ML18012A855

LER 96-013-02:on 961028,condition Outside of Design Basis Where RWST Had Been Aligned w/non-seismically Qualified Sys Was Identified.Caused by Failure to Reconcile Operating Procedure Lineups.Established Administrative Controls

ML18012A855
Person / Time
Site:	Harris
Issue date:	08/08/1997
From:	Verrilli M CAROLINA POWER & LIGHT CO.
To:
Shared Package
ML18012A854	List: ML18012A853 ML18012A855
References
LER-96-013, LER-96-13, NUDOCS 9708200007
Download: ML18012A855 (4)

Text

NRC FORM 366 FFBSI U.S.NUCLEAR REGULATORY COMMISSION LICENSEE EVENT REPORT (LER)(See reverse for required number of digits/characters for each block)APPROVED BY OMB No.3150-0104 EXPIRES 04/30/99 ESTIMATED BURDEN PER RESPONSE TO COMPLY WITH THI MANDATORY INfORMATION COllECTION REDUEST: 500 HRS.REPORTED lESSONS LEARNED ARE INCORPORATED INTO THE UCENSING PROCESS ANO FEO BACK TO INDUSTRY.FORWARD COMMENTS REGARDING BURDEN ESTIMATE TO THE BIFORMATION ANO RECORDS MANAGEMENT BRANCH IT@F331 US.NUCLEAR REGULATORY COMMLSSION, WASHINGTON, DC 20555OODI, AND TO THE PAPERWORK REDUCTION PRMECT (3150.0104L OfFICE OF MANAGEMENT ANO BUDGET, WASHUIGTON, OC 205IXL FACIUTY NAME Itl Harris Nuclear Plant Unit-1 OOCKET NUMBER I2I 50-400 PAGE I3I 1 OF4 TITLE (4)Condition outside of design basis where the RWST had been aligned with a non-seismically qualified system.EVENT DATE{5)LER NUMBER (6)REPORT DATE{7)OTHER FACILITIES INVOLVED (6)MONTH OAY 10 28 SEOUENTIAl REVISION NUMBER NUMBER 96 96-013-02 MONTH OAY 8 8 YEAR 97 FACIUTY NAME FACIUTY NAME DOCKET NUMBER 05000 DOCKET NUMBER 05000 OPERATING MODE{9)POWER LEVEL{10)100%r moro){11)THIS REPORT IS SUBMITTED PUR 20.2201(b) 20.2203(a)(1) 20.2203(a)

(2)(i)20.2203(a)

(2)(ii)20.2203(a)

{2)(iii)SUANT To THE REQUIREMENTS OF 10 CFR B: (Check ono o 50.73(a)(2)(i) 50.73(a)(2)(ii)20.2203(a)(2)(v) 20.2203(a)

(3)(i)20.2203(a)(3)(ii)20.2203(a)(4) 50.36(c){1)50.73(a)(2)(iii) 50,73(a)(2)(iv) 50.73(a)(2)(v) 50.73(a)(2)(viii) 50.73(a)(2)(x) 73.71 OTHER Specify In Abstract below or in NRC Form 366A 20.2203(a)

{2)(iv)50.36(c)(2)

LICENSEE CONTACT FOR THIS LER (12)50.73(a)(2)(vii)

NAME TELEPHONE NUMBER Unclude Area Code)'ichael Verrilli Senior Analyst-Licensing (919)362-2303 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT (13)CAUSE SYSTEM COMPONENT MANUFACTURER REPORTABlE TO NPROS CAUSE SYSTEM COMPONENT MANUFACTURER REPORTABLE TO NPROS SUPPLEMENTAL REPORT EXPECTED{14)YES{If yos, compieto EXPECTED SUBMISSION DATE).X NO EXPECTED SUBMISSION DATE (15)MONTH OAY YEAR ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single-spaced typewritten Lines)(16)On August 1, 1996 with the plant operating in Mode-1 at 100%power, Operations personnel identified a condition outside the plant design basis where the Refueling Water Storage Tank (R ST)had been connected to a non-seismically qualified system.Specifically, non-seismic portions of the fuel pool purification system have been aligned to the R ST for cleanup and non-seismic portions of the hydrostatic test pump have been aligned'to the RWST to fill the Safety Injection accumulators.

