ML19332E769

LER 89-039-00:on 891107,determined That Control Circuits for Two Makeup Valves Did Not Meet Separation Criteria of 10CFR50 App R.Caused by Cognitive Personnel Error.Roving Fire Watch Patrol Confirmed in effect.W/891207 Ltr

ML19332E769
Person / Time
Site:	Crystal River
Issue date:	12/07/1989
From:	Moffatt L, Ken Wilson FLORIDA POWER CORP.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
3F1289-03, 3F1289-3, LER-89-039, LER-89-39, NUDOCS 8912120118
Download: ML19332E769 (6)

Text

I ,

==

COhrOH AT TON December 7, 1989 3F1289-03 U. S. Nuclear Regulatory h l = ion Attention: M= ant Ceritrol Desk Washington, D. C. 20555

Subject:

Crystal River Unit 3 Docket No. 50-302 Operating License No. DPR-72 Licensee Event Report No.89-039 l

Dear Sir:

l Enclosed is Licensee Event Report (IIR)89-039 Milch is subnitted l

in accordance with 10 C m 50.73.

j Should there be any questions, please contact this office.

Very truly yant, Kenneth R. Wilson Manager, Nuclear Licensing WIR:mg Enclosure xc: Regional Administrator, Region II Senior Resident Inspector p1k I i 8912120118 891207

,-POR ADOCK 05000302 3 FDC POST OFFICE DOX 219

• CRYSTAL RIVER, FLORIDA 326290219 * (904) 563-2943 A Florida Progress Company

1

.  :.,c,n,. m C .mt -, . m 0N ,,,,,0v , , 0M, ,,0 ,,,,0,,

. I Krt%t $ ef30'92 ESTtMAttD tvRDEN PIN mt&#0NSE TO COMPLY WTH THl$

. LICENSEE EVENT REPORT (LER) E#8Mi # 'U o'E o'?S O c*t.' E#iM #i T U *t #CYn"S NEdi77.E*COMidIdEI'IIHEEN n EE>SAUNt!i" '

D'M 0'A#F,3 ' "

A4!$'f?T.!!E'a*t'tuf3."

. AcettTV %AMS tli " DOCR E T NUMSi m (3) F AU3 i3' CRYSTAL RIVER UNIT 3 0 is g o l0 l0l3l0 l2 i jorl0 l5 Personnel Error Results in Operation outside the 10CFR50 Annendix R Senaration Desien Basis tytNT DATS tll tin NUMett tai mtPORY Datt t?) Of tet h 9 ACILif ett tNv0LvtD lei MONTM DAY YiAR YiAR Yhf6 7,",N MONTH DAY vtgR . 6CILIT Y h&M.$ DOCS t ? NUM$t hi$)

N/A 0lfijol0l0l l l

- ~

1l1 0l 7 8 9 8l9 0l 3l 9 0l0 1l 2 0l7 8 l9 N/A 0 1 5 1 0 l0 t 0 t l l l T wi. n6,0 7 1. .u.Minio ,v .uaNT T O T i ..Ou.. Mt Nn 0, i. C . i ,C . . ., . ., ,, ,.~ ,, ni, "0D8 1 to eosini ro easie, so nanan i n tit 6i gno. u in o .i.nu o n n.n., n m.i 096 ro .a i.inmi u anim no.n.ns n.i.i n i.nina w n;.n,u

..n,.,m.. in Ai gT,w3, ma ;4, ,,yg.,Ag,ge, u inn ,

x_ = ni.n i n ,. u, n..i. n. ,

20 4066.In n., to psi.ntnesti 60 tal.Hanet LICIN6tl CONT ACT SOR TMis Ltm fiti eg.M g Till' HONE NUMBE R L. W. MOFFATT, NUCLEAR SAFETY SUPCRVISOR 91014 719 i 5 l- 16141816 COMPLif t ONE tikt 80R I ACM COMPONtNT f Altunt ptscaisto 64 TM;$ meP0nt itsi O a OptA E CAust 8v8 TIM COMPONINT "$

"fo(,'n'fII C Avlt sv5f tM COMPONEN1 M A)d AC pp I i 1 I i i l i f I I I I I I i l l l 1 1 I I I i l i I SUPPLtMINT AL RFP0mf E kPECTED ti4l MONTH Day vtan Sv8Mi&510N 4tS te, p.s .emer. I APICTED Sv9 tSSION Ostil NO l l l An T . A e T <t -, ,, , e -.. . . . . . ., ,,, . ... <. ,,,,-~,. ,, n e .

