05000298/LER-2001-006
| Cooper Nuclear Station | |
| Event date: | 11-02-2001 |
|---|---|
| Report date: | 12-28-2001 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident |
| 2982001006R00 - NRC Website | |
PLANT STATUS:
On November 2, 2001, the plant was operating in Mode 1 (Power Operation), at 94 percent power, during end-of-cycle coast down. Preparation for commencing plant shutdown for refueling outage 20 (RE-20) was scheduled for 0900 on this day. There were no inoperable structures, systems, or components at the start of the event that contributed to this event.
BACKGROUND:
The reactor building-to-suppression chamber vacuum breakers (EIIS: VACB) perform a dual-function, serving both a primary containment (EIIS: NH) isolation function when normally closed, as well as a primary containment vacuum relief function to open. These functions are required to be operable only when the plant is operating in Mode 1 (Power Operation), 2 (Start-up), or 3 (Hot Shutdown). The vacuum relief function is designed to actuate at 0.5 psi differential pressure between the reactor building and the suppression chamber to preclude exceeding the primary containment maximum external design differential pressure of 2 psid. The design of the reactor building-to-suppression chamber vacuum relief system consists of four vacuum breakers (two parallel sets of 100 percent capacity vacuum breaker pairs, each set consisting of a self actuating vacuum breaker and an air-operated vacuum breaker), located in two lines. The air-operated vacuum breakers are actuated by differential pressure switches and can be remotely operated from the control room. The self actuating vacuum breakers function similarly to check valves. Both these vacuum breaker lines share a single primary containment penetration. Control Room switches (Close, Auto, Open) for each air operated valve function in Auto to fulfill both safety functions.
With the control room switches for these vacuum breakers in the Close position, the vacuum breakers will not open.
EVENT DESCRIPTION:
During 2000 and early 2001, Cooper Nuclear Station (CNS) was preparing to implement a new, computer- based work management program. The conversion process resulted in categorizing the required plant conditions for the reactor building-to-suppression chamber vacuum breaker local leak rate test (LLRT) as Mode 5 (Refueling). Furthermore, when the LLRT work order was created, it showed the testing required for the primary containment penetration associated with both reactor building-to-suppression chamber vacuum breaker lines as a single test item, rather than making each line a single test. Then, when the clearance tagout was generated to support the work order, it set the conditions to allow for testing both vacuum breaker lines. This would have been acceptable for testing during Mode 4 (cold shutdown) or Mode 5 plant conditions. However, the clearance order did not specify required plant conditions, specific safety function(s) impacted, or specific Technical Specifications potentially impacted.
Separately, the refueling outage work schedule for RE-20 was being developed in a different computer- based scheduling system. The outage schedule independently scheduled performance of a clearance and LLRT surveillance for the reactor building-to-suppression chamber vacuum breakers, one line at a time. Each of these scheduled activities referenced the same work order. This was the work order previously prepared to remove both lines from service in Mode 5. (Testing one line at a time would have allowed sufficient vacuum relief function to remain operable to permit testing while the unit remained on line, per Technical Specification.) This was a scheduling error.
The process for generating the RE-20 outage schedule did not require detailed evaluation of the work instructions that were associated with implementation of a scheduled task. As such, the schedule that the Control Room Work Control Center (WCC) Senior Reactor Operator (SRO) was tasked to execute, specified performance of a clearance per the work order that would render both reactor building-to- suppression chamber vacuum breaker lines incapable of performing their intended function. This improper scheduling of the work for Mode 1 is identified as the first root cause of the event.
On November 1, 2001, at 2300 hours0.0266 days <br />0.639 hours <br />0.0038 weeks <br />8.7515e-4 months <br />, the WCC-SRO had completed review of the work order, clearance, and associated LLRT surveillance test procedure without recognizing the impact of placing both control switches in "Close" on operability of the air-operated vacuum breakers. (Note: The associated Technical Specifications allow this condition for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.) At this time no consideration was given to potential impact on the reactor building-to-suppression chamber vacuum breaker function or its associated Technical Specification. At 2357 hours0.0273 days <br />0.655 hours <br />0.0039 weeks <br />8.968385e-4 months <br /> the clearance was authorized. This was the personnel error identified as the second root cause.
On November 2, 2001, at approximately 0020, the control switches for the air-operated vacuum breakers were both taken from "Auto" to "Close" thereby precluding the ability to relieve vacuum in the suppression chamber, thus rendering both reactor building-to-suppression chamber vacuum relief lines inoperable for opening.
After releasing performance of the LLRT, questions were raised regarding the extent of the clearance order, i.e., it appeared to have more valves tagged than was required for the single LLRT being performed. A further review of the clearance tagout was commenced. An off-shift SRO overheard the discussions, and realizing that both reactor building-to-suppression chamber vacuum breaker lines may be impacted, notified the Control Room. The Control Room confirmed the "Close" status of both reactor building-to-suppression chamber vacuum breaker lines. At 0342 the control room operator placed the control switches for both reactor building-to-suppression chamber vacuum breakers back to "Auto" restoring the vacuum relief function. The total time that the vacuum relief function was unavailable for automatic operation was estimated to be 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, 22 minutes.
BASIS OF REPORT:
By placing the control switch for the valves in both vacuum relief lines in the "Close" position, the valves would not have automatically responded to a condition of a significant external differential pressure across the primary containment and the reactor building. Excessive primary containment external differential pressure could impact the design function of the primary containment to mitigate the consequences of an accident.
