl FORWARD COMMENTS REGARDING BURDEN ESTIMATE TO THE INFORMATION AND RECORDS MANAGEMENT BRANCH (T-8 F33), U.S. NUCLEAR REGULATORY COMMISSION. WASHINGTON, DC 2Q555.0001, AND TO THE PAPERWORK REDUCTION (See reverse for required number of digits/characters for each block) PROJECT (31~104, OFFICE OF MANAGEMENT ANO BUDGET, WASHINGTON, DC 20503 DOCKET NUMBER (2) PAGE(3)

FACILITY NAME (1) CONSUMERS ENERGY COMPANY 05000255 1 of 8 PALISADES NUCLEAR PLANT TITLE (4) Licensing Event Report 98007 - High Pressure Safety Injection System lnoperability Durin~

Technical Specification Surveillance Test EVENT DATE (5) LER NUMBER (6) REPORT DATE (7) OTHER FACILITIES INVOLVED (8)

MONTH DAY YEAR YEAR I SEQUENTIAL NUMBER REVISION NUMBER MONTH DAY YEAR FACILITY NAME DOCKET NUMBER 05000 FACILITY NAME DOCKET NUMBER 04 13 98 98 007 00 05 13 98 05000 OPERATING THIS REPORT IS SUBMITIED PURSUANT TO TH.E REQUIREMENTS OF 1'0 CFR§: (Check one or morer(11)

. MODE (9) N 20.2201(b) 20.2203(a)(2)(v) x 50.73(a)(2)(i) 50. 73(a)(2)(iii)

POWER 20.2203(a)(1) 20.2203(a)(3)(i) 50. 73(a)(2)(ii) 50. 73(a)(2)(x)

LEVEL (10) 97% 20.2203(a)(2)(i) 20.2203(a)(3)(ii) 50. 73(a)(2)(iii) 73.71 20.2203(a)(2)(ii) 20.2203(a)(4) 50. 73(a)(2)(iv) OTHER 20.2203(a)(2)(iii) 50.36(c)(1) x 50. 73(a)(2)(v) Specify in Abstract below 20.2203(a)(2)(iv) 50.36(c)(2) 50. 73(a)(2)(viil or in NRC Form 366A LICENSEE CONTACT FOR THIS LER (1i)

NAME . Dale Engle, Licensing Engineer TELEPHONE NUMBER (Include Area Code)

(616) 764-2848 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT. (1.3) . ..

CAUSE SYSTEM COMPONENT MANUFACTURER REPORTABLE CAUSE SYSTEM COMPONENT MANUFACTURER REPORTABLE TONPRDS TONPRDS SUPPLEMENTAL REPORT EXPECTED (14) MONTH DAY YEAR I YES If yes, COMPLETE EXPECTED COMPLETION DATE

. x I NO EXPECTED SUBMISSION DATE (15)

ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single-spaced.typewritten lines) (16)

On April 13, 1998, with the plant at 97% power, a post implementation review of a Technical Specification Surveillance Test Procedure identified that during the performance of the test on April 10, 1998, the High Pressure Safety Injection (HPSI) System had been rendered inoperable for approximately 90 minutes. The surveillance procedure directed-operations personnel to align both trains of HPSI such that a portion of the flow would be diverted through the Hot Leg Injection (HU) flow path. Since the total flow available to the core would have been less than required for certain postulated loss of coolant accident scenarios, the system safety function was rendered inoperable.

• Technical Specifications require two HPSI pumps to be operable when the primary system is above 325°F. The HU valve manipulations were added to the surveillance procedure in 1988. The procedure has been performed on 5 previous occasions while the plant was in hot shu.tdown wherein it was also not recognized that both trains of HPSI may have been rendered inoperable.

It is likely that the HPSI system was operable with the plant at hot shutdown; however, no analysis has been performed to document that sufficient flow to the core was available at hot shutdown conditions. The event is significant due to the impact on the HPSI system's ability to deliver adequate flow to mitigate certain postulated loss of coolant accident (LOCA) scenarios. Because of the event's significance, plant management responded aggressively. The HPSI system was immediately verified to have been restored to the correct valve alignment. An incident response team was commissioned to investigate the event and implement immediate corrective actions. In addition, a multi-discipline team was established to identify the knowledge, process, and personnel performance weaknesses that permitted the error to occur, and to define appropriate corrective actions to prevent recurrence.