On November 7, 1989, Crystal River Unit 3 was in MODE 1, POWER OPERATION. At 1515, it was determined control circuits for two Make-up valves did not meet the separation criteria required by 10CFR50 Appendix R. This event was caused by cognitive personnel error. The valves and control circuits were operable at the time of the event and no equipment failures occurred. A roving fire watch patrol was confirmed in effect. The two deficient circuits will be modified to meet separation criteria. A review of modifications subsequent to the original 10CFR50 Appendix R design will be performed to assure the separation criteria are being met. Relevant Engineering Procedures have been revised to provide additional guidance to the design engineers. The Nuclear Engineering organization will develop a training program for personnel writing or reviewing modifications that invoke 10CFR50 Appendix R design criteria.

N._C f orm344 . .111

4 C ,00,1M attA U.S LUC 4 L M L E#UL.'.TOh V CCMAMit.lDN

• 4 MllI$ 4'300 l

'y','s*A'2,9fJ'"f,0,M"ol'#??3,'D,gTJ/ .T"JM LICENSEE EVENT CEPORT (LER)

TEXT CONTINU ATION Pgjf,L5,,';',6.^1,'di #ff',Mt'e'"##fu'"l lJ!Tf,!

MiA,' ."J1?*n't5jff',c

• J %P.*#& l???

,'M*1' Of MAN AGt ME NT AND DVDGlf.n A&MINGTON. DC 23h03-8 ACILITY hAMt 44 POChli NUM$t h (2l Lt h WVM$t h ($1 tA06 (Si

'" N,Ip sYo' CRYSTAL RIVER UNIT 3 0 ]6 l0 l0 l0 l3 l0 l 2 8l9 -

0 l3 [9 -

0 l0 0l2 0F 0l5  ;

rsxT in, < w.m e me.m en mc r.~ sm e sm -l EVENT DESCRIPTION On November 7, 1989, Crystal River Unit 3 was in MODE 1, POWER 1 OPERATION, at 855 MWe. The control circuits for two valves (ISV) l in the Make-up System (CB) (MUV-40 and MUV-41) that isolate Reactor Coolant System (RCS) ( AB) letdown are located on the 124 ' elevation of the Control Complex (NA). These two valves, both inside the Reactor Building (NH), comprise one train of letdown isolation (see Figure 1). The valves are part of the equipment required for safe shutdown of CR-3 in the 10CFR50 Appendix R design for a fire on the 124' elevation of the Control Complex. The redundant train is the single isolation valve outside the Reactor Building. For the design fire on the 124' elevation, c'he outside isolation valve control circuitry is assumed failed. At 1515, it was determined the control circuits for the two inside valves did not meet 10CFR50 Appendix R separation criteria from the outside valve. The valves and control circuits were operable at the time of the event and no equipment failures occurred.

The deficiency was discovered during an Engineering review of drawings to support an inspection by NRC personnel. The failure to meet the 10CFR50 Appendix R separation criteria is considered to be an operation outside the design basis for the plant and reportable in accordance with 10CFR50.72 (b) (ii) (B) . A one hour verbal report was made at 1525 on November 7th and assigned NRC event number 17034. This report is beir.g submitted in accordance with 10CFR50.73 (a) (ii) (B) .

CAUSE The control circuits of MUV-40 and MUV-41 were modified in 1985, in an effort to meet the 10CFR50 Appendix R separation critoria.

Despite this effort, the required separation was not achieved by the design change. The failure to implement the required separation was caused by cognitive personnel error by utility and contract engineers. The designer and reviewers failed to assure the design met its intended function.

EyJNT EVALUATION If a fire had disabled these circuits, then letdown flow could not have been isolatud. The 10CFR50 Appendix R design assumed letdcwn flow would be isolated. The consequences of the failure would be that the valves remain open and letdown flow would be higher than assumed. This would require the make up flow to be higher, but still well within the capacity of the pump.

The greatest potential for impact on the ability to safely shut N:.c e A mi

.M ,A ouucum.tovuio < coM.= oN gC,,, ,,,,, ,,, ,,, ,, ,,,,,,,,

E mm m u

LICENSEE EVENT REPORT (LER) (5,'s"".',%*N iOJtid'505',,'%cMV ,T,"J"%

TEXT CONTINUATION M".'ETo'd't e d.*O*in 'All'e',ff,'MM,"' MtR P Att nw r ht T tDN J 60@ O IC 0, MANAGE ME NT AND SVDGET.W A6HINQYON.DC KibO3.