If a seismic event were to occur, the non-seismic portions of these systems could fail and drain the RWST.This condition was caused by a failure to reconcile operating procedure lineups with the plant design basis during original procedure development.

Subsequent technical and safety reviews also failed to identify the conditions as outside the plant design basis.Immediate corrective actions included establishing administrative controls to maintain the seismic boundary isolation valves closed.Additional corrective actions included a review of other seismic/non-seismic interface boundary valves for similar problems and an evaluation of long term design and/or operational options.During further investigations of safety to non-safety related (including seismic/non-seismic) interface boundaries, additional examples were identified that could result in operation of plant systems outside the design basis.These conditions were identified during the continued investigation as committed in the original LER.Specific details were provided in revision 1 of this LER.This revision provides the results of additional analysis that was performed to determine the safety consequences associated with the loss of the Component Cooling ater system.9708200007 i)70807 PDR ADQCK 05000400 8 PDR NRC FORM 366A (4.95)LICENSEE EVENT REPORT (LERj TEXT CONTINUATION el U.S.NUCLDIR REGULATORT COMMISSION FACILITT NAME (I)Shearon Harris Nuclear Plant~Unit//1 DOCKET 50400 LER NUMBER (6)TEAR SEOUEN'r(AL BET(SION NUMBER NUMBER 96-013-02 PAGE (3)2 OF 4 TEXT rH mosr sproris rrslrirsL osr rdditirorl oopd)S ot HRC Psmo 36QI (IT)EVENT DESCRIPTION:

On August 1, 1996 with the plant operating in Mode-1 at 100%power, Operations personnel identified a condition outside the plant design basis where the Refueling Water Storage Tank (RWST)(EIIS Code: BQ-TK)had been connected to a non-seismically qualified system.Specifically, non-seismic portions of the fuel pool purification system (EIIS Code-DA)have been aligned to the RWST for cleanup and non-seismic portions of the hydrostatic test pump (EIIS Code-BP)have been aligned to the RWST to fill the Safety Injection (Sl)accumulators.

If a seismic event were to occur, the non-seismic portions of these systems could fail and drain the RWST.This condition was identified by the Superintendent

-Shift Operations while reviewing a recent similar event at Salem.Fuel Pool Purification Connection The original plant design of the fuel pool purification syste9t was non-safety, non-seismic and separated from the RWST by a normally closed safety related boundary valve.The boundary valve (1CT-23)is manually operated and does not receive an automatic isolation signal.The design basis documents describing the RWST (DBD-106)and the fuel pool purification system (DBD-110)do not describe RWST cleanup during operation.

FSAR Section 9.1.3.2 states that the fuel pool purification pumps can take suction from and return fluid to the RWST;however, no operational limitations are discussed.

Based on the above, extended use of the fuel pool purification system aligned to the RWST during normal operation was not analyzed.The original issue of operating procedure OP-116"Fuel Pool Cooling and Cleanup," (9/4/84)provided for RWST purification using the fuel pool purification system.Procedure reviews and safety reviews were performed, however, they did not identify that this mode of operation would place the system outside its design basis.FSAR Figures 6.2.2-1 and 9.1.3-1 show the seismic/non-seismic boundary.Operations, ALARA and Chemistry reviews were completed but did not question the non-seismic interfaces.

H drostatic Test Pum Connection The original design of the hydrostatic test pump was non-safety, non-seismic and separated from the RWST by a normally closed safety related boundary valve.This boundary valve (1CT-22)is manually operated and does not receive an automatic isolation signal.The hydrostatic test pump design basis document includes a statement that the hydrostatic test pump is isolated from the process piping during normal operation.

The original issue of operating procedure OP-110"Safety Injection," (9/27/84)did not include valve 1CT-22, however, it did include procedural guidance for filling the SI accumulators with the hydrostatic test pump.Revision 1 (12/24/85) to OP-110 added valve 1CT-22 and directs the operator to unlock and open the valve.Operations and Chemistry reviews were completed for both revisions.

The safety evaluation performed in accordance with 10CFR50.59 for Revision 1 states that a common mode failure is not introduced by the performance of this procedure.

FSAR Figures 6.2.2-1 and 6.3.2-3 showed the seismic/non-seismic boundary.OP-110 references a Westinghouse Safety Injection System Description which states that the hydrostatic test pump serves no safety related function but permanent connections are provided for using the hydrostatic test pump in supplying borated water for filling and level adjustment of the accumulators.

