05000397/LER-2003-001
| Docket Number | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| 3972003001R00 - NRC Website | |
DESCRIPTION OF EVENT
On October 24, 2002, with the plant in Mode 1 at full power, it was discovered that, due to discharge piping back-leakage (suspect valve RHR-V-31B, Model 2625-3, manufactured by Anchor Darling Valve Company), the Residual Heat Removal (RHR)-B train would be vulnerable in the event of a control room fire based on Appendix R calculations and abnormal response procedures ABN-CR- EVAC and ABN-FIRE. Compensatory measures were promptly put in place making the system operable but degraded. The Appendix R calculation and the abnormal response procedures require RHR-B discharge piping to remain full of water for at least one hour; however, the current system leak rate is such that the system will begin to void in less than one hour if the keep-fill pump (RHR-P-3) is lost. The RHR-P-3 is not fire protected. The loss of RHR-P-3 with subsequent system voiding could result in water hammer and a possible system failure if the RHR-B system pump was started. The potential water hammer might jeopardize the integrity of the reactor coolant pressure boundary or primary containment isolation barriers associated with the RHR system. In addition, water hammer could result in the potential loss of safe shutdown equipment from indirect impacts such as pipe whip, jet impingement and flooding. The RHR-A train is not fire protected for the given scenario.
On April 3, 2003, it was discovered that data existed indicating that back-leakage of the RHR-B train exceeded limits of Appendix R calculations since as early as 1997. An unanalyzed condition may have existed from that time until October 24, 2002.
Procedures ABN-CR-EVAC and ABN-FIRE require control room operators to check RHR-P-3 within one hour of a fire event to ensure that it is running to prevent water hammer to the RHR system. The one-hour time is based on the assumption that the system will remain full of water for greater than one hour even if the keep-fill pump is lost. Data collected for the RHR-B system in 1997 and from 2000 to 2003 indicates that the depressurization time has decreased to less than one hour and, therefore, the RHR-B train was vulnerable to a water hammer in the event of a control room fire. With multiple RHR trains vulnerable to the same fire, this condition is reportable in accordance with 10 CFR 50.73(a)(2)(ii)(B), "Any event or condition that resulted in...the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety.
The timeline of relevant developments is:
06/14/93 - A Problem Evaluation Request (PER) was initiated to document the concern that RHR-P-3 may require fire protection under the revised Appendix R analysis.
02/10/94 - A system leak test procedure was developed and approved.
06/16/94 - The RHR-B system held adequate pressure for one hour in accordance with the leak test procedure.
01/29/96 - The system leak test procedure was deactivated. The justification was that the procedure was a one-time test and no licensing basis documents were impacted.
04/26/97 - RHR-B pressure decay data was taken during refueling outage R-9. The RHR-B and RHR- C trains had been taken out of service and were depressurized for maintenance. The pressure decay plot was from approximately 109 psig down to approximately 60 psig; NRC � 366A � U.S. NUCLEAR REGULATORY COMMISSION (1-2001) FACILITY NAME (1) Columbia Generating Station DOCKET (2) LER NUMBER (6) however, it is not known if a vent, drain, or other valve was opened to depressurize RHR- B. The plotted depressurization was very rapid.
11/22/00 through 12/28/00 - During this period, four pressure decay rates were collected over a small pressure range as part of system monitoring and trending.
10/24/02 - System monitoring and trending data was extrapolated and indication of a pressure decay rate of less than one hour was recognized. A follow-up assessment of operability was written and compensatory measures were established and the system was returned to an operable status.
04/03/03 - A PER was initiated because the RHR pressure decay rate might have been greater than Appendix R assumptions for several years.
A review of system data collected in 1997 for other purposes suggests that the one-hour requirement may not have been met at that time. Extrapolation of short periods of decay time data taken in November and December 2000 also indicates that the system would not have held water for the required one hour. Therefore, the plant was in an unanalyzed condition from at least December 2000 to October 2002, when compensatory actions were initiated. Although conclusive test data was not available, RHR-B may also have had a pressure decay rate of less than one hour since 1997.
ASSESSMENT OF SAFETY CONSEQUENCES
Based on plant specific historical data, Columbia Generating Station has not experienced a fire that adversely affected the ability to shut down the plant, and no fire event has occurred in the Columbia Generating Station control room. Consequently, the conditions described in this report had an insignificant impact on safe operation of the plant or on the health and safety of plant personnel or the general public. However, if a fire had occurred during the time the RHR system was vulnerable, the fire detection, suppression and barrier systems were either operable or the required compensatory measures were in place. The fire detection and suppression equipment would ensure the ability to promptly identify, confine, and extinguish fires, and the fire barriers and barrier penetrations would minimize the possibility of a fire-related challenge to safe shutdown systems.
