05000254/LER-1997-006-03, :on 970327,loss of Reactor Coolant Inventory in Excess of Design Basis Limits Occurred Due to Inadequate Procedural Guidance.Procedure Qcop 1200-07 Was Revised to Administratively Control Power Feed Breaker

:on 970327,loss of Reactor Coolant Inventory in Excess of Design Basis Limits Occurred Due to Inadequate Procedural Guidance.Procedure Qcop 1200-07 Was Revised to Administratively Control Power Feed Breaker

ML20138B636
Person / Time
Site:	Quad Cities
Issue date:	04/23/1997
From:	Peterson C COMMONWEALTH EDISON CO.
To:
Shared Package
ML20138B624	List: 05000254/LER-1997-006, Forwards LER 97-006,Rev 00 & Submits Commitments Related to LER 05000254/LER-1997-006-03, :on 970327,loss of Reactor Coolant Inventory in Excess of Design Basis Limits Occurred Due to Inadequate Procedural Guidance.Procedure Qcop 1200-07 Was Revised to Administratively Control Power Feed Breaker
References
LER-97-006-03, LER-97-6-3, NUDOCS 9704290223
Download: ML20138B636 (6)

LER-1997-006, on 970327,loss of Reactor Coolant Inventory in Excess of Design Basis Limits Occurred Due to Inadequate Procedural Guidance.Procedure Qcop 1200-07 Was Revised to Administratively Control Power Feed Breaker

Event date:
Report date:
2541997006R03 - NRC Website

text

-.

LICENSEE EVENT REPORT (LER)

Form Rev. 2.0 Facihry Name (1)

Docket Number G)

Page (3)

Quad Cities Una One 0l5l0l0l0l2l5l4 1 l of l 0 l 7 Tit;e (4)

A postulated design basis fire could have caused multiple spurious operations of certain Reactor Water Cleanup System valves, paantially allowing a loss of reactor l

cotard invernory in excess of design basis linuts, due to inadequate procedural guidance.

Evens Date (5)

Lf.R Number (6)

Report Date (7)

Other Facihties lovolved (8)

Morph Day Year Year Sequential Revision Month Day Year Facihty Docket Numberts)

Number Number Names QuadCities 0l5l0l0l0l2l6l5 Unit 2 0l0l6 0l0 0l4 2l3 9l7 0lSl0l0l0l l

l 0l3 2l7 9l7 9l7 OPERATLNG THIS REPORT IS SUBMf!TED PURSUANT 'r0 THE REQUIRE)v ENTS OF 10CFR MODE (9)

(Check one or more of the fouowing) (11) 4 20.402(b) 20.405(c) 50.73(a)G)(iv) 73.71(b)

POWER 20.405(a)(1)0)

So.36(c)(1) 50.73(a)G)(v)

- 73.71(c)

LEVEL 20.405(s)(1)0i) 50.36(c)C) 50.73(a)G)(vii)

Other (Specify (10) l l

0 20.405(a)(1)0ii) 50.73(a)G)0) 50.73(a)G)(viii)(A) in Abstract 20.405(a)(1)0v)

T50.73(a)G)0i>

50.73(a)G)(viii)(n) below and in 20.405(a)(1)(v) 50.73(a)G)0ii) 50.73(a)G)(x)

Text)

LICENSEE CON FACT FOR THIS LER (12)

NAME TELEPHONE NUMBER AREA CODE Charles Peterson, Regulatory AfTairs Manager, ext. 3609 3

0l9 6l5l4l-l2l2l4l1 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN 'FHIS REPORT (13)

CAUSE

5 YSTD4 COMPON DdT MANUFACTURER REPORTABLE

CAUSE

5YSTD4 0)MPONENT MANUFACUlRER REPORTABLE TO NPRDS TO NPRDS I

I I

I I

I I

I I

I I

I I

I i

l l

l l

l l

l 1

l l

l SUP >ID4 ENTAL REPORT EXPECTED (14)

Expected Moesh Day Year Submission

]YES Of yes, sasarleen EXPECTED SUBMISSION DATE)

]O Date (15) l l

l ABSTRACT (lama to 1400 specce, Lo., appronunately fthcen smgne-epam typewraum imes) (16)

ABSTRACT:

On 032797, during a review of a Problem Identification Form (PIF) written on 022796, station personnel concluded that the Plf had been incorrectly dispositioned as non-reportable due to incomplete understanding of the Quad Cities Appendix R Safe Shutdown Analysis.

