05000251/LER-2014-003

LER-2014-003, Emergency Containment Cooler Safety Function Impacted During Breaker Replacement

Turkey Point Unit 4
Event date:	9-3-2014
Report date:	11-10-2014
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident
Initial Reporting
ENS 50440	10 CFR 50.72(b)(3)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident
2512014003R00 - NRC Website

DESCRIPTION OF THE EVENT

On September 3, 2014 at approximately 0529 hours0.00612 days <br />0.147 hours <br />8.746693e-4 weeks <br />2.012845e-4 months <br />, with Turkey Point Unit 4 in Mode 1 at 100% rated thermal power, the 4C Emergency Containment Cooler (ECC) fan [BK, FAN] was removed from service for a breaker cubicle [BK, FAN, BKR] replacement. At approximately 0658 hours0.00762 days <br />0.183 hours <br />0.00109 weeks <br />2.50369e-4 months <br /> on September 4, 2014, the 4C ECC fan was returned to service following the post maintenance test (PMT) of the breaker replacement within the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> allowed outage time (AOT) of Action 'a' of Technical Specification (TS) 3.6.2.2 for one inoperable ECC.

On September 9, 2014, a post-implementation review of the breaker cubicle replacement work order (WO) package by Engineering personnel discovered that the cable conductors associated with the auto- start capability of the 4A ECC fan, following a failure of the 4C ECC fan to start or continue to run, were disconnected and not re-terminated during the breaker cubicle work. This resulted in the 4A ECC fan not being capable of performing its auto-start function with a Train B Safety Injection (SI) signal present and the 4A ECC was declared inoperable at approximately 1936 hours0.0224 days <br />0.538 hours <br />0.0032 weeks <br />7.36648e-4 months <br /> on September 9, 2014. The wires associated with the auto-start function were terminated, and after PMT the 4A ECC was declared operable and returned to service at approximately 1700 hours0.0197 days <br />0.472 hours <br />0.00281 weeks <br />6.4685e-4 months <br /> on September 11, 2014 within the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> AOT from the time of discovery.

Further review of the breaker cubicle replacement activity identified that both the 4C and 4A ECC fans were inoperable concurrently resulting in a condition that could have prevented the fulfillment of the safety function because only one ECC (two are assumed to operate in the safety analysis) would have operated if the 4C ECC fan failed to start or continue to run. Event Notification 50440 was made on September 10, 2014 in accordance with 10 CFR 50.72(b)(3)(v)(D).

The 4A ECC was inoperable for a period of approximately 203.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> which exceeded the AOT of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The 4A and 4C ECCs were inoperable concurrently for a period of approximately 25.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> which exceeded the one hour AOT of TS 3.6.2.2, Action 'W. Because these periods of inoperability were not recognized at the time, the actions required by the TS were not taken, which is reportable in accordance with 10 CFR 50.73(a)(2)(i)(B) as a condition prohibited by the TS. The condition that could have prevented the fulfillment of the safety function for the approximate 25.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> period is also reportable in accordance with 10 CFR 50.73(a)(2)(v)(D).

CAUSE OF THE EVENT

Two conditions were evaluated for causes:

1. An error in the design resulting in the loss of the Train B auto-start function of the 4A ECC fan for approximately 203.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

2. The work planning deficiency resulting in two ECC fans being inoperable for approximately 25.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (1-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Infocollects.Resource10 CFR nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-1 0202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

6. LER NUMER

Condition 1 The root cause is inadequate design integration of the auto-start design provided for the breaker cubicle due to ineffective design verification. No contributing causes were identified.

Condition 2 Direct Cause: The WO did not have the correct plant Mode stipulations for replacement of the 4C ECC fan breaker cubicle in accordance with the design package.

Root Cause: Responsible Engineer duties for the breaker cubicle replacement project were not reassigned when the original design organization was no longer onsite. As a result, plant personnel did not have the detailed circuit design knowledge needed to guide proper implementation of the 4C ECC breaker cubicle replacement.

Contributing Causes (CC):

CC 1: Lack of understanding of the scope of work and impact on plant design.

CC 2: WO planning procedure does not ensure WOs are put on hold when design documents require revision. The WO was not prepared in accordance with the design package requirements.

CC 3: The design package was not revised to update plant restrictions when the implementation schedule changed.

