05000289/LER-2006-001

LER-2006-001,

Docket Number
Event date:
Report date:
2892006001R00 - NRC Website

EVENT DESCRIPTION

Plant Conditions before the event:

Babcock & Wilcox — Pressurized Water Reactor — 2568 MWth Core Power Date/Time: April 23, 2006/approximately 1500 hours0.0174 days <br />0.417 hours <br />0.00248 weeks <br />5.7075e-4 months <br /> Power Level: 100% steady state power prior to and during the event Mode: Power Operations On April 23, 2006, while performing reviews of fire abnormal operating procedures to assure compliance with the Fire Hazards Analysis Report (FHAR), a control logic error was identified in the circuit elementary drawing for the isolation valves (DH-V-6A and DH-V-6B) *[BP/INV] between the Borated Water Storage Tank (BWST) and the Reactor Building (RB) sump. The valve control circuit was verified to be wired as per the elementary drawing.

The design was to prevent a hot short, due to a fire, from opening the valve, but the design change was made on the closing circuit. The identified control logic error could allow DH-V-6A or DH-V-6B to spuriously open due to a fire. The FHAR credits these valves as being protected from spuriously opening due to a fire in AB-FZ-5 (Auxiliary Building 281' general area). If this protection is not provided, then spurious opening could result in draining the BWST inventory to the RB sump. This hot short condition would result in the depletion of the BWST inventory and loss of the High Pressure Injection (HPI) makeup capability, resulting in an unanalyzed condition that significantly degrades plant safety.

The spurious opening of DH-V-6A or DH-V-6B is not prevented by design as described in the FHAR. The FHAR specifies that operator response to a spurious opening of DH-V-6A or —6B is to close the upstream isolation valve (DH-V-5A or —5B). Closing of DH-V-5A or -5B for a fire in AB-FZ-5 cannot be credited since DH-V-5A and DH-V­ 5B are located in this zone.

When the technical basis for the FHAR was completed in 1985, the need to protect DH-V-6A and DH-V-6B from spurious operation due to a hot short from a fire in AB-FZ-5 was identified. The safe fire shutdown analysis determined that such an event could not be tolerated. A hot short in the control circuit for DH-V-6A or DH-V-6B could cause the valve to open and thereby drain the BWST to the RB sump. Analysis was performed to demonstrate that closure of DH-V-5A or DH-V-5B (BWST to LPI suction isolation valve) within 45 minutes would preserve sufficient BWST inventory to achieve cold shutdown. This strategy is not reliable for a fire in AB-FZ-5 because the fire could prevent remote or local operation of DH-V-5A or DH-V-5B. In 1986, the remote shutdown modifications were installed. DH-V-6A and DH-V-6B control circuits were modified. The limit switch wiring at the Motor Control Center (MCC) was moved to the grounded side of the CLOSING relay coil. This change effectively prevented hot short spurious valve CLOSURE for a fire in AB-FZ-5. The OPENING circuit was not modified.

As a result of this design flaw, the following sequence of events could occur if licensing basis failure assumptions are considered. A fire in AB-FZ-5 could cause spurious opening of DH-V-6A or DH-V-6B and the operators would be unable to close the associated DH-V-5A (B) before the BWST was completely drained to the RB sump. The fire could also cause loss of Reactor Coolant Pump (RCP) thermal barrier cooling and loss of RCP seal injection.

As a result, the RCP seals would heat up to Reactor Coolant System (RCS) temperature and the seal leakage rate would increase to — 21 GPM / pump. The fire could also cause loss of both trains of the Decay Heat Removal System. This would prevent use of the Decay Heat (DH) pumps to provide suction to HPI (i.e.

piggyback). The overall effect of these failures would be a loss of all RCS makeup capability. This could eventually cause a loss of core cooling (via Once Through Steam Generator (OTSG) cooling) when RCS inventory was insufficient to support natural circulation. Other methods (beyond the BWST or RB sump via piggyback) to provide inventory for HPI are possible but have not been analyzed for the effects of fire, and, therefore, are not reliable without further analysis.