For the scenario of a control room fire rendering the RHR-A train, RHR-C train and the RHR-P-3 inoperable, and resulting in a control room evacuation and subsequent water hammer damage to the RHR-B train, the core damage frequency was estimated to be 8.28E-7 per year. Since there are alarms in the control room for RHR system pressures, control room evacuation is the only scenario where the pressure drop could result in water hammer and subsequent damage to the RHR-B train.
IMMEDIATE CORRECTIVE ACTIONS
Corrective actions had been implemented prior to discovery of this condition. Since the ability of 121-1R-B to meet the post-fire safe shutdown analysis was in question in 2002, an action was taken on October 24, 2002 to put compensatory measures in place. Barrier impairment documentation and fire tours were established.
A root cause analysis was initiated to determine the cause of the failure.
The cause of this event is the failure to ensure, programmatically, that Appendix R design basis analysis requirements are adequately tested and validated on a periodic basis. This weakness led to multiple cases of individuals not being familiar with Appendix R design basis assumptions. This, in turn, resulted in knowledge-based errors regarding the significance of periodically validating/testing Appendix R design basis assumptions.
Contributing causes include inadequate communication between organizations and inadequate program- to-program interface. When the requirement to develop a test was identified in 1994, the need to make the test a periodic action was not clearly communicated. The responsibilities and formal process for periodically validating/testing design assumptions are not clearly delineated for changes to calculations, analyses and procedures, which are not associated with a plant modification.
ACTIONS TO PREVENT RECURRENCE
The failure to verify/test the RHR-B Appendix R assumption was due to the Appendix R requirement not being clear to the individuals responsible for maintaining the system. Except for the Appendix R analysis and procedures ABN-FIRE and ABN-CR-EVAC, there is currently no other guidance regarding the purpose of maintaining pressure in the RHR-B system for an houi, and no requirements for periodic pressure retention tests. Appendix R analysis requirements are not readily accessible and the procedural actions are often not recognized as requiring periodic verification. To ensure this event does not recur, the following actions will be taken:
1. Develop a periodic test and an associated periodic maintenance task to verify the ability of RHR-B to maintain pressure in the pump discharge piping per the Appendix R analysis requirements.
2. Review the abnormal procedures for time dependent operator responses to determine the need for additional periodic verifications/tests.
3. Place the Appendix R analysis requirements/assumptions that require periodic verification into plant documents as appropriate.
4. Establish a procedure/process for ensuring, when formal analyses are developed, the assumptions are reviewed to determine if there are design analysis assumptions that must be validated.
5. Review, using a risk-weighted approach, other similar design basis special event analyses (such as Station Blackout (SBO), Anticipated Transient without Scram (ATWS), and Pipe Breaks/Cracks) to verify that testing procedures have been prepared as required to assure design requirements/ assumptions are met.
FACILITY NAME (1) Columbia Generating Station DOCKET (2) LER NUMBER (6) RC FORM 366A � U.S. NUCLEAR REGULATORY COMMISSION (1-2001)
PREVIOUS SIMILAR EVENTS
An Energy Northwest database search revealed 17 PERs that dealt with missed surveillances or missed actions and five Licensee Event Reports (LERs) related to Appendix R issues. Most of the issues were emergency lighting issues and operator action timing concerns. These 17 PERs support the conclusion that the Appendix R analytical requirements were not well maintained during implementation. Most of the corrective actions addressed the deficiency itself and only a few cases looked at the cause. The PERs that addressed causal factors were documented in LERs and those similar to this issue are discussed below:
lighting capacity specified by 10CFR50, Appendix R. Plant Operator actions are required to reposition these components in the event of a fire. In addition, it was determined that not all operator actions required for fires outside of the main control room had been incorporated into procedures. The root cause for this event was less than adequate design in that emergency lighting was not provided where required, and less than adequate communication in that all procedures were not revised following direction from Engineering. Corrective actions consisted of staging portable lighting within the plant as required for use in the event of a fire and performing an additional review of procedures to ensure that operator actions pertaining to Appendix R Shutdown Evaluation have been addressed.
Cooling Mode prescribed operator actions at Reactor Pressure Vessel (RPV) levels that were outside the range of the required instruments. Additionally, comparison of the Appendix R Shutdown Analysis and Abnormal Operating Procedures identified three other items involving procedural implementation and Shutdown Analysis requirements that could have affected operator response following a fire. The root cause for these conditions was insufficient interdepartmental communication. A contributing cause was inadequately defined policy regarding responsibility for ensuring actions were reflected in procedures. Corrective actions for this event included an evaluation of the interface between design engineering and plant engineering and inter-organizational communications and responsibilities within the Appendix R implementation process.
The LERs noted above address concerns with implementation of Appendix R actions, but do not identify the problem of verification of assumptions. The corrective actions specified would not necessarily drive Columbia Generating Station to identify the need to validate Appendix R related assumptions on the RHR-B leak rate capability. Some programmatic problems with inter-organizational communication and identification of responsibilities were identified as problems and are still contributing causes as identified in this LER. The corrective actions to evaluate Appendix R analysis assumptions and capture them in Energy Northwest documents address this concern.
26158 R1