In addition to OP-110, the hydrostatic test pump connection to the RWST is also used during performance of OST-1506,"Reactor Coolant System Isolation Valve Leak Test-18 Month Interval-Mode 3." OST-1506 is performed to satisfy Technical Specification surveillance requirements 4.0.5 and 4.4.6.2.2.

The procedure reviews and safety reviews for OST-1506 also failed to identify that this mode of operation would place the system outside its design basis.Further investigations of safety to non-safety related (including seismic/non-seismic) interface boundaries were conducted as committed in Revision 0 of this LER.These investigations found the following additional examples which could result in operation of plant systems outside their design basis.In these cases, where manual operator action could mitigate the consequences of a seismic event, appropriate 10CFR50.59 safety evaluations were not performed to consider these mitigating actions.

NRC FORM 366A (4 96)LICENSEE EVENT REPORT (LER)TEXT CONTINUATION U.S.NUCLEAR REGULATORY COMMISSION FACILITT NAME (I)Shearon Harris Nuclear Plant~Unit//1 TEXT i)r mvss spssv N sspvia(sss sdktsmsl svpms vl INC pvfm 3%4I (I 1)DOCKET 50400 LLR NUMBER (6)SEOUENTIAL NUMBER NUMBER 96-013-02 PAGE r3)3 OF 4 EVENT DESCRIPTION: (continued)

(1)The safety related Component Cooling Water system and Essential Services Chilled Water system are connected to non-safety chemical addition tanks.During chemical addition operations, the CCW and ESCW systems were considered operable.This operability determination was based on a 1994 non-conservative licensing interpretation which concluded that interconnection of the CCW and ESCW systems with the chemical addition tanks would not render the systems inoperable given that the evolution was planned and that there was continuous operator attendance to isolate the non-safety chemical addition tank if needed.In this condition, if a seismic event occurred which prevented the operator from closing the isolation valve, a failure in the chemical addition piping could possibly cause a loss of water inventory resulting in both CCW or one of the ESCW trains becoming inoperable.

(2)The CCW system surge tank is filled via the non-safety, non-seismic Demineralized Water system.The demineralized water make-up line is normally isolated by a seismically qualified, fail closed, air-operated valve (1DW-15)which is remotely operated from the main control room.This valve does not receive an automatic isolation signal.In the event of a loss of off-site power during a CCW system make-up operation, assuming the single failure of 1DW-15 to shut, CCW inventory would be lost through the depressurized demineralized water system.(3)The Boric Acid Tank (BAT)can be aligned to the RWST and Recycle Holdup Tank (RHT)via non-seismic piping to allow addition of borated water to the RWST.If a seismic event should occur during this alignment, causing a failure of the non-seismic piping, the contents of the BAT could be lost, thus rendering this boron injection source inoperable.

In this alignment, the function of the RWST and RHT are not affected since the non-seismic piping penetrates the tanks above the minimum Technical Specification limit (RWST)or normal operating water level (RHT).CAUSE: These conditions were caused by the failure to reconcile operating procedure lineups with the plant design basis during original procedure development.

Subsequent technical and safety reviews also failed to identify the conditions as operation outside the plant design basis.The 1994 licensing interpretation used as the operability basis for the CCW and ESCW systems during chemical addition was a non-conservative decision which did not fully consider design basis accident conditions.

SAFETY SIGNIFICANCE:

The RWST is a safety related water source used by multiple safety systems following a design basis accident including charging/safety injection, residual heat removal, and containment spray.The conditional core damage probability (CCDP), given a seismic event of magnitude greater than the operating basis earthquake, was determined to be 7.32E-2, assuming that a reactor trip occurs and that all non-seismically qualified components and systems are unavailable after the event.If the RWST is also assumed to be unavailable after the seismic event, then the CCDP increases to 7.64E-2, a 4.4%increase.The RWST is not typically assumed to be required to mitigate a seismic event, and the small increase in CCDP is due to scenarios involving random failures of secondary side heat removal systems, which result in a demand for bleed-and-feed cooling using the RWST.Simultaneous design basis accidents and earthquakes are highly unlikely and, in accordance with standard industry PSA practices, not evaluated.