9805200353 980513 PDR ADOCK 05000255.

S PDR

--*-_....,*---*-~"--'-- -***

NRC FORM 366a 4/95 U.S. NUCLEAR REGULA TORY COMMISSION LICENSEE EVENT REPORT (LER) g TEXT CONTINUATION FACILITY NAME 11\ DOCKET12l LER NUMBER 6)

CONSUMERS ENERGY COMPANY 05000255 YEAR I SEQUENTIAL NUMBER REVISION NUMBER 8

PALISADES NUCLEAR PLANT 98 007 00 TEXT (If more space is required, use additional copies of NRC Form 366A) (17)

EVENT DESCRIPTION On April 13, 1998, with the plant at 97% power, a post test review was performed of Technical Specification Surveillance Test Procedure RT-71 B, "HPSI Train 1 and 2 and SIT System, Class 2 System Functional/lnservice Test". This review determined that prior performance of this surveillance procedure on April 10, 1998, resulted in both trains of the High Pressure Safety Injection (HPSI) system being rendered inoperable. The surveillance procedure directed

.operations personnel to align both trains of the HPSI system into a configuration which would have redirected a portion of the HPSI flow from its normal Cold Leg Injection path to the single Hot Leg Injection (HU) path. During normal operation, HPSI Cold Leg Injection valves M0-3080 & M0-3081 are open while Hot Leg Injection valves M0-3082 & M0-3083 are closed (see figure 1). As part of the actions required by the surveillance procedure, M0-3080 & M0-3081 are closed and M0-3082 & M0-3083 are opened, which connects both trains of HPSI to the single HU path.

This redirection of flow resulted in less than credited flow being available to each of the HPSI Cold Leg Injection paths, rendering both trains inoperable. Additionally, with both trains of HPSI connected to the single HU path, a failure of the HU piping could divert enough flow out the break to prevent both trains of HPSI from performing their intended safety function.

Palisades Technical Specifications do not permit both trains of HPSI to be simultaneously inoperable. The subject HPSI system surveillance procedure alignment placed the plant in an condition which could have prevented the fulfillment of the HPSI safety function needed to mitigate the consequences of an accident. The system was in this configuration for approximately 90 minutes (from approximately 0100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> to approximately 0230 hours0.00266 days <br />0.0639 hours <br />3.80291e-4 weeks <br />8.7515e-5 months <br />).

The Technical Specification Surveillance Test Procedure was flawed in that the procedure alignment caused two HPSI trains to be concurrently inoperable during testing and in that the procedure failed to identify Technical Specifications implications.

No system or component failures led to this event. In addition, there were no transients or other challenges to plant operations during this event which would have required the HPSI system to perform its safety function.

• The HU valve manipulations were added to the surveillance procedure in 1988. Since that time the procedure has been performed on 5 occasions while the plant was in hot shutdown. It is. likely that the HPSI system was operable at hot shutdown conditions; however, no analysis has been performed to document that sufficient flow to the core was available.

• Therefore both trains of HPSI may have been inoperable each time the test was performed in hot shutdown. This potential for the system to be inoperable was not recognized each time the test was performed.

NRC FORM 366a 4/95 U.S. NUCLEAR REGULA TORY COMMISSION LICENSEE. EVENT REPORT (LER) g TEXT CONTINUATION FACILITY NAME 11\ DOCKETC2l LER NUMBER 6l CONSUMERS ENERGY COMPANY YEAR I SEQUENTIAL NUMBER REVISION NUMBER 05000255 8 PALISADES NUCLEAR PLANT 98 007 00 TEXT (If more space is required, use additional copies of NRC Form 366A) (17)