8 ACILeiv hAME m DOch ti NUMet a at 4th NUM$th 161 t&Of w viaa " ntW. "'a*J CRYSTAL RIVER UNIT 3 o l6 l0 l0 l0 l 3l0 l2 8 l9 -

0 l3 l9 -

O l0 0l3 0F 0h rseen -..,meo -.< m wNncrn mrown down the plant would have been the inability to isolate the flow of water into the Make-up System (CB) tankage (i.e. Make-up Tank (CE,TK), R.C. Bleed Tanks (WD,TK)) in the Auxiliary Building. The make up capacity, coming from the Borated Water Storage Tank (BP,TK) (capacity 420,000 gal.), would have been sufficient to maintain cooling water to the core ( AC) . However, the letdown flow would not be recirculating to the core and it would quickly overfill the Make-up Tank (capacity 4,488 gal.) or more slowly overfill the R.C. Bleed Tank (capacity 75,000 gal). This would then cause relief valves to lift, spilling untreated reactor coolant liquid onto the Auxiliary Building floor. This condition would create a radiological hazard in the Auxiliary Building and complicate shutting down the unit, even after the fire was  !

extinguished. The possibility of this occurring is considered extremely remote. The postulated fire which would disable the control circuits for MUV-40, MUV-41 and MUV-49, would be located in the control complex while the valves are located in other buildings. Letdown flow could be isolated by manual operation of these valves.

CORRECTIVE ACTION It was immediately confirmed that a roving fire watch patrol was in effect. This was considered to be an effective fire protection measure which would reduce the potential for a major fire and the need to isolate letdown flow as required by the 10CFR50 Appendix R fire study. The roving fire watch and the ability to manually isolate letdown flow were considered adequate compensatory measures until the deficient circuits could be modified. The two deficient

, circuits associated with MUV-40 and MUV-41 will be modified to meet l the 10CFR50 Appendix R separation criteria.

The control circuit for a third letdown cooler outlet isolation valve was checked, and it was found to be acceptable. This letdown cooler was added to the plant after the 10CFR50 Appendix R fire study modification was completed.

The Crystal River Unit 3 10CFR50 Appendix R design development was completed in 1985. Since then, relevant Engineering Procedures have been revised to provide additional guidance, regarding 10CFR50 Appendix R criteria, to the design engineers. A review of all modifications developed subsequent to installation of 10CFR50 l Appendix R modifications in 1985 will be performed to assure all the 10CFR50 Appendix R separation criteria are being met, fdC f.rm ,e6A (6491

..,4 =A u i . vel ..u. .uuio., c-....

l 74 ,,,,,,,,, ,,, ,, ,,,,,,,,

w ,3.ss . w i LlcENSEE EVENT C'.EPORT ILERI 'j,'s"t'#',o',;'ifR ",','o*'231',,'%CMy is,".'"'!

TEXT CONTINU ATION  ?*n",'i;'c',$!'#fai asf'J 1!,'e'3l2 ',*s' Ochfi 1+ 5 APG RWD E fit Y oh .I (3 60 ( i) it Of MAN AOL MINT AND pupGit.n ASHINGTON. DC E%3

$ ActLIT4 h&Mt its DOCK t t NUM64 P Lil Lim huMDtm sei PAOL (Si i.a "m.;;t'  ;'q CRYSTAL RIVER UNIT 3 015l01010l31012 819 -

01319 -

010 0 14 0' 0 15 rsx, c o - A ~. m swc o- w e nn In addition to these actions, the company is taking additional actions in response to an internal audit. The Nuclear Engineering organization will develop a training program for personnel writing or reviewing modifications that invoke 10CFR50 Appendix R design criteria. The additional information in the Engineering procedures, along with the training program, should preclude a repetition of this event.

PREVIOUS.SIMILAR, EVENTS  ;

There have been eight previous events caused by cognitive personnel l error that led to an operation outside design basis. However these were all discovered subsequent to the design of this circuitry.

The corrective action to those events would not have prevented this error. 1 l

CC Fonn 3e6A (6491

f ponesaeta u 8 Luct tan 4i Autatomv Co.suts6sO%

.PP40vi0 Dwe 40 311001C2

, i t,,m .m,

, uCENSEE EVENT CEPORT (LER) .

',*'n'.'&'fe.st M"J'5*otu,'%.it to'f%' TME .%".1"'!

h4ComDS

. ', TEXT CONTINUATION c.o.swa

.i n,t 0 1s.at.G..m.D.iwG.tu. m,DL.h. 8 51 w

. niout c.

~eovos,, sin, oc ravi =u. cts..

u. =o to P(MWOhg R$ DuCTIQh R Of u.P 1HE

.,s v,=b.Gt o , co.wissio=

wt hT AND54tNGionsDVDGit.m.3J{CT Offitt DC 70003 (396

{

,,,, s i a... . . . . . . . .e . $

CRYSTAL RIVER UNIT 3 ' " ' ' * '**'*

o l6 l0 l0 l0 l3l0l 2 8l 9 -

0l3 l9 -

O! O OlV 0F 0l5 tant m ,e . w =ac s un.vem l

l:

FIGURE I J

I 1

- mu Y Y /o.

--4%

80/ 49 IW

'O ' 81 TO WhP d %mY WJ R.RIFItatICN SYSTtA Avv -6m

- >4 -- +h- >4-eenc tonn setA (64e1

. , . . . - , - .- - , . . - -