05000412/LER-2023-003-01, Missile Barrier Door Left Open Resulting in a Loss of Safety Function
| ML24051A155 | |
| Person / Time | |
|---|---|
| Site: | Beaver Valley |
| Issue date: | 02/20/2024 |
| From: | Blair B Energy Harbor Nuclear Corp |
| To: | Office of Nuclear Reactor Regulation, Document Control Desk |
| References | |
| L-24-034 LER 2023-003-01 | |
| Download: ML24051A155 (7) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(vii)(B), Common Cause Inoperability |
| 4122023003R01 - NRC Website | |
text
energy IJ!:::.-' harbor Barry N. Blair Site Vice President February 20, 2024 L-24-034 ATTN: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001
SUBJECT:
Beaver Valley Power Station, Unit No. 2 Docket No. 50-412, License No. NPF-73 LER 2023-003-01 10 CFR 50.73 Beaver Valley Power Station P.O. Box4 200 State Route 3016 Shippingport, PA 15077 724-682-5234 Fax: 724-643-8069 Enclosed is revision 1 to Licensee Event Report (LER) 2023-003, "Missile Barrier Door Left Open Resulting in a Loss of Safety Function," which is being submitted to correct discrepancies with the Component Cooling Water System dates of inoperability. The changes are marked with a revision bar in the margin. The original LER was submitted in accordance with 10 CFR 50.73(a)(2)(i)(B), 10 CFR 50.73(a)(2)(ii)(B),
10 CFR 50.73(a)(2)(v)(B), and 10 CFR 50.73(a)(2)(vii)(B).
There are no regulatory commitments contained in this submittal. If there are any questions or if additional information is required, please contact Mr. Steve Sawtschenko, Manager, Regulatory Compliance and Emergency Response, at 724-682-4284.
Sincerely, Barry N. Blair
Beaver Valley Power Station, Unit No. 2 L 034 Page 2 Enclosure: Beaver Valley Power Station, Unit No. 2 L ER 2023- 003-01 cc:
NRC Region I Administrator NRC Senior Resident Inspector NRC Project Manager INPO Records Center (via INPO Industry Reporting and Information System)
BRP/DEP
Enclosure L-24-034 Beaver Valley Power Station, Unit No. 2 LER 2023-003-01
Abstract
On June 11, 2023, while Beaver Valley Power Station, Unit No. 2 (BVPS-2) was in Mode 1 at 100 percent power, a missile shield door was discovered to have been left open since April 6, 2023 and prior to the start of the spring 2023 refueling outage. Both Primary Component Cooling Water trains were inoperable for the period between April 7, 2023 to April 9, 2023, and May 14, 2023 to June 11, 2023. This was reported via Event Notification 56569 as an unanalyzed condition and a loss of safety function.
The direct cause of the door being left open is station personnel did not adequately track ownership of the door over the multi-day evolution. Personnel did not follow the procedure when they failed to assume ownership of the door and shut the door at the end of the work activity. The root cause is the organization did not have a clear and concise process for controlling ownership and responsibility for missile shield doors when temporarily opened. Corrective actions include adding a check that the door is closed to the daily tour log, creating a specific procedure for opening and closing the door, and adding controls to the administrative procedure, including a dedicated closure team requirement until doors are restored to closed and latched.
- 2. DOCKET NUMBER
- 3. LER NUMBER I
00412 YEAR SEQUENTIAL REV r=:i NUMBER NO.
~-I 003 l-0 Energy Industry Identification System (EIIS) codes are identified in the text as [XX].
BACKGROUND Door A-35-5A [NF-DR] is a credited tornado missile barrier for the Primary Auxiliary Building (PAB) and protects both trains of Primary Component Cooling Water (CCP) [CC]. The normal alignment for this door is closed and latched; however, it could be opened under administrative control in accordance with site procedure 1/2-ADM-2021, "Control of Penetrations (Including HELB Doors)." When opening the door during Modes 1-4, 1/2-ADM-2021, revision 15 required that the work group is briefed to close the door at the end of the work period and a Narrative Log entry is made stating that equipment required to close the door is staged and identifies the responsible work group. In the event of a tornado watch, the Shift Manager is required to direct the work group to close and secure the door. When the door is closed, the responsible work group is required to report the closure to the control room and a Narrative Log entry is made stating that the door is shut. When opening the door during Mode 5, the Narrative Log entry also states that the door shall be shut and latched prior to entry into Mode 4.
Technical Specification (TS) Limiting Condition for Operation (LCO) 3. 7.7 requires two trains of CCP to be operable in Modes 1-4. Wrth one train inoperable, Condition A requires the CCP train to be restored to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or the unit must go to Mode 3 in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 in 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. Wrth both trains inoperable in Modes 1-4, LCO 3.0.3 applies requiring the unit to be placed in a Mode or other specified condition in which LCO 3.7.7 is not applicable. If inadequate residual heat removal (RHR) [BP] capability exists in Mode 4, then LCO 3.7.7 Condition C applies and requires immediate action to restore one train of CCP.
DESCRIPTION OF EVENT
On June 11, 2023, while Beaver Valley Power Station, Unit No. 2 (BVPS-2) was in Mode 1 at 100 percent power, credited tornado missile barrier door A-35-5A was discovered to be open and was subsequently closed and latched. A loss of safety function was declared for the CCP system. This was reported via Event Notification 56569 as an unanalyzed condition and an event that could have prevented the fulfillment of the safety function to remove residual heat. A past operability review determined that operability of the CCP system could not be supported while the door was open during the Modes of TS applicability and both CCP trains were determined to have been inoperable for that period.