On 022796, during a review of the Station's Appendix R Conformance Safe Shutdown Analysis (SSA), plant personnel discovered that the Reactor Water Cleanup (RWCU) system had been identified as a high/ low pressure interface requiring isolation during certain design basis firos. However, no actions to isolate the RWCU system during a fire were included in the safe shutdown procedures due to a cognitive personnel error on the part of the procedure writer.

Failure to properly isolate the RWCU system during a design basis fire could have prevented station operators from attaining safe shutdown prior to reactor level reaching the top of active fuel.

The potential blowdown path was resolved by turning off the power feed breaker to the normally closed RWCU blowdown orifice bypass valve M01(2)-1201-76. All other high/ low pressure interface paths were reviewed to ensure that each was resolved correctly. This event had the potential to pose a safety concern in the unlikely event of a design basis fire.

l LER254\\975006.WPF 9704290223 970423 j

PDR ADOCK 03000254

)

g PDR

. =, - -

..._ -.- -...~...- -

2 a.*

LICENSEE EVENT REPC: T (LER) TEXT CONTINilATION_ _

Form Rev. 2.0 '

FACILTTY NAME (1)

DOCKET NUMBER (2)

LBt NUMBER (6)

PAGEQJ Year Sequennal Revieson Number Number t

olo 2 lOFl o l 7 0lol6 Quad Cities Unit One ol5lolol0l2l5l4 9l7 TEXT Energy ladustry idonaficauco System (EII5) codes are idenh6ed in the text as (XX)

PLANT'AND SYSTEM IDENTIFICATION:

l t

General Electric - Boiling Water Reactor - 2511 MWt rated core thermal power 4

l EVENT IDENTIFICATION: A postulated design basis fire could have caused multiple spurious

.j operations.of certain Reactor Water Cleanup System valves, potentially allowing a loss _of

~

reactor coolant inventory in excess of design basis limits, due to inadequate procedural 4

guidance.

4 A.

CONDITIONS PRIOR TO EVENT

l f

Unit: One Event Date: 022796 Event Time:

1730 Reactor Mode: 4 Mode Name:

Refueling Power Level: 000%

Unit: Two Event Date: 022796 Event Time:

1730 Reactor Mode: 1 Mode Name:

Power Operation Power Level:

100%

This report was initiated by Licensee Event Report 254\\97-006.

B.

DESCRIPTION 0F EVENT i

On 032797, during a review of a problem identification form (PIF) written on 022796 regarding Appendix R safe shutdown procedures, station personnel l

concluded that the PIF had been incorrectly dispositioned as a non-reportable event.

The PIF identified missing procedure steps as the problem.

It was not recognized that the missing steps also constituted a nonconformance to the Safe Shutdown Analysis (SSA). An ENS call was made on 032797 to report the historical condition.

On 022796, while reviewing the Station's Appendix R Conformance Safe Shutdown Analysis (SSA), plant personnel discovered that the Reactor Water Cleanup (RWCU)[CE) system had been identified as a high/ low pressure interface whereby reactor coolant inventory could have been lost. The SSA indicated that to i

prevent excessive reactor inventory loss, the normally-open RWCU outboard containment isolation valve M01(2)-1201-5 should be manually closed during a postulated Appendix R fire.

However, of the six procedures where RWCU isolation was required, none contained steps to isolate the RWCU system. The remaining 10 procedures did not require RWCU isolation.

A PIF was initiated on 022796 to identify the fact that the Appendix R safe i

shutdown procedures did not contain the steps to isolate a high/ low pressure

- interface with the RWCU system as indicated in the SSA.