ANALYSIS OF THE EVENT

Each Turkey Point unit contains three ECCs which must be operable for post loss of coolant accident (LOCA) containment heat removal to prevent containment pressure from exceeding the 55 psig design pressure assuming the occurrence of a single active failure. Two of the ECCs must be capable of automatically starting on a SI signal.

The auto-start capability of the 4A ECC fan was provided as part of the original plant design. The original design configuration had the 4A ECC fan starting on the failure to start or continue to run of either the 413 or 4C ECC fan. This so-called swing feature was disabled in 1995 as part of the previous thermal power uprate project because only one ECC was credited with operating initially for containment heat removal. The containment response analysis for the recent thermal power uprate takes credit for the operation of two ECCs starting within one minute of the initiation of the event. Therefore, the swing feature was restored. The modification to restore the swing function was implemented on December 6, 2012.

The replacement of the 4C ECC breaker cubicle on September 3, 2014 is part of a separate project to replace obsolete breakers. The breaker cubicle replacement project was begun prior to the restoration of the ECC swing function. The design drawings specified that the cables associated with the 4A ECC fan Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by Ar ; LICENSEE EVENT REPORT (LER) intemet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information CONTINUATION SHEET and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503 If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection auto-start function would not be terminated, consistent with the design function at the time. The project recognized that changes resulting from the recent thermal power uprate project would impact the design package for some of the planned replacements and provision was made to perform a design integration prior to installation. Personnel performing the design integration failed to ensure that the design drawings were revised to ensure that the cables associated with the 4A ECC fan auto-start function were terminated when the new breaker cubicle was installed.

The design package also specified that the breaker cubicle replacement occur during an outage. During the work planning process, it was decided to perform the cubicle replacement online; however, the design package was not revised to specify the plant restrictions for online work. The lack of understanding of the detailed design resulted in the work planning process failure to properly determine the impact of the work on ECC operability.

ANALYSIS OF SAFETY SIGNIFICANCE

An assessment of the safety significance was performed for the combined impact of the conditions described in the Cause of the Event section above. It concludes that the ECC system would still be capable of operating for post-LOCA containment heat removal to prevent containment pressure from exceeding the 55 psig design pressure, even if the automatic start feature for the third ECC was not available. Analytical margin is available to support manual operation of the third ECC provided that one of the two ECCs designed to start with SI actuation signals operate as required in accordance with their specified safety function.

The 4C ECC was verified to automatically start on a SI actuation signal as part of post modification testing following replacement of its MCC breaker cubicle. The 4B ECC breaker cubicle had not been modified yet and it was confirmed that the 4B ECC would automatically start in response to a SI signal during performance of the Integrated Engineered Safeguards Test during the previous refueling outage.

In establishing the ECC fan circuit design for power uprate operation, sensitivity analyses were performed to determine acceptable starting times for the third swing ECC assuming that one of the primary ECCs failed to start on the SI actuation condition due to the occurrence of a single active failure (e.g., diesel failure). The results of three of these analyses are provided below:

• Cont ,,;, hiitial..cont:........hittial-'qantr- OA, eat Swing (_.(2 Peak Con) Case No.

• .,

• - .

• ,,. '; Press. (psig)

• ,..‘..

• ..,

• ..—'

• _L.,:  :.

.

• TettipMF) :,

• ,:

• .

• .

• . ..

• Mode

• . .... ,.

, , rilume 1 'tail Time Pros, ' sig , ..

2 1.4 130 Uprate 1.45 24 hrs. 56.3 4 1.4 130 Uprate 1.45 5 min. 54.5 4a 1.4 130 Uprate 1.45 1 min. 53.7 Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

6. LER NUMER

These results indicate that the timing for operation of a second ECC is not overly sensitive to the post- accident peak pressure. As shown, the peak pressure increases by 2.6 psig if the start time of the second ECC is delayed from 60 seconds to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Even with a start time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the peak pressure only exceeds the containment design pressure by 1.3 psig. The sensitivity analyses assumed that the initial containment pressure was at the TS maximum value with an additional margin for instrument uncertainty.

The Unit 4 containment internal pressure is nominally 0.2 psig which effectively reduces the peak pressure value for Case 2 by 0.8 psig to 55.5 psig. The containment volume was also assumed to be at the conservative minimum value of 1.45 x 106 fe. A larger containment volume would act to reduce the peak containment pressure. The minimum calculated volume is 1.45 x 106 ft3. The maximum calculated volume is 1.54 x 106 ft3. It is reasonable to conclude that the actual volume lies somewhere between these values such that the actual volume is approximately 45,000 ft3 greater than that used in the sensitivity analysis which would further reduce the peak containment pressure for Case 2 to less than 55.5 psig.