ANALYSIS OF THE EVENT The HLI valve manipulations were added to the surveillance procedure in 1988 using the temporary change process described by Palisades Technical Specification 6.8.3 (currently section 6.4.3). In retrospect, the implementation of the..,1988 procedure revision in this manner failed to satisfy the requirements of 10CFR50.59. In 1991, the procedure revision to permanently incorporate the temporary change was made based solely on the previous approval of the 1988 temporary change. A 10CFR50.59 evaluation was considered but deemed unnecessary because the 10CFR50.59 screening process erroneously determined that this procedure revision did not affect Technical Specifications or the FSAR. In 1997 the surveillance procedure was revised to allow the procedure to be performed with the plant at power. Again, a 10CFR50.59 evaluation was considered but deemed unnecessary because the 10CFR50.59 screening process erroneously determined that this procedure revision did not affect Technical Specifications or the FSAR. .

The preparers and reviewers of the 10CFR50.59 process documents did not recognize the effect of the HLI lineup on HPSI operability in hot shutdown. The current 10CFR50.59 evaluation process would require a 50.59 evaluation when a system alignment such as this is introduced into a procedure. The improved computer search tools available now would likely have caused preparers and reviewers to recognize and question the implications of the HLI lineup. It is unlikely that the errors made in 1988 and 1991 would be repeated using the current process. The failure to adequately implement the 10CFR50.59 process for the 1997 Surveillance Test Procedure revision was due to individual knowledge and performance weaknesses. The evaluation of this event concluded that the current 10CFR50.59 evaluation process is adequate.

Operations personnel were familiar with this particular valve alignment as an expected post-accident configuration from their accident mitigation training; however they failed to recognize that during powe*r operation and hot shutdown it was not appropriate to align both HPSI trains to 'the HLI path.

During preparation for the performance of the test on April 10, 1998, the Operations crew understood the HLI alignment, and discussed contingency actions in the event of an accident. The crew did preplan the immediate restoration of these valves to their normal alignment in the event of a plant upset. However, during job preparation, none of the crew who performed this test . -**

questioned the simultaneous train inv.olvement, or that many of the valve manipulations (including HLI alignment) were not required to accomplish the leak check of piping outside containment at system operating pressure, which was the procedure objective for this evolution.

For the April 10, 1998, performance, the Operations crew questioned whether LCO times should be recorded during performance of the test. However, they failed to conclude that the change in valve position affected HPSI system operability. This discussion should have taken place during the job preparation. The Control Room Supervisor and Shift ~ngineer referred to Technical

NRC FORM 366a 4/95 U.S. NUCLEAR REGULA TORY COMMISSION LICENSEE EVENT REPORT (LER) g TEXT CONTINUATION DOCKET12\

I FACILITY NAME l1 l LER NUMBER 6l YEAR SEQUENTIAL REVISION CONSUMERS ENERGY COMPANY NUMBER NUMBER PALISADES NUCLEAR PLANT 05000255 8 98 007 00 TEXT (If more space is required, use additional copies of NRC Form 366A) (17)

Specifications, Standing Orders and another surveillance test, which manipulated HLI valves.

However, they determined the surveillance procedure was acceptable as written, and there were no applicable Technical Specification implications. Having arrived at a consensus, the crew felt that the issues were straight forward and did not warrant the Shift Supervisor's involvement in the discussions on Technical Specification applicability. The crew's knowledge of Hot Leg Injection System requirements was improperly applied, as demonstrated by their incorrect conclusion.

Involving the Shift Supervisor would have provided another independent evaluation which might have identified the Technical Specification impact.

SAFETY SIGNIFICANCE No system or component failures led to this event. In addition, there were no transients or other challenges to plant operations during this event which would have required the HPSI system to perform its safety function. However, the impact of this event from a design basis accident perspective was significant.

• To assess the effect of the RT-71 B valve line-up on the design basis accident analyses, flow models of the HPSI system were run in the two most limiting configurations directed by the procedure: 1) a short duration (only several minutes) transition line-up with all HLI valves closed and 2) a test line-up which positioned M0-3080 & M0-3081 closed, while M0-3082 & M0-3083 were open. The flow reduction from the transition and test line-ups was then qualitatively assessed against the current accident analysis results, assuming no operator intervention to realign the system.