LER2$4\\97WO6.WPF,

e

LICENSEE EVE!G REPORT d.E30 TEXT CONTINUATION

_ _ _. _. __.._ ___ ___ form Rev 2.0 FACIIRY NAME (0 DOCKET NUMBER G)

LER NUMBER (6)

PAGE (3)

Year Sequennel Revision Number Number j

Quad Chies Unit one 0l5l0l0l0l2l5l4 9l7 0l0l6 0l0 3 lOFl 0 l 7 TEXT Energy Induary idenuficeuon System (EH5) codes are idenn6ed m the text as (XXj As part of its SSA, Quad Cities was analyzed for the affects of multiple spurious actuation of system components in any one flow path that constitutes a high/ low pressure interface. Each possible reactor blowdown path was resolved within the SSA in such a way that the ability to safely shutdown the reactor prior to water reaching the top of the core was not affected. The resolution for the potential RWCU blowdown path was to manually isolate the i

system during a design basis fire. However, no steps were included in the safe shutdown procedures to isolate the RWCU system.

All other high/ low pressure interface valves identified in the Appendix R SSA were verified to be resolved correctly within the safe shutdown procedures.

While attempting to solve the RWCU issue, Station personnel discovered that in order to manually isolate the M01(2)-1201-5 valve during a Unit 1 or Unit 2 reactor building fire, operations personnel would have been required to enter the fire area.

In essence, the resolution for the RWCU high/ low pressure interface valves as stated in the SSA would not have been possible to implement in two of the six safe shutdown procedures where RWCU isolation was i

required.

It became necessary to use an alternate method to ensure excessive reactor inventory would not be lost through the RWCU system. The alternate method required a detailed calculation of reactor water level timelines.

On 052396, reactor level timeline calculations were completed. The calculations confirmed that the blowdown rate through the RWCU system could be successfully limited to below design basis levels by ensuring that the normally closed blowdown orifice bypass valve M01(2)-1201-76 was not vulnerable to fire induced spurious actuation. This was accomplished by administratively controlling the power feed to M01(2)-1201-76 in the off position. The controlling procedure became effective on 052896.

If the affected shutdown paths had been properly declared inoperable on 022796, per administrative requirements the Station would have been placed in a 67 day Limiting Condition of Operation (LCO) and would have required fire watch duty for compensatory measures.

Nonetheless, fire watch duty was fully in place from 022796 to 052896.

If, at the end of the 67 day period, on 050496, the RWCU issue was not resolved, a shutdown of Unit 2 would have been administratively required. The 67 day LC0 was not entered, and corrective actions were taken in a time frame commensurate with the significance assigned to the PIF.

Unit 2 continued to operate with three of its eight required shutdown paths inoperable until a forced shutdown on 051096 (storm related).

Since Unit I was in cold shutdown between 022796 and 052896, no Unit I shutdown paths were required to be operable during that time.

UER256006,WPF

~

LICENSEE EVENT REPORT (1.ER) TZXT CONTINUATX)N Form Rev. 2.0...

F ACILTTY NAME (1)

DOCKET NUMBER (2)

LER NUMBER (6)

PAGE (3)

Yeer Sequennel Rension Number Number 0l0 4 lOFl 0 l 7 0l0l6 Quad Citie: Unit one 0l5l0l0l0l2l5l4 9l7 TEXT Energy Industry idenu6 cation Sysism (Ells) co<es are idenu5ed in the text as [XX)

{

C.

CAUSE OF EVENT

The root cause of this event was a cognitive personnel error on the part of the safe shutdown procedure writer and reviewer. An incorrect reportability determination was caused by an incomplete understanding of the Quad Cities Appendix R Safe Shutdown Analysis.

D.

SAFETY ANALYSIS

This event had the potential to pose a safety concern in the unlikely event of i

a design basis fire.

The probability of the design basis fire to occur is small. The Station also i

reduces the probability of a design basis fire from occurring by the use of defense-in-depth as described in Appendix R.

The first defense is to prevent a fire from occurring. Administrative controls such as procedures to control hot work and the use of ignition sources are implemented to reduce the number of ignition sources. Administrative controls are in place to keep the amount of combustible materials in the plant low. This is accomplished through i

transient fire load procedures and modification reviews.

The second defense is to provide rapid detection and suppression if a fire were to occur. This is accomplished by using early detection systems and automatic suppression systems.