The Root Cause of the problem is identified as "accountability needs improvement" in that the reviewers did not validate the design requirements for DH-V-6A/B in the original 1985 Appendix R package. The fire hazards analysis team originally specified a generic fix to deal with the spurious operation of several valves, not yet including DH-V-6A/B. The solution to modify the closing control circuit, was correct for all these valves, since they needed protection from spurious closure. However, when DH-V-6A and DH-V-6B were added to the scope, the detailed design requirement was different than those other valves. DH-V-6A and DH-V-6B design requirement was to prevent spurious opening, and was not verified by the design team. The design engineer apparently assumed that the fix, prevention of spurious closure, was appropriate for DH-V-6A and DH-V-6B and apparently did not perform a self-check. Also, the fire hazards analysis team apparently did not review the Design Input Record.

ANALYSIS / SAFETY SIGNIFICANCE

The design flaw in DH-V-6A and DH-V-6B control circuit wiring has the potential to prevent achieving safe shutdown in the event of a fire in AB-FZ-5. The risk of such an event before the valve design is modified is very low.

All of the following events (each of which is unlikely) would have to occur concurrently to prevent achieving safe shutdown.

1. A serious fire occurs in AB-FZ-5. (Note that the probability of this event in this interim period has been reduced by the performance of a fire watch in this area until the valve modifications have been performed.) 2. The fire causes the following equipment failures:

• Loss of DH-P-1A

• Loss of DH-P-1B

• Loss of ICCW flow to RCP thermal barrier coolers

• Loss of RCP seal injection

• Spurious opening of DH-V-6A or DH-V-6B

• Failure of remote operation of DH-V-5A or DH-V-5B 3.The fire blocks access to locally operate DH-V-5A or DH-V-5B for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

A quantitative risk assessment was performed to determine the increase in Core Damage Frequency (CDF) due to the condition of DH-V-6A & DH-V-6B.

Fire scenarios of concern in this area are all self initiated cable fires since the fixed ignition sources in this area are located well away from cable targets. The probability that a fire would occur in AB-FZ-5 and cause a spurious opening of DH-V-6A and disable remote operation of DH-V-5A (or a similar pair of events with DH-V-6B and DH- V-5B) was determined to 3.49E-06.

The probability of core damage was conservatively estimated at 3.49E-07. This is a bounding estimate of the probability of the additional failures that would have to occur to lead to core damage.

This bounding estimate of the probability for core damage is well below the threshold of a significant effect on overall CDF.

2. DH-V-6A and DH-V-6B were modified to correct the design error. The modification was completed and placed in service on June 2, 2006. The roving fire watch was terminated at this time.

Long Term Corrective Actions:

No additional corrective action is needed, as the current Fundamentals Tool Kit procedure (HU-AA-1081) emphasizes personal accountability, which addresses the root cause of this issue. Also, current procedures for Design Input and Configuration Change Impact Screening (CC-AA-102), Configuration Change Control (CC-AA­ 103), and Technical Risk/Rigor Assessment (HU-AA-1212) provide guidance for both initial scope definition and changes in scope, including the required reviews. These process controls did not exist at the time this error was made, and would have prevented this event.

PREVIOUS OCCURENCES

TMI-1 LER 2005-002 reported the discovery of a condition whereby a fire in Control Building Fire Area 1 (CB-FA­ 1) could cause loss of indication and control needed to maintain the plant in a safe shutdown condition. The DC Cable to Inverters 1B and 1D are not protected from damage due to fire. The AC source to the Inverters could be lost by trip of 1B Engineered Safeguards (ES) Motor Control Center (MCC) due to Multiple High Impedance Faults (MHIF) on unprotected cables fed from 1B ES MCC. TMI-1 made the decision not to protect the DC cables to Inverters B and D in 1988 and chose to use procedures to address the event. Unlike this condition, this was not the result of a modification process error, but was an inadequate analysis of the consequences of the MHIF event for a fire in CB-FA-1.

• * Energy Industry Identification System (EIIS), System Identification (SI) and Component Function Identification (CFI) Codes are included in brackets, [SI/CFI] where applicable, as required by 10 CFR 50.73 (b)(2)(ii)(F).