At 0838 on April 6, 2023, while BVPS-2 was in Mode 1 coasting down to enter its twenty-third refueling outage (2R23), the door was authorized to be opened to move equipment. This was documented in the Narrative Log in accordance with 1/2-ADM-2021 and the responsible work group was identified. The responsible work group was required to close the door after moving the equipment in accordance with the procedure; however, when the responsible work group completed the task they did not close the door. The door was not communicated as shut to the control room and there was no log entry stating that the door was shut. Additionally, the Narrative Log entry authorizing the door to be opened was not carried over to later shifts.
DESCRIPTION OF EVENT (Continued)
- 2. DOCKET NUMBER I
- 3. LER NUMBER YEAR SEQUENTIAL r:::7 NUMBER
~-I 003 REV NO.
1-0 At 0947 on April 7, 2023, another work group was authorized to open the door. The door was already open when they arrived, and they determined from the prior Narrative Logs that the responsible work group had previously been authorized to open the door and had not yet closed it. Therefore, after their work activity was complete, the second work group left the door open as they had found it. Since the door was neither closed at the end of the original work activity as required by 1 /2-ADM-2021, nor at the end of the second work activity, and the log entries authorizing the door's open position were not carried over for either work group, the responsibility for the door and control of its position were lost.
BVPS-2 entered 2R23 at 0001 on April 9, 2023. The door remained open throughout the refueling outage, and at 2137 on May 14, 2023, Mode 4 was entered with the door open. While in Mode 1 on June 11, 2023, door A-35-5A was discovered to be open without administrative control and was closed and latched.
There was no equipment inoperable at the start of the event that contributed to the event.
After LER 2023-003-00 was submitted, additional review determined that the previous declaration of inoperability was incorrect. This LER Revision, 2023-003-01, is being submitted to report that the correct dates of CCP System inoperability were from April 7, 2023 at 1800 (end of shift) to April 9, 2023 at 0502 (approximately 35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />) and from May 14, 2023 at 2137 to June 11, 2023 (approximately 27 days). Additionally, the planned corrective actions listed in the original LER have been completed.
CAUSE OF EVENT
The direct cause of the door being left open is station personnel did not adequately track ownership of the door over the multi-day evolution. This was due to personnel not following the procedure when they did not assume ownership over the position of the door and did not shut the door at the end of the work activity. Additionally, a specific procedure did not exist for opening and closing this door.
The root cause is the organization did not have a clear and concise process for controlling ownership and responsibility for missile shield doors should they need to be opened temporarily.
ANALYSIS OF EVENT
This event is reportable as a condition prohibited by TS per 10 CFR 50.73(a)(2)(i)(B), an unanalyzed condition per 10 CFR 50.73(a)(2)(ii)(B), a loss of safety function per 10 CFR 50.73(a)(2)(v)(B), and common cause inoperability of independent trains per 10 CFR 50.73(a)(2)(vii)(B).
The plant risk associated with the tornado missile exposure to Unit 2 for the BVPS-2 tornado missile barrier door being found open and unlatched is considered to be very low, and this event was of very low safety significance. This is based on the observation that the probability of tornado-generated missiles hitting the maximum (bounding) unprotected target area is significantly smaller than the baseline Core Damage Frequencies of the effective BVPS PRA models.
CORRECTIVE ACTIONS
Door A-35-5A was closed and latched on June 11, 2023.
- 2. DOCKET NUMBER
- 3. LER NUMBER I
00412 c:i NUMBER NO.
I YEAR SEQUENTIAL REV
~-I 003 1-0 A check that door A-35-5A is closed was added to the daily operator tour logs on June 14, 2023.
Procedures for opening/closing A-35-5A and another similar missile shield door F-66-3 have been created.
Additional door controls for A-35-5A and F-66-3 have been added to 1/2-ADM-2021, including a dedicated closure team requirement until doors are restored to closed and latched.
PREVIOUS SIMILAR EVENTS
LER 2014-005-00, "Containment Equipment Hatch Missile Shield Removal Inadvertently Results in Exceeding Technical Specification 3.6.1 Required Completion Times." The apparent cause was plant personnel did not fully understand the relationship of TS operability and compliance with the design basis requirements. A contributing cause of this event was a weakness in the review process for removing or altering missile barriers. Corrective actions included requiring an engineering evaluation prior to missile barrier removal, and training Operations and Engineering personnel on the relationship between the missile protection function and its impact to TS operability. These corrective actions would not have precluded this event because door A-35-5A is evaluated for being opened under administrative control.
LER 2017-001-00, "Inadequate Tornado Missile Protection Identified Due to Non-Conforming Design Conditions." Two missile shield doors, including A-35-5A, were found to be open during walk downs conducted to support the evaluation of tornado missile vulnerabilities. The cause was the importance of the function of tornado missile barriers was not identified in plant processes such that site personnel could implement the requirements for missile barrier protection. A Standing Order was issued to Operations to maintain the correct door configuration which was incorporated into a revision to 1 /2-ADM-2021 in 2019. This corrective action did not prevent recurrence because during this event the procedure was not adequately followed. Additionally, the Severe Weather abnormal operating procedure (AOP) was revised to verify these doors are closed. As there were no tornado watches issued during the period when the door was open, there was no action to verify that door A-35-5A was closed.
LER 2020-001-00, "Intake Structure Interconnecting Flood Door Found Open Resulting in a Loss of Train Separation for the Reactor Plant River Water System." The apparent cause was an organizational latent acceptance of weak configuration controls applied to a risk significant flooding boundary door. The condition report investigation identified inadequate controls including physical, administrative, and knowledge type controls. Corrective actions were specific to Intake Structure flood doors and would not have prevented this missile shield door event in the PAB. Page 4
of 4