The results of the assessment indicate that for the analysis of the design basis small break LOCA occurring in a cold leg, the flow reduction resulting from either the transition alignment, or the test alignment would have led to exceeding 10CFR50.46 criteria, with the transition alignment representing the most limiting case. Additionally a third scenario was postulated with the small break occurring in the common portion of the HLI piping, with expected similar results of exceeding 10CFR50.46 criteria.

When evaluated against the design basis large break LOCA, it was determined that the HPSI flow reductions in the short term portion of the event (i.e., pre-recirculation) would not significantly reduce the margin to 10CFR50.46 peak cladding temperature criteria. Evaluation of the test _

alignment determined that HPSI flows would be higher than required for boil-off to remove decay heat after recirculation.. Evaluation of the transition alignment determined that HPSI flows may have been slightly lower than required to provide for initial decay heat removal after recirculation begins if operator intervention was assumed not to occur.

The design basis analyses ofsmall and large break LOCA events utilize many conservative

• assumptions including a high core power history. The safety significance for postulated LOCA events occurring with HPSI in the subject HLI alignments would be most limiting with the plant

NRC FORM 366a 4/95 U.S. NUCLEAR REGULA TORY COMMISSION LICENSEE EVENT REPORT (LER) g TEXT CONTINUATION FACILITY NAME 11 l DOCKET<2l LER NUMBER 6l CONSUMERS ENERGY COMPANY 05000255 YEAR I SEQUENTIAL NUMBER REVISION NUMBER PALISADES NUCLEAR PLANT 8 98 007 00 TEXT {If more space is required, use add1t1onal copies of NRC Form 366A) {17) initially at full power since decay heat removal requirements for events initiated at reduced power are much lower. It is not likely that the 10CFRS0.46 criteria would have been exceeded for small break LOCA events occurring with the HU alignment during hot shutdown. However, a specific analysis of this configuration has not been performed.

Since the operating crew discussed contingency actions and HU valve realignment in the event of an accident as part of their preparations for the surveillance, it is reasonable to conclude that the operator actions would be performed to realign the HPSI system. With operator actions to realign the HPSI system, the event is considered non-risk significant per the Probabilistic Safety Assessment (PSA) Applications Guide.

There were no challenges that required the HPSI function during any of the six occurrences while both HPSI trains were lined up for HU. Therefore, there were no actual consequences from this event.

CAUSE AND CORRECTIVE ACTION The proximate cause of this event was the performance of a flawed procedure. Performance of the flawed procedure has its root in a knowledge issue in which the organization failed to recognize the effect of the HPSI HU valve manipulations on system operability. The staff responsible for this error included both Engineering and Operations personnel involved in procedure development, review, approval, scheduling, and implementation. The barriers provided by both the procedure preparation process and the Operations scheduling and Operations on-shift implementation processes failed to prevent the inadequate procedure from being implemented.

The root cause has three distinct aspects which are described below with planned corrective actions: *

1) There was inadequate knowledge of the relationship between component manipulations and train/system operability. This knowledge deficiency occurred in both the procedure preparation/review process, as well as the job preparation phase of actually implementing the surveillance procedure. There was a failure to understand the safety function attributes associated with the HPSI HU valve manipulations, and integration of that information into operability decisions. Both Engineering and Operations staff displayed this knowledge--

d~ficiency.

Corrective Action: Licensed operators and. engineers will be trained to improve operational decision making through more effective use of available resources and personal knowledge.

NRC FORM 366a 4/95 U.S. NUCLEAR REGULA TORY COMMISSION LICENSEE EVENT REPORT (LER) g TExT CONTINUATION I

FACILITY NAME 11 l DOCKET12\ LER NUMBER 6\

YEAR REVISION CONSUMERS ENERGY COMPANY SEQUENTIAL NUMBER NUMBER PALISADES NUCLEAR PLANT 05000255 8 98 007 00 TEXT (If more space is required, use additional copies of NRC Form 366A) (17)

2) The procedure preparation and revision process should have prevented this procedure from

. being approved for use with the equipment manipulation/system alignment flaw~ that have subsequently been identified. The barriers in the procedure preparation process were ineffective for this procedure. The 10CFR50.59 process was not adequately implemented.