These automatic systems are augmented r 'igh the use of manual fire fighting through the fire brigade. Administrat u requirements for compensatory fire watch duty when safe shutdown paths at:

inoperable are intended to fortify this defense. Since fire watch duty was fully in place between 022796 and 052896, the incorrect operability determination of this event posed an insignificant safety concern.

The final step of defense-in-depth is to contain a fire within a single fire area to protect safe shutdown systems and components. Although not directly i

used to attain safe shutdown, the RWCU system constituted a potential flow i

path whereby reactor inventory could have been lost. During a design basis l

fire, the RWCU system would be required to be sufficiently isolated to prevent a loss of reactor inventory greater than the design basis inventory loss.

1ER254\\9M06.WPF

LICENSEE EVENT REPORT (LEIU TEXT CoNTLNUATION Form Rev. 2.0 FACILrrY NAME (1)

DOCKET NUMBER (2)

LER NUMBER (6)

PAGE (3)

Year Sequeeual Rsvision Number Number Quad Cities Unit One 0l5l0l0l0l2l5l4 9l7 0l0l6' 0l0

$lOFlol7 TEXT Energy industry idenufnuon Sy mem (Elis) codee are idenu6ed in the text as (XX)

The RWCU system was configured such that if two Motor Operated Valves (MOVs) were to have unexpectedly remained in the open position following an auto-close signal and two additional MOVs were to have spuriously opened from their normally closed position and one additional Air Operated Valve was to have spuriously opened from its normally closed position, then an excessive reactor blowdown rate could have been experienced. The probability of this series of five specific fire induced valve failures was low. However, if such a series of valve maloperations were tc have occurred as a result of a design basis fire, a greater than expected reactor inventory loss could have prevented station operators from attaining safe shutdown prior to reactor level reaching the top of active fuel.

Without submergence of the reactor core, damage could have resulted, although other barriers to prevent a radioactivity release to the public would have been unaffected by this event.

E.

CORRECTIVE ACTIONS

Corrective Actions Completed:

1.

Operations Procedure QCOP 1200-07, "RWCU System Coolant Rejection" was revised to administratively control the power feed breaker to M01(2)-1201-76 in the 0FF position (completed on 052896).

2.

Appendix R safe shutdown procedures were reviewed to ensure that all high/ low pressure interface paths were adequately resolved as stated in the Appendix R SSA (completed on 052896).

3.

Station Fire Protection Engineering personnel have received much more in-depth knowledge and understanding of the Station Appendix R design basis through recent completion of the fire Individual Plant Examination of External Events (IPEEE) and various fire protection program improvements.

4.

The current procedure revision process requires a cross discipline review of all Appendix R safe shutdown procedure revisions by the Station Appendix R Coordinator.

Corrective Actions to be Completed:

1.

The Appendix R Conformance Safe Shutdown Report will be revised by 092897 to define the M01(2)-1201-76 valve as the RWCU isolation valve.

(NTS # 2541809700601; Engineering) 2.

All Shift Engineers and Engineering Representatives for the Event Screening Committee will receive training by 101597 on an overview of the Quad Cities Safe Shutdown Analysis and the Appendix R safe shutdown design basis.

(NTS # 2541809700602; Training) l l

LER254\\97206.WPF

,[

e

.,..._. _-. I.JCENSEE EVENT REPORT (LER) TEXT CONTINUATION

. Form Rev. 2.0 FACILTTY NAME (1)

DOCAET NUMBER (2)

LER NUMBER (6)

PAGE0)

Year Sequeoual Revision Number Number 0l0 6 lOFl 0 l 7 Quad Cities Unit One 0l5l0l0l0l2l5l4 9l7 0l0l6 TEXT Energy Industry Idenuficauon System (Ells) codes are utenufied m the text as (XXj F.

PREVIOUS EVENTS:

PIF 96-2053 6/07/96 level III - LER l-96-008 - Testing performed on the CAM check valves does not meet Tech Spec requirements due to an inadequate procedure.

PIF 96-2897 10/9/96 Level III - LER 2-96-002 and PIR 2-96-057 - HPCI declared inoperable when flow could be obtained through FG 2-2301-10 due to inadequate procedures.

G.

COMPONENT FAILURE DATA

There were no component failures associated with this event.

)

i i

LER254\\91h006.WPF