The safety consequences related to the additional conditions reported in this LER revision were also evaluated using PSA techniques and are described as follows: The safety function of the BAT is to provide one of the three boron injection flow paths to ensure that required shutdown margin is maintained during plant operation.

If a seismic event had occurred while both the RWST and BAT were simutaneously connected to non-seismic piping, which is conservatively assumed to fail, each of the three boron injection flow paths required by Technical Specification 3.1.2.2 would be unavailable.

However, simultaneous design basis accidents and earthquakes are highly unlikely and, in accordance with standard industry PSA practices, are not evaluated.

The unavailability of the BAT has no impact on the mitigation of a seismic event, thus the PSA techniques shows no additional increase in risk.The conclusions of the original analysis, which indicated a 4.4%CCDP increase would remain valid.O A(~)

NRC FORM 366A (4-SS)LICENSEE EVENT REPORT (LER)TEXT CONTINUATION U.S.NUCLEAR REGULATORT COMMISSION FACIUTT NAME (1)Shearon Harris Nuclear Plant~Unit//1 DOCKET 50100 ua NUMRER 16)SEOUENTIAL REVISION NUMBER NUMRER 96-013-02 PAGE (3)4 OF 4 TEXT r)ram spmoi r))rr'rmE acr orAfrirmr cupif of)YRC Form ZSS()(13)SAFETY SIGNIFICANCE: (continued)

For the case involving the potential loss of the CCW system due to the failure of non-seismic chemical addition or surge tank demineralized water piping, the contribution to overall core damage frequency is limited by the small fraction of time the CCW system is in the chemical addition or surge tank makeup configuration and the low probability of a seismic event greater than the operating basis earthquake.

This contribution to overall core damage frequency was estimated to be 2.5E-8 per year.This contribution is a small fraction of the baseline annual core damage frequency of 5.95E-5 and is therefore considered to be not risk-significant.

For the potential failure of the non-seismic ESCW chemical addition piping, normal ESCW operation maintains separation between the redundant trains.Should a failure occur, the consequences would be minimal since only one train would be affected.The redundant train of ESCW would remain available to supply cooling water to the safety related air handling units.These conditions are reportable per 10CFR50.73(a)(2)(ii).

PREVIOUS SIMILAR EVENTS: Similar plant events where non-seismic piping has been temporarily connected to safety related systems duiing plant operation have included: (1)Post Accident Sampling system connection to the Emergency Service Water system (1989), (2)chemical addition tank connection to the Component Cooling Water system (1994), and (3)chemical addition tank connection to the Essential Services Chilled Water system (1994).Corrective actions for these similar events were narrowly focussed and did not identify the similar problems with RWST connections.

Similar industry events have been identified which involved non-seismic connections to the RWST.These included events at San Onofre (1989), Diablo Canyon (1990), and Salem (1996).The San Onofre event was documented in an NRC Daily Plant Status Report, however this event did not receive a Harris Plant review.No industry operating experience feedback notification of the Diablo Canyon event could be located.As a result, no Harris Plant review was conducted.

The recent similar event at Salem was reviewed by the Harris Plant Superintendent

-Shift Operations and resulted in this condition being identified at the Harris Plant.CORRECTIVE ACTIONS COMPLETED:

1.2.Established administrative controls to maintain the seismic boundary isolation valves closed.The"Reactor Coolant System Isolation Valve Leak Test-18 Month Interval-Mode 3" (OST-1506) was placed on administrative hold on October 29, 1996 to prevent connection of the hydrostatic test pump to the RWST.A review of other seismic/non-seismic interface boundary valves for similar problems was completed on October 31, 1996 and resulted in the first revision to this LER.The CCW System Operating Procedure (OP-145)was revised on November 14, 1996 to ensure that the CCW trains are separated prior to and during chemical addition and surge tank fill.The affected CCW train during these evolutions will be declared inoperable.

The Chemical and Volume Control System Operating Procedure (OP-107)was revised on November 15, 1996 to ensure that the BAT boron injection flow path is declared inoperable prior to and during alignment to the RWST and RHT via the non-seismic piping.The ESCW Operating Procedure (OP-148)was revised on November 15, 1996 to ensure that the affected ESCW train is declared inoperable prior to and during during chemical addition operations.

An evaluation was performed to determine long term design and/or operational options for the above affected systems.This evaluation was completed on December 26, 1996.A(4-)