Corrective Action: The surveillance procedure preparation process will be strengthened by clarifying individual duties and by providing specific prompts to assure procedure revisions are reviewed in their entirety to broadly consider the effect of component manipulations on system operability.

No changes have been determined to be necessary to the 10CFR50.59 evaluation process.

Action has been completed to discuss the lessons learned from this event with the qualified reviewers of 10CFR50.59 process documents.

3) T:he job preparation process by operations was an ineffective barrier for preventing a .

system alignment which rendered both trains oJ HPSI inoperable. There was not an understanding of the fundamental effect of this test on the system. Operations personnel assumed that activities within an approved procedure were technically acceptable.

Corrective actions: Performance standards will be clarified and recommunicated to the Operations staff to emphasize maintaining a broad perspective, understanding the effect of component manipulations on system operability, and identifying when the Shift Supervisor should be involved in decision making.

CORRECTIVE ACTIONS COMPLETED Significant actions already taken in response.to this event include:

• The HPSI system was verified to have been restored to the correct valve alignment.

• Additional surveillance procedures, which were scheduled to be performed in the following two weeks and which manipulated safety systelTI components, were screened to confirm

. appropriate identification of Technical Specification implications.

• Immediate lessons learned from this event were communicated to the Operations Department including information that repositioning the Hot Leg Injection valves renders the associated HPSI train inoperable and the expectation for rigorous job pr~paration.

• An expert panel was formed and chartered to review two high safety significant systems (Auxiliary Feedwater System and Emergency Diesel Generators) and their associated surveillance procedures. The panel developed and applied screening criteria for the review

NRC FORM 366a 4/95 U.S. NUCLEAR REGULATORY COMMISSION LICENSEE EVENT REPORT (LER) g TEXT CONTINUATION FACILITY NAME m DOCKET<2\ LER NUMBER 6\

CONSUMERS ENERGY COMPANY 05000255 YEAR I SEQUENTIAL NUMBER REVISION NUMBER 8

PALISADES NUCLEAR PLANT 98 007 00 TEXT (If more space 1s required, use add1t1onal copies of NRC Form 366A) (17) to ensure all applicable Technical Specifications were appropriately addressed in the procedures. No similar findings were identified.

• Safety and Design Review personnel qualified to review 10CFRS0.59 evaluations were trained in the performance failures that led to this event.

• • ------~---

NRC FORM 366a 4/95 U.S. NUCLEAR REGULA TORY COMMISSION LICENSEE EVENT REPORT (LER) g TExT CONTINUATION FACILITY NAME f1\ DOCKETl2\ LER NUMBER 61 CONSUMERS ENERGY COMPANY PALISADES NUCLEAR PLANT 05000255 YEAR I SEQUENTIAL NUMBER REVISION NUMBER 8

98 007 00

• TEXT (If more space is required, use add1t1onal copies of NRC Form 366A) (17)

Figure 1 SIMPLIFIED DIAGRAM OF HPSI I HOT LEG INJECTION

~

LO~:Jm?o~EG . . .f - - - - - - - -....1...4f------il'll--.-~------)-- INJ~g~1&.\'Er:~1~E l REDUNDANT LO'l:J~gi?o~EG ----~------'-~-~ 1 - - - - - 1 1 - - 1~m1&:Er:li'1~E 2 LOOP

• t HOT LEC During normal operation, Cold Leg Injection valves M0-3080 and M0-3081 are open while Hot Leg Injection valves, M0-3082 and M0-3083 are closed. As part of the actions required by the surveillance procedure, M0-3080 and M0-3081 are closed and M0-3082 and M0-3083 are opened, which connects the two HPSI trains to the single HU path and wo_uld redirect some flow from the normal Cold Leg Injection path to Hot Leg Injection path.