Analytical margin is also available in the methodology used to calculate the LOCA mass and energy (M&E) release values. The post-blowdown LOCA M&E releases, when calculated with a more mechanistic LOCA analysis code are significantly lower. As a result, the calculated post-blowdown containment pressure for a large dry containment design such as that used at Turkey Point would be significantly reduced if the more accurate LOCA M&E releases were used. Conservatisms inherent in the current safety analysis methodology include modeling aspects and initial conditions assumptions that result in a peak calculated containment pressure that is a minimum of 6 psi higher than what would be calculated if more realistic input values were used. This 6 psi margin is available to offset any increase in containment pressure that would occur due to delayed starting of the swing ECC.

The action to manually start the 4A ECC if the 4C ECC were unavailable would be directed by emergency operating procedure 4-EOP-E-0. This action would be accomplished in approximately 11 minutes. Although this is close to the timing of the occurrence of the peak containment pressure in the current LOCA containment integrity analysis (11.34 minutes), it is unlikely that operation of the swing cooler at 11 minutes would be able to produce similar results to that currently presented in the UFSAR.

However, manually starting the swing cooler at approximately 11 minutes would result in a peak containment pressure that is below 55.5 psig. When the containment volume margin and the 6 psi LOCA M&E margin is considered with the results of Case 2 of the sensitivity analysis, it is evident that the actual peak containment pressure would be less than or equal to the current UFSAR value of 53.85 psi even if the 4A ECC is manually started via the EOPs.

Analysis has confirmed that peak containment pressure for Case 2 would be 56.35 psig, and that the entire 6 psi LOCA M&E analytical margin is available to offset the slight increase in containment pressure that would stem from manual operation of the 4A ECC in accordance with procedure 4-EOP-E-0.

The post-LOCA containment is generally at saturation conditions when the peak containment pressure occurs. The calculated increase in peak containment pressure associated with manual operation of the swing ECC will result in a slightly higher peak containment temperature. The peak containment temperature will increase 3.2°F from 281.8°F to 285°F which exceeds the containment design temperature of 283°F. Since the containment is generally at saturation conditions, the 6 psi LOCA M&E analytical Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150.0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

6. LER NUMER

margin also translates to temperature margin such that the actual peak containment temperature would be less than or equal to the current UFSAR value of 281.8°F even if the 4A ECC is manually started via the EOPs. Additionally, the containment integrity analyses assume that the initial containment temperature is 5°F greater than that allowed by TS which provides more analytical margin.

The peak containment pressure (and temperature) will occur at the same relative time following event initiation as that currently presented in the UFSAR for automatic actuation of the 4A ECC. Consequently, the LOCA containment temperature profile will be similar to the design basis. It is anticipated that manually starting the swing ECC in accordance with the existing EOPs will result in a longer time to reach the terminal temperature of 120°F used in the Equipment Qualification (EQ) program. The EQ profile completely envelopes the post-LOCA containment temperature with margin to allow continued equipment qualification in the event that plant conditions cause the temperature profile to change. The peak EQ temperature value is 315°F which bounds the actual peak containment temperature that will occur with manual operation of the 4A ECC in accordance with the EOPs. Since the EQ peak qualification temperature bounds the peak post-accident temperature, the Arrhenius calculation methodology can be used to credit available margin between the accident profile and the EQ profile to offset any long term temperature increases such that the EQ requirements for the safety related equipment inside containment continue to be met.

CORRECTIVE ACTIONS

Corrective action is in accordance with condition report AR 1990010 and includes:

1. The auto-start design function for the 4A ECC fan on the failure of the 4C ECC fan to start or continue to run was restored.

2. The procedure for performing design verification was revised to specify that engineers performing design verification activities must be qualified.

3. Ensure all remaining ECC breaker cubicle replacements will be performed during an outage.

4. Responsible Engineers (RE) will be assigned to all Approved and Active major modifications such that each RE understands the design details sufficient to provide continued implementation support.

5. Revise the Work Order planning procedure to ensure WOs do not alter/change design requirements and plant restrictions for implementation without an approved design revision.

ADDITIONAL INFORMATION

component function identifier (if appropriate)].

FAILED COMPONENTS IDENTIFIED: None PREVIOUS SIMILAR EVENTS: None