As such, the loss of both reactor building-to-suppression chamber vacuum breakers is reportable as an "event or condition that could have prevented fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident" under 10CFR50.73(a)(2)(v)(D).
CAUSE:
The root cause of this event was determined to be twofold; either cause, had it not occurred, would have prevented this impairment. First, the process for scheduling LLRTs did not ensure that the requisite work order, clearance order, and surveillance procedure were appropriate for use in Mode 1.
Secondly, the individual authorizing the clearance order did not recognize the impact of the clearance on the reactor building-to-suppression chamber vacuum breaker function or associated Technical Specification.
SAFETY SIGNIFICANCE:
The condition where both reactor building-to-suppression chamber vacuum breakers were inoperable was reviewed for risk significance and found to have a negligible impact on plant safety.
Two phenomena can cause a reduction of pressure in the drywell following an accident or transient. The first is by the condensation of steam under post-loss of coolant accident (LOCA) conditions. The second is by the cooling of the nitrogen atmosphere in the drywell; this phenomenon is applicable under all conditions.
When there is a LOCA, the pressure in the drywell increases quickly enough that the operators will not be able to control drywell pressure via the normal pressure control system. This means that the mass of nitrogen present in the drywell at the beginning of the accident is fixed by the Technical Specification limits of pressure and temperature during operation. Shortly into the LOCA, the Emergency Operating Procedures will direct drywell spray and the plant conditions will already be within the Drywell Spray Initiation Limit (DWSIL). Even if all of the steam is condensed, the initial mass of nitrogen will limit the pressure drop, which has been shown by calculation to be within the capability of the drywell structure. If containment sprays initially fail, the containment may be vented via the hard pipe vent. If sprays were then recovered, the hard pipe vent path would provide the makeup to the containment atmosphere to preserve the drywell structure.
For non-LOCA events with no drywell cooling, the pressure and temperature increase in the drywell is very slow. It takes greater than 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> for the drywell parameters to reach a point where drywell sprays are required (ID, > 280 degrees Fahrenheit). In these cases, the DWSIL is set to prevent the rapid pressure reduction in the drywell due to evaporative cooling in the initial few seconds of the spray. The limit is defined so that the rapid depressurization will terminate above 2 psig. The subsequent pressure reduction will be controlled via the convective cooling of the nitrogen by the spray droplets. This slow pressure reduction is controllable by either operator actions or the 2 psig drywell spray interlock. Whichever is in control, the spray will be terminated well before the drywell external differential pressure reaches its structural limit.
Additionally, for the non-LOCA case, if either the drywell coolers become available or the operators start a 100 degrees Fahrenheit per hour cooldown within the first 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> of the transient, drywell temperature will not reach 280 degrees Fahrenheit and there will be no demand for drywell sprays.
CORRECTIVE ACTIONS:
The immediate corrective action to correct the condition was to return the reactor building-to-suppression chamber vacuum breaker control switches to "Auto.
Completed Interim Actions In addition to the immediate action taken to correct the condition, the following interim actions were taken:
1. Clearance orders for Modes 1, 2, and 3 were validated.
2. Active outage tagouts were reviewed and validated against the schedule and plant configuration.
3. Scheduled outage clearance orders were validated against the plant conditions for which they were scheduled to ensure compliance with Technical Specifications.
4. A single point of contact was established for authorizing clearance orders.
5. The Off-Watch SRO in the work control center was tasked to provide oversight of, and focus on, the adequacy of briefs.
6. Expectations of the operating procedure governing clearance orders were reinforced by management.
7. Plant conditions were verified to be specified in the current outage clearance orders.
8. LLRTs not required during Modes 1, 2 and 3 were eliminated from the on-line schedule and scheduled for cold shutdown.
9. Both operators involved in the tagging incident were removed from the watch until an investigation was conducted and appropriate remedial action was taken.
Planned corrective actions to prevent recurrence of the root cause include:
1. Modify the outage and on-line scheduling process to explicitly require the developers and authorizers of the surveillance schedule to confirm that the activities can be performed in the Mode in which they are planned to be implemented. (To be completed: 3/15/02) 2. Revise the LLRT procedure for the reactor building-to-suppression chamber vacuum breakers to meet expected content requirements for surveillance procedures. Specifically, add Technical Specification impact considerations, required plant conditions, and any operability considerations.
(To be completed: 3/15/02) 3. Revise the tagging procedure to require the verifier of the clearance order to review and document the Technical Specification impact, limiting condition for operation number(s), plant conditions and Mode required to support implementation. (To be completed: 3/15/02) 4. Revise applicable procedures to clarify roles and responsibilities to maintain separation of the tag desk operator from the senior reactor operator oversight function. (To be completed: 3/15/02)
PREVIOUS EVENTS
A review of similar events during the past three-years has identified one LER that is related to the same root causes identified for this LER. LER 2000-009 identified a condition where all drywell leakage monitoring systems were inoperable for 69 minutes. This occurred when a scheduled routine loop channel calibration was initiated. Prior to this, the drywell atmospheric monitoring system, RMV-RR-2 (EIIS Code:
FQT), was inoperable due to sample pump failure. With both instrumentation systems inoperable, Technical Specification LCO 3.4.5 required an immediate entry into LCO 3.0.3. The cause was determined to be procedural inadequacy. Operations management provided procedural clarification to all Control Room personnel. Station documents were revised to detail the requirement to complete an independent verification of LCO entries prior to beginning work.